Merge pull request #1 from JJK96/pr-1

- Update to the latest Certipy version
- Use Certipy for interpreting results and assigning vulnerability classes
- Since we now use Certipy for outputting, we might as well make this configurable by copying the output options (text, json, csv) from Certipy.
- Allow supplying user SIDs, which is necessary for finding templates where the user can enroll
- Allow using BloodHound to resolve SIDs dynamically and for obtaining the SIDs of owned users
- Allow parsing output of Outflank C2's reg query command

Author: Anthirian

README.md

@@ -1,57 +1,140 @@
 # regcertipy
-Parses cached certificate templates from a Windows Registry `.reg` file and 
-displays them in the same style as 
-[Certipy](https://github.com/ly4k/Certipy) does.
+
+Parses cached certificate templates from a Windows Registry `.reg` file and displays them in the same style as [Certipy](https://github.com/ly4k/Certipy) does.
 
 ## Getting started
-We prefer using the [uv package manager](https://docs.astral.sh/uv/), as it 
-will automatically create a virtual environment for you. Alternatively, you 
-can use `pip install regcertipy` within any other Python environment that 
-you manage.
+
+We prefer using the [uv package manager](https://docs.astral.sh/uv/), as it will automatically create a virtual environment for you. Alternatively, you can use `pip install regcertipy` within any other Python environment that you manage.
 
 ```
 $ uv venv
 $ source .venv/bin/activate
 $ uv pip install regcertipy
 $ regcertipy -h
-usage: regcertipy [-h] regfile
+usage: regcertipy [-h] [-s SID_FILE] [-f {.reg,reg_bof}] [-text] [-stdout]
+                  [-json] [-csv] [-output prefix] [--neo4j-user NEO4J_USER]
+                  [--neo4j-pass NEO4J_PASS] [--neo4j-host NEO4J_HOST]
+                  [--neo4j-port NEO4J_PORT] [--use-owned-sids]
+                  regfile
 
 Regfile ingestor for Certipy
 
 positional arguments:
-  regfile     Path to the .reg file.
+  regfile               Path to the .reg file.
 
 options:
-  -h, --help  show this help message and exit
+  -h, --help            show this help message and exit
+  -s SID_FILE, --sid-file SID_FILE
+                        File containing the user's SIDs
+  -f {.reg,reg_bof}, --input-format {.reg,reg_bof}
+                        Format of input file
+
+output options:
+  -text                 Output result as formatted text file
+  -stdout               Output result as text directly to console
+  -json                 Output result as JSON
+  -csv                  Output result as CSV
+  -output prefix        Filename prefix for writing results to
+
+BloodHound:
+  --neo4j-user NEO4J_USER
+                        Username for neo4j
+  --neo4j-pass NEO4J_PASS
+                        Password for neo4j
+  --neo4j-host NEO4J_HOST
+                        Host for neo4j
+  --neo4j-port NEO4J_PORT
+                        Port for neo4j
+  --use-owned-sids      Use the SIDs of all owned principals as the user SIDs
 ```
 
-Use regedit.exe to export the keys under 
-`HKEY_USERS\.DEFAULT\Software\ Microsoft\Cryptography\CertificateTemplateCache\`. 
-Then, the .reg file can be fed into regcertipy with: regcertipy <regfile>.
+Use regedit.exe to export the keys under `HKEY_USERS\.DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache\`. Then, the .reg file can be fed into regcertipy with: regcertipy <regfile>.
 
 ![Example of how to export a .reg file](resources/regedit.png)
 
+Alternatively, it is possible to parse output the Outflank C2 `reg query` command by specifying the `-f reg_bof` flag. This parses the following (truncated) output.
+
+```
+[01/01/1970 12:34:56 PM] (finished) Outflank > reg query -r HKEY_USERS\.DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache
+
+Reg Key:   HKEY_USERS\.DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache
+
+Reg Value: TimestampAfter
+Reg Type:  REG_BINARY
+Reg Data:  86F63B1D13E7DB01
+
+Reg Value: Timestamp
+Reg Type:  REG_BINARY
+Reg Data:  86F63B1D13E7DB01
+
+Reg Key:   HKEY_USERS\.DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache\Administrator
+
+Reg Value: DisplayName
+Reg Type:  REG_SZ
+Reg Data:  Administrator
+
+Reg Value: SupportedCSPs
+Reg Type:  REG_MULTI_SZ
+Reg Data:  Microsoft Enhanced Cryptographic Provider v1.0 Microsoft Base Cryptographic Provider v1.0                                                                                             
+
+Reg Value: ExtKeyUsageSyntax
+Reg Type:  REG_MULTI_SZ
+Reg Data:  1.3.6.1.4.1.311.10.3.1 1.3.6.1.4.1.311.10.3.4 1.3.6.1.5.5.7.3.4 1.3.6.1.5.5.7.3.2
+
+[...]
+```
+
+### SIDs
+
+Because `regcertipy` is intended for offline usage, SIDs cannot be dynamically resolved. Therefore, `regcertipy` includes a couple of options that can be used for offline SID information.
+
+Firstly, the `--sid-file` flag can be used to provide a list of SIDs that the user is a member of. This list can be obtained from BloodHound or other tools.
+
+Secondly, `regcertipy` can use a `neo4j` connection to dynamically resolve SIDs using BloodHound's database. This, combined with the `--use-owned-sids` command can help you find vulnerable templates exploitable by objects marked as owned in BloodHound.
+
 ## Development
-Note that we use the [Black code formatter](https://black.readthedocs.io/en/stable/) 
-for code formatting. Moreover, we use the Git Flow branching model, meaning 
-that we actively develop on the "develop" branch, and merge to the "main" 
-branch (& tag it) when a new release is made, making the "main" branch the 
-production branch.
+
+Note that we use the [Black code formatter](https://black.readthedocs.io/en/stable/) for code formatting. Moreover, we use the Git Flow branching model, meaning that we actively develop on the "develop" branch, and merge to the "main" branch (& tag it) when a new release is made, making the "main" branch the production branch.
 
 ```
 $ uv sync --dev # Also installs the Black code formatter.
 $ uv run black . # To format the current code base.
 $ uv run regcertipy -h
-usage: regcertipy [-h] regfile
+usage: regcertipy [-h] [-s SID_FILE] [-f {.reg,reg_bof}] [-text] [-stdout]
+                  [-json] [-csv] [-output prefix] [--neo4j-user NEO4J_USER]
+                  [--neo4j-pass NEO4J_PASS] [--neo4j-host NEO4J_HOST]
+                  [--neo4j-port NEO4J_PORT] [--use-owned-sids]
+                  regfile
 
 Regfile ingestor for Certipy
 
 positional arguments:
-  regfile     Path to the .reg file.
+  regfile               Path to the .reg file.
 
 options:
-  -h, --help  show this help message and exit
+  -h, --help            show this help message and exit
+  -s SID_FILE, --sid-file SID_FILE
+                        File containing the user's SIDs
+  -f {.reg,reg_bof}, --input-format {.reg,reg_bof}
+                        Format of input file
+
+output options:
+  -text                 Output result as formatted text file
+  -stdout               Output result as text directly to console
+  -json                 Output result as JSON
+  -csv                  Output result as CSV
+  -output prefix        Filename prefix for writing results to
+
+BloodHound:
+  --neo4j-user NEO4J_USER
+                        Username for neo4j
+  --neo4j-pass NEO4J_PASS
+                        Password for neo4j
+  --neo4j-host NEO4J_HOST
+                        Host for neo4j
+  --neo4j-port NEO4J_PORT
+                        Port for neo4j
+  --use-owned-sids      Use the SIDs of all owned principals as the user SIDs
 ```
 
-You can also run the `__init__.py` or `__main.py__` Python file in your 
-favourite debugger.
+You can also run the `__init__.py` or `__main.py__` Python file in your favourite debugger.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "regcertipy"
-version = "1.0.0"
+version = "1.1.0"
 description = """
 Parses cached certificate templates from a Windows Registry file and \
 displays them in the same style as Certipy does.
@@ -12,7 +12,8 @@ authors = [
 ]
 requires-python = ">=3.12"
 dependencies = [
-    "certipy-ad==4.8.2",
+    "certipy-ad==5.0.3",
+    "neo4j>=5.28.1",
 ]
 
 [project.scripts]

src/regcertipy/__init__.py

@@ -1,8 +1,64 @@
 import argparse
 
-from certipy.lib.formatting import pretty_print
+from certipy.commands.find import Find
 from regcertipy.models import CertTemplate
-from regcertipy.parsers import RegfileParser
+from regcertipy.parsers import RegfileParser, RegBofParser
+from datetime import datetime
+from .utils import sid_to_name
+import functools
+
+
+class MockTarget:
+    username = None
+
+
+class MockLDAPConnection:
+    user_sids = []
+
+    def __init__(self, sid_file, neo4j_driver=None, use_owned_sids=False):
+        self.neo4j_driver = neo4j_driver
+        if sid_file:
+            with open(sid_file) as f:
+                for line in f:
+                    self.user_sids.append(line[:-1])
+        if use_owned_sids and self.neo4j_driver:
+            self.get_owned_sids()
+
+    def get_user_sids(self, *args, **kwargs):
+        return self.user_sids
+
+    def get_owned_sids(self):
+        records, _, _ = self.neo4j_driver.execute_query(
+            "MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE COALESCE(u.system_tags, '') CONTAINS 'owned' return g.objectid"
+        )
+        for record in records:
+            self.user_sids.append(record["g.objectid"])
+
+    @functools.cache
+    def lookup_sid(self, sid, **kwargs):
+        name = sid_to_name(sid)
+        if name != sid:
+            return {"name": name}
+        if self.neo4j_driver:
+            records, _, _ = self.neo4j_driver.execute_query(
+                "MATCH (g {objectid:'%s'}) return g.name" % (sid,)
+            )
+            if records:
+                return {"name": records[0]["g.name"]}
+        return {"name": name}
+
+
+class MyFind(Find):
+    def get_template_properties(self, template, template_properties):
+        template_properties = super().get_template_properties(
+            template, template_properties
+        )
+        for key in ["Template OIDs"]:
+            template_oids = template.get(key)
+            if template_oids:
+                template_properties[key] = template_oids
+
+        return template_properties
 
 
 def main():
@@ -12,9 +68,68 @@ def main():
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
     parser.add_argument("regfile", help="Path to the .reg file.")
+    parser.add_argument("-s", "--sid-file", help="File containing the user's SIDs")
+    parser.add_argument(
+        "-f",
+        "--input-format",
+        choices=[".reg", "reg_bof"],
+        help="Format of input file",
+        default=".reg",
+    )
+    output_group = parser.add_argument_group("output options")
+    output_group.add_argument(
+        "-text",
+        action="store_true",
+        help="Output result as formatted text file",
+    )
+    output_group.add_argument(
+        "-stdout",
+        action="store_true",
+        help="Output result as text directly to console",
+    )
+    output_group.add_argument(
+        "-json",
+        action="store_true",
+        help="Output result as JSON",
+    )
+    output_group.add_argument(
+        "-csv",
+        action="store_true",
+        help="Output result as CSV",
+    )
+    output_group.add_argument(
+        "-output",
+        action="store",
+        metavar="prefix",
+        help="Filename prefix for writing results to",
+    )
+
+    bloodhound = parser.add_argument_group("BloodHound")
+    bloodhound.add_argument("--neo4j-user", help="Username for neo4j")
+    bloodhound.add_argument("--neo4j-pass", help="Password for neo4j")
+    bloodhound.add_argument("--neo4j-host", help="Host for neo4j", default="localhost")
+    bloodhound.add_argument("--neo4j-port", help="Port for neo4j", default=7687)
+    bloodhound.add_argument(
+        "--use-owned-sids",
+        help="Use the SIDs of all owned principals as the user SIDs",
+        action="store_true",
+    )
     args = parser.parse_args()
 
-    parser = RegfileParser(args.regfile)
+    if args.neo4j_user and args.neo4j_pass:
+        from neo4j import GraphDatabase
+
+        neo4j_driver = GraphDatabase.driver(
+            f"neo4j://{args.neo4j_host}:{args.neo4j_port}",
+            auth=(args.neo4j_user, args.neo4j_pass),
+        )
+    else:
+        neo4j_driver = None
+
+    if args.input_format == ".reg":
+        parser = RegfileParser(args.regfile)
+    elif args.input_format == "reg_bof":
+        parser = RegBofParser(args.regfile)
 
     templates = []
 
@@ -32,8 +147,25 @@ def main():
 
     print(f"[*] Found {len(templates)} templates in the registry")
 
+    templates = [template.to_dict() for template in templates]
+
+    find = MyFind(
+        target=MockTarget(),
+        connection=MockLDAPConnection(
+            args.sid_file, neo4j_driver=neo4j_driver, use_owned_sids=args.use_owned_sids
+        ),
+        stdout=args.stdout,
+        text=args.text,
+        json=args.json,
+    )
+
     for template in templates:
-        pretty_print(template.to_dict())
+        user_can_enroll, enrollable_sids = find.can_user_enroll_in_template(template)
+        template.set("Can Enroll", user_can_enroll)
+        template.set("Enrollable SIDs", [sid_to_name(sid) for sid in enrollable_sids])
+
+    prefix = datetime.now().strftime("%Y%m%d%H%M%S") if not args.output else args.output
+    find._save_output(templates=templates, cas=[], oids=[], prefix=prefix)
 
 
 if __name__ == "__main__":