p15693087
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fix Windows file permissions checking

This commit is contained in:
shreyamalviya 2021-06-09 15:59:47 +05:30 committed by Mike Salvatore
parent 438a63b0f4
commit fcd758e24f
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
monkey/monkey_island/cc/server_utils/file_utils.py
View File

@ -9,9 +9,16 @@ def expand_path(path: str) -> str:
def has_expected_permissions(path: str, expected_permissions: int) -> bool: def has_expected_permissions(path: str, expected_permissions: int) -> bool:
if is_windows_os(): if is_windows_os():
# checks that admin has any permissions, user has `expected_permissions`,
# and everyone else has no permissions
import win32api # noqa: E402 import win32api # noqa: E402
import win32security # noqa: E402 import win32security # noqa: E402
FULL_CONTROL = 2032127
ACE_TYPE_ALLOW = 0
ACE_TYPE_DENY = 1
admins_sid, _, _ = win32security.LookupAccountName("", "Administrators") admins_sid, _, _ = win32security.LookupAccountName("", "Administrators")
user_sid, _, _ = win32security.LookupAccountName("", win32api.GetUserName()) user_sid, _, _ = win32security.LookupAccountName("", win32api.GetUserName())
@ -23,15 +30,18 @@ def has_expected_permissions(path: str, expected_permissions: int) -> bool:
for i in range(acl.GetAceCount()): for i in range(acl.GetAceCount()):
ace = acl.GetAce(i) ace = acl.GetAce(i)
sid = ace[-1] ace_type, _ = ace[0] # 0 for allow, 1 for deny
permissions = ace[1] permissions = ace[1]
sid = ace[-1]
if sid == user_sid: if sid == user_sid:
if permissions != expected_permissions: if not (permissions == expected_permissions and ace_type == ACE_TYPE_ALLOW):
return False return False
elif sid == admins_sid: elif sid == admins_sid:
continue continue
# TODO: consider removing; so many system accounts/groups exist, it's likely to fail
else: else:
if permissions != 2032127: # everyone but user & admins should have no permissions if not (permissions == FULL_CONTROL and ace_type == ACE_TYPE_DENY):
return False return False
return True return True