You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
580 lines
16 KiB
580 lines
16 KiB
/*++
|
|
|
|
Copyright (c) 1989 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
uipers.c
|
|
|
|
Abstract:
|
|
|
|
Temporary security context display command.
|
|
|
|
|
|
Author:
|
|
|
|
Jim Kelly (JimK) 23-May-1991
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
#include <nt.h>
|
|
#include <ntrtl.h>
|
|
#include <nturtl.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
#define _TST_USER_ // User mode test
|
|
|
|
|
|
#include "tsevars.c" // Common test variables
|
|
#include "tsecomm.c" // Mode dependent macros and routines.
|
|
|
|
|
|
GUID SystemAuthenticationId = SYSTEM_GUID;
|
|
|
|
|
|
VOID
|
|
DisplaySecurityContext(
|
|
IN HANDLE TokenHandle
|
|
);
|
|
|
|
|
|
VOID
|
|
DisplayAccountSid(
|
|
PISID Sid
|
|
);
|
|
|
|
|
|
BOOLEAN
|
|
SidTranslation(
|
|
PSID Sid,
|
|
PSTRING AccountName
|
|
);
|
|
|
|
|
|
|
|
|
|
////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Private Macros //
|
|
// //
|
|
////////////////////////////////////////////////////////////////
|
|
|
|
|
|
#define PrintGuid(G) \
|
|
printf( "(0x%lx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx-%hx)\n", \
|
|
(G)->Data1, (G)->Data2, (G)->Data3, \
|
|
(G)->Data4[0], (G)->Data4[1], (G)->Data4[2], \
|
|
(G)->Data4[3], (G)->Data4[4], (G)->Data4[5], \
|
|
(G)->Data4[6], (G)->Data4[7]); \
|
|
|
|
|
|
BOOLEAN
|
|
SidTranslation(
|
|
PSID Sid,
|
|
PSTRING AccountName
|
|
)
|
|
// AccountName is expected to have a large maximum length
|
|
|
|
{
|
|
if (RtlEqualSid(Sid, WorldSid)) {
|
|
RtlInitString( AccountName, "WORLD");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, LocalSid)) {
|
|
RtlInitString( AccountName, "LOCAL");
|
|
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, NetworkSid)) {
|
|
RtlInitString( AccountName, "NETWORK");
|
|
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, BatchSid)) {
|
|
RtlInitString( AccountName, "BATCH");
|
|
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, InteractiveSid)) {
|
|
RtlInitString( AccountName, "INTERACTIVE");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, LocalSystemSid)) {
|
|
RtlInitString( AccountName, "SYSTEM");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, LocalManagerSid)) {
|
|
RtlInitString( AccountName, "LOCAL MANAGER");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, LocalAdminSid)) {
|
|
RtlInitString( AccountName, "LOCAL ADMIN");
|
|
return(TRUE);
|
|
}
|
|
|
|
return(FALSE);
|
|
|
|
}
|
|
|
|
|
|
VOID
|
|
DisplayAccountSid(
|
|
PISID Sid
|
|
)
|
|
{
|
|
UCHAR Buffer[128];
|
|
STRING AccountName;
|
|
UCHAR i;
|
|
ULONG Tmp;
|
|
|
|
Buffer[0] = 0;
|
|
|
|
AccountName.MaximumLength = 127;
|
|
AccountName.Length = 0;
|
|
AccountName.Buffer = (PVOID)&Buffer[0];
|
|
|
|
|
|
|
|
if (SidTranslation( (PSID)Sid, &AccountName) ) {
|
|
|
|
printf("%s\n", AccountName.Buffer );
|
|
|
|
} else {
|
|
printf("S-%lu-", (USHORT)Sid->Revision );
|
|
if ( (Sid->IdentifierAuthority.Value[0] != 0) ||
|
|
(Sid->IdentifierAuthority.Value[1] != 0) ){
|
|
printf("0x%02hx%02hx%02hx%02hx%02hx%02hx",
|
|
(USHORT)Sid->IdentifierAuthority.Value[0],
|
|
(USHORT)Sid->IdentifierAuthority.Value[1],
|
|
(USHORT)Sid->IdentifierAuthority.Value[2],
|
|
(USHORT)Sid->IdentifierAuthority.Value[3],
|
|
(USHORT)Sid->IdentifierAuthority.Value[4],
|
|
(USHORT)Sid->IdentifierAuthority.Value[5] );
|
|
} else {
|
|
Tmp = (ULONG)Sid->IdentifierAuthority.Value[5] +
|
|
(ULONG)(Sid->IdentifierAuthority.Value[4] << 8) +
|
|
(ULONG)(Sid->IdentifierAuthority.Value[3] << 16) +
|
|
(ULONG)(Sid->IdentifierAuthority.Value[2] << 24);
|
|
printf("%lu", Tmp);
|
|
}
|
|
|
|
|
|
for (i=0;i<Sid->SubAuthorityCount ;i++ ) {
|
|
printf("-%lu", Sid->SubAuthority[i]);
|
|
}
|
|
printf("\n");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
BOOLEAN
|
|
DisplayPrivilegeName(
|
|
PLUID Privilege
|
|
)
|
|
{
|
|
|
|
//
|
|
// This should be rewritten to use RtlLookupPrivilegeName.
|
|
//
|
|
// First we should probably spec and write RtlLookupPrivilegeName.
|
|
//
|
|
|
|
if ( ((*Privilege)QuadPart == CreateTokenPrivilege.QuadPart)) {
|
|
printf("SeCreateTokenPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == AssignPrimaryTokenPrivilege.QuadPart)) {
|
|
printf("SeAssignPrimaryTokenPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == LockMemoryPrivilege.QuadPart)) {
|
|
printf("SeLockMemoryPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == IncreaseQuotaPrivilege.QuadPart)) {
|
|
printf("SeIncreaseQuotaPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == UnsolicitedInputPrivilege.QuadPart)) {
|
|
printf("SeUnsolicitedInputPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == TcbPrivilege.QuadPart)) {
|
|
printf("SeTcbPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == SecurityPrivilege.QuadPart)) {
|
|
printf("SeSecurityPrivilege (Security Operator) ");
|
|
return(TRUE);
|
|
}
|
|
|
|
|
|
if ( ((*Privilege).QuadPart == TakeOwnershipPrivilege.QuadPart)) {
|
|
printf("SeTakeOwnershipPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == LpcReplyBoostPrivilege.QuadPart)) {
|
|
printf("SeLpcReplyBoostPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == CreatePagefilePrivilege.QuadPart)) {
|
|
printf("SeCreatePagefilePrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == IncreaseBasePriorityPrivilege.QuadPart)) {
|
|
printf("SeIncreaseBasePriorityPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == SystemProfilePrivilege.QuadPart)) {
|
|
printf("SeSystemProfilePrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == SystemtimePrivilege.QuadPart)) {
|
|
printf("SeSystemtimePrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == ProfileSingleProcessPrivilege.QuadPart)) {
|
|
printf("SeProfileSingleProcessPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == CreatePermanentPrivilege.QuadPart)) {
|
|
printf("SeCreatePermanentPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == BackupPrivilege.QuadPart)) {
|
|
printf("SeBackupPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == RestorePrivilege.QuadPart)) {
|
|
printf("SeRestorePrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == ShutdownPrivilege.QuadPart)) {
|
|
printf("SeShutdownPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == DebugPrivilege.QuadPart)) {
|
|
printf("SeDebugPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if ( ((*Privilege).QuadPart == SystemEnvironmentPrivilege.QuadPart)) {
|
|
printf("SeSystemEnvironmentPrivilege ");
|
|
return(TRUE);
|
|
}
|
|
|
|
return(FALSE);
|
|
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DisplayPrivilege(
|
|
PLUID_AND_ATTRIBUTES Privilege
|
|
)
|
|
{
|
|
|
|
|
|
if (!DisplayPrivilegeName(&Privilege->Luid)) {
|
|
printf("(Unknown Privilege. Value is: (0x%lx,0x%lx))",
|
|
Privilege->Luid.HighPart,
|
|
Privilege->Luid.LowPart
|
|
);
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Display the attributes assigned to the privilege.
|
|
//
|
|
|
|
printf("\n [");
|
|
if (!(Privilege->Attributes & SE_PRIVILEGE_ENABLED)) {
|
|
printf("Not ");
|
|
}
|
|
printf("Enabled");
|
|
|
|
//printf(" / ");
|
|
//if (!(Privilege->Attributes & SE_PRIVILEGE_ENABLED_BY_DEFAULT)) {
|
|
// printf("Not ");
|
|
//}
|
|
//printf("Enabled By Default");
|
|
|
|
|
|
printf("]\n");
|
|
printf(" ");
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
VOID
|
|
DisplaySecurityContext(
|
|
IN HANDLE TokenHandle
|
|
)
|
|
{
|
|
|
|
#define BUFFER_SIZE (2048)
|
|
|
|
NTSTATUS Status;
|
|
ULONG i;
|
|
ULONG ReturnLength;
|
|
TOKEN_STATISTICS ProcessTokenStatistics;
|
|
GUID AuthenticationId;
|
|
UCHAR Buffer[BUFFER_SIZE];
|
|
|
|
|
|
PTOKEN_USER UserId;
|
|
PTOKEN_OWNER DefaultOwner;
|
|
PTOKEN_PRIMARY_GROUP PrimaryGroup;
|
|
PTOKEN_GROUPS GroupIds;
|
|
PTOKEN_PRIVILEGES Privileges;
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Logon ID //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenStatistics, // TokenInformationClass
|
|
&ProcessTokenStatistics, // TokenInformation
|
|
sizeof(TOKEN_STATISTICS), // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
AuthenticationId = ProcessTokenStatistics.AuthenticationId;
|
|
|
|
printf(" Logon Session: ");
|
|
if (RtlEqualGuid(&AuthenticationId, &SystemAuthenticationId )) {
|
|
printf("(System Logon Session)\n");
|
|
} else {
|
|
PrintGuid( &AuthenticationId );
|
|
}
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// User Id //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
UserId = (PTOKEN_USER)&Buffer[0];
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenUser, // TokenInformationClass
|
|
UserId, // TokenInformation
|
|
BUFFER_SIZE, // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
|
|
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
printf(" User id: ");
|
|
DisplayAccountSid( (PISID)UserId->User.Sid );
|
|
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Default Owner //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
DefaultOwner = (PTOKEN_OWNER)&Buffer[0];
|
|
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenOwner, // TokenInformationClass
|
|
DefaultOwner, // TokenInformation
|
|
BUFFER_SIZE, // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
|
|
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
printf(" Default Owner: ");
|
|
DisplayAccountSid( (PISID)DefaultOwner->Owner );
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Primary Group //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
PrimaryGroup = (PTOKEN_PRIMARY_GROUP)&Buffer[0];
|
|
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenPrimaryGroup, // TokenInformationClass
|
|
PrimaryGroup, // TokenInformation
|
|
BUFFER_SIZE, // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
|
|
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
printf(" Primary Group: ");
|
|
DisplayAccountSid( (PISID)PrimaryGroup->PrimaryGroup );
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Group Ids //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
printf("\n");
|
|
GroupIds = (PTOKEN_GROUPS)&Buffer[0];
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenGroups, // TokenInformationClass
|
|
GroupIds, // TokenInformation
|
|
BUFFER_SIZE, // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
|
|
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
//printf(" Number of groups: %ld\n", GroupIds->GroupCount);
|
|
printf(" Groups: ");
|
|
|
|
for (i=0; i < GroupIds->GroupCount; i++ ) {
|
|
//printf(" Group %ld: ", i);
|
|
DisplayAccountSid( (PISID)GroupIds->Groups[i].Sid );
|
|
printf(" ");
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// Privileges //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////
|
|
|
|
printf("\n");
|
|
Privileges = (PTOKEN_PRIVILEGES)&Buffer[0];
|
|
Status = NtQueryInformationToken(
|
|
TokenHandle, // Handle
|
|
TokenPrivileges, // TokenInformationClass
|
|
Privileges, // TokenInformation
|
|
BUFFER_SIZE, // TokenInformationLength
|
|
&ReturnLength // ReturnLength
|
|
);
|
|
|
|
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
printf(" Privileges: ");
|
|
if (Privileges->PrivilegeCount > 0) {
|
|
|
|
for (i=0; i < Privileges->PrivilegeCount; i++ ) {
|
|
DisplayPrivilege( &(Privileges->Privileges[i]) );
|
|
}
|
|
} else {
|
|
printf("(none assigned)\n");
|
|
}
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
BOOLEAN
|
|
main()
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
HANDLE ProcessToken;
|
|
|
|
|
|
TSeVariableInitialization(); // Initialize global variables
|
|
|
|
printf("\n");
|
|
|
|
|
|
//
|
|
// Open our process token
|
|
//
|
|
|
|
Status = NtOpenProcessToken(
|
|
NtCurrentProcess(),
|
|
TOKEN_QUERY,
|
|
&ProcessToken
|
|
);
|
|
if (!NT_SUCCESS(Status)) {
|
|
printf("I'm terribly sorry, but you don't seem to have access to\n");
|
|
printf("open your own process's token.\n");
|
|
printf("\n");
|
|
return(FALSE);
|
|
}
|
|
|
|
printf("Your process level security context is:\n");
|
|
printf("\n");
|
|
DisplaySecurityContext( ProcessToken );
|
|
|
|
|
|
Status = NtClose( ProcessToken );
|
|
|
|
return(TRUE);
|
|
}
|
|
|