able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/ds/adsi/dbgexts/dbgsec.c

649 lines
17 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1990 Microsoft Corporation
Module Name:
dbgsec.c
Abstract:
Argus debugging extensions. The routines here dump out Security Descriptors
and allow you to examine them.
Author:
Krishna Ganugapati (KrishnaG) 1-July-1993
Revision History:
KrishnaG: Created: 1-July-1993 (imported most of IanJa's stuff)
KrishnaG: Added: 7-July-1993 (added AndrewBe's UnicodeAnsi conversion routines)
KrishnaG Added: 3-Aug-1993 (added DevMode/SecurityDescriptor dumps)
To do:
--*/
#define NOMINMAX
#define SECURITY_WIN32
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <stdlib.h>
#include <math.h>
#include <ntsdexts.h>
#include <windows.h>
#include <winspool.h>
#include <security.h>
#include <wchar.h>
#include "dbglocal.h"
#define NULL_TERMINATED 0
#define VERBOSE_ON 1
#define VERBOSE_OFF 0
#define MAX_SDC_FLAGS 7
typedef struct _DBG_SED_CONTROL{
unsigned short Flag;
LPSTR String;
}DBG_SED_CONTROL, *PDBG_SED_CONTROL;
DBG_SED_CONTROL SDC_Table[] =
{
0x0001, "SE_OWNER_DEFAULTED",
0x0002, "SE_GROUP_DEFAULTED",
0x0004, "SE_DACL_PRESENT",
0x0008, "SE_DACL_DEFAULTED",
0x0010, "SE_SACL_PRESENT",
0x0020, "SE_SACL_DEFAULTED",
0x8000, "SE_SELF_RELATIVE"
};
#define MAX_ACE_FLAGS 6
typedef struct _DBG_ACE_FLAGS{
UCHAR Flags;
LPSTR String;
}DBG_ACE_FLAGS, *PDBG_ACE_FLAGS;
DBG_ACE_FLAGS AceFlagsTable[] =
{
0x1, "OBJECT_INHERIT_ACE",
0x2, "CONTAINER_INHERIT_ACE",
0x4, "NO_PROPAGATE_INHERIT_ACE",
0x8, "INHERIT_ONLY_ACE",
0x40, "SUCCESSFUL_ACCESS_ACE_FLAG",
0x80, "FAILED_ACCESS_ACE_FLAG"
};
typedef struct _ACCESSMASKTAB{
DWORD Flag;
LPSTR String;
}ACCESSMASKTAB, *PACCESSMASKTAB;
ACCESSMASKTAB AccessMaskTable[33] =
{
0x00000001, "SERVER_ACCESS_ADMINSTER",
0x00000002, "SERVER_ACCESS_ENUMERATE",
0x00000004, "PRINTER_ACCESS_ADMINSTER",
0x00000008, "PRINTER_ACCESS_USE",
0x00000010, "JOB_ACCESS_ADMINISTER",
0x00010000, "DELETE",
0x00020000, "READ_CONTROL",
0x00040000, "WRITE_DAC",
0x00080000, "WRITE_OWNER",
0x00100000, "SYNCHRONIZE",
0x01000000, "ACCESS_SYSTEM_SECURITY",
0x10000000, "GENERIC_ALL",
0x20000000, "GENERIC_EXECUTE",
0x40000000, "GENERIC_WRITE",
0x80000000, "GENERIC_READ",
0x0000FFFF, "SPECIFIC_RIGHTS_ALL",
0x000F0000, "STANDARD_RIGHTS_REQUIRED <D-R/C-W/DAC-W/O>",
0x001F0000, "STANDARD_RIGHTS_ALL <D-R/C-W/DAC-W/O-S>",
READ_CONTROL, "STANDARD_RIGHTS_READ <R/C>",
READ_CONTROL, "STANDARD_RIGHTS_WRITE <R/C>",
READ_CONTROL, "STANDARD_RIGHTS_EXECUTE <R/C>",
SERVER_ALL_ACCESS, "SERVER_ALL_ACCESS <SRREQ-SAA-SAE>",
SERVER_READ, "SERVER_READ <SRR-SAE>",
SERVER_WRITE, "SERVER_WRITE <SRW-SAA-SAE>",
SERVER_EXECUTE, "SERVER_EXECUTE <SRE-SAE>",
PRINTER_ALL_ACCESS, "PRINTER_ALL_ACCESS <SRREQ-PAA-PAU>",
PRINTER_READ, "PRINTER_READ <SRR-PAU>",
PRINTER_WRITE, "PRINTER_WRITE <SRW-PAU>",
PRINTER_EXECUTE, "PRINTER_EXECUTE <SRE-PAU>",
JOB_ALL_ACCESS, "JOB_ALL_ACCESS <SRREQ-JAA>",
JOB_READ, "JOB_READ <SRR-JAA>",
JOB_WRITE, "JOB_WRITE <SRW-JAA>",
JOB_EXECUTE, "JOB_EXECUTE <SRE-JAA>"
};
BOOL
DbgDumpSecurityDescriptor(
HANDLE hCurrentProcess,
PNTSD_OUTPUT_ROUTINE Print,
PISECURITY_DESCRIPTOR pSecurityDescriptor
)
{
BOOL bSe_Self_Relative = FALSE;
DWORD i;
DWORD OwnerSidAddress, GroupSidAddress;
DWORD SaclAddress, DaclAddress;
SECURITY_DESCRIPTOR SecurityDescriptor;
memset(&SecurityDescriptor, 0, sizeof(SECURITY_DESCRIPTOR));
movestruct(pSecurityDescriptor, &SecurityDescriptor, SECURITY_DESCRIPTOR);
(*Print)("SecurityDescriptor\n");
bSe_Self_Relative = SecurityDescriptor.Control & SE_SELF_RELATIVE;
if (bSe_Self_Relative) {
(*Print)("This Security Descriptor is a Self-Relative Security Descriptor\n");
}
(*Print)("UCHAR Revision 0x%x\n", SecurityDescriptor.Revision);
(*Print)("UCHAR Sbz1 0x%x\n", SecurityDescriptor.Sbz1);
(*Print)("USHORT Control 0x%x\n", SecurityDescriptor.Control);
for (i = 0; i < MAX_SDC_FLAGS; i++ ) {
if (SecurityDescriptor.Control & SDC_Table[i].Flag) {
(*Print)("%s - ON (%.4x)\n", SDC_Table[i].String, SDC_Table[i].Flag);
} else {
(*Print)("%s - OFF (%.4x)\n", SDC_Table[i].String, SDC_Table[i].Flag);
}
}
//
// Now dumping out the owner's sid
//
if (SecurityDescriptor.Owner == NULL) {
(*Print)("PSID Owner null -- no owner sid present in the security descriptor\n");
}else {
if (bSe_Self_Relative) {
// (*Print)("PSID Owner Offset 0x%.8x\n",SecurityDescriptor.Owner);
OwnerSidAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Owner;
}else {
OwnerSidAddress = (DWORD)SecurityDescriptor.Owner;
}
// (*Print)("PSID Owner 0x%.8x\n", OwnerSidAddress);
}
(*Print)("The owner's sid is:\t\n");
DbgDumpSid(hCurrentProcess, Print, (PVOID)OwnerSidAddress);
(*Print)("\n\n");
//
// Now dumping out the group's sid
if (SecurityDescriptor.Group == NULL) {
(*Print)("PSID Group null -- no group sid present in the security descriptor\n");
}else {
if (bSe_Self_Relative) {
// (*Print)("PSID Group Offset 0x%.8x\n", SecurityDescriptor.Group);
GroupSidAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Group;
}else {
GroupSidAddress = (DWORD)SecurityDescriptor.Group;
}
// (*Print)("PSID Group 0x%.8x\n", GroupSidAddress);
}
(*Print)("The group's sid is:\t\n");
DbgDumpSid(hCurrentProcess, Print, (PVOID)GroupSidAddress);
(*Print)("\n");
if (SecurityDescriptor.Sacl == NULL) {
(*Print)("PACL Sacl null -- no sacl present in this security descriptor\n");
}else {
if (bSe_Self_Relative) {
// (*Print)("PACL Sacl Offset %.8x\n", SecurityDescriptor.Sacl);
SaclAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Sacl;
}else{
SaclAddress = (DWORD)SecurityDescriptor.Sacl;
}
// (*Print)("PACL Sacl 0x%.8x\n", SaclAddress);
}
if (SecurityDescriptor.Dacl == NULL) {
(*Print)("PACL Dacl null -- no dacl present in this security descriptor\n");
}else {
if (bSe_Self_Relative) {
// (*Print)("PACL Dacl Offset %.8x\n", SecurityDescriptor.Dacl);
DaclAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Dacl;
}else {
DaclAddress = (DWORD)SecurityDescriptor.Dacl;
}
(*Print)("PACL Dacl 0x%.8x\n", DaclAddress);
DbgDumpAcl(hCurrentProcess, Print,(PVOID)DaclAddress);
}
}
BOOL
DbgDumpSid(
HANDLE hCurrentProcess,
PNTSD_OUTPUT_ROUTINE Print,
PVOID SidAddress
)
{
BYTE Sid[256];
CHAR SidString[256];
SID_NAME_USE SidType = 1;
// (*Print)("Size of a SID is %d\n", sizeof(SID));
// movestruct(SidAddress, &Sid, SID);
memset(Sid, 0, 256);
movemem(SidAddress, Sid, 256);
ConvertSidToAsciiString(Sid, SidString);
(*Print)("PSID %s\n", SidString);
}
BOOL
DbgDumpAceHeader(
HANDLE hCurrentProcess,
PNTSD_OUTPUT_ROUTINE Print,
PVOID AceHeaderAddress
)
{
ACE_HEADER AceHeader;
DWORD i = 0;
memset(&AceHeader, 0, sizeof(ACE_HEADER));
movestruct(AceHeaderAddress, &AceHeader, ACE_HEADER);
(*Print)("UCHAR AceType %.2x\n", AceHeader.AceType);
switch (AceHeader.AceType) {
case ACCESS_ALLOWED_ACE_TYPE:
(*Print)("This is an ace of type: ACCESS_ALLOWED_ACE_TYPE\n");
break;
case ACCESS_DENIED_ACE_TYPE:
(*Print)("This is an ace of type: ACCESS_DENIED_ACE_TYPE\n");
break;
case SYSTEM_AUDIT_ACE_TYPE:
(*Print)("This is an ace of type: SYSTEM_AUDIT_ACE_TYPE\n");
break;
case SYSTEM_ALARM_ACE_TYPE:
(*Print)("This is an ace of type: SYSTEM_ALARM_ACE_TYPE\n");
break;
}
(*Print)("UCHAR AceFlags %.2x\n", AceHeader.AceFlags);
for (i = 0; i < MAX_ACE_FLAGS; i++ ) {
if (AceFlagsTable[i].Flags & AceHeader.AceFlags) {
(*Print)("%s - ON (%d)\n", AceFlagsTable[i].String, AceFlagsTable[i].Flags);
}else {
(*Print)("%s - OFF (%d)\n", AceFlagsTable[i].String, AceFlagsTable[i].Flags);
}
}
(*Print)("USHORT AceSize %d\n", AceHeader.AceSize);
}
BOOL
DbgDumpAcl(
HANDLE hCurrentProcess,
PNTSD_OUTPUT_ROUTINE Print,
PVOID AclAddress
)
{
ACL Acl;
PVOID AceAddress;
ACE_HEADER AceHeader;
ACCESS_ALLOWED_ACE AccessAllowedAce;
ACCESS_DENIED_ACE AccessDeniedAce;
SYSTEM_AUDIT_ACE SystemAuditAce;
SYSTEM_ALARM_ACE SystemAlarmAce;
DWORD i;
DWORD SidAddress;
// Pull the Acl across
movestruct(AclAddress, &Acl, ACL);
(*Print)("ACL\n");
(*Print)("UCHAR AclRevision 0x%x\n", Acl.AclRevision);
(*Print)("UCHAR Sbz1 0x%x\n", Acl.Sbz1);
(*Print)("USHORT AclSize %d\n", Acl.AclSize);
(*Print)("USHORT AceCount %d\n", Acl.AceCount);
(*Print)("USHORT Sz2 0x%x\n", Acl.Sbz2);
AceAddress = (LPBYTE)AclAddress + sizeof(ACL);
for (i = 0; i < Acl.AceCount; i++ ) {
(*Print)("\nAce # %d: ",i);
DbgDumpAceHeader(hCurrentProcess, Print, AceAddress);
movestruct(AceAddress, &AceHeader, ACE_HEADER);
switch (AceHeader.AceType) {
case ACCESS_ALLOWED_ACE_TYPE:
memset(&AccessAllowedAce, 0, sizeof(ACCESS_ALLOWED_ACE));
movestruct(AceAddress, &AccessAllowedAce, ACCESS_ALLOWED_ACE);
(*Print)("ACCESSMASK AccessMask %.8x\n", AccessAllowedAce.Mask);
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
// (*Print)("The Address of the Sid is %.8x\n", SidAddress);
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
break;
case ACCESS_DENIED_ACE_TYPE:
memset(&AccessDeniedAce, 0, sizeof(ACCESS_DENIED_ACE));
movestruct(AceAddress, &AccessDeniedAce, ACCESS_DENIED_ACE);
(*Print)("ACCESSMASK AccessMask %.8x\n", AccessDeniedAce.Mask);
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
break;
case SYSTEM_AUDIT_ACE_TYPE:
memset(&SystemAuditAce, 0, sizeof(SYSTEM_AUDIT_ACE));
movestruct(AceAddress, &SystemAuditAce, SYSTEM_AUDIT_ACE);
(*Print)("ACCESSMASK AccessMask %.8x\n", SystemAuditAce.Mask);
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
break;
case SYSTEM_ALARM_ACE_TYPE:
memset(&SystemAlarmAce, 0, sizeof(SYSTEM_ALARM_ACE));
movestruct(AceAddress, &SystemAlarmAce, SYSTEM_ALARM_ACE);
(*Print)("ACCESSMASK AccessMask %.8x\n", SystemAlarmAce.Mask);
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
break;
}
AceAddress = (PVOID)((DWORD)AceAddress + AceHeader.AceSize);
(*Print)("\n");
}
}
BOOL
dsd(
HANDLE hCurrentProcess,
HANDLE hCurrentThread,
DWORD dwCurrentPc,
PNTSD_EXTENSION_APIS lpExtensionApis,
LPSTR lpArgumentString)
{
PNTSD_OUTPUT_ROUTINE Print;
PNTSD_GET_EXPRESSION EvalExpression;
PNTSD_GET_SYMBOL GetSymbol;
DWORD dwAddress = (DWORD)NULL;
DWORD dwCount = 0;
BOOL bThereAreOptions = TRUE;
UNREFERENCED_PARAMETER(hCurrentProcess);
UNREFERENCED_PARAMETER(hCurrentThread);
UNREFERENCED_PARAMETER(dwCurrentPc);
Print = lpExtensionApis->lpOutputRoutine;
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
while (bThereAreOptions) {
while (isspace(*lpArgumentString)) {
lpArgumentString++;
}
switch (*lpArgumentString) {
case 'c':
lpArgumentString++;
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
break;
default: // go get the address because there's nothing else
bThereAreOptions = FALSE;
break;
}
}
if (*lpArgumentString != 0) {
dwAddress = EvalValue(&lpArgumentString, EvalExpression, Print);
}
// if we've got no address, then quit now - nothing we can do
if (dwAddress == (DWORD)NULL) {
Print("We have a Null address\n");
return(0);
}
DbgDumpSecurityDescriptor(
hCurrentProcess,
Print,
(PISECURITY_DESCRIPTOR)dwAddress
);
// Add Command to the Command Queue
return 0;
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
}
BOOL
dsid(
HANDLE hCurrentProcess,
HANDLE hCurrentThread,
DWORD dwCurrentPc,
PNTSD_EXTENSION_APIS lpExtensionApis,
LPSTR lpArgumentString)
{
PNTSD_OUTPUT_ROUTINE Print;
PNTSD_GET_EXPRESSION EvalExpression;
PNTSD_GET_SYMBOL GetSymbol;
DWORD dwAddress = (DWORD)NULL;
DWORD dwCount = 0;
BOOL bThereAreOptions = TRUE;
UNREFERENCED_PARAMETER(hCurrentProcess);
UNREFERENCED_PARAMETER(hCurrentThread);
UNREFERENCED_PARAMETER(dwCurrentPc);
Print = lpExtensionApis->lpOutputRoutine;
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
while (bThereAreOptions) {
while (isspace(*lpArgumentString)) {
lpArgumentString++;
}
switch (*lpArgumentString) {
case 'c':
lpArgumentString++;
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
break;
default: // go get the address because there's nothing else
bThereAreOptions = FALSE;
break;
}
}
if (*lpArgumentString != 0) {
dwAddress = EvalValue(&lpArgumentString, EvalExpression, Print);
}
// if we've got no address, then quit now - nothing we can do
if (dwAddress == (DWORD)NULL) {
Print("We have a Null address\n");
return(0);
}
DbgDumpSid(
hCurrentProcess,
Print,
(PVOID)dwAddress
);
// Add Command to the Command Queue
return 0;
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
}
BOOL
DbgDumpAccessMask(
HANDLE hCurrentProcess,
PNTSD_OUTPUT_ROUTINE Print,
DWORD AccessMask
)
{
DWORD i;
for (i = 0; i < 33; i++) {
if (AccessMask & AccessMaskTable[i].Flag) {
(*Print)("%s\t\tON\n", AccessMaskTable[i].String);
}else {
(*Print)("%s\t\tOFF\n", AccessMaskTable[i].String);
}
}
return TRUE;
}
BOOL
dam(
HANDLE hCurrentProcess,
HANDLE hCurrentThread,
DWORD dwCurrentPc,
PNTSD_EXTENSION_APIS lpExtensionApis,
LPSTR lpArgumentString)
{
PNTSD_OUTPUT_ROUTINE Print;
PNTSD_GET_EXPRESSION EvalExpression;
PNTSD_GET_SYMBOL GetSymbol;
DWORD AccessMask = (DWORD)NULL;
DWORD dwCount = 0;
BOOL bThereAreOptions = TRUE;
UNREFERENCED_PARAMETER(hCurrentProcess);
UNREFERENCED_PARAMETER(hCurrentThread);
UNREFERENCED_PARAMETER(dwCurrentPc);
Print = lpExtensionApis->lpOutputRoutine;
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
while (bThereAreOptions) {
while (isspace(*lpArgumentString)) {
lpArgumentString++;
}
switch (*lpArgumentString) {
case 'c':
lpArgumentString++;
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
break;
default: // go get the address because there's nothing else
bThereAreOptions = FALSE;
break;
}
}
if (*lpArgumentString != 0) {
AccessMask = EvalValue(&lpArgumentString, EvalExpression, Print);
}
// if we've got no address, then quit now - nothing we can do
if (AccessMask == (DWORD)NULL) {
Print("We have a Null address\n");
return(0);
}
DbgDumpAccessMask(
hCurrentProcess,
Print,
AccessMask
);
// Add Command to the Command Queue
return 0;
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
}

Reference in a new issue Copy permalink