ADExplorerSnapshot.py
ADExplorerSnapshot.py copied to clipboard
Fix: avoid sid=none in JSON output
I had an issue with the output files. Bloodhound would fail when importing. The message in the dev console said something like Cannot read property of null
.
I found that the computers.json
contained lines like this:
"AllowedToDelegate": [
"S-1-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
null
],
This patch makes sure to add sids to the AllowedToDelegate
list only if they are not Null
(or empty).
I reckon this happens when the SID is from another domain.
tested and confirmed fix allows data to be ingested correctly.
These edits patch the BloodHound freezing issue but unintentionally result in incomplete data output. I opened a new PR that fixes the underlying issue, see #16.
thanks for making this change, closing it in favour of #16