ANSSI-FR/ADTimeline

Error parsing DS_REPL_VALUE_META_DATA

fastlorenzo opened this issue · 2 comments

I've seen a lot of errors when running the tool similar to this one:

Cannot convert value "<DS_REPL_VALUE_META_DATA>
    <pszAttributeName>member</pszAttributeName>
    <pszObjectDn>CN=IT Helpdesk\0ACNF:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,OU=Shared Mailboxes,OU=XX,OU=XXX XXXXXXXX,OU=Users & Groups,DC=xxxxxx,DC=xxxxx</pszObjectDn>
    <cbData>0</cbData>
    <pbData></pbData>
    <ftimeDeleted>1601-01-01T00:00:00Z</ftimeDeleted>
    <ftimeCreated>2012-11-02T11:25:44Z</ftimeCreated>
    <dwVersion>1</dwVersion>
    <ftimeLastOriginatingChange>2012-11-02T11:25:44Z</ftimeLastOriginatingChange>
    <uuidLastOriginatingDsaInvocationID>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</uuidLastOriginatingDsaInvocationID>
    <usnOriginatingChange>44912828</usnOriginatingChange>
    <usnLocalChange>29905</usnLocalChange>
    <pszLastOriginatingDsaDN></pszLastOriginatingDsaDN>
</DS_REPL_VALUE_META_DATA>
" to type "System.Xml.XmlDocument". Error: "An error occurred while parsing EntityName. Line 3, position 125."
At C:\Users\Administrator\Desktop\ADTimeline-master\ADTimeline-master\ADTimeline.ps1:2508 char:124
+             {if($objgrp."msDS-ReplValueMetadata"){$metadasgrp = $objgrp."msDS-ReplValueMetadata" | foreach-object{ ([
xml] $_.Replace <<<< ("`0","")).DS_REPL_VALUE_META_DATA}}}
    + CategoryInfo          : NotSpecified: (:) [], RuntimeException
    + FullyQualifiedErrorId : RuntimeException

I think this might be related to the OU name containing &, which should be escaped.

Example with and without &:
image

Replacing & with &amp; should do the trick (quick and dirty fix that doesn't take into account other type of characters that would need to be escaped as well)

PS C:\> $val="<DS_REPL_VALUE_META_DATA>
>>     <pszAttributeName>member</pszAttributeName>
>>     <pszObjectDn>CN=IT Helpdesk\0ACNF:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,OU=Shared Mailboxes,OU=XX,OU=XXX XXXXXXXX,OU=Users & Groups,DC=xxxxxx,DC=xxxxx</pszObjectDn>
>>     <cbData>0</cbData>
>>     <pbData></pbData>
>>     <ftimeDeleted>1601-01-01T00:00:00Z</ftimeDeleted>
>>     <ftimeCreated>2012-11-02T11:25:44Z</ftimeCreated>
>>     <dwVersion>1</dwVersion>
>>     <ftimeLastOriginatingChange>2012-11-02T11:25:44Z</ftimeLastOriginatingChange>
>>     <uuidLastOriginatingDsaInvocationID>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</uuidLastOriginatingDsaInvocationID>
>>     <usnOriginatingChange>44912828</usnOriginatingChange>
>>     <usnLocalChange>29905</usnLocalChange>
>>     <pszLastOriginatingDsaDN></pszLastOriginatingDsaDN>
>> </DS_REPL_VALUE_META_DATA>"
PS C:\> $valok = $val.Replace('&','&amp;')
PS C:\> $valok
<DS_REPL_VALUE_META_DATA>
    <pszAttributeName>member</pszAttributeName>
    <pszObjectDn>CN=IT Helpdesk\0ACNF:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,OU=Shared Mailboxes,OU=XX,OU=XXX XXXXXXXX,OU=Users &amp; Groups,DC=xxxxxx,DC=xxxxx</pszObjectDn>
    <cbData>0</cbData>
    <pbData></pbData>
    <ftimeDeleted>1601-01-01T00:00:00Z</ftimeDeleted>
    <ftimeCreated>2012-11-02T11:25:44Z</ftimeCreated>
    <dwVersion>1</dwVersion>
    <ftimeLastOriginatingChange>2012-11-02T11:25:44Z</ftimeLastOriginatingChange>
    <uuidLastOriginatingDsaInvocationID>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</uuidLastOriginatingDsaInvocationID>
    <usnOriginatingChange>44912828</usnOriginatingChange>
    <usnLocalChange>29905</usnLocalChange>
    <pszLastOriginatingDsaDN></pszLastOriginatingDsaDN>
</DS_REPL_VALUE_META_DATA>
PS C:\> [xml]$valok

DS_REPL_VALUE_META_DATA
-----------------------
DS_REPL_VALUE_META_DATA

Many thanks for the PR.
Have a good day.