Add AddSelf edge functionality to UI

[rookuu]

Adds the "AddSelf" edge to the ingestion logic and UI elements. This additional ACE means that we can add the "AddSelf" edge to the GUI when a principle has the ability to add themselves (but no one else) to a group. This information is not currently collected or displayed.

Corresponding PR for SharpHound is here -> BloodHoundAD/SharpHound3#16

[andyrobbins]

Thank you very much, this is a fantastic set of PRs. I'll take some time this weekend and next week to test this out.

[rvazarkar]

So I've been testing this in a lab, and I cant seem to actually get this ACE to work.

PS C:\Users\dfm\Desktop> Get-ObjectACL -SamAccountName "TestGroup" -ResolveGUIDs |? {$_.SecurityIdentifier -eq "S-1-5-21-3130019616-2776909439-2417379446-1105"}
AceQualifier           : AccessAllowed
ObjectDN               : CN=TestGroup,CN=Users,DC=testlab,DC=local
ActiveDirectoryRights  : Self
ObjectAceType          : Self-Membership
ObjectSID              : S-1-5-21-3130019616-2776909439-2417379446-3103
InheritanceFlags       : None
BinaryLength           : 56
AceType                : AccessAllowedObject
ObjectAceFlags         : ObjectAceTypePresent
IsCallback             : False
PropagationFlags       : None
SecurityIdentifier     : S-1-5-21-3130019616-2776909439-2417379446-1105
AccessMask             : 8
AuditFlags             : None
IsInherited            : False
AceFlags               : None
InheritedObjectAceType : All
OpaqueLength           : 0

PS C:\Users\dfm\Desktop> net group "TestGroup" dfm /add /domain
The request will be processed at a domain controller for domain testlab.local.

System error 5 has occurred.

Access is denied.

PS C:\Users\dfm\Desktop> whoami /all
USER INFORMATION
----------------
User Name   SID
=========== ==============================================
testlab\dfm S-1-5-21-3130019616-2776909439-2417379446-1105

Am I missing something?

[rookuu]

Hi @rvazarkar! Thanks for reviewing the PR.

For some reason you're unable to use net.exe to exercise the "Add-Self to Group" ACE. I'm not sure why this is the case, I've tested with PowerView and it works as expected.

PS C:\> Get-ObjectACL -SamAccountName "Test Group" -ResolveGUIDs |? {$_.SecurityIdentifier -eq "S-1-5-21-3878895623-4031543421-294952868-1000"}                                                            

AceQualifier           : AccessAllowed
ObjectDN               : CN=Test Group,OU=Groups,DC=test,DC=lab
ActiveDirectoryRights  : Self
ObjectAceType          : Self-Membership
ObjectSID              : S-1-5-21-3878895623-4031543421-294952868-1107
InheritanceFlags       : ContainerInherit
BinaryLength           : 56
AceType                : AccessAllowedObject
ObjectAceFlags         : ObjectAceTypePresent
IsCallback             : False
PropagationFlags       : None
SecurityIdentifier     : S-1-5-21-3878895623-4031543421-294952868-1000
AccessMask             : 8
AuditFlags             : None
IsInherited            : False
AceFlags               : ContainerInherit
InheritedObjectAceType : All
OpaqueLength           : 0

PS C:\> Add-DomainGroupMember -Identity "Test Group" -Members rookuu 

PS C:\> Add-DomainGroupMember -Identity "Test Group" -Members john                                                                                                                                         
Exception calling "Save" with "0" argument(s): "Access is denied.
"
At C:\Users\rookuu.TEST\Desktop\PowerView.ps1:11685 char:17
+                 $Group.Save()
+                 ~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : UnauthorizedAccessException

PS C:\> net group "Test Group" /domain                                                                                                                                                                     
The request will be processed at a domain controller for domain test.lab.

Group name     Test Group
Comment

Members

-------------------------------------------------------------------------------
rookuu
The command completed successfully.

PS C:\> whoami /all                                                                                                                                                                                        
USER INFORMATION
----------------

User Name   SID
=========== =============================================
test\rookuu S-1-5-21-3878895623-4031543421-294952868-1000

[rvazarkar]

This information is being added into vnext. Unfortunately because of the way the new update had to be done, I can't accept the PR. However, the functionality is present. Thank you so much for the PR.