Add sam.groups plugin and reworking of t.users (feedback required) #1478
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR changes the
samplugin to a namespace ofsam.usersand adds asam.groupsfunction that parses local groups from SAM.Some changes are made to
t.usersto also parse users fromsamas the currently implementation seem to fail to return some local users as mentioned in: #1477Feedback requested:
.regfiles - including tooling to export registry keys and construction ofVirtualHivesfrom.regfiles.local_admin=Boelto user records somewhere, either inSAM.usersortarget.usersas this would provide a user friendly way to identify local admin users. Because the 'administrators' group name can be changed and is language specific.Still some work to do, such as fix a test i'm failing (
tests/plugins/os/windows/test__os.py::test_windows_user_from_sam) because theMocktarget does not get properly parsed by the newtarget.usersimplementation that makes use ofSAM. A solution is likely a change to the test, rather than a change in the code as I have tested this scenario on a live machine