{"id":8703,"date":"2021-07-15T19:15:37","date_gmt":"2021-07-15T17:15:37","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8703"},"modified":"2021-07-15T19:15:39","modified_gmt":"2021-07-15T17:15:39","slug":"sddl-security-descriptors","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/cisco-and-networking\/sddl-security-descriptors\/","title":{"rendered":"SDDL Security Descriptors"},"content":{"rendered":"\n

Some notes to myself to use as a reference guide and to gain a better understanding of the privileges and rights assigned to Windows services in the form of SDDL security descriptor strings finally today became useful to solve a problem of a Good friend and college of mine (Dear Vanik). maybe in other post going to explain and write-up the solution for that specific case, but anyway the solution need to have good understanding of SDDL, stay with me till end of this post, you will find it very useful later \ud83d\ude09 .<\/p>\n\n\n\n

SDDL<\/h2>\n\n\n\n

The Windows Security Descriptor Definition Language defines the string format used to describe a security descriptor as a text string, commonly used to define an ACL (list of ACEs) for a Windows service.<\/p>\n\n\n\n

Take the following userlogger<\/code> service from an old Hack The Box machine:<\/p>\n\n\n\n

C:\\util> sc qc userlogger\nsc qc userlogger\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: userlogger\n        TYPE               : 10  WIN32_OWN_PROCESS \n        START_TYPE         : 3   DEMAND_START\n        ERROR_CONTROL      : 1   NORMAL\n        BINARY_PATH_NAME   : c:\\windows\\system32\\UserLogger.exe\n        LOAD_ORDER_GROUP   : \n        TAG                : 0\n        DISPLAY_NAME       : User Logger\n        DEPENDENCIES       : \n        SERVICE_START_NAME : LocalSystem\n<\/code><\/pre>\n\n\n\n
The SERVICE_START_NAME<\/code> defines the privileges with which the service runs, in this instance it\u2019s LocalSystem<\/code>, or in other words NT AUTHORITY\\SYSTEM<\/code>.<\/p>\n\n\n\n
We can request the SDDL string applied to the userlogger<\/code> service using the following command:<\/p>\n\n\n\n
C:\\util> sc sdshow userlogger\nD:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;BU)(A;;CCLCSWRPWPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU) \n<\/code><\/pre>\n\n\n\n
ACE Structure<\/h3>\n\n\n\n
\n\n\n\n
The ACEs in a SDDL string are enclosed in parentheses, the userlogger<\/code> service therefore contains six ACEs. One of them is shown below:<\/p>\n\n\n\n
(A;;CCLCSWRPWPDTLOCRRC;;;SY)\n<\/code><\/pre>\n\n\n\n
Each ACE contains five semi-colon terminated strings, followed by the SID for whom the ACE applies. The structure is as follows with each section labelled:<\/p>\n\n\n\n
(ace_type; ace_flags; rights; object_guid; inherit_object_guid; account_sid)\n<\/code><\/pre>\n\n\n\n
For this individual ACE only the ace_type<\/code> and rights<\/code> are set and are applied to SY<\/code> which represents LocalSystem<\/code>, meaning this ACE is assigned to NT AUTHORITY\\SYSTEM<\/code>.<\/p>\n\n\n\n
The account_sid<\/code> has a set of predefined values. You have the option of supplying a specific SID into the account_sid<\/code> field when configuring an ACE:<\/p>\n\n\n\n
(A;;CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003)\n<\/code><\/pre>\n\n\n\n
The account_sid<\/code> identifies the trustee of the ACE. The SID in this ACE applies to the hacker<\/code> user from the box.<\/p>\n\n\n\n
Decoding<\/h3>\n\n\n\n
\n\n\n\n
The userlogger<\/code> service security descriptor:<\/p>\n\n\n\n
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;BU)(A;;CCLCSWRPWPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU) \n<\/code><\/pre>\n\n\n\n
The service\u2019s SDDL only contains a DACL, defined by the D:<\/code> at the start of the string. The string can be prefixed with any of the following symbols:<\/p>\n\n\n\n
Symbol<\/th>Description<\/th><\/tr><\/thead>
O:<\/td>Owner<\/td><\/tr>
G:<\/td>Primary Group<\/td><\/tr>
D:<\/td>Discretionary Access Control List (DACL)<\/td><\/tr>
S:<\/td>System Access Control List (SACL)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
The first value of the user\u2019s ACE – A<\/code> – in (A;;CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003)<\/code> is defined as the ace_type<\/code>, a table containing different ace_type<\/code> values is shown below:<\/p>\n\n\n\n
ACE Type<\/th>Description<\/th><\/tr><\/thead>
A<\/td>Access Allowed<\/td><\/tr>
D<\/td>Access Denied<\/td><\/tr>
OA<\/td>Object Access Allowed<\/td><\/tr>
OD<\/td>Object Access Denied<\/td><\/tr>
AU<\/td>System Audit<\/td><\/tr>
AL<\/td>System Alarm<\/td><\/tr>
OU<\/td>System Object Audit<\/td><\/tr>
OL<\/td>System Object Alarm<\/td><\/tr>
ML<\/td>System Mandatory Label<\/td><\/tr>
SP<\/td>Central Policy ID<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
After the A;;<\/code> (the double semi-colon implies there are no ace_flags<\/code> assigned) comes the following string – CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003<\/code>.<\/p>\n\n\n\n
Ignoring the user\u2019s SID (we know that the object_guid<\/code> and inherit_object_guid<\/code> values are empty and the trustee is hacker<\/code>) for now we\u2019re left with CCLCSWRPWPDTLORC<\/code>.<\/p>\n\n\n\n
The letters are in pairs and each pair represents a certain right, the following rights are represented in the rights<\/code> section of the hacker<\/code> user ACE for the userlogger<\/code> service:<\/p>\n\n\n\n
Symbol<\/th>Right<\/th><\/tr><\/thead>
CC<\/td>SERVICE_QUERY_CONFIG<\/td><\/tr>
LC<\/td>SERVICE_QUERY_STATUS<\/td><\/tr>
SW<\/td>SERVICE_ENUMERATE_DEPENDENTS<\/td><\/tr>
RP<\/td>SERVICE_START<\/td><\/tr>
WP<\/td>SERVICE_STOP<\/td><\/tr>
DT<\/td>SERVICE_PAUSE_CONTINUE<\/td><\/tr>
LO<\/td>SERVICE_INTERROGATE<\/td><\/tr>
RC<\/td>READ_CONTROL<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
A table containing all of the different service DACL rights can be found here<\/a>.<\/p>\n\n\n\n
ConvertFrom-SDDLString<\/h2>\n\n\n\n
An easy way to read the security descriptor is by using the ConvertFrom-SDDLString<\/code> PowerShell cmdlet. The docs for the command can be found here<\/a>.<\/p>\n\n\n\n
The syntax is straightforward, you just parse the SDDL to the -Sddl<\/code> parameter:<\/p>\n\n\n\n
PS C:\\Users\\New> ConvertFrom-SddlString -Sddl \"D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWRPWPDTLORC;;;S-1-5-21-2115913093-551423064-1540603852-1003)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;BU)(A;;CCLCSWRPWPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)\" \n\n\nOwner            :\nGroup            :\nDiscretionaryAcl : {NT AUTHORITY\\INTERACTIVE: AccessAllowed (CreateDirectories, ExecuteKey, GenericExecute, GenericRead, GenericWrite, ListDirectory, Read,\n                   ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Traverse, WriteAttributes, WriteExtendedAttributes), NT\n                   AUTHORITY\\SERVICE: AccessAllowed (CreateDirectories, GenericExecute, ListDirectory, Read, ReadAttributes, ReadExtendedAttributes,\n                   ReadPermissions, WriteAttributes), NT AUTHORITY\\SYSTEM: AccessAllowed (CreateDirectories, DeleteSubdirectoriesAndFiles, ExecuteKey,\n                   GenericExecute, GenericRead, GenericWrite, ListDirectory, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions,\n                   Traverse, WriteAttributes, WriteExtendedAttributes), BUILTIN\\Administrators: AccessAllowed (ChangePermissions, CreateDirectories, Delete,\n                   DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory, Modify, Read,\n                   ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, Write, WriteAttributes, WriteData,\n                   WriteExtendedAttributes, WriteKey)...}\nSystemAcl        : {}\nRawDescriptor    : System.Security.AccessControl.CommonSecurityDescriptor\n<\/code><\/pre>\n\n\n\n
The ConvertFrom-SDDLString<\/code> cmdlet will not decode the ACE rights in the same manner as manually doing so with the table in the previous section. The following section explains why in more detail.<\/p>\n\n\n\n
Types<\/h3>\n\n\n\n
\n\n\n\n
The ConvertFrom-SDDLString<\/a> docs show that the -Type<\/code> flag only has the following values:<\/p>\n\n\n\n