Function query_computers

NetworkHound.py:1397–1494

Query all computer objects from Active Directory

(connection, domain)

        return None

def query_computers(connection, domain):
    """Query all computer objects from Active Directory"""
    try:
        logger.info("Collecting computer objects from Active Directory...")
        
        # Check if this is an impacket connection
        if hasattr(connection, 'is_impacket') and connection.is_impacket:
            logger.info("🔐 Using impacket for AD computer query")
            
            # Convert domain to DN format (e.g., company.local -> DC=company,DC=local)
            domain_dn = ','.join([f"DC={part}" for part in domain.split('.')])
            
            # Search for computer objects using real impacket LDAP
            search_base = domain_dn
            search_filter = '(objectClass=computer)'
            attributes = ['objectSid', 'cn', 'dNSHostName', 'operatingSystem']
            
            logger.info(f"🔍 Searching for computers in: {search_base}")
            logger.info(f"🔍 Filter: {search_filter}")
            
            # Use the real search method
            results = connection.search(search_base, search_filter, attributes=attributes)
            
            computers = []
            skipped_computers = 0
            synthetic_sid_count = 0
            
            for entry in connection.entries:  # Use stored entries
                # Get computer attributes
                computer_name = getattr(entry, 'cn', None)
                
                # Skip if no computer name
                if not computer_name:
                    logger.warning(f"⚠️  Skipping entry with no computer name (cn)")
                    skipped_computers += 1
                    continue
                
                computer_sid_binary = getattr(entry, 'objectSid', None)
                
                # Get the real SID parsed from AD
                clean_sid = computer_sid_binary  # This is now already parsed as string from LDAP
                
                # Check if SID is valid (starts with S- and looks like a real SID)
                if not clean_sid or not isinstance(clean_sid, str) or not clean_sid.startswith('S-1-5-21-'):
                    # Generate synthetic SID for computers with failed/invalid SID parsing
                    # Use a deterministic hash of computer name to ensure uniqueness
                    import hashlib
                    name_hash = int(hashlib.md5(computer_name.encode()).hexdigest()[:8], 16)
                    synthetic_sid = f"S-1-5-21-SYNTHETIC-{name_hash}-{abs(hash(computer_name)) % 100000}"
                    
                    logger.warning(f"⚠️  Failed to parse SID for '{computer_name}', using synthetic SID")
                    logger.debug(f"   Original SID value: {clean_sid}")
                    logger.debug(f"   Synthetic SID: {synthetic_sid}")
                    
                    clean_sid = synthetic_sid
                    synthetic_sid_count += 1
                else:
                    logger.debug(f"✅ Using real SID from AD for {computer_name}: {clean_sid}")