Function ParseSD

SecurityDescriptor/SecurityDescriptorFuncs.go:194–293

(SD string, baseDN string, conn *ldap.Conn)

}

func ParseSD(SD string, baseDN string, conn *ldap.Conn) (abusableAcesResult []CHECK_ABUSABLE_ACES) {
	header := getHeader(SD)
	ACLHeader := getACLHeader(SD)
	DACL := getDACL(header, SD)
	rawACES := DACL[16:]
	aceCount, _ := strconv.Atoi(hexToDecimalString(ACLHeader.ACECount))
	rawACESList := make([]string, aceCount)

	for i := 0; i < aceCount; i++ {
		rawACESList[i] = getACE(rawACES)
		rawACES = rawACES[len(rawACESList[i]):]
	}

	abusableAces := []CHECK_ABUSABLE_ACES{}
	for ace, _ := range rawACESList {
		entry := CHECK_ABUSABLE_ACES{SamAccountName: "", GENERIC_ALL: false, GENERIC_WRITE: false, WRITE_OWNER: false, WRITE_DACL: false, FORCE_CHANGE_PASSWORD: false, ADD_MEMBER: false}

		aceHeader := getACEHeader(rawACESList[ace])
		aceType, _ := strconv.Atoi(aceHeader.ACEType)

		var resolvedACEType string
		for entry, _ := range aceTypeMap {
			if entry == aceType {
				resolvedACEType = aceTypeMap[entry]
			}

		}

		switch resolvedACEType {
		case "ACCESS_ALLOWED_ACE_TYPE":
			ACE := new(ACCESS_ALLOWED_ACE)
			ACE.parse(rawACESList[ace], baseDN, conn)
			entry.SamAccountName = ACE.samAccountName

			permissions, err := strconv.ParseInt(ACE.mask, 16, 64)
			if err != nil {
				fmt.Printf("ACE Mask Conversion Error, %s\n", err)
			}

			if permissions&int64(accessRightsMap["RIGHT_DS_CREATE_CHILD"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_DELETE_CHILD"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_LIST_CONTENTS"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_WRITE_PROPERTY_EXTENDED"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_READ_PROPERTY"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_WRITE_PROPERTY"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_DELETE_TREE"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_LIST_OBJECT"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_CONTROL_ACCESS"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DELETE"]) > 0 && permissions&int64(accessRightsMap["RIGHT_READ_CONTROL"]) > 0 && permissions&int64(accessRightsMap["RIGHT_WRITE_DACL"]) > 0 && permissions&int64(accessRightsMap["RIGHT_WRITE_OWNER"]) > 0 {
				entry.GENERIC_ALL = true
			}

			if permissions&int64(accessRightsMap["RIGHT_WRITE_DACL"]) > 0 {
				entry.WRITE_DACL = true
			}

			if permissions&int64(accessRightsMap["RIGHT_WRITE_OWNER"]) > 0 {
				entry.WRITE_OWNER = true
			}

			if permissions&int64(accessRightsMap["RIGHT_READ_CONTROL"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_WRITE_PROPERTY"]) > 0 && permissions&int64(accessRightsMap["RIGHT_DS_WRITE_PROPERTY_EXTENDED"]) > 0 {
				entry.GENERIC_WRITE = true
			}

			inArray := false
			for index := range abusableAces {
				if entry.SamAccountName == abusableAces[index].SamAccountName {