BED-3868: Build contains edges from DNs (ADCS)

BloodHoundAD · Nov 9, 2023 · f694291 · f694291
1 parent fe6c8a8
commit f694291
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/src/Producers/BaseProducer.cs b/src/Producers/BaseProducer.cs
@@ -161,7 +161,7 @@ protected LDAPData CreateConfigNCData()
             {
                 if ((methods & ResolvedCollectionMethod.Container) != 0)
                 {
-                    query = query.AddContainers();
+                    query = query.AddContainers().AddCertificateTemplates().AddCertificateAuthorities().AddEnterpriseCertificationAuthorities();
                     props.AddRange(CommonProperties.ContainerProps);
                 }
 

diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
@@ -566,6 +566,11 @@ private async Task<RootCA> ProcessRootCA(ISearchResultEntry entry, ResolvedSearc
                 ret.Properties.Merge(props);
             }
 
+            if ((_methods & ResolvedCollectionMethod.Container) != 0)
+            {
+                ret.ContainedBy = _containerProcessor.GetContainingObject(entry.DistinguishedName);
+            }
+
             return ret;
         }
 
@@ -593,6 +598,11 @@ private async Task<AIACA> ProcessAIACA(ISearchResultEntry entry, ResolvedSearchR
                 ret.Properties.Merge(props);
             }
 
+            if ((_methods & ResolvedCollectionMethod.Container) != 0)
+            {
+                ret.ContainedBy = _containerProcessor.GetContainingObject(entry.DistinguishedName);
+            }
+
             return ret;
         }
 
@@ -623,6 +633,11 @@ private async Task<EnterpriseCA> ProcessEnterpriseCA(ISearchResultEntry entry, R
                 ret.EnabledCertTemplates = _certAbuseProcessor.ProcessCertTemplates(entry.GetArrayProperty(LDAPProperties.CertificateTemplates), resolvedSearchResult.Domain).ToArray();
             }
 
+            if ((_methods & ResolvedCollectionMethod.Container) != 0)
+            {
+                ret.ContainedBy = _containerProcessor.GetContainingObject(entry.DistinguishedName);
+            }
+
             // Collect properties from CA server registry
             bool cASecurityCollected = false;
             bool enrollmentAgentRestrictionsCollected = false;
@@ -688,6 +703,11 @@ private async Task<NTAuthStore> ProcessNTAuthStore(ISearchResultEntry entry, Res
                 ret.Properties.Merge(props);
             }
 
+            if ((_methods & ResolvedCollectionMethod.Container) != 0)
+            {
+                ret.ContainedBy = _containerProcessor.GetContainingObject(entry.DistinguishedName);
+            }
+
             return ret;
         }
 
@@ -714,6 +734,12 @@ private async Task<CertTemplate> ProcessCertTemplate(ISearchResultEntry entry, R
                 var certTemplatesProps = LDAPPropertyProcessor.ReadCertTemplateProperties(entry);
                 ret.Properties.Merge(certTemplatesProps);
             }
+
+            if ((_methods & ResolvedCollectionMethod.Container) != 0)
+            {
+                ret.ContainedBy = _containerProcessor.GetContainingObject(entry.DistinguishedName);
+            }
+
             return ret;
         }
     }