ADExplorerSnapshot.py icon indicating copy to clipboard operation
ADExplorerSnapshot.py copied to clipboard

Added certificate parsing of ADExplorer snapshots, based on Certipy.

Open PTVB opened this issue 2 years ago • 1 comments

Added certificate parsing from AD Snapshots, based on Certipy.

PTVB avatar Apr 06 '22 12:04 PTVB

This looks massive and awesome. Will review, test and merge in the next few days.

c3c avatar Apr 06 '22 13:04 c3c

any update on this to be merged?

OscarAkaElvis avatar Nov 30 '22 16:11 OscarAkaElvis

Added certificate parsing from AD Snapshots, based on Certipy. I installed the latest ceripy4.4 and still encountered this issue ModuleNotFoundError: No module named 'certipy.constants' image

helloyw avatar May 16 '23 08:05 helloyw

Added certificate parsing from AD Snapshots, based on Certipy. I installed the latest ceripy4.4 and still encountered this issue ModuleNotFoundError: No module named 'certipy.constants' image

should be fixed in new commit :) thanks for making this, apologies for taking so long

c3c avatar May 18 '23 20:05 c3c

添加了基于Certipy 的AD 快照中的证书解析。 我安装了最新的ceripy4.4,仍然遇到这个问题 ModuleNotFoundError: No module named 'certipy.constants' 图像

应该在新的提交中修复 :) 感谢你做这个,抱歉花了这么长时间 I have a new issue. After resolving the issue of missing dependency packages, I successfully found 37 certificate templates using ADExplorerSnapshot.py. When I imported the generated JSON file into BloodHound 4.2.0-ly4k and used Find all Certificate Templates, I couldn't find any information. image

helloyw avatar May 19 '23 03:05 helloyw

Based on the output, you're working from a different branch than current main. I don't think that will resolve the problem though: current output format predates ly4k's version, that'll need to be implemented. I've created https://github.com/c3c/ADExplorerSnapshot.py/issues/17 to track this.

c3c avatar May 19 '23 07:05 c3c

根据输出,您正在与当前主分支不同的分支工作。我不认为这会解决问题:当前输出格式早于 ly4k 的版本,需要实施。我创建了#17来跟踪这个。

Great, looking forward to you solving this problem

helloyw avatar May 19 '23 07:05 helloyw

Should be implemented with latest commits. Make sure to re-run pip as dependency versions have changed.

c3c avatar May 20 '23 22:05 c3c

I tested the latest warehouse and found an error running, AttributeError: 'ADExplorerSnapshot' object has no attribute 'numCAS' Did you mean: 'numCAs'?, You need to globally replace numCAS with numCAs to successfully run,I hope you can modify this issue again image

helloyw avatar May 22 '23 04:05 helloyw

Ah forgot to stage that line for the main branch. https://github.com/c3c/ADExplorerSnapshot.py/commit/38e5100ee5925e1adfe63591f9df7fb97d35ca5e

c3c avatar May 22 '23 07:05 c3c

啊忘了为主要分支准备那条线。38e5100

You did a great job

helloyw avatar May 22 '23 07:05 helloyw