SpecterOps / BloodHound

Six Degrees of Domain Admin
https://bloodhoundenterprise.io/
Apache License 2.0
1.14k stars 113 forks source link

fix: BED-4954 - Include SyncedToADUser and SyncedToEntraUser in Delet… #918

Closed zinic closed 2 weeks ago

zinic commented 2 weeks ago

Description

Azure Post is missing SyncedToADUser: https://github.com/SpecterOps/BloodHound/blob/c347ed2bfa2d524494657269ab23828674f74376/packages/go/analysis/azure/post.go#L120

ActiveDirectory Post is missing SyncedToEntraUser: https://github.com/SpecterOps/BloodHound/blob/c347ed2bfa2d524494657269ab23828674f74376/packages/go/analysis/ad/post.go#L37

Lastly, as written the resulting query from DeleteTransitEdges(...) narrows the start and end node kinds to just one base type: (:Base)-[:SyncedToEntraUser]->(:Base). This presents a problem since AD/Entra Hybrid Paths, by definition, must cross boundaries: (:Base)-[:SyncedToEntraUser]->(:AZBase). As such, the DeleteTransitEdges(...) function must be rewritten to match on multiple start and end node kinds.

Motivation and Context

This PR addresses: BED-4954

Calls to DeleteTransitEdges(…) do not include the most recent AD/Entra Hybrid Path edges. Additionally, due to the way that the function is written, cross-domain edges will never be deleted.

How Has This Been Tested?

Integration testing.

Screenshots (optional):

Types of changes

Checklist: