Skip to content

Commit

Permalink
Removed unnecessary $UnsafeOwners and rights checks.
Browse files Browse the repository at this point in the history
  • Loading branch information
@TrimarcJake
TrimarcJake committed Feb 26, 2024
1 parent 6336642 commit 440835a
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 79 deletions.
54 changes: 10 additions & 44 deletions Invoke-Locksmith.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -259,31 +259,15 @@ function Find-ESC4 {
$SID = ($Principal.Translate([System.Security.Principal.SecurityIdentifier])).Value
}

if ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -match $UnsafeOwners) ) {
if ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
IdentityReference = $entry.IdentityReference
ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$PreferredOwner`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Revert = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$($_.nTSecurityDescriptor.Owner)`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Technique = 'ESC4'
}
$Issue
}
elseif ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
IdentityReference = $entry.IdentityReference
ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = '[TODO]'
Revert = '[TODO]'
Technique = 'ESC4'
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$PreferredOwner`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Revert = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$($_.nTSecurityDescriptor.Owner)`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Technique = 'ESC4'
}
$Issue
}
Expand Down Expand Up @@ -339,37 +323,19 @@ function Find-ESC5 {
else {
$SID = ($Principal.Translate([System.Security.Principal.SecurityIdentifier])).Value
}
if ( ($_.objectClass -ne 'pKICertificateTemplate') -and ($SID -match $UnsafeOwners) ) {

if ( ($_.objectClass -ne 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
# IdentityReference = $entry.IdentityReference
# ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$PreferredOwner`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Revert = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$($_.nTSecurityDescriptor.Owner)`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Technique = 'ESC5'
}
$Issue
}
elseif ( ($_.objectClass -ne 'pKICertificateTemplate') -and
($SID -notmatch $SafeOwners) -and
($entry.ActiveDirectoryRights.ObjectType -notmatch $SafeObjectTypes)
) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
# IdentityReference = $entry.IdentityReference
# ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this object"
Fix = '[TODO]'
Revert = '[TODO]'
Technique = 'ESC5'
}
$Issue
}

foreach ($entry in $_.nTSecurityDescriptor.Access) {
$Principal = New-Object System.Security.Principal.NTAccount($entry.IdentityReference)
Expand Down
17 changes: 1 addition & 16 deletions Private/Find-ESC4.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,32 +18,17 @@
$SID = ($Principal.Translate([System.Security.Principal.SecurityIdentifier])).Value
}

if ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -match $UnsafeOwners) ) {
if ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
IdentityReference = $entry.IdentityReference
ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$PreferredOwner`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Revert = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$($_.nTSecurityDescriptor.Owner)`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Technique = 'ESC4'
}
$Issue
} elseif ( ($_.objectClass -eq 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
IdentityReference = $entry.IdentityReference
ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = '[TODO]'
Revert = '[TODO]'
Technique = 'ESC4'
}
$Issue
}

foreach ($entry in $_.nTSecurityDescriptor.Access) {
Expand Down
21 changes: 2 additions & 19 deletions Private/Find-ESC5.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,35 +17,18 @@
} else {
$SID = ($Principal.Translate([System.Security.Principal.SecurityIdentifier])).Value
}
if ( ($_.objectClass -ne 'pKICertificateTemplate') -and ($SID -match $UnsafeOwners) ) {

if ( ($_.objectClass -ne 'pKICertificateTemplate') -and ($SID -notmatch $SafeOwners) ) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
# IdentityReference = $entry.IdentityReference
# ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this template"
Fix = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$PreferredOwner`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Revert = "`$Owner = New-Object System.Security.Principal.SecurityIdentifier(`'$($_.nTSecurityDescriptor.Owner)`'); `$ACL = Get-Acl -Path `'AD:$($_.DistinguishedName)`'; `$ACL.SetOwner(`$Owner); Set-ACL -Path `'AD:$($_.DistinguishedName)`' -AclObject `$ACL"
Technique = 'ESC5'
}
$Issue
} elseif ( ($_.objectClass -ne 'pKICertificateTemplate') -and
($SID -notmatch $SafeOwners) -and
($entry.ActiveDirectoryRights.ObjectType -notmatch $SafeObjectTypes)
) {
$Issue = [pscustomobject]@{
Forest = $_.CanonicalName.split('/')[0]
Name = $_.Name
DistinguishedName = $_.DistinguishedName
# IdentityReference = $entry.IdentityReference
# ActiveDirectoryRights = $entry.ActiveDirectoryRights
Issue = "$($_.nTSecurityDescriptor.Owner) has Owner rights on this object"
Fix = '[TODO]'
Revert = '[TODO]'
Technique = 'ESC5'
}
$Issue
}

foreach ($entry in $_.nTSecurityDescriptor.Access) {
Expand Down

0 comments on commit 440835a

Please sign in to comment.