/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
rtdmpsec.c
Abstract:
NT level registry security test program #1, basic non-error paths.
Dump out the security descriptors of a sub-tree of the registry.
rtdmpsec <KeyPath>
Will ennumerate and dump out the subkeys and values of KeyPath,
and then apply itself recursively to each subkey it finds.
It assumes data values are null terminated strings.
Example:
rtdmpsec \REGISTRY\MACHINE\TEST\bigkey
Author:
John Vert (jvert) 24-Jan-92
based on rtdmp.c by
Bryan Willman (bryanwi) 10-Dec-91
and getdacl.c by RobertRe
Revision History:
Richard Ward (richardw) 14 April 1992 Changed ACE_HEADER
--*/
#include "cmp.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define WORK_SIZE 1024
//
// Get a pointer to the first ace in an acl
//
#define FirstAce(Acl) ((PVOID)((PUCHAR)(Acl) + sizeof(ACL)))
//
// Get a pointer to the following ace
//
#define NextAce(Ace) ((PVOID)((PUCHAR)(Ace) + ((PACE_HEADER)(Ace))->AceSize))
//
// Generic ACE structure, to be used for casting ACE's of known types
//
typedef struct _KNOWN_ACE {
ACE_HEADER Header;
ACCESS_MASK Mask;
ULONG SidStart;
} KNOWN_ACE, *PKNOWN_ACE;
VOID
InitVars();
VOID
PrintAcl (
IN PACL Acl
);
VOID
PrintAccessMask(
IN ACCESS_MASK AccessMask
);
void __cdecl main(int, char *);
void processargs();
void print(PUNICODE_STRING);
void
DumpSecurity(
HANDLE Handle
);
void
Dump(
HANDLE Handle
);
UNICODE_STRING WorkName;
WCHAR workbuffer[WORK_SIZE];
//
// Universal well known SIDs
//
PSID NullSid;
PSID WorldSid;
PSID LocalSid;
PSID CreatorOwnerSid;
//
// Sids defined by NT
//
PSID NtAuthoritySid;
PSID DialupSid;
PSID NetworkSid;
PSID BatchSid;
PSID InteractiveSid;
PSID LocalSystemSid;
void
__cdecl main(
int argc,
char *argv[]
)
{
NTSTATUS status;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE BaseHandle;
InitVars();
//
// Process args
//
WorkName.MaximumLength = WORK_SIZE;
WorkName.Length = 0L;
WorkName.Buffer = &(workbuffer[0]);
processargs(argc, argv);
//
// Set up and open KeyPath
//
printf("rtdmpsec: starting\n");
InitializeObjectAttributes(
&ObjectAttributes,
&WorkName,
0,
(HANDLE)NULL,
NULL
);
ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE;
status = NtOpenKey(
&BaseHandle,
MAXIMUM_ALLOWED,
&ObjectAttributes
);
if (!NT_SUCCESS(status)) {
printf("rtdmpsec: t0: %08lx\n", status);
exit(1);
}
Dump(BaseHandle);
}
void
Dump(
HANDLE Handle
)
{
NTSTATUS status;
PKEY_BASIC_INFORMATION KeyInformation;
OBJECT_ATTRIBUTES ObjectAttributes;
ULONG NamePos;
ULONG index;
STRING enumname;
HANDLE WorkHandle;
ULONG ResultLength;
static char buffer[WORK_SIZE];
PUCHAR p;
KeyInformation = (PKEY_BASIC_INFORMATION)buffer;
NamePos = WorkName.Length;
//
// Print name of node we are about to dump out
//
printf("\n");
print(&WorkName);
printf("::\n");
//
// Print out node's values
//
DumpSecurity(Handle);
//
// Enumerate node's children and apply ourselves to each one
//
for (index = 0; TRUE; index++) {
RtlZeroMemory(KeyInformation, WORK_SIZE);
status = NtEnumerateKey(
Handle,
index,
KeyBasicInformation,
KeyInformation,
WORK_SIZE,
&ResultLength
);
if (status == STATUS_NO_MORE_ENTRIES) {
WorkName.Length = NamePos;
return;
} else if (!NT_SUCCESS(status)) {
printf("rtdmpsec: dump1: status = %08lx\n", status);
exit(1);
}
enumname.Buffer = &(KeyInformation->Name[0]);
enumname.Length = KeyInformation->NameLength;
enumname.MaximumLength = KeyInformation->NameLength;
p = WorkName.Buffer;
p += WorkName.Length;
*p = '\\';
p++;
*p = '\0';
WorkName.Length += 2;
RtlAppendStringToString((PSTRING)&WorkName, (PSTRING)&enumname);
InitializeObjectAttributes(
&ObjectAttributes,
&enumname,
0,
Handle,
NULL
);
ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE;
status = NtOpenKey(
&WorkHandle,
MAXIMUM_ALLOWED,
&ObjectAttributes
);
if (!NT_SUCCESS(status)) {
if (status == STATUS_ACCESS_DENIED) {
printf("\n");
print(&WorkName);
printf("::\n\tAccess denied!\n");
} else {
printf("rtdmpsec: dump2: %08lx\n", status);
exit(1);
}
} else {
Dump(WorkHandle);
NtClose(WorkHandle);
}
WorkName.Length = NamePos;
}
}
void
DumpSecurity(
HANDLE Handle
)
{
PSECURITY_DESCRIPTOR SecurityDescriptor;
NTSTATUS Status;
ULONG Length;
PACL Dacl;
BOOLEAN DaclPresent;
BOOLEAN DaclDefaulted;
Status = NtQuerySecurityObject( Handle,
DACL_SECURITY_INFORMATION,
NULL,
0,
&Length );
if (Status != STATUS_BUFFER_TOO_SMALL) {
printf("DumpSecurity t0: NtQuerySecurityObject failed %lx\n",Status);
exit(1);
}
SecurityDescriptor = malloc(Length);
if (SecurityDescriptor == NULL) {
printf("DumpSecurity: couldn't malloc buffer\n");
exit(1);
}
Status = NtQuerySecurityObject( Handle,
DACL_SECURITY_INFORMATION,
SecurityDescriptor,
Length,
&Length );
if (!NT_SUCCESS(Status)) {
printf("DumpSecurity t1: NtQuerySecurityObject failed %lx\n",Status);
exit(1);
}
Dacl = NULL;
Status = RtlGetDaclSecurityDescriptor( SecurityDescriptor,
&DaclPresent,
&Dacl,
&DaclDefaulted );
if (!NT_SUCCESS(Status)) {
printf("DumpSecurity t2: RtlGetDaclSecurityDescriptor failed %lx\n",Status);
}
if (DaclPresent) {
PrintAcl(Dacl);
} else {
printf("\tAcl not present\n");
}
}
void
print(
PUNICODE_STRING String
)
{
static ANSI_STRING temp;
static char tempbuffer[WORK_SIZE];
temp.MaximumLength = WORK_SIZE;
temp.Length = 0L;
temp.Buffer = tempbuffer;
RtlUnicodeStringToAnsiString(&temp, String, FALSE);
printf("%s", temp.Buffer);
return;
}
void
processargs(
int argc,
char *argv[]
)
{
ANSI_STRING temp;
if ( (argc != 2) )
{
printf("Usage: %s <KeyPath>\n",
argv[0]);
exit(1);
}
RtlInitAnsiString(
&temp,
argv[1]
);
RtlAnsiStringToUnicodeString(
&WorkName,
&temp,
FALSE
);
return;
}
BOOLEAN
SidTranslation(
PSID Sid,
PSTRING AccountName
)
// AccountName is expected to have a large maximum length
{
if (RtlEqualSid(Sid, WorldSid)) {
RtlInitString( AccountName, "WORLD");
return(TRUE);
}
if (RtlEqualSid(Sid, LocalSid)) {
RtlInitString( AccountName, "LOCAL");
return(TRUE);
}
if (RtlEqualSid(Sid, NetworkSid)) {
RtlInitString( AccountName, "NETWORK");
return(TRUE);
}
if (RtlEqualSid(Sid, BatchSid)) {
RtlInitString( AccountName, "BATCH");
return(TRUE);
}
if (RtlEqualSid(Sid, InteractiveSid)) {
RtlInitString( AccountName, "INTERACTIVE");
return(TRUE);
}
if (RtlEqualSid(Sid, LocalSystemSid)) {
RtlInitString( AccountName, "SYSTEM");
return(TRUE);
}
//
// if (RtlEqualSid(Sid, LocalManagerSid)) {
// RtlInitString( AccountName, "LOCAL MANAGER");
// return(TRUE);
// }
// if (RtlEqualSid(Sid, LocalAdminSid)) {
// RtlInitString( AccountName, "LOCAL ADMIN");
// return(TRUE);
// }
return(FALSE);
}
VOID
DisplayAccountSid(
PSID Sid
)
{
UCHAR Buffer[128];
STRING AccountName;
UCHAR i;
ULONG Tmp;
PSID_IDENTIFIER_AUTHORITY IdentifierAuthority;
UCHAR SubAuthorityCount;
Buffer[0] = 0;
AccountName.MaximumLength = 127;
AccountName.Length = 0;
AccountName.Buffer = (PVOID)&Buffer[0];
if (SidTranslation( (PSID)Sid, &AccountName) ) {
printf("%s\n", AccountName.Buffer );
} else {
IdentifierAuthority = RtlIdentifierAuthoritySid(Sid);
//
// HACK! HACK!
// The next line prints the revision of the SID. Since there is no
// rtl routine which gives us the SID revision, we must make due.
// luckily, the revision field is the first field in the SID, so we
// can just cast the pointer.
//
printf("S-%u-", (USHORT) *((PUCHAR) Sid) );
if ( (IdentifierAuthority->Value[0] != 0) ||
(IdentifierAuthority->Value[1] != 0) ){
printf("0x%02hx%02hx%02hx%02hx%02hx%02hx",
IdentifierAuthority->Value[0],
IdentifierAuthority->Value[1],
IdentifierAuthority->Value[2],
IdentifierAuthority->Value[3],
IdentifierAuthority->Value[4],
IdentifierAuthority->Value[5] );
} else {
Tmp = IdentifierAuthority->Value[5] +
(IdentifierAuthority->Value[4] << 8) +
(IdentifierAuthority->Value[3] << 16) +
(IdentifierAuthority->Value[2] << 24);
printf("%lu", Tmp);
}
SubAuthorityCount = *RtlSubAuthorityCountSid(Sid);
for (i=0;i<SubAuthorityCount ;i++ ) {
printf("-%lu", (*RtlSubAuthoritySid(Sid, i)));
}
printf("\n");
}
}
VOID
InitVars()
{
ULONG SidWithZeroSubAuthorities;
ULONG SidWithOneSubAuthority;
ULONG SidWithThreeSubAuthorities;
ULONG SidWithFourSubAuthorities;
SID_IDENTIFIER_AUTHORITY NullSidAuthority = SECURITY_NULL_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY WorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY LocalSidAuthority = SECURITY_LOCAL_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
//
// The following SID sizes need to be allocated
//
SidWithZeroSubAuthorities = RtlLengthRequiredSid( 0 );
SidWithOneSubAuthority = RtlLengthRequiredSid( 1 );
SidWithThreeSubAuthorities = RtlLengthRequiredSid( 3 );
SidWithFourSubAuthorities = RtlLengthRequiredSid( 4 );
//
// Allocate and initialize the universal SIDs
//
NullSid = (PSID)malloc(SidWithOneSubAuthority);
WorldSid = (PSID)malloc(SidWithOneSubAuthority);
LocalSid = (PSID)malloc(SidWithOneSubAuthority);
CreatorOwnerSid = (PSID)malloc(SidWithOneSubAuthority);
RtlInitializeSid( NullSid, &NullSidAuthority, 1 );
RtlInitializeSid( WorldSid, &WorldSidAuthority, 1 );
RtlInitializeSid( LocalSid, &LocalSidAuthority, 1 );
RtlInitializeSid( CreatorOwnerSid, &CreatorSidAuthority, 1 );
*(RtlSubAuthoritySid( NullSid, 0 )) = SECURITY_NULL_RID;
*(RtlSubAuthoritySid( WorldSid, 0 )) = SECURITY_WORLD_RID;
*(RtlSubAuthoritySid( LocalSid, 0 )) = SECURITY_LOCAL_RID;
*(RtlSubAuthoritySid( CreatorOwnerSid, 0 )) = SECURITY_CREATOR_OWNER_RID;
//
// Allocate and initialize the NT defined SIDs
//
NtAuthoritySid = (PSID)malloc(SidWithZeroSubAuthorities);
DialupSid = (PSID)malloc(SidWithOneSubAuthority);
NetworkSid = (PSID)malloc(SidWithOneSubAuthority);
BatchSid = (PSID)malloc(SidWithOneSubAuthority);
InteractiveSid = (PSID)malloc(SidWithOneSubAuthority);
LocalSystemSid = (PSID)malloc(SidWithOneSubAuthority);
RtlInitializeSid( NtAuthoritySid, &NtAuthority, 0 );
RtlInitializeSid( DialupSid, &NtAuthority, 1 );
RtlInitializeSid( NetworkSid, &NtAuthority, 1 );
RtlInitializeSid( BatchSid, &NtAuthority, 1 );
RtlInitializeSid( InteractiveSid, &NtAuthority, 1 );
RtlInitializeSid( LocalSystemSid, &NtAuthority, 1 );
*(RtlSubAuthoritySid( DialupSid, 0 )) = SECURITY_DIALUP_RID;
*(RtlSubAuthoritySid( NetworkSid, 0 )) = SECURITY_NETWORK_RID;
*(RtlSubAuthoritySid( BatchSid, 0 )) = SECURITY_BATCH_RID;
*(RtlSubAuthoritySid( InteractiveSid, 0 )) = SECURITY_INTERACTIVE_RID;
*(RtlSubAuthoritySid( LocalSystemSid, 0 )) = SECURITY_LOCAL_SYSTEM_RID;
return;
}
VOID
PrintAcl (
IN PACL Acl
)
/*++
Routine Description:
This routine dumps an Acl for debug purposes (via printf). It is
specialized to dump standard aces.
Arguments:
Acl - Supplies the Acl to dump
Return Value:
None
--*/
{
ULONG i;
PKNOWN_ACE Ace;
BOOLEAN KnownType;
PCHAR AceTypes[] = { "Access Allowed",
"Access Denied ",
"System Audit ",
"System Alarm "
};
if (Acl == NULL) {
printf("\tAcl == ALL ACCESS GRANTED!\n");
return;
}
//
// Dump the Acl header
//
printf("\tRevision: %02x", Acl->AclRevision);
printf(" Size: %04x", Acl->AclSize);
printf(" AceCount: %04x\n", Acl->AceCount);
//
// Now for each Ace we want do dump it
//
for (i = 0, Ace = FirstAce(Acl);
i < Acl->AceCount;
i++, Ace = NextAce(Ace) ) {
//
// print out the ace header
//
printf("\n\tAceHeader: %08lx ", *(PULONG)Ace);
//
// special case on the standard ace types
//
if ((Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) ||
(Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE) ||
(Ace->Header.AceType == SYSTEM_AUDIT_ACE_TYPE) ||
(Ace->Header.AceType == SYSTEM_ALARM_ACE_TYPE)) {
//
// The following array is indexed by ace types and must
// follow the allowed, denied, audit, alarm seqeuence
//
PCHAR AceTypes[] = { "Access Allowed",
"Access Denied ",
"System Audit ",
"System Alarm "
};
printf(AceTypes[Ace->Header.AceType]);
PrintAccessMask(Ace->Mask);
KnownType = TRUE;
} else {
KnownType = FALSE;
printf(" Unknown Ace Type\n");
}
printf("\n");
printf("\tAceSize = %d\n",Ace->Header.AceSize);
printf("\tAce Flags = ");
if (Ace->Header.AceFlags & OBJECT_INHERIT_ACE) {
printf("OBJECT_INHERIT_ACE\n");
printf(" ");
}
if (Ace->Header.AceFlags & CONTAINER_INHERIT_ACE) {
printf("CONTAINER_INHERIT_ACE\n");
printf(" ");
}
if (Ace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE) {
printf("NO_PROPAGATE_INHERIT_ACE\n");
printf(" ");
}
if (Ace->Header.AceFlags & INHERIT_ONLY_ACE) {
printf("INHERIT_ONLY_ACE\n");
printf(" ");
}
if (Ace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) {
printf("SUCCESSFUL_ACCESS_ACE_FLAG\n");
printf(" ");
}
if (Ace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG) {
printf("FAILED_ACCESS_ACE_FLAG\n");
printf(" ");
}
printf("\n");
printf("\tSid = ");
DisplayAccountSid(&Ace->SidStart);
}
}
VOID
PrintAccessMask(
IN ACCESS_MASK AccessMask
)
{
printf("\n\tAccess Mask: ");
if (AccessMask == KEY_ALL_ACCESS) {
printf("KEY_ALL_ACCESS\n\t ");
return;
}
if (AccessMask == KEY_READ) {
printf("KEY_READ\n\t ");
return;
}
if (AccessMask == KEY_WRITE) {
printf("KEY_WRITE\n\t ");
return;
}
if (AccessMask & KEY_QUERY_VALUE) {
printf("KEY_QUERY_VALUE\n\t ");
}
if (AccessMask & KEY_SET_VALUE) {
printf("KEY_SET_VALUE\n\t ");
}
if (AccessMask & KEY_CREATE_SUB_KEY) {
printf("KEY_CREATE_SUB_KEY\n\t ");
}
if (AccessMask & KEY_ENUMERATE_SUB_KEYS) {
printf("KEY_ENUMERATE_SUB_KEYS\n\t ");
}
if (AccessMask & KEY_NOTIFY) {
printf("KEY_NOTIFY\n\t ");
}
if (AccessMask & KEY_CREATE_LINK) {
printf("KEY_CREATE_LINK\n\t ");
}
if (AccessMask & GENERIC_ALL) {
printf("GENERIC_ALL\n\t ");
}
if (AccessMask & GENERIC_EXECUTE) {
printf("GENERIC_EXECUTE\n\t ");
}
if (AccessMask & GENERIC_WRITE) {
printf("GENERIC_WRITE\n\t ");
}
if (AccessMask & GENERIC_READ) {
printf("GENERIC_READ\n\t ");
}
if (AccessMask & GENERIC_READ) {
printf("GENERIC_READ\n\t ");
}
if (AccessMask & MAXIMUM_ALLOWED) {
printf("MAXIMUM_ALLOWED\n\t ");
}
if (AccessMask & ACCESS_SYSTEM_SECURITY) {
printf("ACCESS_SYSTEM_SECURITY\n\t ");
}
if (AccessMask & WRITE_OWNER) {
printf("WRITE_OWNER\n\t ");
}
if (AccessMask & WRITE_DAC) {
printf("WRITE_DAC\n\t ");
}
if (AccessMask & READ_CONTROL) {
printf("READ_CONTROL\n\t ");
}
if (AccessMask & DELETE) {
printf("DELETE\n\t ");
}
}