+# ---------------------------------------------------------------------------\r
+# User rights assignment (LSA account rights)\r
+#\r
+# Windows has no built-in cmdlet for "grant this SID this privilege". The two\r
+# ways to script it are secedit (export the whole USER_RIGHTS area to an INF,\r
+# edit one line, re-import) and the LSA API. The API is used here because it is\r
+# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is\r
+# a no-op when it is already held, where a secedit round-trip re-applies every\r
+# user right on the box to fix one of them. The GUI equivalent, for a human, is\r
+# secpol.msc > Local Policies > User Rights Assignment\r
+#\r
+# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's\r
+# Add-Type compiles with the in-box CodeDom compiler.\r
+# ---------------------------------------------------------------------------\r
+function Initialize-LsaRightsType {\r
+ if ('LsaRights' -as [type]) { return }\r
+ Add-Type -TypeDefinition @'\r
+using System;\r
+using System.ComponentModel;\r
+using System.Runtime.InteropServices;\r
+\r
+public static class LsaRights\r
+{\r
+ [StructLayout(LayoutKind.Sequential)]\r
+ private struct LSA_UNICODE_STRING\r
+ {\r
+ public ushort Length;\r
+ public ushort MaximumLength;\r
+ public IntPtr Buffer;\r
+ }\r
+\r
+ [StructLayout(LayoutKind.Sequential)]\r
+ private struct LSA_OBJECT_ATTRIBUTES\r
+ {\r
+ public int Length;\r
+ public IntPtr RootDirectory;\r
+ public IntPtr ObjectName;\r
+ public uint Attributes;\r
+ public IntPtr SecurityDescriptor;\r
+ public IntPtr SecurityQualityOfService;\r
+ }\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaOpenPolicy(IntPtr systemName,\r
+ ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle);\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid,\r
+ LSA_UNICODE_STRING[] userRights, uint countOfRights);\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid,\r
+ out IntPtr userRights, out uint countOfRights);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern uint LsaClose(IntPtr policyHandle);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern uint LsaFreeMemory(IntPtr buffer);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern int LsaNtStatusToWinError(uint status);\r
+\r
+ private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001;\r
+ private const uint POLICY_CREATE_ACCOUNT = 0x00000010;\r
+ private const uint POLICY_LOOKUP_NAMES = 0x00000800;\r
+\r
+ // Returned by LsaEnumerateAccountRights when the SID holds no rights at all,\r
+ // which is an empty list rather than an error.\r
+ private const uint STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034;\r
+\r
+ private static IntPtr OpenPolicy()\r
+ {\r
+ LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES();\r
+ attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));\r
+ IntPtr handle;\r
+ uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs,\r
+ POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle);\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ return handle;\r
+ }\r
+\r
+ public static string[] Get(byte[] sid)\r
+ {\r
+ IntPtr policy = OpenPolicy();\r
+ try\r
+ {\r
+ IntPtr rights;\r
+ uint count;\r
+ uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count);\r
+ if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; }\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ try\r
+ {\r
+ string[] result = new string[count];\r
+ int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING));\r
+ for (int i = 0; i < count; i++)\r
+ {\r
+ LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure(\r
+ new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING));\r
+ result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2);\r
+ }\r
+ return result;\r
+ }\r
+ finally { LsaFreeMemory(rights); }\r
+ }\r
+ finally { LsaClose(policy); }\r
+ }\r
+\r
+ public static void Add(byte[] sid, string right)\r
+ {\r
+ IntPtr policy = OpenPolicy();\r
+ try\r
+ {\r
+ LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1];\r
+ rights[0].Buffer = Marshal.StringToHGlobalUni(right);\r
+ // Length counts BYTES and excludes the terminator; MaximumLength includes it.\r
+ rights[0].Length = (ushort)(right.Length * 2);\r
+ rights[0].MaximumLength = (ushort)(right.Length * 2 + 2);\r
+ try\r
+ {\r
+ uint status = LsaAddAccountRights(policy, sid, rights, 1);\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ }\r
+ finally { Marshal.FreeHGlobal(rights[0].Buffer); }\r
+ }\r
+ finally { LsaClose(policy); }\r
+ }\r
+}\r
+'@\r
+}\r
+\r
+function Get-SidBytes([string]$Sid) {\r
+ $s = New-Object System.Security.Principal.SecurityIdentifier($Sid)\r
+ $bytes = New-Object byte[] $s.BinaryLength\r
+ $s.GetBinaryForm($bytes, 0)\r
+ return ,$bytes\r
+}\r
+\r
+function Get-AccountRight([string]$Sid) {\r
+ Initialize-LsaRightsType\r
+ return [LsaRights]::Get((Get-SidBytes $Sid))\r
+}\r
+\r
+function Grant-AccountRight([string]$Sid, [string]$Right) {\r
+ Initialize-LsaRightsType\r
+ [LsaRights]::Add((Get-SidBytes $Sid), $Right)\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# ETW provider-GUID access control\r
+#\r
+# ETW keeps a security descriptor per provider GUID under\r
+# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, and EventAccessControl is\r
+# the documented way to edit one. Editing the registry value directly would work\r
+# too - it is a self-relative SD in a REG_BINARY - but the API takes the SID and\r
+# the rights mask and leaves the descriptor's shape to Windows.\r
+# ---------------------------------------------------------------------------\r
+function Initialize-EtwAclType {\r
+ if ('EtwAcl' -as [type]) { return }\r
+ Add-Type -TypeDefinition @'\r
+using System;\r
+using System.Runtime.InteropServices;\r
+\r
+public static class EtwAcl\r
+{\r
+ // ULONG EventAccessControl(LPGUID, ULONG Operation, PSID, ULONG Rights, BOOLEAN AllowOrDeny)\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ public static extern uint EventAccessControl(ref Guid guid, uint operation, byte[] sid,\r
+ uint rights, [MarshalAs(UnmanagedType.U1)] bool allowOrDeny);\r
+\r
+ // ULONG EventAccessQuery(LPGUID, PSECURITY_DESCRIPTOR, PULONG BufferSize)\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ public static extern uint EventAccessQuery(ref Guid guid, byte[] buffer, ref uint bufferSize);\r
+}\r
+'@\r
+}\r
+\r
+# The rights a session controller needs, from evntrace.h:\r
+# 0x0001 WMIGUID_QUERY 0x0100 TRACELOG_ACCESS_KERNEL_LOGGER\r
+# 0x0020 TRACELOG_CREATE_REALTIME 0x0200 TRACELOG_LOG_EVENT\r
+# 0x0040 TRACELOG_CREATE_ONDISK 0x0400 TRACELOG_ACCESS_REALTIME\r
+# 0x0080 TRACELOG_GUID_ENABLE 0x0800 TRACELOG_REGISTER_GUIDS\r
+# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger\r
+# specifically; the rest are what any controller needs to create a session,\r
+# write it to disk and enable providers on it.\r
+#\r
+# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and\r
+# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the\r
+# group cannot read the descriptor back, which makes EventAccessQuery useless as\r
+# a check on whether the grant landed: it answers "access denied" either way.\r
+$EtwControllerRights = 0x120FE1\r
+\r
+function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {\r
+ Initialize-EtwAclType\r
+ $g = [Guid]$Guid\r
+ # Operation 2 = EventSecurityAddDACL: add one ACE and leave every existing\r
+ # one in place. EventSecuritySetDACL (0) would REPLACE the descriptor, which\r
+ # on the kernel logger means removing the entries Windows itself relies on.\r
+ $rc = [EtwAcl]::EventAccessControl([ref]$g, 2, (Get-SidBytes $Sid), $Rights, $true)\r
+ if ($rc -ne 0) { throw (New-Object System.ComponentModel.Win32Exception([int]$rc)) }\r
+}\r
+\r
+function Get-EtwGuidSddl([string]$Guid) {\r
+ Initialize-EtwAclType\r
+ $g = [Guid]$Guid\r
+ $size = [uint32]0\r
+ [void][EtwAcl]::EventAccessQuery([ref]$g, $null, [ref]$size)\r
+ if ($size -eq 0) { return $null }\r
+ $buf = New-Object byte[] $size\r
+ if ([EtwAcl]::EventAccessQuery([ref]$g, $buf, [ref]$size) -ne 0) { return $null }\r
+ return (New-Object System.Security.AccessControl.RawSecurityDescriptor($buf, 0)).GetSddlForm('Access')\r
+}\r
+\r
vilimpoc.org / repos / dotfiles / blobdiff