Skip to content

Commit

Permalink
chore: add ingest integration tests for adcs information (#256)
Browse files Browse the repository at this point in the history 
* c/p ADCS stuff from monorepo

* Adcs poc updates (#133)

* added authentication for feature flag endpoint (#131)

* chore: update incoming model structs and rename enrollmentservice to enterpriseca

* chore: rename enrollmentservice-entity.json to enterpriseca-entity.json

---------

Co-authored-by: Irshad Ajmal Ahmed <[email protected]>

* chore: handle isaclprotected and isdelted in ConvertObjectToNode, update enterpriseca ingestion, add properties to ad schema (#135)

* chore: handle isaclprotected and isdelted in ConvertObjectToNode, update enterpriseca ingestion, add properties to ad schema

* chore: update ad cue schema

* feat: create ntauthstorefor edges during ingest

* chore: cleanup commented code

* chore: remove some property setting from the API and handle instead in SharpHound

* chore: update string equality checks to use defined constants

* chore: define constant for AccessAllowedCallback

* fix: typos, move isaclprotected property setting to collector

* chore: Ingest DCRegistryData  (#140)

* Ingest DCRegistryData for Computers

* Update cue files for DCRegistryData properties

* feat: add IssuedSignedBy post processing (#144)

* feat: add IssuedSignedBy post processing

* fix: actually do the real post

* chore: rename function for clarity

* chore: dry and remove parallelism to a degree

* chore: properly account for error

* chore: make edges to rootca and enterpriseca for IssuedSignedBy

* chore: genericize findMatchingCertChainIDs

* chore: use helper

* chore: add index for CertThumbprint

* feat: ntauthstorefor (#146)

---------

Co-authored-by: Ulises Rangel <[email protected]>

* feat: Add post-processing logic for EnterpriseCAFor edges (#148)

* chore: wire up post processing for currently existing adcs handlers (#150)

* EnrollOnBehalfOf Post Processing (#151)

* feat: initial EnrollOnBehalfOf post processing

* chore: rerun schemagen

* fix: actually use param

* chore: pass in operation to PostEnrollOnBehalfOf

* chore: remove duplicated post edge
chore: replace %v with %w
chore: add a log in an else
fix: change eku name

* Update icons for ADCS nodes (#155)

* Update EnterpriseCA icon (#155)

* Store raw CertificateMappingMethods integer value (#154)

* feat: add edge information components for some of the new adcs edges (#152)

* feat: add edge information components for some of the new adcs edges

* chore: implement feedback

* feat: handle dc reg values not existing (#166)

* feat: handle dc reg values not existing

* Address code revie comments

* Bed 3789 - ADCSESC1 (#165)

* chore: initial WIP commit

* wip: split property resolution from validation logic

* feat: initial ESC1 POC

* chore: change some ordering, fix up some esc1 issues

* chore: fix var type

* chore: fix a couple more things

* feat: first draft cross product matcher

* feat: create generic cross product shortcutter and polish it a bit

* fix: regen schema

* chore: uncomment harness case

* chore: remove commented code
fix: remove owns rel

* test: add a test for ESC1

* test: add another test

* test: add another test

* test: add last harness

* test: add harness svg/jsons for ESC1

* chore: fix weird ordering

* chore: fix var name, remove domainsid from harness as its unnecessary

---------

Co-authored-by: Ulises Rangel <[email protected]>

* feat: add golden cert post processing to adcs (#180)

* wip: golden cert post processing

* chore: add integration test and harness for golden cert post processing

* chore: Add migration for new data quality attributes for ADCS nodes (#187)

* EnrollOnBehalfOf Post Processing (#176)

* tests: add tests for EnrollOnBehalfOf

* tests: add harness diagrams

* chore: fix harness rep
chore: remove bad allocation

* fix: check result of channel submit

* Fix print version of CertTemplate attributes (#189)

* fix: TrustedForNTAuth bug (#199)

* fix: add missing ADCS edges to path filter (#186)

* feat: Contains edges from DN for ADSC objects (#203)

* remove ADCSESC2 (#193)

* BED-3869: ADCS edges help text (#185)

* feat: HostsCAService edge helptext

* feat: DelegatedEnrollmentAgent edge helptext

* feat: EnrollOnBehalfOf edge helptext

* chore: update EnrollOnBehalfOf help text

* chore: update EnrollOnBehalfOf help text

* fixed the display version of the new node type names

* chore: Add GoldenCert help text

* chore: fix help text grammar mistakes

* fix: order of ADCS post-processing (#208)

* chore: run just schemagen

* fix: EnterpriseCA reg data ingest

* feat: add EnterpriseCA properties (#213)

* chore: move post local groups to bhce packages for use in BHE, run license generation for headers (#209)

* Create ADCS feature flag and wrap associated code (#216)

* feat: Add adcs flag to default flags

* feat: Add new middleware for preventing access to feature flagged routes
and put ADCS related routes behind it

* chore: wrap ADCS ingest and post-processing by feature flag

* feat: create help text components for esc3 (#212)

* feat: create help text components for esc3

* chore: change edge name to adcsesc3 and format code

* ADCS Edge Composition Visibility (#224)

* wip: wip commit

* feat: esc1 edge detail cypher

* chore: use helpers to clean up code

* chore: fix merge

* fix: use CAs from first query into second query

* wip: Trying to hook up ADCSESC1 details query to API

* chore: a bit of refactoring

* chore: add endpoint and fix handler

* feat: add esc1 edge info content

* chore: improve esc1 abuse info

* chore: formatting changes

* wip: wip edge details

* chore: improve esc1 edge info

* wip: display a list of nodes when expanding the detail section of an adcsesc1 edge panel

* wip: display a list of nodes when expanding the detail section of an adcsesc1 edge panel

* feat: better icon colors for ADCS nodes

* feat: update getEdgeDetails endpoint with optional options parameter

* wip: display a list of nodes when expanding the detail section of an adcsesc1 edge panel

* wip: esc1 edge detail fix

* wip: actually fix esc 1

* feat: ensure non-transit edges are not included in pathfinding

* chore:  fix typo

* handle case when details endpoint returns empty result set

* feat: GoldenCert details (#223)

* factor out VirtualizedNodeList component

* replace faBuilding icon with faGlobe icon in DataSelector.tsx

* removing HostsCAService from pathfinding

* missing license

* formatting changes

* rename edge details to edge composition

* rename edge details to graphs/edge-composition. no more bike shedding!

* chore: addressing PR feedback and minor cleanups

---------

Co-authored-by: rvazarkar <[email protected]>
Co-authored-by: James Barnett <[email protected]>
Co-authored-by: jknudsen <[email protected]>
Co-authored-by: Jonas Bülow Knudsen <[email protected]>

* feat: helptexts for ManageCA, ManageCertificates, WritePKIEnrollmentFlag, and WritePKINameFlag (#227)

* fix: mising enterprise CA edges (#226)

* chore: add collection method properties to schedule job req type (#228)

* fix: Remove early return from ADCS post-processing (#234)

* chore: partition collection methods to split out ldap source in its own option (#215)

* chore: split stats components into shared ui (#242)

* chore: split stats components into shared ui

* fix: unit test imports

* chore: move entity content file to shared ui and update icon colors in bh graph go file (#246)

* chore: move entity content file to shared ui and update icon colors in bh graph go file

* fix: lint errors and circular deps

* docs: consitency for 'ESC1'

* Move edgeTypes to shared UI (#247)

* chore: Move edgeTypes to bh-shared-ui

* chore: remove option for HostsCaFor from edge filtering

* chore: remove circular dependency

* fix: fix styling for low number of edge filters in a subcategory

---------

Co-authored-by: Eli K Miller <[email protected]>
Co-authored-by: Ben Waples <[email protected]>
Co-authored-by: Stephen Hinck <[email protected]>
Co-authored-by: Wesley Maffly-Kipp <[email protected]>

* fix: address PR feedback for typo and edge info collapsible section

* chore: clean up types related to ScheduledJobRequests

* fix: don't include local groups in enterprise ca security data (#250)

Closes: https://specterops.atlassian.net/browse/BED-3937

* wip

* chore: add ingest integration tests for adcs information

* chore: update and compile sharphound, recollect, update assertions

* chore: clean up left over conflicts

---------

Co-authored-by: jknudsen <[email protected]>
Co-authored-by: James Barnett <[email protected]>
Co-authored-by: Irshad Ajmal Ahmed <[email protected]>
Co-authored-by: Rohan Vazarkar <[email protected]>
Co-authored-by: rvazarkar <[email protected]>
Co-authored-by: Jonas Bülow Knudsen <[email protected]>
Co-authored-by: Dillon Lees <[email protected]>
Co-authored-by: Eli K Miller <[email protected]>
Co-authored-by: Ben Waples <[email protected]>
Co-authored-by: Stephen Hinck <[email protected]>
Co-authored-by: Wesley Maffly-Kipp <[email protected]>
  • Loading branch information
@urangel @JonasBK
@juggernot325 @irshadaj @rvazarkar @ddlees @elikmiller @benwaples @StephenHinck @maffkipp
12 people authored Dec 15, 2023
1 parent ec60c6e commit db38103
Show file tree
Hide file tree
Showing 21 changed files with 22,004 additions and 9 deletions.
28 changes: 28 additions & 0 deletions cmd/api/src/api/v2/file_uploads_integration_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,34 @@ func Test_FileUploadWorkFlowVersion6(t *testing.T) {
testCtx.AssertIngest(fixtures.IngestAssertions)
}

func Test_FileUploadVersion6AllOptionADCS(t *testing.T) {
testCtx := integration.NewContext(t, integration.StartBHServer)

if adcsFlag, err := testCtx.DB.GetFlagByKey("adcs"); err != nil {
t.Fatalf("unable to get adcs flag: %v", err)
} else {
adcsFlag.Enabled = true
testCtx.DB.SetFlag(adcsFlag)
}

testCtx.SendFileIngest([]string{
"v6/all/aiacas.json",
"v6/all/certtemplates.json",
"v6/all/computers.json",
"v6/all/containers.json",
"v6/all/domains.json",
"v6/all/enterprisecas.json",
"v6/all/gpos.json",
"v6/all/groups.json",
"v6/all/ntauthstores.json",
"v6/all/ous.json",
"v6/all/rootcas.json",
"v6/all/users.json",
})

testCtx.AssertIngest(fixtures.IngestADCSAssertions)
}

func Test_CompressedFileUploadWorkFlowVersion5(t *testing.T) {
testCtx := integration.NewContext(t, integration.StartBHServer)

Expand Down
9 changes: 5 additions & 4 deletions cmd/api/src/test/fixtures/fixture.go
View file
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
// Copyright 2023 Specter Ops, Inc.
//
//
// Licensed under the Apache License, Version 2.0
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//
// http://www.apache.org/licenses/LICENSE-2.0
//
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
//
// SPDX-License-Identifier: Apache-2.0

package fixtures
Expand Down Expand Up @@ -64,6 +64,7 @@ func (s loader) Get(path string) []byte {
s.errorHandler(path, err)
return nil
} else {
content = bytes.TrimPrefix(content, []byte("\xef\xbb\xbf"))
return content
}
}
Expand Down
5 changes: 3 additions & 2 deletions cmd/api/src/test/fixtures/fixtures/expected_ingest.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ package fixtures

import (
"bytes"

"github.com/specterops/bloodhound/cypher/frontend"
"github.com/specterops/bloodhound/cypher/model"
"github.com/specterops/bloodhound/dawgs/graph"
Expand Down Expand Up @@ -246,7 +247,7 @@ var (
}
)

func formatQueryComponent(criteria graph.Criteria) string {
func FormatQueryComponent(criteria graph.Criteria) string {
var (
emitter = frontend.NewCypherEmitter(false)
stringBuffer = &bytes.Buffer{}
Expand All @@ -262,6 +263,6 @@ func formatQueryComponent(criteria graph.Criteria) string {
func IngestAssertions(testCtrl test.Controller, tx graph.Transaction) {
for _, assertionCriteria := range ingestRelationshipAssertionCriteria {
_, err := tx.Relationships().Filter(assertionCriteria).First()
require.Nilf(testCtrl, err, "Unable to find an expected relationship: %s", formatQueryComponent(assertionCriteria))
require.Nilf(testCtrl, err, "Unable to find an expected relationship: %s", FormatQueryComponent(assertionCriteria))
}
}
554 changes: 554 additions & 0 deletions cmd/api/src/test/fixtures/fixtures/expected_ingest_adcs.go
View file

Large diffs are not rendered by default.

79 changes: 79 additions & 0 deletions cmd/api/src/test/fixtures/fixtures/v6/all/aiacas.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
{
"data": [
{
"Properties": {
"domain": "ESC1.LOCAL",
"name": "[email protected]",
"distinguishedname": "CN=ESC1-ESC1-DC-CA,CN=AIA,CN=PUBLIC KEY SERVICES,CN=SERVICES,CN=CONFIGURATION,DC=ESC1,DC=LOCAL",
"domainsid": "S-1-5-21-909015691-3030120388-2582151266",
"description": null,
"whencreated": 1664426237,
"crosscertificatepair": [],
"hascrosscertificatepair": false,
"certthumbprint": "5F0143662A7EA16E8DB90E44D0F1F1FC87B1E703",
"certname": "5F0143662A7EA16E8DB90E44D0F1F1FC87B1E703",
"certchain": ["5F0143662A7EA16E8DB90E44D0F1F1FC87B1E703"],
"hasbasicconstraints": false,
"basicconstraintpathlength": 0
},
"Aces": [
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-519",
"PrincipalType": "Group",
"RightName": "Owns",
"IsInherited": false
},
{
"PrincipalSID": "ESC1.LOCAL-S-1-5-32-544",
"PrincipalType": "Group",
"RightName": "GenericAll",
"IsInherited": false
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-512",
"PrincipalType": "Group",
"RightName": "GenericAll",
"IsInherited": false
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-519",
"PrincipalType": "Group",
"RightName": "GenericAll",
"IsInherited": false
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-1000",
"PrincipalType": "Computer",
"RightName": "GenericAll",
"IsInherited": false
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-519",
"PrincipalType": "Group",
"RightName": "GenericAll",
"IsInherited": true
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-512",
"PrincipalType": "Group",
"RightName": "WriteDacl",
"IsInherited": true
},
{
"PrincipalSID": "S-1-5-21-909015691-3030120388-2582151266-512",
"PrincipalType": "Group",
"RightName": "WriteOwner",
"IsInherited": true
}
],
"ObjectIdentifier": "6345151F-D854-4D83-B7D0-D94E10CFBAF2",
"IsDeleted": false,
"IsACLProtected": false,
"ContainedBy": {
"ObjectIdentifier": "D44AC8AF-C24E-489B-B0BB-E832A5E3C91A",
"ObjectType": "Container"
}
}
],
"meta": { "methods": 521215, "type": "aiacas", "count": 1, "version": 6 }
}
Loading

0 comments on commit db38103

Please sign in to comment.