-
Notifications
You must be signed in to change notification settings - Fork 1
/
getsids.py
202 lines (187 loc) · 8.35 KB
/
getsids.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
# Volatility
# Copyright (C) 2008 Volatile Systems
#
# Additional Authors:
# Mike Auty <[email protected]>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# Based heavily upon the getsids plugin by Moyix
# http://kurtz.cs.wesleyan.edu/%7Ebdolangavitt/memory/getsids.py
"""
@author: AAron Walters and Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: [email protected],[email protected]
@organization: Volatile Systems
"""
import volatility.obj as obj
import volatility.plugins.taskmods as taskmods
import volatility.plugins.registryapi as registryapi
import volatility.plugins.getservicesids as getservicesids
import re
def find_sid_re(sid_string, sid_re_list):
for reg, name in sid_re_list:
if reg.search(sid_string):
return name
well_known_sid_re = [
(re.compile(r'S-1-5-[0-9-]+-500'), 'Administrator'),
(re.compile(r'S-1-5-[0-9-]+-501'), 'Guest'),
(re.compile(r'S-1-5-[0-9-]+-502'), 'KRBTGT'),
(re.compile(r'S-1-5-[0-9-]+-512'), 'Domain Admins'),
(re.compile(r'S-1-5-[0-9-]+-513'), 'Domain Users'),
(re.compile(r'S-1-5-[0-9-]+-514'), 'Domain Guests'),
(re.compile(r'S-1-5-[0-9-]+-515'), 'Domain Computers'),
(re.compile(r'S-1-5-[0-9-]+-516'), 'Domain Controllers'),
(re.compile(r'S-1-5-[0-9-]+-517'), 'Cert Publishers'),
(re.compile(r'S-1-5-[0-9-]+-520'), 'Group Policy Creator Owners'),
(re.compile(r'S-1-5-[0-9-]+-533'), 'RAS and IAS Servers'),
(re.compile(r'S-1-5-5-[0-9]+-[0-9]+'), 'Logon Session'),
(re.compile(r'S-1-5-21-[0-9-]+-518'), 'Schema Admins'),
(re.compile(r'S-1-5-21-[0-9-]+-519'), 'Enterprise Admins'),
(re.compile(r'S-1-5-21-[0-9-]+-553'), 'RAS Servers'),
]
well_known_sids = {
'S-1-0': 'Null Authority',
'S-1-0-0': 'Nobody',
'S-1-1': 'World Authority',
'S-1-1-0': 'Everyone',
'S-1-2': 'Local Authority',
'S-1-2-0': 'Local (Users with the ability to log in locally)',
'S-1-2-1': 'Console Logon (Users who are logged onto the physical console)',
'S-1-3': 'Creator Authority',
'S-1-3-0': 'Creator Owner',
'S-1-3-1': 'Creator Group',
'S-1-3-2': 'Creator Owner Server',
'S-1-3-3': 'Creator Group Server',
'S-1-3-4': 'Owner Rights',
'S-1-4': 'Non-unique Authority',
'S-1-5': 'NT Authority',
'S-1-5-1': 'Dialup',
'S-1-5-2': 'Network',
'S-1-5-3': 'Batch',
'S-1-5-4': 'Interactive',
'S-1-5-6': 'Service',
'S-1-5-7': 'Anonymous',
'S-1-5-8': 'Proxy',
'S-1-5-9': 'Enterprise Domain Controllers',
'S-1-5-10': 'Principal Self',
'S-1-5-11': 'Authenticated Users',
'S-1-5-12': 'Restricted Code',
'S-1-5-13': 'Terminal Server Users',
'S-1-5-14': 'Remote Interactive Logon',
'S-1-5-15': 'This Organization',
'S-1-5-17': 'This Organization (Used by the default IIS user)',
'S-1-5-18': 'Local System',
'S-1-5-19': 'NT Authority',
'S-1-5-20': 'NT Authority',
'S-1-5-32-544': 'Administrators',
'S-1-5-32-545': 'Users',
'S-1-5-32-546': 'Guests',
'S-1-5-32-547': 'Power Users',
'S-1-5-32-548': 'Account Operators',
'S-1-5-32-549': 'Server Operators',
'S-1-5-32-550': 'Print Operators',
'S-1-5-32-551': 'Backup Operators',
'S-1-5-32-552': 'Replicators',
'S-1-5-32-554': 'BUILTIN\Pre-Windows 2000 Compatible Access',
'S-1-5-32-555': 'BUILTIN\Remote Desktop Users',
'S-1-5-32-556': 'BUILTIN\Network Configuration Operators',
'S-1-5-32-557': 'BUILTIN\Incoming Forest Trust Builders',
'S-1-5-32-558': 'BUILTIN\Performance Monitor Users',
'S-1-5-32-559': 'BUILTIN\Performance Log Users',
'S-1-5-32-560': 'BUILTIN\Windows Authorization Access Group',
'S-1-5-32-561': 'BUILTIN\Terminal Server License Servers',
'S-1-5-32-562': 'BUILTIN\Distributed COM Users',
'S-1-5-32-568': 'BUILTIN\IIS IUSRS',
'S-1-5-32-569': 'Cryptographic Operators',
'S-1-5-32-573': 'BUILTIN\Event Log Readers',
'S-1-5-32-574': 'BUILTIN\Certificate Service DCOM Access',
'S-1-5-33': 'Write Restricted',
'S-1-5-64-10': 'NTLM Authentication',
'S-1-5-64-14': 'SChannel Authentication',
'S-1-5-64-21': 'Digest Authentication',
'S-1-5-80': 'NT Service',
'S-1-5-86-1544737700-199408000-2549878335-3519669259-381336952': 'WMI (Local Service)',
'S-1-5-86-615999462-62705297-2911207457-59056572-3668589837': 'WMI (Network Service)',
'S-1-5-1000': 'Other Organization',
'S-1-16-0': 'Untrusted Mandatory Level',
'S-1-16-4096': 'Low Mandatory Level',
'S-1-16-8192': 'Medium Mandatory Level',
'S-1-16-8448': 'Medium Plus Mandatory Level',
'S-1-16-12288': 'High Mandatory Level',
'S-1-16-16384': 'System Mandatory Level',
'S-1-16-20480': 'Protected Process Mandatory Level',
'S-1-16-28672': 'Secure Process Mandatory Level',
}
class GetSIDs(taskmods.DllList, getservicesids.GetServiceSids, registryapi.RegistryAPI):
"""Print the SIDs owning each process"""
# Declare meta information associated with this plugin
meta_info = {}
meta_info['author'] = 'Brendan Dolan-Gavitt'
meta_info['copyright'] = 'Copyright (c) 2007,2008 Brendan Dolan-Gavitt'
meta_info['contact'] = '[email protected]'
meta_info['license'] = 'GNU General Public License 2.0 or later'
meta_info['url'] = 'http://moyix.blogspot.com/'
meta_info['os'] = 'WIN_32_XP_SP2'
meta_info['version'] = '1.0'
def __init__(self, config, *args):
config.remove_option("HIVE-OFFSET")
registryapi.RegistryAPI.__init__(self, config, *args)
getservicesids.GetServiceSids.__init__(self, config, *args)
taskmods.DllList.__init__(self, config, *args)
config.add_option('VERBOSE', short_option = 'v', default = False,
help = 'Get Service SIDs and User SIDs from Registry',
action = "store_true")
self.servicesids = getservicesids.servicesids
def render_text(self, outfd, data):
"""Renders the sids as text"""
usersids = {}
if self._config.VERBOSE:
ssids = getservicesids.GetServiceSids.calculate(self)
print "Getting Service SIDs...."
for sid, service in ssids:
self.servicesids[sid] = service
print "Getting User SIDs...."
self.reset_current()
self.set_current("SOFTWARE")
for k1 in self.reg_enum_key('SOFTWARE', 'Microsoft\\Windows NT\\CurrentVersion\\ProfileList'):
val = self.reg_get_value('SOFTWARE', k1, 'ProfileImagePath')
sid = k1.split("\\")[-1]
if val != None:
usersids[sid] = " (User: " + val.split("\\")[-1] + ")"
for task in data:
if not task.Token.is_valid():
outfd.write("{0} ({1}): Token unreadable\n".format(task.ImageFileName, int(task.UniqueProcessId)))
continue
tok = task.Token.dereference_as("_TOKEN")
for sa in tok.UserAndGroups.dereference():
sid = sa.Sid.dereference_as('_SID')
for i in sid.IdentifierAuthority.Value:
id_auth = i
sid_string = "S-" + "-".join(str(i) for i in (sid.Revision, id_auth) + tuple(sid.SubAuthority))
if sid_string in well_known_sids:
sid_name = " ({0})".format(well_known_sids[sid_string])
elif sid_string in self.servicesids:
sid_name = " (Service: {0})".format(self.servicesids[sid_string])
else:
sid_name_re = find_sid_re(sid_string, well_known_sid_re)
if sid_name_re:
sid_name = " ({0})".format(sid_name_re)
else:
try:
sid_name = usersids[sid_string]
except KeyError:
sid_name = ""
outfd.write("{0} ({1}): {2}{3}\n".format(task.ImageFileName, task.UniqueProcessId, sid_string, sid_name))