BloodHoundAD / SharpHoundCommon

Common library used by SharpHound.
GNU General Public License v3.0
73 stars 47 forks source link

fix: msPKI-RA-Application-Policies parsing #88

Closed JonasBK closed 6 months ago

JonasBK commented 7 months ago

The msPKI-RA-Application-Policies attribute has two different syntaxes. This change implements parsing of the second syntax described here: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/c55ec697-be3f-4117-8316-8895e4399237

The result is that we no longer get strings like this (if syntax 2) in our output:

"applicationpolicies": [
      "msPKI-Asymmetric-Algorithm`PZPWSTR`RSA`msPKI-Hash-Algorithm`PZPWSTR`SHA1`msPKI-Key-Security-Descriptor`PZPWSTR`D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;GR;;;S-1-5-80-3804348527-3718992918-2141599610-3686422417-2726379419)`msPKI-Key-Usage`DWORD`2`msPKI-RA-Application-Policies`PZPWSTR`1.3.6.1.4.1.311.20.2.1`"
],

as they are now parsed so we only get the OID values like in syntax 1 output:

"applicationpolicies": [
      "1.3.6.1.4.1.311.20.2.1"
],