private NtToken GetLowBoxToken(NtToken token)
{
Sid package_sid = TokenUtils.GetPackageSidFromName(PackageSid);
if (!NtSecurity.IsPackageSid(package_sid))
{
throw new ArgumentException($"Invalid Package Sid {package_sid}");
}
if (!String.IsNullOrEmpty(RestrictedPackageName))
{
package_sid = TokenUtils.DeriveRestrictedPackageSidFromSid(package_sid, RestrictedPackageName);
}
IEnumerable <Sid> capability_sids = CapabilitySids == null ? new Sid[0] : CapabilitySids.Select(s =>
{
if (!s.StartsWith("S-"))
{
return(NtSecurity.GetCapabilitySid(s));
}
Sid sid = new Sid(s);
if (!NtSecurity.IsCapabilitySid(sid))
{
throw new ArgumentException($"{s} is not a capability SID", s);
}
return(sid);
}
);
return(token.CreateLowBoxToken(package_sid, capability_sids, Handles ?? new NtObject[0], TokenAccessRights.MaximumAllowed));
}
private IEnumerable <Sid> GetCapabilitySids()
{
return(CapabilitySid == null ? new Sid[0] : CapabilitySid.Select(s =>
{
if (!s.StartsWith("S-"))
{
return NtSecurity.GetCapabilitySid(s);
}
Sid sid = new Sid(s);
if (!NtSecurity.IsCapabilitySid(sid))
{
throw new ArgumentException($"{s} is not a capability SID", s);
}
return sid;
}
));
}
/// <summary>
/// Process record.
/// </summary>
protected override void ProcessRecord()
{
Sid sid;
switch (ParameterSetName)
{
case "sddl":
sid = new Sid(Sddl);
break;
case "name":
sid = NtSecurity.LookupAccountName(Name);
break;
case "service":
sid = NtSecurity.GetServiceSid(ServiceName);
break;
case "il":
sid = NtSecurity.GetIntegritySid(IntegrityLevel);
break;
case "il_raw":
sid = NtSecurity.GetIntegritySidRaw(IntegrityLevelRaw);
break;
case "package":
sid = TokenUtils.DerivePackageSidFromName(PackageName);
if (RestrictedPackageName != null)
{
sid = TokenUtils.DeriveRestrictedPackageSidFromSid(sid, RestrictedPackageName);
}
break;
case "known":
sid = KnownSids.GetKnownSid(KnownSid);
break;
case "token":
using (NtToken token = NtToken.OpenProcessToken())
{
if (PrimaryGroup)
{
sid = token.PrimaryGroup;
}
else if (Owner)
{
sid = token.Owner;
}
else if (LogonGroup)
{
sid = token.LogonSid.Sid;
}
else if (AppContainer)
{
sid = token.AppContainerSid;
}
else if (Label)
{
sid = token.IntegrityLevelSid.Sid;
}
else
{
sid = token.User.Sid;
}
}
break;
case "cap":
sid = CapabilityGroup ? NtSecurity.GetCapabilityGroupSid(CapabilityName)
: NtSecurity.GetCapabilitySid(CapabilityName);
break;
case "sid":
sid = new Sid(SecurityAuthority, RelativeIdentifier);
break;
case "logon":
sid = NtSecurity.GetLogonSessionSid();
break;
case "trust":
sid = NtSecurity.GetTrustLevelSid(TrustType, TrustLevel);
break;
case "ace":
sid = AccessControlEntry.Sid;
break;
default:
throw new ArgumentException("No SID type specified");
}
if (ToSddl)
{
WriteObject(sid.ToString());
}
else if (ToName)
{
WriteObject(sid.Name);
}
else
{
WriteObject(sid);
}
}
/// <summary>
/// Add an AppContainer capability by name.
/// </summary>
/// <param name="capability_name"></param>
public void AddNamedCapability(string capability_name)
{
Capabilities.Add(NtSecurity.GetCapabilitySid(capability_name));
}
/// <summary>
/// Process record.
/// </summary>
protected override void ProcessRecord()
{
IEnumerable <Sid> sids;
switch (ParameterSetName)
{
case "sddl":
sids = Sddl.Select(s => new Sid(s));
break;
case "name":
sids = Name.Select(s => NtSecurity.LookupAccountName(s));
break;
case "service":
sids = ServiceName.Select(s => NtSecurity.GetServiceSid(s));
break;
case "il":
sids = IntegrityLevel.Select(s => NtSecurity.GetIntegritySid(s));
break;
case "il_raw":
sids = IntegrityLevelRaw.Select(s => NtSecurity.GetIntegritySidRaw(s));
break;
case "package":
sids = PackageName.Select(s => TokenUtils.DerivePackageSidFromName(s));
if (RestrictedPackageName != null)
{
sids = sids.Select(s => TokenUtils.DeriveRestrictedPackageSidFromSid(s, RestrictedPackageName));
}
if (AsCapability)
{
sids = sids.Select(s => NtSecurity.PackageSidToCapability(s));
}
break;
case "known":
sids = KnownSid.Select(s => KnownSids.GetKnownSid(s));
break;
case "token":
using (NtToken token = NtToken.OpenProcessToken())
{
Sid temp = null;
if (PrimaryGroup)
{
temp = token.PrimaryGroup;
}
else if (Owner)
{
temp = token.Owner;
}
else if (LogonGroup)
{
temp = token.LogonSid.Sid;
}
else if (AppContainer)
{
temp = token.AppContainerSid;
}
else if (Label)
{
temp = token.IntegrityLevelSid.Sid;
}
else
{
temp = token.User.Sid;
}
sids = new[] { temp };
}
break;
case "cap":
sids = CapabilityName.Select(s => CapabilityGroup ? NtSecurity.GetCapabilityGroupSid(s)
: NtSecurity.GetCapabilitySid(s));
break;
case "sid":
sids = new[] { new Sid(SecurityAuthority, RelativeIdentifier ?? new uint[0]) };
break;
case "rawsa":
sids = new[] { new Sid(new SidIdentifierAuthority(SecurityAuthorityByte), RelativeIdentifier) };
break;
case "logon":
sids = new[] { NtSecurity.GetLogonSessionSid() };
break;
case "trust":
sids = new[] { NtSecurity.GetTrustLevelSid(TrustType, TrustLevel) };
break;
case "ace":
sids = AccessControlEntry.Select(a => a.Sid);
break;
case "relsid":
sids = new[] { Sibling?BaseSid.CreateSibling(RelativeIdentifier) : BaseSid.CreateRelative(RelativeIdentifier) };
break;
case "bytes":
sids = new[] { new Sid(Byte) };
break;
default:
throw new ArgumentException("No SID type specified");
}
if (AsSddl)
{
WriteObject(sids.Select(s => s.ToString()), true);
}
else if (AsName)
{
WriteObject(sids.Select(s => s.Name), true);
}
else
{
WriteObject(sids, true);
}
}