Saturday, July 12, 2008

More Fun with SDDL, Python Style!

NOTE: This project has been moved to Google Code so people can propose changes.



It seems like I still get a couple of hits a week from people looking for SDDLTranslate.exe, so I decided to update it. Win32::SDDL was my first and only object-oriented Perl module, but lately I've discovered that making OO modules is much easier in Python (don't get me wrong, I still love Perl, but where it's better, it's better).

So let's get down to the nitty gritty:

SDDL.py is the Python module that makes this work.

All SDDL.SDDL objects have the following attributes:

sddl_string: the SDDL string that was passed to initialize the object.
target: If the target is a service, set this to 'service'
sddl_type: the type of string, D (DACL), S (SACL)
acl: a list of SDDL.ACE objects representing Access Control Entries if the type is DACL or SACL, empty if the type is Owner or Group
owner_sid: the sid of the owner
owner_account: the account name of the owner
group_sid: the sid of the group
group_account: the account name of the group
ACCESS: a dictionary of constants used in SDDL, updated to reflect the target type

All SDDL.ACE objects in the acl attribute have the following attributes:

ace_string: the string contained between the parentheses before parsing
flags: the translated flags indicated in the ace_string. Usually blank.
perms: the translated perms indicated in the ace_string.
ace_type: allow, deny, etc.
object_type: can be the GUID of the object type. Usually blank.
inherited_type: GUID of object types inherited. Usually blank.
trustee: The credential being allowed or denied access. This is either translated from one of the constants or obtained by converting the SID string in the ace_string to an account name.

The new version of SDDLTranslate now handles SDDL strings in the format O: and G: as well as the DACL and SACL formats.

You will need to install Python if you haven't already. I recommend ActivePython. You'll also want to download Tim Golden's wmi module.

In case you missed the links, that's:


and



Note: I don't have a good replacement for PerlApp that works with Python, so I'll only be releasing the .py files. If you want, you can use py2exe to convert the program to a packaged EXE, but you'll end up with a directory full of files. I do use py2exe, and it works, but I'll leave that as an exercise up to the reader. Shoot me an email if you can't get it to work and I'll help you out if I have time.

Labels: , , ,

Wednesday, June 04, 2008

The Living Room

As I trudged up the steps to our apartment door, I wished I wasn't so tired, because I thought that I would get a chance to hang out with you.  I'd left work a little early because we hadn't really hung out in a while, and I was thinking maybe we could go to a movie or something.  It seemed a little weird that the door was locked because I knew I'd seen your car in the carport. 

As the door swung open, I knew something was wrong.  The speaker stands in the living room were knocked over, and the ottoman was upside-down across part of the couch.  Everything was knocked over, and I started to look around to see what was missing, because I was sure we'd been robbed.



I knew you were pretty down after losing your job, and lately at night you were always wanting to go out to a bar (and drink) or go out to play pool (and drink) with your boyfriend, and then you guys would stop by the house (and drink).  Don't get me wrong, I liked drinking with you most of the time.  We had a lot of fun playing Dance Dance Revolution or watching TV or just hanging out, but it had really started to escalate lately.  I'd go to bed with you begging me to stay up and drink more, and you were always trying to make my drinks stronger, and I knew it was because you felt guilty about drinking so much more than anyone else.  

As more time passed it got to the point where you couldn't drink without having a panic attack or waking me up in the middle of the night so you could cry about nothing in particular, and every time you would try to find some way to make it look like our problems were the same.  You kept asking me questions about my own issues with depression, and it made me uncomfortable because you were asking me for an answer to your problems that I couldn't give you.  One night you got so drunk that you pissed on yourself and spent the night writhing on the floor, and that's when I got really scared.

Amazing as it may seem, this had all escalated slowly enough that I still hadn't put my finger completely on what was bothering me up to that point except for being very concerned about you and feeling more and more distant and unhappy.  Maybe I was already letting my guilt over drinking with you block me from seeing what was going on.

 


With my second step into the door I noticed nothing seemed to be missing, and I decided we hadn't been robbed or vandalized because the front door wouldn't have been locked.  A disconcerting anxiety had just started to twist my diaphragm when I saw the blood.  There were several large stains on the carpet, and a 10-inch cooking knife was on the table, bent at a right angle and covered with blood.  The first bubbles of panic shook loose from my stomach, but I quelled it quickly, and that's when I realized that I'd already decided that something bad had happened to you.  I was in emergency management mode, thinking quickly, and not allowing myself to panic, and it was probably the right thing to do, but it meant that I already had no hope that you were okay.  I tried to call you, but I could hear your phone ringing from behind the couch cushions.  I tried to call your boyfriend over and over, but he wasn't answering.  He had one of those stupid voice mail messages that tricks you into thinking he's answering the phone, and it made me wish he was here so I could throw my phone at him.

There was no one to help me and I needed something to go on, so I turned back to the living room for clues.  I found a utility knife with the blade sticking out and a smeared, bloody handprint on the floor that I hadn't noticed before.  If something had happened then why didn't you call me?  What if you'd been kidnapped?  I called all of the local hospitals and they all said there was no one with your name there.  

Finally I gave up and called our parents.  Mom answered the phone and I explained the situation.  I was hoping that you'd had to go to the hospital, and that maybe you only had time to call Mom, but instead I had to be the one to tell her that the house was messed up, and there was blood, and a knife, and I had no idea what had happened.  When Mom suggested that I call 911 and find out if there was a call from the house I felt like an idiot.  Why didn't I do that before?

One call to 911 verified that a female had been picked up after trying to commit suicide and had been taken to the hospital.  It felt so wrong to feel so relieved about that, but I was so glad you were safe.  After hanging up I realized that I had no idea how to get there, so I called the hospital where you were staying, but they told me that you weren't there.  I knew you were there, but nobody could find your name on any of the admission records.  I called the hospital over and over.  One time the nurse said, "That's funny, she's had a lot of people call for her, but I don't see here name anywhere."

An hour had passed by the time I realized that you were registered under your married name.  You'd been separated for a year and were never planning on getting back together, so I'd totally forgotten that your driver's license still had it.  I called, got directions to the Emergency Room you were in and sped down the highway to be with you.  On the trip over a nurse from the hospital called me on my cell phone to tell me you were in the Emergency Room and that you'd asked for me.  Great.

 


Getting someone from security to let me into the emergency room took an infuriatingly long time, and by the time I got through those double-doors it was all I could do not to break into a run, and the only thing holding me back was the fear that someone would stop me if I did.   I don't know what my face must have looked like when I saw you, but I was trying my best to look stoic.  I know I failed.  You looked terrible, and wild.  Wrists and ankles were shackled to a gurney pushed against the wall in the hallway, and a makeshift restraint made of a bedsheet was tied around your torso to hold you down.  Your hair was flying everywhere, and your clothes were disheveled.  You had gauze around both wrists, and your sluggish movements made it obvious that you were either still very drunk, under the influence of some other medication, or both.

I was glad that I was finally there, because I felt like you would be happy to see me, and maybe I could give you some small amount of comfort.  Instead, the minute you recognized me you looked at me accusingly.  "What took you so long?  I was waiting and waiting, and you never came!"  Still in emergency mode, my jaw involuntarily loosed, and I stammered an excuse.  I don't know what I expected, but I wasn't prepared for this.  I was glad that our parents lived so far away, because I didn't want anyone else to have to go through it.

 

 

It took you a long time to fill me in.  The makeshift bedsheet restraint was tied around your ribs  because you kept trying to escape.  You'd gotten out twice and tried to cut your wounds open  again with a sign that you'd ripped off the wall.   You didn't have any stitches yet because you wouldn't let anyone touch you when you were admitted, and when the doctor finally put them in I could see that you'd cut yourself several times, and some of the wounds were so deep that I could see the fat and flesh from your arm.  A couple of the paramedics or firemen that had showed up at the house for the 911 call had been joking around with each other.  I don't know if they were really laughing about you or not, but apparenly they'd brought you in kicking and screaming, and yelling obscenities at anyone that came near.  You told me about how you'd yelled at the nurses, and when you needed to get up to go to the bathroom they'd told you to just pee on yourself.   I tried to listen sympathetically, but I it was obvious that you weren't being mistreated.  The humiliation of sobering up in a hallway and knowing that every nurse, doctor, and orderly that passed by knew you as the crazy suicide that had been brought in earlier screaming and thrashing must have been horrible, but there are some things that you can't erase, you can only survive.  That was months ago, and you still haven't survived it yet.  I've been preparing myself for the possibility that you won't.

 


A week later, when you left my house to go live with our parents, you lied to me and told me that you didn't want to live with them, then you told them that you really wanted to get away behind my back.  I'm sure you were trying to spare my feelings, but the lies only got worse and worse from that day forward.  I used to laugh about it, because your lies were so bad that anybody could see through them, and you would still lie to our faces.  You've tried to kill yourself 4 or 5 times since then, to varying degrees, by overdosing on your medication or getting stoned drunk and driving a car with two flat tires down a mountain road, or just taking off on foot through the snow.  

When you were forced to stay at the hospital I helped you get out of the mandatory suicide watch a day early in the hopes that I could get you to go to your psychiatrist, and if I'd known that you would try to pretend like you had no problem when you got out, and if I'd known that you would refuse to quit drinking, I would have asked them to keep you for longer, not shorter.  You lied to me about stupid things, and then told me about some of the lies you told your doctors.  You called me in the middle of the night over and over again, and you expected me to understand why you had to go get drunk.  You stole Mom and Dad's car and left for the weekend, and when you returned you'd crashed the car.  You moved out of their house just as they were about to have to make the painful decision to ask you to leave, and for the last six months or so you've been living with the guy you had been getting drunk with.

 


The hits just keep coming.  Every time I think I've come to terms with what you've done with your life you lie to me again, and I felt like such an idiot when I found out that you never stopped drinking when your boyfriend did.  I understand now why you stopped calling, and the truth is I'm ashamed to admit that I was relieved not to hear from you.  I hate not being able to trust anything you say, and I hate secretly fearing whenever I get a call from Mom or Dad or our brother that it's The Call, the one to tell me that you're hospitalized or dead.  I'm afraid of how angry I am that you were given everything, and you still pretend that you can just be a "normal person" and that you deserve to be able to have a drink for fun.  People always say that you have to hit rock bottom, but after having to sit with you for seven and a half hours in that hallway, I don't know what could possibly be lower without losing  you.

 


There is nothing on this Earth that I wouldn't do to help you, but there's nothing on this Earth I can do to help you.  I have to let you go, but I can't, and it rips me apart over and over.

You're my sister and I love you so very, very much.  


Labels: , ,

Wednesday, January 16, 2008

By the way, "SP" stands for Suppressive Person

Like most of the made-up words that a "certain religion" uses in order to keep the general public from understanding what's going on, SP is rather cryptic, but essentially it's someone who has been officially cast out of the Church.

Here's an example of someone's SP Declare, a document officially expelling them: http://www.holysmoke.org/cos/sp-declare-swazey.htm

Labels: ,

Wednesday, August 23, 2006

SDDL Utilities

UPDATE:  There's a new version of SDDLTranslate.  This one's in Python, and you can find it at 

http://tojo2000.com/blog/2008/07/more-fun-with-sddl-python-style.html

-----------------------------

SDDL (Security Descriptor Definition Language) may not be the most exciting thing in the world for most people, but it's something I've had to delve into because I've been trying to come up with a good solution for scanning a computer for weak service permissions. I've found several systems so far with weak service permissions that could easily allow a malicious user to take over a system. This is a huge problem, but it is not a problem that can be "fixed". Microsoft is not going to release a patch that will eliminate weak service permissions because it is not a bug. Weak service permissions happen when the creator of the service sets the permissions incorrectly on the service, either because he/she fat-fingered it or didn't realize what they were doing.

Trying to find the best way to dump service permissions, I came across SC.exe (Windows XP and Server 2003). It has an option, "sdshow", that will export the service permissions for a particular service. As an example, try typing in the following at a command prompt:

sc sdshow Spooler
(I chose Spooler because it exists on all XP/2003 systems)

You should get an SDDL string like this back:

D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)
(I cut it a little short, but it's still a valid SDDL string)

The problem with this is that it is a huge pain to figure out what you are reading even if you understand the anatomy of an SDDL string, which most people don't. That's where SDDLTranslate and SvcInfo come in, two utilities I wrote in the process of researching service permissions.

SDDLTranslate
USAGE: SDTranslate SDDL_String [-s]

SDDLTranslate takes an SDDL string as an argument and returns the corresponding access control list in human-readable format. The optional -s switch tells SDDLTranslate that the SDDL string refers to a service (some constants change their meaning when referring to a service). Let's use the SDDL string from earlier as an example:




SvcInfo
USAGE: SvcInfo

SvcInfo basically just automates the task of cycling through your services, running "SC sdshow Service", and then running SDDLTranslate on the result. Running SvcInfo will enumerate all of your services and get the security descriptor for each. Since the result typically spans many pages, it will also create the SvcInfo.log file with the output so you can view it in another program later.


Both SDDLTranslate and SvcInfo were written in Perl using a module I wrote for the purpose, Win32::SDDL. You can find Win32::SDDL on CPAN.


Click here to download SDDLTranslate.
Click here to download the source for SDDLTranslate.

Click here to download SvcInfo.
Click here to download the source for SvcInfo.

Labels: , ,