|
@@ -169,6 +169,7 @@ const (
|
|
|
//sys GetLengthSid(sid *SID) (len uint32) = advapi32.GetLengthSid
|
|
|
//sys CopySid(destSidLen uint32, destSid *SID, srcSid *SID) (err error) = advapi32.CopySid
|
|
|
//sys AllocateAndInitializeSid(identAuth *SidIdentifierAuthority, subAuth byte, subAuth0 uint32, subAuth1 uint32, subAuth2 uint32, subAuth3 uint32, subAuth4 uint32, subAuth5 uint32, subAuth6 uint32, subAuth7 uint32, sid **SID) (err error) = advapi32.AllocateAndInitializeSid
|
|
|
+//sys createWellKnownSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID, sid *SID, sizeSid *uint32) (err error) = advapi32.CreateWellKnownSid
|
|
|
//sys FreeSid(sid *SID) (err error) [failretval!=0] = advapi32.FreeSid
|
|
|
//sys EqualSid(sid1 *SID, sid2 *SID) (isEqual bool) = advapi32.EqualSid
|
|
|
|
|
@@ -286,6 +287,158 @@ func (sid *SID) LookupAccount(system string) (account, domain string, accType ui
|
|
|
}
|
|
|
}
|
|
|
|
|
|
+// Various types of pre-specified sids that can be synthesized at runtime.
|
|
|
+type WELL_KNOWN_SID_TYPE uint32
|
|
|
+
|
|
|
+const (
|
|
|
+ WinNullSid = 0
|
|
|
+ WinWorldSid = 1
|
|
|
+ WinLocalSid = 2
|
|
|
+ WinCreatorOwnerSid = 3
|
|
|
+ WinCreatorGroupSid = 4
|
|
|
+ WinCreatorOwnerServerSid = 5
|
|
|
+ WinCreatorGroupServerSid = 6
|
|
|
+ WinNtAuthoritySid = 7
|
|
|
+ WinDialupSid = 8
|
|
|
+ WinNetworkSid = 9
|
|
|
+ WinBatchSid = 10
|
|
|
+ WinInteractiveSid = 11
|
|
|
+ WinServiceSid = 12
|
|
|
+ WinAnonymousSid = 13
|
|
|
+ WinProxySid = 14
|
|
|
+ WinEnterpriseControllersSid = 15
|
|
|
+ WinSelfSid = 16
|
|
|
+ WinAuthenticatedUserSid = 17
|
|
|
+ WinRestrictedCodeSid = 18
|
|
|
+ WinTerminalServerSid = 19
|
|
|
+ WinRemoteLogonIdSid = 20
|
|
|
+ WinLogonIdsSid = 21
|
|
|
+ WinLocalSystemSid = 22
|
|
|
+ WinLocalServiceSid = 23
|
|
|
+ WinNetworkServiceSid = 24
|
|
|
+ WinBuiltinDomainSid = 25
|
|
|
+ WinBuiltinAdministratorsSid = 26
|
|
|
+ WinBuiltinUsersSid = 27
|
|
|
+ WinBuiltinGuestsSid = 28
|
|
|
+ WinBuiltinPowerUsersSid = 29
|
|
|
+ WinBuiltinAccountOperatorsSid = 30
|
|
|
+ WinBuiltinSystemOperatorsSid = 31
|
|
|
+ WinBuiltinPrintOperatorsSid = 32
|
|
|
+ WinBuiltinBackupOperatorsSid = 33
|
|
|
+ WinBuiltinReplicatorSid = 34
|
|
|
+ WinBuiltinPreWindows2000CompatibleAccessSid = 35
|
|
|
+ WinBuiltinRemoteDesktopUsersSid = 36
|
|
|
+ WinBuiltinNetworkConfigurationOperatorsSid = 37
|
|
|
+ WinAccountAdministratorSid = 38
|
|
|
+ WinAccountGuestSid = 39
|
|
|
+ WinAccountKrbtgtSid = 40
|
|
|
+ WinAccountDomainAdminsSid = 41
|
|
|
+ WinAccountDomainUsersSid = 42
|
|
|
+ WinAccountDomainGuestsSid = 43
|
|
|
+ WinAccountComputersSid = 44
|
|
|
+ WinAccountControllersSid = 45
|
|
|
+ WinAccountCertAdminsSid = 46
|
|
|
+ WinAccountSchemaAdminsSid = 47
|
|
|
+ WinAccountEnterpriseAdminsSid = 48
|
|
|
+ WinAccountPolicyAdminsSid = 49
|
|
|
+ WinAccountRasAndIasServersSid = 50
|
|
|
+ WinNTLMAuthenticationSid = 51
|
|
|
+ WinDigestAuthenticationSid = 52
|
|
|
+ WinSChannelAuthenticationSid = 53
|
|
|
+ WinThisOrganizationSid = 54
|
|
|
+ WinOtherOrganizationSid = 55
|
|
|
+ WinBuiltinIncomingForestTrustBuildersSid = 56
|
|
|
+ WinBuiltinPerfMonitoringUsersSid = 57
|
|
|
+ WinBuiltinPerfLoggingUsersSid = 58
|
|
|
+ WinBuiltinAuthorizationAccessSid = 59
|
|
|
+ WinBuiltinTerminalServerLicenseServersSid = 60
|
|
|
+ WinBuiltinDCOMUsersSid = 61
|
|
|
+ WinBuiltinIUsersSid = 62
|
|
|
+ WinIUserSid = 63
|
|
|
+ WinBuiltinCryptoOperatorsSid = 64
|
|
|
+ WinUntrustedLabelSid = 65
|
|
|
+ WinLowLabelSid = 66
|
|
|
+ WinMediumLabelSid = 67
|
|
|
+ WinHighLabelSid = 68
|
|
|
+ WinSystemLabelSid = 69
|
|
|
+ WinWriteRestrictedCodeSid = 70
|
|
|
+ WinCreatorOwnerRightsSid = 71
|
|
|
+ WinCacheablePrincipalsGroupSid = 72
|
|
|
+ WinNonCacheablePrincipalsGroupSid = 73
|
|
|
+ WinEnterpriseReadonlyControllersSid = 74
|
|
|
+ WinAccountReadonlyControllersSid = 75
|
|
|
+ WinBuiltinEventLogReadersGroup = 76
|
|
|
+ WinNewEnterpriseReadonlyControllersSid = 77
|
|
|
+ WinBuiltinCertSvcDComAccessGroup = 78
|
|
|
+ WinMediumPlusLabelSid = 79
|
|
|
+ WinLocalLogonSid = 80
|
|
|
+ WinConsoleLogonSid = 81
|
|
|
+ WinThisOrganizationCertificateSid = 82
|
|
|
+ WinApplicationPackageAuthoritySid = 83
|
|
|
+ WinBuiltinAnyPackageSid = 84
|
|
|
+ WinCapabilityInternetClientSid = 85
|
|
|
+ WinCapabilityInternetClientServerSid = 86
|
|
|
+ WinCapabilityPrivateNetworkClientServerSid = 87
|
|
|
+ WinCapabilityPicturesLibrarySid = 88
|
|
|
+ WinCapabilityVideosLibrarySid = 89
|
|
|
+ WinCapabilityMusicLibrarySid = 90
|
|
|
+ WinCapabilityDocumentsLibrarySid = 91
|
|
|
+ WinCapabilitySharedUserCertificatesSid = 92
|
|
|
+ WinCapabilityEnterpriseAuthenticationSid = 93
|
|
|
+ WinCapabilityRemovableStorageSid = 94
|
|
|
+ WinBuiltinRDSRemoteAccessServersSid = 95
|
|
|
+ WinBuiltinRDSEndpointServersSid = 96
|
|
|
+ WinBuiltinRDSManagementServersSid = 97
|
|
|
+ WinUserModeDriversSid = 98
|
|
|
+ WinBuiltinHyperVAdminsSid = 99
|
|
|
+ WinAccountCloneableControllersSid = 100
|
|
|
+ WinBuiltinAccessControlAssistanceOperatorsSid = 101
|
|
|
+ WinBuiltinRemoteManagementUsersSid = 102
|
|
|
+ WinAuthenticationAuthorityAssertedSid = 103
|
|
|
+ WinAuthenticationServiceAssertedSid = 104
|
|
|
+ WinLocalAccountSid = 105
|
|
|
+ WinLocalAccountAndAdministratorSid = 106
|
|
|
+ WinAccountProtectedUsersSid = 107
|
|
|
+ WinCapabilityAppointmentsSid = 108
|
|
|
+ WinCapabilityContactsSid = 109
|
|
|
+ WinAccountDefaultSystemManagedSid = 110
|
|
|
+ WinBuiltinDefaultSystemManagedGroupSid = 111
|
|
|
+ WinBuiltinStorageReplicaAdminsSid = 112
|
|
|
+ WinAccountKeyAdminsSid = 113
|
|
|
+ WinAccountEnterpriseKeyAdminsSid = 114
|
|
|
+ WinAuthenticationKeyTrustSid = 115
|
|
|
+ WinAuthenticationKeyPropertyMFASid = 116
|
|
|
+ WinAuthenticationKeyPropertyAttestationSid = 117
|
|
|
+ WinAuthenticationFreshKeyAuthSid = 118
|
|
|
+ WinBuiltinDeviceOwnersSid = 119
|
|
|
+)
|
|
|
+
|
|
|
+// Creates a sid for a well-known predefined alias, generally using the constants of the form
|
|
|
+// Win*Sid, for the local machine.
|
|
|
+func CreateWellKnownSid(sidType WELL_KNOWN_SID_TYPE) (*SID, error) {
|
|
|
+ return CreateWellKnownDomainSid(sidType, nil)
|
|
|
+}
|
|
|
+
|
|
|
+// Creates a sid for a well-known predefined alias, generally using the constants of the form
|
|
|
+// Win*Sid, for the domain specified by the domainSid parameter.
|
|
|
+func CreateWellKnownDomainSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID) (*SID, error) {
|
|
|
+ n := uint32(50)
|
|
|
+ for {
|
|
|
+ b := make([]byte, n)
|
|
|
+ sid := (*SID)(unsafe.Pointer(&b[0]))
|
|
|
+ err := createWellKnownSid(sidType, domainSid, sid, &n)
|
|
|
+ if err == nil {
|
|
|
+ return sid, nil
|
|
|
+ }
|
|
|
+ if err != ERROR_INSUFFICIENT_BUFFER {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ if n <= uint32(len(b)) {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
const (
|
|
|
// do not reorder
|
|
|
TOKEN_ASSIGN_PRIMARY = 1 << iota
|
|
@@ -372,6 +525,7 @@ type Tokengroups struct {
|
|
|
//sys OpenProcessToken(h Handle, access uint32, token *Token) (err error) = advapi32.OpenProcessToken
|
|
|
//sys GetTokenInformation(t Token, infoClass uint32, info *byte, infoLen uint32, returnedLen *uint32) (err error) = advapi32.GetTokenInformation
|
|
|
//sys GetUserProfileDirectory(t Token, dir *uint16, dirLen *uint32) (err error) = userenv.GetUserProfileDirectoryW
|
|
|
+//sys getSystemDirectory(dir *uint16, dirLen uint32) (len uint32, err error) = kernel32.GetSystemDirectoryW
|
|
|
|
|
|
// An access token contains the security information for a logon session.
|
|
|
// The system creates an access token when a user logs on, and every
|
|
@@ -468,6 +622,23 @@ func (t Token) GetUserProfileDirectory() (string, error) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
+// GetSystemDirectory retrieves path to current location of the system
|
|
|
+// directory, which is typically, though not always, C:\Windows\System32.
|
|
|
+func GetSystemDirectory() (string, error) {
|
|
|
+ n := uint32(MAX_PATH)
|
|
|
+ for {
|
|
|
+ b := make([]uint16, n)
|
|
|
+ l, e := getSystemDirectory(&b[0], n)
|
|
|
+ if e != nil {
|
|
|
+ return "", e
|
|
|
+ }
|
|
|
+ if l <= n {
|
|
|
+ return UTF16ToString(b[:l]), nil
|
|
|
+ }
|
|
|
+ n = l
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
// IsMember reports whether the access token t is a member of the provided SID.
|
|
|
func (t Token) IsMember(sid *SID) (bool, error) {
|
|
|
var b int32
|