Skip to content

Commit 79ff18e

Browse files
hakrilhakril
committed
Update doc/samples/test of windows.security
1 parent 986664d commit 79ff18e

5 files changed

Lines changed: 641 additions & 23 deletions

File tree

‎docs/source/security.rst‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
``windows.security`` -- Security Descriptor & related
2+
*****************************************************
3+
4+
.. warning:
5+
6+
Foutre les token ici ?
7+
Ca a du sens https://docs.microsoft.com/en-us/windows/desktop/secauthz/access-control-components
8+
9+
ACCESS CONTROL TOUT CA..
10+
Les deux vont bien ensemble..
11+
12+
13+
.. module:: windows.security
14+
15+
16+
SecurityDescriptor
17+
""""""""""""""""""
18+
19+
.. autoclass:: SecurityDescriptor
20+
21+
22+
Acl
23+
"""
24+
25+
.. autoclass:: Acl
26+
:special-members: __len__, __iter__
27+
28+
29+
.. _security_ace:
30+
31+
Ace
32+
"""
33+
34+
The ACE are regrouped in two categories.
35+
36+
The DACL related ACEs:
37+
38+
- :class:`AccessAllowedACE`
39+
- :class:`AccessDeniedACE`
40+
- :class:`AccessAllowedCallbackACE`
41+
- :class:`AccessDeniedCallbackACE`
42+
- :class:`AccessAllowedObjectACE`
43+
- :class:`AccessDeniedObjectACE`
44+
- :class:`AccessAllowedCallbackObjectACE`
45+
- :class:`AccessDeniedCallbackObjectACE`
46+
47+
The SACL related ACEs:
48+
49+
- :class:`SystemAuditACE`
50+
- :class:`SystemAlarmACE`
51+
- :class:`SystemAuditObjectACE`
52+
- :class:`SystemAlarmObjectACE`
53+
- :class:`SystemAuditCallbackACE`
54+
- :class:`SystemAlarmCallbackACE`
55+
- :class:`SystemAuditCallbackObjectACE`
56+
- :class:`SystemAlarmCallbackObjectACE`
57+
- :class:`SystemMandatoryLabelACE`
58+
- :class:`SystemResourceAttributeACE`
59+
- :class:`SystemScopedPolicyIDACE`
60+
- :class:`SystemProcessTrustLabelACE`
61+
62+
63+
Ace classes
64+
'''''''''''
65+
66+
AccessAllowedACE
67+
~~~~~~~~~~~~~~~~
68+
69+
.. autoclass:: AccessAllowedACE
70+
:show-inheritance:
71+
:inherited-members:
72+
73+
AccessDeniedACE
74+
~~~~~~~~~~~~~~~
75+
76+
.. autoclass:: AccessDeniedACE
77+
:show-inheritance:
78+
:inherited-members:
79+
80+
81+
AccessAllowedCallbackACE
82+
~~~~~~~~~~~~~~~~~~~~~~~~
83+
84+
.. autoclass:: AccessAllowedCallbackACE
85+
:show-inheritance:
86+
:inherited-members:
87+
88+
89+
AccessDeniedCallbackACE
90+
~~~~~~~~~~~~~~~~~~~~~~~
91+
92+
.. autoclass:: AccessDeniedCallbackACE
93+
:show-inheritance:
94+
:inherited-members:
95+
96+
AccessAllowedObjectACE
97+
~~~~~~~~~~~~~~~~~~~~~~
98+
99+
.. autoclass:: AccessAllowedObjectACE
100+
:show-inheritance:
101+
:inherited-members:
102+
103+
AccessDeniedObjectACE
104+
~~~~~~~~~~~~~~~~~~~~~
105+
106+
.. autoclass:: AccessDeniedObjectACE
107+
:show-inheritance:
108+
:inherited-members:
109+
110+
111+
AccessAllowedCallbackObjectACE
112+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
113+
114+
.. autoclass:: AccessAllowedCallbackObjectACE
115+
:show-inheritance:
116+
:inherited-members:
117+
118+
119+
AccessDeniedCallbackObjectACE
120+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
121+
122+
.. autoclass:: AccessDeniedCallbackObjectACE
123+
:show-inheritance:
124+
:inherited-members:
125+
126+
127+
SystemAuditACE
128+
~~~~~~~~~~~~~~
129+
130+
.. autoclass:: SystemAuditACE
131+
:show-inheritance:
132+
:inherited-members:
133+
134+
135+
SystemAlarmACE
136+
~~~~~~~~~~~~~~
137+
138+
.. autoclass:: SystemAlarmACE
139+
:show-inheritance:
140+
:inherited-members:
141+
142+
SystemAuditObjectACE
143+
~~~~~~~~~~~~~~~~~~~~
144+
145+
.. autoclass:: SystemAuditObjectACE
146+
:show-inheritance:
147+
:inherited-members:
148+
149+
SystemAlarmObjectACE
150+
~~~~~~~~~~~~~~~~~~~~
151+
152+
.. autoclass:: SystemAlarmObjectACE
153+
:show-inheritance:
154+
:inherited-members:
155+
156+
SystemAuditCallbackACE
157+
~~~~~~~~~~~~~~~~~~~~~~
158+
159+
.. autoclass:: SystemAuditCallbackACE
160+
:show-inheritance:
161+
:inherited-members:
162+
163+
164+
SystemAlarmCallbackACE
165+
~~~~~~~~~~~~~~~~~~~~~~
166+
167+
.. autoclass:: SystemAlarmCallbackACE
168+
:show-inheritance:
169+
:inherited-members:
170+
171+
SystemAuditCallbackObjectACE
172+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
173+
174+
.. autoclass:: SystemAuditCallbackObjectACE
175+
:show-inheritance:
176+
:inherited-members:
177+
178+
179+
SystemAlarmCallbackObjectACE
180+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
181+
182+
.. autoclass:: SystemAlarmCallbackObjectACE
183+
:show-inheritance:
184+
:inherited-members:
185+
186+
187+
SystemMandatoryLabelACE
188+
~~~~~~~~~~~~~~~~~~~~~~~
189+
190+
.. autoclass:: SystemMandatoryLabelACE
191+
:show-inheritance:
192+
:inherited-members:
193+
194+
195+
SystemResourceAttributeACE
196+
~~~~~~~~~~~~~~~~~~~~~~~~~~
197+
198+
.. autoclass:: SystemResourceAttributeACE
199+
:show-inheritance:
200+
:inherited-members:
201+
202+
203+
SystemScopedPolicyIDACE
204+
~~~~~~~~~~~~~~~~~~~~~~~
205+
206+
.. autoclass:: SystemScopedPolicyIDACE
207+
:show-inheritance:
208+
:inherited-members:
209+
210+
211+
SystemProcessTrustLabelACE
212+
~~~~~~~~~~~~~~~~~~~~~~~~~~
213+
214+
.. autoclass:: SystemProcessTrustLabelACE
215+
:show-inheritance:
216+
:inherited-members:
217+
218+
219+
220+
Ace common base
221+
"""""""""""""""
222+
223+
These classes are internals and here for completness sake.
224+
You should not need to instanciate/use them directly.
225+
226+
AceHeader
227+
'''''''''
228+
229+
.. autoclass:: AceHeader
230+
231+
AceBase
232+
'''''''
233+
234+
.. autoclass:: AceBase
235+
236+
237+
MaskAndSidACE
238+
'''''''''''''
239+
240+
.. autoclass:: MaskAndSidACE
241+
242+
243+
CallbackACE
244+
'''''''''''
245+
246+
.. autoclass:: CallbackACE
247+
248+
249+
ObjectRelatedACE
250+
''''''''''''''''
251+
252+
.. autoclass:: ObjectRelatedACE
253+
254+
255+

‎samples/security/query_sacl.py‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
import sys
2+
import windows.security
3+
4+
TARGET = r"C:\windows\notepad.exe" # On WIN10 (at least) notepad.exe has a AuditACE
5+
6+
if not windows.current_process.token.elevated:
7+
print(ValueError("This sample should be run as admin to demonstration SACL access"))
8+
9+
print("")
10+
print("[NO-PRIV] Querying <{0}> SecurityDescriptor without SACL".format(TARGET))
11+
sd = windows.security.SecurityDescriptor.from_filename(TARGET)
12+
print("sacl = {0}".format(sd.sacl))
13+
14+
print("")
15+
print("[NO-PRIV] Querying <{0}> SecurityDescriptor with SACL".format(TARGET))
16+
try:
17+
sd = windows.security.SecurityDescriptor.from_filename(TARGET, query_sacl=True)
18+
print("sacl = {0}".format(sd.sacl))
19+
except WindowsError as e:
20+
print(e)
21+
22+
print("")
23+
print("Enabling <SeSecurityPrivilege>")
24+
try:
25+
windows.current_process.token.enable_privilege("SeSecurityPrivilege")
26+
except ValueError as e:
27+
print("[ERROR] {0}".format(e))
28+
exit(1)
29+
30+
print("")
31+
print("[PRIV] Querying <{0}> SecurityDescriptor with SACL".format(TARGET))
32+
sd = windows.security.SecurityDescriptor.from_filename(TARGET, query_sacl=True)
33+
print("sacl = {0}".format(sd.sacl))
34+
print(list(sd.sacl))

‎samples/security/security_descriptor.py‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
import windows.security
2+
3+
SDDL = "O:BAG:AND:(A;OI;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)(D;CIIO;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)"
4+
5+
sd = windows.security.SecurityDescriptor.from_string(SDDL)
6+
print("Security descriptor is: {0}".format(sd))
7+
8+
print("Owner: {0}".format(sd.owner))
9+
print(" - lookup: {0}".format(windows.security.lookup_sid(sd.owner)))
10+
print("Group: {0}".format(sd.group))
11+
print(" - lookup: {0}".format(windows.security.lookup_sid(sd.group)))
12+
13+
dacl = sd.dacl
14+
print("Dacl: {0}".format(dacl))
15+
16+
for i, ace in enumerate(dacl):
17+
print("")
18+
print(" ACE [{0}]: {1}".format(i, ace))
19+
print(" - Header-AceType: {0}".format(ace.Header.AceType))
20+
print(" - Header-AceFlags: {0}".format(ace.Header.AceFlags))
21+
print(" - Header-flags: {0}".format(ace.Header.flags))
22+
print(" - Mask: {0}".format(ace.Mask))
23+
print(" - mask: {0}".format(ace.mask))
24+
print(" - Sid: {0}".format(ace.sid))

‎tests/test_security.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,13 @@
1919
def test_security_descriptor_from_string(sddl):
2020
sd = SecurityDescriptor.from_string(sddl)
2121

22+
def test_empty_security_descriptor():
23+
esd = SecurityDescriptor.from_string("")
24+
assert esd.owner is None # Should NOT be NULL PSID but None
25+
assert esd.group is None # Should NOT be NULL PSID but None
26+
assert esd.dacl is None
27+
assert esd.sacl is None
28+
2229

2330
def test_pacl_object():
2431
SDDL = "O:ANG:S-1-2-3D:(A;;;;;S-1-42-42)(A;;;;;S-1-42-43)(A;;;;;S-1-42-44)"
@@ -193,3 +200,4 @@ def test_conditional_ace_applicationdata(sddl, expected_value):
193200
assert expected_value in appdata.replace("\x00", "")
194201

195202

203+

0 commit comments

Comments
 (0)