Skip to content
This repository has been archived by the owner on Sep 2, 2022. It is now read-only.

Added the raw UAC flag to the users JSON #43

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

MaxNad
Copy link

@MaxNad MaxNad commented Oct 7, 2021

Added the raw value for the UAC flag in the user's object for extensibility (The field is called "uac" and value si the integer value to keep it more compact in the final JSON dataset).

This has a few benefits:

Allows blue team to identify potentially problematic accounts using the Bloodhound datasets by running queries like:

  • match (u) where apoc.bitwise.op(u.uac, "&", 2097152) = 1 return u.name matches all accounts with DES enabled
  • match (u) where apoc.bitwise.op(u.uac, "&", 128) = 1 return u.name matches all account with passwords stored using reversible encryption

Individual properties could be added for those elements (just like the "Enabled" property that is derived from this flag), but this approach allows for future elements of the UAC flag to be taken into consideration without having to make changes to Sharphound.

It also allows red team to identify accounts using DES (with the query listed above) to avoid potential downgrade detection usecases.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant