581 lines
15 KiB
C
581 lines
15 KiB
C
/*++
|
||
|
||
Copyright (c) 1989 Microsoft Corporation
|
||
|
||
Module Name:
|
||
|
||
uipers.c
|
||
|
||
Abstract:
|
||
|
||
Temporary security context display command.
|
||
|
||
|
||
Author:
|
||
|
||
Jim Kelly (JimK) 23-May-1991
|
||
|
||
Revision History:
|
||
|
||
--*/
|
||
|
||
#include <nt.h>
|
||
#include <ntrtl.h>
|
||
#include <nturtl.h>
|
||
#include <stdio.h>
|
||
#include <string.h>
|
||
|
||
#define _TST_USER_ // User mode test
|
||
|
||
|
||
#include "tsevars.c" // Common test variables
|
||
#include "tsecomm.c" // Mode dependent macros and routines.
|
||
|
||
|
||
GUID SystemAuthenticationId = SYSTEM_GUID;
|
||
|
||
|
||
VOID
|
||
DisplaySecurityContext(
|
||
IN HANDLE TokenHandle
|
||
);
|
||
|
||
|
||
VOID
|
||
DisplayAccountSid(
|
||
PISID Sid
|
||
);
|
||
|
||
|
||
BOOLEAN
|
||
SidTranslation(
|
||
PSID Sid,
|
||
PSTRING AccountName
|
||
);
|
||
|
||
|
||
|
||
|
||
////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Private Macros //
|
||
// //
|
||
////////////////////////////////////////////////////////////////
|
||
|
||
|
||
#define PrintGuid(G) \
|
||
printf( "(0x%lx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx)\n", \
|
||
(G)->Data1, (G)->Data2, (G)->Data3, \
|
||
(G)->Data4[0], (G)->Data4[1], (G)->Data4[2], \
|
||
(G)->Data4[3], (G)->Data4[4], (G)->Data4[5], \
|
||
(G)->Data4[6], (G)->Data4[7]); \
|
||
|
||
|
||
BOOLEAN
|
||
SidTranslation(
|
||
PSID Sid,
|
||
PSTRING AccountName
|
||
)
|
||
// AccountName is expected to have a large maximum length
|
||
|
||
{
|
||
if (RtlEqualSid(Sid, WorldSid)) {
|
||
RtlInitString( AccountName, "WORLD");
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, LocalSid)) {
|
||
RtlInitString( AccountName, "LOCAL");
|
||
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, NetworkSid)) {
|
||
RtlInitString( AccountName, "NETWORK");
|
||
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, BatchSid)) {
|
||
RtlInitString( AccountName, "BATCH");
|
||
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, InteractiveSid)) {
|
||
RtlInitString( AccountName, "INTERACTIVE");
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, LocalSystemSid)) {
|
||
RtlInitString( AccountName, "SYSTEM");
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, LocalManagerSid)) {
|
||
RtlInitString( AccountName, "LOCAL MANAGER");
|
||
return(TRUE);
|
||
}
|
||
|
||
if (RtlEqualSid(Sid, LocalAdminSid)) {
|
||
RtlInitString( AccountName, "LOCAL ADMIN");
|
||
return(TRUE);
|
||
}
|
||
|
||
return(FALSE);
|
||
|
||
}
|
||
|
||
|
||
VOID
|
||
DisplayAccountSid(
|
||
PISID Sid
|
||
)
|
||
{
|
||
UCHAR Buffer[128];
|
||
STRING AccountName;
|
||
UCHAR i;
|
||
ULONG Tmp;
|
||
|
||
Buffer[0] = 0;
|
||
|
||
AccountName.MaximumLength = 127;
|
||
AccountName.Length = 0;
|
||
AccountName.Buffer = (PVOID)&Buffer[0];
|
||
|
||
|
||
|
||
if (SidTranslation( (PSID)Sid, &AccountName) ) {
|
||
|
||
printf("%s\n", AccountName.Buffer );
|
||
|
||
} else {
|
||
printf("S-%lu-", (USHORT)Sid->Revision );
|
||
if ( (Sid->IdentifierAuthority.Value[0] != 0) ||
|
||
(Sid->IdentifierAuthority.Value[1] != 0) ){
|
||
printf("0x%02hx%02hx%02hx%02hx%02hx%02hx",
|
||
(USHORT)Sid->IdentifierAuthority.Value[0],
|
||
(USHORT)Sid->IdentifierAuthority.Value[1],
|
||
(USHORT)Sid->IdentifierAuthority.Value[2],
|
||
(USHORT)Sid->IdentifierAuthority.Value[3],
|
||
(USHORT)Sid->IdentifierAuthority.Value[4],
|
||
(USHORT)Sid->IdentifierAuthority.Value[5] );
|
||
} else {
|
||
Tmp = (ULONG)Sid->IdentifierAuthority.Value[5] +
|
||
(ULONG)(Sid->IdentifierAuthority.Value[4] << 8) +
|
||
(ULONG)(Sid->IdentifierAuthority.Value[3] << 16) +
|
||
(ULONG)(Sid->IdentifierAuthority.Value[2] << 24);
|
||
printf("%lu", Tmp);
|
||
}
|
||
|
||
|
||
for (i=0;i<Sid->SubAuthorityCount ;i++ ) {
|
||
printf("-%lu", Sid->SubAuthority[i]);
|
||
}
|
||
printf("\n");
|
||
|
||
}
|
||
|
||
}
|
||
|
||
|
||
|
||
BOOLEAN
|
||
DisplayPrivilegeName(
|
||
PLUID Privilege
|
||
)
|
||
{
|
||
|
||
//
|
||
// This should be rewritten to use RtlLookupPrivilegeName.
|
||
//
|
||
// First we should probably spec and write RtlLookupPrivilegeName.
|
||
//
|
||
|
||
if ( ((*Privilege)QuadPart == CreateTokenPrivilege.QuadPart)) {
|
||
printf("SeCreateTokenPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == AssignPrimaryTokenPrivilege.QuadPart)) {
|
||
printf("SeAssignPrimaryTokenPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == LockMemoryPrivilege.QuadPart)) {
|
||
printf("SeLockMemoryPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == IncreaseQuotaPrivilege.QuadPart)) {
|
||
printf("SeIncreaseQuotaPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == UnsolicitedInputPrivilege.QuadPart)) {
|
||
printf("SeUnsolicitedInputPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == TcbPrivilege.QuadPart)) {
|
||
printf("SeTcbPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == SecurityPrivilege.QuadPart)) {
|
||
printf("SeSecurityPrivilege (Security Operator) ");
|
||
return(TRUE);
|
||
}
|
||
|
||
|
||
if ( ((*Privilege).QuadPart == TakeOwnershipPrivilege.QuadPart)) {
|
||
printf("SeTakeOwnershipPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == LpcReplyBoostPrivilege.QuadPart)) {
|
||
printf("SeLpcReplyBoostPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == CreatePagefilePrivilege.QuadPart)) {
|
||
printf("SeCreatePagefilePrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == IncreaseBasePriorityPrivilege.QuadPart)) {
|
||
printf("SeIncreaseBasePriorityPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == SystemProfilePrivilege.QuadPart)) {
|
||
printf("SeSystemProfilePrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == SystemtimePrivilege.QuadPart)) {
|
||
printf("SeSystemtimePrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == ProfileSingleProcessPrivilege.QuadPart)) {
|
||
printf("SeProfileSingleProcessPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == CreatePermanentPrivilege.QuadPart)) {
|
||
printf("SeCreatePermanentPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == BackupPrivilege.QuadPart)) {
|
||
printf("SeBackupPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == RestorePrivilege.QuadPart)) {
|
||
printf("SeRestorePrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == ShutdownPrivilege.QuadPart)) {
|
||
printf("SeShutdownPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == DebugPrivilege.QuadPart)) {
|
||
printf("SeDebugPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
if ( ((*Privilege).QuadPart == SystemEnvironmentPrivilege.QuadPart)) {
|
||
printf("SeSystemEnvironmentPrivilege ");
|
||
return(TRUE);
|
||
}
|
||
|
||
return(FALSE);
|
||
|
||
}
|
||
|
||
|
||
|
||
VOID
|
||
DisplayPrivilege(
|
||
PLUID_AND_ATTRIBUTES Privilege
|
||
)
|
||
{
|
||
|
||
|
||
if (!DisplayPrivilegeName(&Privilege->Luid)) {
|
||
printf("(Unknown Privilege. Value is: (0x%lx,0x%lx))",
|
||
Privilege->Luid.HighPart,
|
||
Privilege->Luid.LowPart
|
||
);
|
||
}
|
||
|
||
|
||
|
||
//
|
||
// Display the attributes assigned to the privilege.
|
||
//
|
||
|
||
printf("\n [");
|
||
if (!(Privilege->Attributes & SE_PRIVILEGE_ENABLED)) {
|
||
printf("Not ");
|
||
}
|
||
printf("Enabled");
|
||
|
||
//printf(" / ");
|
||
//if (!(Privilege->Attributes & SE_PRIVILEGE_ENABLED_BY_DEFAULT)) {
|
||
// printf("Not ");
|
||
//}
|
||
//printf("Enabled By Default");
|
||
|
||
|
||
printf("]\n");
|
||
printf(" ");
|
||
|
||
|
||
return;
|
||
|
||
}
|
||
|
||
|
||
VOID
|
||
DisplaySecurityContext(
|
||
IN HANDLE TokenHandle
|
||
)
|
||
{
|
||
|
||
#define BUFFER_SIZE (2048)
|
||
|
||
NTSTATUS Status;
|
||
ULONG i;
|
||
ULONG ReturnLength;
|
||
TOKEN_STATISTICS ProcessTokenStatistics;
|
||
GUID AuthenticationId;
|
||
UCHAR Buffer[BUFFER_SIZE];
|
||
|
||
|
||
PTOKEN_USER UserId;
|
||
PTOKEN_OWNER DefaultOwner;
|
||
PTOKEN_PRIMARY_GROUP PrimaryGroup;
|
||
PTOKEN_GROUPS GroupIds;
|
||
PTOKEN_PRIVILEGES Privileges;
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Logon ID //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenStatistics, // TokenInformationClass
|
||
&ProcessTokenStatistics, // TokenInformation
|
||
sizeof(TOKEN_STATISTICS), // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
ASSERT(NT_SUCCESS(Status));
|
||
AuthenticationId = ProcessTokenStatistics.AuthenticationId;
|
||
|
||
printf(" Logon Session: ");
|
||
if (RtlEqualGuid(&AuthenticationId, &SystemAuthenticationId )) {
|
||
printf("(System Logon Session)\n");
|
||
} else {
|
||
PrintGuid( &AuthenticationId );
|
||
}
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// User Id //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
UserId = (PTOKEN_USER)&Buffer[0];
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenUser, // TokenInformationClass
|
||
UserId, // TokenInformation
|
||
BUFFER_SIZE, // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
|
||
|
||
ASSERT(NT_SUCCESS(Status));
|
||
|
||
printf(" User id: ");
|
||
DisplayAccountSid( (PISID)UserId->User.Sid );
|
||
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Default Owner //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
DefaultOwner = (PTOKEN_OWNER)&Buffer[0];
|
||
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenOwner, // TokenInformationClass
|
||
DefaultOwner, // TokenInformation
|
||
BUFFER_SIZE, // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
|
||
|
||
ASSERT(NT_SUCCESS(Status));
|
||
|
||
printf(" Default Owner: ");
|
||
DisplayAccountSid( (PISID)DefaultOwner->Owner );
|
||
|
||
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Primary Group //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
PrimaryGroup = (PTOKEN_PRIMARY_GROUP)&Buffer[0];
|
||
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenPrimaryGroup, // TokenInformationClass
|
||
PrimaryGroup, // TokenInformation
|
||
BUFFER_SIZE, // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
|
||
|
||
ASSERT(NT_SUCCESS(Status));
|
||
|
||
printf(" Primary Group: ");
|
||
DisplayAccountSid( (PISID)PrimaryGroup->PrimaryGroup );
|
||
|
||
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Group Ids //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
printf("\n");
|
||
GroupIds = (PTOKEN_GROUPS)&Buffer[0];
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenGroups, // TokenInformationClass
|
||
GroupIds, // TokenInformation
|
||
BUFFER_SIZE, // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
|
||
|
||
ASSERT(NT_SUCCESS(Status));
|
||
|
||
//printf(" Number of groups: %ld\n", GroupIds->GroupCount);
|
||
printf(" Groups: ");
|
||
|
||
for (i=0; i < GroupIds->GroupCount; i++ ) {
|
||
//printf(" Group %ld: ", i);
|
||
DisplayAccountSid( (PISID)GroupIds->Groups[i].Sid );
|
||
printf(" ");
|
||
}
|
||
|
||
|
||
|
||
|
||
|
||
/////////////////////////////////////////////////////////////////////////
|
||
// //
|
||
// Privileges //
|
||
// //
|
||
/////////////////////////////////////////////////////////////////////////
|
||
|
||
printf("\n");
|
||
Privileges = (PTOKEN_PRIVILEGES)&Buffer[0];
|
||
Status = NtQueryInformationToken(
|
||
TokenHandle, // Handle
|
||
TokenPrivileges, // TokenInformationClass
|
||
Privileges, // TokenInformation
|
||
BUFFER_SIZE, // TokenInformationLength
|
||
&ReturnLength // ReturnLength
|
||
);
|
||
|
||
|
||
ASSERT(NT_SUCCESS(Status));
|
||
|
||
printf(" Privileges: ");
|
||
if (Privileges->PrivilegeCount > 0) {
|
||
|
||
for (i=0; i < Privileges->PrivilegeCount; i++ ) {
|
||
DisplayPrivilege( &(Privileges->Privileges[i]) );
|
||
}
|
||
} else {
|
||
printf("(none assigned)\n");
|
||
}
|
||
|
||
|
||
|
||
return;
|
||
|
||
}
|
||
|
||
|
||
BOOLEAN
|
||
main()
|
||
{
|
||
|
||
NTSTATUS Status;
|
||
HANDLE ProcessToken;
|
||
|
||
|
||
TSeVariableInitialization(); // Initialize global variables
|
||
|
||
printf("\n");
|
||
|
||
|
||
//
|
||
// Open our process token
|
||
//
|
||
|
||
Status = NtOpenProcessToken(
|
||
NtCurrentProcess(),
|
||
TOKEN_QUERY,
|
||
&ProcessToken
|
||
);
|
||
if (!NT_SUCCESS(Status)) {
|
||
printf("I'm terribly sorry, but you don't seem to have access to\n");
|
||
printf("open your own process's token.\n");
|
||
printf("\n");
|
||
return(FALSE);
|
||
}
|
||
|
||
printf("Your process level security context is:\n");
|
||
printf("\n");
|
||
DisplaySecurityContext( ProcessToken );
|
||
|
||
|
||
Status = NtClose( ProcessToken );
|
||
|
||
return(TRUE);
|
||
}
|
||
|