search

BloodHoundAD / SharpHound2

The Old BloodHound C# Ingestor (Deprecated)
509 stars 113 forks source link

Fix GPO collection collecting versioning GPO when GPA is used #65

Open Crypt0-M3lon opened 5 years ago

Crypt0-M3lon commented 5 years ago

My compagny use Group Policy Admin (https://www.microfocus.com/en-us/products/netiq-group-policy-administrator/overview) to manage GPO. When collecting GPO, versionned GPO managed by GPA are collected, leading the the collect of 4 Default Domain Policy and wrong/false positive attack paths. The main différence between a versionned GPO and an GPO is the presence of the Flags attributes in the Group Policy Object. The patch just add a check for the flags attribute existence in LDAP queries to ignore versionned GPO.

rvazarkar commented 5 years ago

Interesting, I dont think I've run into this before, going to take a look and make sure everything works properly before merging

Crypt0-M3lon commented 5 years ago

Yep sure, ping me on slack if you need further information.