o jT@sddlmZddlmZmZddlmZddlmZddl m Z m Z m Z m Z ddlZdZdZd Zd Zd Zd ZdZdZd Zd ZdZdZdddd ddZGdddeZGdddeZGdddeZGdddZGdddZ dS)) Structure)lsadlsat) SMBTransport) SMBConnection)FileSecInformationFILE_OPEN_REPARSE_POINT GENERIC_ALL READ_CONTROLNi iiiii)RWDXFc@seZdZdZdS) FileNTUser))RevisionHr&r-Sr<{}I) lenstructunpackjoinmapstrintlistformat)selfn authorityr!r!r"__repr__KszACL_SID.__repr__cCs|ddd}t|d}t|d}t|d}tjd|gttt|ddR}td||dtd||}t|S) Nr*r rr r,z<2Bsr$) splitr3r-r.packr5tupler1r#)dataitemsrevisionnumAuth sub_lengthsubauthoritiesraw_sidr!r!r"build_from_stringWs   *  zACL_SID.build_from_stringcC|SNr9r6r!r!r"__str__fzACL_SID.__str__cC||kSrFrGr6otherr!r!r"__eq__izACL_SID.__eq__cCs |SrF)r9__hash__rHr!r!r"rPls zACL_SID.__hash__cOs|j|i|SrF)rIr:)r6argskwargsr!r!r"r:osz ACL_SID.splitN) rrrr r9 staticmethodrDrIrNrPr:r!r!r!r"r#Cs  r#c @sFeZdZddddddddd effZd d Zd d ZddZddZdS) FileNTACE)Typer$) NTACE_Flagsr$)rsz/SecurityAttributes.__repr__..)r5rrrsr0rurHr!rHr"r9s  zSecurityAttributes.__repr__cCrErFrGrHr!r!r"rIrJzSecurityAttributes.__str__cCrKrFrGrLr!r!r"rNrOzSecurityAttributes.__eq__N)rrr__doc__rvr9rIrNr!r!r!r"rqs  rqc@seZdZdZd"ddZddZd d Zefd d Zd dZ ddZ ddZ ddZ ddZ d#ddZddZddZeddZd#d d!ZdS)$ SMBFileACLz Manage Windows file ACLs over SMB. You can view, set, or remove ACLs. You must have the appropriate permissions to do so. NrdFc Cstddi|_ddd|_| du|_| dur| |_nt|||_| r0|j||||||| n |j|||||| |_ | |_ d|_ d|_d|_dS)a @param ip: target server's remote address (IPv4, IPv6) or FQDN @param remote_name: Remote NetBIOS name @param username: username @param password: password @param domain: domain where the account is valid for @param lmhash: LM hash for NTLM authentication @param nthash: NT hash for NTLM authentication @param aesKey: AES key for Kerberos authentication @param doKerberos: Use Kerberos authentication @param kdcHost: KDC hostname or IP address @param smb_connection: existing SMBConnection to reuse (if provided, other auth params are ignored) zS-1-5-18zNT AUTHORITY\SYSTEMzBUILTIN\Administratorsz Domain Users)544513N)r#rD sid_to_name rid_to_name_owns_connection connectionr kerberosLoginlogin start_dce_rpcdce_rpcopen_policy_handle policy_handle transporttidfid) r6ip remote_nameusernamepassworddomainlmhashnthashaesKey doKerberoskdcHostsmb_connectionr!r!r"rvs"      zSMBFileACL.__init__cCs>|jr t|j|j|jr|j|jr|jdSdS)zh Disconnect from the tree id, close the file and disconnect from the smb server N) rr hLsarCloserr disconnectrrcloserHr!r!r"close_connections zSMBFileACL.close_connectioncCs4|jr |j|j|j|jr|j|jdSdS)z7 Close the tree ID and file ID handles N)rr closeFilerdisconnectTreerHr!r!r" close_file's zSMBFileACL.close_filecCs2|j||_|jj|j||td|_|j|jfS)z Open the given file in the specified share @param share_name: share to connect to @param file_name: file to open @return: tuple of (tid, fid) ) desiredAccesscreationOption)r connectTreeropenFilerr)r6 share_name file_namedesired_accessr!r!r" open_file0s   zSMBFileACL.open_filecCs0t|j|jdd|_|j|j}|S)z] Start a new DCE/RPC connection over SMB @return: DCE/RPC connection lsarpc)rfilename)rr getRemoteNamerconnect get_dce_rpc)r6dcer!r!r"r=s  zSMBFileACL.start_dce_rpccCs&|jtjt|jtjd}|S)zU Open a new handle to MSRPC_UUID_LSAD @return: policy handle PolicyHandle)rbindrMSRPC_UUID_LSADhLsarOpenPolicy2POLICY_LOOKUP_NAMES)r6rr!r!r"rLs zSMBFileACL.open_policy_handlecCsdd|ddD}t|D]2\}}|dvr||}|dd}||jvr3|j||jt|<q|||jvrA||j||<qdS) z Set the sid_to_name dictionary according to the given SIDs :param sids: SIDs to translate to their names :param resp: the response containing the names :return: None cSsg|]}|dqS)Namer!)rwnamer!r!r"ry_sz.SMBFileACL.set_sid_to_name..TranslatedNamesNames)Noner*N) enumerater:rr~r#rD)r6sidsrespnamesirridr!r!r"set_sid_to_nameXs zSMBFileACL.set_sid_to_namec CsTz t|j|j|}Wntjy!}z |j}WYd}~nd}~ww|||dS)z Resolve SIDs to names using LSA_LookupSids :param sids: list of SIDs :return: list of usernames N)rhLsarLookupSids2rrDCERPCSessionErrorpacketr)r6rr session_errorr!r!r" sids_to_namesjszSMBFileACL.sids_to_namesc Cshzt|j|j|g}|ddddddWSty3}z td|dt|d}~ww) z= Translate name to SID using LSA_LookupNames TranslatedSidsSidsrSidrNzFailed to resolve name 'z ' to SID: )rhLsarLookupNames3rrgetData Exceptionr2)r6rrer!r!r" name_to_sidws"zSMBFileACL.name_to_sidgrantc Csd}g}|r=|dD]}z |t|O}Wq ty%||Yq w|r7ddl}|dd||s=td| |}dt |} t ddd| ||} t | } || _| S) z Convert given permissions and user to binary format @param username: username to add/remove permissions @param permissions: permissions in the icacls format @param action: 'grant', 'revoke', or 'delete' r,Nz"Ignoring unsupported permissions: z, zNo valid permissions specifiedr zr5ru)r6secrrrs owner_name group_namesecurity_attributesntntuserntacefacerxrrr!r!r"get_security_attributessB      z"SMBFileACL.get_security_attributescCsV|j||dz|jjj|j|jdddd}t|}||}|W|S|w)z Connect to the given share and get the file permissions @param share_name: the share name where the file is to be opened @param file_name: file to get permissions from @return: SecurityAttributes )rrr fileInfoClassinfoTypeadditionalInformation) rr_SMBConnection queryInforrrrr)r6rrresultrrr!r!r"get_permissionss zSMBFileACL.get_permissionscCst|j|dd}|d}d}d}d}|j}t|rd}t|} t| d} | j|dkrd}|dkrT| d |d O<| d |d O<| d |d O<nD|d kr| d |d M<| d |d M<| d |d M<| d d kr| d d kr| d d krd}d}n|dkrd}d}|s|| 7}|| dd}t|s|r||d<t|d|d<|r|dd8<n&|dkr|d kr|dt|7<|dd7<||d|d<|j|d|d} |j|d|d} || | |} | S)a This function will get the current security descriptor, and then insert the given permission to it. Supports different actions: - grant: Add permissions to existing ACE (OR operation) - revoke: Remove specific permissions from existing ACE (AND NOT operation) - delete: Remove the entire ACE @param sec: current security descriptor @param permission: new permission ACE with action attribute rNrrFr\TrrXrYrZrevokerdeleterr rr rr)rrrr-rTr#r)rrrr new_buffer sid_found ace_deletedr delete_acerrxrrrs sec_info_blobr!r!r"insert_permissionsb      # zSMBFileACL.insert_permissionc Cs|||t\|_|_z6||||}|jjj|j|jdddd}t|}|j ||d} |jjj |j|jddd| d}|W| S| w)a Add, remove, or modify permissions for a given user to the given file @param share_name: the share name where the file is to be opened @param file_name: file to set permissions to @param user: user to edit permissions for; can be a SID as well @param permissions: permissions in the icacls format (example: R,W,X,D). NOTE: not all permission types are supported; currently supporting: R - read-only access W - write-only access D - delete access X - execute access F - full control @param action: action to perform - 'grant' (add), 'revoke' (remove), 'delete' (remove ACE) @return: bool. whether the operation succeeded or not rrrr)rrr)rrr inputBlob) rr rrrrrrrrsetInfor) r6rruserrrrrrsecurity_descriptorr!r!r"set_permissions?s, zSMBFileACL.set_permissions) NNrdrdrdrdrdNFNN)r)rrrrzrvrrr rrrrrrrrrrSrrr!r!r!r"r{s" (    %0 Lr{)!impacket.structurerimpacket.dcerpc.v5rrimpacket.dcerpc.v5.transportrimpacket.smbconnectionrimpacket.smb3structsrrr r r.rerfrgrhrirlrkrmrorprnSEC_READ_RIGHTrrr#rTrqr{r!r!r!r"s:     1[