Make CheckFiles specifically to find writable files and also added checking on the parent directory.

Author: tyranid

NtObjectManager/Cmdlets/Accessible/GetAccessibleServiceCmdlet.cs

@@ -253,6 +253,12 @@ private ServiceAccessRights GetTriggerAccess(Win32Service service, NtToken token
         [Parameter(ParameterSetName = "CheckScm")]
         public SwitchParameter CheckScmAccess { get; set; }
 
+        /// <summary>
+        /// <para type="description">Specify access mask for access to the SCM.</para>
+        /// </summary>
+        [Parameter(ParameterSetName = "CheckScm")]
+        public ServiceControlManagerAccessRights ScmAccess { get; set; }
+
         /// <summary>
         /// <para type="description">Check mode for accessible services.</para>
         /// </summary>
@@ -267,7 +273,7 @@ private ServiceAccessRights GetTriggerAccess(Win32Service service, NtToken token
         public SwitchParameter IgnoreTrigger { get; set; }
 
         /// <summary>
-        /// <para type="description">Generate access check results for the service files.</para>
+        /// <para type="description">Check for writable service files and directories.</para>
         /// </summary>
         [Parameter(ParameterSetName = "All")]
         [Parameter(ParameterSetName = "FromName")]
@@ -279,11 +285,15 @@ private protected override void RunAccessCheck(IEnumerable<TokenEntry> tokens)
             {
                 SecurityDescriptor sd = ServiceUtils.GetScmSecurityDescriptor();
                 GenericMapping scm_mapping = ServiceUtils.GetScmGenericMapping();
+                AccessMask access_rights = scm_mapping.MapMask(ScmAccess);
                 foreach (TokenEntry token in tokens)
                 {
                     AccessMask granted_access = NtSecurity.GetMaximumAccess(sd, token.Token, scm_mapping);
-                    WriteAccessCheckResult("SCM", "SCM", granted_access, scm_mapping, sd,
+                    if (IsAccessGranted(granted_access, access_rights))
+                    {
+                        WriteAccessCheckResult("SCM", "SCM", granted_access, scm_mapping, sd,
                         typeof(ServiceControlManagerAccessRights), false, token.Information);
+                    }
                 }
             }
             else
@@ -295,7 +305,10 @@ private protected override void RunAccessCheck(IEnumerable<TokenEntry> tokens)
                 {
                     file_cmdlet = new InternalGetAccessibleFileCmdlet(this)
                     {
-                        FormatWin32Path = true
+                        FormatWin32Path = true,
+                        Access = FileAccessRights.WriteData | FileAccessRights.WriteDac | FileAccessRights.WriteOwner | FileAccessRights.AppendData | FileAccessRights.Delete,
+                        DirectoryAccess = FileDirectoryAccessRights.AddFile | FileDirectoryAccessRights.WriteDac | FileDirectoryAccessRights.WriteOwner,
+                        AllowPartialAccess = true
                     };
                 }
 
@@ -323,13 +336,15 @@ private protected override void RunAccessCheck(IEnumerable<TokenEntry> tokens)
                             && checked_files.Add(service.ImagePath))
                         {
                             file_cmdlet.RunAccessCheckPathInternal(tokens, service.ImagePath);
+                            file_cmdlet.RunAccessCheckPathInternal(tokens, Path.GetDirectoryName(service.ImagePath));
                         }
 
                         if (!string.IsNullOrWhiteSpace(service.ServiceDll) 
                             && File.Exists(service.ServiceDll) 
                             && checked_files.Add(service.ServiceDll))
                         {
                             file_cmdlet.RunAccessCheckPathInternal(tokens, service.ServiceDll);
+                            file_cmdlet.RunAccessCheckPathInternal(tokens, Path.GetDirectoryName(service.ServiceDll));
                         }
                     }
                 }