Begin adding tests for new functions

SpecterOps · Jan 18, 2024 · 6b9a700 · 6b9a700
1 parent 2be6f38
commit 6b9a700
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 4 deletions.
diff --git a/src/CommonLib/Processors/LDAPPropertyProcessor.cs b/src/CommonLib/Processors/LDAPPropertyProcessor.cs
@@ -128,7 +128,7 @@ public async Task<UserProperties> ReadUserProperties(ISearchResultEntry entry)
 
             var sidHistory = ReadSidHistory(entry);
             props.Add(PropertyMap.GetPropertyName(LDAPProperties.SIDHistory), sidHistory.ToArray());
-            userProps.SidHistory = sidHistory.Select(ssid => ReadSidPrinciple(entry, ssid)).ToArray();
+            userProps.SidHistory = sidHistory.Select(ssid => ReadSidPrincipal(entry, ssid)).ToArray();
 
             userProps.Props = props;
 
@@ -161,7 +161,7 @@ public async Task<ComputerProperties> ReadComputerProperties(ISearchResultEntry
 
             var sidHistory = ReadSidHistory(entry);
             props.Add(PropertyMap.GetPropertyName(LDAPProperties.SIDHistory), sidHistory.ToArray());
-            compProps.SidHistory = sidHistory.Select(ssid => ReadSidPrinciple(entry, ssid)).ToArray();
+            compProps.SidHistory = sidHistory.Select(ssid => ReadSidPrincipal(entry, ssid)).ToArray();
 
             compProps.DumpSMSAPassword = ReadSmsaPrinciples(entry).ToArray();
 
@@ -237,7 +237,7 @@ public List<string> ReadSidHistory(ISearchResultEntry entry)
         /// <param name="entry"></param>
         /// <param name="sidHistoryItem"></param>
         /// <returns></returns>
-        public TypedPrincipal ReadSidPrinciple(ISearchResultEntry entry, string sidHistoryItem)
+        public TypedPrincipal ReadSidPrincipal(ISearchResultEntry entry, string sidHistoryItem)
         {
             var domain = Helpers.DistinguishedNameToDomain(entry.DistinguishedName);
             return _utils.ResolveIDAndType(sidHistoryItem, domain);
@@ -803,7 +803,7 @@ public static string GetPropertyName(string ldapProperty)
                 case LDAPProperties.PasswordLastSet:
                     return "pwdlastset";
                 case LDAPProperties.ServicePrincipalNames:
-                    return "serviceprinciplenames";
+                    return "serviceprincipalnames";
                 case LDAPProperties.DisplayName:
                     return "displayname";
                 case LDAPProperties.Email:

diff --git a/test/unit/LDAPPropertyTests.cs b/test/unit/LDAPPropertyTests.cs
@@ -876,5 +876,43 @@ public async Task LDAPPropertyProcessor_ReadPropertyDelegates_ReturnsPoplatedLis
                 Assert.Single(delegates, host);
             }
         }
+
+        [WindowsOnlyFact]
+        public void LDAPPropertyProcessor_ReadSidHistory_ReturnsPopulatedList()
+        {
+            var mock = new MockSearchResultEntry("CN\u003dWIN10,OU\u003dTestOU,DC\u003dtestlab,DC\u003dlocal",
+                new Dictionary<string, object>
+                {
+                    {
+                        "sidhistory", new[]
+                        {
+                            Helpers.B64ToBytes("AQUAAAAAAAUVAAAAIE+Qun9GhKV2SBaQUQQAAA==")
+                        }
+                    },
+                }, "S-1-5-21-3130019616-2776909439-2417379446-1101", Label.Computer);
+
+            var processor = new LDAPPropertyProcessor(new MockLDAPUtils());
+            var sids = processor.ReadSidHistory(mock);
+
+            Assert.Contains("S-1-5-21-3130019616-2776909439-2417379446-1105", sids);
+            Assert.Single(sids);
+        }
+
+        [Fact]
+        public void LDAPPropertyProcessor_ReadSidPrincipal_GetPrincipal()
+        {
+            var mock = new MockSearchResultEntry("CN\u003dWIN10,OU\u003dTestOU,DC\u003dtestlab,DC\u003dlocal",
+                new Dictionary<string, object>(), "S-1-5-21-3130019616-2776909439-2417379446-1101", Label.Computer);
+
+            var sid = "S-1-5-21-3130019616-2776909439-2417379446-1105";
+            var processor = new LDAPPropertyProcessor(new MockLDAPUtils());
+            var principal = processor.ReadSidPrincipal(mock, sid);
+
+            Assert.Equal(new TypedPrincipal
+            {
+                ObjectIdentifier = "S-1-5-21-3130019616-2776909439-2417379446-1105",
+                ObjectType = Label.User
+            }, principal);
+        }
     }
 }