feat: collect delegated managed service accounts

I now classify delegated managed service accounts separately, collect their predecessor links, and emit CreateDMSA rights from access controls on valid OU and container parents.

Signed-off-by: Adil Alperen Çiftci <adilalperenciftci@users.noreply.github.com>

Author: adilalperenciftci

src/CommonLib/DirectoryObjects/DirectoryObjectExtensions.cs

@@ -20,7 +20,15 @@ public static bool IsGMSA(this IDirectoryObject directoryObject) {
 
         return classes.Contains(ObjectClass.GMSAClass, StringComparer.InvariantCultureIgnoreCase);
     }
-    
+
+    public static bool IsDMSA(this IDirectoryObject directoryObject) {
+        if (!directoryObject.TryGetArrayProperty(LDAPProperties.ObjectClass, out var classes)) {
+            return false;
+        }
+
+        return classes.Contains(ObjectClass.DMSAClass, StringComparer.InvariantCultureIgnoreCase);
+    }
+
     public static bool GetObjectIdentifier(this IDirectoryObject directoryObject, out string objectIdentifier) {
         // Builtin container has a SID (always "S-1-5-32"). We use the ObjectGUID as ID like for other containers 
         if (directoryObject.TryGetArrayProperty(LDAPProperties.ObjectClass, out var objectClasses) &&

src/CommonLib/Enums/DataType.cs

@@ -18,5 +18,6 @@ public static class DataType
         public const string Sites = "sites";
         public const string SiteServers = "siteservers";
         public const string SiteSubnets = "sitesubnets";
+        public const string DMSAs = "dmsas";
     }
 }

src/CommonLib/Enums/EdgeNames.cs

@@ -26,6 +26,7 @@ public static class EdgeNames
         public const string WritePublicInformation = "WritePublicInformation";
         public const string WriteSupersededManagedAccountLink = "WriteSupersededManagedAccountLink";
         public const string WriteSupersededServiceAccountState = "WriteSupersededServiceAccountState";
+        public const string CreateDMSA = "CreateDMSA";
         public const string ServerIs = "ServerIs";
 
         //CertAbuse edges

src/CommonLib/Enums/LDAPProperties.cs

@@ -3,6 +3,7 @@
     public static class LDAPProperties
     {
         public const string GroupMSAMembership = "msds-groupmsamembership";
+        public const string ManagedAccountPrecededByLink = "msds-managedaccountprecededbylink";
         public const string UserAccountControl = "useraccountcontrol";
         public const string IsDeleted = "isdeleted";
         public const string SAMAccountType = "samaccounttype";

src/CommonLib/Enums/Labels.cs

@@ -21,6 +21,7 @@ public enum Label
         IssuancePolicy,
         Site,
         SiteServer,
-        SiteSubnet
+        SiteSubnet,
+        DMSA
     }
 }

src/CommonLib/Enums/ObjectClass.cs

@@ -14,6 +14,7 @@ public static class ObjectClass {
     public const string OIDContainerClass = "msPKI-Enterprise-Oid";
     public const string GMSAClass = "msds-groupmanagedserviceaccount";
     public const string MSAClass = "msds-managedserviceaccount";
+    public const string DMSAClass = "msds-delegatedmanagedserviceaccount";
     public const string SiteClass = "site";
     public const string SiteServerClass = "server";
     public const string SiteSubnetClass = "subnet";

src/CommonLib/LdapQueries/CommonProperties.cs

@@ -62,7 +62,7 @@ public static class CommonProperties
             LDAPProperties.MinPwdLength, LDAPProperties.PwdProperties, LDAPProperties.MinPwdAge, 
             LDAPProperties.MaxPwdAge, LDAPProperties.PwdHistoryLength, LDAPProperties.LockoutDuration, 
             LDAPProperties.LockoutThreshold, LDAPProperties.LockOutObservationWindow, LDAPProperties.GroupType, 
-            LDAPProperties.PrincipalName
+            LDAPProperties.PrincipalName, LDAPProperties.ManagedAccountPrecededByLink
         };
 
         public static readonly string[] ContainerProps =

src/CommonLib/LdapUtils.cs

@@ -1166,12 +1166,18 @@ internal static bool ResolveLabel(string objectIdentifier, string distinguishedN
                 return true;
             }
 
-            //Override GMSA/MSA account to treat them as users for the graph
-            if (objectClasses != null &&
-                (objectClasses.Contains(ObjectClass.MSAClass, StringComparer.OrdinalIgnoreCase) ||
-                 objectClasses.Contains(ObjectClass.GMSAClass, StringComparer.OrdinalIgnoreCase))) {
-                type = Label.User;
-                return true;
+            if (objectClasses != null) {
+                if (objectClasses.Contains(ObjectClass.DMSAClass, StringComparer.OrdinalIgnoreCase)) {
+                    type = Label.DMSA;
+                    return true;
+                }
+
+                //Override GMSA/MSA account to treat them as users for the graph
+                if (objectClasses.Contains(ObjectClass.MSAClass, StringComparer.OrdinalIgnoreCase) ||
+                    objectClasses.Contains(ObjectClass.GMSAClass, StringComparer.OrdinalIgnoreCase)) {
+                    type = Label.User;
+                    return true;
+                }
             }
 
             if (samAccountType != null) {
@@ -1344,6 +1350,7 @@ private static string ComputeDisplayName(IDirectoryObject directoryObject, strin
             string displayName;
             switch (label) {
                 case Label.User:
+                case Label.DMSA:
                 case Label.Group:
                 case Label.Base:
                     if (!string.IsNullOrWhiteSpace(samAccountName)) {

src/CommonLib/OutputTypes/DMSA.cs

@@ -0,0 +1,7 @@
+namespace SharpHoundCommonLib.OutputTypes
+{
+    public class DMSA : OutputBase
+    {
+        public TypedPrincipal PrecededBy { get; set; }
+    }
+}

src/CommonLib/Processors/ACEGuids.cs

@@ -19,6 +19,7 @@ public class ACEGuids
         public const string WritePublicInformation = "e48d0154-bcf8-11d1-8702-00c04fb96050";
         public const string WriteSupersededManagedAccountLink = "3752e002-43be-48c8-b3ca-2cb2fffbc8a1";
         public const string WriteSupersededServiceAccountState = "a4693096-a4c3-4ecd-b8cb-73cd6398b7a2";
+        public const string DMSAClass = "0feb936f-47b3-49f2-9386-1dedc2c23765";
 
         //Cert abuse ACEs
         public const string PKINameFlag = "ea1dddc4-60ff-416e-8cc0-17cee534bce7";