o
    àý°jí¢  ã                   @   sJ  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d dlmZmZ d dlmZ d d	lmZ d d
lmZmZ d dl m!Z!m"Z" i Z#e# $e¡ e# $e¡ i dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“d d!“d"d#“d$d%“d&d'“d(d)“d*d+“d,d-“i d.d/“d0d1“d2d3“d4d5“d6d7“d8d9“d:d;“d<d=“d>d?“d@dA“dBdC“dDdE“dFdG“dHdG“dIdJ“dKd+“dLd+“¥i dMdN“dOdP“dQdR“dSdT“dUdV“dWdX“dYdZ“d[d\“d]d^“d_d`“dadb“dcdd“dedf“dgdh“didj“dkdl“dmdn“¥i dodp“dqdr“dsdt“dudv“dwdx“dydz“d{d|“d}d~“dd€“dd‚“dƒd„“d…d†“d‡dˆ“d‰dŠ“d‹dŒ“ddŽ“dd“¥d‘d’d“d”d•d–d—œ¥Z%G d˜d™„ d™eƒZ&G dšd›„ d›eƒZ'G dœd„ deƒZ(G dždŸ„ dŸeƒZ)G d d¡„ d¡eƒZ*G d¢d£„ d£eƒZ+G d¤d¥„ d¥e,ƒZ-d¦d§„ Z.d¨d©„ Z/e0dªkr£e/ƒ  dS dS )«é    N)ÚEnum)Ú
format_sid)Úversion)ÚloggerÚutils)Ú	ldaptypes)ÚSCHEMA_OBJECTSÚEXTENDED_RIGHTS)Úescape_filter_chars)Úsecurity_descriptor_control)Ústring_to_binÚbin_to_string)Úinit_ldap_sessionÚparse_identityzS-1-0zNull AuthorityzS-1-0-0ÚNobodyzS-1-1zWorld AuthorityzS-1-1-0ÚEveryonezS-1-2zLocal AuthorityzS-1-2-0ÚLocalzS-1-2-1zConsole LogonzS-1-3zCreator AuthorityzS-1-3-0zCreator OwnerzS-1-3-1zCreator GroupzS-1-3-2zCreator Owner ServerzS-1-3-3zCreator Group ServerzS-1-3-4zOwner Rightsz
S-1-5-80-0zAll ServiceszS-1-4zNon-unique AuthorityzS-1-5zNT AuthorityzS-1-5-1ÚDialupzS-1-5-2ÚNetworkzS-1-5-3ÚBatchzS-1-5-4ÚInteractivezS-1-5-6ÚServicezS-1-5-7Ú	AnonymouszS-1-5-8ÚProxyzS-1-5-9zEnterprise Domain ControllerszS-1-5-10zPrincipal SelfzS-1-5-11zAuthenticated UserszS-1-5-12zRestricted CodezS-1-5-13zTerminal Server UserszS-1-5-14zRemote Interactive LogonzS-1-5-15zThis OrganizationzS-1-5-17zS-1-5-18zLocal SystemzS-1-5-19zS-1-5-20zS-1-5-32-544ÚAdministratorszS-1-5-32-545ÚUserszS-1-5-32-546ÚGuestszS-1-5-32-547zPower UserszS-1-5-32-548zAccount OperatorszS-1-5-32-549zServer OperatorszS-1-5-32-550zPrint OperatorszS-1-5-32-551zBackup OperatorszS-1-5-32-552ÚReplicatorszS-1-5-64-10zNTLM AuthenticationzS-1-5-64-14zSChannel AuthenticationzS-1-5-64-21zDigest AuthorityzS-1-5-80z
NT Servicez
S-1-5-83-0z#NT VIRTUAL MACHINE\Virtual MachineszS-1-16-0zUntrusted Mandatory LevelzS-1-16-4096zLow Mandatory LevelzS-1-16-8192zMedium Mandatory LevelzS-1-16-8448zMedium Plus Mandatory LevelzS-1-16-12288zHigh Mandatory LevelzS-1-16-16384zSystem Mandatory LevelzS-1-16-20480z!Protected Process Mandatory LevelzS-1-16-28672zSecure Process Mandatory LevelzS-1-5-32-554z*BUILTIN\Pre-Windows 2000 Compatible AccesszS-1-5-32-555zBUILTIN\Remote Desktop UserszS-1-5-32-557z&BUILTIN\Incoming Forest Trust BuilderszS-1-5-32-556z'BUILTIN\Network Configuration OperatorszS-1-5-32-558z!BUILTIN\Performance Monitor UserszS-1-5-32-559zBUILTIN\Performance Log UserszS-1-5-32-560z*BUILTIN\Windows Authorization Access GroupzS-1-5-32-561z'BUILTIN\Terminal Server License ServerszS-1-5-32-562zBUILTIN\Distributed COM UserszS-1-5-32-569zBUILTIN\Cryptographic OperatorszS-1-5-32-573zBUILTIN\Event Log ReaderszS-1-5-32-574z'BUILTIN\Certificate Service DCOM Accessz!BUILTIN\RDS Remote Access ServerszBUILTIN\RDS Endpoint ServerszBUILTIN\RDS Management ServerszBUILTIN\Hyper-V Administratorsz+BUILTIN\Access Control Assistance OperatorszBUILTIN\Remote Management Users)zS-1-5-32-575zS-1-5-32-576zS-1-5-32-577zS-1-5-32-578zS-1-5-32-579zS-1-5-32-580c                   @   s   e Zd ZdZdZdZdZdS )ÚRIGHTS_GUIDz$bf9679c0-0de6-11d0-a285-00aa003049e2z$00299570-246d-11d0-a768-00aa006e0529z$1131f6aa-9c07-11d1-f79f-00c04fc2dcd2z$1131f6ad-9c07-11d1-f79f-00c04fc2dcd2N)Ú__name__Ú
__module__Ú__qualname__ÚWriteMembersÚResetPasswordÚDS_Replication_Get_ChangesÚDS_Replication_Get_Changes_All© r&   r&   úˆ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/dacledit.pyr   „   s
    r   c                   @   sD   e Zd ZejjZejjZejjZejjZejj	Z	ejj
Z
ejjZdS )Ú	ACE_FLAGSN)r   r    r!   r   ÚACEÚCONTAINER_INHERIT_ACEÚFAILED_ACCESS_ACE_FLAGÚINHERIT_ONLY_ACEÚINHERITED_ACEÚNO_PROPAGATE_INHERIT_ACEÚOBJECT_INHERIT_ACEÚSUCCESSFUL_ACCESS_ACE_FLAGr&   r&   r&   r'   r(   Ž   s    r(   c                   @   s   e Zd ZejjZejjZdS )ÚOBJECT_ACE_FLAGSN)r   r    r!   r   ÚACCESS_ALLOWED_OBJECT_ACEÚACE_OBJECT_TYPE_PRESENTÚ!ACE_INHERITED_OBJECT_TYPE_PRESENTr&   r&   r&   r'   r1   œ   s    r1   c                   @   s\   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdS )ÚACCESS_MASKl        i   @i    i   i   i   i   i   i   i   i   é   é€   é@   é    é   é   é   é   é   N)r   r    r!   ÚGenericReadÚGenericWriteÚGenericExecuteÚ
GenericAllÚMaximumAllowedÚAccessSystemSecurityÚSynchronizeÚ
WriteOwnerÚ	WriteDACLÚReadControlÚDeleteÚAllExtendedRightsÚ
ListObjectÚ
DeleteTreeÚWritePropertiesÚReadPropertiesÚSelfÚListChildObjectsÚDeleteChildÚCreateChildr&   r&   r&   r'   r5   ¥   s*    r5   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )ÚSIMPLE_PERMISSIONSiÿ i¿ i©  iŸ i”  i¼  N)	r   r    r!   ÚFullControlÚModifyÚReadAndExecuteÚReadAndWriteÚReadÚWriter&   r&   r&   r'   rS   È   s    rS   c                   @   s<   e Zd ZejjZejjZejj	Z
ejjZejjZejjZdS )ÚALLOWED_OBJECT_ACE_MASK_FLAGSN)r   r    r!   r   r2   ÚADS_RIGHT_DS_CONTROL_ACCESSÚControlAccessÚADS_RIGHT_DS_CREATE_CHILDrR   ÚADS_RIGHT_DS_DELETE_CHILDrQ   ÚADS_RIGHT_DS_READ_PROPÚReadPropertyÚADS_RIGHT_DS_WRITE_PROPÚWritePropertyÚADS_RIGHT_DS_SELFrO   r&   r&   r&   r'   rZ   Õ   s    rZ   c                       sª   e Zd ZdZ‡ fdd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd d!„ Zd"d#„ Zd'd%d&„Z‡  ZS )(ÚDACLeditzdocstring for setrbcdc                    sX  t t| ƒ ¡  || _|| _|j| _|j| _|j| _|j| _|j	| _	|j
| _
|j| _|j| _|j| _|j| _|j| _| jrAt d¡ t d¡ t ¡ }d |_t | j| j|¡| _|jd urš|j d¡rjt|jdƒ| _n3|jdkrytjjtjj | _n$|jdkr„tjj| _n|jdkrtjj | _n|jdkr™tjj!| _nd | _| js¦| js¦| jr»|  "¡  | j#d	 j$d
 | _%tj&| j%d| _'| j	d u rÅ| jd usË| j
d ur*d}| jd uræ| j}| jj(| jj)dt*|ƒ dgd n| j
d urú| j
}| jj(|d| dgd zt+| jj,d
 d j$d
 ƒ| _	t d| j	 ¡ W d S  t-y)   t .d| ¡ t/dƒ Y d S w d S )NzQNB: objects with adminCount=1 will no inherit ACEs from their parent container/OUzInitializing domainDumper()Ú0xr:   Ú	readwriteÚwriteÚselfÚallextÚnTSecurityDescriptorr   ©ÚdataÚ ú(sAMAccountName=%s)Ú	objectSid©Ú
attributesú(distinguishedName=%s)zFound principal SID: %sz$Principal SID not found in LDAP (%s)r>   )0Úsuperrd   Ú__init__Úldap_serverÚldap_sessionÚtarget_sAMAccountNameÚ
target_SIDÚ	target_DNÚprincipal_sAMAccountNameÚprincipal_SIDÚprincipal_DNÚace_typeÚrightsÚrights_guidÚfilenameÚinheritanceÚloggingÚinfoÚdebugÚldapdomaindumpÚdomainDumpConfigÚbasepathÚdomainDumperÚdomain_dumperÚmaskÚ
startswithÚintÚ
force_maskr   r2   r_   ra   rc   r[   Ú+search_target_principal_security_descriptorÚtarget_principalÚ
raw_valuesÚ!principal_raw_security_descriptorÚSR_SECURITY_DESCRIPTORÚprincipal_security_descriptorÚsearchÚrootr
   r   ÚentriesÚ
IndexErrorÚerrorÚexit)rh   ru   rv   ÚargsÚcnfÚ_lookedup_principal©Ú	__class__r&   r'   rt   á   sn   



ÿ



€ 
"
þõzDACLedit.__init__c                 C   s   |   | jd ¡}|  |¡ d S )NÚDacl)Ú	parseDACLr“   ÚprintparsedDACL)rh   Úparsed_daclr&   r&   r'   Úread$  s   
zDACLedit.readc              	   C   s  | j dkr*| jd u r*t d| jt| jƒf ¡ | jd j 	|  
tjj| j| j¡¡ nQ| j dkrS| jd urSt d| jt| jƒf ¡ | jd j 	|  
| j| j| j¡¡ n(|  ¡ D ]#}t d| j|t| jƒf ¡ | jd j 	| j|| j| j| jd¡ qW|  ¡  |  | jj| j¡ d S )NrT   z(Appending ACE (%s --(FullControl)--> %s)rŸ   ÚCustomz#Appending ACE (%s --(Custom)--> %s)zAppending ACE (%s --(%s)--> %s)©r   )r~   r   r‚   r„   r{   r   rx   r“   ÚacesÚappendÚ
create_acerS   rT   Úvaluer}   r   Úbuild_guids_for_rightsÚcreate_object_aceÚbackupÚmodify_secDesc_for_dnr   Úentry_dn)rh   r   r&   r&   r'   rg   ,  s   &$(zDACLedit.writec           	   	   C   sV  g }| j dkr| jd u r| |  tjj| j| j¡¡ n.| j dkr3| j	d ur3| |  | j	| j| j¡¡ n|  
¡ D ]}| | j|| j| j| j	d¡ q7g }d}d}| jd jD ]¶}d}|D ]}|d |d krè|d |d krè|d	 d
 d
 |d	 d
 d
 krè|d	 d d |d	 d d krè|d	 d d |d	 d d krè|d	 d d |d	 d d krè|d	 d d d |d	 d d d krèd|d	 j ¡ v räd|d	 j ¡ v rä|d	 d |d	 d krãd}d}q[d}d}q[|sñ| |¡ nt ¡ jtjkrt d¡ |  |  |¡¡ |d7 }qU|r$|| jd _|  ¡  |  | jj| j¡ d S t d¡ d S )NrT   r¤   r¥   r   FrŸ   ÚAceTypeÚAceFlagsÚAceÚMaskÚSidÚRevisionÚSubAuthorityCountÚSubAuthorityÚIdentifierAuthorityÚValueÚ
ObjectTypeTzThis ACE will be removedr>   zNothing to remove...)r~   r   r§   r¨   rS   rT   r©   r{   r}   r   rª   r«   r“   r¦   ÚfieldsÚkeysr‚   Ú	getLoggerÚlevelÚDEBUGr„   ÚprintparsedACEÚparseACEr¬   r­   r   r®   rƒ   )	rh   Úcompare_acesr   Únew_daclÚiÚdacl_must_be_replacedÚaceÚace_must_be_removedÚcompare_acer&   r&   r'   ÚremoveB  sN    	    ($€€

zDACLedit.removec                 C   sÆ   i }t  | j¡ d¡|d< | jj|d< | js"dtj ¡  	d¡ | _nt
j | j¡r<t d| j ¡ dtj ¡  	d¡ | _t | jdd¡}t ||¡ W d   ƒ n1 sUw   Y  t d| j¡ d S )	Núutf-8ÚsdÚdnzdacledit-%s.bakz%Y%m%d-%H%M%SzNFile %s already exists, I'm refusing to overwrite it, setting another filenameÚwzDACL backed up to %s)ÚbinasciiÚhexlifyr‘   Údecoder   r®   r€   ÚdatetimeÚnowÚstrftimeÚosÚpathÚexistsr‚   rƒ   ÚcodecsÚopenÚjsonÚdump)rh   r¬   Úoutfiler&   r&   r'   r¬   |  s   ÿzDACLedit.backupc                 C   sÒ   t  | jdd¡}t |¡}d| ¡ v sJ ‚d| ¡ v sJ ‚W d   ƒ n1 s(w   Y  t |d  d¡¡}t	j
|d}|d | _|  ¡  | jd jd | _t	j
| jd| _|  ¡  t d¡ |  | j|¡ d S )	NÚrrÉ   rÊ   rË   rk   rj   r   zRestoring DACL)rÖ   r×   r€   rØ   Úloadr»   rÍ   Ú	unhexlifyÚencoder   r’   ry   rŽ   r   r   r‘   r“   r¬   r‚   rƒ   r­   )rh   ÚinfileÚrestoreÚnew_raw_security_descriptorÚnew_security_descriptorr&   r&   r'   rà   Œ  s   
ý

zDACLedit.restorec                 C   sê   d}t dd}| jd ur!| j}| jj| jjdt|ƒ dg|d n-| jd ur9| j}| jj| jjd| dg|d n| jd urN| j}| jj|d| dg|d z| jj	d	 | _
t d
| ¡ W d S  tyt   t d| ¡ td	ƒ Y d S w )Nrm   r<   ©Úsdflagsrn   rj   )rq   Úcontrolsú(objectSid=%s)rr   r   z#Target principal found in LDAP (%s)z'Target principal not found in LDAP (%s))r   rw   rv   r”   r‰   r•   r
   rx   ry   r–   r   r‚   r„   r—   r˜   r™   )rh   rœ   rå   r&   r&   r'   rŽ   £  s$   

$
 
þz4DACLedit.search_target_principal_security_descriptorc                 C   sv   | j j| jjdt|ƒ dgd z| j jd j}t| j jd d jd ƒ}||fW S  t	y:   t
 d| ¡ Y dS w )Nrn   ro   rp   r   zUser not found in LDAP: %sF)rv   r”   r‰   r•   r
   r–   r®   r   r   r—   r‚   r˜   )rh   ÚsamnamerË   Úsidr&   r&   r'   Úget_user_info»  s    
þzDACLedit.get_user_infoc                 C   sx   |t  ¡ v r
t | S | jj| jjd| dgd z| jjd j}| jjd d }|W S  ty;   t	 
d| ¡ Y dS w )Nræ   Úsamaccountnamerp   r   zSID not found in LDAP: %srm   )ÚWELL_KNOWN_SIDSr»   rv   r”   r‰   r•   r–   r®   r—   r‚   r„   )rh   rè   rË   rç   r&   r&   r'   Ú
resolveSIDÈ  s   þzDACLedit.resolveSIDc                 C   s@   g }t  d¡ d}|d D ]}|  |¡}| |¡ |d7 }q|S )NzParsing DACLr   ÚDatar>   )r‚   rƒ   rÀ   r§   )rh   Údaclr¢   rÃ   rÅ   Ú
parsed_acer&   r&   r'   r    Ú  s   



zDACLedit.parseDACLc                 C   sZ   g }t D ]}||j@ |jkr| |j¡ ||j @ }qtD ]}||j@ r*| |j¡ q|S ©N)rS   r©   r§   Únamer5   )rh   ÚfsrÚ_permsÚPERMr&   r&   r'   Ú
parsePermsè  s   €
€zDACLedit.parsePermsc           	      C   sÆ  |d dv r-i }|d |d< g }t D ]}| |j¡r!| |j¡ qd |¡p(d|d< |d dv rfdd |  |d	 d
 d
 ¡¡|d	 d
 d
 f |d< d|  |d	 d  ¡ ¡pXd|d	 d  ¡ f |d< |S |d dv r+g }t	D ]}|d	 d
  
|j¡rƒ| |j¡ qqdd |¡|d	 d
 d
 f |d< g }tD ]}|d	  |j¡r©| |j¡ q™d |¡p°d|d< |d	 d dkrát|d	 d ƒ ¡ }zdt| |f |d< W n tyà   d| |d< Y nw |d	 d dkrt|d	 d ƒ ¡ }zdt| |f |d< W n ty   d| |d< Y nw d|  |d	 d  ¡ ¡pd|d	 d  ¡ f |d< |S t d|d  ¡ i }|d |d< g }t D ]}| |j¡rQ| |j¡ qBd |¡pZd|d< d|d< |S )NÚTypeName)ÚACCESS_ALLOWED_ACEr2   ÚACCESS_DENIED_ACEÚACCESS_DENIED_OBJECT_ACEzACE Typez, ÚNonez	ACE flags)r÷   rø   z	%s (0x%x)r±   r²   zAccess maskz%s (%s)r³   ÚUNKNOWNúTrustee (SID))r2   rù   ÚFlagsÚObjectTypeLenr   r¹   zObject type (GUID)zUNKNOWN (%s)ÚInheritedObjectTypeLenÚInheritedObjectTypezInherited type (GUID)zBACE Type (%s) unsupported for parsing yet, feel free to contributezACE typezLACE type not supported for parsing by dacleditor.py, feel free to contributer¾   )r(   ÚhasFlagr©   r§   rñ   Újoinrõ   rì   ÚformatCanonicalrZ   ÚhasPrivr1   r   ÚlowerÚOBJECT_TYPES_GUIDÚKeyErrorr‚   r„   )	rh   rÅ   rï   Ú
_ace_flagsÚFLAGÚ_access_mask_flagsÚ_object_flagsÚobj_typeÚinh_obj_typer&   r&   r'   rÀ   ö  sj   €42,×€"€ÿÿ4÷€zDACLedit.parseACEc                 C   sz  | j d u r| js| jrb| jd ur$| j}| jj| jjdt|ƒ dgd n| jd ur8| j}| jj|d| dgd zt| jj	d d j
d ƒ| _ W n tyY   t d| ¡ Y dS w t d| j  ¡ t d	¡ d}| j d urvt d
| j  ¡ |D ]B}d}| j d ur¦z| j |d vr‹d}W n ty¥ } zt d| ¡ W Y d }~nd }~ww |r¶t dd | ¡ |  |¡ |d7 }qxd S )Nrn   ro   rp   rr   r   z Principal not found in LDAP (%s)Fz*Found principal SID to write in ACE(s): %szPrinting parsed DACLzFiltering results for SID (%s)Trü   zRError filtering ACE, probably because of ACE type unsupported for parsing yet (%s)z  %-28szACE[%d] infor>   )r{   rz   r|   rv   r”   r‰   r•   r
   r   r–   r   r—   r‚   r˜   r„   rƒ   Ú	Exceptionr¿   )rh   r¢   rœ   rÃ   rï   Ú	print_aceÚer&   r&   r'   r¡   7  sD   
"
 þ


€€ÿ

õzDACLedit.printparsedDACLc                 C   s0   t | ¡ ƒ}|D ]}t d||| f ¡ qd S )Nz    %-26s: %s)Úlistr»   r‚   rƒ   )rh   rï   Úelements_nameÚ	attributer&   r&   r'   r¿   \  s   ÿzDACLedit.printparsedACEc                 C   sn   g }| j d ur| j g}n#| jdkrtjjg}n| jdkr"tjjg}n| jdkr/tjjtjjg}t 	d|¡ |S )Nr"   r#   ÚDCSynczBuilt GUID: %s)
r   r~   r   r"   r©   r#   r$   r%   r‚   r„   )rh   Ú_rights_guidsr&   r&   r'   rª   c  s   




zDACLedit.build_guids_for_rightsc                 C   sÀ   |  ¡ }tdd}t d¡ | jj|dtj|gfi|d | jjd dkr,t 	d¡ d S | jjd d	kr@t 
d
| jjd ¡ d S | jjd dkrTt 
d| jjd ¡ d S t 
d| jjd ¡ d S )Nr<   rã   z+Attempts to modify the Security Descriptor.rj   )rå   Úresultr   zDACL modified successfully!é2   zCCould not modify object, the server reports insufficient rights: %sÚmessageé   zGCould not modify object, the server reports a constrained violation: %sz The server returned an error: %s)ÚgetDatar   r‚   r„   rv   ÚmodifyÚldap3ÚMODIFY_REPLACEr  rƒ   r˜   )rh   rË   ÚsecDescrl   rå   r&   r&   r'   r­   u  s   


ÿ
ÿzDACLedit.modify_secDesc_for_dnc                 C   s¦   t  ¡ }|dkrt jj|d< t  ¡ }n
t jj|d< t  ¡ }| jr+t jjt jj |d< nd|d< t  ¡ |d< ||d d< t  	¡ |d< |d  
|¡ ||d< t d¡ |S )	NÚallowedr¯   r°   r   r²   r³   r±   zACE created.)r   r)   r÷   ÚACE_TYPErø   r   r/   r*   r5   ÚLDAP_SIDÚfromCanonicalr‚   r„   )rh   Úaccess_maskrè   r}   ÚnaceÚacedatar&   r&   r'   r¨   Œ  s    

zDACLedit.create_aceNc                 C   s  t  ¡ }|dkrt jj|d< t  ¡ }n
t jj|d< t  ¡ }| jr+t jjt jj |d< nd|d< t  ¡ |d< |d ur@||d d< n|t	j
jkrSt jjt jj |d d< nt jj|d d< t|ƒ|d< d|d< t  ¡ |d	< |d	  |¡ ||d	  ¡ ks|J ‚t jj|d
< ||d< t d¡ |S )Nr  r¯   r°   r   r²   r¹   ó    r   r³   rý   r±   zObject-specific ACE created.)r   r)   r2   r   rù   r   r/   r*   r5   r   r"   r©   r_   ra   r[   r   r!  r"  r  r3   r‚   r„   )rh   Úprivguidrè   r}   r   r$  r%  r&   r&   r'   r«   §  s0   

zDACLedit.create_object_acerð   )r   r    r!   Ú__doc__rt   r£   rg   rÈ   r¬   rà   rŽ   ré   rì   r    rõ   rÀ   r¡   r¿   rª   r­   r¨   r«   Ú__classcell__r&   r&   r   r'   rd   Þ   s(    C:A%rd   c                  C   s   t jddd} | jdddd | jdd	d
d | jdd	dd | jdd	dd |  d¡}|jddddd |jdd	dd |jdd	dd |jddddd |jddddd |jdddd d | jd!d"d#}|jd$d%d&td'd(d) |jd*d+d,td'd-d) |jd.d/d0td'd1d) | jd2d3d#}|jd4d5d&td'd(d) |jd6d7d,td'd-d) |jd8d9d0td'd1d) |  d:¡}|jd;g d<¢d=d>d?d@ |jdAdBtdCdD |jdEdFdGgd=dFdHd@ |jdIg dJ¢d=dKdLd@ |jdMtdNdO |jdPd=d dQdR |jdSd	dTd ttjƒdUkr|  ¡  t 	dU¡ |  
¡ S )VNTz%Python editor for a principal's DACL.)Úadd_helpÚdescriptionÚidentityÚstorez domain.local/username[:password])ÚactionÚhelpz
-use-ldapsÚ
store_truezUse LDAPS instead of LDAPz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONzauthentication & connectionz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r.  Úmetavarr/  z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addressz¤IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameterz-dc-hostÚhostnamezpHostname of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted, -dc-ip will be usedÚ	principalzgObject, controlled by the attacker, to reference in the ACE to create or to filter when printing a DACL)r+  z
-principalrz   ÚNAMEFÚsAMAccountName)Údestr1  ÚtypeÚrequiredr/  z-principal-sidr{   ÚSIDzSecurity IDentifierz-principal-dnr|   ÚDNzDistinguished NameÚtargetz)Principal object to read/edit the DACL ofz-targetrw   z-target-sidrx   z
-target-dnry   zdacl editorz-action)r£   rg   rÈ   r¬   rà   ú?r£   zAction to operate on the DACL)ÚchoicesÚnargsÚdefaultr/  z-filer€   zCFilename/path (optional for -action backup, required for -restore)))r6  r7  r/  z	-ace-typer  ÚdeniedzXThe ACE Type (access allowed or denied) that must be added or removed (default: allowed)z-rights)rT   r#   r"   r  r¤   rT   z@Rights to write/remove in the target DACL (default: FullControl)z-rights-guidz2Manual GUID representing the right to write/remove)r7  r/  z-maskz£Force access mask, possible values: readwrite, write, self, allext, 0xXXXXX. Useful with -rights Custom or --rights-guid where the mask is different of read+write.)r>  r?  r/  z-inheritancezáEnable the inheritance in the ACE flag with CONTAINER_INHERIT_ACE and OBJECT_INHERIT_ACE. Useful when target is a Container or an OU, ACE will be inherited by objects within the container/OU (except objects with adminCount=1)r>   )ÚargparseÚArgumentParserÚadd_argumentÚadd_argument_groupÚstrÚlenÚsysÚargvÚ
print_helpr™   Ú
parse_args)ÚparserÚauth_conÚprincipal_parserÚtarget_parserÚdacl_parserr&   r&   r'   rJ  Ë  s@   


rJ  c            
      C   s¶  t tjƒ tƒ } t | j| j¡ | jdkr.| j	d u r.| j
d u r.| jd u r.t d¡ t d¡ | jdkr;| js;t d¡ t| j| j| j| j| jƒ\}}}}}| _zet|||||| j| j| j| j| jƒ
\}}t||| ƒ}| jdkrv| ¡  W d S | jdkr‚| ¡  W d S | jdkrŽ| ¡  W d S | jdkrš| ¡  W d S | jd	kr¦|  ¡  W d S | jdkr²| !¡  W d S W d S  t"yÚ }	 zt #¡ j$tj%krÈt& '¡  t (t)|	ƒ¡ W Y d }	~	d S d }	~	ww )
Nrg   zY-principal, -principal-sid, or -principal-dn should be specified when using -action writer>   rà   z,-file is required when using -action restorer£   rÈ   Úflushr¬   )*Úprintr   ÚBANNERrJ  r   ÚinitÚtsr„   r.  rz   r{   r|   r‚   ÚcriticalrG  r™   r€   r   r,  ÚhashesÚno_passÚaesKeyÚkr   Údc_ipÚdc_hostÚ	use_ldapsrd   r£   rg   rÈ   rP  r¬   rà   r  r¼   r½   r¾   Ú	tracebackÚ	print_excr˜   rE  )
rš   ÚdomainÚusernameÚpasswordÚlmhashÚnthashru   rv   Údacleditr  r&   r&   r'   Úmainõ  s>   
(


((





ÿ€ýre  Ú__main__)1rA  rÍ   rÖ   rØ   r‚   rÓ   rG  r]  rÐ   r  r…   Úenumr   Ú$ldap3.protocol.formatters.formattersr   Úimpacketr   Úimpacket.examplesr   r   Úimpacket.ldapr   Úimpacket.msada_guidsr   r	   Úldap3.utils.convr
   Úldap3.protocol.microsoftr   Úimpacket.uuidr   r   Úimpacket.examples.utilsr   r   r  Úupdaterë   r   r(   r1   r5   rS   rZ   Úobjectrd   rJ  re  r   r&   r&   r&   r'   Ú<module>   sn  

ÿþýüûúùø	÷
öõôóòñðïîíìëêéèçæåäãâá à!ß"Þ#Ý$Ü%Û&Ú'Ù(Ø)×*Ö+Õ,Ô-Ó.Ò/Ñ0Ð1Ï2Î3Í4Ì5Ë6Ê7É8È9Ç:Æ;Å<Ä=Ã>Â?Á@ÀA¿B¾C½D¼E¶Q
	#	   p*
#
ÿ