UmLsa.h

Go to the documentation of this file.

//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
// Project: uLib - User mode library.
// Module:  User mode LSA based functions and helpful security subroutines.
// Author: Copyright (c) Love Nystrom
// License: NNOSL (BSD descendant, see NNOSL.txt in the base directory).
//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#ifndef __UsermodeLsa_h_incl__
#define __UsermodeLsa_h_incl__

#include <uLib/Common.h>

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

#ifndef NT_SUCCESS
  #define NT_SUCCESS(rc)    ((rc) >= STATUS_SUCCESS)
#endif

#ifndef NT_ERROR
  #define NT_ERROR(Status)  (((ULONG)(Status) >> 30) == 3)
#endif

BEGIN_EXTERN_C

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool InitLsaFunc();

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool OpenLsaPolicy( CSTR Machine, ACCESS_MASK Access, PLSA_HANDLE phPolicy );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

LSA_HANDLE LsaCloseEx( LSA_HANDLE hLsa );

//=============================================================================
//=============================================================================
//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PSID GetAdminGroupSid();

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool GetAccountSid( CSTR Machine, CSTR Account, PSID* ppSid );
PSID FreeAccountSid( PSID pSid ); 


PSID GetCurrentUserSid(); // Uses GetAccountSid..

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool GetLogonSid( HANDLE hToken, PSID *ppSid );
PSID FreeLogonSid( PSID pSid ); 

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PACL GetObjectAcl(
    HANDLE hObj,
    SECURITY_INFORMATION Type, size_t cbExtra,
    PSECURITY_DESCRIPTOR* ppSecDesc OPTOUT DEF_(NULL),
    PDWORD cbSecDesc OPTOUT DEF_(NULL)
    );
PACL FreeObjectAcl( PACL pAcl ); 

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PSECURITY_DESCRIPTOR FreeObjectSecDesc( PSECURITY_DESCRIPTOR pSecDesc );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PISECURITY_DESCRIPTOR_RELATIVE
    GetObjectSecDesc( HANDLE hObj, SECURITY_INFORMATION Type, PDWORD cbDesc );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PISECURITY_DESCRIPTOR AllocAbsoluteSecDesc( size_t cbDesc DEF_(0) );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

PISECURITY_DESCRIPTOR MakeAbsoluteSecDesc(
    PSID Owner, PSID Group, PACL Sacl, PACL Dacl, SECURITY_DESCRIPTOR_CONTROL Control
    );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool GetAccountSystemAccess(
    LSA_HANDLE hPolicy, PSID AccountSid, ACCESS_MASK* Access
    );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool SetAccountSystemAccess(
    LSA_HANDLE hPolicy, PSID AccountSid, ACCESS_MASK AccsType, bool Add
    );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool AccountHasPrivilege( LSA_HANDLE hPolicy, PSID AccountSid, CSTR Privilege );

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

bool SetAccountPrivilege(
    LSA_HANDLE hPolicy, PSID AccountSid, CSTR Privilege, bool Add
    );

//==---------------------------------------------------------------------------
//  Under consideration: SetThreadPrivilegeEx
//==---------------------------------------------------------------------------


DECLARE_HANDLE( HPRIVILEGE ); // Opaque control block..


HPRIVILEGE SetThreadPrivilegeEx( CSTR Privilege );
HPRIVILEGE SetThreadPrivilegesEx( UINT NrPriv, CSTR* Privileges );


HPRIVILEGE RestoreThreadPrivilege( HPRIVILEGE hPriv );


HANDLE GetPrivilegeToken( HPRIVILEGE hPriv );

END_EXTERN_C
#ifdef __cplusplus
#ifndef __GNUC__ // MinGW(64) doesn't have ADSiid.

#include <uLib/ListFunc.h>
#include <uLib/UtilFunc.h>
#include <IADS.h> // Link with: ActiveDS.lib and ADSiid.lib
#include <ADSHlp.h>

BEGIN_NAMESPACE( uLib )

//== GroupList ================================================================


//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

struct GroupEntry : LIST_ENTRY
{
    CSTR  Name;     
    PSID  Sid;      
    SID_NAME_USE sidUse; 
    CSTR  Domain;   

    GroupEntry( CSTR name ); 
  #ifndef _UNICODE
    GroupEntry( WSTR name ); 
  #endif
    ~GroupEntry();


    static bool __stdcall _find_Sid( PLIST_ENTRY Entry, PVOID Ctx );
};
#ifdef __DOXYGEN__ // doxygen kludge..
typedef struct GroupEntry  GroupEntry;
#endif
typedef GroupEntry* PGroupEntry;

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

class GroupList : public DLinkList {
public:
    CSTR Machine;   

    GroupList();
    ~GroupList();
    void Clear();


    UINT GetFromADS( CSTR Machine );

protected:
    static bool __stdcall _del_Entry( PLIST_ENTRY Entry, PVOID Ctx );
};
typedef GroupList*  PGroupList;

END_NAMESPACE( uLib )
#endif//ndef __GNUC__
#endif//def __cplusplus

//=============================================================================
// And finally the LSA function pointers..
//=============================================================================
// Use declaration macro so the naming scheme can be easily changed.
// An underscore disambiguate these from AdvApi32/Secur32 publics such as LsaClose.
//=============================================================================

#define LSAFUNC(Name)   NTSTATUS (NTAPI *_##Name)

// INIT_LSAFUNC is used in UmLsa.cpp, but keep it here for proximity reasons.

#define INIT_LSAFUNC(Name) \
    (FARPROC&)_##Name = GetProcAddress( hMod, #Name ); \
    TRACE_IF( !_##Name, DP_WARNING, _F("API missing: %s\n"), #Name ); \
    anyPtr |= (LONG_PTR)_##Name

// Use an _INIT_FP_ construct, so we can have a single set of fnptr declarations.
// The normal case that uLib user's program sees will have them 'extern'.

#if _INIT_FP_ // INTERNAL
  #define _FP_ = NULL
  #define _LSAFN_EXTERN
#else
  #define _FP_
  #define _LSAFN_EXTERN extern
#endif

//=============================================================================
//  Local Security Policy - Dynalinked function pointers.
//=============================================================================
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaOpenAccount )(
    IN  LSA_HANDLE   PolicyHandle,
    IN  PSID         AccountSid,
    IN  ACCESS_MASK  DesiredAccess,
    OUT PLSA_HANDLE  AccountHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaCreateAccount )(
    IN  LSA_HANDLE   PolicyHandle,
    IN  PSID         AccountSid,
    IN  ACCESS_MASK  DesiredAccess,
    OUT PLSA_HANDLE  AccountHandle
  )_FP_;


_LSAFN_EXTERN LSAFUNC( LsaEnumerateAccounts )(
    IN    LSA_HANDLE  PolicyHandle,
    INOUT PLSA_ENUMERATION_HANDLE EnumerationContext,
    OUT   PVOID       *Buffer, // PLSA_ENUMERATION_INFORMATION
    IN    ULONG       PreferedMaximumLength,
    OUT   PULONG      CountReturned
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaGetSystemAccessAccount )(
    IN  LSA_HANDLE    AccountHandle,
    OUT PULONG        SystemAccess
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaSetSystemAccessAccount )(
    IN LSA_HANDLE     AccountHandle,
    IN ULONG          SystemAccess
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaEnumeratePrivilegesOfAccount )(
    IN  LSA_HANDLE    AccountHandle,
    OUT PPRIVILEGE_SET *Privileges
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaAddPrivilegesToAccount )(
    IN LSA_HANDLE     AccountHandle,
    IN PPRIVILEGE_SET Privileges
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaRemovePrivilegesFromAccount )(
    IN    LSA_HANDLE AccountHandle,
    IN    BOOLEAN    AllPrivileges,
    OPTIN PPRIVILEGE_SET Privileges
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaGetQuotasForAccount )(
    IN  LSA_HANDLE AccountHandle,
    OUT PQUOTA_LIMITS QuotaLimits
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaSetQuotasForAccount )(
    IN LSA_HANDLE AccountHandle,
    IN PQUOTA_LIMITS QuotaLimits
  )_FP_;


#ifndef ACCOUNT_VIEW

  #define ACCOUNT_VIEW                  0x00000001L
  #define ACCOUNT_ADJUST_PRIVILEGES     0x00000002L
  #define ACCOUNT_ADJUST_QUOTAS         0x00000004L
  #define ACCOUNT_ADJUST_SYSTEM_ACCESS  0x00000008L

  #define ACCOUNT_EXECUTE (STANDARD_RIGHTS_EXECUTE)
  #define ACCOUNT_READ    (STANDARD_RIGHTS_READ | ACCOUNT_VIEW)

  #define ACCOUNT_WRITE \
          ( STANDARD_RIGHTS_WRITE | ACCOUNT_ADJUST_PRIVILEGES \
          | ACCOUNT_ADJUST_QUOTAS | ACCOUNT_ADJUST_SYSTEM_ACCESS)

  #define ACCOUNT_ALL_ACCESS \
          ( STANDARD_RIGHTS_REQUIRED | ACCOUNT_VIEW \
          | ACCOUNT_ADJUST_PRIVILEGES | ACCOUNT_ADJUST_QUOTAS \
          | ACCOUNT_ADJUST_SYSTEM_ACCESS)

#endif//ndef ACCOUNT_VIEW

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaLookupPrivilegeValue )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLSA_UNICODE_STRING Name,
    OUT PLUID Value
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaEnumeratePrivileges )(
    IN    LSA_HANDLE PolicyHandle,
    INOUT PLSA_ENUMERATION_HANDLE EnumerationContext, // Not a handle
    OUT   PVOID* Buffer, 
    IN    ULONG  PreferedMaximumLength, 
    OUT   PULONG CountReturned 
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaDelete )(
    IN  LSA_HANDLE ObjectHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaQuerySecurityObject )(
    IN  LSA_HANDLE ObjectHandle,
    IN  SECURITY_INFORMATION SecurityInformation,
    OUT PSECURITY_DESCRIPTOR *SecurityDescriptor
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaSetSecurityObject )(
    IN  LSA_HANDLE ObjectHandle,
    IN  SECURITY_INFORMATION SecurityInformation,
    IN  PSECURITY_DESCRIPTOR SecurityDescriptor
  )_FP_;

// R.I.P: LsaChangePassword is gone. I assume some asshole managed to exploit it :/
//_LSAFN_EXTERN LSAFUNC( LsaChangePassword )(
//    IN  PLSA_UNICODE_STRING ServerName,
//    IN  PLSA_UNICODE_STRING DomainName,
//    IN  PLSA_UNICODE_STRING AccountName,
//    IN  PLSA_UNICODE_STRING OldPassword,
//    IN  PLSA_UNICODE_STRING NewPassword
//    );

_LSAFN_EXTERN LSAFUNC( LsaClearAuditLog )(
    IN  LSA_HANDLE PolicyHandle
  )_FP_;

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaOpenTrustedDomain )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PSID TrustedDomainSid,
    IN  ACCESS_MASK DesiredAccess,
    OUT PLSA_HANDLE TrustedDomainHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaCreateTrustedDomain )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLSA_TRUST_INFORMATION TrustedDomainInformation,
    IN  ACCESS_MASK DesiredAccess,
    OUT PLSA_HANDLE TrustedDomainHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaQueryInfoTrustedDomain )(
    IN  LSA_HANDLE TrustedDomainHandle,
    IN  TRUSTED_INFORMATION_CLASS InformationClass,
    OUT PVOID *Buffer
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaSetInformationTrustedDomain )(
    IN  LSA_HANDLE TrustedDomainHandle,
    IN  TRUSTED_INFORMATION_CLASS InformationClass,
    IN  PVOID Buffer
  )_FP_;

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaOpenSecret )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLSA_UNICODE_STRING SecretName,
    IN  ACCESS_MASK DesiredAccess,
    OUT PLSA_HANDLE SecretHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaCreateSecret )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLSA_UNICODE_STRING SecretName,
    IN  ACCESS_MASK DesiredAccess,
    OUT PLSA_HANDLE SecretHandle
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaSetSecret )(
    IN    LSA_HANDLE SecretHandle,
    OPTIN PLSA_UNICODE_STRING CurrentValue,
    OPTIN PLSA_UNICODE_STRING OldValue
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaQuerySecret )(
    IN     LSA_HANDLE SecretHandle,
    OPTOUT OPTIONAL PLSA_UNICODE_STRING *CurrentValue,
    OPTOUT PLARGE_INTEGER CurrentValueSetTime,
    OPTOUT PLSA_UNICODE_STRING *OldValue,
    OPTOUT PLARGE_INTEGER OldValueSetTime
  )_FP_;


#ifndef SECRET_SET_VALUE

  #define SECRET_SET_VALUE      0x00000001L
  #define SECRET_QUERY_VALUE    0x00000002L

  #define SECRET_ALL_ACCESS \
          (STANDARD_RIGHTS_REQUIRED | SECRET_SET_VALUE | SECRET_QUERY_VALUE)

  #define SECRET_READ       (STANDARD_RIGHTS_READ | SECRET_QUERY_VALUE)
  #define SECRET_WRITE      (STANDARD_RIGHTS_WRITE | SECRET_SET_VALUE)
  #define SECRET_EXECUTE    (STANDARD_RIGHTS_EXECUTE)


  #define LSA_GLOBAL_SECRET_PREFIX          L"G$"
  #define LSA_GLOBAL_SECRET_PREFIX_LENGTH   2


  #define LSA_LOCAL_SECRET_PREFIX           L"L$"
  #define LSA_LOCAL_SECRET_PREFIX_LENGTH    2


  #define LSA_MACHINE_SECRET_PREFIX         L"M$"
  #define LSA_MACHINE_SECRET_PREFIX_LENGTH  2
    // ((sizeof(LSA_MACHINE_SECRET_PREFIX) - sizeof(WCHAR)) / sizeof(WCHAR)) //<<< I.e: 2

  #define LSA_SECRET_MAXIMUM_COUNT          0x00001000L
  #define LSA_SECRET_MAXIMUM_LENGTH         0x00000200L

#endif//ndef SECRET_SET_VALUE

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaLookupPrivilegeName )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLUID Value,
    OUT PLSA_UNICODE_STRING *Name
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaLookupPrivilegeDisplayName )(
    IN  LSA_HANDLE PolicyHandle,
    IN  PLSA_UNICODE_STRING Name,
    OUT PLSA_UNICODE_STRING *DisplayName,
    OUT PSHORT LanguageReturned
  )_FP_;

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

_LSAFN_EXTERN LSAFUNC( LsaGetUserName )(
    OUT    PLSA_UNICODE_STRING * UserName, //__deref_out
    OPTOUT PLSA_UNICODE_STRING * DomainName //__deref_opt_out
  )_FP_;

_LSAFN_EXTERN LSAFUNC( LsaGetRemoteUserName)(
    OPTIN  PLSA_UNICODE_STRING SystemName,
    OUT    PLSA_UNICODE_STRING * UserName, //__deref_out
    OPTOUT PLSA_UNICODE_STRING * DomainName //__deref_opt_out
  )_FP_;

#undef LSAFUNC
#undef _FP_

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

#ifndef SECURITY_ACCESS_INTERACTIVE_LOGON

  #define SECURITY_ACCESS_INTERACTIVE_LOGON             ((ULONG) 0x00000001L)
  #define SECURITY_ACCESS_NETWORK_LOGON                 ((ULONG) 0x00000002L)
  #define SECURITY_ACCESS_BATCH_LOGON                   ((ULONG) 0x00000004L)
  #define SECURITY_ACCESS_SERVICE_LOGON                 ((ULONG) 0x00000010L)
  #define SECURITY_ACCESS_PROXY_LOGON                   ((ULONG) 0x00000020L)

  #define SECURITY_ACCESS_DENY_INTERACTIVE_LOGON        ((ULONG) 0x00000040L)
  #define SECURITY_ACCESS_DENY_NETWORK_LOGON            ((ULONG) 0x00000080L)
  #define SECURITY_ACCESS_DENY_BATCH_LOGON              ((ULONG) 0x00000100L)
  #define SECURITY_ACCESS_DENY_SERVICE_LOGON            ((ULONG) 0x00000200L)
  #define SECURITY_ACCESS_REMOTE_INTERACTIVE_LOGON      ((ULONG) 0x00000400L)
  #define SECURITY_ACCESS_DENY_REMOTE_INTERACTIVE_LOGON ((ULONG) 0x00000800L)

#endif//ndef SECURITY_ACCESS_INTERACTIVE_LOGON

//==---------------------------------------------------------------------------
//==---------------------------------------------------------------------------

#ifndef POLICY_MODE_INTERACTIVE

  #define POLICY_MODE_INTERACTIVE             SECURITY_ACCESS_INTERACTIVE_LOGON
  #define POLICY_MODE_NETWORK                 SECURITY_ACCESS_NETWORK_LOGON
  #define POLICY_MODE_BATCH                   SECURITY_ACCESS_BATCH_LOGON
  #define POLICY_MODE_SERVICE                 SECURITY_ACCESS_SERVICE_LOGON
  #define POLICY_MODE_PROXY                   SECURITY_ACCESS_PROXY_LOGON
  #define POLICY_MODE_DENY_INTERACTIVE        SECURITY_ACCESS_DENY_INTERACTIVE_LOGON
  #define POLICY_MODE_DENY_NETWORK            SECURITY_ACCESS_DENY_NETWORK_LOGON
  #define POLICY_MODE_DENY_BATCH              SECURITY_ACCESS_DENY_BATCH_LOGON
  #define POLICY_MODE_DENY_SERVICE            SECURITY_ACCESS_DENY_SERVICE_LOGON
  #define POLICY_MODE_REMOTE_INTERACTIVE      SECURITY_ACCESS_REMOTE_INTERACTIVE_LOGON
  #define POLICY_MODE_DENY_REMOTE_INTERACTIVE SECURITY_ACCESS_DENY_REMOTE_INTERACTIVE_LOGON

  #define POLICY_MODE_ALL \
          ( POLICY_MODE_INTERACTIVE | POLICY_MODE_NETWORK \
          | POLICY_MODE_BATCH | POLICY_MODE_SERVICE | POLICY_MODE_PROXY \
          | POLICY_MODE_DENY_INTERACTIVE | POLICY_MODE_DENY_NETWORK \
          | SECURITY_ACCESS_DENY_BATCH_LOGON | SECURITY_ACCESS_DENY_SERVICE_LOGON \
          | POLICY_MODE_REMOTE_INTERACTIVE | POLICY_MODE_DENY_REMOTE_INTERACTIVE )

  #define POLICY_MODE_ALL_NT4 \
          ( POLICY_MODE_INTERACTIVE | POLICY_MODE_NETWORK \
          | POLICY_MODE_BATCH | POLICY_MODE_SERVICE | POLICY_MODE_PROXY )

  typedef ULONG  POLICY_SYSTEM_ACCESS_MODE, *PPOLICY_SYSTEM_ACCESS_MODE;


  typedef struct _POLICY_PRIVILEGE_DEFINITION
  {
      LSA_UNICODE_STRING Name;
      LUID LocalValue;
  }
  POLICY_PRIVILEGE_DEFINITION, *PPOLICY_PRIVILEGE_DEFINITION;

#endif//ndef POLICY_MODE_INTERACTIVE


#define LSA_LOOKUP_ISOLATED_AS_LOCAL  0x80000000L

//==---------------------------------------------------------------------------
#endif//ndef __UsermodeLsa_h_incl__
// EOF