|
|
#include "pch.h"
AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAET;UCHAR Buffer[2048];AUTHZ_ACCESS_REQUEST Request = {0};PAUTHZ_ACCESS_REPLY pReply = (PAUTHZ_ACCESS_REPLY) Buffer;BOOL b = TRUE;HANDLE hToken = NULL;LUID Luid = {0xdead,0xbeef};NTSTATUS Status = STATUS_SUCCESS;PAUDIT_PARAMS pParams = NULL;
PHANDLE pThreads = NULL;ACCESS_MASK DesiredAccess = 0;DWORD dwThreads = 0;DWORD dwThreadsRemaining = 0;DWORD dwAuditsPerThread = 0;BOOL bAudit = 0;DWORD i = 0;
PSECURITY_DESCRIPTOR pSD = NULL;PWCHAR StringSD = L"O:BAG:DUD:(A;;0x40;;;s-1-2-2)(A;;0x1;;;BA)(OA;;0x2;6da8a4ff-0e52-11d0-a286-00aa00304900;;BA)(OA;;0x4;6da8a4ff-0e52-11d0-a286-00aa00304901;;BA)(OA;;0x8;6da8a4ff-0e52-11d0-a286-00aa00304903;;AU)(OA;;0x10;6da8a4ff-0e52-11d0-a286-00aa00304904;;BU)(OA;;0x20;6da8a4ff-0e52-11d0-a286-00aa00304905;;AU)(A;;0x40;;;PS)S:(AU;IDSAFA;0xFFFFFF;;;WD)";
AUTHZ_AUDIT_EVENT_HANDLE hAuditEvent1 = NULL;AUTHZ_AUDIT_EVENT_HANDLE hAuditEvent2 = NULL;AUTHZ_RESOURCE_MANAGER_HANDLE hRM = NULL;AUTHZ_CLIENT_CONTEXT_HANDLE hCC = NULL;AUTHZ_ACCESS_CHECK_RESULTS_HANDLE hAuthzCache = NULL;AUTHZ_AUDIT_QUEUE_HANDLE hAAQ = NULL;
ULONG AccessCheckAuditWork( LPVOID lpParameter ){ DWORD i = 0; DWORD num = *((PDWORD)lpParameter);
for (i = 0; i < dwAuditsPerThread; i++) { b = AuthzAccessCheck( 0, hCC, &Request, hAuditEvent2, pSD, NULL, 0, pReply, NULL );
b = AuthzAccessCheck( 0, hCC, &Request, hAuditEvent1, pSD, NULL, 0, pReply, NULL );
}
InterlockedDecrement( &dwThreadsRemaining );
wprintf(L"Thread Done %d (%d left).\n", num, dwThreadsRemaining); return TRUE;}
void _cdecl wmain(int argc, WCHAR * argv[]){ if (argc != 5) { wprintf(L"usage: %s AccessMask dwThreads dwAuditsPerThread bAudit\n", argv[0]); exit(0); }
DesiredAccess = wcstol(argv[1], NULL, 16); dwThreads = wcstol(argv[2], NULL, 10); dwAuditsPerThread = wcstol(argv[3], NULL, 10); bAudit = wcstol(argv[4], NULL, 10);
dwThreadsRemaining = dwThreads;
pThreads = LocalAlloc( 0, sizeof(HANDLE) * dwThreads );
if (NULL == pThreads) { wprintf(L"LocalAlloc failed with %d\n", GetLastError()); return; }
//
// Create the SD for the access checks
//
b = ConvertStringSecurityDescriptorToSecurityDescriptorW( StringSD, SDDL_REVISION_1, &pSD, NULL );
if (!b) { wprintf(L"SDDL failed with %d\n", GetLastError()); return; }
//
// Authz stuff
//
b = AuthzInitializeResourceManager( 0, NULL, NULL, NULL, L"Jeff's RM", &hRM );
if (!b) { wprintf(L"AuthzInitializeResourceManager failed with %d\n", GetLastError()); return; } b = AuthziInitializeAuditQueue( AUTHZ_MONITOR_AUDIT_QUEUE_SIZE, 10000, 500, NULL, &hAAQ );
if (!b) { printf("AuthzInitializeAuditQueue failed with %d.\n", GetLastError()); return; }
b = AuthziInitializeAuditEventType( 0, SE_CATEGID_OBJECT_ACCESS, 777, 1, &hAET );
if (!b) { wprintf(L"initaet returned %d\n", GetLastError()); return; }
b = AuthziAllocateAuditParams( &pParams, 1 );
AuthziInitializeAuditParamsWithRM( 0, hRM, 1, pParams, APT_String, L"Hello???" );
b = AuthziInitializeAuditEvent( AUTHZ_NO_ALLOC_STRINGS, hRM, hAET, //NULL, // event
pParams, //NULL, // params
hAAQ, // queue
INFINITE, // timeout
L"op type", L"object type", L"object name", L"some additional info", &hAuditEvent2 );
b = AuthziInitializeAuditEvent( 0, hRM, NULL, // event
NULL, // params
NULL, // queue
INFINITE, // timeout
L"op type1", L"object type1", L"object name1", L"some additional info1", &hAuditEvent1 ); if (!b) { printf("AuthzInitializeAuditInfo failed with %d.\n", GetLastError()); return; }
//
// Create a client context from the current token.
//
OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY, &hToken );
b = AuthzInitializeContextFromToken( 0, hToken, hRM, NULL, Luid, NULL, &hCC );
if (!b) { wprintf(L"AuthzInitializeContextFromToken failed with 0x%x\n", GetLastError()); return; }
//
// Now do the access check.
//
Request.ObjectTypeList = NULL; Request.PrincipalSelfSid = NULL; Request.DesiredAccess = DesiredAccess;
pReply->ResultListLength = 1; pReply->Error = (PDWORD) (((PCHAR) pReply) + sizeof(AUTHZ_ACCESS_REPLY)); pReply->GrantedAccessMask = (PACCESS_MASK) (pReply->Error + pReply->ResultListLength); pReply->SaclEvaluationResults = (PDWORD) (pReply->GrantedAccessMask + (pReply->ResultListLength * sizeof(ACCESS_MASK)));
wprintf(L"* AccessCheck (PrincipalSelfSid == NULL, ResultListLength == 8)\n"); b = AuthzAccessCheck( 0, hCC, &Request, NULL, pSD, NULL, 0, pReply, &hAuthzCache );
if (!b) { wprintf(L"Initial AuthzAccessCheck failed with %d\n", GetLastError()); return; } else { wprintf(L"Initial AuthzAccessCheck succeeded. Here are results:\n");
for (i = 0; i < pReply->ResultListLength; i++) { wprintf(L"ObjectType %d :: AccessMask = 0x%x, Error = %d\n", i, pReply->GrantedAccessMask[i], pReply->Error[i]); } }
wprintf(L"\nBeginning creation of audit threads.\n");
for (i = 0; i < dwThreads; i++) { pThreads[i] = CreateThread( NULL, 0, AccessCheckAuditWork, &i, CREATE_SUSPENDED, NULL ); if (pThreads[i] == NULL) { wprintf(L"CreateThread failed for thread %d with %d\n", i, GetLastError()); return; } }
for (i = 0; i < dwThreads; i++) { if (-1 == ResumeThread( pThreads[i] )) { wprintf(L"ResumeThread failed on thread %d with %d\n", i, GetLastError()); fflush(stdout); } }
Status = WaitForMultipleObjects( i, pThreads, TRUE, INFINITE );
if (!NT_SUCCESS(Status)) { wprintf(L"Wait failed %d.\n", GetLastError()); }
wprintf(L"Done waiting for all threads.\n"); AuthzFreeAuditEvent( hAuditEvent2 );
AuthziFreeAuditQueue(hAAQ);
AuthzFreeContext(hCC);
return;}
|
