diff --git a/Sharphound.csproj b/Sharphound.csproj index 09e5cbb..dddc11e 100644 --- a/Sharphound.csproj +++ b/Sharphound.csproj @@ -36,6 +36,9 @@ + + + diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs index 16841a0..74d5810 100644 --- a/src/Runtime/ObjectProcessors.cs +++ b/src/Runtime/ObjectProcessors.cs @@ -13,6 +13,7 @@ using SharpHoundCommonLib.Enums; using SharpHoundCommonLib.OutputTypes; using SharpHoundCommonLib.Processors; +using SharpHoundRPC.Registry; using SharpHoundRPC.Wrappers; using Container = SharpHoundCommonLib.OutputTypes.Container; using Group = SharpHoundCommonLib.OutputTypes.Group; @@ -85,6 +86,9 @@ internal void ClearEventHandlers() { _spnProcessor.ComputerStatusEvent -= HandleCompStatusEvent; _ldapPropertyProcessor.ComputerStatusEvent -= HandleCompStatusEvent; _certAbuseProcessor.ComputerStatusEvent -= HandleCompStatusEvent; + foreach (var registryProcessor in _registryProcessorMap.Values) { + registryProcessor.ComputerStatusEvent -= HandleCompStatusEvent; + } } private async Task HandleCompStatusEvent(CSVComputerStatus status) { @@ -372,13 +376,12 @@ await HandleCompStatusEvent(new CSVComputerStatus { if (_methods.HasFlag(CollectionMethod.NTLMRegistry)) { await _context.DoDelay(); - if (_registryProcessorMap.TryGetValue(resolvedSearchResult.DomainSid, out var processor)) { - ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName); - } else { - var newProcessor = new RegistryProcessor(null, resolvedSearchResult.Domain); - _registryProcessorMap.TryAdd(resolvedSearchResult.DomainSid, newProcessor); - ret.NTLMRegistryData = await newProcessor.ReadRegistrySettings(resolvedSearchResult.DisplayName); - } + var processor = _registryProcessorMap.GetOrAdd(resolvedSearchResult.DomainSid, _ => { + var newProcessor = new RegistryProcessor(null, new StrategyExecutor(), resolvedSearchResult.Domain); + newProcessor.ComputerStatusEvent += HandleCompStatusEvent; + return newProcessor; + }); + ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName); } if (_methods.HasFlag(CollectionMethod.WebClientService)) {