Skip to content

Commit bfada64

Browse files
NeffIsBackNeffIsBack
committed
Formatting
1 parent 1779e84 commit bfada64

1 file changed

Lines changed: 76 additions & 84 deletions

File tree

‎nxc/modules/gpp_privileges.py‎

Lines changed: 76 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -17,87 +17,84 @@ class NXCModule:
1717
multiple_hosts = True
1818

1919
WELL_KNOWN_SIDS = {
20-
"S-1-0": "Null Authority",
21-
"S-1-0-0": "Nobody",
22-
"S-1-1": "World Authority",
23-
"S-1-1-0": "Everyone",
24-
"S-1-2": "Local Authority",
25-
"S-1-2-0": "Local",
26-
"S-1-2-1": "Console Logon",
27-
"S-1-3": "Creator Authority",
28-
"S-1-3-0": "Creator Owner",
29-
"S-1-3-1": "Creator Group",
30-
"S-1-3-2": "Creator Owner Server",
31-
"S-1-3-3": "Creator Group Server",
32-
"S-1-3-4": "Owner Rights",
33-
"S-1-5-80-0": "All Services",
34-
"S-1-4": "Non-unique Authority",
35-
"S-1-5": "NT Authority",
36-
"S-1-5-1": "Dialup",
37-
"S-1-5-2": "Network",
38-
"S-1-5-3": "Batch",
39-
"S-1-5-4": "Interactive",
40-
"S-1-5-6": "Service",
41-
"S-1-5-7": "Anonymous",
42-
"S-1-5-8": "Proxy",
43-
"S-1-5-9": "Enterprise Domain Controllers",
44-
"S-1-5-10": "Principal Self",
45-
"S-1-5-11": "Authenticated Users",
46-
"S-1-5-12": "Restricted Code",
47-
"S-1-5-13": "Terminal Server Users",
48-
"S-1-5-14": "Remote Interactive Logon",
49-
"S-1-5-15": "This Organization",
50-
"S-1-5-17": "This Organization",
51-
"S-1-5-18": "Local System",
52-
"S-1-5-19": "NT Authority",
53-
"S-1-5-20": "NT Authority",
54-
"S-1-5-32-544": "Administrators",
55-
"S-1-5-32-545": "Users",
56-
"S-1-5-32-546": "Guests",
57-
"S-1-5-32-547": "Power Users",
58-
"S-1-5-32-548": "Account Operators",
59-
"S-1-5-32-549": "Server Operators",
60-
"S-1-5-32-550": "Print Operators",
61-
"S-1-5-32-551": "Backup Operators",
62-
"S-1-5-32-552": "Replicators",
63-
"S-1-5-64-10": "NTLM Authentication",
64-
"S-1-5-64-14": "SChannel Authentication",
65-
"S-1-5-64-21": "Digest Authority",
66-
"S-1-5-80": "NT Service",
67-
"S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
68-
"S-1-16-0": "Untrusted Mandatory Level",
69-
"S-1-16-4096": "Low Mandatory Level",
70-
"S-1-16-8192": "Medium Mandatory Level",
71-
"S-1-16-8448": "Medium Plus Mandatory Level",
72-
"S-1-16-12288": "High Mandatory Level",
73-
"S-1-16-16384": "System Mandatory Level",
74-
"S-1-16-20480": "Protected Process Mandatory Level",
75-
"S-1-16-28672": "Secure Process Mandatory Level",
76-
"S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
77-
"S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
78-
"S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
79-
"S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
80-
"S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
81-
"S-1-5-32-559": "BUILTIN\\Performance Log Users",
82-
"S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
83-
"S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
84-
"S-1-5-32-562": "BUILTIN\\Distributed COM Users",
85-
"S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
86-
"S-1-5-32-573": "BUILTIN\\Event Log Readers",
87-
"S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
88-
"S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
89-
"S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
90-
"S-1-5-32-577": "BUILTIN\\RDS Management Servers",
91-
"S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
92-
"S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
93-
"S-1-5-32-580": "BUILTIN\\Remote Management Users",
94-
}
20+
"S-1-0": "Null Authority",
21+
"S-1-0-0": "Nobody",
22+
"S-1-1": "World Authority",
23+
"S-1-1-0": "Everyone",
24+
"S-1-2": "Local Authority",
25+
"S-1-2-0": "Local",
26+
"S-1-2-1": "Console Logon",
27+
"S-1-3": "Creator Authority",
28+
"S-1-3-0": "Creator Owner",
29+
"S-1-3-1": "Creator Group",
30+
"S-1-3-2": "Creator Owner Server",
31+
"S-1-3-3": "Creator Group Server",
32+
"S-1-3-4": "Owner Rights",
33+
"S-1-5-80-0": "All Services",
34+
"S-1-4": "Non-unique Authority",
35+
"S-1-5": "NT Authority",
36+
"S-1-5-1": "Dialup",
37+
"S-1-5-2": "Network",
38+
"S-1-5-3": "Batch",
39+
"S-1-5-4": "Interactive",
40+
"S-1-5-6": "Service",
41+
"S-1-5-7": "Anonymous",
42+
"S-1-5-8": "Proxy",
43+
"S-1-5-9": "Enterprise Domain Controllers",
44+
"S-1-5-10": "Principal Self",
45+
"S-1-5-11": "Authenticated Users",
46+
"S-1-5-12": "Restricted Code",
47+
"S-1-5-13": "Terminal Server Users",
48+
"S-1-5-14": "Remote Interactive Logon",
49+
"S-1-5-15": "This Organization",
50+
"S-1-5-17": "This Organization",
51+
"S-1-5-18": "Local System",
52+
"S-1-5-19": "NT Authority",
53+
"S-1-5-20": "NT Authority",
54+
"S-1-5-32-544": "Administrators",
55+
"S-1-5-32-545": "Users",
56+
"S-1-5-32-546": "Guests",
57+
"S-1-5-32-547": "Power Users",
58+
"S-1-5-32-548": "Account Operators",
59+
"S-1-5-32-549": "Server Operators",
60+
"S-1-5-32-550": "Print Operators",
61+
"S-1-5-32-551": "Backup Operators",
62+
"S-1-5-32-552": "Replicators",
63+
"S-1-5-64-10": "NTLM Authentication",
64+
"S-1-5-64-14": "SChannel Authentication",
65+
"S-1-5-64-21": "Digest Authority",
66+
"S-1-5-80": "NT Service",
67+
"S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines",
68+
"S-1-16-0": "Untrusted Mandatory Level",
69+
"S-1-16-4096": "Low Mandatory Level",
70+
"S-1-16-8192": "Medium Mandatory Level",
71+
"S-1-16-8448": "Medium Plus Mandatory Level",
72+
"S-1-16-12288": "High Mandatory Level",
73+
"S-1-16-16384": "System Mandatory Level",
74+
"S-1-16-20480": "Protected Process Mandatory Level",
75+
"S-1-16-28672": "Secure Process Mandatory Level",
76+
"S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
77+
"S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
78+
"S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
79+
"S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
80+
"S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
81+
"S-1-5-32-559": "BUILTIN\\Performance Log Users",
82+
"S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
83+
"S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
84+
"S-1-5-32-562": "BUILTIN\\Distributed COM Users",
85+
"S-1-5-32-569": "BUILTIN\\Cryptographic Operators",
86+
"S-1-5-32-573": "BUILTIN\\Event Log Readers",
87+
"S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
88+
"S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers",
89+
"S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers",
90+
"S-1-5-32-577": "BUILTIN\\RDS Management Servers",
91+
"S-1-5-32-578": "BUILTIN\\Hyper-V Administrators",
92+
"S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators",
93+
"S-1-5-32-580": "BUILTIN\\Remote Management Users",
94+
}
9595

9696
def options(self, context, module_options):
97-
"""
98-
Define module options.
99-
- no_ldap: If set to True, disables LDAP queries for resolving SIDs.
100-
"""
97+
"""NO_LDAP If set to True, disables LDAP queries for resolving SIDs."""
10198
self.no_ldap = module_options.get("NO_LDAP", False)
10299

103100
def on_login(self, context, connection):
@@ -250,9 +247,6 @@ def initialize_ldap_connection(self, context, connection):
250247

251248
return None
252249

253-
254-
255-
256250
def resolve_sid(self, context, sid, ldap_connection):
257251
"""Resolves a SID to a human-readable name using well-known mappings or LDAP queries."""
258252
if sid in self.WELL_KNOWN_SIDS:
@@ -284,5 +278,3 @@ def resolve_sid(self, context, sid, ldap_connection):
284278
context.log.warning(f"LDAP connection not established or unbound. Returning raw SID: {sid}")
285279

286280
return sid
287-
288-

0 commit comments

Comments
 (0)