Skip to content

Commit ae929c2

Browse files
tyranidtyranid
committed
Added Device Info parser.
1 parent d970ccf commit ae929c2

5 files changed

Lines changed: 143 additions & 5 deletions

File tree

‎NtApiDotNet/NtApiDotNet.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,7 @@
324324
<Compile Include="Win32\Security\Authentication\ASN1AuthenticationToken.cs" />
325325
<Compile Include="Win32\Security\Authentication\GSSAPIUtils.cs" />
326326
<Compile Include="Win32\Security\Authentication\Kerberos\KerberosAPReplyEncryptedPart.cs" />
327+
<Compile Include="Win32\Security\Authentication\Kerberos\KerberosAuthorizationDataPACDevice.cs" />
327328
<Compile Include="Win32\Security\Authentication\Kerberos\KerberosAuthorizationDataPACLogon.cs" />
328329
<Compile Include="Win32\Security\Authentication\Kerberos\KerberosAuthorizationDataPACSignature.cs" />
329330
<Compile Include="Win32\Security\Authentication\Kerberos\KerberosAuthorizationDataPACClientInfo.cs" />

‎NtApiDotNet/Win32/Security/Authentication/Kerberos/KerberosAuthorizationDataPAC.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,10 @@ internal static bool Parse(byte[] data, out KerberosAuthorizationDataPAC auth_da
101101
if (!KerberosAuthorizationDataPACLogon.Parse(entry_type, entry_data, out pac_entry))
102102
pac_entry = null;
103103
break;
104+
case KerberosAuthorizationDataPACEntryType.Device:
105+
if (!KerberosAuthorizationDataPACDevice.Parse(entry_data, out pac_entry))
106+
pac_entry = null;
107+
break;
104108
}
105109

106110
if (pac_entry == null)

‎NtApiDotNet/Win32/Security/Authentication/Kerberos/KerberosAuthorizationDataPACDevice.cs‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
// Copyright 2020 Google Inc. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using NtApiDotNet.Ndr.Marshal;
16+
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Ndr;
17+
using System.Collections.Generic;
18+
using System.Linq;
19+
using System.Text;
20+
21+
namespace NtApiDotNet.Win32.Security.Authentication.Kerberos
22+
{
23+
/// <summary>
24+
/// Class to represent PAC Device Info.
25+
/// </summary>
26+
public class KerberosAuthorizationDataPACDevice : KerberosAuthorizationDataPACEntry
27+
{
28+
/// <summary>
29+
/// Sid of the Device.
30+
/// </summary>
31+
public Sid DeviceId { get; }
32+
/// <summary>
33+
/// Primary group SID.
34+
/// </summary>
35+
public Sid PrimaryGroupId { get; }
36+
/// <summary>
37+
/// List of account groups.
38+
/// </summary>
39+
public IReadOnlyList<UserGroup> AccountGroups { get; }
40+
/// <summary>
41+
/// List of extra SIDs.
42+
/// </summary>
43+
public IReadOnlyList<UserGroup> ExtraSids { get; }
44+
/// <summary>
45+
/// List of domain groups.
46+
/// </summary>
47+
public IReadOnlyList<UserGroup> DomainGroups { get; }
48+
49+
private KerberosAuthorizationDataPACDevice(byte[] data, PAC_DEVICE_INFO device_info)
50+
: base(KerberosAuthorizationDataPACEntryType.Device, data)
51+
{
52+
Sid account_domain_sid = device_info.AccountDomainId.GetValue().ToSid();
53+
DeviceId = account_domain_sid.CreateRelative((uint)device_info.UserId);
54+
PrimaryGroupId = account_domain_sid.CreateRelative((uint)device_info.PrimaryGroupId);
55+
List <UserGroup> groups = new List<UserGroup>();
56+
if (device_info.AccountGroupIds != null)
57+
{
58+
groups.AddRange(device_info.AccountGroupIds.GetValue()
59+
.Select(g => new UserGroup(account_domain_sid.CreateRelative((uint)g.RelativeId), (GroupAttributes)g.Attributes)));
60+
}
61+
AccountGroups = groups.AsReadOnly();
62+
63+
groups = new List<UserGroup>();
64+
if (device_info.ExtraSids != null)
65+
{
66+
groups.AddRange(device_info.ExtraSids.GetValue()
67+
.Select(g => new UserGroup(g.Sid.GetValue().ToSid(), (GroupAttributes)g.Attributes)));
68+
}
69+
ExtraSids = groups.AsReadOnly();
70+
71+
groups = new List<UserGroup>();
72+
if (device_info.DomainGroup != null)
73+
{
74+
foreach (var group in device_info.DomainGroup.GetValue())
75+
{
76+
if (group.GroupIds != null)
77+
{
78+
Sid group_sid = group.DomainId.GetValue().ToSid();
79+
groups.AddRange(group.GroupIds.GetValue()
80+
.Select(g => new UserGroup(group_sid.CreateRelative((uint)g.RelativeId), (GroupAttributes)g.Attributes)));
81+
}
82+
}
83+
}
84+
DomainGroups = groups.AsReadOnly();
85+
}
86+
87+
internal static bool Parse(byte[] data, out KerberosAuthorizationDataPACEntry entry)
88+
{
89+
entry = null;
90+
try
91+
{
92+
var info = PacDeviceInfoParser.Decode(new NdrPickledType(data));
93+
if (!info.HasValue)
94+
return false;
95+
96+
entry = new KerberosAuthorizationDataPACDevice(data, info.Value);
97+
return true;
98+
}
99+
catch
100+
{
101+
return false;
102+
}
103+
}
104+
105+
private protected override void FormatData(StringBuilder builder)
106+
{
107+
builder.AppendLine($"Device Name : {DeviceId.Name}");
108+
builder.AppendLine($"Primary Group : {PrimaryGroupId.Name}");
109+
110+
if (AccountGroups.Count > 0)
111+
{
112+
builder.AppendLine("<Groups>");
113+
foreach (var g in AccountGroups)
114+
{
115+
builder.AppendLine($"{g.Sid.Name,-30} - {g.Attributes}");
116+
}
117+
}
118+
119+
if (DomainGroups.Count > 0)
120+
{
121+
builder.AppendLine("<Domain Groups>");
122+
foreach (var g in DomainGroups)
123+
{
124+
builder.AppendLine($"{g.Sid.Name,-30} - {g.Attributes}");
125+
}
126+
}
127+
128+
if (ExtraSids.Count > 0)
129+
{
130+
builder.AppendLine("<Extra Groups>");
131+
foreach (var g in ExtraSids)
132+
{
133+
builder.AppendLine($"{g.Sid.Name,-30} - {g.Attributes}");
134+
}
135+
}
136+
}
137+
}
138+
}

‎NtApiDotNet/Win32/Security/Authentication/Kerberos/KerberosAuthorizationDataPACLogon.cs‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,8 @@
1616
using NtApiDotNet.Win32.Security.Authentication.Kerberos.Ndr;
1717
using System;
1818
using System.Collections.Generic;
19-
using System.Drawing;
2019
using System.Linq;
2120
using System.Text;
22-
using System.Threading.Tasks;
2321

2422
namespace NtApiDotNet.Win32.Security.Authentication.Kerberos
2523
{
@@ -287,7 +285,6 @@ private protected override void FormatData(StringBuilder builder)
287285
builder.AppendLine($"User SID : {User}");
288286
builder.AppendLine($"Primary Group : {PrimaryGroup.Name}");
289287
builder.AppendLine($"Primary Group SID: {PrimaryGroup}");
290-
291288

292289
if (Groups.Count > 0)
293290
{
@@ -298,8 +295,6 @@ private protected override void FormatData(StringBuilder builder)
298295
}
299296
}
300297

301-
302-
303298
if (ResourceGroups.Count > 0 || ResourceGroupDomainSid != null)
304299
{
305300
builder.AppendLine("<Resource Groups>");

‎NtApiDotNet/Win32/Security/Authentication/Kerberos/Ndr/PacDeviceInfoParser.cs‎

20.6 KB
Binary file not shown.

0 commit comments

Comments
 (0)