Skip to content

Commit a1af056

Browse files
tyranidtyranid
committed
General cleanups.
1 parent 12ab93e commit a1af056

13 files changed

Lines changed: 438 additions & 316 deletions

‎NtObjectManager/Cmdlets/Accessible/DeviceAccessCheckResult.cs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Copyright 2017 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet;
16+
17+
namespace NtObjectManager.Cmdlets.Accessible
18+
{
19+
/// <summary>
20+
/// <para type="description">Access check result for a device.</para>
21+
/// </summary>
22+
public class DeviceAccessCheckResult : CommonAccessCheckResult
23+
{
24+
/// <summary>
25+
/// Indicates this was a namespace open
26+
/// </summary>
27+
public bool NamespacePath { get; }
28+
29+
/// <summary>
30+
/// Indicates the type of device.
31+
/// </summary>
32+
public FileDeviceType DeviceType { get; }
33+
34+
/// <summary>
35+
/// Indicates the device characteristics.
36+
/// </summary>
37+
public FileDeviceCharacteristics Characteristics { get; }
38+
39+
internal DeviceAccessCheckResult(string name, bool namespace_path, FileDeviceType device_type, FileDeviceCharacteristics device_chars,
40+
AccessMask granted_access, SecurityDescriptor sd, TokenInformation token_info) : base(name, "Device",
41+
granted_access, NtType.GetTypeByType<NtFile>().GenericMapping, sd, typeof(FileAccessRights), true, token_info)
42+
{
43+
NamespacePath = namespace_path;
44+
DeviceType = device_type;
45+
Characteristics = device_chars;
46+
}
47+
}
48+
}

‎NtObjectManager/Cmdlets/Accessible/EventTraceAccessCheckResult.cs‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet;
16+
using NtApiDotNet.Win32;
17+
using System;
18+
19+
namespace NtObjectManager.Cmdlets.Accessible
20+
{
21+
/// <summary>
22+
/// <para type="description">Access check result for an event trace.</para>
23+
/// </summary>
24+
public class EventTraceAccessCheckResult : CommonAccessCheckResult
25+
{
26+
/// <summary>
27+
/// The ID of the event trace provider.
28+
/// </summary>
29+
public Guid Id => Provider.Id;
30+
31+
/// <summary>
32+
/// The source of the event trace provider.
33+
/// </summary>
34+
public EventTraceProviderSource Source => Provider.Source;
35+
36+
/// <summary>
37+
/// The event trace provider.
38+
/// </summary>
39+
public EventTraceProvider Provider { get; }
40+
41+
internal EventTraceAccessCheckResult(EventTraceProvider provider,
42+
NtType type, AccessMask granted_access,
43+
SecurityDescriptor sd, TokenInformation token_info)
44+
: base(string.IsNullOrEmpty(provider.Name) ? provider.Id.ToString() : provider.Name,
45+
type.Name, granted_access,
46+
type.GenericMapping, sd,
47+
type.AccessRightsType, false, token_info)
48+
{
49+
Provider = provider;
50+
}
51+
}
52+
}

‎NtObjectManager/Cmdlets/Accessible/GetAccessibleDeviceCmdlet.cs‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,36 +19,6 @@
1919

2020
namespace NtObjectManager.Cmdlets.Accessible
2121
{
22-
/// <summary>
23-
/// <para type="description">Access check result for a device.</para>
24-
/// </summary>
25-
public class DeviceAccessCheckResult : CommonAccessCheckResult
26-
{
27-
/// <summary>
28-
/// Indicates this was a namespace open
29-
/// </summary>
30-
public bool NamespacePath { get; }
31-
32-
/// <summary>
33-
/// Indicates the type of device.
34-
/// </summary>
35-
public FileDeviceType DeviceType { get; }
36-
37-
/// <summary>
38-
/// Indicates the device characteristics.
39-
/// </summary>
40-
public FileDeviceCharacteristics Characteristics { get; }
41-
42-
internal DeviceAccessCheckResult(string name, bool namespace_path, FileDeviceType device_type, FileDeviceCharacteristics device_chars,
43-
AccessMask granted_access, SecurityDescriptor sd, TokenInformation token_info) : base(name, "Device",
44-
granted_access, NtType.GetTypeByType<NtFile>().GenericMapping, sd, typeof(FileAccessRights), true, token_info)
45-
{
46-
NamespacePath = namespace_path;
47-
DeviceType = device_type;
48-
Characteristics = device_chars;
49-
}
50-
}
51-
5222
/// <summary>
5323
/// <para type="description">Mode for checking device object.</para>
5424
/// </summary>

‎NtObjectManager/Cmdlets/Accessible/GetAccessibleEventTraceCmdlet.cs‎

Lines changed: 96 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -1,130 +1,98 @@
1-
// Copyright 2020 Google Inc. All Rights Reserved.
2-
//
3-
// Licensed under the Apache License, Version 2.0 (the "License");
4-
// you may not use this file except in compliance with the License.
5-
// You may obtain a copy of the License at
6-
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
8-
//
9-
// Unless required by applicable law or agreed to in writing, software
10-
// distributed under the License is distributed on an "AS IS" BASIS,
11-
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
// See the License for the specific language governing permissions and
13-
// limitations under the License.
14-
15-
using NtApiDotNet;
16-
using NtApiDotNet.Win32;
17-
using System;
18-
using System.Collections.Generic;
19-
using System.Linq;
20-
using System.Management.Automation;
21-
22-
namespace NtObjectManager.Cmdlets.Accessible
23-
{
24-
/// <summary>
25-
/// <para type="description">Access check result for an event trace.</para>
26-
/// </summary>
27-
public class EventTraceAccessCheckResult : CommonAccessCheckResult
28-
{
29-
/// <summary>
30-
/// The ID of the event trace provider.
31-
/// </summary>
32-
public Guid Id => Provider.Id;
33-
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet;
16+
using NtApiDotNet.Win32;
17+
using System;
18+
using System.Collections.Generic;
19+
using System.Linq;
20+
using System.Management.Automation;
21+
22+
namespace NtObjectManager.Cmdlets.Accessible
23+
{
24+
/// <summary>
25+
/// <para type="synopsis">Get a list of ETW providers accessible by a specified token.</para>
26+
/// <para type="description">This cmdlet checks all ETW providers and tries to determine
27+
/// if one or more specified tokens can access them. If no tokens are specified then the
28+
/// current process token is used.</para>
29+
/// </summary>
30+
/// <remarks>This will only work if run as an administrator.</remarks>
31+
/// <example>
32+
/// <code>Get-AccessibleEventTrace</code>
33+
/// <para>Check all accessible ETW providers for the current process token.</para>
34+
/// </example>
35+
/// <example>
36+
/// <code>Get-AccessibleEventTrace -ProcessIds 1234,5678</code>
37+
/// <para>>Check all accessible ETW providers for the process tokens of PIDs 1234 and 5678</para>
38+
/// </example>
39+
/// <example>
40+
/// <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low&#x0A;Get-AccessibleEventTrace -Tokens $token</code>
41+
/// <para>Get all ETW providers which can be accessed by a low integrity copy of current token.</para>
42+
/// </example>
43+
[Cmdlet(VerbsCommon.Get, "AccessibleEventTrace", DefaultParameterSetName = "All")]
44+
[OutputType(typeof(CommonAccessCheckResult))]
45+
public class GetAccessibleEventTraceCmdlet : CommonAccessBaseWithAccessCmdlet<TraceAccessRights>
46+
{
3447
/// <summary>
35-
/// The source of the event trace provider.
36-
/// </summary>
37-
public EventTraceProviderSource Source => Provider.Source;
38-
48+
/// <para type="description">Specify list of ETW provider GUID to check.</para>
49+
/// </summary>
50+
[Parameter(ParameterSetName = "FromId")]
51+
public Guid[] ProviderId { get; set; }
52+
3953
/// <summary>
40-
/// The event trace provider.
41-
/// </summary>
42-
public EventTraceProvider Provider { get; }
43-
44-
internal EventTraceAccessCheckResult(EventTraceProvider provider,
45-
NtType type, AccessMask granted_access,
46-
SecurityDescriptor sd, TokenInformation token_info)
47-
: base(string.IsNullOrEmpty(provider.Name) ? provider.Id.ToString() : provider.Name,
48-
type.Name, granted_access,
49-
type.GenericMapping, sd,
50-
type.AccessRightsType, false, token_info)
51-
{
52-
Provider = provider;
53-
}
54-
}
55-
56-
/// <summary>
57-
/// <para type="synopsis">Get a list of ETW providers accessible by a specified token.</para>
58-
/// <para type="description">This cmdlet checks all ETW providers and tries to determine
59-
/// if one or more specified tokens can access them. If no tokens are specified then the
60-
/// current process token is used.</para>
61-
/// </summary>
62-
/// <remarks>This will only work if run as an administrator.</remarks>
63-
/// <example>
64-
/// <code>Get-AccessibleEventTrace</code>
65-
/// <para>Check all accessible ETW providers for the current process token.</para>
66-
/// </example>
67-
/// <example>
68-
/// <code>Get-AccessibleEventTrace -ProcessIds 1234,5678</code>
69-
/// <para>>Check all accessible ETW providers for the process tokens of PIDs 1234 and 5678</para>
70-
/// </example>
71-
/// <example>
72-
/// <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low&#x0A;Get-AccessibleEventTrace -Tokens $token</code>
73-
/// <para>Get all ETW providers which can be accessed by a low integrity copy of current token.</para>
74-
/// </example>
75-
[Cmdlet(VerbsCommon.Get, "AccessibleEventTrace", DefaultParameterSetName = "All")]
76-
[OutputType(typeof(CommonAccessCheckResult))]
77-
public class GetAccessibleEventTraceCmdlet : CommonAccessBaseWithAccessCmdlet<TraceAccessRights>
78-
{
79-
/// <summary>
80-
/// <para type="description">Specify list of ETW provider GUID to check.</para>
81-
/// </summary>
82-
[Parameter(ParameterSetName = "FromId")]
83-
public Guid[] ProviderId { get; set; }
84-
85-
/// <summary>
86-
/// <para type="description">Specify list of ETW provider names to check.</para>
87-
/// </summary>
88-
[Parameter(ParameterSetName = "FromName")]
89-
public string[] Name { get; set; }
90-
91-
private protected override void RunAccessCheck(IEnumerable<TokenEntry> tokens)
92-
{
93-
NtType type = NtType.GetTypeByType<NtEtwRegistration>();
94-
AccessMask access_rights = type.GenericMapping.MapMask(Access);
95-
var providers = EventTracing.GetProviders();
96-
97-
if (ProviderId != null && ProviderId.Length > 0)
98-
{
99-
HashSet<Guid> guids = new HashSet<Guid>(ProviderId);
100-
providers = providers.Where(p => guids.Contains(p.Id));
101-
}
102-
else if (Name != null && Name.Length > 0)
103-
{
104-
var names = new HashSet<string>(Name, StringComparer.OrdinalIgnoreCase);
105-
providers = providers.Where(p => names.Contains(p.Name));
106-
}
107-
108-
foreach (var provider in providers)
109-
{
110-
var sd = provider.SecurityDescriptor;
111-
if (sd == null)
112-
{
113-
WriteWarning($"Couldn't query security for ETW Provider {provider.Name}. Perhaps run as administrator.");
114-
continue;
115-
}
116-
117-
foreach (TokenEntry token in tokens)
118-
{
119-
AccessMask granted_access = NtSecurity.GetMaximumAccess(sd,
120-
token.Token, type.GenericMapping);
121-
if (IsAccessGranted(granted_access, access_rights))
122-
{
123-
WriteObject(new EventTraceAccessCheckResult(provider, type,
124-
granted_access, sd, token.Information));
125-
}
126-
}
127-
}
128-
}
129-
}
130-
}
54+
/// <para type="description">Specify list of ETW provider names to check.</para>
55+
/// </summary>
56+
[Parameter(ParameterSetName = "FromName")]
57+
public string[] Name { get; set; }
58+
59+
private protected override void RunAccessCheck(IEnumerable<TokenEntry> tokens)
60+
{
61+
NtType type = NtType.GetTypeByType<NtEtwRegistration>();
62+
AccessMask access_rights = type.GenericMapping.MapMask(Access);
63+
var providers = EventTracing.GetProviders();
64+
65+
if (ProviderId != null && ProviderId.Length > 0)
66+
{
67+
HashSet<Guid> guids = new HashSet<Guid>(ProviderId);
68+
providers = providers.Where(p => guids.Contains(p.Id));
69+
}
70+
else if (Name != null && Name.Length > 0)
71+
{
72+
var names = new HashSet<string>(Name, StringComparer.OrdinalIgnoreCase);
73+
providers = providers.Where(p => names.Contains(p.Name));
74+
}
75+
76+
foreach (var provider in providers)
77+
{
78+
var sd = provider.SecurityDescriptor;
79+
if (sd == null)
80+
{
81+
WriteWarning($"Couldn't query security for ETW Provider {provider.Name}. Perhaps run as administrator.");
82+
continue;
83+
}
84+
85+
foreach (TokenEntry token in tokens)
86+
{
87+
AccessMask granted_access = NtSecurity.GetMaximumAccess(sd,
88+
token.Token, type.GenericMapping);
89+
if (IsAccessGranted(granted_access, access_rights))
90+
{
91+
WriteObject(new EventTraceAccessCheckResult(provider, type,
92+
granted_access, sd, token.Information));
93+
}
94+
}
95+
}
96+
}
97+
}
98+
}

0 commit comments

Comments
 (0)