869 lines
24 KiB
C
869 lines
24 KiB
C
|
|
||
|
|
/*++
|
||
|
|
|
||
|
|
Copyright (c) 1997-1999 Microsoft Corporation
|
||
|
|
|
||
|
|
Module Name:
|
||
|
|
|
||
|
|
wmisecur.c
|
||
|
|
|
||
|
|
Abstract:
|
||
|
|
|
||
|
|
Wmi security tool
|
||
|
|
|
||
|
|
Author:
|
||
|
|
|
||
|
|
16-Jan-1997 AlanWar
|
||
|
|
|
||
|
|
Revision History:
|
||
|
|
|
||
|
|
--*/
|
||
|
|
|
||
|
|
#define INITGUID
|
||
|
|
|
||
|
|
#include <nt.h>
|
||
|
|
#include <ntrtl.h>
|
||
|
|
#include <nturtl.h>
|
||
|
|
#include <windows.h>
|
||
|
|
#include <ole2.h>
|
||
|
|
#include <stdio.h>
|
||
|
|
#include <stdlib.h>
|
||
|
|
|
||
|
|
#include <aclapi.h>
|
||
|
|
|
||
|
|
#include "wmium.h"
|
||
|
|
|
||
|
|
#include "wmiumkm.h"
|
||
|
|
|
||
|
|
#define SE_WMIGUID_OBJECT 11
|
||
|
|
#define WMI_SECURITY_REGSTR "SYSTEM\\CurrentControlSet\\Control\\WMI\\Security"
|
||
|
|
|
||
|
|
#define WmipAllocEvent() CreateEvent(NULL, FALSE, FALSE, NULL)
|
||
|
|
#define WmipFreeEvent(EventHandle) CloseHandle(EventHandle)
|
||
|
|
HANDLE WmipKMHandle;
|
||
|
|
ULONG PrintSecurityString(LPSTR Guid);
|
||
|
|
|
||
|
|
ULONG WmipSendWmiKMRequest(
|
||
|
|
ULONG Ioctl,
|
||
|
|
PVOID Buffer,
|
||
|
|
ULONG InBufferSize,
|
||
|
|
ULONG MaxBufferSize,
|
||
|
|
ULONG *ReturnSize
|
||
|
|
)
|
||
|
|
/*+++
|
||
|
|
|
||
|
|
Routine Description:
|
||
|
|
|
||
|
|
This routine does the work of sending WMI requests to the WMI kernel
|
||
|
|
mode device. Any retry errors returned by the WMI device are handled
|
||
|
|
in this routine.
|
||
|
|
|
||
|
|
Arguments:
|
||
|
|
|
||
|
|
Ioctl is the IOCTL code to send to the WMI device
|
||
|
|
Buffer is the input and output buffer for the call to the WMI device
|
||
|
|
InBufferSize is the size of the buffer passed to the device
|
||
|
|
MaxBufferSize is the maximum number of bytes that can be written
|
||
|
|
into the buffer
|
||
|
|
*ReturnSize on return has the actual number of bytes written in buffer
|
||
|
|
|
||
|
|
Return Value:
|
||
|
|
|
||
|
|
ERROR_SUCCESS or an error code
|
||
|
|
---*/
|
||
|
|
{
|
||
|
|
OVERLAPPED Overlapped;
|
||
|
|
ULONG Status;
|
||
|
|
BOOL IoctlSuccess;
|
||
|
|
|
||
|
|
if (WmipKMHandle == NULL)
|
||
|
|
{
|
||
|
|
//
|
||
|
|
// If device is not open for then open it now. The
|
||
|
|
// handle is closed in the process detach dll callout (DlllMain)
|
||
|
|
WmipKMHandle = CreateFile(WMIDataDeviceName,
|
||
|
|
GENERIC_READ | GENERIC_WRITE,
|
||
|
|
0,
|
||
|
|
NULL,
|
||
|
|
OPEN_EXISTING,
|
||
|
|
FILE_ATTRIBUTE_NORMAL |
|
||
|
|
FILE_FLAG_OVERLAPPED,
|
||
|
|
NULL);
|
||
|
|
if (WmipKMHandle == (HANDLE)-1)
|
||
|
|
{
|
||
|
|
WmipKMHandle = NULL;
|
||
|
|
return(GetLastError());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Overlapped.hEvent = WmipAllocEvent();
|
||
|
|
if (Overlapped.hEvent == NULL)
|
||
|
|
{
|
||
|
|
return(ERROR_NOT_ENOUGH_MEMORY);
|
||
|
|
}
|
||
|
|
|
||
|
|
do
|
||
|
|
{
|
||
|
|
IoctlSuccess = DeviceIoControl(WmipKMHandle,
|
||
|
|
Ioctl,
|
||
|
|
Buffer,
|
||
|
|
InBufferSize,
|
||
|
|
Buffer,
|
||
|
|
MaxBufferSize,
|
||
|
|
ReturnSize,
|
||
|
|
&Overlapped);
|
||
|
|
|
||
|
|
if (GetLastError() == ERROR_IO_PENDING)
|
||
|
|
{
|
||
|
|
IoctlSuccess = GetOverlappedResult(WmipKMHandle,
|
||
|
|
&Overlapped,
|
||
|
|
ReturnSize,
|
||
|
|
TRUE);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (! IoctlSuccess)
|
||
|
|
{
|
||
|
|
Status = GetLastError();
|
||
|
|
} else {
|
||
|
|
Status = ERROR_SUCCESS;
|
||
|
|
}
|
||
|
|
} while (Status == ERROR_WMI_TRY_AGAIN);
|
||
|
|
|
||
|
|
WmipFreeEvent(Overlapped.hEvent);
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
#ifdef SET_SECURITY_BY_HANDLE
|
||
|
|
ULONG WmipOpenKernelGuid(
|
||
|
|
LPGUID Guid,
|
||
|
|
ACCESS_MASK DesiredAccess,
|
||
|
|
PHANDLE Handle
|
||
|
|
)
|
||
|
|
{
|
||
|
|
WMIOPENGUIDBLOCK WmiOpenGuidBlock;
|
||
|
|
ULONG ReturnSize;
|
||
|
|
ULONG Status;
|
||
|
|
|
||
|
|
WmiOpenGuidBlock.Guid = *Guid;
|
||
|
|
WmiOpenGuidBlock.DesiredAccess = DesiredAccess;
|
||
|
|
|
||
|
|
Status = WmipSendWmiKMRequest(IOCTL_WMI_OPEN_GUID,
|
||
|
|
(PVOID)&WmiOpenGuidBlock,
|
||
|
|
sizeof(WMIOPENGUIDBLOCK),
|
||
|
|
sizeof(WMIOPENGUIDBLOCK),
|
||
|
|
&ReturnSize);
|
||
|
|
|
||
|
|
if (Status == ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
*Handle = WmiOpenGuidBlock.Handle;
|
||
|
|
} else {
|
||
|
|
*Handle = NULL;
|
||
|
|
}
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
ULONG SetWmiGuidSecurityInfo(
|
||
|
|
LPGUID Guid,
|
||
|
|
SECURITY_INFORMATION SecurityInformation,
|
||
|
|
PSID OwnerSid,
|
||
|
|
PSID GroupSid,
|
||
|
|
PACL Dacl,
|
||
|
|
PACL Sacl
|
||
|
|
)
|
||
|
|
{
|
||
|
|
HANDLE Handle;
|
||
|
|
ULONG Status;
|
||
|
|
#ifdef SET_SECURITY_BY_HANDLE
|
||
|
|
Status = WmipOpenKernelGuid(Guid,
|
||
|
|
WRITE_DAC | WRITE_OWNER,
|
||
|
|
&Handle);
|
||
|
|
|
||
|
|
if (Status == ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
Status = SetSecurityInfo(Handle,
|
||
|
|
SE_KERNEL_OBJECT,
|
||
|
|
SecurityInformation,
|
||
|
|
OwnerSid,
|
||
|
|
GroupSid,
|
||
|
|
Dacl,
|
||
|
|
Sacl);
|
||
|
|
CloseHandle(Handle);
|
||
|
|
}
|
||
|
|
|
||
|
|
#else
|
||
|
|
PCHAR GuidName;
|
||
|
|
|
||
|
|
Status = UuidToString(Guid,
|
||
|
|
&GuidName);
|
||
|
|
|
||
|
|
if (Status == ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
Status = SetNamedSecurityInfo(GuidName,
|
||
|
|
SE_WMIGUID_OBJECT,
|
||
|
|
SecurityInformation,
|
||
|
|
OwnerSid,
|
||
|
|
GroupSid,
|
||
|
|
Dacl,
|
||
|
|
Sacl);
|
||
|
|
RpcStringFree(&GuidName);
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
ULONG GetWmiGuidSecurityInfo(
|
||
|
|
LPGUID Guid,
|
||
|
|
SECURITY_INFORMATION SecurityInformation,
|
||
|
|
PSID *OwnerSid,
|
||
|
|
PSID *GroupSid,
|
||
|
|
PACL *Dacl,
|
||
|
|
PACL *Sacl,
|
||
|
|
PSECURITY_DESCRIPTOR *Sd
|
||
|
|
)
|
||
|
|
{
|
||
|
|
HANDLE Handle;
|
||
|
|
ULONG Status;
|
||
|
|
|
||
|
|
#ifdef SET_SECURITY_BY_HANDLE
|
||
|
|
Status = WmipOpenKernelGuid(Guid,
|
||
|
|
READ_CONTROL,
|
||
|
|
&Handle);
|
||
|
|
|
||
|
|
if (Status == ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
Status = GetSecurityInfo(Handle,
|
||
|
|
SE_KERNEL_OBJECT,
|
||
|
|
SecurityInformation,
|
||
|
|
OwnerSid,
|
||
|
|
GroupSid,
|
||
|
|
Dacl,
|
||
|
|
Sacl,
|
||
|
|
Sd);
|
||
|
|
CloseHandle(Handle);
|
||
|
|
}
|
||
|
|
#else
|
||
|
|
PCHAR GuidName;
|
||
|
|
|
||
|
|
Status = UuidToString(Guid,
|
||
|
|
&GuidName);
|
||
|
|
|
||
|
|
if (Status == ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
Status = GetNamedSecurityInfo(GuidName,
|
||
|
|
SE_WMIGUID_OBJECT,
|
||
|
|
SecurityInformation,
|
||
|
|
OwnerSid,
|
||
|
|
GroupSid,
|
||
|
|
Dacl,
|
||
|
|
Sacl,
|
||
|
|
Sd);
|
||
|
|
|
||
|
|
RpcStringFree(&GuidName);
|
||
|
|
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// The routines below were blantenly stolen without remorse from the ole
|
||
|
|
// sources in \nt\private\ole32\com\class\compapi.cxx. They are copied here
|
||
|
|
// so that WMI doesn't need to load in ole32 only to convert a guid string
|
||
|
|
// into its binary representation.
|
||
|
|
//
|
||
|
|
|
||
|
|
|
||
|
|
//+-------------------------------------------------------------------------
|
||
|
|
//
|
||
|
|
// Function: HexStringToDword (private)
|
||
|
|
//
|
||
|
|
// Synopsis: scan lpsz for a number of hex digits (at most 8); update lpsz
|
||
|
|
// return value in Value; check for chDelim;
|
||
|
|
//
|
||
|
|
// Arguments: [lpsz] - the hex string to convert
|
||
|
|
// [Value] - the returned value
|
||
|
|
// [cDigits] - count of digits
|
||
|
|
//
|
||
|
|
// Returns: TRUE for success
|
||
|
|
//
|
||
|
|
//--------------------------------------------------------------------------
|
||
|
|
BOOL HexStringToDword(LPCSTR lpsz, DWORD * RetValue,
|
||
|
|
int cDigits, WCHAR chDelim)
|
||
|
|
{
|
||
|
|
int Count;
|
||
|
|
DWORD Value;
|
||
|
|
|
||
|
|
Value = 0;
|
||
|
|
for (Count = 0; Count < cDigits; Count++, lpsz++)
|
||
|
|
{
|
||
|
|
if (*lpsz >= '0' && *lpsz <= '9')
|
||
|
|
Value = (Value << 4) + *lpsz - '0';
|
||
|
|
else if (*lpsz >= 'A' && *lpsz <= 'F')
|
||
|
|
Value = (Value << 4) + *lpsz - 'A' + 10;
|
||
|
|
else if (*lpsz >= 'a' && *lpsz <= 'f')
|
||
|
|
Value = (Value << 4) + *lpsz - 'a' + 10;
|
||
|
|
else
|
||
|
|
return(FALSE);
|
||
|
|
}
|
||
|
|
|
||
|
|
*RetValue = Value;
|
||
|
|
|
||
|
|
if (chDelim != 0)
|
||
|
|
return *lpsz++ == chDelim;
|
||
|
|
else
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
//+-------------------------------------------------------------------------
|
||
|
|
//
|
||
|
|
// Function: wUUIDFromString (internal)
|
||
|
|
//
|
||
|
|
// Synopsis: Parse UUID such as 00000000-0000-0000-0000-000000000000
|
||
|
|
//
|
||
|
|
// Arguments: [lpsz] - Supplies the UUID string to convert
|
||
|
|
// [pguid] - Returns the GUID.
|
||
|
|
//
|
||
|
|
// Returns: TRUE if successful
|
||
|
|
//
|
||
|
|
//--------------------------------------------------------------------------
|
||
|
|
BOOL wUUIDFromString(LPCSTR lpsz, LPGUID pguid)
|
||
|
|
{
|
||
|
|
DWORD dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &pguid->Data1, sizeof(DWORD)*2, '-'))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(DWORD)*2 + 1;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(WORD)*2, '-'))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(WORD)*2 + 1;
|
||
|
|
|
||
|
|
pguid->Data2 = (WORD)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(WORD)*2, '-'))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(WORD)*2 + 1;
|
||
|
|
|
||
|
|
pguid->Data3 = (WORD)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[0] = (BYTE)dw;
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, '-'))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2+1;
|
||
|
|
|
||
|
|
pguid->Data4[1] = (BYTE)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[2] = (BYTE)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[3] = (BYTE)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[4] = (BYTE)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[5] = (BYTE)dw;
|
||
|
|
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[6] = (BYTE)dw;
|
||
|
|
if (!HexStringToDword(lpsz, &dw, sizeof(BYTE)*2, 0))
|
||
|
|
return FALSE;
|
||
|
|
lpsz += sizeof(BYTE)*2;
|
||
|
|
|
||
|
|
pguid->Data4[7] = (BYTE)dw;
|
||
|
|
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
//+-------------------------------------------------------------------------
|
||
|
|
//
|
||
|
|
// Function: wGUIDFromString (internal)
|
||
|
|
//
|
||
|
|
// Synopsis: Parse GUID such as {00000000-0000-0000-0000-000000000000}
|
||
|
|
//
|
||
|
|
// Arguments: [lpsz] - the guid string to convert
|
||
|
|
// [pguid] - guid to return
|
||
|
|
//
|
||
|
|
// Returns: TRUE if successful
|
||
|
|
//
|
||
|
|
//--------------------------------------------------------------------------
|
||
|
|
BOOL wGUIDFromString(LPCSTR lpsz, LPGUID pguid)
|
||
|
|
{
|
||
|
|
DWORD dw;
|
||
|
|
|
||
|
|
if (*lpsz == '{' )
|
||
|
|
lpsz++;
|
||
|
|
|
||
|
|
if(wUUIDFromString(lpsz, pguid) != TRUE)
|
||
|
|
return FALSE;
|
||
|
|
|
||
|
|
lpsz +=36;
|
||
|
|
|
||
|
|
if (*lpsz == '}' )
|
||
|
|
lpsz++;
|
||
|
|
|
||
|
|
if (*lpsz != '\0') // check for zero terminated string - test bug #18307
|
||
|
|
{
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
ULONG RemoveWmiSD(
|
||
|
|
LPGUID Guid
|
||
|
|
)
|
||
|
|
{
|
||
|
|
CHAR GuidName[35];
|
||
|
|
HKEY RegistryKey;
|
||
|
|
ULONG Status;
|
||
|
|
|
||
|
|
Status = RegOpenKey(HKEY_LOCAL_MACHINE,
|
||
|
|
"System\\CurrentControlSet\\Control\\Wmi\\Security",
|
||
|
|
&RegistryKey);
|
||
|
|
if (Status != ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
printf("RegOpenKey returned %d\n", Status);
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Guid != NULL)
|
||
|
|
{
|
||
|
|
wsprintf(GuidName, "%08x-%04x-%04x-%02x%02x%02x%02x%02x%02x%02x%02x",
|
||
|
|
Guid->Data1, Guid->Data2,
|
||
|
|
Guid->Data3,
|
||
|
|
Guid->Data4[0], Guid->Data4[1],
|
||
|
|
Guid->Data4[2], Guid->Data4[3],
|
||
|
|
Guid->Data4[4], Guid->Data4[5],
|
||
|
|
Guid->Data4[6], Guid->Data4[7]);
|
||
|
|
} else {
|
||
|
|
strcpy(GuidName, "00000000-0000-0000-0000000000000000");
|
||
|
|
}
|
||
|
|
|
||
|
|
RegDeleteValue(RegistryKey,
|
||
|
|
GuidName);
|
||
|
|
|
||
|
|
RegCloseKey(RegistryKey);
|
||
|
|
|
||
|
|
return(ERROR_SUCCESS);
|
||
|
|
}
|
||
|
|
|
||
|
|
void Usage(
|
||
|
|
void
|
||
|
|
)
|
||
|
|
{
|
||
|
|
printf("wmisecur <guid> [owner | group | dacl | adacl] [parameters]\n");
|
||
|
|
printf(" wmisecur <guid> owner <account name>\n");
|
||
|
|
printf(" sets owner of guid to be <account name>\n\n");
|
||
|
|
printf(" wmisecur <guid> group <account name>\n");
|
||
|
|
printf(" sets group of guid to be <account name>\n\n");
|
||
|
|
printf(" wmisecur <guid> dacl <account name> [allow | deny] <right1> <right2> ....\n");
|
||
|
|
printf(" resets dacl to assign <right1>, <right2>, ... to <account name>\n\n");
|
||
|
|
printf(" wmisecur <guid> adacl <account name> [allow | deny] <right1> <right2> ....\n");
|
||
|
|
printf(" appends ace to dacl,<right1>, <right2>, ... assigned to <account name>\n\n");
|
||
|
|
printf(" wmisecur <guid> query\n");
|
||
|
|
printf(" queries and prints the security string\n\n");
|
||
|
|
printf(" Rights: WMIGUID_QUERY\n");
|
||
|
|
printf(" WMIGUID_SET\n");
|
||
|
|
printf(" WMIGUID_NOTIFICATION\n");
|
||
|
|
printf(" WMIGUID_READ_DESCRIPTION\n");
|
||
|
|
printf(" WMIGUID_EXECUTE\n");
|
||
|
|
printf(" TRACELOG_CREATE_REALTIME\n");
|
||
|
|
printf(" TRACELOG_CREATE_ONDISK\n");
|
||
|
|
printf(" TRACELOG_GUID_ENABLE\n");
|
||
|
|
printf(" TRACELOG_ACCESS_KERNEL_LOGGER\n");
|
||
|
|
printf(" TRACELOG_CREATE_INPROC\n");
|
||
|
|
printf(" TRACELOG_ACCESS_REALTIME\n");
|
||
|
|
printf(" READ_CONTROL\n");
|
||
|
|
printf(" WRITE_DAC\n");
|
||
|
|
printf(" WRITE_OWNER\n");
|
||
|
|
printf(" DELETE\n");
|
||
|
|
printf(" SYNCHRONIZE\n");
|
||
|
|
printf(" ALL (all wmi specific rights)\n");
|
||
|
|
printf(" ALLRIGHTS (STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL)\n");
|
||
|
|
}
|
||
|
|
|
||
|
|
typedef enum
|
||
|
|
{
|
||
|
|
SetOwner,
|
||
|
|
SetGroup,
|
||
|
|
ResetDacl,
|
||
|
|
AppendDacl,
|
||
|
|
CopyDacl,
|
||
|
|
QueryGuid
|
||
|
|
} OPERATION;
|
||
|
|
|
||
|
|
typedef enum
|
||
|
|
{
|
||
|
|
Allow,
|
||
|
|
Deny
|
||
|
|
} ALLOWORDENY;
|
||
|
|
|
||
|
|
|
||
|
|
ULONG SetOwnerOrGroup(
|
||
|
|
OPERATION Operation,
|
||
|
|
LPGUID Guid,
|
||
|
|
PSID Sid
|
||
|
|
)
|
||
|
|
{
|
||
|
|
ULONG Status;
|
||
|
|
|
||
|
|
if (Operation == SetOwner)
|
||
|
|
{
|
||
|
|
Status = SetWmiGuidSecurityInfo(Guid,
|
||
|
|
OWNER_SECURITY_INFORMATION,
|
||
|
|
Sid,
|
||
|
|
NULL,
|
||
|
|
NULL,
|
||
|
|
NULL);
|
||
|
|
} else {
|
||
|
|
Status = SetWmiGuidSecurityInfo(Guid,
|
||
|
|
GROUP_SECURITY_INFORMATION,
|
||
|
|
NULL,
|
||
|
|
Sid,
|
||
|
|
NULL,
|
||
|
|
NULL);
|
||
|
|
}
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
ULONG ResetOrAppendDacl(
|
||
|
|
OPERATION Operation,
|
||
|
|
LPGUID Guid,
|
||
|
|
PSID Sid,
|
||
|
|
ALLOWORDENY AllowOrDeny,
|
||
|
|
ULONG Rights
|
||
|
|
)
|
||
|
|
{
|
||
|
|
ULONG Status;
|
||
|
|
PSECURITY_DESCRIPTOR OldSD;
|
||
|
|
PACL OldDacl, NewDacl;
|
||
|
|
UCHAR NewDaclBuffer[512];
|
||
|
|
|
||
|
|
NewDacl = (PACL)NewDaclBuffer;
|
||
|
|
if ((Operation == AppendDacl) || (Operation == CopyDacl))
|
||
|
|
{
|
||
|
|
Status = GetWmiGuidSecurityInfo(Guid,
|
||
|
|
DACL_SECURITY_INFORMATION,
|
||
|
|
NULL,
|
||
|
|
NULL,
|
||
|
|
&OldDacl,
|
||
|
|
NULL,
|
||
|
|
&OldSD);
|
||
|
|
if (Status != ERROR_SUCCESS)
|
||
|
|
{
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
memcpy(NewDacl, OldDacl, OldDacl->AclSize);
|
||
|
|
LocalFree(OldSD);
|
||
|
|
NewDacl->AclSize = sizeof(NewDaclBuffer);
|
||
|
|
} else {
|
||
|
|
RtlCreateAcl(NewDacl,
|
||
|
|
sizeof(NewDaclBuffer),
|
||
|
|
ACL_REVISION);
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Operation != CopyDacl)
|
||
|
|
{
|
||
|
|
if (AllowOrDeny == Deny)
|
||
|
|
{
|
||
|
|
if (! AddAccessDeniedAce(NewDacl,
|
||
|
|
ACL_REVISION,
|
||
|
|
Rights,
|
||
|
|
Sid))
|
||
|
|
{
|
||
|
|
return(GetLastError());
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if (! AddAccessAllowedAce(NewDacl,
|
||
|
|
ACL_REVISION,
|
||
|
|
Rights,
|
||
|
|
Sid))
|
||
|
|
{
|
||
|
|
return(GetLastError());
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Status = SetWmiGuidSecurityInfo(Guid,
|
||
|
|
DACL_SECURITY_INFORMATION,
|
||
|
|
NULL,
|
||
|
|
NULL,
|
||
|
|
NewDacl,
|
||
|
|
NULL);
|
||
|
|
|
||
|
|
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
BOOLEAN RightNameToDWord(
|
||
|
|
PCHAR RightName,
|
||
|
|
PDWORD RightDWord
|
||
|
|
)
|
||
|
|
{
|
||
|
|
*RightDWord = 0;
|
||
|
|
if (_stricmp(RightName, "WMIGUID_QUERY") == 0)
|
||
|
|
{
|
||
|
|
*RightDWord = WMIGUID_QUERY;
|
||
|
|
} else if (_stricmp(RightName, "WMIGUID_SET") == 0) {
|
||
|
|
*RightDWord = WMIGUID_SET;
|
||
|
|
} else if (_stricmp(RightName, "WMIGUID_NOTIFICATION") == 0) {
|
||
|
|
*RightDWord = WMIGUID_NOTIFICATION;
|
||
|
|
} else if (_stricmp(RightName, "WMIGUID_READ_DESCRIPTION") == 0) {
|
||
|
|
*RightDWord = WMIGUID_READ_DESCRIPTION;
|
||
|
|
} else if (_stricmp(RightName, "WMIGUID_EXECUTE") == 0) {
|
||
|
|
*RightDWord = WMIGUID_EXECUTE;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_CREATE_REALTIME") == 0) {
|
||
|
|
*RightDWord = TRACELOG_CREATE_REALTIME;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_CREATE_ONDISK") == 0) {
|
||
|
|
*RightDWord = TRACELOG_CREATE_ONDISK;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_GUID_ENABLE") == 0) {
|
||
|
|
*RightDWord = TRACELOG_GUID_ENABLE;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_ACCESS_KERNEL_LOGGER") == 0) {
|
||
|
|
*RightDWord = TRACELOG_ACCESS_KERNEL_LOGGER;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_CREATE_INPROC") == 0) {
|
||
|
|
*RightDWord = TRACELOG_CREATE_INPROC;
|
||
|
|
} else if (_stricmp(RightName, "TRACELOG_ACCESS_REALTIME") == 0) {
|
||
|
|
*RightDWord = TRACELOG_ACCESS_REALTIME;
|
||
|
|
} else if (_stricmp(RightName, "READ_CONTROL") == 0) {
|
||
|
|
*RightDWord = READ_CONTROL;
|
||
|
|
} else if (_stricmp(RightName, "WRITE_DAC") == 0) {
|
||
|
|
*RightDWord = WRITE_DAC;
|
||
|
|
} else if (_stricmp(RightName, "WRITE_OWNER") == 0) {
|
||
|
|
*RightDWord = WRITE_OWNER;
|
||
|
|
} else if (_stricmp(RightName, "WRITE_DAC") == 0) {
|
||
|
|
*RightDWord = WRITE_DAC;
|
||
|
|
} else if (_stricmp(RightName, "DELETE") == 0) {
|
||
|
|
*RightDWord = DELETE;
|
||
|
|
} else if (_stricmp(RightName, "SYNCHRONIZE") == 0) {
|
||
|
|
*RightDWord = SYNCHRONIZE;
|
||
|
|
} else if (_stricmp(RightName, "ALL") == 0) {
|
||
|
|
*RightDWord = WMIGUID_ALL_ACCESS;
|
||
|
|
} else if (_stricmp(RightName, "ALLRIGHTS") == 0) {
|
||
|
|
*RightDWord = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
|
||
|
|
} else {
|
||
|
|
return(FALSE);
|
||
|
|
}
|
||
|
|
|
||
|
|
return(TRUE);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
int __cdecl main(int argc, char *argv[])
|
||
|
|
{
|
||
|
|
int i;
|
||
|
|
ALLOWORDENY AllowOrDeny;
|
||
|
|
OPERATION Operation;
|
||
|
|
DWORD Rights;
|
||
|
|
DWORD NewRight;
|
||
|
|
PSID Sid;
|
||
|
|
UCHAR SidBuffer[512];
|
||
|
|
ULONG SidLength;
|
||
|
|
GUID Guid;
|
||
|
|
CHAR ReferencedDomain[512];
|
||
|
|
SID_NAME_USE SidNameUse;
|
||
|
|
ULONG ReferencedDomainSize;
|
||
|
|
ULONG Status;
|
||
|
|
|
||
|
|
if (argc < 2)
|
||
|
|
{
|
||
|
|
Usage();
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
if (_stricmp(argv[2], "owner") == 0)
|
||
|
|
{
|
||
|
|
Operation = SetOwner;
|
||
|
|
} else if (_stricmp(argv[2], "group") == 0) {
|
||
|
|
Operation = SetGroup;
|
||
|
|
} else if (_stricmp(argv[2], "dacl") == 0) {
|
||
|
|
Operation = ResetDacl;
|
||
|
|
} else if (_stricmp(argv[2], "adacl") == 0) {
|
||
|
|
Operation = AppendDacl;
|
||
|
|
} else if (_stricmp(argv[2], "copy") == 0) {
|
||
|
|
Operation = CopyDacl;
|
||
|
|
} else if (_stricmp(argv[2], "query") == 0) {
|
||
|
|
Operation = QueryGuid;
|
||
|
|
} else {
|
||
|
|
Usage();
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
//
|
||
|
|
// Parse the guid parameter
|
||
|
|
if (! wUUIDFromString(argv[1], &Guid))
|
||
|
|
{
|
||
|
|
printf("Bad guid %s\n", argv[1]);
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Operation == QueryGuid)
|
||
|
|
{
|
||
|
|
if (PrintSecurityString(argv[1]))
|
||
|
|
printf("Cannot find security set for given guid\n");
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
if (Operation == CopyDacl)
|
||
|
|
{
|
||
|
|
Status = ResetOrAppendDacl(Operation, &Guid, NULL, Allow, 0);
|
||
|
|
printf("Status is %d\n", Status);
|
||
|
|
return(Status);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (_stricmp(argv[3], "LocalSystem") == 0)
|
||
|
|
{
|
||
|
|
//
|
||
|
|
// This is a special SID we need to build by hand
|
||
|
|
//
|
||
|
|
|
||
|
|
//
|
||
|
|
// Create SID for LocalSystem dynamically
|
||
|
|
//
|
||
|
|
Sid = (PSID)malloc(RtlLengthRequiredSid( 1 ));
|
||
|
|
if (Sid != NULL)
|
||
|
|
{
|
||
|
|
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
|
||
|
|
RtlInitializeSid( Sid, &NtAuthority, 1);
|
||
|
|
*(RtlSubAuthoritySid( Sid, 0 )) = SECURITY_LOCAL_SYSTEM_RID;
|
||
|
|
} else {
|
||
|
|
printf("Not enougfh memory for local system sid\n");
|
||
|
|
return(ERROR_NOT_ENOUGH_MEMORY);
|
||
|
|
}
|
||
|
|
|
||
|
|
} else {
|
||
|
|
//
|
||
|
|
// Parse the account name parameter
|
||
|
|
Sid = (PSID)SidBuffer;
|
||
|
|
SidLength = sizeof(SidBuffer);
|
||
|
|
ReferencedDomainSize = sizeof(ReferencedDomain);
|
||
|
|
if (! LookupAccountName(NULL,
|
||
|
|
argv[3],
|
||
|
|
Sid,
|
||
|
|
&SidLength,
|
||
|
|
ReferencedDomain,
|
||
|
|
&ReferencedDomainSize,
|
||
|
|
&SidNameUse))
|
||
|
|
{
|
||
|
|
printf("Error %d looking up account %s\n", GetLastError(), argv[3]);
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
if ((Operation == SetOwner) ||
|
||
|
|
(Operation == SetGroup))
|
||
|
|
|
||
|
|
{
|
||
|
|
Status = SetOwnerOrGroup(Operation, &Guid, Sid);
|
||
|
|
printf("Status is %d\n", Status);
|
||
|
|
if (Status == 0) {
|
||
|
|
PrintSecurityString(argv[1]);
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if (argc < 4)
|
||
|
|
{
|
||
|
|
Usage();
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (_stricmp(argv[4], "allow") == 0)
|
||
|
|
{
|
||
|
|
AllowOrDeny = Allow;
|
||
|
|
} else if (_stricmp(argv[4], "deny") == 0) {
|
||
|
|
AllowOrDeny = Deny;
|
||
|
|
} else {
|
||
|
|
Usage();
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
|
||
|
|
Rights = 0;
|
||
|
|
for (i = 5; i < argc; i++)
|
||
|
|
{
|
||
|
|
if (! RightNameToDWord(argv[i], &NewRight))
|
||
|
|
{
|
||
|
|
printf("Invalid right %s\n", argv[i]);
|
||
|
|
return(0);
|
||
|
|
}
|
||
|
|
Rights |= NewRight;
|
||
|
|
}
|
||
|
|
Status = ResetOrAppendDacl(Operation, &Guid, Sid, AllowOrDeny, Rights);
|
||
|
|
printf("Status is %d\n", Status);
|
||
|
|
if (Status == 0) {
|
||
|
|
PrintSecurityString(argv[1]);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
ULONG
|
||
|
|
PrintSecurityString(LPSTR GuidStr)
|
||
|
|
{
|
||
|
|
ULONG status;
|
||
|
|
HKEY hKey;
|
||
|
|
UCHAR buffer[1024];
|
||
|
|
ULONG size, i;
|
||
|
|
|
||
|
|
status = RegOpenKeyEx(
|
||
|
|
HKEY_LOCAL_MACHINE,
|
||
|
|
WMI_SECURITY_REGSTR,
|
||
|
|
0L,
|
||
|
|
KEY_QUERY_VALUE,
|
||
|
|
&hKey);
|
||
|
|
if (status != ERROR_SUCCESS)
|
||
|
|
return status;
|
||
|
|
size = 1024;
|
||
|
|
status = RegQueryValueEx(
|
||
|
|
hKey,
|
||
|
|
GuidStr,
|
||
|
|
NULL,
|
||
|
|
NULL,
|
||
|
|
buffer,
|
||
|
|
&size);
|
||
|
|
if (status != ERROR_SUCCESS) {
|
||
|
|
RegCloseKey(hKey);
|
||
|
|
return status;
|
||
|
|
}
|
||
|
|
printf("\nHKLM,\"%s\",\"%s\",0x00030003,\\\n",
|
||
|
|
WMI_SECURITY_REGSTR, GuidStr);
|
||
|
|
for (i=0; i<size; i++) {
|
||
|
|
if ((i%16) == 0) {
|
||
|
|
if (i>0)
|
||
|
|
printf(",\\\n");
|
||
|
|
printf(" ");
|
||
|
|
printf("%02x", buffer[i]);
|
||
|
|
}
|
||
|
|
else
|
||
|
|
printf(",%02x", buffer[i]);
|
||
|
|
}
|
||
|
|
printf("\n");
|
||
|
|
RegCloseKey(hKey);
|
||
|
|
return ERROR_SUCCESS;
|
||
|
|
}
|