Hello,
the attached patch for the DCE-RPC SAMR dissector adds descriptions of
specific permissions for the SAM_SERVER and SAM_USER objects that are
currently unknown in the current version of the dissector.
To discover textual descriptions of unknown specific permissions, the
trick is to analyze security events (more precisely, 560 and 565,
depending on whether the SAM in stored in the registry or in Active
Directory) that appear in the Windows security eventlog, once the _Audit
object access_ or _Audit directory access_ security auditing categories
are enabled.
For more information, see:
http://sisyphus.iocaine.com/pipermail/loganalysis/2003-June/002083.html
http://sisyphus.iocaine.com/pipermail/loganalysis/2003-July/002104.html
Example of a 560 event for a SAM_SERVER object:
[...]
Object Open:
Object Server: Security Account Manager
Object Type: SAM_SERVER
Object Name: SAM
Handle ID: 1223296
Operation ID: {0,190525}
Process ID: 504
Image File Name: C:\WINDOWS\system32\lsass.exe
Primary User Name: GARBAREK$
Primary Domain: WORKGROUP
Primary Logon ID: (0x0,0x3E7)
Client User Name: jbm
Client Domain: GARBAREK
Client Logon ID: (0x0,0xC41B)
Accesses: READ_CONTROL
ConnectToServer
EnumerateDomains
LookupDomain
[...]
In this specific event, the SAM_SERVER object was opened with the
specific permissions ConnectToServer, EnumerateDomains and LookupDomain.
To find the exact mapping between specific permissions bits and
textual description, you can use a (unicode-aware) strings utility
(http://www.sysinternals.com/ntw2k/source/misc.shtml) to extract all
textual descriptions of specific permissions that can appear in the
Windows security eventlog from the msobjs.dll DLL.
It is easier to do this operation on a Windows Server 2003 version of
the DLL, because specific permissions bits for each object types can be
distinguished, because the 16 bits available for specific permissions in
a NT permission mask are never all used.
For instance, SAM_SERVER specific permissions appear as follow (output
of the strings utility on a Windows Server 2003 version of the
msobjs.dll DLL):
[...]
Undefined Access (no effect) Bit 15 # end of specific permissions
# for another object type
ConnectToServer
ShutdownServer
InitializeServer
CreateDomain
EnumerateDomains
LookupDomain
Undefined Access (no effect) Bit 6
Undefined Access (no effect) Bit 7
Undefined Access (no effect) Bit 8
Undefined Access (no effect) Bit 9
Undefined Access (no effect) Bit 10
Undefined Access (no effect) Bit 11
Undefined Access (no effect) Bit 12
Undefined Access (no effect) Bit 13
Undefined Access (no effect) Bit 14
Undefined Access (no effect) Bit 15
ReadPasswordParameters # begin of permissions for another object type
[...]
Once you know at least one description for a specific permission of a
given object (in the case of SAM objects, you can find 560 or 565 events
in the security eventlog for each kind of SAM objects), you can easily
identify other specific permissions.
For the record, specific permissions descriptions for the SAM objects
are defined as follow:
SAM_SERVER:
0x01 ConnectToServer
0x02 ShutdownServer
0x04 InitializeServer
0x08 CreateDomain
0x10 EnumerateDomains
0x20 LookupDomain
SAM_DOMAIN:
0x01 ReadPasswordParameters
0x02 WritePasswordParameters
0x04 ReadOtherParameters
0x08 WriteOtherParameters
0x10 CreateUser
0x20 CreateGlobalGroup
0x40 CreateLocalGroup
0x80 GetLocalGroupMembership
0x100 ListAccounts
0x200 LookupIDs
0x400 AdministerServer
SAM_GROUP:
0x01 ReadInformation
0x02 WriteAccount
0x04 AddMember
0x08 RemoveMember
0x10 ListMembers
SAM_ALIAS:
0x01 AddMember
0x02 RemoveMember
0x04 ListMembers
0x08 ReadInformation
0x10 WriteAccount
SAM_USER:
0x01 ReadGeneralInformation
0x02 ReadPreferences
0x04 WritePreferences
0x08 ReadLogon
0x10 ReadAccount
0x20 WriteAccount
0x40 ChangePassword (with knowledge of old password)
0x80 SetPassword (without knowledge of old password)
0x100 ListGroups
0x200 ReadGroupMembership
0x400 ChangeGroupMembership
Looking at current descriptions for some specific permissions of
SAM_USER objects, it might be possible to improve descriptions, given
that new information.
Jean-Baptiste Marchand
--
Jean-Baptiste.Marchand@xxxxxx
Herv� Schauer Consultants
http://www.hsc.fr/
Attachment:
packet-dcerpc-samr.c.patch.gz
Description: application/gunzip
Attachment:
packet-dcerpc-samr.h.patch.gz
Description: application/gunzip
