Remove check for sAMAccountName, there should always be one

Author: NeffIsBack

nxc/protocols/ldap.py

@@ -1091,7 +1091,7 @@ def find_delegation(self):
         UF_TRUSTED_FOR_DELEGATION = 0x80000
         UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0x1000000
         UF_ACCOUNTDISABLE = 0x2
-        """SERVER_TRUST_ACCOUNT = 0x2000"""
+        SERVER_TRUST_ACCOUNT = 0x2000
 
         def printTable(items, header):
             colLen = []
@@ -1124,7 +1124,7 @@ def printTable(items, header):
                          f"(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_FOR_DELEGATION})"
                          "(msDS-AllowedToDelegateTo=*)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))"
                          f"(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE})))")
-        # f"(!(UserAccountControl:1.2.840.113556.1.4.803:={SERVER_TRUST_ACCOUNT})))")  To listing  RBCD to DCs
+        # f"(!(UserAccountControl:1.2.840.113556.1.4.803:={SERVER_TRUST_ACCOUNT})))")  This would filter out RBCD to DCs
 
         attributes = ["sAMAccountName", "pwdLastSet", "userAccountControl", "objectCategory",
                       "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-AllowedToDelegateTo"]
@@ -1143,56 +1143,54 @@ def printTable(items, header):
             protocolTransition = 0
 
             try:
-                sAMAccountName = item.get("sAMAccountName")
-                if sAMAccountName:
-
-                    userAccountControl = int(item.get("userAccountControl", 0))
-                    objectType = item.get("objectCategory")
-
-                    if userAccountControl & UF_TRUSTED_FOR_DELEGATION:
-                        delegation = "Unconstrained"
-                        rightsTo.append("N/A")
-                    elif userAccountControl & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION:
-                        delegation = "Constrained w/ Protocol Transition"
-                        protocolTransition = 1
-
-                    if item.get("msDS-AllowedToDelegateTo") is not None:
-                        if protocolTransition == 0:
-                            delegation = "Constrained"
-                        rightsTo = item.get("msDS-AllowedToDelegateTo")
-
-                    # Not an elif as an object could both have RBCD and another type of delegation
-                    if item.get("msDS-AllowedToActOnBehalfOfOtherIdentity") is not None:
-                        databyte = item.get("msDS-AllowedToActOnBehalfOfOtherIdentity")
-                        rbcdRights = []
-                        rbcdObjType = []
-                        sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=bytes(databyte))
-                        if len(sd["Dacl"].aces) > 0:
-                            search_filter = "(&(|"
-                            for ace in sd["Dacl"].aces:
-                                search_filter += "(objectSid=" + ace["Ace"]["Sid"].formatCanonical() + ")"
-                            search_filter += ")(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"
-                            delegUserResp = self.search(search_filter, attributes=["sAMAccountName", "objectCategory"], sizeLimit=999)
-                            delegUserResp_parse = parse_result_attributes(delegUserResp)
-
-                            for rbcd in delegUserResp_parse:
-                                rbcdRights.append(str(rbcd.get("sAMAccountName")))
-                                rbcdObjType.append(str(rbcd.get("objectCategory")))
-
-                            
-                            if int(userAccountControl) & UF_ACCOUNTDISABLE:
-                                self.logger.debug(f"Bypassing disabled account {sAMAccountName}")
-                            else:
-                                for rights, objType in zip(rbcdRights, rbcdObjType):
-                                    answers.append([rights, objType, "Resource-Based Constrained", sAMAccountName])
-
-                    if delegation in ["Unconstrained", "Constrained", "Constrained w/ Protocol Transition"]:
+                sAMAccountName = item["sAMAccountName"]
+
+                userAccountControl = int(item["userAccountControl"])
+                objectType = item.get("objectCategory")
+
+                if userAccountControl & UF_TRUSTED_FOR_DELEGATION:
+                    delegation = "Unconstrained"
+                    rightsTo.append("N/A")
+                elif userAccountControl & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION:
+                    delegation = "Constrained w/ Protocol Transition"
+                    protocolTransition = 1
+
+                if item.get("msDS-AllowedToDelegateTo") is not None:
+                    if protocolTransition == 0:
+                        delegation = "Constrained"
+                    rightsTo = item.get("msDS-AllowedToDelegateTo")
+
+                # Not an elif as an object could both have RBCD and another type of delegation
+                if item.get("msDS-AllowedToActOnBehalfOfOtherIdentity") is not None:
+                    databyte = item.get("msDS-AllowedToActOnBehalfOfOtherIdentity")
+                    rbcdRights = []
+                    rbcdObjType = []
+                    sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=bytes(databyte))
+                    if len(sd["Dacl"].aces) > 0:
+                        search_filter = "(&(|"
+                        for ace in sd["Dacl"].aces:
+                            search_filter += "(objectSid=" + ace["Ace"]["Sid"].formatCanonical() + ")"
+                        search_filter += ")(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"
+                        delegUserResp = self.search(search_filter, attributes=["sAMAccountName", "objectCategory"], sizeLimit=999)
+                        delegUserResp_parse = parse_result_attributes(delegUserResp)
+
+                        for rbcd in delegUserResp_parse:
+                            rbcdRights.append(str(rbcd.get("sAMAccountName")))
+                            rbcdObjType.append(str(rbcd.get("objectCategory")))
+
                         if int(userAccountControl) & UF_ACCOUNTDISABLE:
                             self.logger.debug(f"Bypassing disabled account {sAMAccountName}")
                         else:
-                            # Check if the entry is invalid, i.e., for "Unconstrained N/A"
-                            if not (delegation == "Unconstrained" and rightsTo == ["N/A"]):
-                                answers.append([sAMAccountName, objectType, delegation, rightsTo])
+                            for rights, objType in zip(rbcdRights, rbcdObjType):
+                                answers.append([rights, objType, "Resource-Based Constrained", sAMAccountName])
+
+                if delegation in ["Unconstrained", "Constrained", "Constrained w/ Protocol Transition"]:
+                    if int(userAccountControl) & UF_ACCOUNTDISABLE:
+                        self.logger.debug(f"Bypassing disabled account {sAMAccountName}")
+                    else:
+                        # Check if the entry is invalid, i.e., for "Unconstrained N/A"
+                        if not (delegation == "Unconstrained" and rightsTo == ["N/A"]):
+                            answers.append([sAMAccountName, objectType, delegation, rightsTo])
 
             except Exception as e:
                 self.logger.error(f"Skipping item, cannot process due to error {e}")