BloodHoundAD / SharpHound3

C# Data Collector for the BloodHound Project, Version 3
GNU General Public License v3.0
520 stars 156 forks source link

[Suggestion] Remove "ComputerId" attribute from "Sessions" in computers.csv as it is redundant #23

Closed cnotin closed 3 years ago

cnotin commented 4 years ago

A computer object in computers.json looks like this:

{
  "Properties": {
[...]
    "objectid": "S-1-5-21-xxxx-999",
[...]
  "Sessions": [
    {
      "UserId": "S-1-5-21-xxxxxx-123",
      "ComputerId": "S-1-5-21-xxxx-999"
    },
    {
      "UserId": "S-1-5-21-xxxxxx-456",
      "ComputerId": "S-1-5-21-xxxx-999"
    },
[...]

The ComputerId attribute is repeated for each session and it is redundant with the objectid of the computer which we already know (except if I missed a specific case?). I suggest removing it then to have a smaller file :)

rvazarkar commented 3 years ago

Running NetSessionEnum against a DC will give you sessions for systems that aren't the DC for example. The ComputerID comes from resolving the computer name that comes back from NetSessionEnum.

cnotin commented 3 years ago

Of course it makes sense! Perhaps I made a mistake when looking at the output, or I had an odd case, but I just confirmed that we have ComputerId != ObjectIdentifier in the output so it's all good Sorry @rvazarkar!