RE: RE: PLUGIN HELP [nes #BFP-98828-930]

["John Scherff" <JScherff@24hourfit.com>]

Correction: raw_dword( d: 32 ) + raw_dword( d: objRid );   

---

From: John Scherff
Sent: Thursday, May 10, 2007 5:46 PM
To: 'George A. Theall'
Cc: nessus@list.nessus.org; 'Tenable Support - Nessus'
Subject: RE: PLUGIN HELP [nes #BFP-98828-930]

Okay, George, I figured it out.

 

The SIDs for Local built-in groups do not contain a host or domain SID component.  They are "well-known" SIDs.  For example, the SID for a user account with a RID of 1007 may look something like S-1-5-21-1277933745-1127690641-2306662984-1007 (with everything between 21 and 1007 belonging to the host or domain SID), while the SID for the built-in group Backup Operators (RID 551) will always be S-1-5-32-551 on every host.

 

Obviously, joining the host SID to the group RID and then looking it up with LsaLookupSid will not work for local built-in groups.

 

Instead, we need to convert this directly to a raw byte string (see http://support.microsoft.com/kb/243330 and http://blogs.msdn.com/oldnewthing/archive/2004/03/15/89753.aspx):

 

  The revision (1): 01
  The number of dashes (4) minus two (2): 02
  Six-byte big-endian hex value for 5: 000000000005
  Four-byte little-endian hex value for 32: 20000000
  Four-byte little-endian hex value for the RID: 27020000

 

Which becomes:

 

  01020000000000052000000027020000

 

Calling my getObjectName on this value does, indeed, produce "Backup Operators."

 

The range of well-known RIDS for built-in local groups is 544 through 561, so modifying my getObjectSid function as follows produces a correct raw object SID value regardless of the object type:

 

  function getObjectSid ( hostSid, objRid ) {
    local_var objSid;
    if( objRid >= 544 && objRid <= 561 ) {
      objSid = raw_string(0x01,0x02,0x00,0x00,0x00,0x00,0x00,0x05 ) +
        raw_dword( 32 ) + raw_dword( objRid );
    } else {
      hostSid = hex2raw2( s: hostSid );
      objSid = hostSid[0] + raw_byte( b: ord( hostSid[1] ) +1 ) +
        substr( hostSid, 2, strlen( hostSid ) -1 ) + raw_dword( d: objRid );
    }
    return objSid;
  }

 

Passing this to my getObjectName function produces the correct object name - again, regardless of object type:

 

  function getObjectName ( lsaHandle, objSid ) {
    local_var objSids, objNames, objInfo;
    objSids = NULL; objSids[0] = objSid;
    objNames = LsaLookupSid( handle: lsaHandle, sid_array: objSids );
    if( !isnull( objNames ) ) objInfo = parse_lsalookupsid( data: objNames[0] );
    return objInfo[2];
  }

 

Thanks again for the tips, George.

 

Regards,

 

John Scherff

Sr. IT Security Engineer

24 Hour Fitness
 

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus