Fix token.py doc + improve NDR with new class + doc NdrString new behavior + update uac.py sample to match new NdrString

This commit is contained in:
hakril
2018-12-21 16:05:37 +01:00
parent a9a39bc53f
commit f522f08e7f
5 changed files with 54 additions and 286 deletions
@@ -1,276 +0,0 @@
typedef enum _ALPC_PORT_INFORMATION_CLASS
{
AlpcBasicInformation,
AlpcPortInformation,
AlpcAssociateCompletionPortInformation,
AlpcConnectedSIDInformation,
AlpcServerInformation,
AlpcMessageZoneInformation,
AlpcRegisterCompletionListInformation,
AlpcUnregisterCompletionListInformation,
AlpcAdjustCompletionListConcurrencyCountInformation,
AlpcRegisterCallbackInformation,
AlpcCompletionListRundownInformation,
AlpcWaitForPortReferences,
MaxAlpcPortInfoClass
} ALPC_PORT_INFORMATION_CLASS;
typedef enum _ALPC_MESSAGE_INFORMATION_CLASS
{
AlpcMessageSidInformation,
AlpcMessageTokenModifiedIdInformation,
MaxAlpcMessageInfoClass,
AlpcMessageHandleInformation,
} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;
typedef struct _ALPC_PORT_ATTRIBUTES32
{
ULONG Flags;
SECURITY_QUALITY_OF_SERVICE SecurityQos;
SIZE_T MaxMessageLength;
SIZE_T MemoryBandwidth;
SIZE_T MaxPoolUsage;
SIZE_T MaxSectionSize;
SIZE_T MaxViewSize;
SIZE_T MaxTotalSectionSize;
ULONG DupObjectTypes;
} ALPC_PORT_ATTRIBUTES32, *PALPC_PORT_ATTRIBUTES32;
typedef struct _ALPC_PORT_ATTRIBUTES64
{
ULONG Flags;
SECURITY_QUALITY_OF_SERVICE SecurityQos;
SIZE_T MaxMessageLength;
SIZE_T MemoryBandwidth;
SIZE_T MaxPoolUsage;
SIZE_T MaxSectionSize;
SIZE_T MaxViewSize;
SIZE_T MaxTotalSectionSize;
ULONG DupObjectTypes;
ULONG Reserved;
} ALPC_PORT_ATTRIBUTES64, *PALPC_PORT_ATTRIBUTES64;
typedef struct _ALPC_MESSAGE_ATTRIBUTES
{
ULONG AllocatedAttributes;
ULONG ValidAttributes;
} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;
typedef union _PORT_MESSAGE32_TMP_UNION
{
ULONG ClientViewSize;
ULONG CallbackId;
} PORT_MESSAGE_TMP_UNION;
typedef union _PORT_MESSAGE64_TMP_UNION
{
ULONGLONG ClientViewSize;
ULONG CallbackId;
} PORT_MESSAGE_TMP_UNION;
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1
{
CSHORT DataLength;
CSHORT TotalLength;
} _PORT_MESSAGE_TMP_SUBSTRUCT_S1;
typedef union _PORT_MESSAGE_TMP_UNION_U1
{
ULONG Length;
_PORT_MESSAGE_TMP_SUBSTRUCT_S1 s1;
} _PORT_MESSAGE_TMP_UNION_U1;
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2
{
CSHORT Type;
CSHORT DataInfoOffset;
} _PORT_MESSAGE_TMP_SUBSTRUCT_S2;
typedef union _PORT_MESSAGE_TMP_UNION_U2
{
ULONG ZeroInit;
_PORT_MESSAGE_TMP_SUBSTRUCT_S2 s2;
} _PORT_MESSAGE_TMP_UNION_U2;
typedef struct _PORT_MESSAGE32
{
_PORT_MESSAGE_TMP_UNION_U1 u1;
_PORT_MESSAGE_TMP_UNION_U2 u2;
CLIENT_ID32 ClientId;
ULONG MessageId;
_PORT_MESSAGE32_TMP_UNION tmp_union;
} PORT_MESSAGE32, *PPORT_MESSAGE32;
typedef struct _PORT_MESSAGE64
{
_PORT_MESSAGE_TMP_UNION_U1 u1;
_PORT_MESSAGE_TMP_UNION_U2 u2;
CLIENT_ID64 ClientId;
ULONG MessageId;
_PORT_MESSAGE64_TMP_UNION tmp_union;
} PORT_MESSAGE64, *PPORT_MESSAGE64;
typedef struct _ALPC_SERVER_INFORMATION_TMP_IN
{
HANDLE ThreadHandle;
} ALPC_SERVER_INFORMATION_TMP_IN;
typedef struct _ALPC_SERVER_INFORMATION_TMP_OUT
{
BOOLEAN ThreadBlocked;
HANDLE ConnectedProcessId;
UNICODE_STRING ConnectionPortName;
} ALPC_SERVER_INFORMATION_TMP_OUT;
typedef union ALPC_SERVER_INFORMATION
{
ALPC_SERVER_INFORMATION_TMP_IN In;
ALPC_SERVER_INFORMATION_TMP_OUT Out;
} ALPC_SERVER_INFORMATION;
typedef struct _ALPC_CONTEXT_ATTR
{
PVOID PortContext;
PVOID MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR;
typedef struct _ALPC_CONTEXT_ATTR32
{
ULONG PortContext;
ULONG MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR32, *PALPC_CONTEXT_ATTR32;
typedef struct _ALPC_CONTEXT_ATTR64
{
ULONGLONG PortContext;
ULONGLONG MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR64, *PALPC_CONTEXT_ATTR64;
typedef struct _ALPC_HANDLE_ATTR
{
ULONG Flags;
HANDLE Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR;
typedef struct _ALPC_HANDLE_ATTR32
{
ULONG Flags;
ULONG Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR32, *PALPC_HANDLE_ATTR32;
typedef struct _ALPC_HANDLE_ATTR64
{
ULONG Flags;
ULONGLONG Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR64, *PALPC_HANDLE_ATTR64;
typedef struct _ALPC_SECURITY_ATTR
{
ULONG Flags;
PSECURITY_QUALITY_OF_SERVICE QoS;
ALPC_HANDLE ContextHandle;
} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR;
typedef struct _ALPC_SECURITY_ATTR32
{
ULONG Flags;
ULONG QoS;
ULONG ContextHandle;
} ALPC_SECURITY_ATTR32, *PALPC_SECURITY_ATTR32;
typedef struct _ALPC_SECURITY_ATTR64
{
ULONGLONG Flags;
ULONGLONG QoS;
ULONGLONG ContextHandle;
} ALPC_SECURITY_ATTR64, *PALPC_SECURITY_ATTR64;
typedef struct _ALPC_DATA_VIEW_ATTR
{
ULONG Flags;
ALPC_HANDLE SectionHandle;
PVOID ViewBase;
PVOID ViewSize;
} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR;
typedef struct _ALPC_DATA_VIEW_ATTR32
{
ULONG Flags;
ULONG SectionHandle;
ULONG ViewBase;
ULONG ViewSize;
} ALPC_DATA_VIEW_ATTR32, *PALPC_DATA_VIEW_ATTR32;
typedef struct _ALPC_DATA_VIEW_ATTR64
{
ULONG Flags;
ULONGLONG SectionHandle;
ULONGLONG ViewBase;
ULONGLONG ViewSize;
} ALPC_DATA_VIEW_ATTR64, *PALPC_DATA_VIEW_ATTR64;
typedef struct _ALPC_TOKEN_ATTR
{
ULONGLONG TokenId;
ULONGLONG AuthenticationId;
ULONGLONG ModifiedId;
} ALPC_TOKEN_ATTR, *PALPC_TOKEN_ATTR;
typedef struct _ALPC_DIRECT_ATTR
{
HANDLE Event;
} ALPC_DIRECT_ATTR, *PALPC_DIRECT_ATTR;
typedef struct _ALPC_DIRECT_ATTR32
{
ULONG Event;
} ALPC_DIRECT_ATTR32, *PALPC_DIRECT_ATTR32;
typedef struct _ALPC_DIRECT_ATTR64
{
ULONGLONG Event;
} ALPC_DIRECT_ATTR64, *PALPC_DIRECT_ATTR64;
typedef struct _ALPC_WORK_ON_BEHALF_ATTR
{
ULONGLONG Ticket;
} ALPC_WORK_ON_BEHALF_ATTR, *PALPC_WORK_ON_BEHALF_ATTR;
typedef struct _RPC_IF_ID {
IID Uuid;
USHORT VersMajor;
USHORT VersMinor;
} RPC_IF_ID;
+4 -4
View File
@@ -52,12 +52,12 @@ iid = client.bind(UAC_UIID)
# Marshalling parameters.
parameters = RAiLaunchAdminProcessParameters.pack([
params.target + "\x00", # Application Path
params.cmdline + "\x00", # Commandline
params.target, # Application Path
params.cmdline, # Commandline
params.uacflags, # UAC-Request Flag
params.creationflags, # dwCreationFlags
"\x00", # StartDirectory
"WinSta0\\Default\x00", # Station
"", # StartDirectory
"WinSta0\\Default", # Station
# Startup Info
(None, # Title
0, # dwX
+35 -2
View File
@@ -100,6 +100,7 @@ class NdrSID(object):
class NdrVaryingCString(object):
@classmethod
def pack(cls, data):
"""Pack string ``data``. append ``\\x00`` if not present at the end of the string"""
if data is None:
return None
if not data.endswith('\x00'):
@@ -112,6 +113,7 @@ class NdrVaryingCString(object):
class NdrWString(object):
@classmethod
def pack(cls, data):
"""Pack string ``data``. append ``\\x00`` if not present at the end of the string"""
if data is None:
return None
if not data.endswith('\x00'):
@@ -134,6 +136,7 @@ class NdrWString(object):
class NdrCString(object):
@classmethod
def pack(cls, data):
"""Pack string ``data``. append ``\\x00`` if not present at the end of the string"""
if data is None:
return None
if not data.endswith('\x00'):
@@ -168,7 +171,7 @@ class NdrHyper(object):
@classmethod
def unpack(self, stream):
stream.align(4)
stream.align(8)
return stream.partial_unpack("<Q")[0]
class NdrShort(object):
@@ -191,6 +194,18 @@ class NdrByte(object):
return stream.partial_unpack("<B")[0]
class NdrGuid(object):
@classmethod
def pack(cls, data):
if not isinstance(data, gdef.IID):
data = gdef.IID.from_string(data)
return str(bytearray(data))
@classmethod
def unpack(self, stream):
rawguid = stream.partial_unpack("16s")[0]
return gdef.IID.from_buffer_copy(rawguid)
class NdrContextHandle(object):
@classmethod
def pack(cls, data):
@@ -252,15 +267,17 @@ class NdrStructure(object):
data.append(member.unpack_conformant(stream, conformant_size))
else:
if hasattr(member, "unpack_in_struct"):
# print("[{0}] Dereferenced unpacking".format(i))
ptr, subcls = member.unpack_in_struct(stream)
if not ptr:
data.append(None)
else:
data.append(ptr)
post_subcls.append((i, subcls))
print(post_subcls)
# print(post_subcls)
else:
data.append(member.unpack(stream))
# print("Applying deref unpack")
for i, entry in post_subcls:
data[i] = entry.unpack(stream)
return cls.post_unpack(data)
@@ -369,13 +386,27 @@ class NdrWcharConformantVaryingArrays(NdrConformantVaryingArrays):
return u"".join(unichr(c) for c in result)
class NdrHyperConformantVaryingArrays(NdrConformantVaryingArrays):
MEMBER_TYPE = NdrHyper
class NdrHyperConformantArray(NdrConformantArray):
MEMBER_TYPE = NdrHyper
class NdrLongConformantArray(NdrConformantArray):
MEMBER_TYPE = NdrLong
class NdrShortConformantArray(NdrConformantArray):
MEMBER_TYPE = NdrShort
class NdrByteConformantArray(NdrConformantArray):
MEMBER_TYPE = NdrByte
@classmethod
def _post_unpack(self, result):
return bytearray(result)
class NdrGuidConformantArray(NdrConformantArray):
MEMBER_TYPE = NdrGuid
class NdrStream(object):
@@ -412,6 +443,8 @@ class NdrStream(object):
# Realign
size_to_align = (size - (already_read % size))
self.data = self.data[size_to_align:]
return size_to_align
return 0
def make_parameters(types, name=None):
+8 -3
View File
@@ -594,15 +594,20 @@ class Token(utils.AutoHandle):
buffsize = ctypes.sizeof(privileges)
winproxy.AdjustTokenPrivileges(self.handle, False, privileges, buffsize, None, None)
if winproxy.GetLastError() == gdef.ERROR_NOT_ALL_ASSIGNED:
raise ValueError("Failed to adjust all privileges")
# Transform this in a real WindowsError
raise WindowsError(gdef.ERROR_NOT_ALL_ASSIGNED, "Failed to adjust all privileges")
def enable_privilege(self, name):
"""Enable privilege ``name`` in the token"""
"""Enable privilege ``name`` in the token
:raises: :class:`ValueError` if :class:`Token` has no privilege ``name``
"""
privs = self.privileges
try:
privs[name] = gdef.SE_PRIVILEGE_ENABLED
except KeyError as e:
raise ValueError("{0} as no privilege <{1}>".format(self, name))
# Emulate the WindowsError that would be triggered in 'adjust_privileges' ?
raise ValueError("{0} has no privilege <{1}>".format(self, name))
return self.adjust_privileges(privs)
def __repr__(self):
+7 -1
View File
@@ -82,7 +82,13 @@ class ApiProxy(object):
def generate_ctypes_function():
try:
c_prototyped = prototype((self.func_name, getattr(ctypes.windll, self.APIDLL)), params)
api_dll = ctypes.windll[self.APIDLL]
except WindowsError as e:
if e.winerror == gdef.ERROR_BAD_EXE_FORMAT:
e.strerror = e.strerror.replace("%1", "<{0}>".format(self.APIDLL))
raise
try:
c_prototyped = prototype((self.func_name, api_dll), params)
except (AttributeError, WindowsError):
raise ExportNotFound(self.func_name, self.APIDLL)
if self.error_check is not None: