Skip to content

Unable to scan Forest with child domains #241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jakehildreth merged 2 commits into from
Mar 28, 2025
Merged

Unable to scan Forest with child domains #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4101938
Refactor Invoke-Command calls to use CAHostFQDN and improve connectio…
rebelinux Feb 24, 2025
cdfed4a
Merge branch 'jakehildreth:testing' into testing
rebelinux Mar 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions Invoke-Locksmith.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2900,11 +2900,11 @@ function Set-AdditionalCAProperty {
$CAHostDistinguishedName = (Get-ADObject -Filter { (Name -eq $CAHostName) -and (objectclass -eq 'computer') } -Server $ForestGC ).DistinguishedName
$CAHostFQDN = (Get-ADObject -Filter { (Name -eq $CAHostName) -and (objectclass -eq 'computer') } -Properties DnsHostname -Server $ForestGC).DnsHostname
}
$ping = Test-Connection -ComputerName $CAHostFQDN -Quiet -Count 1
$ping = if ($CAHostFQDN) { Test-Connection -ComputerName $CAHostFQDN -Count 1 -Quiet } else { Write-Warning "Unable to resolve $($_.Name) Fully Qualified Domain Name (FQDN)" }
if ($ping) {
try {
if ($Credential) {
$CertutilAudit = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg CA\AuditFilter } -ArgumentList $CAFullName
$CertutilAudit = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg CA\AuditFilter }
}
else {
$CertutilAudit = certutil -config $CAFullName -getreg CA\AuditFilter
Expand All @@ -2915,7 +2915,7 @@ function Set-AdditionalCAProperty {
}
try {
if ($Credential) {
$CertutilFlag = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg policy\EditFlags } -ArgumentList $CAFullName
$CertutilFlag = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg policy\EditFlags }
}
else {
$CertutilFlag = certutil -config $CAFullName -getreg policy\EditFlags
Expand All @@ -2926,7 +2926,7 @@ function Set-AdditionalCAProperty {
}
try {
if ($Credential) {
$CertutilInterfaceFlag = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg CA\InterfaceFlags } -ArgumentList $CAFullName
$CertutilInterfaceFlag = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg CA\InterfaceFlags }
}
else {
$CertutilInterfaceFlag = certutil -config $CAFullName -getreg CA\InterfaceFlags
Expand Down Expand Up @@ -3395,23 +3395,23 @@ function Set-RiskRating {
switch ($Issue.objectClass) {
# Being able to modify Root CA Objects is very bad.
'certificationAuthority' {
$RiskValue += 2; $RiskScoring += 'Root Certification Authority bject: +2'
$RiskValue += 2; $RiskScoring += 'Root Certification Authority bject: +2'
}
# Being able to modify Issuing CA Objects is also very bad.
'pKIEnrollmentService' {
$RiskValue += 2; $RiskScoring += 'Issuing Certification Authority Object: +2'
$RiskValue += 2; $RiskScoring += 'Issuing Certification Authority Object: +2'
}
# Being able to modify CA Hosts? Yeah... very bad.
'computer' {
$RiskValue += 2; $RiskScoring += 'Certification Authority Host Computer: +2'
$RiskValue += 2; $RiskScoring += 'Certification Authority Host Computer: +2'
}
# Being able to modify OIDs could result in ESC13 vulns.
'msPKI-Enterprise-Oid' {
$RiskValue += 1; $RiskScoring += 'OID: +1'
$RiskValue += 1; $RiskScoring += 'OID: +1'
}
# Being able to modify PKS containers is bad.
'container' {
$RiskValue += 1; $RiskScoring += 'Container: +1'
$RiskValue += 1; $RiskScoring += 'Container: +1'
}
}
}
Expand All @@ -3420,19 +3420,19 @@ function Set-RiskRating {
# Convert Value to Name
$RiskName = switch ($RiskValue) {
{ $_ -le 1 } {
'Informational'
'Informational'
}
2 {
'Low'
'Low'
}
3 {
'Medium'
'Medium'
}
4 {
'High'
'High'
}
{ $_ -ge 5 } {
'Critical'
'Critical'
}
}

Expand Down Expand Up @@ -3981,7 +3981,7 @@ Set-Acl -Path `$Path -AclObject `$ACL
"@
}
4 {
break
break
}
5 {
$Issue.Fix = @"
Expand Down Expand Up @@ -4144,10 +4144,10 @@ Function Write-HostColorized {
# We precompile them for better performance with many input objects.
[System.Text.RegularExpressions.RegexOptions] $reOpts =
if ($CaseSensitive) {
'Compiled, ExplicitCapture'
'Compiled, ExplicitCapture'
}
else {
'Compiled, ExplicitCapture, IgnoreCase'
'Compiled, ExplicitCapture, IgnoreCase'
}

# Transform the dictionary:
Expand All @@ -4169,10 +4169,10 @@ Function Write-HostColorized {
}
$colorArgs = @{ }
if ($fg) {
$colorArgs['ForegroundColor'] = [ConsoleColor] $fg
$colorArgs['ForegroundColor'] = [ConsoleColor] $fg
}
if ($bg) {
$colorArgs['BackgroundColor'] = [ConsoleColor] $bg
$colorArgs['BackgroundColor'] = [ConsoleColor] $bg
}

# Consolidate the patterns into a single pattern with alternation ('|'),
Expand All @@ -4191,7 +4191,7 @@ Function Write-HostColorized {
}
}
catch {
throw
throw
}

# Construct the arguments to pass to Out-String.
Expand All @@ -4214,7 +4214,7 @@ Function Write-HostColorized {
foreach ($m in $entry.Key.Matches($_)) {
@{ Index = $m.Index; Text = $m.Value; ColorArgs = $entry.Value }
if ($WholeLine) {
break patternLoop
break patternLoop
}
}
}
Expand Down
8 changes: 4 additions & 4 deletions Private/Set-AdditionalCAProperty.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,11 +127,11 @@
$CAHostDistinguishedName = (Get-ADObject -Filter { (Name -eq $CAHostName) -and (objectclass -eq 'computer') } -Server $ForestGC ).DistinguishedName
$CAHostFQDN = (Get-ADObject -Filter { (Name -eq $CAHostName) -and (objectclass -eq 'computer') } -Properties DnsHostname -Server $ForestGC).DnsHostname
}
$ping = Test-Connection -ComputerName $CAHostFQDN -Quiet -Count 1
$ping = if ($CAHostFQDN) { Test-Connection -ComputerName $CAHostFQDN -Count 1 -Quiet } else { Write-Warning "Unable to resolve $($_.Name) Fully Qualified Domain Name (FQDN)" }
if ($ping) {
try {
if ($Credential) {
$CertutilAudit = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg CA\AuditFilter } -ArgumentList $CAFullName
$CertutilAudit = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg CA\AuditFilter }
Comment thread
SamErde marked this conversation as resolved.
} else {
$CertutilAudit = certutil -config $CAFullName -getreg CA\AuditFilter
}
Expand All @@ -140,7 +140,7 @@
}
try {
if ($Credential) {
$CertutilFlag = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg policy\EditFlags } -ArgumentList $CAFullName
$CertutilFlag = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg policy\EditFlags }
} else {
$CertutilFlag = certutil -config $CAFullName -getreg policy\EditFlags
}
Expand All @@ -149,7 +149,7 @@
}
try {
if ($Credential) {
$CertutilInterfaceFlag = Invoke-Command -ComputerName $CAHostname -Credential $Credential -ScriptBlock { param($CAFullName); certutil -config $CAFullName -getreg CA\InterfaceFlags } -ArgumentList $CAFullName
$CertutilInterfaceFlag = Invoke-Command -ComputerName $CAHostFQDN -Credential $Credential -ScriptBlock { certutil -config $using:CAFullName -getreg CA\InterfaceFlags }
} else {
$CertutilInterfaceFlag = certutil -config $CAFullName -getreg CA\InterfaceFlags
}
Expand Down
Loading