feat: new functions

Author: jakehildreth

ADCSGoat/Private/GetHelloWorld.ps1

@@ -0,0 +1,29 @@
+function Deploy-AdcsGoat {
+    $TemplateNames = @(
+        'ESC1'
+        'ESC2'
+        'ESC3c1'
+        'ESC3c2'
+        'ESC4'
+        'ESC9'
+    )
+
+    # We need blank template objects.
+    $TemplateNames | ForEach-Object { 
+        New-AdcsGoatBlankTemplateObject -TemplateName $_
+    }
+
+    # We need to assign properties to the blank template objects to turn them into real templates.
+    $TemplateNames | ForEach-Object {
+        $PropertiesPath = Join-Path -Path ".\Research" -ChildPath "${_}.xml" 
+        $Properties = Import-Clixml -Path $PropertiesPath
+        Set-AdcsGoatTemplateProperty -TemplateName $_ -Properties $Properties
+    }
+
+    # We need to grant low privileged users control over blank template objects to turn them into ESC issues.
+    $TemplateNames | ForEach-Object {
+        Set-AdcsGoatTemplateAce -TemplateName $_ -AceType GenericAll
+    }
+}
+
+ 

ADCSGoat/Public/Deploy-AdcsGoat.ps1

@@ -0,0 +1,8 @@
+function Find-AdcsGoatEnrollmentService {
+    # Get the Configuration partition automatically via RootDSE
+    $RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
+    $ConfigurationPartition = $rootDSE.configurationNamingContext
+    $EnrollmentServicesContainer = "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigurationPartition"
+    $EnrollmentServicesPath = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$EnrollmentServicesContainer")
+    $EnrollmentServicesPath.Children
+}

ADCSGoat/Public/Find-AdcsGoatEnrollmentService.ps1

@@ -0,0 +1,9 @@
+function Get-AdcsGoatEnrollmentServiceFullName {
+    param (
+        [Parameter(Mandatory)]
+        [ValidateScript({ $_.objectClass -eq 'pKIEnrollmentService' })]
+        [System.DirectoryServices.DirectoryEntry]$EnrollmentService
+    )
+
+    "$($EnrollmentService.dNSHostName)\$($EnrollmentService.name)"
+}

ADCSGoat/Public/Get-AdcsGoatEnrollmentServiceFullName.ps1

@@ -1,4 +1,4 @@
-function New-BLLBlankTemplateObject {
+function New-AdcsGoatBlankTemplateObject {
     [CmdletBinding()]
     param (
         [Parameter(ValueFromPipeline, Mandatory)]

ADCSGoat/Public/Get-HelloWorld.ps1

@@ -0,0 +1,11 @@
+function Set-AdcsGoatEnrollmentServiceFullName {
+    param (
+        [Parameter(Mandatory)]
+        [ValidateScript({ $_.objectClass -eq 'pKIEnrollmentService' })]
+        [System.DirectoryServices.DirectoryEntry]$EnrollmentService,
+        [Parameter(Mandatory)]
+        [string]$EnrollmentServiceFullName 
+    )
+
+    "$($EnrollmentService.dNSHostName)\$($EnrollmentService.name)"
+}

…t/Private/New-BLLBlankTemplateObject.ps1 …blic/New-AdcsGoatBlankTemplateObject.ps1ADCSGoat/Private/New-BLLBlankTemplateObject.ps1 renamed to ADCSGoat/Public/New-AdcsGoatBlankTemplateObject.ps1 ADCSGoat/Private/New-BLLBlankTemplateObject.ps1 renamed to ADCSGoat/Public/New-AdcsGoatBlankTemplateObject.ps1

@@ -1,4 +1,4 @@
-function Set-BLLTemplateAce {
+function Set-AdcsGoatTemplateAce {
     [CmdletBinding()]
     param (
         [Parameter(ValueFromPipeline, Mandatory)]
@@ -37,7 +37,7 @@ function Set-BLLTemplateAce {
 
         # Define Access Control Type for use in ACEs
         $Allow = [System.Security.AccessControl.AccessControlType]::Allow
-        $Deny = [System.Security.AccessControl.AccessControlType]::Deny
+        # $Deny = [System.Security.AccessControl.AccessControlType]::Deny
 
         $AccessRule = switch -Regex ($AceType) {
             'Enroll' {

ADCSGoat/Public/Set-AdcsGoatEnrollmentServiceFullName.ps1

@@ -1,10 +1,10 @@
-function Set-BLLTemplateProperty {
+function Set-AdcsGoatTemplateProperty {
     [CmdletBinding()]
     param (
         [Parameter(ValueFromPipeline, Mandatory)]
         [string]$TemplateName,
         [Parameter(ValueFromPipeline, Mandatory)]
-        [hashtable]$properties
+        [hashtable]$Properties
     )
 
     begin {
@@ -21,7 +21,7 @@ function Set-BLLTemplateProperty {
 
         try {
             # Apply $Properties to the object
-            foreach ($property in $properties.GetEnumerator()) {
+            foreach ($property in $Properties.GetEnumerator()) {
                 # Each $property could be of a different type, and each type has to be applied differently.
                 if ($property.Value -is [System.Collections.ICollection] -and $property.Value -isnot [byte[]]) {
                     # Handle different collection types (ArrayList, Array, etc.), but not byte arrays