@etcsec-com/etc-collector 1.4.0

package/src/types/adcs.types.ts

@@ -0,0 +1,107 @@
+/**
+ * ADCS (AD Certificate Services) Types
+ *
+ * Types for certificate templates and CAs used in ESC1-ESC11 vulnerability detection.
+ */
+
+/**
+ * ADCS Certificate Template
+ */
+export interface ADCSCertificateTemplate {
+  dn: string;
+  name: string;
+  displayName?: string;
+
+  // Template OID
+  'msPKI-Cert-Template-OID'?: string;
+
+  // Flags
+  'msPKI-Certificate-Name-Flag'?: number;
+  'msPKI-Enrollment-Flag'?: number;
+  'msPKI-Private-Key-Flag'?: number;
+  'msPKI-RA-Signature'?: number;
+
+  // Schema version (1 = legacy, 2+ = newer with security extension support)
+  'msPKI-Template-Schema-Version'?: number;
+
+  // Extended Key Usage OIDs
+  pKIExtendedKeyUsage?: string[];
+
+  // Security descriptor for ACL analysis
+  nTSecurityDescriptor?: Buffer;
+
+  // cn field (used for matching)
+  cn?: string;
+}
+
+/**
+ * ADCS Certificate Authority
+ */
+export interface ADCSCertificateAuthority {
+  dn: string;
+  name: string;
+  dNSHostName: string;
+
+  // CA configuration
+  certificateTemplates?: string[];
+  cACertificate?: Buffer;
+
+  // Security descriptor
+  nTSecurityDescriptor?: Buffer;
+}
+
+// Certificate Name Flags (msPKI-Certificate-Name-Flag)
+export const CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x00000001;
+export const CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME = 0x00010000;
+export const CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH = 0x80000000;
+export const CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME = 0x40000000;
+export const CT_FLAG_SUBJECT_REQUIRE_EMAIL = 0x20000000;
+export const CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN = 0x10000000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_UPN = 0x02000000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL = 0x04000000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_SPN = 0x00800000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID = 0x01000000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_DNS = 0x08000000;
+export const CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS = 0x00400000;
+
+// Enrollment Flags (msPKI-Enrollment-Flag)
+export const CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS = 0x00000001;
+export const CT_FLAG_PEND_ALL_REQUESTS = 0x00000002; // Manager approval required
+export const CT_FLAG_PUBLISH_TO_KRA_CONTAINER = 0x00000004;
+export const CT_FLAG_PUBLISH_TO_DS = 0x00000008;
+export const CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE = 0x00000010;
+export const CT_FLAG_AUTO_ENROLLMENT = 0x00000020;
+export const CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT = 0x00000040;
+export const CT_FLAG_USER_INTERACTION_REQUIRED = 0x00000100;
+export const CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE = 0x00000400;
+export const CT_FLAG_ALLOW_ENROLL_ON_BEHALF_OF = 0x00000800;
+export const CT_FLAG_ADD_OCSP_NOCHECK = 0x00001000;
+export const CT_FLAG_ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL = 0x00002000;
+export const CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS = 0x00004000;
+export const CT_FLAG_INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS = 0x00008000;
+export const CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT = 0x00010000;
+export const CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST = 0x00020000;
+
+// Common Extended Key Usage OIDs
+export const EKU_CLIENT_AUTH = '1.3.6.1.5.5.7.3.2';
+export const EKU_PKIINIT_CLIENT_AUTH = '1.3.6.1.5.2.3.4';
+export const EKU_SMART_CARD_LOGON = '1.3.6.1.4.1.311.20.2.2';
+export const EKU_ANY_PURPOSE = '2.5.29.37.0';
+export const EKU_CERTIFICATE_REQUEST_AGENT = '1.3.6.1.4.1.311.20.2.1'; // Enrollment Agent
+export const EKU_SERVER_AUTH = '1.3.6.1.5.5.7.3.1';
+
+/**
+ * ESC vulnerability type enum
+ */
+export type ESCVulnerabilityType =
+  | 'ESC1'
+  | 'ESC2'
+  | 'ESC3'
+  | 'ESC4'
+  | 'ESC5'
+  | 'ESC6'
+  | 'ESC7'
+  | 'ESC8'
+  | 'ESC9'
+  | 'ESC10'
+  | 'ESC11';

package/src/types/attack-graph.types.ts

@@ -0,0 +1,260 @@
+/**
+ * Attack Graph Export Types
+ *
+ * Types for exporting attack path data in a format suitable
+ * for visualization tools like BloodHound or custom graph UIs.
+ */
+
+/**
+ * Node types in the attack graph
+ */
+export type AttackNodeType = 'user' | 'group' | 'computer' | 'gpo' | 'ou' | 'domain';
+
+/**
+ * Risk levels for attack paths
+ */
+export type AttackPathRisk = 'critical' | 'high' | 'medium' | 'low';
+
+/**
+ * Types of attack paths
+ */
+export type AttackPathType =
+  | 'ACL_ABUSE'
+  | 'KERBEROASTING'
+  | 'ASREP_ROASTING'
+  | 'DELEGATION_ABUSE'
+  | 'LATERAL_MOVEMENT'
+  | 'CERTIFICATE_ABUSE'
+  | 'GROUP_MEMBERSHIP'
+  | 'DCSYNC'
+  | 'OWNERSHIP_ABUSE';
+
+/**
+ * Relation types between nodes
+ */
+export type AttackRelationType =
+  | 'MemberOf'
+  | 'GenericAll'
+  | 'WriteDacl'
+  | 'WriteOwner'
+  | 'GenericWrite'
+  | 'ForceChangePassword'
+  | 'AddMember'
+  | 'DCSync'
+  | 'AllowedToDelegate'
+  | 'AllowedToAct'
+  | 'HasSPN'
+  | 'NoPreauth'
+  | 'Owns'
+  | 'AdminTo'
+  | 'HasSession'
+  | 'CanPSRemote'
+  | 'CanRDP'
+  | 'ExecuteDCOM'
+  | 'SQLAdmin'
+  | 'ReadLAPSPassword'
+  | 'ReadGMSAPassword'
+  | 'Contains'
+  | 'GPLink'
+  | 'TrustedBy';
+
+/**
+ * A node in the attack graph
+ */
+export interface AttackGraphNode {
+  id: string; // SID or unique identifier
+  name: string; // sAMAccountName or displayName
+  type: AttackNodeType;
+  sid?: string;
+  dn?: string;
+  domain?: string;
+  isEnabled?: boolean;
+  isPrivileged?: boolean;
+}
+
+/**
+ * A relation in the attack chain
+ */
+export interface AttackGraphRelation {
+  relation: AttackRelationType;
+  isAbusable: boolean;
+  accessMask?: number;
+  objectType?: string;
+  description?: string;
+}
+
+/**
+ * Chain element - either a node or a relation
+ */
+export type AttackChainElement = AttackGraphNode | AttackGraphRelation;
+
+/**
+ * Entry point properties for an attack path
+ */
+export interface AttackEntryPointProperties {
+  hasSPN?: boolean;
+  noPreauth?: boolean;
+  passwordNotExpire?: boolean;
+  unconstrained?: boolean;
+  constrained?: boolean;
+  rbcd?: boolean;
+  adminCount?: boolean;
+  enabled?: boolean;
+}
+
+/**
+ * Entry point for an attack path
+ */
+export interface AttackEntryPoint {
+  id: string;
+  name: string;
+  type: AttackNodeType;
+  properties: AttackEntryPointProperties;
+}
+
+/**
+ * A complete attack path
+ */
+export interface AttackPath {
+  id: string; // path-001, path-002, etc.
+  risk: AttackPathRisk;
+  type: AttackPathType;
+  hops: number;
+  description: string;
+  chain: AttackChainElement[];
+  entryPoint: AttackEntryPoint;
+  target: AttackGraphNode;
+  mitigation: string;
+}
+
+/**
+ * Target information
+ */
+export interface AttackTarget {
+  id: string;
+  name: string;
+  type: AttackNodeType;
+  sid?: string;
+  dn?: string;
+  reason: string; // Why this is a target (e.g., "Domain Admins", "adminCount=1")
+}
+
+/**
+ * Statistics for the attack graph
+ */
+export interface AttackGraphStats {
+  totalPaths: number;
+  byRisk: {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+  };
+  byType: Record<AttackPathType, number>;
+  averageHops: number;
+  shortestPath: number;
+  longestPath: number;
+}
+
+/**
+ * Unique node with path count
+ */
+export interface AttackGraphUniqueNode {
+  id: string;
+  name: string;
+  type: AttackNodeType;
+  pathCount: number; // Number of paths this node appears in
+  sid?: string;
+}
+
+/**
+ * Complete attack graph export format
+ */
+export interface AttackGraphExport {
+  version: string;
+  generatedAt: string; // ISO 8601 timestamp
+  domain: string;
+  targets: AttackTarget[];
+  paths: AttackPath[];
+  stats: AttackGraphStats;
+  uniqueNodes: AttackGraphUniqueNode[];
+}
+
+/**
+ * ACL GUIDs for specific rights
+ */
+export const ACL_GUIDS = {
+  // Extended rights
+  FORCE_CHANGE_PASSWORD: '00299570-246d-11d0-a768-00aa006e0529',
+  DS_REPLICATION_GET_CHANGES: '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2',
+  DS_REPLICATION_GET_CHANGES_ALL: '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2',
+  DS_REPLICATION_GET_CHANGES_IN_FILTERED_SET: '89e95b76-444d-4c62-991a-0facbeda640c',
+
+  // Property sets
+  SELF_MEMBERSHIP: 'bf9679c0-0de6-11d0-a285-00aa003049e2', // Add self to group
+
+  // Schema objects for LAPS
+  LAPS_PASSWORD: 'e91556f8-b3c8-4b66-b3c8-4b0c8ac2c45b',
+
+  // Certificate enrollment
+  CERTIFICATE_ENROLLMENT: '0e10c968-78fb-11d2-90d4-00c04f79dc55',
+  CERTIFICATE_AUTOENROLLMENT: 'a05b8cc2-17bc-4802-a710-e7c15ab866a2',
+} as const;
+
+/**
+ * Access mask bits for ACL analysis
+ */
+export const ACCESS_MASK = {
+  GENERIC_READ: 0x80000000,
+  GENERIC_WRITE: 0x40000000,
+  GENERIC_EXECUTE: 0x20000000,
+  GENERIC_ALL: 0x10000000,
+  MAXIMUM_ALLOWED: 0x02000000,
+  ACCESS_SYSTEM_SECURITY: 0x01000000,
+  SYNCHRONIZE: 0x00100000,
+  WRITE_OWNER: 0x00080000,
+  WRITE_DACL: 0x00040000,
+  READ_CONTROL: 0x00020000,
+  DELETE: 0x00010000,
+  WRITE_PROPERTY: 0x00000020,
+  READ_PROPERTY: 0x00000010,
+  SELF: 0x00000008,
+  LIST_OBJECT: 0x00000080,
+  DELETE_TREE: 0x00000040,
+  CONTROL_ACCESS: 0x00000100, // Extended right
+} as const;
+
+/**
+ * Well-known privileged SID suffixes (relative to domain SID)
+ */
+export const PRIVILEGED_SID_SUFFIXES = {
+  DOMAIN_ADMINS: '-512',
+  DOMAIN_USERS: '-513',
+  DOMAIN_GUESTS: '-514',
+  DOMAIN_COMPUTERS: '-515',
+  DOMAIN_CONTROLLERS: '-516',
+  SCHEMA_ADMINS: '-518',
+  ENTERPRISE_ADMINS: '-519',
+  GROUP_POLICY_CREATOR_OWNERS: '-520',
+  KEY_ADMINS: '-526',
+  ENTERPRISE_KEY_ADMINS: '-527',
+  ADMINISTRATORS: '-544',
+  BACKUP_OPERATORS: '-551',
+  ACCOUNT_OPERATORS: '-548',
+  SERVER_OPERATORS: '-549',
+  PRINT_OPERATORS: '-550',
+} as const;
+
+/**
+ * Check if a node element in chain
+ */
+export function isAttackGraphNode(element: AttackChainElement): element is AttackGraphNode {
+  return 'type' in element && 'name' in element && !('relation' in element);
+}
+
+/**
+ * Check if a relation element in chain
+ */
+export function isAttackGraphRelation(element: AttackChainElement): element is AttackGraphRelation {
+  return 'relation' in element;
+}

package/src/types/audit.types.ts

@@ -0,0 +1,42 @@
+import { Finding } from './finding.types';
+
+/**
+ * Audit Types
+ */
+
+export type Provider = 'active-directory' | 'azure';
+
+export interface AuditOptions {
+  includeDetails?: boolean;
+  includeComputers?: boolean;
+  includeConfig?: boolean;
+}
+
+export interface AuditSummary {
+  totalFindings: number;
+  critical: number;
+  high: number;
+  medium: number;
+  low: number;
+  riskScore: number;
+  categoryScores?: Record<string, number>;
+}
+
+export interface AuditMetadata {
+  auditId: string;
+  provider: Provider;
+  timestamp: string;
+  duration: number; // milliseconds
+  objectsCounted?: {
+    users?: number;
+    groups?: number;
+    computers?: number;
+    policies?: number;
+  };
+}
+
+export interface AuditResult {
+  metadata: AuditMetadata;
+  summary: AuditSummary;
+  findings: Finding[];
+}

package/src/types/azure.types.ts

@@ -0,0 +1,68 @@
+/**
+ * Azure AD Types
+ */
+
+export interface AzureUser {
+  // Core identity
+  id: string;
+  userPrincipalName: string;
+  displayName?: string;
+  mail?: string;
+  givenName?: string;
+  surname?: string;
+
+  // Organization
+  jobTitle?: string;
+  department?: string;
+  companyName?: string;
+  manager?: { id?: string; displayName?: string } | string;
+  officeLocation?: string;
+  employeeId?: string;
+
+  // Dates
+  createdDateTime?: string;
+  lastSignInDateTime?: string;
+  lastPasswordChangeDateTime?: string;
+
+  // Security
+  accountEnabled: boolean;
+  userType?: string; // "Member" | "Guest"
+  riskLevel?: string;
+  riskState?: string;
+  isMfaRegistered?: boolean;
+  strongAuthenticationMethods?: unknown[];
+  assignedLicenses?: Array<{ skuId?: string }>;
+  memberOf?: Array<{ id?: string; displayName?: string }> | string[];
+  passwordPolicies?: string;
+
+  // Allow additional attributes
+  [key: string]: unknown;
+}
+
+export interface AzureGroup {
+  id: string;
+  displayName: string;
+  mailEnabled: boolean;
+  securityEnabled: boolean;
+  groupTypes?: string[];
+  members?: string[];
+  [key: string]: unknown;
+}
+
+export interface AzureApp {
+  id: string;
+  appId: string;
+  displayName: string;
+  createdDateTime?: string;
+  signInAudience?: string;
+  [key: string]: unknown;
+}
+
+export interface AzurePolicy {
+  id: string;
+  displayName: string;
+  state?: string;
+  conditions?: unknown;
+  grantControls?: unknown;
+  [key: string]: unknown;
+}

package/src/types/config.types.ts

@@ -0,0 +1,79 @@
+/**
+ * Configuration Types
+ */
+
+export interface ServerConfig {
+  port: number;
+  nodeEnv: 'development' | 'production' | 'test';
+}
+
+export interface JWTConfig {
+  privateKeyPath: string;
+  publicKeyPath: string;
+  tokenExpiry: string;
+  tokenMaxUses: number;
+}
+
+export interface InfoEndpointsConfig {
+  tokenInfoEnabled: boolean;
+  providersInfoEnabled: boolean;
+}
+
+export interface LDAPConfig {
+  url: string;
+  bindDN: string;
+  bindPassword: string;
+  baseDN: string;
+  tlsVerify: boolean;
+  caCertPath?: string;
+  timeout: number;
+  skipHostnameVerification?: boolean;
+  tlsServername?: string;
+}
+
+export interface AzureConfig {
+  enabled: boolean;
+  tenantId?: string;
+  tenantName?: string;
+  clientId?: string;
+  clientSecret?: string;
+}
+
+export interface SMBConfig {
+  enabled: boolean;
+  /** Username for SMB auth (defaults to LDAP user if not set) */
+  username?: string;
+  /** Password for SMB auth (defaults to LDAP password if not set) */
+  password?: string;
+  /** Connection timeout in ms */
+  timeout: number;
+}
+
+/** Azure config with required credentials (for GraphProvider) */
+export interface AzureProviderConfig {
+  tenantId: string;
+  clientId: string;
+  clientSecret: string;
+}
+
+export interface LoggingConfig {
+  level: 'error' | 'warn' | 'info' | 'debug';
+  format: 'json' | 'simple';
+}
+
+export interface DatabaseConfig {
+  path: string;
+  enableWAL: boolean;
+  busyTimeout: number;
+}
+
+export interface AppConfig {
+  server: ServerConfig;
+  infoEndpoints: InfoEndpointsConfig;
+  jwt: JWTConfig;
+  ldap: LDAPConfig;
+  azure: AzureConfig;
+  smb: SMBConfig;
+  logging: LoggingConfig;
+  database: DatabaseConfig;
+}

package/src/types/error.types.ts

@@ -0,0 +1,69 @@
+/**
+ * Custom Error Classes
+ */
+
+export class BaseError extends Error {
+  constructor(
+    message: string,
+    public statusCode: number = 500,
+    public isOperational: boolean = true
+  ) {
+    super(message);
+    this.name = this.constructor.name;
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export class AuthenticationError extends BaseError {
+  constructor(message = 'Authentication failed') {
+    super(message, 401);
+  }
+}
+
+export class AuthorizationError extends BaseError {
+  constructor(message = 'Insufficient permissions') {
+    super(message, 403);
+  }
+}
+
+export class ValidationError extends BaseError {
+  constructor(message = 'Validation failed') {
+    super(message, 400);
+  }
+}
+
+export class NotFoundError extends BaseError {
+  constructor(message = 'Resource not found') {
+    super(message, 404);
+  }
+}
+
+export class LDAPConnectionError extends BaseError {
+  constructor(message = 'LDAP connection failed') {
+    super(message, 503);
+  }
+}
+
+export class GraphAPIError extends BaseError {
+  constructor(message = 'Graph API request failed') {
+    super(message, 502);
+  }
+}
+
+export class AuditExecutionError extends BaseError {
+  constructor(message = 'Audit execution failed') {
+    super(message, 500);
+  }
+}
+
+export class TokenExpiredError extends BaseError {
+  constructor(message = 'Token has expired') {
+    super(message, 401);
+  }
+}
+
+export class RateLimitError extends BaseError {
+  constructor(message = 'Rate limit exceeded') {
+    super(message, 429);
+  }
+}