Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Skip over CAs that can't be resolved to SIDs during collection #90

Merged
merged 2 commits into from
Mar 14, 2024

Conversation

definitelynotagoblin
Copy link
Contributor

Description

If ResolveHostToSid doesn't return a valid SID when processing a CA, we don't want to collect it.
Currently ResolveHostToSid from SHCommon falls back onto a hostname from DNS when a SID can't be determined. For now we wish to leave that behavior as is.

Motivation and Context

https://specterops.atlassian.net/browse/BP-508

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

  • Chore (a change that does not modify the application functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • Documentation updates are needed, and have been made accordingly.
  • I have added and/or updated tests to cover my changes.
  • All new and existing tests passed.
  • My changes include a database migration.

@StephenHinck
Copy link

Will this fix it for all scenarios where ResolveHostToSid is used? I believe this also affects some delegation paths as well today.

@definitelynotagoblin definitelynotagoblin merged commit 268374f into 2.X Mar 14, 2024
1 check passed
@definitelynotagoblin definitelynotagoblin deleted the anemeth/ca-skip-non-sid branch March 14, 2024 15:48
@github-actions github-actions bot locked and limited conversation to collaborators Mar 14, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants