Add NTLMv1 flag on GPO

SpecterOps · Feb 3, 2024 · 2bd4658 · 2bd4658
1 parent aba4872
commit 2bd4658
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
@@ -32,6 +32,7 @@ public class ObjectProcessors
         private readonly GroupProcessor _groupProcessor;
         private readonly LDAPPropertyProcessor _ldapPropertyProcessor;
         private readonly GPOLocalGroupProcessor _gpoLocalGroupProcessor;
+        private readonly GPOLmCompatibilityLevelProcessor _gpoLmCompatibilityLevelProcessor;
         private readonly UserRightsAssignmentProcessor _userRightsAssignmentProcessor;
         private readonly LocalGroupProcessor _localGroupProcessor;
         private readonly ILogger _log;
@@ -52,6 +53,7 @@ public ObjectProcessors(IContext context, ILogger log)
             _groupProcessor = new GroupProcessor(context.LDAPUtils);
             _containerProcessor = new ContainerProcessor(context.LDAPUtils);
             _gpoLocalGroupProcessor = new GPOLocalGroupProcessor(context.LDAPUtils);
+            _gpoLmCompatibilityLevelProcessor = new GPOLmCompatibilityLevelProcessor(context.LDAPUtils);
             _userRightsAssignmentProcessor = new UserRightsAssignmentProcessor(context.LDAPUtils);
             _localGroupProcessor = new LocalGroupProcessor(context.LDAPUtils);
             _methods = context.ResolvedCollectionMethods;
@@ -71,7 +73,7 @@ internal async Task<OutputBase> ProcessObject(ISearchResultEntry entry,
                 case Label.Group:
                     return ProcessGroupObject(entry, resolvedSearchResult);
                 case Label.GPO:
-                    return ProcessGPOObject(entry, resolvedSearchResult);
+                    return await ProcessGPOObject(entry, resolvedSearchResult);
                 case Label.Domain:
                     return await ProcessDomainObject(entry, resolvedSearchResult);
                 case Label.OU:
@@ -407,7 +409,7 @@ private async Task<Domain> ProcessDomainObject(ISearchResultEntry entry,
             return ret;
         }
 
-        private GPO ProcessGPOObject(ISearchResultEntry entry,
+        private async Task<GPO> ProcessGPOObject(ISearchResultEntry entry,
             ResolvedSearchResult resolvedSearchResult)
         {
             var ret = new GPO
@@ -436,6 +438,8 @@ private GPO ProcessGPOObject(ISearchResultEntry entry,
                         ret.Properties);
                 }
             }
+            ret.NTLMv1Enabled = await _gpoLmCompatibilityLevelProcessor.ReadGPOLmCompatibilityLevel(entry);
+            ret.Properties.Add("ntlmv1", ret.NTLMv1Enabled);
 
             return ret;
         }