Timothy Pearson
12 years ago
parent
760c8abb53
commit
2a8d25d3bd
Binary file not shown.
@ -0,0 +1,295 @@
|
||||
// sspap3registrypermissions.cpp : Defines the entry point for the console application.
|
||||
//
|
||||
|
||||
#include "stdafx.h"
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <aclapi.h>
|
||||
|
||||
#define RTN_OK 0
|
||||
#define RTN_ERROR 13
|
||||
|
||||
void
|
||||
DisplayWinError(
|
||||
LPSTR szAPI, // pointer to Ansi function name
|
||||
DWORD dwError // DWORD WinError
|
||||
);
|
||||
|
||||
|
||||
int _tmain(int argc, _TCHAR* argv[])
|
||||
{
|
||||
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
|
||||
PSID pRestrictedSid = NULL;
|
||||
PSID pSystemSid = NULL;
|
||||
PSID pAdministratorsSid = NULL;
|
||||
PSID pEveryoneSid = NULL;
|
||||
SECURITY_DESCRIPTOR sd;
|
||||
PACL pDacl = NULL;
|
||||
DWORD dwAclSize;
|
||||
DWORD sidSize;
|
||||
HKEY hKey;
|
||||
LONG lRetCode;
|
||||
BOOL bSuccess = FALSE; // assume this function fails
|
||||
|
||||
//
|
||||
// open the performance key for WRITE_DAC access
|
||||
//
|
||||
lRetCode = RegOpenKeyEx(
|
||||
HKEY_CURRENT_USER,
|
||||
TEXT(""),
|
||||
0,
|
||||
WRITE_DAC,
|
||||
&hKey
|
||||
);
|
||||
|
||||
if(lRetCode != ERROR_SUCCESS) {
|
||||
DisplayWinError("RegOpenKeyEx", lRetCode);
|
||||
return RTN_ERROR;
|
||||
}
|
||||
|
||||
//
|
||||
// prepare a Sid representing the Restricted user
|
||||
//
|
||||
if(!AllocateAndInitializeSid(
|
||||
&sia,
|
||||
1,
|
||||
SECURITY_RESTRICTED_CODE_RID,
|
||||
0, 0, 0, 0, 0, 0, 0,
|
||||
&pRestrictedSid
|
||||
)) {
|
||||
DisplayWinError("AllocateAndInitializeSid SECURITY_RESTRICTED_CODE_RID", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// prepare a Sid representing the System user
|
||||
//
|
||||
if(!AllocateAndInitializeSid(
|
||||
&sia,
|
||||
1,
|
||||
SECURITY_LOCAL_SYSTEM_RID,
|
||||
0, 0, 0, 0, 0, 0, 0,
|
||||
&pSystemSid
|
||||
)) {
|
||||
DisplayWinError("AllocateAndInitializeSid SECURITY_LOCAL_SYSTEM_RID", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// prepare a Sid representing any administrator
|
||||
//
|
||||
pAdministratorsSid = (PSID)HeapAlloc(GetProcessHeap(), 0, SECURITY_MAX_SID_SIZE);
|
||||
if(pAdministratorsSid == NULL) goto cleanup;
|
||||
if(!CreateWellKnownSid(
|
||||
WinBuiltinAdministratorsSid,
|
||||
NULL,
|
||||
pAdministratorsSid,
|
||||
&sidSize
|
||||
)) {
|
||||
DisplayWinError("CreateWellKnownSid WinBuiltinAdministratorsSid", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// prepare a Sid representing any user
|
||||
//
|
||||
pEveryoneSid = (PSID)HeapAlloc(GetProcessHeap(), 0, SECURITY_MAX_SID_SIZE);
|
||||
if(pEveryoneSid == NULL) goto cleanup;
|
||||
if(!CreateWellKnownSid(
|
||||
WinWorldSid,
|
||||
NULL,
|
||||
pEveryoneSid,
|
||||
&sidSize
|
||||
)) {
|
||||
DisplayWinError("CreateWellKnownSid WinWorldSid", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// compute size of new acl
|
||||
//
|
||||
dwAclSize = sizeof(ACL) +
|
||||
4 * ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) ) +
|
||||
GetLengthSid(pRestrictedSid) +
|
||||
GetLengthSid(pSystemSid) +
|
||||
GetLengthSid(pAdministratorsSid) +
|
||||
GetLengthSid(pEveryoneSid) ;
|
||||
|
||||
//
|
||||
// allocate storage for Acl
|
||||
//
|
||||
pDacl = (PACL)HeapAlloc(GetProcessHeap(), 0, dwAclSize);
|
||||
if(pDacl == NULL) goto cleanup;
|
||||
|
||||
if(!InitializeAcl(pDacl, dwAclSize, ACL_REVISION)) {
|
||||
DisplayWinError("InitializeAcl", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// grant the Restricted Sid KEY_READ access to the perf key
|
||||
//
|
||||
if(!AddAccessAllowedAceEx(
|
||||
pDacl,
|
||||
ACL_REVISION,
|
||||
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
|
||||
KEY_READ,
|
||||
pRestrictedSid
|
||||
)) {
|
||||
DisplayWinError("AddAccessAllowedAce", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// grant the System Sid KEY_ALL_ACCESS access to the perf key
|
||||
//
|
||||
if(!AddAccessAllowedAceEx(
|
||||
pDacl,
|
||||
ACL_REVISION,
|
||||
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
|
||||
KEY_ALL_ACCESS,
|
||||
pSystemSid
|
||||
)) {
|
||||
DisplayWinError("AddAccessAllowedAce", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// grant the Administrators Sid KEY_ALL_ACCESS access to the perf key
|
||||
//
|
||||
if(!AddAccessAllowedAceEx(
|
||||
pDacl,
|
||||
ACL_REVISION,
|
||||
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
|
||||
KEY_ALL_ACCESS,
|
||||
pAdministratorsSid
|
||||
)) {
|
||||
DisplayWinError("AddAccessAllowedAce", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// grant the Everyone Sid KEY_ALL_ACCESS access to the perf key
|
||||
//
|
||||
if(!AddAccessAllowedAceEx(
|
||||
pDacl,
|
||||
ACL_REVISION,
|
||||
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
|
||||
KEY_ALL_ACCESS,
|
||||
pEveryoneSid
|
||||
)) {
|
||||
DisplayWinError("AddAccessAllowedAce", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if(!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION)) {
|
||||
DisplayWinError("InitializeSecurityDescriptor", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* if(!SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE)) {
|
||||
DisplayWinError("SetSecurityDescriptorDacl", GetLastError());
|
||||
goto cleanup;
|
||||
}*/
|
||||
|
||||
//
|
||||
// Unlike SetSecurityDescriptorDacl, SetNamedSecurityInfo propogates inheritance to subkeys
|
||||
// See http://comments.gmane.org/gmane.comp.python.windows/10609
|
||||
//
|
||||
if(!SetNamedSecurityInfo(L"CURRENT_USER", SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION, NULL, NULL, pDacl, NULL)) {
|
||||
DisplayWinError("SetNamedSecurityInfo", GetLastError());
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
//
|
||||
// apply the security descriptor to the registry key
|
||||
//
|
||||
lRetCode = RegSetKeySecurity(
|
||||
hKey,
|
||||
(SECURITY_INFORMATION)DACL_SECURITY_INFORMATION,
|
||||
&sd
|
||||
);
|
||||
|
||||
if(lRetCode != ERROR_SUCCESS) {
|
||||
DisplayWinError("RegSetKeySecurity", lRetCode);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
bSuccess = TRUE; // indicate success
|
||||
|
||||
cleanup:
|
||||
|
||||
RegCloseKey(hKey);
|
||||
RegCloseKey(HKEY_LOCAL_MACHINE);
|
||||
|
||||
//
|
||||
// free allocated resources
|
||||
//
|
||||
if(pDacl != NULL)
|
||||
HeapFree(GetProcessHeap(), 0, pDacl);
|
||||
|
||||
if(pRestrictedSid != NULL)
|
||||
FreeSid(pRestrictedSid);
|
||||
|
||||
if(pSystemSid != NULL)
|
||||
FreeSid(pSystemSid);
|
||||
|
||||
if(pAdministratorsSid != NULL)
|
||||
FreeSid(pAdministratorsSid);
|
||||
|
||||
if(pEveryoneSid != NULL)
|
||||
FreeSid(pEveryoneSid);
|
||||
|
||||
if(bSuccess) {
|
||||
printf("SUCCESS updating user hive security\n");
|
||||
return RTN_OK;
|
||||
} else {
|
||||
printf("ERROR updating user hive security\n");
|
||||
return RTN_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
DisplayWinError(
|
||||
LPSTR szAPI, // pointer to Ansi function name
|
||||
DWORD dwError // DWORD WinError
|
||||
)
|
||||
{
|
||||
LPSTR MessageBuffer;
|
||||
DWORD dwBufferLength;
|
||||
|
||||
//
|
||||
// TODO get this fprintf out of here!
|
||||
//
|
||||
fprintf(stderr,"%s error!\n", szAPI);
|
||||
|
||||
if(dwBufferLength=FormatMessageA(
|
||||
FORMAT_MESSAGE_ALLOCATE_BUFFER |
|
||||
FORMAT_MESSAGE_FROM_SYSTEM,
|
||||
NULL,
|
||||
dwError,
|
||||
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
|
||||
(LPSTR) &MessageBuffer,
|
||||
0,
|
||||
NULL
|
||||
))
|
||||
{
|
||||
DWORD dwBytesWritten; // unused
|
||||
|
||||
//
|
||||
// Output message string on stderr
|
||||
//
|
||||
WriteFile(
|
||||
GetStdHandle(STD_ERROR_HANDLE),
|
||||
MessageBuffer,
|
||||
dwBufferLength,
|
||||
&dwBytesWritten,
|
||||
NULL
|
||||
);
|
||||
|
||||
//
|
||||
// free the buffer allocated by the system
|
||||
//
|
||||
LocalFree(MessageBuffer);
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,36 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Text Include="ReadMe.txt" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="stdafx.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="targetver.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="stdafx.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="sspap3registrypermissions.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@ -0,0 +1,3 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
</Project>
|
||||
@ -0,0 +1,8 @@
|
||||
// stdafx.cpp : source file that includes just the standard includes
|
||||
// sspap3registrypermissions.pch will be the pre-compiled header
|
||||
// stdafx.obj will contain the pre-compiled type information
|
||||
|
||||
#include "stdafx.h"
|
||||
|
||||
// TODO: reference any additional headers you need in STDAFX.H
|
||||
// and not in this file
|
||||
@ -0,0 +1,15 @@
|
||||
// stdafx.h : include file for standard system include files,
|
||||
// or project specific include files that are used frequently, but
|
||||
// are changed infrequently
|
||||
//
|
||||
|
||||
#pragma once
|
||||
|
||||
#include "targetver.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <tchar.h>
|
||||
|
||||
|
||||
|
||||
// TODO: reference additional headers your program requires here
|
||||
@ -0,0 +1,8 @@
|
||||
#pragma once
|
||||
|
||||
// Including SDKDDKVer.h defines the highest available Windows platform.
|
||||
|
||||
// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
|
||||
// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
|
||||
|
||||
#include <SDKDDKVer.h>
|
||||
Loading…
Reference in new issue