o
    jR                     @   s  d dl Z d dlmZ d dlmZmZmZmZ dZdZ	G dd de j
ZG dd	 d	e j
ZG d
d de j
ZdZdZdZdZdZi dddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2i d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLedMedNdOdPdQdRi dSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhedidjdkdldmedndodpdqdrdsdtdudvdwdxdydzd{d|d}d~edddddddi
Zi ejdejdejdejdejdejdejdejdejdejdejdejdej dej!dej"dej#dej$dZ%g dZ&G dd dZ'dS )    N)SECURITY_DESCRIPTOR)ACETypeACE_OBJECT_PRESENCEACCESS_MASKADS_ACCESS_MASKz$0e10c968-78fb-11d2-90d4-00c04f79dc55z$a05b8cc2-17bc-4802-a710-e7c15ab866a2c                   @   s@   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdS )CertificateNameFlag      i  @ i   i   i   i   i   i   i    i   @l           N)__name__
__module____qualname__ENROLLEE_SUPPLIES_SUBJECT"ENROLLEE_SUPPLIES_SUBJECT_ALT_NAMESUBJECT_ALT_REQUIRE_DOMAIN_DNSSUBJECT_ALT_REQUIRE_SPN"SUBJECT_ALT_REQUIRE_DIRECTORY_GUIDSUBJECT_ALT_REQUIRE_UPNSUBJECT_ALT_REQUIRE_EMAILSUBJECT_ALT_REQUIRE_DNSSUBJECT_REQUIRE_DNS_AS_CNSUBJECT_REQUIRE_EMAILSUBJECT_REQUIRE_COMMON_NAMESUBJECT_REQUIRE_DIRECTORY_PATH&OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME r   r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/msldap/ldap_objects/adcertificatetemplate.pyr   
   s    r   c                   @   sT   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdS )EnrollmentFlagr         r
          @      i   i          i @  i   r	   i   i   i   N)r   r   r   INCLUDE_SYMMETRIC_ALGORITHMSPEND_ALL_REQUESTSPUBLISH_TO_KRA_CONTAINERPUBLISH_TO_DS)AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATEAUTO_ENROLLMENT'PREVIOUS_APPROVAL_VALIDATE_REENROLLMENTUSER_INTERACTION_REQUIRED.REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STOREALLOW_ENROLL_ON_BEHALF_OFADD_OCSP_NOCHECK0ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULLNOREVOCATIONINFOINISSUEDCERTS&INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS=ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENTISSUANCE_POLICIES_FROM_REQUESTSKIP_AUTO_RENEWALNO_SECURITY_EXTENSIONr   r   r   r   r      s&    r   c                   @   s0   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
S )PrivateKeyFlagr   r    r!   r"      r#   r%   r$   i    N)r   r   r   REQUIRE_PRIVATE_KEY_ARCHIVALEXPORTABLE_KEYSTRONG_KEY_PROTECTION_REQUIRED%REQUIRE_ALTERNATE_SIGNATURE_ALGORITHMREQUIRE_SAME_KEY_RENEWALUSE_LEGACY_PROVIDERATTEST_REQUIREDATTEST_PREFERREDHELLO_LOGON_KEYr   r   r   r   r8   -   s    r8   z1.3.6.1.5.5.7.3.2z1.3.6.1.5.2.3.4z1.3.6.1.4.1.311.20.2.2z2.5.29.37.0z1.3.6.1.4.1.311.20.2.1z1.3.6.1.4.1.311.2.6.1SpcRelaxedPEMarkerCheckz1.3.6.1.4.1.311.2.6.2SpcEncryptedDigestRetryCountz1.3.6.1.4.1.311.10.3.6z%Windows System Component Verificationz1.3.6.1.4.1.311.10.3.22z$Protected Process Light Verificationz1.3.6.1.4.1.311.10.3.27zPreview Build Signingz1.3.6.1.4.1.311.10.3.1zMicrosoft Trust List Signingz1.3.6.1.4.1.311.10.3.2zMicrosoft Time Stampingz1.3.6.1.4.1.311.10.3.7z)OEM Windows System Component Verificationz1.3.6.1.4.1.311.10.3.13zLifetime Signingz1.3.6.1.4.1.311.10.3.11zKey Recoveryz1.3.6.1.4.1.311.10.3.23zWindows TCB Componentz1.3.6.1.4.1.311.10.3.25z)Windows Third Party Application Componentz1.3.6.1.4.1.311.10.3.26z'Windows Software Extension Verificationz1.3.6.1.4.1.311.10.3.8z.Embedded Windows System Component Verificationz1.3.6.1.4.1.311.10.3.20zWindows Kits Componentz1.3.6.1.4.1.311.10.3.5z$Windows Hardware Driver Verificationz1.3.6.1.4.1.311.10.3.39z-Windows Hardware Driver Extended Verificationz1.3.6.1.4.1.311.10.3.5.1z-Windows Hardware Driver Attested Verificationz1.3.6.1.4.1.311.10.3.4.1zFile Recoveryz1.3.6.1.4.1.311.10.3.30zDisallowed Listz1.3.6.1.4.1.311.10.3.19zRevoked List Signerz1.3.6.1.4.1.311.10.3.21zWindows RT Verificationz1.3.6.1.4.1.311.10.3.10zQualified Subordinationz1.3.6.1.4.1.311.10.3.12zDocument Signingz1.3.6.1.4.1.311.10.3.24zProtected Process Verificationz1.3.6.1.4.1.311.10.3.4zEncrypting File Systemz1.3.6.1.4.1.311.10.3.9zRoot List Signerz1.3.6.1.4.1.311.10.5.1zDigital Rightsz1.3.6.1.4.1.311.10.6.2zLicense Server Verificationz1.3.6.1.4.1.311.10.6.1zKey Pack LicenseszSmart Card LogonzCertificate Request Agentz1.3.6.1.4.1.311.20.1z	CTL Usagez1.3.6.1.4.1.311.21.6zKey Recovery Agentz1.3.6.1.4.1.311.21.19z#Directory Service Email Replicationz1.3.6.1.4.1.311.21.5zPrivate Key Archivalz1.3.6.1.4.1.311.61.1.1zKernel Mode Code Signingz1.3.6.1.4.1.311.61.4.1zEarly Launch Antimalware Driverz1.3.6.1.4.1.311.61.5.1zHAL Extensionz1.3.6.1.4.1.311.64.1.1z%Domain Name System (DNS) Server Trustz1.3.6.1.4.1.311.76.6.1zWindows Updatez1.3.6.1.4.1.311.76.3.1zWindows Storez1.3.6.1.4.1.311.76.5.1zDynamic Code Generatorz1.3.6.1.4.1.311.76.8.1zMicrosoft Publisherz1.3.6.1.4.1.311.80.1zDocument EncryptionzPKINIT Client Authenticationz1.3.6.1.5.2.3.5zKDC Authenticationz1.3.6.1.5.5.7.3.7zIP security userzClient Authenticationz1.3.6.1.5.5.7.3.9zOCSP Signingz1.3.6.1.5.5.7.3.3zCode Signingz1.3.6.1.5.5.7.3.4zSecure Emailz1.3.6.1.5.5.7.3.5zIP security end systemz1.3.6.1.5.5.7.3.6zIP security tunnel terminationz1.3.6.1.5.5.8.2.2zIP security IKE intermediatez1.3.6.1.5.5.7.3.8zTime Stampingz1.3.6.1.5.5.7.3.1zServer AuthenticationzAny Purposez2.23.133.8.1zEndorsement Key Certificatez2.23.133.8.2zPlatform Certificatez2.23.133.8.3z$Attestation Identity Key Certificater&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   )cnsndistinguishedNamenamemsPKI-RA-Application-Policies$msPKI-Certificate-Application-PolicymsPKI-Template-Schema-VersionmsPKI-Certificate-Name-FlagmsPKI-Enrollment-FlagmsPKI-RA-SignaturemsPKI-Private-Key-FlagpKIExtendedKeyUsagenTSecurityDescriptorc                   @   s   e Zd Zdd Zedd Zdd Zdd Zd	d
 Zdd Z	dd Z
dd Zdd Zdd Zdd Zd)ddZd)ddZd)ddZdd Zed d! Zed"d# Zd$d% Zd&d' Zd(d% ZdS )*MSADCertificateTemplatec                 C   s   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _g | _t | _t | _t | _t | _t | _t | _t | _d | _g | _d S N)rF   rE   rG   rH   RA_Application_PoliciesCertificate_Application_PolicyTemplate_Schema_VersionCertificate_Name_FlagEnrollment_FlagRA_SignaturePrivate_Key_FlagrP   rQ   vulnssetenroll_sidsautoenroll_sidswrite_owner_sidswrite_dacl_sidswrite_property_sidsfullcontrol_sidsallextendedrights_sidssid_lookup_tableenroll_servicesselfr   r   r   __init__   s.   
z MSADCertificateTemplate.__init__c                 C   s   t  }| d d|_| d d|_| d d|_| d d|_| d d|_| d d|_| d d|_| d d	|_	| d d
|_
| d d|_| d d|_| d dg |_| d d|_|jd urxt|j|_|  |S )N
attributesrF   rE   rG   rH   rI   rJ   rK   rL   rM   rN   rO   rP   rQ   )rR   getrF   rE   rG   rH   rT   rU   rV   rW   rX   rY   rZ   rP   rQ   r   
from_bytes	calc_aces)entryadir   r   r   	from_ldap   s$   
z!MSADCertificateTemplate.from_ldapc                 C   s>   t |}|dv r
dS |ddu r|ddd dv rdS dS )N)zS-1-1-0zS-1-5-11Tz	S-1-5-21--r   )513515545F)str
startswithrsplit)rg   sidr   r   r   isLowPrivSid   s   "z$MSADCertificateTemplate.isLowPrivSidc                 C   s*   |   ptttttgt| jdkS Nr   )can_be_used_for_any_purposelenr\   EKU_CLIENT_AUTHENTICATION_OIDEKU_SMART_CARD_LOGON_OID$EKU_PKINIT_CLIENT_AUTHENTICATION_OIDintersectionrP   rf   r   r   r   allows_authentication   s   *z-MSADCertificateTemplate.allows_authenticationc                 C   s   t | jdkpt| jv S ry   )r{   rP   EKU_ANY_PURPOSE_OIDrf   r   r   r   rz      s   z3MSADCertificateTemplate.can_be_used_for_any_purposec                 C      t jt | jv S rS   )r   r'   rX   rf   r   r   r   requires_manager_approval      z1MSADCertificateTemplate.requires_manager_approvalc                 C   s   | j d ko	| j dkS ry   )rY   rf   r   r   r   requires_authorized_signatures      z6MSADCertificateTemplate.requires_authorized_signaturesc                 C   s   t | jt j@ dkS ry   )r   rW   r   rf   r   r   r   allows_to_specify_san   r   z-MSADCertificateTemplate.allows_to_specify_sanc                 C   s
   t | jv S rS   )!EKU_CERTIFICATE_REQUEST_AGENT_OIDrP   rf   r   r   r   #allows_to_request_agent_certificate   s   
z;MSADCertificateTemplate.allows_to_request_agent_certificatec                 C   s    t | jv rdS t| jv rdS d S )NT)r   rP   r   rf   r   r   r   allows_to_use_agent_certificate   s
   

z7MSADCertificateTemplate.allows_to_use_agent_certificatec                 C   r   rS   )r   r7   rX   rf   r   r   r   no_securty_extension   r   z,MSADCertificateTemplate.no_securty_extensionNc                    s  |d u r  t jjdu rdS n
t jj|v rdS d}|d u rt fdd jD du r2dS t fdd jD du rBd	S t fd
d jD du rRdS t fdd jD du rbdS t fdd j	D du rrd}t fdd j
D du rd}nRt j	t|dkst j
t|dkrd}t jt|dkrdS t jt|dkrdS t jt|dkrdS t jt|dkrdS   du rdS   du rdS   r|r  rdS |r  r  rdS dS )NT)TOwner is low priv user)Tz'Owner can be controlled by current userFc                 3       | ]
}  t|V  qd S rS   rx   rt   .0rw   rf   r   r   	<genexpr>       z8MSADCertificateTemplate.is_vulnerable.<locals>.<genexpr>)TLowpriv SID has full controlc                 3   r   rS   r   r   rf   r   r   r     r   )TLowpriv SID can write DACLsc                 3   r   rS   r   r   rf   r   r   r     r   )TLowpriv SID can change Ownerc                 3   r   rS   r   r   rf   r   r   r     r   )TLowpriv SID can write propertyc                 3   r   rS   r   r   rf   r   r   r   
  r   c                 3   r   rS   r   r   rf   r   r   r     r   r   )TCurrent user can write DACLs)TCurrent user can change Owner)TCurrent user can write property)TCurrent user has full control)FzNeeds manager approval)FzNeeds authorized signature)TzEnrollee supplies subject)TzCertificate request agent)FzNo match found)rx   rt   rQ   Owneranyrb   r`   r_   ra   r]   rc   r{   r   r\   r   r   r   r   r   r   )rg   tokengroupslowprivcanenrollr   rf   r   is_vulnerable   sP   0z%MSADCertificateTemplate.is_vulnerablec                    sz  g }|d u st |dkrj t jjdu r|d t fdd jD du r/|d t fdd jD du rB|d t fd	d j	D du rU|d
 t fdd j
D du rh|d |S t  jt|dkr{|d t  j	t|dkr|d t  j
t|dkr|d t  jt|dkr|d t jj|v r|d |S )Nr   Tr   c                 3   r   rS   r   r   rf   r   r   r   4  r   zFMSADCertificateTemplate.check_dangerous_permissions.<locals>.<genexpr>r   c                 3   r   rS   r   r   rf   r   r   r   7  r   r   c                 3   r   rS   r   r   rf   r   r   r   :  r   r   c                 3   r   rS   r   r   rf   r   r   r   =  r   r   r   r   r   r   z8The current user can control the owner -or is the owner-)r{   rx   rt   rQ   r   appendr   rb   r`   r_   ra   r   r\   )rg   r   issuesr   rf   r   check_dangerous_permissions.  s0   









z3MSADCertificateTemplate.check_dangerous_permissionsc                 C   s   i }|d u rg }d}t t| jt|dkrd}|r,|  r,|  r,| jdd|d< |r<|  du r<| jdd|d< |rJ|  rJ| jd	d|d
< |rX|  rX| jdd|d< | 	|}t |dkrm|d
|d|d< |S )NFr   TzUUsers can enroll, enrollee supplies subject and template allows client authentication)SIDsReasonESC1z0Users can enroll and template allows any purposeESC2z>Users can enroll and template allows certificate request agentESC3zAUsers can enroll and template does not require security extensionESC9, ESC4)r{   r\   r]   r   r   r   rz   r   r   r   join)rg   r   r[   user_can_enrollperm_issuesr   r   r   is_vulnerable2R  s8   





z&MSADCertificateTemplate.is_vulnerable2c                 C   sd  | j d u rd S | j jjD ]}|jtjkr|jtjkrq|jtjkrZt|jt	kr2| j
t|j n't|jtkrC| jt|j ntjt|jv rY|jd u rY| jt|j qtjt|jv rk| jt|j tjt|jv r|| jt|j tjt|jv r| jt|j tjt|jv r| jt|j tjt|jv r| jt|j qd S rS   )rQ   DaclacesAceTyper   ACCESS_ALLOWED_OBJECT_ACE_TYPEACCESS_ALLOWED_ACE_TYPErt   
ObjectTypeEX_RIGHT_CERTIFICATE_ENROLLMENTr]   addSid#EX_RIGHT_CERTIFICATE_AUTOENROLLMENTr^   r   CONTROL_ACCESSMaskrc   GENERIC_ALLrb   
WRITE_DACLr`   WRITE_OWNERr_   
WRITE_PROPra   )rg   acer   r   r   rl   {  s2   
z!MSADCertificateTemplate.calc_acesc                 C   s   t | jdkS ry   )r{   re   rf   r   r   r   
is_enabled  s   z"MSADCertificateTemplate.is_enabledc                 C   sP   g }| j D ] }|ddkr|dd\}}|||f q|d |f q|S )N\r   )re   findsplitr   )rg   reseshostnameservicer   r   r   enrollment_services  s   
z+MSADCertificateTemplate.enrollment_servicesc                 C   s*   d}| j D ]}|d|| j | f 7 }q|S )N== MSADCertificateTemplate ==
z%s: %s
)__dict__)rg   tkr   r   r   __str__  s   
zMSADCertificateTemplate.__str__c                    s$  d) fdd	}d}|d j  7 }|d j 7 }|d j 7 } jr+|dd	 j 7 }t jd
kr<|dd	 j 7 } jd urjtt	 j
dd}t|dkr[|d dd	}n	t jdd	}|d| 7 } jd urtt j
dd}t|dkr|d dd	}n	t jdd	}|d| 7 } jd ur|d j 7 } jd ur|dd	dd  jD  7 } jd ur|dd	dd  jD  7 } jd ur|dd	dd  jD  7 }|d7 }|d7 }t jd
kr|d7 }|| j}t jd
kr|d7 }|| j}t jd
kr|d7 }|| j}|d7 }|d 7 }t jj} jd urK| jv rK|d! j| d
  j| d |f 7 }n|d"| 7 }t jd
krc|d#7 }|| j}|d$7 }|| j}|d%7 }|| j}|d&7 }|| j}|d'7 }| j 7 }|d(7 }|S )*N   c                    sd   |D ]-} j d ur%| j v r%| d|d  j | d  j | d |f 7 } q| d|d |f 7 } q| S )Nz%s%s\%s [%s]
 r   r   z%s%s
)rd   )buffersidlistoffsetrw   rf   r   r   
print_sids  s
   .z7MSADCertificateTemplate.prettyprint.<locals>.print_sidsr   z
Name: %s
zdistinguishedName: %s
zSchema Version: %s
zEnroll Services: %s
r   r   zVulnerabilities: %s
.r   r   |z!msPKI-Certificate-Name-Flag: %s
zmsPKI-Enrollment-Flag: %s
zmsPKI-RA-Signature: %s
zpKIExtendedKeyUsage: %s
c                 S      g | ]}t ||qS r   
EKUS_NAMESrj   r   oidr   r   r   
<listcomp>      z7MSADCertificateTemplate.prettyprint.<locals>.<listcomp>z*msPKI-Certificate-Application-Policy: %s
c                 S   r   r   r   r   r   r   r   r     r   z!msPKI-RA-Application-Policy: %s
c                 S   r   r   r   r   r   r   r   r     r   zPermissions
z  Enrollment Permissions
z    Enrollment Rights
z    AutoEnrollment Rights
z    All Extended Rights
z  Object Control Permissions
z    Owner
z      %s\%s [%s]
z
      %s
z    Full Control
z    Write Owner
z    Write DACL
z    Write Property
z
    SDDL
z
)r   )rH   rG   rV   re   r   r{   r[   rW   rt   r   r   replacerX   r   rY   rP   rU   rT   r]   r^   rc   rQ   r   rd   rb   r_   r`   ra   to_sddl)rg   r   r   xrw   r   rf   r   prettyprint  sv   





(z#MSADCertificateTemplate.prettyprintc                 C   s   |   S rS   )r   rf   r   r   r   r     s   rS   )r   r   r   rh   staticmethodro   rx   r   rz   r   r   r   r   r   r   r   r   r   rl   propertyr   r   r   r   r   r   r   r   rR      s0    


;
$)

SrR   )(enumwinacl.dtyp.security_descriptorr   winacl.dtyp.acer   r   r   r   r   r   IntFlagr   r   r8   r|   r~   r}   r   r   r   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   ENROLLMENT_FLAGS_NAMESMSADCertificateTemplate_ATTRSrR   r   r   r   r   <module>   sH   	
 !"#$%&'()*+,-./01234@	
