mirror of https://github.com/raandree/NTFSSecurity
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
151 lines
11 KiB
151 lines
11 KiB
[CmdletBinding()]
|
|
param (
|
|
[Parameter(Mandatory)] [string[]] $ModulePath,
|
|
[Parameter(Mandatory)] [string] $OutFile,
|
|
[string] $Client = 'OSWin11E',
|
|
[string] $DomainController = 'OSDC1',
|
|
[string] $FileServer = 'OSFile22',
|
|
[ValidateRange(2, 20)] [int] $Rounds = 4,
|
|
[string] $LabName = 'NtfsSecurityOsMatrixLab'
|
|
)
|
|
|
|
# Probe of the groups that a computer reports for an account that was deleted and created again with the same name (Decision 24). In each
|
|
# round it creates a user in a group that is in another group, with the same names and new SIDs, and a folder on the file server whose DACL
|
|
# grants the outer group ReadAndExecute. Then it logs the user on with Kerberos S4U, like the oracle of the live tests does, on the domain
|
|
# controller, the client, and the file server, and asks from the client, in a new process for each module, for the effective access of the
|
|
# account on the folder by name and by SID, with the default server name and with the name of the file server. -ModulePath takes module
|
|
# folders as label=path, such as baseline=C:\Build\NTFSSecurity. From the second round on, a computer that still holds the deleted account
|
|
# reports its SID, and every module reports no access (Synchronize only), whichever its version. The probe removes everything it created; the
|
|
# accounts, the folder, and the files on the client are named NtfsProbe*, so Test-MatrixCleanup.ps1 reports a leftover. The password of the
|
|
# user is random and exists only in memory. Windows PowerShell 5.1 on the Hyper-V host, with AutomatedLab.
|
|
& {
|
|
$ErrorActionPreference = 'Stop'
|
|
# -File passes an array as one string, so a list may arrive as 'A,B'.
|
|
$modules = @(
|
|
foreach ($entry in @($ModulePath | ForEach-Object -Process { $_ -split ',' } | Where-Object -FilterScript { $_ })) {
|
|
$label, $path = $entry -split '=', 2
|
|
if (-not $path -or -not (Test-Path -LiteralPath (Join-Path -Path $path -ChildPath 'NTFSSecurity.psd1'))) { throw "-ModulePath takes label=folder with a module; '$entry' has none." }
|
|
[pscustomobject]@{ Label = $label; Path = $path }
|
|
}
|
|
)
|
|
Import-Module -Name AutomatedLab -ErrorAction Stop
|
|
Import-Lab -Name $LabName -NoValidation -NoDisplay
|
|
$domainName = (Get-Lab).Domains[0].Name
|
|
$netBiosName = $domainName.Split('.')[0].ToUpperInvariant()
|
|
$dcSession = New-LabPSSession -ComputerName $DomainController
|
|
$clientSession = New-LabPSSession -ComputerName $Client
|
|
$serverSession = New-LabPSSession -ComputerName $FileServer
|
|
$machines = [ordered]@{ $DomainController = $dcSession; $Client = $clientSession; $FileServer = $serverSession }
|
|
$userName = 'NtfsProbeSubject'
|
|
$innerName = 'NtfsProbeInner'
|
|
$outerName = 'NtfsProbeOuter'
|
|
$folderName = 'NtfsProbeRecreation'
|
|
$stageName = 'C:\NtfsProbeModules'
|
|
$report = New-Object -TypeName 'System.Collections.Generic.List[string]'
|
|
$bytes = New-Object -TypeName 'byte[]' -ArgumentList 24
|
|
$generator = [Security.Cryptography.RandomNumberGenerator]::Create()
|
|
try { $generator.GetBytes($bytes) } finally { $generator.Dispose() }
|
|
# Base64 has upper case and lower case letters and digits; the suffix adds the other classes of a domain's complexity rules.
|
|
$secret = New-Object -TypeName 'System.Security.SecureString'
|
|
foreach ($character in ([Convert]::ToBase64String($bytes) + '!a1Z').ToCharArray()) { $secret.AppendChar($character) }
|
|
$secret.MakeReadOnly()
|
|
|
|
$removeOnDcScript = {
|
|
param ($User, $Inner, $Outer)
|
|
Import-Module -Name ActiveDirectory
|
|
foreach ($name in $User) { Get-ADUser -Filter "SamAccountName -eq '$name'" | Remove-ADUser -Confirm:$false }
|
|
foreach ($name in $Inner, $Outer) { Get-ADGroup -Filter "SamAccountName -eq '$name'" | Remove-ADGroup -Confirm:$false }
|
|
}
|
|
$createOnDcScript = {
|
|
param ($User, $Inner, $Outer, [securestring] $Secret)
|
|
Import-Module -Name ActiveDirectory
|
|
$null = New-ADGroup -Name $Outer -SamAccountName $Outer -GroupScope Global
|
|
$null = New-ADGroup -Name $Inner -SamAccountName $Inner -GroupScope Global
|
|
Add-ADGroupMember -Identity $Outer -Members $Inner
|
|
$null = New-ADUser -Name $User -SamAccountName $User -UserPrincipalName ('{0}@{1}' -f $User, (Get-ADDomain).DNSRoot) -AccountPassword $Secret -Enabled $true
|
|
Add-ADGroupMember -Identity $Inner -Members $User
|
|
[pscustomobject]@{ User = (Get-ADUser -Identity $User).SID.Value; Outer = (Get-ADGroup -Identity $Outer).SID.Value }
|
|
}
|
|
$setFolderScript = {
|
|
param ($Folder, $OuterSid)
|
|
$path = Join-Path -Path $env:SystemDrive -ChildPath $Folder
|
|
if (-not (Test-Path -LiteralPath $path)) { $null = New-Item -ItemType Directory -Path $path }
|
|
$acl = New-Object -TypeName 'System.Security.AccessControl.DirectorySecurity'
|
|
$acl.SetAccessRuleProtection($true, $false)
|
|
foreach ($entry in @(@('S-1-5-32-544', 'FullControl'), @('S-1-5-18', 'FullControl'), @($OuterSid, 'ReadAndExecute'))) {
|
|
$acl.AddAccessRule((New-Object -TypeName 'System.Security.AccessControl.FileSystemAccessRule' -ArgumentList ([Security.Principal.SecurityIdentifier] $entry[0]), $entry[1], 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
|
|
}
|
|
|
|
Set-Acl -LiteralPath $path -AclObject $acl
|
|
}
|
|
$tokenScript = {
|
|
param ($User, $Domain, $UserSid, $OuterSid)
|
|
try {
|
|
$identity = New-Object -TypeName 'System.Security.Principal.WindowsIdentity' -ArgumentList ('{0}@{1}' -f $User, $Domain)
|
|
$groups = @($identity.Groups | ForEach-Object -Process { $_.Value })
|
|
'S4U token of the {0} account, outer group {1}' -f $(if ($identity.User.Value -eq $UserSid) { 'CURRENT' } else { 'OLD' }), ($groups -contains $OuterSid)
|
|
}
|
|
catch { 'S4U logon failed: ' + $_.Exception.Message }
|
|
}
|
|
$effectiveScript = {
|
|
param ($ModuleFolder, $Folder, $Server, $Domain, $NetBios, $User, $UserSid)
|
|
Import-Module -Name (Join-Path -Path $ModuleFolder -ChildPath 'NTFSSecurity.psd1') -Force
|
|
$unc = '\\{0}.{1}\C$\{2}' -f $Server, $Domain, $Folder
|
|
$name = '{0}\{1}' -f $NetBios, $User
|
|
function Measure-Answer {
|
|
param ([hashtable] $Arguments)
|
|
$result = @(Get-NTFSEffectiveAccess @Arguments -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -ErrorVariable failures)
|
|
$value = if ($result.Count) { '0x{0:X}' -f ([long] $result[0].AccessRights) } else { 'none' }
|
|
if (@($failures).Count) { $value += ' ERR ' + $failures[0].Exception.Message }
|
|
$value
|
|
}
|
|
|
|
$serverName = '{0}.{1}' -f $Server, $Domain
|
|
'effective access by name {0}, by name and server {1}, by SID {2}, by SID and server {3}' -f
|
|
(Measure-Answer -Arguments @{ Path = $unc; Account = $name }),
|
|
(Measure-Answer -Arguments @{ Path = $unc; Account = $name; ServerName = $serverName }),
|
|
(Measure-Answer -Arguments @{ Path = $unc; Account = $UserSid }),
|
|
(Measure-Answer -Arguments @{ Path = $unc; Account = $UserSid; ServerName = $serverName })
|
|
}
|
|
$runEffectiveScript = {
|
|
param ($Stage, $ModuleLabel, $ScriptText, $Folder, $Server, $Domain, $NetBios, $User, $UserSid)
|
|
$block = [scriptblock]::Create($ScriptText)
|
|
$powershell = Join-Path -Path $env:SystemRoot -ChildPath 'System32\WindowsPowerShell\v1.0\powershell.exe'
|
|
& $powershell -NoProfile -ExecutionPolicy Bypass -Command $block -args (Join-Path -Path $Stage -ChildPath $ModuleLabel), $Folder, $Server, $Domain, $NetBios, $User, $UserSid
|
|
}
|
|
try {
|
|
Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName
|
|
Invoke-Command -Session $clientSession -ArgumentList $stageName -ScriptBlock { param ($Stage) if (Test-Path -LiteralPath $Stage) { Remove-Item -LiteralPath $Stage -Recurse -Force }; $null = New-Item -ItemType Directory -Path $Stage -Force }
|
|
foreach ($module in $modules) {
|
|
Invoke-Command -Session $clientSession -ArgumentList (Join-Path -Path $stageName -ChildPath $module.Label) -ScriptBlock { param ($Path) $null = New-Item -ItemType Directory -Path $Path -Force }
|
|
Copy-Item -Path (Join-Path -Path $module.Path -ChildPath '*') -Destination (Join-Path -Path $stageName -ChildPath $module.Label) -ToSession $clientSession -Recurse -Force
|
|
}
|
|
|
|
for ($round = 1; $round -le $Rounds; $round++) {
|
|
$created = Invoke-Command -Session $dcSession -ScriptBlock $createOnDcScript -ArgumentList $userName, $innerName, $outerName, $secret
|
|
Invoke-Command -Session $serverSession -ScriptBlock $setFolderScript -ArgumentList $folderName, $created.Outer
|
|
$report.Add(('round {0} at {1:HH:mm:ss}Z: subject {2}, outer group {3}' -f $round, [DateTime]::UtcNow, $created.User, $created.Outer))
|
|
foreach ($machine in $machines.Keys) {
|
|
$report.Add((' {0}: {1}' -f $machine, (Invoke-Command -Session $machines[$machine] -ScriptBlock $tokenScript -ArgumentList $userName, $domainName, $created.User, $created.Outer)))
|
|
}
|
|
|
|
# The order of the modules alternates, so that the module that asks first is not always the same.
|
|
$ordered = if ($round % 2) { $modules } else { @($modules)[($modules.Count - 1)..0] }
|
|
foreach ($module in $ordered) {
|
|
$answer = Invoke-Command -Session $clientSession -ArgumentList $stageName, $module.Label, $effectiveScript.ToString(), $folderName, $FileServer, $domainName, $netBiosName, $userName, $created.User -ScriptBlock $runEffectiveScript
|
|
$report.Add((' {0} on {1}: {2}' -f $module.Label, $Client, (@($answer) -join ' ')))
|
|
}
|
|
|
|
Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName
|
|
}
|
|
}
|
|
finally {
|
|
try { Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName } catch { $report.Add("cleanup on the domain controller failed: $($_.Exception.Message)") }
|
|
try { Invoke-Command -Session $serverSession -ArgumentList $folderName -ScriptBlock { param ($Folder) Remove-Item -LiteralPath (Join-Path -Path $env:SystemDrive -ChildPath $Folder) -Recurse -Force -ErrorAction SilentlyContinue } } catch { $report.Add("cleanup on the file server failed: $($_.Exception.Message)") }
|
|
try { Invoke-Command -Session $clientSession -ArgumentList $stageName -ScriptBlock { param ($Stage) Remove-Item -LiteralPath $Stage -Recurse -Force -ErrorAction SilentlyContinue } } catch { $report.Add("cleanup on the client failed: $($_.Exception.Message)") }
|
|
$report | Set-Content -LiteralPath $OutFile -Encoding utf8
|
|
Remove-PSSession -Session @($machines.Values) -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
'done'
|
|
}
|
|
|