Class: Rex::Proto::MsDtyp::MsDtypAce

Inherits:

BinData::Record

• Object
• BinData::Record
• Rex::Proto::MsDtyp::MsDtypAce

Defined in:

lib/rex/proto/ms_dtyp.rb

Class Method Summary

• .from_sddl_text(sddl_text, domain_sid:) ⇒ Object

Instance Method Summary

• #to_sddl_text(domain_sid: nil) ⇒ Object

Class Method Details

.from_sddl_text(sddl_text, domain_sid:) ⇒ Object

Raises:

• (SDDLParseError)

# File 'lib/rex/proto/ms_dtyp.rb', line 543

def self.from_sddl_text(sddl_text, domain_sid:)
  parts = sddl_text.upcase.split(';', -1)
  raise SDDLParseError.new('too few ACE fields') if parts.length < 6
  raise SDDLParseError.new('too many ACE fields') if parts.length > 7

  ace_type, ace_flags, rights, object_guid, inherit_object_guid, account_sid = parts[0...6]
  resource_attribute = parts[6]

  ace = self.new
  case ace_type
  when 'A'
    ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE
  when 'D'
    ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_ACE_TYPE
  when 'OA'
    ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE
  when 'OD'
    ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE
  when 'AU'
    ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE
  when 'OU'
    ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE
  when 'AL', 'OL', 'ML', 'XA', 'SD', 'RA', 'SP', 'XU', 'ZA', 'TL', 'FL'
    raise SDDLParseError.new('unsupported ACE type: ' + ace_type)
  else
    raise SDDLParseError.new('unknown ACE type: ' + ace_type)
  end

  ace_flags.split(/(CI|OI|NP|IO|ID|SA|FA|TP|CR)/).each do |flag|
    case flag
    when 'CI'
      ace.header.ace_flags.container_inherit_ace = true
    when 'OI'
      ace.header.ace_flags.object_inherit_ace = true
    when 'NP'
      ace.header.ace_flags.no_propagate_inherit_ace = true
    when 'IO'
      ace.header.ace_flags.inherit_only_ace = true
    when 'ID'
      ace.header.ace_flags.inherited_ace = true
    when 'SA'
      ace.header.ace_flags.successful_access_ace_flag = true
    when 'FA'
      ace.header.ace_flags.failed_access_ace_flag = true
    when 'TP'
      raise SDDLParseError.new('unsupported ACE flag: TP')
    when 'CR'
      ace.header.ace_flags.critical_ace_flag = true
    when ''
    else
      raise SDDLParseError.new('unknown ACE flag: ' + flag)
    end
  end

  ace.body.access_mask = MsDtypAccessMask.from_sddl_text(rights)

  unless object_guid.blank?
    begin
      guid = MsDtypGuid.new(object_guid)
    rescue StandardError
      raise SDDLParseError.new('invalid object GUID: ' + object_guid)
    end

    unless ace.body.respond_to?('object_type=')
      raise SDDLParseError.new('setting object type for incompatible ACE type')
    end
    ace.body.flags.ace_object_type_present = true
    ace.body.object_type = guid
  end

  unless inherit_object_guid.blank?
    begin
      guid = MsDtypGuid.new(inherit_object_guid)
    rescue StandardError
      raise SDDLParseError.new('invalid inherited object GUID: ' + inherit_object_guid)
    end

    unless ace.body.respond_to?('inherited_object_type=')
      raise SDDLParseError.new('setting inherited object type for incompatible ACE type')
    end
    ace.body.flags.ace_inherited_object_type_present = true
    ace.body.inherited_object_type = guid
  end

  unless account_sid.blank?
    ace.body.sid = MsDtypSid.from_sddl_text(account_sid, domain_sid: domain_sid)
  end

  unless resource_attribute.blank?
    raise SDDLParseError.new('unsupported resource attribute: ' + resource_attribute)
  end

  ace
end

Instance Method Details

#to_sddl_text(domain_sid: nil) ⇒ Object

# File 'lib/rex/proto/ms_dtyp.rb', line 492

def to_sddl_text(domain_sid: nil)
  parts = []

  case header.ace_type
  when MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE
    parts << 'A'
  when MsDtypAceType::ACCESS_DENIED_ACE_TYPE
    parts << 'D'
  when MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE
    parts << 'OA'
  when MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE
    parts << 'OD'
  when MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE
    parts << 'AU'
  when MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE
    parts << 'OU'
  else
    raise SDDLParseError.new('unknown ACE type: ' + header.ace_type.to_i)
  end

  ace_flags = ''
  ace_flags << 'OI' if header.ace_flags.object_inherit_ace == 1
  ace_flags << 'CI' if header.ace_flags.container_inherit_ace == 1
  ace_flags << 'IO' if header.ace_flags.inherit_only_ace == 1

  ace_flags << 'NP' if header.ace_flags.no_propagate_inherit_ace == 1
  ace_flags << 'ID' if header.ace_flags.inherited_ace == 1
  ace_flags << 'SA' if header.ace_flags.successful_access_ace_flag == 1
  ace_flags << 'FA' if header.ace_flags.failed_access_ace_flag == 1
  ace_flags << 'CR' if header.ace_flags.critical_ace_flag == 1
  parts << ace_flags

  parts << body.access_mask.to_sddl_text

  if body[:flags]
    parts << (body.flags[:ace_object_type_present] == 1 ? body.object_type.to_s : '')
    parts << (body.flags[:ace_inherited_object_type_present] == 1 ? body.inherited_object_type.to_s : '')
  else
    parts << ''
    parts << ''
  end

  if body.sid?
    parts << body.sid.to_sddl_text(domain_sid: domain_sid)
  else
    parts << ''
  end

  parts.join(';')
end