rtsetsec.c File Reference

#include "cmp.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

Go to the source code of this file.

Functions
PSID	GetMySid (VOID)
PSECURITY_DESCRIPTOR	GenerateDescriptor (VOID)
void __cdecl	main (int argc, char *argv[])

---

Function Documentation

PSECURITY_DESCRIPTOR GenerateDescriptor (  VOID   )

Definition at line 122 of file rtsetsec.c. References CreatorSid, exit, FALSE, GetMySid(), NT_SUCCESS, NTSTATUS(), NULL, RtlAddAce(), RtlCopySid(), RtlCreateAcl(), RtlCreateSecurityDescriptor(), RtlInitializeSid(), RtlLengthRequiredSid(), RtlSetDaclSecurityDescriptor(), RtlSubAuthoritySid(), RtlValidSid(), SeLengthSid, Status, TRUE, USHORT, and WorldSid. Referenced by main(). { PSECURITY_DESCRIPTOR SecurityDescriptor; PACL Acl; PSID WorldSid, CreatorSid; SID_IDENTIFIER_AUTHORITY WorldAuthority = SECURITY_WORLD_SID_AUTHORITY; ULONG OwnerAceLength, WorldAceLength; ULONG AclLength; NTSTATUS Status; PACCESS_ALLOWED_ACE OwnerAce; PACCESS_ALLOWED_ACE WorldAce; WorldSid = malloc(RtlLengthRequiredSid(1)); if (WorldSid == NULL) { printf("rtsetsec: GenerateDescriptor() couldn't malloc WorldSID\n"); exit(1); } RtlInitializeSid(WorldSid, &WorldAuthority, 1); *(RtlSubAuthoritySid(WorldSid, 0)) = SECURITY_WORLD_RID; if (!RtlValidSid(WorldSid)) { printf("rtsetsec: GenerateDescriptor() created invalid World SID\n"); exit(1); } CreatorSid = GetMySid(); // // Since the ACCESS_DENIED_ACE already contains a ULONG for the // SID, we subtract this back out when calculating the size of the ACE // WorldAceLength = SeLengthSid(WorldSid) - sizeof(ULONG) + sizeof(ACCESS_ALLOWED_ACE) ; WorldAce = malloc(WorldAceLength); if (WorldAce == NULL) { printf("rtsetsec: GenerateDescriptor() couldn't malloc WorldAce\n"); exit(1); } OwnerAceLength = SeLengthSid(CreatorSid) - sizeof(ULONG) + sizeof(ACCESS_ALLOWED_ACE); OwnerAce = malloc( OwnerAceLength ); if (OwnerAce == NULL) { printf("rtsetsec: GenerateDescriptor() couldn't malloc OwnerAce\n"); exit(1); } AclLength = OwnerAceLength + WorldAceLength + sizeof(ACL); Acl = malloc(AclLength); if (Acl == NULL) { printf("rtsetsec: GenerateDescriptor() couldn't malloc ACL\n"); exit(1); } Status = RtlCreateAcl(Acl, AclLength, ACL_REVISION); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlCreateAcl failed status %08lx\n", Status); exit(1); } // // Fill in ACE fields // WorldAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE; WorldAce->Header.AceSize = (USHORT)WorldAceLength; WorldAce->Header.AceFlags = 0; // clear audit and inherit flags WorldAce->Mask = KEY_READ; Status = RtlCopySid( SeLengthSid(WorldSid), &WorldAce->SidStart, WorldSid ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlCopySid failed status %08lx\n", Status); exit(1); } OwnerAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE; OwnerAce->Header.AceSize = (USHORT)OwnerAceLength; OwnerAce->Header.AceFlags = 0; // clear audit and inherit flags OwnerAce->Mask = KEY_ALL_ACCESS; Status = RtlCopySid( SeLengthSid(CreatorSid), &OwnerAce->SidStart, CreatorSid ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlCopySid failed status %08lx\n", Status); exit(1); } free(WorldSid); // // Now add the ACE to the beginning of the ACL. // Status = RtlAddAce( Acl, ACL_REVISION, 0, WorldAce, WorldAceLength ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlAddAce (world ace) failed status %08lx\n", Status); exit(1); } Status = RtlAddAce( Acl, ACL_REVISION, 0, OwnerAce, OwnerAceLength ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlAddAce (owner ace) failed status %08lx\n", Status); exit(1); } free(OwnerAce); free(WorldAce); // // Allocate and initialize the Security Descriptor // SecurityDescriptor = malloc(sizeof(SECURITY_DESCRIPTOR)); Status = RtlCreateSecurityDescriptor( SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlCreateSecurityDescriptor failed status %08lx\n",Status); exit(1); } Status = RtlSetDaclSecurityDescriptor( SecurityDescriptor, TRUE, Acl, FALSE ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: RtlSetDaclSecurityDescriptor failed status %08lx\n",Status); exit(1); } // // FINALLY we are finished! // return(SecurityDescriptor); }

PSID GetMySid (  VOID   )

Definition at line 273 of file rtsetsec.c. References exit, NT_SUCCESS, NtClose(), NtOpenProcessToken(), NtQueryInformationToken(), NTSTATUS(), NULL, Owner, Status, and Token. Referenced by GenerateDescriptor(). { NTSTATUS Status; HANDLE Token; PTOKEN_OWNER Owner; ULONG Length; Status = NtOpenProcessToken( NtCurrentProcess(), TOKEN_QUERY, &Token ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: GetMySid() NtOpenProcessToken failed status %08lx\n",Status); exit(1); } Status = NtQueryInformationToken( Token, TokenOwner, Owner, 0, &Length ); if (Status != STATUS_BUFFER_TOO_SMALL) { printf("rtsetsec: GetMySid() NtQueryInformationToken failed status %08lx\n",Status); exit(1); } Owner = malloc(Length); if (Owner==NULL) { printf("rtsetsec: GetMySid() Couldn't malloc TOKEN_OWNER buffer\n"); exit(1); } Status = NtQueryInformationToken( Token, TokenOwner, Owner, Length, &Length ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: GetMySid() NtQueryInformationToken failed status %08lx\n",Status); exit(1); } NtClose(Token); return(Owner->Owner); }

void __cdecl main (  int  argc, char *  argv[] )

Definition at line 48 of file rtsetsec.c. References exit, GenerateDescriptor(), KeyName, NT_SUCCESS, NtClose(), NtOpenKey(), NtSetSecurityObject(), NTSTATUS(), NULL, ObjectAttributes, RtlAnsiStringToUnicodeString(), RtlInitAnsiString(), Status, and TRUE. { NTSTATUS Status; OBJECT_ATTRIBUTES ObjectAttributes; UNICODE_STRING KeyName; ANSI_STRING AnsiKeyName; HANDLE KeyHandle; PSECURITY_DESCRIPTOR NewSecurityDescriptor; // // Process args // if (argc != 2) { printf("Usage: %s <KeyPath>\n",argv[0]); exit(1); } RtlInitAnsiString(&AnsiKeyName, argv[1]); Status = RtlAnsiStringToUnicodeString(&KeyName, &AnsiKeyName, TRUE); if (!NT_SUCCESS(Status)) { printf("RtlAnsiStringToUnicodeString failed %lx\n",Status); exit(1); } printf("rtsetsec: starting\n"); // // Open node that we want to change the security descriptor for. // InitializeObjectAttributes( &ObjectAttributes, &KeyName, 0, (HANDLE)NULL, NULL ); ObjectAttributes.Attributes |= OBJ_CASE_INSENSITIVE; Status = NtOpenKey( &KeyHandle, WRITE_DAC, &ObjectAttributes ); if (!NT_SUCCESS(Status)) { printf("rtsetsec: NtOpenKey failed: %08lx\n", Status); exit(1); } NewSecurityDescriptor = GenerateDescriptor(); Status = NtSetSecurityObject( KeyHandle, DACL_SECURITY_INFORMATION, NewSecurityDescriptor); if (!NT_SUCCESS(Status)) { printf("rtsetsec: NtSetSecurity failed: %08lx\n",Status); exit(1); } Status = NtClose(KeyHandle); if (!NT_SUCCESS(Status)) { printf("rtsetsec: NtClose failed: %08lx\n", Status); exit(1); } printf("rtsetsec: successful\n"); }

---