o jg@sZddlZddlZddlmZddlTddlmZddlmZm Z ddZ dd Z e d e d e d e d e de de ddZ ddZ ddZddZddZd3ddZ dZeZejedd Gd!d"d"eZGd#d$d$eZGd%d&d&eZGd'd(d(eZGd)d*d*eZGd+d,d,eZGd-d.d.eZ Gd/d0d0eZGd1d2d2eZdS)4N)logger)*)BytesIO)unpackpackcCsDtd|dd\}}}td|dd\}}}d||||||fS)NHHLz%08X-%04X-%04X-%04X-%04X%08X)r)uuiduuid1uuid2uuid3uuid4uuid5uuid6r/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/msldap/external/bloodhoundpy/acls.py bin_to_string"srcCs`d|vr t|Std|}dd|D\}}}}}}td|||}|td|||7}|S)N-z^([\dA-Fa-f]{8})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})([\dA-Fa-f]{8})cSsg|]}t|dqS)r )int).0xrrr 1z!string_to_bin..rr )binascii unhexlifyrematchgroupsr)r matchesr r rrrrrrr string_to_bin(s r!z$1131f6aa-9c07-11d1-f79f-00c04fc2dcd2z$1131f6ad-9c07-11d1-f79f-00c04fc2dcd2z$89e95b76-444d-4c62-991a-0facbeda640cz$bf9679c0-0de6-11d0-a285-00aa003049e2z$00299570-246d-11d0-a768-00aa006e0529z$3f78c3e5-f79a-46bd-a0b8-9d18116ddc79z$4c164200-20c0-11d0-a768-00aa006e0529) GetChanges GetChangesAllGetChangesInFilteredSet WriteMemberUserForceChangePassword AllowedToActUserAccountRestrictionsSetc Cs|s||gfStt|}||j|d<g}t|j}gd}||vr.|t|ddd|jj D]K} | j j dkrJ| j j dkrJt d| j j q2t| jj} | |vrUq2| j j dkr| tj} | tjso| tjroq2| tjr| jtjrt| j||sq2| jj} | tjs| tjs| tjs| tjr.| jtj rt| j!||sq2| tjr|d kr| jtj r|d d r| j!|d kr|t| d | dn |t| d| dq2| tjr |t| d| d|dkr |d kr q2| tjr|t| d| d| tjr.|t| d| d| jjtj"} | r|dvrP| jtj sP|t| d| d|dkrht#| t$drh|t| dd| d|d krt#| t$dr|t| dd| d|d krt#| t$dr| %ds|t| dd| d|dvr| jtj rd|vr| j!|dkr|t| d| d|d kr| jtj r| j!|d!kr|t| d"| dn#| jjtj&r |dkr | jj'j(t$dkr |t| d#d| d| jjtj)r@|d kr@| jtj r@|d d r@| j!|d kr@|t| d | d| jjtj*}|r|d$vrc| jtj sc|t| d%d| d|d kr{| jtj s{|t| d%d| d|dkrt+| t$d&r|t| d&d| d|dkrt+| t$d'r|t| d'd| d|dkrt+| t$d(r|t| d(d| d|d krt+| t$d)r|t| d*d| d| j j dkr~| tj} | jj} | tjs| tjrq2| tjr |t| d| dq2| tj"r#|dvr#|t| d| d| tjr4|t| d| d|d$vrK| tj*rK|t| d%d| d|d krm| tj*rm| d+krm| %dsm|t| d%d| d| tjr~|t| d| dq2|||fS),z Main ACL structure parse function. This is offloaded to subprocesses and takes the current entry and the acl data as argument. This is then returned and processed back in the main process IsACLProtected)zS-1-3-0zS-1-5-18zS-1-5-10OwnsF) inheritedrzDon't care about acetype %dcomputer Propertieshaslapsz ms-mcs-admpwdReadLAPSPassword GenericAll GenericWritedomain WriteDacl WriteOwner)usergroupr-gpor7r% AddMemberr'AddAllowedToActr(z-512WriteAccountRestrictions)r6r-zms-ds-key-credential-linkAddKeyCredentialLinkr6zservice-principal-nameWriteSPNAddSelf)r6r3AllExtendedRightsr"r#r$r&ForceChangePasswordz S-1-5-32-544),SecurityDescriptorr has_controlPDstr owner_sidappendbuild_relationdaclacesaceAceTyperdebugacedatasidhas_flagACE INHERITED_ACEINHERIT_ONLY_ACEACCESS_ALLOWED_OBJECT_ACE!ACE_INHERITED_OBJECT_TYPE_PRESENT ace_appliesget_inherited_object_typelowermaskhas_priv ACCESS_MASK GENERIC_ALL WRITE_DACL WRITE_OWNER GENERIC_WRITEACE_OBJECT_TYPE_PRESENTget_object_typeADS_RIGHT_DS_WRITE_PROPcan_write_propertyEXTRIGHTS_GUID_MAPPINGendswithADS_RIGHT_DS_SELFdata ObjectTypeADS_RIGHT_DS_READ_PROPADS_RIGHT_DS_CONTROL_ACCESShas_extended_right)dnentry entrytypeaclobjecttype_guid_mapsd relationsosid ignoresids ace_objectrO is_inheritedrY writeprivscontrol_accessrrrparse_binary_aclDs            &"      rycC<|jjtjs dS|jtjsdS|jjj |krdSdS)a Checks if the access is sufficient to write to a specific property. This can either be because we have the right ADS_RIGHT_DS_WRITE_PROP and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_WRITE_PROP right and the ObjectType is empty, in which case we can write to any property. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx FT) rNrYrZr[rbrPrTr`rgrh)ru binpropertyrrrrcrccCrz)a Checks if the access is sufficient to control the right with the given GUID. This can either be because we have the right ADS_RIGHT_DS_CONTROL_ACCESS and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_CONTROL_ACCESS right and the ObjectType is empty, in which case we have all extended rights. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx FT) rNrYrZr[rjrPrTr`rgrh)ru binrightguidrrrrk r|rkcCs|||krdSdS)z Checks if an ACE applies to this object (based on object classes). Note that this function assumes you already verified that InheritedObjectType is set (via the flag). If this is not set, the ACE applies to all object types. TFr)ace_guid object_classrprrrrVs rVr:FcCs|dkrtd|||dS)Nr:z!BH 4.0 incompatible output called) rightnamerOr+) ValueError)rOrelationacetyper+rrrrH's rHa struct SECURITY_DESCRIPTOR { uint8 Revision; uint8 Sbz1; uint16 Control; uint32 OffsetOwner; uint32 OffsetGroup; uint32 OffsetSacl; uint32 OffsetDacl; }; struct LDAP_SID_IDENTIFIER_AUTHORITY { char Value[6]; }; struct LDAP_SID { uint8 Revision; uint8 SubAuthorityCount; LDAP_SID_IDENTIFIER_AUTHORITY IdentifierAuthority; uint32 SubAuthority[SubAuthorityCount]; }; struct ACL { uint8 AclRevision; uint8 Sbz1; uint16 AclSize; uint16 AceCount; uint16 Sbz2; char Data[AclSize - 8]; }; struct ACE { uint8 AceType; uint8 AceFlags; uint16 AceSize; char Data[AceSize - 4]; }; struct ACCESS_ALLOWED_ACE { uint32 Mask; LDAP_SID Sid; }; struct ACCESS_ALLOWED_OBJECT_ACE { uint32 Mask; uint32 Flags; char ObjectType[Flags & 1 * 16]; char InheritedObjectType[Flags & 2 * 8]; LDAP_SID Sid; }; T)compiledc@s\eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZddZddZdS)rBrr,r cCst|jdd|dkS)Nr1)bincontrol)selfrrrrrCszSecurityDescriptor.has_controlcCs||_t||_|jj|_d|_d|_d|_d|_ |jj dkr-| |jj t |d|_|jj dkr@| |jj t |d|_|jjdkrR| |jjt||_|jjdkrf| |jjt||_ dSdS)Nr)fh)rc_secdSECURITY_DESCRIPTOR descriptorControlrrF group_sidsaclrI OffsetOwnerseekLdapSid OffsetGroup OffsetSaclACL OffsetDaclrrrrr__init__s(         zSecurityDescriptor.__init__N)__name__ __module__ __qualname__SRRMPSrDSIDISCDCSSDTSDSPDDDPGDODrCrrrrrrBxs& rBc@seZdZdddZddZdS)rNcCs$|r ||_t||_dS||_dSN)rrLDAP_SIDldap_sid)rrin_objrrrrs zLdapSid.__init__cCs4d|jjt|jjjdddd|jjDS)Nz S-{}-{}-{}r,rcSsg|]}d|qS)z{:d})format)rvrrrrrz$LdapSid.__repr__..)rrRevision bytearrayIdentifierAuthorityValuejoin SubAuthorityrrrr__repr__s4zLdapSid.__repr__)NNrrrrrrrrrrs  rc@seZdZddZdS)rcCsJ||_t||_g|_t|jj}t|jjD] }|j t |qdSr) rrrrorJrDatarangeAceCountrGrQ)rrbufirrrrs  z ACL.__init__N)rrrrrrrrrs rc@seZdZddZddZdS)ACCESS_ALLOWED_ACEcC4||_t||_t|jjd|_t|jj|_ dSN)r) rrrrgrSidrOr[MaskrYrrrrr zACCESS_ALLOWED_ACE.__init__cCsdt|jt|jfS)Nz*)rErOrYrrrrrszACCESS_ALLOWED_ACE.__repr__Nrrrrrrs rc@ eZdZdS)ACCESS_DENIED_ACENrrrrrrrrrc@s<eZdZdZdZddZddZddZd d Zd d Z d S)rTrrcCrr) rrrTrgrrrOr[rrYrrrrrrz"ACCESS_ALLOWED_OBJECT_ACE.__init__cC|jj|@|kSr)rgFlagsrflagrrrrPz"ACCESS_ALLOWED_OBJECT_ACE.has_flagcC||jr t|jjSdSr)rPr`rrgrhrrrrra  z)ACCESS_ALLOWED_OBJECT_ACE.get_object_typecCrr)rPrUrrgInheritedObjectTyperrrrrWrz3ACCESS_ALLOWED_OBJECT_ACE.get_inherited_object_typecCspg}ttD]\}}|dst|tur||r||qd|t|j t|j | | f}d|S)N_ | z^) varsrT startswithtyperrPrGrrErOrYrarW)routnamevaluergrrrrs  z"ACCESS_ALLOWED_OBJECT_ACE.__repr__N) rrrr`rUrrPrarWrrrrrrTs rTc@r)ACCESS_DENIED_OBJECT_ACENrrrrrrrrc@seZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZddZddZddZddZddZd S)!r[lii iii(iiiiiiiiirrr rcCs ||_dSrrY)rrYrrrr!s zACCESS_MASK.__init__cCs|j|@|kSrrrprivrrrrZ$szACCESS_MASK.has_privcCs|j|O_dSrrrrrrset_priv'zACCESS_MASK.set_privcCs|j|N_dSrrrrrr remove_priv*rzACCESS_MASK.remove_privcCsTg}ttD]\}}|dst|tur||r||qd|jd|fS)Nrz!r) rr[rrrrZrGrYrrrrrrrrr-s   zACCESS_MASK.__repr__N)rrrSET_GENERIC_READSET_GENERIC_WRITESET_GENERIC_EXECUTESET_GENERIC_ALL GENERIC_READr_GENERIC_EXECUTEr\MAXIMUM_ALLOWEDACCESS_SYSTEM_SECURITY SYNCHRONIZEr^r] READ_CONTROLDELETErjADS_RIGHT_DS_CREATE_CHILDADS_RIGHT_DS_DELETE_CHILDrirbrfrrZrrrrrrrr[s6 r[c@s@eZdZdZdZdZdZdZdZdZ ddZ d d Z d d Z d S)rQrrr rrcCs||_t||_d|_t|jj}|jjdkrt||_n#|jjdkr*t ||_n|jjdkr6t ||_n |jjdkrAt ||_|jrNt |jj j|_dSdS)Nrr,rr)rrrQrKrNrrrLrrTrrr[rgrrY)rrrrrrr@s          z ACE.__init__cCsdg}ttD]\}}|dst|tur||r||qd|jjd ||jj t |j fS)Nrz+r) rrQrrrrPrGrKrLrAceFlagsrErNrrrrrWs   $z ACE.__repr__cCrr)rKrrrrrrP_rz ACE.has_flagN) rrrCONTAINER_INHERIT_ACEFAILED_ACCESS_ACE_FLAGrSrRNO_PROPAGATE_INHERIT_ACEOBJECT_INHERIT_ACESUCCESSFUL_ACCESS_ACE_FLAGrrrPrrrrrQ7s rQ)r:F) rrmsldapr(msldap.external.bloodhoundpy.lib.cstructiorstructrrrr!rdryrcrkrVrHcdefcstructrloadobjectrBrrrrrTrr[rQrrrrsH   5 43   %: