Skip to content

Commit 16e863e

Browse files
tyranidtyranid
committed
Added Get/Set-NtTokenDefaultDacl.
1 parent 92a733e commit 16e863e

5 files changed

Lines changed: 192 additions & 1 deletion

File tree

‎NtApiDotNet/NtToken.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2223,6 +2223,20 @@ public static NtResult<NtToken> OpenEffectiveToken(NtThread thread, bool open_as
22232223
return OpenProcessToken(pid.Result, duplicate, desired_access, throw_on_error);
22242224
}
22252225

2226+
/// <summary>
2227+
/// Open the effective token, thread if available or process
2228+
/// </summary>
2229+
/// <param name="thread">The thread to open the token for</param>
2230+
/// <param name="duplicate">True to duplicate the token before returning</param>
2231+
/// <param name="desired_access">Desired access for token.</param>
2232+
/// <param name="open_as_self">Open token as self.</param>
2233+
/// <returns>The opened token</returns>
2234+
/// <exception cref="NtException">Thrown if cannot open token</exception>
2235+
public static NtToken OpenEffectiveToken(NtThread thread, bool open_as_self, bool duplicate, TokenAccessRights desired_access)
2236+
{
2237+
return OpenEffectiveToken(thread, open_as_self, duplicate, desired_access, true).Result;
2238+
}
2239+
22262240
/// <summary>
22272241
/// Open the effective token, thread if available or process
22282242
/// </summary>

‎NtObjectManager/Cmdlets/Object/GetNtTokenDefaultDacl.cs‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet;
16+
using System.Management.Automation;
17+
18+
namespace NtObjectManager.Cmdlets.Object
19+
{
20+
/// <summary>
21+
/// <para type="synopsis">Get the Default DACL from a Token.</para>
22+
/// <para type="description">This cmdlet gets the Default DACL from a Token.</para>
23+
/// </summary>
24+
/// <example>
25+
/// <code>$dacl = Get-NtTokenDefaultDacl</code>
26+
/// <para>Get current effective token's Default DACL.</para>
27+
/// </example>
28+
/// <example>
29+
/// <code>$dacl = Get-NtTokenDefaultDacl -Token $token</code>
30+
/// <para>Get Default DACL from a Token.</para>
31+
/// </example>
32+
/// <example>
33+
/// <code>$sd = Get-NtTokenDefaultDacl -AsSecurityDescriptor</code>
34+
/// <para>Get current process' primary token's Default DACL as a Security Descriptor.</para>
35+
/// </example>
36+
[Cmdlet(VerbsCommon.Get, "NtTokenDefaultDacl", DefaultParameterSetName = "FromCurrent")]
37+
[OutputType(typeof(SecurityDescriptor), typeof(Acl))]
38+
public class GetNtTokenDefaultDacl : PSCmdlet
39+
{
40+
private NtToken GetToken()
41+
{
42+
if (Token != null)
43+
return Token.Duplicate();
44+
return NtToken.OpenEffectiveToken(NtThread.Current, true, false, TokenAccessRights.Query);
45+
}
46+
47+
/// <summary>
48+
/// <para type="description">Specify the token to query for the default DACL.</para>
49+
/// </summary>
50+
[Parameter(ParameterSetName = "FromToken", Position = 0, Mandatory = true)]
51+
public NtToken Token { get; set; }
52+
53+
/// <summary>
54+
/// <para type="description">Specify to return the ACL in a Security Descriptor.</para>
55+
/// </summary>
56+
[Parameter]
57+
[Alias("sd")]
58+
public SwitchParameter AsSecurityDescriptor { get; set; }
59+
60+
/// <summary>
61+
/// Overridden ProcessRecord method.
62+
/// </summary>
63+
protected override void ProcessRecord()
64+
{
65+
using (var token = GetToken())
66+
{
67+
Acl default_dacl = token.DefaultDacl;
68+
if (AsSecurityDescriptor)
69+
{
70+
WriteObject(new SecurityDescriptor() { Dacl = default_dacl });
71+
}
72+
else
73+
{
74+
WriteObject(default_dacl, false);
75+
}
76+
}
77+
}
78+
}
79+
}

‎NtObjectManager/Cmdlets/Object/SetNtTokenDefaultDacl.cs‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet;
16+
using System;
17+
using System.Management.Automation;
18+
19+
namespace NtObjectManager.Cmdlets.Object
20+
{
21+
/// <summary>
22+
/// <para type="synopsis">Set the Default DACL for a Token.</para>
23+
/// <para type="description">This cmdlet sets the Default DACL for a Token.</para>
24+
/// </summary>
25+
/// <example>
26+
/// <code>Set-NtTokenDefaultDacl -DefaultDacl $dacl</code>
27+
/// <para>Set current effective token's Default DACL.</para>
28+
/// </example>
29+
/// <example>
30+
/// <code>Set-NtTokenDefaultDacl -SecurityDescriptor $sd</code>
31+
/// <para>Set current effective token's Default DACL from a Security Descriptor.</para>
32+
/// </example>
33+
/// <example>
34+
/// <code>Set-NtTokenDefaultDacl -DefaultDacl $dacl -Token $token</code>
35+
/// <para>Set Default DACL for a Token.</para>
36+
/// </example>
37+
[Cmdlet(VerbsCommon.Set, "NtTokenDefaultDacl", DefaultParameterSetName = "FromAcl")]
38+
public class SetNtTokenDefaultDacl : PSCmdlet
39+
{
40+
private NtToken GetToken()
41+
{
42+
if (Token != null)
43+
return Token.Duplicate();
44+
return NtToken.OpenEffectiveToken(NtThread.Current, true, false, TokenAccessRights.AdjustDefault);
45+
}
46+
47+
/// <summary>
48+
/// <para type="description">Specify the default DACL.</para>
49+
/// </summary>
50+
[Parameter(ParameterSetName = "FromAcl", Position = 1, Mandatory = true)]
51+
[AllowEmptyCollection]
52+
public Acl DefaultDacl { get; set; }
53+
54+
/// <summary>
55+
/// <para type="description">Specify the default DACL as a Security Descriptor.</para>
56+
/// </summary>
57+
[Parameter(ParameterSetName = "FromSD", Position = 1, Mandatory = true)]
58+
public SecurityDescriptor SecurityDescriptor { get; set; }
59+
60+
/// <summary>
61+
/// <para type="description">Specify the token to set the default DACL.</para>
62+
/// </summary>
63+
[Parameter(Position = 1)]
64+
public NtToken Token { get; set; }
65+
66+
/// <summary>
67+
/// Overridden ProcessRecord method.
68+
/// </summary>
69+
protected override void ProcessRecord()
70+
{
71+
72+
Acl default_dacl = null;
73+
74+
switch (ParameterSetName)
75+
{
76+
case "FromAcl":
77+
default_dacl = DefaultDacl;
78+
break;
79+
case "FromSD":
80+
default_dacl = SecurityDescriptor.Dacl;
81+
break;
82+
}
83+
84+
if (default_dacl == null)
85+
{
86+
throw new ArgumentNullException(nameof(DefaultDacl));
87+
}
88+
89+
using (var token = GetToken())
90+
{
91+
token.SetDefaultDacl(default_dacl);
92+
}
93+
}
94+
}
95+
}

‎NtObjectManager/NtObjectManager.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@
9797
<Compile Include="Cmdlets\Object\GetNtSymbolicLinkCmdlet.cs" />
9898
<Compile Include="Cmdlets\Object\GetNtSymbolicLinkTargetCmdlet.cs" />
9999
<Compile Include="Cmdlets\Object\GetNtTokenCmdlet.cs" />
100+
<Compile Include="Cmdlets\Object\GetNtTokenDefaultDacl.cs" />
100101
<Compile Include="Cmdlets\Object\GetNtTransactionCmdlet.cs" />
101102
<Compile Include="Cmdlets\Object\GetNtTransactionManagerCmdlet.cs" />
102103
<Compile Include="Cmdlets\Object\GetNtWaitTimeoutCmdlet.cs" />
@@ -141,6 +142,7 @@
141142
<Compile Include="Cmdlets\Object\SetNtFileReparsePointCmdlet.cs" />
142143
<Compile Include="Cmdlets\Object\SetNtProcessJobCmdlet.cs" />
143144
<Compile Include="Cmdlets\Object\SetNtTokenCmdlet.cs" />
145+
<Compile Include="Cmdlets\Object\SetNtTokenDefaultDacl.cs" />
144146
<Compile Include="Cmdlets\Object\SpecificAccessType.cs" />
145147
<Compile Include="Cmdlets\Object\StartNtDebugWaitCmdlet.cs" />
146148
<Compile Include="Cmdlets\Object\CompareNtSidCmdlet.cs" />

‎NtObjectManager/NtObjectManager.psd1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,8 @@ CmdletsToExport = 'Add-NtKeyHive', 'Get-NtDirectory', 'Get-NtEvent', 'Get-NtFile
133133
'Test-NtTokenGroup', 'Test-NtAccessMask', 'Grant-NtAccessMask',
134134
'Revoke-NtAccessMask', 'Select-NtSecurityDescriptorAce', 'Write-NtAudit',
135135
'New-AuthZResourceManager', 'New-AuthZContext', 'Get-AuthZGrantedAccess',
136-
'Add-AuthZSid', 'Remove-AuthZSid', 'Set-NtToken'
136+
'Add-AuthZSid', 'Remove-AuthZSid', 'Set-NtToken', 'Get-NtTokenDefaultDacl',
137+
'Set-NtTokenDefaultDacl'
137138

138139
# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
139140
AliasesToExport = @()

0 commit comments

Comments
 (0)