o
    ju                     @   s  d dl Z d dlmZ d dlmZmZmZmZmZm	Z	m
Z
 d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+ d dl,Z,d dl-Z-d dl.m/Z/ d dl0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6 d d	l7m8Z8 d
d Z9dd Z:dd Z;dd Z<dd Z=dd Z>d)ddZ?dd Z@dd ZAdd ZBdd  ZCd!d" ZDd#d$ ZEd*d%d&ZFd'd( ZGdS )+    N)SE_OBJECT_TYPE)CloseHandleCreateFileWGENERIC_READREAD_CONTROLOPEN_EXISTINGFILE_ATTRIBUTE_DIRECTORYFILE_FLAG_BACKUP_SEMANTICS)LookupAccountNameWLookupAccountSidWGetSecurityInfoOWNER_SECURITY_INFORMATIONGROUP_SECURITY_INFORMATIONDACL_SECURITY_INFORMATIONOpenSCManagerWSC_MANAGER_ENUMERATE_SERVICEEnumServicesStatusWOpenServiceWQueryServiceObjectSecurityCloseServiceHandlehive_name_mapRegOpenKeyExWRegCloseKeyRegEnumKeyExWRegEnumValueWSetSecurityInfoBuildTrusteeWithSidWGetEffectiveRightsFromAclWConvertSidToStringSidWConvertStringSidToSidW4ConvertSecurityDescriptorToStringSecurityDescriptorWOpenProcessTokenGetTokenInformationLsaGetLogonSessionDataTokenStatisticsOpenProcessGetCurrentProcessId)NetUserGetLocalGroupsNetUserGetInfo)SECURITY_DESCRIPTOR)ACCESS_ALLOWED_ACEAceFlagsFILE_ACCESS_MASKACCESS_MASK)SID)EvaluateSidAgainstDescriptorc                 C   s   t d | \}}}|S N)r
   )usernamesiddomainuse r5   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/winacl/functions/highlevel.pyget_sid_for_user   s   r7   c                 C   s*   t | }td | \}}}d||f S )N%s\%s)r.   from_stringr   to_bytes)sid_strr2   r1   r3   r4   r5   r5   r6   get_user_for_sid   s   
r<   c                 C   s   t | tjjttB tB }|S r0   )r   r   SE_REGISTRY_KEYvaluer   r   r   )
key_handlesdr5   r5   r6   
get_reg_sd   s   rA   c                 C   s.   d}t | |td}t|tjj| t| d S )Ni   dwDesiredAccessdwCreationDisposition)r   r   r   r   SE_FILE_OBJECTr>   r   )	file_pathr@   
req_rightsfile_handler5   r5   r6   set_file_sd"   s   rI   c                 C   s2   t | ttd}t|tjjttB t	B }t
| |S )NrB   )r   r   r   r   r   rE   r>   r   r   r   r   )rF   rH   r@   r5   r5   r6   get_file_sd(   s   rJ   c                 C   s8   t | ttttB d}t|tjjt	t
B tB }t| |S )N)rC   rD   dwFlagsAndAttributes)r   r   r   r   r	   r   r   rE   r>   r   r   r   r   )dir_pathrH   r@   r5   r5   r6   get_directory_sd.   s   rM   Fc                 c   s    | d dkr| d7 } t j| d ddD ]B}tj|du r4z
|dt|fV  W q   |ddfV  Y q|du rVtj|du rVz
|dt|fV  W q   |ddfV  Y qqd S )	N\z**/*T)	recursivedirERRfile)globiglobospathisdirrM   isfilerJ   )rL   
with_filesfilenamer5   r5   r6   get_dir_file_recursive4   s    r\   c                  C   s.   t td} t| ttB tB tjd}t|  |S NrC   dwSecurityInformationsd_object_type)	r   r   r   r   r   r   r   
SE_SERVICEr   )
scm_handler@   r5   r5   r6   get_servicemanager_sdC   s   
rd   c                 C   sH   t ttB d}t|| td}t|ttB tB tj	d}t
| t
| |S r]   )r   r   r   r   r   r   r   r   r   rb   r   )service_namerc   service_handler@   r5   r5   r6   get_service_sdI   s   rg   c                  c   s    dt  fV  tttB d} t| D ]M}z?zt| |td}t|ttB t	B t
jd}||fV  W n tyF } z|dfV  W Y d }~nd }~ww W zt| W q   Y qzt| W w    Y w zt|  W d S    Y d S )NSCMr^   r_   err)rd   r   r   r   r   r   r   r   r   r   r   rb   	Exceptionr   )rc   re   rf   r@   er5   r5   r6   enumerate_all_service_sdQ   s2   rl   c                 C   s$   t |  }t|tjjttB tB }|S r0   )r   r   r   r=   r>   r   r   r   )	hive_namer?   r@   r5   r5   r6   get_registry_hive_sde   s   rn   c                 C   sx   |  d}t|d  }g }|dd D ]}t||}|| qt|tjjtt	B t
B }|d d d D ]}t| q3|S )NrO   r      rN   )splitr   r   appendr   r   r=   r>   r   r   r   r   )reg_pathpath_elements
reg_handlehandlesnamer@   r5   r5   r6   get_registry_key_sdj   s   


rw   c                 C   s|   g }d }| ddkr|d\}}t||^}}|| t||D ]}t||\}}}	|| q#t| |d|\}
}|S )NrO   rN   i   )findrp   r
   rq   r'   r/   )r@   r1   
sid_groupsr3   user_sidt
group_namer2   	groupnamer4   resmaskr5   r5   r6    get_maximum_permissions_for_user|   s   
r   c                 c   s2   | d dkr| d d } g }|d u r3|  d}t|d  }g }|dd  D ]}t||}|| q&t|}|D ]T}d| |f }zt||}W n( typ }	 zt|	ddkrbtt|	|  nt|	 W Y d }	~	q9d }	~	ww t	|t
jjttB tB t
jd}
||
fV  t||E d H  q9|D ]}t| qd S )NrN   rO   r   ro   r8   zcannot find)se_object_type)rp   r   r   rq   r   rj   strrx   printr   r   r=   r>   r   r   r   enumerate_registry_sdr   )rr   rt   ru   rs   rv   subkeysskreg_path_skreg_handle_skrk   r@   r5   r5   r6   r      s8   



r   c                  C   s*   t d dt } t| }t|t}t|jS )NF)r%   r&   r!   r"   r$   r#   AuthenticationId)phandle	tokhandlestatsr5   r5   r6   get_logon_info   s   

r   )Fr0   )Hctypeswinacl.functions.constantsr   winacl.functions.kernel32r   r   r   r   r   r   r	   winacl.functions.advapi32r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   winacl.functions.netapi32r'   r(   rT   rV   winacl.dtyp.security_descriptorr)   winacl.dtyp.acer*   r+   r,   r-   winacl.dtyp.sidr.   winacl.functions.rights_calcr/   r7   r<   rA   rI   rJ   rM   r\   rd   rg   rl   rn   rw   r   r   r   r5   r5   r5   r6   <module>   s4    $|	

"