PowerShellMafia / PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework
Other
11.78k stars 4.59k forks source link

Support for DNs containing commas #226

Closed joncave closed 7 years ago

joncave commented 7 years ago

If an object's distinguished name contains a comma then it ends up quoted. This may often happen in a user's common name when "surname, firstname" format is used. For example:

CN=Smith\, John,OU=Admins,DC=example,DC=com

This breaks a number of functions which attempt to identify DOMAIN\name by matching on a \ anywhere in the specified identity before checking if the identity was a DN (or SID or GUID).

For example, attempting to list members of "Domain Admins" using Get-DomainGroupMember gives the following:

VERBOSE: [Convert-ADName] Error initializing translation for 'CN=Smith\, John,OU=Admins,DC=example,DC=com' : Exception calling "InvokeMember" with "5" argument(s): "The specified domain either does not exist or could not be contacted. (Exception from HRESULT: 0x8007054B)"
VERBOSE: [Convert-ADName] Error translating 'CN=Smith\, John,OU=Admins,DC=example,DC=com' : The specified domain either does not exist or could not be contacted. (Exception from HRESULT: 0x8007054B)
VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (objectClass=*)

The fix implemented here is to perform more specific pattern matching prior to falling back to looking for a . The order is SID, DN, GUID, qualified name (DOMAIN\name), and then plain name.

joncave commented 7 years ago

There are a couple more instances of the old patterns still present in Get-PrincipalContext and Add-DomainGroupMember. I'm confident they can be changed in a similar manner, but I haven't had a chance to test them out. I may follow up with a separate commit to address those.

HarmJ0y commented 7 years ago

Awesome, thanks!