Add Secondary localgroup/session BOFs Supported by BOFHound #114
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
freefirex
requested changes
Jan 31, 2024
src/SA/get-netsession2/entry.c
Outdated
| // DNS cleanup | ||
| END: | ||
| if(base) | ||
| {DNSAPI$DnsFree(base, freetype);} |
There was a problem hiding this comment.
the value of base is passed by value. This free will never get hit and the value returned in the query_domain call will get leaked. The free for this value needs to be in query_domain
There was a problem hiding this comment.
I think I fixed this one, moving the call up to query_domain
|
@freefirex thank you for providing recommended fixes for the issues - huge help. I think I've made the changes as requested, but if any issues are still lingering, please let me know and I'll take another pass |
|
Merged, thanks again! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
External tool BOFHound (now here) has supported parsing
ldapsearchresults out of C2 logs to produce JSON for BloodHound. This PR adds several secondary versions of existing BOFs that allow parsing of session data and local group memberships from log files. This allows for BloodHound'sHasSession,AdminToand other edges that rely on local group data.This PR includes secondary versions of the following BOFs (mostly modified for ease of output parsing, but there are some other modifications such as structures returned by API calls):
netsession2netloggedon2netLocalGroupListMember2One "new" BOF to pull sessions from the registry:
regsessionI opted for separate secondary BOFs since the changes aren't really upgrades/bugfixes for the original BOFs, and in some cases might clutter the output with data some users don't care for. With that said, if you'd like these changes merged into the original BOFs, I can make the necessary edits. Conversely, if you don't want to accept this PR, I am happy to move these BOFs to their own dedicated repo.
Additional details here: https://posts.specterops.io/bofhound-session-integration-7b88b6f18423