dacledit.py: -mask added + bugfix

[shellinvictus]

• new parameter -mask to add more granularity on access masks. Useful with -rights Custom (new option) or --rights-guid where the mask is different of read+write.
• bugfix: access masks were badly parsed

[shellinvictus]

Some examples below :

FullControl vs Custom

FullControl

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights FullControl -action write

[*] Filtering results for SID (S-1-5-21-756988169-910435930-493999333-1163)
[*]   ACE[20] info
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : FullControl (0xf01ff)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)

Custom

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -action write -mask readwrite

[*]   ACE[19] info                
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : WriteProperties, ReadProperties (0x30)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)

Removing an ACE

The mask is necessary to remove an ACE (otherwise it uses the default values of dacledit). To remove the previous ACE, we can use 0x30 or again readwrite):

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -action remove -mask 0x30
dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -action remove -mask readwrite

GUID objects

By default on guid objects, the mask is AllExtendedRights (original behavior):

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights-guid bf967a68-0de6-11d0-a285-00aa003049e2 -action write

[*]     ACE Type                  : ACCESS_ALLOWED_OBJECT_ACE
[*]     ACE flags                 : None
[*]     Access mask               : ControlAccess (0x100)
[*]     Flags                     : ACE_OBJECT_TYPE_PRESENT
[*]     Object type (GUID)        : User-Account-Control (bf967a68-0de6-11d0-a285-00aa003049e2)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)

Example on giving only the right write on UserAccountControl:

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights-guid bf967a68-0de6-11d0-a285-00aa003049e2 -mask write -action write

[*]   ACE[5] info
[*]     ACE Type                  : ACCESS_ALLOWED_OBJECT_ACE
[*]     ACE flags                 : None
[*]     Access mask               : WriteProperty (0x20)
[*]     Flags                     : ACE_OBJECT_TYPE_PRESENT
[*]     Object type (GUID)        : User-Account-Control (bf967a68-0de6-11d0-a285-00aa003049e2)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)

Masks

dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -mask readwrite -action write
dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -mask write -action write
dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -mask self -action write
dacledit.py corp.local/admin:password -dc-ip 10.0.0.2 -principal alice -target bob -rights Custom -mask allext -action write

[*]   ACE[19] info
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : AllExtendedRights (0x100)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)
[*]   ACE[20] info
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : Self (0x8)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)
[*]   ACE[21] info
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : WriteProperties (0x20)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)
[*]   ACE[22] info
[*]     ACE Type                  : ACCESS_ALLOWED_ACE
[*]     ACE flags                 : None
[*]     Access mask               : WriteProperties, ReadProperties (0x30)
[*]     Trustee (SID)             : alice (S-1-5-21-756988169-910435930-493999333-1163)