/*++
Copyright (c) 1990 Microsoft Corporation
Module Name:
obdir.c
Abstract:
Utility to obtain a directory of Object Manager Directories for NT.
Author:
Darryl E. Havens (DarrylH) 9-Nov-1990
Revision History:
--*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <malloc.h>
#include <ntlsa.h>
#define BUFFERSIZE 1024
#define Error(N,S) { \
printf(#S); \
printf(" Error %08lX\n", S); \
}
typedef struct _TYPEINFO {
PWSTR pszName;
char * * AccessRights;
DWORD NumberRights;
} TYPEINFO, * PTYPEINFO;
////////////////////////////////////////////////////////
// //
// Internal Prototypes //
// //
////////////////////////////////////////////////////////
BOOLEAN
EnableAllPrivileges(
VOID
);
VOID
QueryDirectory(
IN PSTRING DirectoryName
);
NTSTATUS
OpenObject(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name,
IN ACCESS_MASK DesiredAccess,
OUT PHANDLE Object
);
VOID
OpenAndDisplaySacl(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name
);
VOID
QueryAndDisplaySacl(
IN HANDLE Object,
IN PWSTR Type
);
NTSTATUS
DisplaySacl(
PSECURITY_DESCRIPTOR SD,
IN PWSTR Type
);
VOID
OpenAndDisplayDacl(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name
);
VOID
QueryAndDisplayDacl(
IN HANDLE Object,
IN PWSTR Type
);
NTSTATUS
DisplayDacl(
PSECURITY_DESCRIPTOR SD,
IN PWSTR Type
);
VOID
DumpAce(
PACE_HEADER Ace,
BOOLEAN AclIsDacl,
PTYPEINFO TypeInfo
);
VOID
DumpStandardAceInfo(
PACE_HEADER Ace,
BOOLEAN AclIsDacl,
PTYPEINFO TypeInfo
);
VOID
DisplaySid(
IN PSID Sid
);
VOID
ConnectToLsa( VOID );
VOID
Usage( VOID );
////////////////////////////////////////////////////////
// //
// Global Variables //
// //
////////////////////////////////////////////////////////
UCHAR
Buffer[BUFFERSIZE];
LSA_HANDLE
LsaHandle;
BOOLEAN
CompoundLineOutput = FALSE;
DumpDacl = FALSE; // May be changed by command parameter
DumpDaclFull = FALSE; // May be changed by command parameter
DumpSacl = FALSE; // May be changed by command parameter
DumpSaclFull = FALSE; // May be changed by command parameter
char * AccessMask[] = { "Delete", "ReadControl", "WriteDac", "WriteOwner",
"Synch", "", "", "",
"Sacl", "MaxAllowed", "", "",
"GenericAll", "GenericExec", "GenericWrite", "GenericRead"};
char * TokenRights[] = {"AssignPrimary", "Duplicate", "Impersonate", "Query",
"QuerySource", "AdjustPriv", "AdjustGroup", "AdjustDef" };
char * KeyRights[] = { "QueryValue", "SetValue", "CreateSubKey", "EnumSubKey",
"Notify", "CreateLink", "", "" };
char * EventRights[] = {"QueryState", "ModifyState" };
char * MutantRights[]={ "QueryState" };
char * SemaphoreRights[] = { "QueryState", "ModifyState" };
char * TimerRights[] = {"QueryState", "ModifyState" };
char * ProfileRights[]={"Control"};
char * ProcessRights[]={"Terminate", "CreateThread", "", "VMOp",
"VMRead", "VMWrite", "DupHandle", "CreateProcess",
"SetQuota", "SetInfo", "QueryInfo", "SetPort" };
char * ThreadRights[] ={"Terminate", "Suspend", "Alert", "GetContext",
"SetContext", "SetInfo", "QueryInfo", "SetToken",
"Impersonate", "DirectImpersonate" };
char * SectionRights[]={"Query", "MapWrite", "MapRead", "MapExecute",
"Extend"};
char * FileRights[] = { "Read/List", "Write/Add", "Append/SubDir/CreatePipe", "ReadEA",
"WriteEA", "Execute/Traverse", "DelChild", "ReadAttr",
"WriteAttr"};
char * PortRights[] = { "Connect" };
char * DirRights[] = { "Query", "Traverse", "Create", "CreateSubdir" };
char * SymLinkRights[]={"Query" };
char * WinstaRights[]={ "EnumDesktops", "ReadAttr", "Clipboard", "CreateDesktop",
"WriteAttr", "GlobalAtom", "ExitWindows", "",
"Enumerate", "ReadScreen" };
char * DesktopRights[]={"ReadObjects", "CreateWindow", "CreateMenu", "HookControl",
"JournalRecord", "JournalPlayback", "Enumerate", "WriteObjects",
"SwitchDesktop" };
char * CompletionRights[] = { "Query", "Modify" };
char * ChannelRights[] = { "ReadMessage", "WriteMessage", "Query", "SetInfo" };
char * JobRights[] = { "AssignProcess", "SetAttr", "Query", "Terminate", "SetSecAttr" };
#define TYPE_NONE 0
#define TYPE_EVENT 1
#define TYPE_SECTION 2
#define TYPE_FILE 3
#define TYPE_PORT 4
#define TYPE_DIRECTORY 5
#define TYPE_LINK 6
#define TYPE_MUTANT 7
#define TYPE_WINSTA 8
#define TYPE_SEM 9
#define TYPE_KEY 10
#define TYPE_TOKEN 11
#define TYPE_PROCESS 12
#define TYPE_THREAD 13
#define TYPE_DESKTOP 14
#define TYPE_COMPLETE 15
#define TYPE_CHANNEL 16
#define TYPE_TIMER 17
#define TYPE_JOB 18
#define TYPE_WPORT 19
#define TYPE_MAX 20
LPWSTR pszTypeNames[TYPE_MAX] = { L"None", L"Event", L"Section", L"File",
L"Port", L"Directory", L"SymbolicLink",
L"Mutant", L"WindowStation", L"Semaphore",
L"Key", L"Token", L"Process", L"Thread",
L"Desktop", L"IoCompletion", L"Channel",
L"Timer", L"Job", L"WaitablePort" };
TYPEINFO TypeNames[TYPE_MAX] = {
{ L"Unknown", NULL, 0 },
{ L"Event", EventRights, 2 },
{ L"Section", SectionRights, 5 },
{ L"File", FileRights, 9 },
{ L"Port", PortRights, 1 },
{ L"Directory", DirRights, 4 },
{ L"SymbolicLink", SymLinkRights, 1 },
{ L"Mutant", MutantRights, 2 },
{ L"WindowStation", WinstaRights, 10 },
{ L"Semaphore", SemaphoreRights, 2 },
{ L"Key", KeyRights, 6 },
{ L"Token", TokenRights, 8 },
{ L"Process", ProcessRights, 12 },
{ L"Thread", ThreadRights, 10 },
{ L"Desktop", DesktopRights, 10 },
{ L"IoCompletion", CompletionRights, 2 },
{ L"Channel", ChannelRights, 4 },
{ L"Timer", TimerRights, 2 },
{ L"Job", JobRights, 5 },
{ L"WaitablePort", PortRights, 1 }
};
DWORD
GetObjectTypeIndex(
PWSTR TypeName )
{
DWORD i;
for ( i = 1 ; i < TYPE_MAX ; i++ )
{
if (_wcsicmp( TypeNames[i].pszName, TypeName ) == 0 )
{
return( i );
}
}
return( 0 );
}
VOID
DisplayFlags(
ULONG Flags,
ULONG FlagLimit,
char *flagset[],
ULONG Indent,
ULONG LineBreak,
ULONG BufferSize,
UCHAR * buffer)
{
char * offset;
char * limit ;
char * linelimit ;
DWORD mask, test, i, flagsize ;
DWORD scratch;
if ( LineBreak > BufferSize )
{
strcpy( (CHAR *)buffer, "Invalid Parameter");
return;
}
mask = 0;
offset = (CHAR *) buffer;
test = 1;
limit = offset + BufferSize ;
if ( LineBreak )
{
linelimit = offset + LineBreak ;
}
else
{
linelimit = limit ;
}
if ( linelimit > limit )
{
linelimit = limit ;
}
memset(offset, ' ', Indent);
offset += Indent ;
if (!Flags) {
strcpy( offset, "None");
return;
}
for ( i = 0 ; i < FlagLimit ; i++ )
{
if ( ( Flags & test ) != 0 )
{
//
// Found a flag set in the flag word. Try to write the text
// form into the buffer
//
flagsize = strlen( flagset[ i ] );
if ( offset + flagsize + 2 > limit )
{
return;
}
if ( offset + flagsize + 2 > linelimit )
{
//
// Need to do a linebreak:
//
*offset++ = '\r';
*offset++ = '\n';
if ( LineBreak )
{
linelimit = offset + LineBreak ;
}
else
{
linelimit = limit ;
}
if ( linelimit > limit )
{
linelimit = limit ;
}
memset(offset, ' ', Indent);
offset += Indent ;
if ( offset + flagsize + 2 > linelimit )
{
*offset++ = '\0';
return;
}
}
CopyMemory( offset, flagset[ i ], flagsize );
offset += flagsize ;
mask |= test;
if ( ( Flags & (~mask) ) != 0 )
{
*offset++ = ' ' ;
}
}
test <<= 1 ;
}
*offset = '\0';
}
////////////////////////////////////////////////////////
// //
// Routines //
// //
////////////////////////////////////////////////////////
VOID
__cdecl main(
int argc,
char *argv[]
)
{
STRING
String;
int
arg;
char
*s;
BOOLEAN
DirectoryNameArg;
//
// process any qualifiers
//
// All arguments are considered qualifiers until we reach a backslash ("\").
// If we reach a backslash, then that argument is accepted as the last argument
// and it is expected to the the name of the directory to be listed.
//
DirectoryNameArg = FALSE;
arg = 1;
while (arg < argc) {
s = argv[arg];
if (*s == '\\') {
DirectoryNameArg = TRUE;
break; // break out of while loop
}
if (*s != '/') {
Usage();
return;
}
s++;
if (*s == 'd') {
//
// Dump DACL qualifier
//
if (DumpDaclFull == TRUE) {
printf("\n\n Conflicting qualifiers: /d and /D\n");
Usage();
return;
}
DumpDacl = TRUE;
DumpDaclFull = FALSE;
CompoundLineOutput = TRUE;
} else if (*s == 'D') {
//
// Dump DACL qualifier
//
if ((DumpDacl== TRUE) && (DumpDaclFull == FALSE)) {
printf("\n\n Conflicting qualifiers: /d and /D\n");
Usage();
return;
}
DumpDacl = TRUE;
DumpDaclFull = TRUE;
CompoundLineOutput = TRUE;
} else if (*s == 's') {
//
// Dump SACL qualifier
//
if (DumpSaclFull == TRUE) {
printf("\n\n Conflicting qualifiers: /s and /S\n");
Usage();
return;
}
DumpSacl = TRUE;
DumpSaclFull = FALSE;
CompoundLineOutput = TRUE;
} else if (*s == 'S') {
//
// Dump SACL qualifier
//
if ((DumpSacl== TRUE) && (DumpSaclFull == FALSE)) {
printf("\n\n Conflicting qualifiers: /s and /S\n");
Usage();
return;
}
DumpSacl = TRUE;
DumpSaclFull = TRUE;
CompoundLineOutput = TRUE;
} else {
Usage();
return;
}
arg++;
} // end_while
if (DumpDacl || DumpSacl) {
ConnectToLsa();
}
//
// Set up the name of the directory to list
//
if (!DirectoryNameArg) {
RtlInitString( &String, "\\" );
} else {
RtlInitString( &String, argv[arg] );
}
if (EnableAllPrivileges()) {
QueryDirectory( &String );
}
}
WCHAR LinkTargetBuffer[ 1024 ];
typedef struct _DIR_ENTRY {
PWSTR Name;
PWSTR Type;
} DIR_ENTRY, *PDIR_ENTRY;
#define MAX_DIR_ENTRIES 1024
ULONG NumberOfDirEntries;
DIR_ENTRY DirEntries[ MAX_DIR_ENTRIES ];
int
__cdecl
CompareDirEntry(
void const *p1,
void const *p2
)
{
return _wcsicmp( ((PDIR_ENTRY)p1)->Name, ((PDIR_ENTRY)p2)->Name );
}
VOID
QueryDirectory(
IN PSTRING DirectoryName
)
//
// DumpDacl and DumpSacl are expected to be set prior to calling this routine.
//
{
NTSTATUS Status;
HANDLE DirectoryHandle, LinkHandle;
ULONG Context = 0;
ULONG i, ReturnedLength;
UNICODE_STRING LinkTarget;
POBJECT_DIRECTORY_INFORMATION DirInfo;
POBJECT_NAME_INFORMATION NameInfo;
OBJECT_ATTRIBUTES Attributes;
UNICODE_STRING UnicodeString;
ACCESS_MASK ExtraAccess = 0;
UNICODE_STRING Match = { 0 };
UNICODE_STRING Separators = { 0 };
USHORT Offset ;
ULONG DisplayedEntries = 0 ;
BOOLEAN PrefixMatch = FALSE ;
BOOLEAN SuffixMatch = FALSE ;
ULONG ObjectNameLength ;
BOOL PrefixMatched, SuffixMatched ;
//
// Perform initial setup
//
RtlZeroMemory( Buffer, BUFFERSIZE );
if (DumpDacl) {
ExtraAccess |= READ_CONTROL;
}
if (DumpSacl) {
ExtraAccess |= ACCESS_SYSTEM_SECURITY;
}
//
// Open the directory for list directory access
//
Status = RtlAnsiStringToUnicodeString( &UnicodeString,
DirectoryName,
TRUE );
ASSERT( NT_SUCCESS( Status ) );
InitializeObjectAttributes( &Attributes,
&UnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
Status = NtOpenDirectoryObject( &DirectoryHandle,
DIRECTORY_QUERY | ExtraAccess,
&Attributes
);
if ( ( Status == STATUS_OBJECT_TYPE_MISMATCH ) ||
( Status == STATUS_OBJECT_NAME_NOT_FOUND ) ||
( Status == STATUS_OBJECT_PATH_NOT_FOUND ) ) {
RtlInitUnicodeString( &Separators, L"\\" );
Status = RtlFindCharInUnicodeString(
RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END,
&UnicodeString,
&Separators,
&Offset );
if ( NT_SUCCESS( Status ) )
{
UnicodeString.Length = Offset ;
RtlInitUnicodeString( &Match, UnicodeString.Buffer + ((Offset + 2) / sizeof( WCHAR ) ) );
if ( Match.Buffer[ 0 ] == L'*' )
{
Match.Buffer++ ;
Match.Length -= sizeof( WCHAR );
SuffixMatch = TRUE ;
}
if ( Match.Buffer[ Match.Length / sizeof( WCHAR ) - 1 ] == L'*' )
{
Match.Buffer[ Match.Length / sizeof( WCHAR ) - 1 ] = L'\0';
Match.Length -= sizeof( WCHAR );
PrefixMatch = TRUE ;
}
if ( PrefixMatch && SuffixMatch )
{
printf("Too complicated a search\n" );
return;
}
#if DBG
printf("Searching for %c%ws%c\n",
(SuffixMatch ? '*' : ' '), Match.Buffer, (PrefixMatch ? '*' : ' ') );
#endif
Status = NtOpenDirectoryObject( &DirectoryHandle,
DIRECTORY_QUERY | ExtraAccess,
&Attributes );
}
}
if (!NT_SUCCESS( Status )) {
if (Status == STATUS_OBJECT_TYPE_MISMATCH) {
printf( "%Z is not a valid Object Directory Object name\n",
DirectoryName );
}
else {
Error( OpenDirectory, Status );
}
return;
}
//
// Get the actual name of the object directory object.
//
NameInfo = (POBJECT_NAME_INFORMATION) &Buffer[0];
if (!NT_SUCCESS( Status = NtQueryObject( DirectoryHandle,
ObjectNameInformation,
NameInfo,
BUFFERSIZE,
(PULONG) NULL ) )) {
printf( "Unexpected error obtaining actual object directory name\n" );
printf( "Error was: %X\n", Status );
return;
}
//
// Output initial informational message
//
printf( "Directory of: %wZ\n", &NameInfo->Name );
if ( Match.Length == 0 )
{
if (DumpDacl) {
QueryAndDisplayDacl( DirectoryHandle, L"Directory" );
}
if (DumpSacl) {
QueryAndDisplaySacl( DirectoryHandle, L"Directory" );
}
printf( "\n" );
}
//
// Query the entire directory in one sweep
//
NumberOfDirEntries = 0;
for (Status = NtQueryDirectoryObject( DirectoryHandle,
&Buffer,
BUFFERSIZE,
FALSE,
FALSE,
&Context,
&ReturnedLength );
NT_SUCCESS( Status );
Status = NtQueryDirectoryObject( DirectoryHandle,
&Buffer,
BUFFERSIZE,
FALSE,
FALSE,
&Context,
&ReturnedLength ) ) {
//
// Check the status of the operation.
//
if (!NT_SUCCESS( Status )) {
if (Status != STATUS_NO_MORE_FILES) {
Error( Status, Status );
}
break;
}
//
// For every record in the buffer type out the directory information
//
//
// Point to the first record in the buffer, we are guaranteed to have
// one otherwise Status would have been No More Files
//
DirInfo = (POBJECT_DIRECTORY_INFORMATION) &Buffer[0];
while (TRUE) {
//
// Check if there is another record. If there isn't, then get out
// of the loop now
//
if (DirInfo->Name.Length == 0) {
break;
}
//
// Print out information about the file
//
if (NumberOfDirEntries >= MAX_DIR_ENTRIES) {
printf( "OBJDIR: Too many directory entries.\n" );
exit( 1 );
}
DirEntries[ NumberOfDirEntries ].Name = RtlAllocateHeap( RtlProcessHeap(),
HEAP_ZERO_MEMORY,
DirInfo->Name.Length +
sizeof( UNICODE_NULL )
);
DirEntries[ NumberOfDirEntries ].Type = RtlAllocateHeap( RtlProcessHeap(),
HEAP_ZERO_MEMORY,
DirInfo->TypeName.Length +
sizeof( UNICODE_NULL )
);
memmove( DirEntries[ NumberOfDirEntries ].Name,
DirInfo->Name.Buffer,
DirInfo->Name.Length
);
memmove( DirEntries[ NumberOfDirEntries ].Type,
DirInfo->TypeName.Buffer,
DirInfo->TypeName.Length
);
NumberOfDirEntries++;
//
// There is another record so advance DirInfo to the next entry
//
DirInfo = (POBJECT_DIRECTORY_INFORMATION) (((PUCHAR) DirInfo) +
sizeof( OBJECT_DIRECTORY_INFORMATION ) );
}
RtlZeroMemory( Buffer, BUFFERSIZE );
}
qsort( DirEntries,
NumberOfDirEntries,
sizeof( DIR_ENTRY ),
CompareDirEntry
);
for (i=0; i<NumberOfDirEntries; i++) {
if ( Match.Length )
{
ObjectNameLength = wcslen( DirEntries[ i ].Name );
if ( PrefixMatch )
{
PrefixMatched = _wcsnicmp( DirEntries[ i ].Name,
Match.Buffer,
Match.Length / sizeof( WCHAR ) ) == 0 ;
}
if ( SuffixMatch )
{
if ( ObjectNameLength >= Match.Length / sizeof( WCHAR ) )
{
SuffixMatched =
_wcsnicmp( DirEntries[ i ].Name + ( ObjectNameLength - (Match.Length / sizeof( WCHAR ) )),
Match.Buffer,
Match.Length / sizeof( WCHAR) ) == 0 ;
}
else
{
SuffixMatched = FALSE ;
}
}
if ( SuffixMatch && !SuffixMatched )
{
continue;
}
if ( PrefixMatch && !PrefixMatched )
{
continue;
}
if ( (!SuffixMatch) && (!PrefixMatch) &&
_wcsicmp( Match.Buffer, DirEntries[ i ].Name ) )
{
continue;
}
}
DisplayedEntries++ ;
printf( "%-32ws ", DirEntries[ i ].Name);
if (CompoundLineOutput) {
printf("\n ");
}
printf( "%ws", DirEntries[ i ].Type );
if (!wcscmp( DirEntries[ i ].Type, L"SymbolicLink" )) {
RtlInitUnicodeString( &UnicodeString, DirEntries[ i ].Name );
InitializeObjectAttributes( &Attributes,
&UnicodeString,
OBJ_CASE_INSENSITIVE,
DirectoryHandle,
NULL );
Status = NtOpenSymbolicLinkObject( &LinkHandle,
SYMBOLIC_LINK_QUERY,
&Attributes
);
if (NT_SUCCESS( Status )) {
LinkTarget.Buffer = LinkTargetBuffer;
LinkTarget.Length = 0;
LinkTarget.MaximumLength = sizeof( LinkTargetBuffer );
Status = NtQuerySymbolicLinkObject( LinkHandle,
&LinkTarget,
NULL
);
NtClose( LinkHandle );
}
if (!NT_SUCCESS( Status )) {
printf( " - unable to query link target (Status == %09X)\n", Status );
}
else {
printf( " - %wZ\n", &LinkTarget );
}
}
else {
printf( "\n" );
}
if (DumpDacl) {
OpenAndDisplayDacl( DirectoryHandle, DirEntries[ i ].Type, DirEntries[ i ].Name);
}
if (DumpSacl) {
OpenAndDisplaySacl( DirectoryHandle, DirEntries[ i ].Type, DirEntries[ i ].Name);
}
}
//
// Output final messages
//
if ( Match.Length != 0 )
{
if ( DisplayedEntries == 0 )
{
printf("not found\n" );
}
else if ( DisplayedEntries == 1 )
{
printf("\n1 entry\n" );
}
else
{
printf("\n%ld entries\n", DisplayedEntries );
}
}
else
{
if (NumberOfDirEntries == 0) {
printf( "no entries\n" );
}
else
if (NumberOfDirEntries == 1) {
printf( "\n1 entry\n" );
}
else {
printf( "\n%ld entries\n", NumberOfDirEntries );
}
}
//
// Now close the directory object
//
(VOID) NtClose( DirectoryHandle );
//
// And return to our caller
//
return;
}
BOOLEAN
EnableAllPrivileges(
VOID
)
/*++
Routine Description:
This routine enables all privileges in the token.
If we are being asked to dump SACLs then we will check
to make sure we have SE_SECURITY_PRIVILEGE enabled too.
Arguments:
None.
Return Value:
None.
--*/
{
HANDLE Token;
ULONG ReturnLength, Index;
PTOKEN_PRIVILEGES NewState;
BOOLEAN Result;
LUID SecurityPrivilege;
SecurityPrivilege =
RtlConvertLongToLuid(SE_SECURITY_PRIVILEGE);
Token = NULL;
NewState = NULL;
Result = (OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
&Token
) ? 1 : 0);
if (Result) {
ReturnLength = 4096;
NewState = malloc( ReturnLength );
Result = (BOOLEAN)(NewState != NULL);
if (Result) {
Result = (GetTokenInformation( Token, // TokenHandle
TokenPrivileges, // TokenInformationClass
NewState, // TokenInformation
ReturnLength, // TokenInformationLength
&ReturnLength // ReturnLength
) ? 1 : 0);
if (Result) {
//
// Set the state settings so that all privileges are enabled...
//
if (DumpSacl) {
Result = FALSE;
}
if (NewState->PrivilegeCount > 0) {
for (Index = 0; Index < NewState->PrivilegeCount; Index++ ) {
NewState->Privileges[Index].Attributes = SE_PRIVILEGE_ENABLED;
if (RtlEqualLuid(&NewState->Privileges[Index].Luid, &SecurityPrivilege )) {
Result = TRUE;
}
}
}
if (!Result) {
// Don't have privilege to dump SACL
ASSERT(DumpSacl);
printf("\n\n You do not have sufficient privilege to display SACLs.\n\n");
}
else {
Result = (AdjustTokenPrivileges( Token, // TokenHandle
FALSE, // DisableAllPrivileges
NewState, // NewState (OPTIONAL)
ReturnLength, // BufferLength
NULL, // PreviousState (OPTIONAL)
&ReturnLength // ReturnLength
) ? 1 : 0);
if (!Result) {
DbgPrint( "AdjustTokenPrivileges( %lx ) failed - %u\n", Token, GetLastError() );
}
}
}
else {
DbgPrint( "GetTokenInformation( %lx ) failed - %u\n", Token, GetLastError() );
}
}
else {
DbgPrint( "malloc( %lx ) failed - %u\n", ReturnLength, GetLastError() );
}
}
else {
DbgPrint( "OpenProcessToken( %lx ) failed - %u\n", GetCurrentProcess(), GetLastError() );
}
if (NewState != NULL) {
free( NewState );
}
if (Token != NULL) {
CloseHandle( Token );
}
return( Result );
}
NTSTATUS
OpenObject(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name,
IN ACCESS_MASK DesiredAccess,
OUT PHANDLE Object
)
{
NTSTATUS
Status,
IgnoreStatus;
UNICODE_STRING
UnicodeName;
OBJECT_ATTRIBUTES
Attributes;
IO_STATUS_BLOCK
Iosb;
RtlInitUnicodeString( &UnicodeName, Name );
InitializeObjectAttributes( &Attributes, &UnicodeName, OBJ_CASE_INSENSITIVE, Root, NULL );
//
// This is effectively a big switch statement of object types
// that we know how to open...
//
if (!wcscmp( Type, L"SymbolicLink" )) {
Status = NtOpenSymbolicLinkObject( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Device" )) {
Status = NtOpenFile( Object, DesiredAccess, &Attributes, &Iosb, 0, 0 );
} else if (!wcscmp( Type, L"Event" )) {
Status = NtOpenEvent( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"EventPair" )) {
Status = NtOpenEventPair( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Mutant" )) {
Status = NtOpenMutant( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Timer" )) {
Status = NtOpenTimer( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Semaphore" )) {
Status = NtOpenSemaphore( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Section" )) {
Status = NtOpenSection( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Directory" )) {
Status = NtOpenDirectoryObject( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"Process" )) {
Status = NtOpenProcess( Object, DesiredAccess, &Attributes, NULL );
} else if (!wcscmp( Type, L"Job" )) {
Status = NtOpenJobObject( Object, DesiredAccess, &Attributes );
} else if (!wcscmp( Type, L"WindowStation" )) {
*Object = OpenWindowStationW( Name, FALSE, DesiredAccess );
if (*Object)
{
Status = STATUS_SUCCESS;
}
else
{
Status = STATUS_ACCESS_DENIED;
}
} else if (!wcscmp( Type, L"Desktop" )) {
*Object = OpenDesktopW( Name, 0, FALSE, DesiredAccess );
if (*Object)
{
Status = STATUS_SUCCESS;
}
else
{
Status = STATUS_ACCESS_DENIED;
}
} else {
//
// this utility doesn't yet support opening this type of object
//
Status = STATUS_NOT_SUPPORTED;
}
return(Status);
}
VOID
OpenAndDisplaySacl(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name
)
{
NTSTATUS
Status,
IgnoreStatus;
HANDLE
Object;
Status = OpenObject( Root, Type, Name, ACCESS_SYSTEM_SECURITY, &Object);
if (NT_SUCCESS(Status)) {
QueryAndDisplaySacl( Object, Type );
IgnoreStatus = NtClose( Object );
ASSERT(NT_SUCCESS(IgnoreStatus));
}
if (!NT_SUCCESS(Status)) {
if (Status == STATUS_NOT_SUPPORTED) {
printf(" Utility doesn't yet query SACLs for this type of object.\n\n");
} else {
printf(" Error attempting to query SACL: 0x%lx.\n\n", Status);
}
}
return;
}
VOID
QueryAndDisplaySacl(
IN HANDLE Object,
IN PWSTR Type
)
{
NTSTATUS
Status;
PSECURITY_DESCRIPTOR
SD;
ULONG
LengthNeeded,
TypeIndex ;
Status = NtQuerySecurityObject( Object,
SACL_SECURITY_INFORMATION,
NULL,
0,
&LengthNeeded
);
ASSERT(!NT_SUCCESS(Status));
if (Status == STATUS_BUFFER_TOO_SMALL) {
SD = RtlAllocateHeap( RtlProcessHeap(), 0, LengthNeeded );
if (SD == NULL) {
Status = STATUS_NO_MEMORY;
} else {
Status = NtQuerySecurityObject( Object,
SACL_SECURITY_INFORMATION,
SD,
LengthNeeded,
&LengthNeeded
);
if (NT_SUCCESS(Status)) {
//
// Display the SACL
//
Status = DisplaySacl( SD, Type );
}
}
}
return;
}
NTSTATUS
DisplaySacl(
PSECURITY_DESCRIPTOR SD,
PWSTR Type
)
/*++
Routine Description:
This function dumps out a SACL
If an error status is returned, then the caller is responsible
for printing a message.
--*/
{
NTSTATUS
Status;
BOOLEAN
AclPresent,
AclDefaulted;
PACL
Acl;
ACL_SIZE_INFORMATION
AclInfo;
ULONG
i;
PACE_HEADER
Ace;
ULONG TypeIndex ;
TypeIndex = GetObjectTypeIndex( Type );
Status = RtlGetSaclSecurityDescriptor ( SD, &AclPresent, &Acl, &AclDefaulted );
if (NT_SUCCESS(Status)) {
printf(" SACL - ");
if (!AclPresent) {
printf("No SACL present on object\n");
} else {
if (AclDefaulted) {
printf("SACL Defaulted flag set\n ");
}
if (Acl == NULL) {
printf("NULL SACL - no auditing performed.\n");
} else {
Status = RtlQueryInformationAcl ( Acl,
&AclInfo,
sizeof(ACL_SIZE_INFORMATION),
AclSizeInformation);
ASSERT(NT_SUCCESS(Status));
if (AclInfo.AceCount == 0) {
printf("No ACEs in ACL, Auditing performed.\n");
} else {
printf("\n");
for (i=0; i<AclInfo.AceCount; i++) {
Status = RtlGetAce( Acl, i, &Ace );
ASSERT(NT_SUCCESS(Status));
printf(" Ace[%2d] - ", i);
DumpAce( Ace, FALSE, &TypeNames[ TypeIndex ] );
printf("\n");
}
}
}
}
}
printf("\n");
return(Status);
}
VOID
OpenAndDisplayDacl(
IN HANDLE Root,
IN PWCHAR Type,
IN PWCHAR Name
)
{
NTSTATUS
Status,
IgnoreStatus;
HANDLE
Object;
ULONG TypeIndex ;
Status = OpenObject( Root, Type, Name, READ_CONTROL, &Object);
if (NT_SUCCESS(Status)) {
QueryAndDisplayDacl( Object, Type );
IgnoreStatus = NtClose( Object );
ASSERT(NT_SUCCESS(IgnoreStatus));
}
if (!NT_SUCCESS(Status)) {
if (Status == STATUS_ACCESS_DENIED) {
printf(" Protection on object prevented querying the DACL.\n\n");
} else if (Status == STATUS_NOT_SUPPORTED) {
printf(" Utility doesn't yet query DACLs for this type of object.\n\n");
} else {
printf(" Error attempting to query DACL: 0x%lx.\n\n", Status);
}
}
return;
}
VOID
QueryAndDisplayDacl(
IN HANDLE Object,
IN PWSTR Type
)
{
NTSTATUS
Status;
PSECURITY_DESCRIPTOR
SD;
ULONG
LengthNeeded;
Status = NtQuerySecurityObject( Object,
DACL_SECURITY_INFORMATION,
NULL,
0,
&LengthNeeded
);
ASSERT(!NT_SUCCESS(Status));
if (Status == STATUS_BUFFER_TOO_SMALL) {
SD = RtlAllocateHeap( RtlProcessHeap(), 0, LengthNeeded );
if (SD == NULL) {
Status = STATUS_NO_MEMORY;
} else {
Status = NtQuerySecurityObject( Object,
DACL_SECURITY_INFORMATION,
SD,
LengthNeeded,
&LengthNeeded
);
if (NT_SUCCESS(Status)) {
//
// Display the DACL
//
Status = DisplayDacl( SD, Type );
}
}
}
return;
}
NTSTATUS
DisplayDacl(
PSECURITY_DESCRIPTOR SD,
PWSTR Type
)
/*++
Routine Description:
This function dumps out a DACL
If an error status is returned, then the caller is responsible
for printing a message.
--*/
{
NTSTATUS
Status;
BOOLEAN
AclPresent,
AclDefaulted;
PACL
Acl;
ACL_SIZE_INFORMATION
AclInfo;
ULONG
i;
PACE_HEADER
Ace;
ULONG TypeIndex ;
TypeIndex = GetObjectTypeIndex( Type );
Status = RtlGetDaclSecurityDescriptor ( SD, &AclPresent, &Acl, &AclDefaulted );
if (NT_SUCCESS(Status)) {
printf(" DACL - ");
if (!AclPresent) {
printf("No DACL present on object\n");
} else {
if (AclDefaulted) {
printf("DACL Defaulted flag set\n ");
}
if (Acl == NULL) {
printf("NULL DACL - grants all access to Everyone\n");
} else {
Status = RtlQueryInformationAcl ( Acl,
&AclInfo,
sizeof(ACL_SIZE_INFORMATION),
AclSizeInformation);
ASSERT(NT_SUCCESS(Status));
if (AclInfo.AceCount == 0) {
printf("No ACEs in ACL, Denies all access to everyone\n");
} else {
printf("\n");
for (i=0; i<AclInfo.AceCount; i++) {
Status = RtlGetAce( Acl, i, &Ace );
ASSERT(NT_SUCCESS(Status));
printf(" Ace[%2d] - ", i);
DumpAce( Ace, TRUE, &TypeNames[ TypeIndex ] );
printf("\n");
}
}
}
}
}
printf("\n");
return(Status);
}
VOID
DumpAce(
PACE_HEADER Ace,
BOOLEAN AclIsDacl,
PTYPEINFO TypeInfo
)
/*++
Routine Description:
This function displays a single ACE
Arguments:
Ace - Points to an ACE.
AclIsDacl - TRUE if acl is a DACL. False if acl is an SACL.
Return Value:
None.
--*/
{
if ((Ace->AceFlags & INHERIT_ONLY_ACE) != 0) {
printf("Inherit Only - ");
}
switch (Ace->AceType) {
case ACCESS_ALLOWED_ACE_TYPE:
printf("Grant -");
DumpStandardAceInfo(Ace, AclIsDacl, TypeInfo);
break;
case ACCESS_DENIED_ACE_TYPE:
printf("Deny -");
DumpStandardAceInfo(Ace, AclIsDacl, TypeInfo);
break;
case SYSTEM_AUDIT_ACE_TYPE:
printf("Audit ");
DumpStandardAceInfo(Ace, AclIsDacl, TypeInfo);
break;
default:
printf(" ** Unknown ACE Type **");
}
return;
}
VOID
DumpStandardAceInfo(
PACE_HEADER Ace,
BOOLEAN AclIsDacl,
PTYPEINFO TypeInfo
)
/*++
Routine Description:
This function dumps out the standard information for a single ACE.
Arguments:
Ace - Points to an ACE_HEADER. The ACE must be one of the known types.
AclIsDacl - TRUE if acl is a DACL. False if acl is an SACL.
Return Value:
None.
--*/
{
PACCESS_ALLOWED_ACE
Local;
ACCESS_MASK
Specific;
CHAR FlagBuffer[ 256 ];
//
// WARNING -
//
// It is assumed that all the known ACE types have their ACCESS_MASK
// and SID fields in the same location as the ACCESS_ALLOWED_ACE.
//
Local = (PACCESS_ALLOWED_ACE)(Ace);
if (Ace->AceType == SYSTEM_AUDIT_ACE_TYPE) {
printf("[");
if (Ace->AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) {
printf("S");
if (Ace->AceFlags & FAILED_ACCESS_ACE_FLAG) {
printf(",F");
}
} else if (Ace->AceFlags & FAILED_ACCESS_ACE_FLAG) {
printf(" ,F");
} else {
printf("Neither Success nor Failure flag set]");
return;
}
printf("] -");
}
printf(" 0x%lx - ", Local->Mask );
DisplaySid( (PSID)(&Local->SidStart) );
//
// Everything else is only printed for FULL displays
if (AclIsDacl && !DumpDaclFull) {
return;
}
if (!AclIsDacl && !DumpSaclFull) {
return;
}
//
// Print the inheritance
//
printf("\n Inherit: ");
if ((Ace->AceFlags & INHERIT_ONLY_ACE) != 0) {
printf("IO ");
}
if ((Ace->AceFlags & OBJECT_INHERIT_ACE) != 0) {
printf("OI ");
}
if ((Ace->AceFlags & CONTAINER_INHERIT_ACE) != 0) {
printf("CI ");
}
if ((Ace->AceFlags & NO_PROPAGATE_INHERIT_ACE) != 0) {
printf("NPI");
}
//
// Print the accesses
//
Specific = (Local->Mask & 0xFFFF);
printf("\n Access: 0x%04lX", Specific);
if ( TypeInfo->NumberRights )
{
DisplayFlags(
Specific,
TypeInfo->NumberRights,
TypeInfo->AccessRights,
38,
80,
sizeof( Buffer ),
(PUCHAR) Buffer );
printf("\n%s\n ", Buffer);
}
if (Local->Mask != Specific) {
printf(" and (");
}
if ((Local->Mask & DELETE) != 0) {
printf(" D");
}
if ((Local->Mask & READ_CONTROL) != 0) {
printf(" RCtl");
}
if ((Local->Mask & WRITE_OWNER) != 0) {
printf(" WOwn");
}
if ((Local->Mask & WRITE_DAC) != 0) {
printf(" WDacl");
}
if ((Local->Mask & SYNCHRONIZE) != 0) {
printf(" Synch");
}
if ((Local->Mask & GENERIC_READ) != 0) {
printf(" R");
}
if ((Local->Mask & GENERIC_WRITE) != 0) {
printf(" W");
}
if ((Local->Mask & GENERIC_EXECUTE) != 0) {
printf(" E");
}
if ((Local->Mask & GENERIC_ALL) != 0) {
printf(" ALL");
}
if ((Local->Mask & ACCESS_SYSTEM_SECURITY) != 0) {
printf(" ACC_SYS_SEC");
}
if ((Local->Mask & MAXIMUM_ALLOWED) != 0) {
printf(" MAX_ALLOWED");
}
if (Local->Mask != Specific) {
printf(" )");
}
printf("\n");
return;
}
VOID
DisplaySid(
IN PSID Sid
)
/*++
Routine Description:
This function calls LSA to lookup a SID and displays the result.
Arguments:
Sid
Return Value:
None.
--*/
{
NTSTATUS
Status;
PLSA_REFERENCED_DOMAIN_LIST
ReferencedDomains;
PLSA_TRANSLATED_NAME
SidName;
ULONG
DomainIndex;
UNICODE_STRING
SidString;
if (LsaHandle == NULL) {
printf("Can't call LSA to lookup sid");
return;
}
Status = LsaLookupSids(
LsaHandle,
1,
&Sid,
&ReferencedDomains,
&SidName
);
if (!NT_SUCCESS(Status)) {
RtlConvertSidToUnicodeString( &SidString, Sid, TRUE );
printf("%ws (Unable to translate)", SidString.Buffer );
RtlFreeUnicodeString( &SidString );
return;
}
DomainIndex = SidName[0].DomainIndex;
printf("%wZ", &ReferencedDomains->Domains[DomainIndex].Name );
if (ReferencedDomains->Domains[DomainIndex].Name.Length != 0) {
printf("\\");
}
printf("%wZ", &SidName[0].Name );
LsaFreeMemory( ReferencedDomains );
LsaFreeMemory( SidName );
return;
}
VOID
ConnectToLsa( VOID )
/*++
Routine Description:
This function connects to LSA in preparation for expected SID
lookup calls.
--*/
{
NTSTATUS
Status;
OBJECT_ATTRIBUTES
ObjectAttributes;
InitializeObjectAttributes( &ObjectAttributes, NULL, 0, 0, NULL );
LsaHandle = NULL;
Status = LsaOpenPolicy(
NULL, // SystemName
&ObjectAttributes,
POLICY_LOOKUP_NAMES, // DesiredAccess
&LsaHandle
);
if (!NT_SUCCESS(Status)) {
LsaHandle = NULL;
}
return;
}
VOID
Usage(VOID)
{
printf("\n\n"
" Usage:\n"
" objdir [/d | /D] [/s | /S] [<dir_name>]\n\n"
" Where:\n"
" /d - causes DACLs to be displayed in short form.\n\n"
" /D - causes DACLs to be displayed in long form.\n\n"
" /s - causes SACLs to be displayed in short form.\n\n"
" /S - causes SACLs to be displayed in long form.\n\n"
" <dir_name> - is the name of the directory you\n"
" would like to see displayed. Default\n"
" is the root directory.\n\n"
" Examples:\n"
" objdir /d\n"
" - displays dacls of objects in root directory\n\n"
" objdir \\DosDevices\n"
" - displays objects in \\DosDevices\n\n"
" objdir /d \\BaseNamedObjects\n"
" - displays dacls of objects in \\BaseNamedObjects\n\n"
" objdir /s /d \\Windows\n"
" - displays sacls and dacls of objects in \\Windowss\n\n"
" objdir /d \\Windows\\Windowstations\\Service*\n"
" - displays dacls of all windowstations beginning with 'service'\n\n"
" objdir \\Global??\\w*\n"
" - displays objects starting with w in \\Global??\n\n"
);
return;
}