Toss out CAs processed without SIDs

SpecterOps · Mar 13, 2024 · 52a674b · 52a674b
1 parent cc52d72
commit 52a674b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/src/Producers/ComputerFileProducer.cs b/src/Producers/ComputerFileProducer.cs
@@ -46,7 +46,7 @@ public override async Task Produce()
                     string sid;
                     if (!computer.StartsWith("S-1-5-21"))
                         //The computer isn't a SID so try to convert it to one
-                        sid = await Context.LDAPUtils.ResolveHostToSid(computer, Context.DomainName);
+                        sid = await Context.LDAPUtils.ResolveHostToSidWithHostnameFallback(computer, Context.DomainName);
                     else
                         //The computer is already a sid, so just store it off
                         sid = computer;

diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
@@ -638,6 +638,13 @@ private async Task<EnterpriseCA> ProcessEnterpriseCA(ISearchResultEntry entry, R
                 {
                     ret.HostingComputer = await _context.LDAPUtils.ResolveHostToSid(dnsHostName, resolvedSearchResult.Domain);
 
+                    // If we don't resolve a SID to this CA, throw it out
+                    if (ret.HostingComputer == null)
+                    {
+                        _log.LogWarning("Unable to resolve Enterprise CA host to SID.", dnsHostName, resolvedSearchResult.Domain);
+                        return null;
+                    }
+
                     CARegistryData cARegistryData = new()
                     {
                         IsUserSpecifiesSanEnabled = _certAbuseProcessor.IsUserSpecifiesSanEnabled(dnsHostName, caName),