search

Mazars-Tech / AD_Miner

AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses
GNU General Public License v3.0
1.01k stars 103 forks source link

Report fails with ACL/ADLocalGroup #129

Closed bdesforges closed 2 months ago

bdesforges commented 3 months ago

Describe the bug Working with a dataset that includes 3 domains and 5 tenants. The report errors out with a KeyError: 'ADLocalGroup'

Terminal Output `[+]Generate paths of objects that can RCBD on a computer Traceback (most recent call last): File "/root/.local/bin/AD-miner", line 8, in sys.exit(main()) ^^^^^^ File "/root/.local/pipx/venvs/ad-miner/lib/python3.11/site-packages/ad_miner/main.py", line 184, in main users = Users(arguments, neo4j, domains) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/pipx/venvs/ad-miner/lib/python3.11/site-packages/ad_miner/sources/modules/users.py", line 255, in init self.number_group_ACL_anomaly = self.genGroupAnomalyAcl(domain) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/pipx/venvs/ad-miner/lib/python3.11/site-packages/ad_miner/sources/modules/users.py", line 1563, in genGroupAnomalyAcl "label": f"{generic_formating.get_label_icon_dictionary()[formated_data[name_label_instance]['label']]} {formated_data[name_label_instance]['label']}" ,


KeyError: 'ADLocalGroup'`

**Screenshots**
![image](https://github.com/Mazars-Tech/AD_Miner/assets/26072916/581c80c8-e885-41d4-8e95-1d43c77c4334)

**System information**
- AD_Miner 1.2.0, installed using Python 3.11.2
- Bloodhound-ce
- Data collected with Sharphound
![image](https://github.com/Mazars-Tech/AD_Miner/assets/26072916/bae306f2-9639-44fe-8269-9d7cd62ac237)

**Additional context**
As discussed in discord, running this query `MATCH (d:ADLocalGroup) DETACH DELETE d` , deleting the relevant cache files (*acl*) makes ad-miner run successfully.
snowpeacock commented 3 months ago

Hello, Thanks for the feedback and the detailed bug report :)

As we found out that ADLocalGroup objects are only used for post-processing edges in bloodhound we're going to choose this solution (deleting them at the start of AD Miner execution).