0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-6LKRLK2R.js

@@ -0,0 +1,542 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  AD_ANALYZERS,
+  findAclAbuseChains,
+  findAdcsEscalation,
+  findDcsyncPrincipals,
+  findKerberoastablePaths,
+  findPathsToDomainAdmin,
+  findUnconstrainedDelegation
+} from "./chunk-VQG4FT5D.js";
+
+// packages/core/dist/adgraph/ingest.js
+var FILE_TYPE_TO_NODE_KIND = {
+  users: "User",
+  computers: "Computer",
+  groups: "Group",
+  domains: "Domain",
+  gpos: "GPO",
+  ous: "OU",
+  containers: "Container",
+  certtemplates: "CertTemplate",
+  enterprisecas: "EnterpriseCA",
+  rootcas: "RootCA",
+  aiacas: "AIACA",
+  ntauthstores: "NTAuthStore",
+  issuancepolicies: "IssuancePolicy"
+};
+var ACE_RIGHT_ALIASES = {
+  owner: "Owns",
+  all: "GenericAll",
+  extendedright: "AllExtendedRights",
+  "ds-replication-get-changes": "GetChanges",
+  "ds-replication-get-changes-all": "GetChangesAll",
+  "ds-replication-get-changes-in-filtered-set": "GetChangesInFilteredSet",
+  "user-force-change-password": "ForceChangePassword"
+};
+var PRINCIPAL_TO_COMPUTER_COLLECTIONS = [
+  ["LocalAdmins", "AdminTo"],
+  ["RemoteDesktopUsers", "CanRDP"],
+  ["DcomUsers", "ExecuteDCOM"],
+  ["PSRemoteUsers", "CanPSRemote"],
+  ["AllowedToAct", "AllowedToAct"]
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+  if (typeof value === "string" && value.trim().length > 0)
+    return value.trim();
+  return void 0;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function readResultList(value) {
+  if (Array.isArray(value))
+    return value;
+  if (isRecord(value))
+    return asArray(value.Results ?? value.results);
+  return [];
+}
+function field(record, ...names) {
+  for (const name of names) {
+    if (name in record)
+      return record[name];
+    const lower = name.toLowerCase();
+    for (const key of Object.keys(record)) {
+      if (key.toLowerCase() === lower)
+        return record[key];
+    }
+  }
+  return void 0;
+}
+function normalizeProperties(value) {
+  if (!isRecord(value))
+    return {};
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    out[key.toLowerCase()] = raw;
+  }
+  return out;
+}
+function normalizeObjectId(value) {
+  const id = asString(value);
+  return id ? id.toUpperCase() : void 0;
+}
+function normalizeNodeKind(value, fallback) {
+  const kind = asString(value);
+  if (!kind)
+    return fallback;
+  if (kind.toLowerCase() === "base")
+    return fallback;
+  return kind;
+}
+function normalizeEdgeKind(value) {
+  const kind = asString(value);
+  if (!kind)
+    return void 0;
+  return ACE_RIGHT_ALIASES[kind.toLowerCase()] ?? kind;
+}
+var ChunkBuilder = class {
+  nodes = [];
+  edges = [];
+  warnings = [];
+  node(node) {
+    this.nodes.push(node);
+  }
+  /**
+   * Reference to an object we may not have collected. Emitted as a stub node so
+   * traversal never dead-ends on a member SID whose own file is missing; a real
+   * record for the same id wins during {@link buildAdGraph} merge.
+   */
+  reference(objectId, kind, label) {
+    this.nodes.push({
+      objectId,
+      label: label ?? objectId,
+      kind,
+      properties: {},
+      stub: true
+    });
+  }
+  edge(source, target, kind, properties) {
+    this.edges.push(properties ? { source, target, kind, properties } : { source, target, kind });
+  }
+  warn(message) {
+    if (this.warnings.length < 200)
+      this.warnings.push(message);
+  }
+};
+function readReference(builder, value, fallbackKind, idFields = ["ObjectIdentifier"]) {
+  if (typeof value === "string") {
+    const id2 = normalizeObjectId(value);
+    if (id2)
+      builder.reference(id2, fallbackKind);
+    return id2;
+  }
+  if (!isRecord(value))
+    return void 0;
+  const id = normalizeObjectId(field(value, ...idFields));
+  if (!id)
+    return void 0;
+  builder.reference(id, normalizeNodeKind(field(value, "ObjectType", "kind"), fallbackKind));
+  return id;
+}
+function parseCollectorObject(builder, raw, defaultKind, index, sourceType) {
+  if (!isRecord(raw)) {
+    builder.warn(`${sourceType}[${index}]: not an object, skipped`);
+    return;
+  }
+  const objectId = normalizeObjectId(field(raw, "ObjectIdentifier", "objectid"));
+  if (!objectId) {
+    builder.warn(`${sourceType}[${index}]: missing ObjectIdentifier, skipped`);
+    return;
+  }
+  const properties = normalizeProperties(field(raw, "Properties"));
+  const label = asString(properties.name) ?? asString(properties.distinguishedname) ?? objectId;
+  const domainSid = normalizeObjectId(properties.domainsid) ?? (defaultKind === "Domain" ? objectId : void 0);
+  builder.node({
+    objectId,
+    label,
+    kind: normalizeNodeKind(field(raw, "ObjectType"), defaultKind),
+    ...domainSid ? { domainSid } : {},
+    properties
+  });
+  parseAces(builder, raw, objectId, sourceType, index);
+  parseMembership(builder, raw, objectId);
+  parseComputerCollections(builder, raw, objectId);
+  parseDelegation(builder, raw, objectId);
+  parseContainment(builder, raw, objectId, defaultKind);
+  parseTrusts(builder, raw, objectId);
+}
+function parseAces(builder, raw, objectId, sourceType, index) {
+  for (const ace of asArray(field(raw, "Aces"))) {
+    if (!isRecord(ace))
+      continue;
+    const principal = normalizeObjectId(field(ace, "PrincipalSID", "principalsid"));
+    const kind = normalizeEdgeKind(field(ace, "RightName", "rightname"));
+    if (!principal || !kind) {
+      builder.warn(`${sourceType}[${index}]: ACE missing PrincipalSID or RightName, skipped`);
+      continue;
+    }
+    builder.reference(principal, normalizeNodeKind(field(ace, "PrincipalType"), "Base"));
+    builder.edge(principal, objectId, kind, { isinherited: field(ace, "IsInherited") === true });
+  }
+}
+function parseMembership(builder, raw, objectId) {
+  for (const member of readResultList(field(raw, "Members"))) {
+    const memberId = readReference(builder, member, "Base");
+    if (memberId)
+      builder.edge(memberId, objectId, "MemberOf");
+  }
+  const primaryGroup = normalizeObjectId(field(raw, "PrimaryGroupSID"));
+  if (primaryGroup) {
+    builder.reference(primaryGroup, "Group");
+    builder.edge(objectId, primaryGroup, "MemberOf");
+  }
+  for (const sidHistory of readResultList(field(raw, "HasSIDHistory"))) {
+    const targetId = readReference(builder, sidHistory, "Base");
+    if (targetId)
+      builder.edge(objectId, targetId, "HasSIDHistory");
+  }
+}
+function parseComputerCollections(builder, raw, objectId) {
+  for (const [name, kind] of PRINCIPAL_TO_COMPUTER_COLLECTIONS) {
+    for (const entry of readResultList(field(raw, name))) {
+      const principalId = readReference(builder, entry, "Base");
+      if (principalId)
+        builder.edge(principalId, objectId, kind);
+    }
+  }
+  for (const session of readResultList(field(raw, "Sessions", "PrivilegedSessions", "RegistrySessions"))) {
+    if (!isRecord(session))
+      continue;
+    const userSid = normalizeObjectId(field(session, "UserSID"));
+    const computerSid = normalizeObjectId(field(session, "ComputerSID")) ?? objectId;
+    if (!userSid)
+      continue;
+    builder.reference(userSid, "User");
+    builder.reference(computerSid, "Computer");
+    builder.edge(computerSid, userSid, "HasSession");
+  }
+  for (const smsa of readResultList(field(raw, "DumpSMSAPassword"))) {
+    const principalId = readReference(builder, smsa, "User");
+    if (principalId)
+      builder.edge(objectId, principalId, "DumpSMSAPassword");
+  }
+}
+function parseDelegation(builder, raw, objectId) {
+  for (const target of readResultList(field(raw, "AllowedToDelegate"))) {
+    const targetId = readReference(builder, target, "Computer");
+    if (targetId)
+      builder.edge(objectId, targetId, "AllowedToDelegate");
+  }
+  for (const spnTarget of asArray(field(raw, "SPNTargets"))) {
+    if (!isRecord(spnTarget))
+      continue;
+    const computerSid = normalizeObjectId(field(spnTarget, "ComputerSID"));
+    if (!computerSid)
+      continue;
+    const service = asString(field(spnTarget, "Service")) ?? "";
+    if (service.toLowerCase() !== "sqladmin")
+      continue;
+    builder.reference(computerSid, "Computer");
+    builder.edge(objectId, computerSid, "SQLAdmin", { port: field(spnTarget, "Port") });
+  }
+}
+function parseContainment(builder, raw, objectId, defaultKind) {
+  for (const child of readResultList(field(raw, "ChildObjects"))) {
+    const childId = readReference(builder, child, "Base");
+    if (childId)
+      builder.edge(objectId, childId, "Contains");
+  }
+  for (const link of readResultList(field(raw, "Links"))) {
+    if (!isRecord(link))
+      continue;
+    const gpoId = normalizeObjectId(field(link, "Guid", "GUID", "ObjectIdentifier"));
+    if (!gpoId)
+      continue;
+    builder.reference(gpoId, "GPO");
+    builder.edge(gpoId, objectId, "GPLink", { isenforced: field(link, "IsEnforced") === true });
+  }
+  if (defaultKind === "Computer") {
+    const containedBy = field(raw, "ContainedBy");
+    const parentId = readReference(builder, containedBy, "Container");
+    if (parentId)
+      builder.edge(parentId, objectId, "Contains");
+  }
+}
+function parseTrusts(builder, raw, objectId) {
+  for (const trust of asArray(field(raw, "Trusts"))) {
+    if (!isRecord(trust))
+      continue;
+    const targetSid = normalizeObjectId(field(trust, "TargetDomainSid"));
+    if (!targetSid)
+      continue;
+    builder.reference(targetSid, "Domain", asString(field(trust, "TargetDomainName")));
+    const direction = Number(field(trust, "TrustDirection") ?? 0);
+    const properties = {
+      istransitive: field(trust, "IsTransitive") === true,
+      sidfilteringenabled: field(trust, "SidFilteringEnabled") === true,
+      trusttype: field(trust, "TrustType")
+    };
+    if (direction === 1 || direction === 3)
+      builder.edge(objectId, targetSid, "TrustedBy", properties);
+    if (direction === 2 || direction === 3)
+      builder.edge(targetSid, objectId, "TrustedBy", properties);
+  }
+}
+function parseGraphExport(builder, nodesRaw, edgesRaw) {
+  const byGraphId = /* @__PURE__ */ new Map();
+  for (const [graphId, value] of Object.entries(nodesRaw)) {
+    if (!isRecord(value))
+      continue;
+    const objectId = normalizeObjectId(field(value, "objectId", "ObjectIdentifier", "objectid")) ?? graphId.toUpperCase();
+    byGraphId.set(graphId, objectId);
+    builder.node({
+      objectId,
+      label: asString(field(value, "label", "name")) ?? objectId,
+      kind: normalizeNodeKind(field(value, "kind", "ObjectType"), "Base"),
+      properties: normalizeProperties(field(value, "properties", "Properties"))
+    });
+  }
+  for (const [index, value] of edgesRaw.entries()) {
+    if (!isRecord(value))
+      continue;
+    const kind = normalizeEdgeKind(field(value, "kind", "label", "RightName"));
+    const rawSource = asString(field(value, "source"));
+    const rawTarget = asString(field(value, "target"));
+    if (!kind || !rawSource || !rawTarget) {
+      builder.warn(`graph export edge[${index}]: missing source, target or kind, skipped`);
+      continue;
+    }
+    const source = byGraphId.get(rawSource) ?? rawSource.toUpperCase();
+    const target = byGraphId.get(rawTarget) ?? rawTarget.toUpperCase();
+    builder.reference(source, "Base");
+    builder.reference(target, "Base");
+    builder.edge(source, target, kind);
+  }
+}
+function parseBloodHoundFile(raw) {
+  const builder = new ChunkBuilder();
+  if (!isRecord(raw)) {
+    builder.warn("file is not a JSON object, skipped");
+    return { nodes: [], edges: [], warnings: builder.warnings };
+  }
+  const meta = isRecord(raw.meta) ? raw.meta : {};
+  const sourceType = asString(meta.type)?.toLowerCase();
+  const versionValue = Number(meta.version);
+  const collectorVersion = Number.isFinite(versionValue) ? versionValue : void 0;
+  const data = raw.data ?? raw.Data;
+  if (isRecord(data) && (isRecord(data.nodes) || Array.isArray(data.edges))) {
+    parseGraphExport(builder, isRecord(data.nodes) ? data.nodes : {}, asArray(data.edges));
+    return {
+      nodes: builder.nodes,
+      edges: builder.edges,
+      sourceType: sourceType ?? "graph-export",
+      collectorVersion,
+      warnings: builder.warnings
+    };
+  }
+  if (!Array.isArray(data)) {
+    builder.warn(`file has no usable "data" array (meta.type=${sourceType ?? "unknown"})`);
+    return { nodes: [], edges: [], sourceType, collectorVersion, warnings: builder.warnings };
+  }
+  const defaultKind = (sourceType && FILE_TYPE_TO_NODE_KIND[sourceType]) ?? "Base";
+  if (sourceType && !FILE_TYPE_TO_NODE_KIND[sourceType]) {
+    builder.warn(`unknown collector type "${sourceType}", nodes kept with ObjectType fallback`);
+  }
+  for (const [index, entry] of data.entries()) {
+    parseCollectorObject(builder, entry, defaultKind, index, sourceType ?? "unknown");
+  }
+  return {
+    nodes: builder.nodes,
+    edges: builder.edges,
+    sourceType,
+    collectorVersion,
+    warnings: builder.warnings
+  };
+}
+function buildAdGraph(nodes, edges, meta = {}) {
+  const nodeMap = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    if (!node.objectId)
+      continue;
+    const existing = nodeMap.get(node.objectId);
+    if (!existing) {
+      nodeMap.set(node.objectId, node);
+      continue;
+    }
+    if (existing.stub && !node.stub) {
+      nodeMap.set(node.objectId, node);
+      continue;
+    }
+    if (existing.kind === "Base" && node.kind !== "Base")
+      existing.kind = node.kind;
+    if (existing.label === existing.objectId && node.label !== node.objectId)
+      existing.label = node.label;
+    if (!existing.domainSid && node.domainSid)
+      existing.domainSid = node.domainSid;
+    if (existing.stub && node.stub && Object.keys(node.properties).length > 0) {
+      existing.properties = { ...node.properties, ...existing.properties };
+    }
+  }
+  const outbound = /* @__PURE__ */ new Map();
+  const inbound = /* @__PURE__ */ new Map();
+  const edgesByKind = /* @__PURE__ */ new Map();
+  const dedupedEdges = [];
+  const seenEdges = /* @__PURE__ */ new Set();
+  const push = (index, key, value) => {
+    const bucket = index.get(key);
+    if (bucket)
+      bucket.push(value);
+    else
+      index.set(key, [value]);
+  };
+  for (const edge of edges) {
+    if (!edge.source || !edge.target || !edge.kind)
+      continue;
+    const key = `${edge.source}\0${edge.kind}\0${edge.target}`;
+    if (seenEdges.has(key))
+      continue;
+    seenEdges.add(key);
+    if (!nodeMap.has(edge.source)) {
+      nodeMap.set(edge.source, { objectId: edge.source, label: edge.source, kind: "Base", properties: {}, stub: true });
+    }
+    if (!nodeMap.has(edge.target)) {
+      nodeMap.set(edge.target, { objectId: edge.target, label: edge.target, kind: "Base", properties: {}, stub: true });
+    }
+    const index = dedupedEdges.length;
+    dedupedEdges.push(edge);
+    push(outbound, edge.source, index);
+    push(inbound, edge.target, index);
+    push(edgesByKind, edge.kind, index);
+  }
+  const nodesByKind = /* @__PURE__ */ new Map();
+  for (const node of nodeMap.values())
+    push(nodesByKind, node.kind, node.objectId);
+  return {
+    nodes: nodeMap,
+    edges: dedupedEdges,
+    outbound,
+    inbound,
+    nodesByKind,
+    edgesByKind,
+    meta: {
+      sourceTypes: meta.sourceTypes ?? [],
+      collectorVersion: meta.collectorVersion,
+      nodeCount: nodeMap.size,
+      edgeCount: dedupedEdges.length,
+      warnings: meta.warnings ?? [],
+      ingestedAt: meta.ingestedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+}
+function ingestBloodHoundFiles(files) {
+  const nodes = [];
+  const edges = [];
+  const warnings = [];
+  const sourceTypes = [];
+  let collectorVersion;
+  for (const [index, file] of files.entries()) {
+    const chunk = parseBloodHoundFile(file);
+    nodes.push(...chunk.nodes);
+    edges.push(...chunk.edges);
+    for (const warning of chunk.warnings)
+      warnings.push(`file[${index}]: ${warning}`);
+    if (chunk.sourceType && !sourceTypes.includes(chunk.sourceType))
+      sourceTypes.push(chunk.sourceType);
+    if (chunk.collectorVersion !== void 0) {
+      collectorVersion = Math.max(collectorVersion ?? 0, chunk.collectorVersion);
+    }
+  }
+  return buildAdGraph(nodes, edges, { sourceTypes, collectorVersion, warnings });
+}
+function ingestBloodHoundJson(texts) {
+  const parsed = [];
+  const parseErrors = [];
+  for (const [index, text] of texts.entries()) {
+    try {
+      parsed.push(JSON.parse(text));
+    } catch (error) {
+      parseErrors.push(`file[${index}]: invalid JSON (${error.message})`);
+    }
+  }
+  const graph = ingestBloodHoundFiles(parsed);
+  graph.meta.warnings = [...parseErrors, ...graph.meta.warnings];
+  return graph;
+}
+
+// packages/core/dist/adgraph/index.js
+var SEVERITY_RANK = { info: 1, low: 2, medium: 3, high: 4, critical: 5 };
+function summarize(findings) {
+  const principals = /* @__PURE__ */ new Set();
+  const analyzersFired = /* @__PURE__ */ new Set();
+  let topSeverity = "info";
+  let criticalCount = 0;
+  let highCount = 0;
+  let mediumCount = 0;
+  let lowCount = 0;
+  for (const item of findings) {
+    analyzersFired.add(item.analyzer);
+    for (const principal of item.affectedPrincipals)
+      principals.add(principal);
+    if (SEVERITY_RANK[item.severity] > SEVERITY_RANK[topSeverity])
+      topSeverity = item.severity;
+    if (item.severity === "critical")
+      criticalCount += 1;
+    else if (item.severity === "high")
+      highCount += 1;
+    else if (item.severity === "medium")
+      mediumCount += 1;
+    else if (item.severity === "low")
+      lowCount += 1;
+  }
+  return {
+    findingCount: findings.length,
+    criticalCount,
+    highCount,
+    mediumCount,
+    lowCount,
+    topSeverity,
+    analyzersFired: [...analyzersFired],
+    affectedPrincipalCount: principals.size
+  };
+}
+function runAdGraphAnalysis(graph, opts = {}) {
+  const findings = [];
+  const warnings = [...graph.meta.warnings];
+  for (const analyzer of AD_ANALYZERS) {
+    try {
+      findings.push(...analyzer(graph, opts));
+    } catch (error) {
+      warnings.push(`analyzer ${analyzer.name} failed: ${error.message}`);
+    }
+  }
+  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || (a.paths[0]?.length ?? Number.MAX_SAFE_INTEGER) - (b.paths[0]?.length ?? Number.MAX_SAFE_INTEGER) || a.id.localeCompare(b.id));
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: { ...graph.meta, warnings },
+    summary: summarize(findings),
+    findings
+  };
+}
+var AD_ANALYZERS_BY_ID = {
+  "paths-to-domain-admin": findPathsToDomainAdmin,
+  "kerberoastable-paths": findKerberoastablePaths,
+  "unconstrained-delegation": findUnconstrainedDelegation,
+  "dcsync-principals": findDcsyncPrincipals,
+  "acl-abuse-chains": findAclAbuseChains,
+  "adcs-escalation": findAdcsEscalation
+};
+
+export {
+  parseBloodHoundFile,
+  buildAdGraph,
+  ingestBloodHoundFiles,
+  ingestBloodHoundJson,
+  runAdGraphAnalysis,
+  AD_ANALYZERS_BY_ID
+};