| | | 1 | | using SharpHoundCommonLib.Enums; |
| | | 2 | | using SharpHoundCommonLib.OutputTypes; |
| | | 3 | | |
| | | 4 | | namespace SharpHoundCommonLib |
| | | 5 | | { |
| | | 6 | | public static class WellKnownPrincipal |
| | | 7 | | { |
| | | 8 | | /// <summary> |
| | | 9 | | /// Gets the principal associated with a well known SID |
| | | 10 | | /// </summary> |
| | | 11 | | /// <param name="sid"></param> |
| | | 12 | | /// <param name="commonPrincipal"></param> |
| | | 13 | | /// <returns>True if SID matches a well known principal, false otherwise</returns> |
| | | 14 | | public static bool GetWellKnownPrincipal(string sid, out TypedPrincipal commonPrincipal) |
| | 163 | 15 | | { |
| | 163 | 16 | | commonPrincipal = sid switch |
| | 163 | 17 | | { |
| | 1 | 18 | | "S-1-0" => new TypedPrincipal("Null Authority", Label.User), |
| | 2 | 19 | | "S-1-0-0" => new TypedPrincipal("Nobody", Label.User), |
| | 1 | 20 | | "S-1-1" => new TypedPrincipal("World Authority", Label.User), |
| | 1 | 21 | | "S-1-1-0" => new TypedPrincipal("Everyone", Label.Group), |
| | 1 | 22 | | "S-1-2" => new TypedPrincipal("Local Authority", Label.User), |
| | 1 | 23 | | "S-1-2-0" => new TypedPrincipal("Local", Label.Group), |
| | 1 | 24 | | "S-1-2-1" => new TypedPrincipal("Console Logon", Label.Group), |
| | 1 | 25 | | "S-1-3" => new TypedPrincipal("Creator Authority", Label.User), |
| | 1 | 26 | | "S-1-3-0" => new TypedPrincipal("Creator Owner", Label.User), |
| | 1 | 27 | | "S-1-3-1" => new TypedPrincipal("Creator Group", Label.Group), |
| | 1 | 28 | | "S-1-3-2" => new TypedPrincipal("Creator Owner Server", Label.Computer), |
| | 1 | 29 | | "S-1-3-3" => new TypedPrincipal("Creator Group Server", Label.Computer), |
| | 1 | 30 | | "S-1-3-4" => new TypedPrincipal("Owner Rights", Label.Group), |
| | 1 | 31 | | "S-1-4" => new TypedPrincipal("Non-unique Authority", Label.User), |
| | 1 | 32 | | "S-1-5" => new TypedPrincipal("NT Authority", Label.User), |
| | 1 | 33 | | "S-1-5-1" => new TypedPrincipal("Dialup", Label.Group), |
| | 1 | 34 | | "S-1-5-2" => new TypedPrincipal("Network", Label.Group), |
| | 1 | 35 | | "S-1-5-3" => new TypedPrincipal("Batch", Label.Group), |
| | 1 | 36 | | "S-1-5-4" => new TypedPrincipal("Interactive", Label.Group), |
| | 1 | 37 | | "S-1-5-6" => new TypedPrincipal("Service", Label.Group), |
| | 1 | 38 | | "S-1-5-7" => new TypedPrincipal("Anonymous", Label.Group), |
| | 1 | 39 | | "S-1-5-8" => new TypedPrincipal("Proxy", Label.Group), |
| | 5 | 40 | | "S-1-5-9" => new TypedPrincipal("Enterprise Domain Controllers", Label.Group), |
| | 1 | 41 | | "S-1-5-10" => new TypedPrincipal("Principal Self", Label.User), |
| | 7 | 42 | | "S-1-5-11" => new TypedPrincipal("Authenticated Users", Label.Group), |
| | 1 | 43 | | "S-1-5-12" => new TypedPrincipal("Restricted Code", Label.Group), |
| | 1 | 44 | | "S-1-5-13" => new TypedPrincipal("Terminal Server Users", Label.Group), |
| | 1 | 45 | | "S-1-5-14" => new TypedPrincipal("Remote Interactive Logon", Label.Group), |
| | 1 | 46 | | "S-1-5-15" => new TypedPrincipal("This Organization", Label.Group), |
| | 1 | 47 | | "S-1-5-17" => new TypedPrincipal("IUSR", Label.User), |
| | 1 | 48 | | "S-1-5-18" => new TypedPrincipal("Local System", Label.User), |
| | 1 | 49 | | "S-1-5-19" => new TypedPrincipal("Local Service", Label.User), |
| | 1 | 50 | | "S-1-5-20" => new TypedPrincipal("Network Service", Label.User), |
| | 1 | 51 | | "S-1-5-113" => new TypedPrincipal("Local Account", Label.User), |
| | 1 | 52 | | "S-1-5-114" => new TypedPrincipal("Local Account and Member of Administrators Group", Label.User), |
| | 1 | 53 | | "S-1-5-80-0" => new TypedPrincipal("All Services ", Label.Group), |
| | 16 | 54 | | "S-1-5-32-544" => new TypedPrincipal("Administrators", Label.Group), |
| | 3 | 55 | | "S-1-5-32-545" => new TypedPrincipal("Users", Label.Group), |
| | 1 | 56 | | "S-1-5-32-546" => new TypedPrincipal("Guests", Label.Group), |
| | 1 | 57 | | "S-1-5-32-547" => new TypedPrincipal("Power Users", Label.Group), |
| | 3 | 58 | | "S-1-5-32-548" => new TypedPrincipal("Account Operators", Label.Group), |
| | 1 | 59 | | "S-1-5-32-549" => new TypedPrincipal("Server Operators", Label.Group), |
| | 1 | 60 | | "S-1-5-32-550" => new TypedPrincipal("Print Operators", Label.Group), |
| | 1 | 61 | | "S-1-5-32-551" => new TypedPrincipal("Backup Operators", Label.Group), |
| | 1 | 62 | | "S-1-5-32-552" => new TypedPrincipal("Replicators", Label.Group), |
| | 5 | 63 | | "S-1-5-32-554" => new TypedPrincipal("Pre-Windows 2000 Compatible Access", Label.Group), |
| | 2 | 64 | | "S-1-5-32-555" => new TypedPrincipal("Remote Desktop Users", Label.Group), |
| | 1 | 65 | | "S-1-5-32-556" => new TypedPrincipal("Network Configuration Operators", Label.Group), |
| | 1 | 66 | | "S-1-5-32-557" => new TypedPrincipal("Incoming Forest Trust Builders", Label.Group), |
| | 1 | 67 | | "S-1-5-32-558" => new TypedPrincipal("Performance Monitor Users", Label.Group), |
| | 1 | 68 | | "S-1-5-32-559" => new TypedPrincipal("Performance Log Users", Label.Group), |
| | 3 | 69 | | "S-1-5-32-560" => new TypedPrincipal("Windows Authorization Access Group", Label.Group), |
| | 1 | 70 | | "S-1-5-32-561" => new TypedPrincipal("Terminal Server License Servers", Label.Group), |
| | 1 | 71 | | "S-1-5-32-562" => new TypedPrincipal("Distributed COM Users", Label.Group), |
| | 1 | 72 | | "S-1-5-32-568" => new TypedPrincipal("IIS_IUSRS", Label.Group), |
| | 1 | 73 | | "S-1-5-32-569" => new TypedPrincipal("Cryptographic Operators", Label.Group), |
| | 1 | 74 | | "S-1-5-32-573" => new TypedPrincipal("Event Log Readers", Label.Group), |
| | 1 | 75 | | "S-1-5-32-574" => new TypedPrincipal("Certificate Service DCOM Access", Label.Group), |
| | 1 | 76 | | "S-1-5-32-575" => new TypedPrincipal("RDS Remote Access Servers", Label.Group), |
| | 1 | 77 | | "S-1-5-32-576" => new TypedPrincipal("RDS Endpoint Servers", Label.Group), |
| | 1 | 78 | | "S-1-5-32-577" => new TypedPrincipal("RDS Management Servers", Label.Group), |
| | 1 | 79 | | "S-1-5-32-578" => new TypedPrincipal("Hyper-V Administrators", Label.Group), |
| | 1 | 80 | | "S-1-5-32-579" => new TypedPrincipal("Access Control Assistance Operators", Label.Group), |
| | 1 | 81 | | "S-1-5-32-580" => new TypedPrincipal("Remote Management Users", Label.Group), |
| | 0 | 82 | | "S-1-5-32-581" => new TypedPrincipal("System Managed Accounts Group", Label.Group), |
| | 0 | 83 | | "S-1-5-32-582" => new TypedPrincipal("Storage Replica Administrators", Label.Group), |
| | 0 | 84 | | "S-1-5-32-583" => new TypedPrincipal("Device Owners", Label.Group), |
| | 62 | 85 | | _ => null |
| | 163 | 86 | | }; |
| | | 87 | | |
| | 163 | 88 | | return commonPrincipal != null; |
| | 163 | 89 | | } |
| | | 90 | | } |
| | | 91 | | } |