Skip to content
This repository was archived by the owner on Sep 2, 2022. It is now read-only.

Conversation

@MaxNad
Copy link

@MaxNad MaxNad commented Oct 7, 2021

Added the raw value for the UAC flag in the user's object for extensibility (The field is called "uac" and value si the integer value to keep it more compact in the final JSON dataset).

This has a few benefits:

Allows blue team to identify potentially problematic accounts using the Bloodhound datasets by running queries like:

  • match (u) where apoc.bitwise.op(u.uac, "&", 2097152) = 1 return u.name matches all accounts with DES enabled
  • match (u) where apoc.bitwise.op(u.uac, "&", 128) = 1 return u.name matches all account with passwords stored using reversible encryption

Individual properties could be added for those elements (just like the "Enabled" property that is derived from this flag), but this approach allows for future elements of the UAC flag to be taken into consideration without having to make changes to Sharphound.

It also allows red team to identify accounts using DES (with the query listed above) to avoid potential downgrade detection usecases.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant