Class: MiqWin32::Accounts

Inherits:
Object
  • Object
show all
Defined in:
lib/metadata/util/win32/Win32Accounts.rb

Constant Summary collapse

SAM_STRUCT_USERS_F =

Definition derived from www.beginningtoseethelight.org/ntsecurity/#8603CF0AFBB170DD HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsers%RID%F (fixed length, 80)

[
  'a8',     nil,                    # UNKNOWN
  'Q',      'last_logon',           # Last logon (WinNT format), 0 if never logged on
  'a8',     nil,                    # UNKNOWN
  'Q',      'last_pw_set',          # Password last set (WinNT format), 0 if not changed
  'Q',      'account_expires',      # Account expires (WinNT format), 0 if set not to expire
  'Q',      'last_wrong_pw',        # Last incorrect password (WinNT format), 0 if not
  'I',      'user_num',             # User number
  'a4',     nil,                    # UNKNOWN
  'C',      'logon_ok_account_active',
  # High nibble
  #   Unsure - 0/2/6/8/A/C/E=pwd/username invalid
  #   1/3/4=logonokay
  #   5/7/D/F=Logon Message
  #     The system can not log you on due to the following error:
  #     The account used is an interdomain trust account. Use your global user
  #       account or local user account to access this server.
  #     Please try again or consult your system administrator.
  #   9/B=Logon Message
  #     The system can not log you on due to the following error:
  #     The account used is a computer account. Use your global user account
  #       or local user account to access this server.
  #     Please try again or consult your system administrator.
  # Low nibble
  #   Account active - 0=active 1=not active.
  #   Password required - 0=yes 4=no
  #   0/2/4/6/8/A/C/E=logonokay - 1/2/5/7/9/B/D/F=accountdisabled/inactive
  'C',      'pw_never_expire',      # High nibble
  #   UNKNOWN
  # Low nibble
  #   Password never expire - 0=secpoltime 2=never
  #   For some unknown reason this value is set to 4 on a lockout and 0 on
  #     unlocking. If the password is set never to expire the option to force
  #     the user to change their password on next logon is greyed out.
  #   2/3/6/7/A/B/E/F=Password never expires (2=GUI setting)
  #
  #   0/2/8/A=logonokay
  #   1/3/5/7/9/B/D/F=Logon Message
  #     The system can not log you on due to the following error:
  #     The account used is a server trust account. Use your global user
  #       account or local user account to access this server.
  #     Please try again or consult your system administrator.
  #   4/6/C/E=logonokay - reset to X-4 though.
  'a2',     nil,                    # UNKNOWN
  'S',      'country_code',         # Country code
  'a2',     nil,                    # UNKNOWN
  'S',      'invalid_pw_count',     # Invalid password count, reset after a correct logon
  'S',      'num_logons',           # Number of logons, gets stuck at FF,FF
]
SIZEOF_SAM_STRUCT_USERS_F = 
BinaryStruct.sizeof(SAM_STRUCT_USERS_F)
SAM_STRUCT_USERS_V_HEADER =

Definition derived from www.beginningtoseethelight.org/ntsecurity/#D3BC3F5643A17823 HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsers%RID%V (fixed length, 80)

[
  'a12',    nil,                    # UNKNOWN
  'I',      'username_offset',      # Offset to username in V data section
  'I',      'username_length',      # Length of username in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'fullname_offset',      # Offset to fullname in V data section
  'I',      'fullname_length',      # Length of fullname in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'comment_offset',       # Offset to comment in V data section
  'I',      'comment_length',       # Length of comment in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'user_comment_offset',  # Offset to user comment in V data section
  'I',      'user_comment_length',  # Length of user comment in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'unknown1_offset',      # Offset to unknown1 in V data section
  'I',      'unknown1_length',      # Length of unknown1 in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'homedir_offset',       # Offset to homedir in V data section
  'I',      'homedir_length',       # Length of homedir in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'homedir_conn_offset',  # Offset to homedir connect in V data section
  'I',      'homedir_conn_length',  # Length of homedir connect in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'script_path_offset',   # Offset to script path in V data section
  'I',      'script_path_length',   # Length of script path in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'profile_path_offset',  # Offset to profile path in V data section
  'I',      'profile_path_length',  # Length of profile path in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'workstations_offset',  # Offset to workstations in V data section
  'I',      'workstations_length',  # Length of workstations in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'hours_allowed_offset', # Offset to hours allowed in V data section
  'I',      'hours_allowed_length', # Length of hours allowed in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'unknown2_offset',      # Offset to unknown2 in V data section
  'I',      'unknown2_length',      # Length of unknown2 in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'LM_pw_hash_offset',    # Offset to LM pw hash in V data section
  'I',      'LM_pw_hash_length',    # Length of LM pw hash in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'NT_pw_hash_offset',    # Offset to NT pw hash in V data section
  'I',      'NT_pw_hash_length',    # Length of NT pw hash in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'unknown3_offset',      # Offset to unknown3 in V data section
  'I',      'unknown3_length',      # Length of unknown3 in V data section
  'a4',     nil,                    # UNKNOWN
  'I',      'unknown4_offset',      # Offset to unknown4 in V data section
  'I',      'unknown4_length',      # Length of unknown4 in V data section
  'a4',     nil,                    # UNKNOWN

  'a72',    nil,                    # UNKNOWN (WinXP, 2003, Vista, 2008)
  # 'a52',   nil,                    # UNKNOWN (Win2K)
  'I',      'num_permissions',      # Number of permissions
]
SIZEOF_SAM_STRUCT_USERS_V_HEADER = 
BinaryStruct.sizeof(SAM_STRUCT_USERS_V_HEADER)
SAM_STRUCT_GROUPS_C_HEADER =

Definition derived from www.beginningtoseethelight.org/ntsecurity/#D98C08727B08B0CB HKEY_LOCAL_MACHINESAMSAMDomainsAccountAliases%RID%C (variable length) (custom groups) HKEY_LOCAL_MACHINESAMSAMDomainsBuiltinAliases00000220C (variable length) (builtin groups)

[
  'I',      'group_num',            # Group (user) number
  'a12',    nil,                    # UNKNOWN
  'I',      'group_name_offset',    # Offset to group name in C data section
  'I',      'group_name_length',    # Length of group name in C data section
  'a4',     nil,                    # UNKNOWN
  'I',      'group_desc_offset',    # Offset to group description in C data section
  'I',      'group_desc_length',    # Length of group description in C data section
  'a4',     nil,                    # UNKNOWN
  'I',      'sids_offset',          # Offset to sids in C data section
  'I',      'sids_length',          # Length of sids in C data section
  'I',      'num_users',            # Number of users in sids data
  'a72',    nil,                    # UNKNOWN (WinXP, 2003, Vista, 2008)
  # 'a52',   nil,                    # UNKNOWN (Win2K)
  'I',      'num_permissions',      # Number of permissions
]
SIZEOF_SAM_STRUCT_GROUPS_C_HEADER = 
BinaryStruct.sizeof(SAM_STRUCT_GROUPS_C_HEADER)
SAM_STRUCT_SID_HEADER =

Definition derived from www.beginningtoseethelight.org/ntsecurity/#3C091C8F1BF2345C and www.beginningtoseethelight.org/ntsecurity/#B1945830FA4449A5

[
  'C', 'part1',                     # First part of SID: S-[here]-?-...
  'C', 'num_sections',              # Number of 4-byte sections following second part of SID
  'a5', nil,                        # UNKNOWN
  'C', 'part2',                     # Second part of SID: S-?-[here]-...
]
SIZEOF_SAM_STRUCT_SID_HEADER = 
BinaryStruct.sizeof(SAM_STRUCT_SID_HEADER)

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(_c, fs) ⇒ Accounts

Returns a new instance of Accounts.



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 13

def initialize(_c, fs)
  @users = []
  @groups = []

  # Extracted data also built into a human-readable format if uncommented
  # @debug_str = ''

  regHnd = RemoteRegistry.new(fs, true)
  reg_doc = regHnd.loadHive("sam", nil)
  regHnd.close

  # Collect a mapping of user SIDs to user names for user-group relationships
  users_by_sids = {}

  # Extract the users data from the registry
  @debug_str += "Users:\n" if @debug_str
  sections = [
    "HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users",
    # "SAM/SAM/Domains/Builtin/Users"
  ]
  sections.each do |section|
    reg_node = MIQRexml.findRegElement("#{section}\\Names", reg_doc.root)
    if reg_node
      reg_node.each_element_with_attribute(:keyname) do |e|
        username = e.attributes[:keyname]
        user_data = {}
        @debug_str += "  %s:\n" % username if @debug_str

        e.each_element(:value) do |e2|
          @debug_str += "    %s - %s - %s\n" % [e2.attributes[:name], e2.attributes[:type], e2.text] if @debug_str

          # Find the rest of the user's data based on the hex value stored in the type
          reg_node2 = MIQRexml.findRegElement("#{section}/#{e2.attributes[:type]}", reg_doc.root)
          if reg_node2
            reg_node2.each_element(:value) do |e3|
              @debug_str += "      %s - %s - %s\n" % [e3.attributes[:name], e3.attributes[:type], e3.text] if @debug_str
              if e3.attributes[:name] == "F"
                users_f = process_users_f(e3.text)

                # Do a sanity check on the return data
                if users_f.nil?
                  # Set the user_data to nil to signify a parsing problem
                  user_data = nil
                elsif !user_data.nil?
                  user_data.merge!(users_f)
                end
              elsif e3.attributes[:name] == "V"
                users_v = process_users_v(e3.text)

                # Do a sanity check on the return data
                if users_v.nil? || users_v['username'] != username
                  # Set the user_data to nil to signify a parsing problem
                  user_data = nil
                  $log.warn "Unable to process data for user account [#{username}]"
                elsif !user_data.nil?
                  user_data.merge!(users_v)
                end
              end
            end
          end
        end

        # Get the pertinent data from out of that
        nh = {"name" => username}
        unless user_data.nil? || user_data.length == 0
          nh.merge!(
            "userid"       => user_data['user_num'],
            "display_name" => user_data['fullname'],
            "comment"      => user_data['comment'],
            "homedir"      => user_data['homedir'],
            "enabled"      => user_data['account_active'],
            "expires"      => user_data['account_expires'].nil? ? "never" : user_data['account_expires'],
            "last_logon"   => user_data['last_logon'],
            "groups"       => []
          )

          # Check for the SID in the permissions block by looking for a certain set of permissions.
          #   Checking is done in reverse, since the last permission set tends to be the right one.
          user_data['num_permissions'].downto(1) do |x|
            if user_data["perm#{x}_sid"] && ["D\000\002\000", "\004\000\002\000"].include?(user_data["perm#{x}_perms"])
              users_by_sids[user_data["perm#{x}_sid"]] = nh['name']
              break
            end
          end
        end
        @users << nh
      end
      @debug_str += "\n\n" if @debug_str
    end
  end

  # Extract the groups data from the registry
  @debug_str += "Groups:\n" if @debug_str
  sections = [
    "HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Builtin\\Aliases",
    # "SAM/SAM/Domains/Builtin/Groups",
    "HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Aliases",
    # "SAM/SAM/Domains/Account/Groups"
  ]
  sections.each do |section|
    reg_node = MIQRexml.findRegElement("#{section}\\Names", reg_doc.root)
    if reg_node
      reg_node.each_element_with_attribute(:keyname) do |e|
        groupname = e.attributes[:keyname]
        group_data = {}
        @debug_str += "  %s:\n" % groupname if @debug_str

        e.each_element(:value) do |e2|
          @debug_str += "    %s - %s - %s\n" % [e2.attributes[:name], e2.attributes[:type], e2.text] if @debug_str

          # Find the rest of the group's data based on the hex value stored in the type
          reg_node2 = MIQRexml.findRegElement("#{section}/#{e2.attributes[:type]}", reg_doc.root)
          if reg_node2
            reg_node2.each_element(:value) do |e3|
              @debug_str += "      %s - %s - %s\n" % [e3.attributes[:name], e3.attributes[:type], e3.text] if @debug_str
              if e3.attributes[:name] == "C"
                groups_c = process_groups_c(e3.text)

                # Do a sanity check on the return data
                if groups_c.nil? || groups_c['group_name'] != groupname
                  # Set the group_data to nil to signify a parsing problem
                  group_data = nil
                elsif !group_data.nil?
                  group_data.merge!(groups_c)
                end
              end
            end
          end
        end

        # Get the pertinent data from out of that
        nh = {"name" => groupname}
        unless group_data.nil? || group_data.length == 0
          nh.merge!(
            "groupid" => group_data['group_num'],
            "comment" => group_data['group_desc']
          )

          nh['users'] = []
          group_data['sids'].each do |sid|
            if users_by_sids.include?(sid)
              # Add this user to the set of users for this group
              nh['users'] << users_by_sids[sid]

              # Add this group to the original user's set of groups
              found = @users.find { |u| u['name'] == users_by_sids[sid] }
              found['groups'] << nh['name'] if found
            end
          end
        end
        @groups << nh
      end
      @debug_str += "\n\n" if @debug_str
    end
  end

  # Force memory cleanup
  reg_doc = nil; GC.start

  # Dump the debug string to a file if we are collecting that data
  # File.open('C:/Temp/reg_extract_full_accounts.txt', 'w') { |f| f.write(@debug_str) } if @debug_str
end

Instance Attribute Details

#groups ⇒ Object (readonly)

Returns the value of attribute groups.



11
12
13
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 11

def groups
  @groups
end

#users ⇒ Object (readonly)

Returns the value of attribute users.



11
12
13
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 11

def users
  @users
end

Class Method Details

.rawBinaryToRegBinary(a) ⇒ Object 



386
387
388
389
390
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 386

def self.rawBinaryToRegBinary(a)
  b = ''
  a.each_byte { |c| b += "%02x," % c } unless a.nil?
  b.chop
end

.rawBinaryToSids(data) ⇒ Object 



358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 358

def self.rawBinaryToSids(data)
  sids = []
  while data && data.length > 0
    # Determine the full structure for this SID
    header = BinaryStruct.decode(data, SAM_STRUCT_SID_HEADER)
    sam_struct_sid_footer = []
    1.upto(header['num_sections']) { |x| sam_struct_sid_footer << 'I' << "section#{x}" }
    sam_struct_sid = [] + SAM_STRUCT_SID_HEADER + sam_struct_sid_footer

    # Get the parts and build the SID string
    sid_parts = BinaryStruct.decode(data, sam_struct_sid)
    sid = "S-#{sid_parts['part1']}-#{sid_parts['part2']}"
    'section1'.upto("section#{sid_parts['num_sections']}") do |x|
      break if sid_parts[x].nil?
      sid += '-' + sid_parts[x].to_s
    end
    sids << sid

    # Process the next SID
    data = data[BinaryStruct.sizeof(sam_struct_sid)..-1]
  end
  sids
end

.regBinaryToSid(data) ⇒ Object 



382
383
384
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 382

def self.regBinaryToSid(data)
  rawBinaryToSids(MSRegHive.regBinaryToRawBinary(data))
end

Instance Method Details

#groupsToXml(doc = nil) ⇒ Object 



199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 199

def groupsToXml(doc = nil)
  doc = MiqXml.createDoc(nil) unless doc
  unless @groups.empty?
    node = doc.add_element("groups")
    @groups.each do |g|
      g_users = g.delete('users')
      group = node.add_element("group", g)

      g_users.each do |u|
        group.add_element('member_users', 'name' => u)
      end unless g_users.nil?
    end
  end
  doc
end

#process_groups_c(data) ⇒ Object 



675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 675

def process_groups_c(data)
  bin = MSRegHive.regBinaryToRawBinary(data)
  header_size = SIZEOF_SAM_STRUCT_GROUPS_C_HEADER
  c = BinaryStruct.decode(bin, SAM_STRUCT_GROUPS_C_HEADER)

  if @debug_str
    @debug_str += "        Header:\n"
    @debug_str += "          group_num         - %s\n" % c['group_num']
    @debug_str += "          group_name_offset - 0x%08x\n" % c['group_name_offset']
    @debug_str += "          group_name_length - %s\n" % c['group_name_length']
    @debug_str += "          group_desc_offset - 0x%08x\n" % c['group_desc_offset']
    @debug_str += "          group_desc_length - %s\n" % c['group_desc_length']
    @debug_str += "          sids_offset       - 0x%08x\n" % c['sids_offset']
    @debug_str += "          sids_length       - %s\n" % c['sids_length']
    @debug_str += "          num_users         - %s\n" % c['num_users']
    @debug_str += "          num_permissions   - %s\n" % c['num_permissions']
  end

  # Build middle section based on the num_permissions
  sam_struct_groups_c_middle = []

  # Do a sanity check for the permissions section
  return nil if c['num_permissions'] > 100 || c['num_permissions'] <= 0

  sect_start = header_size
  'perm1'.upto("perm#{c['num_permissions']}") do |sect_name|
    sect_size = bin[sect_start + 2...sect_start + 4].unpack('S')[0]

    sam_struct_groups_c_middle += [
      'a2',                 nil,                    # UNKNOWN
      'S',                  "#{sect_name}_length",  # Length of block for permissions?
      'a4',                 "#{sect_name}_perms",   # Permissions
      "a#{sect_size - 8}",  "#{sect_name}_sid",     # SID
    ]

    sect_start += sect_size
  end

  sam_struct_groups_c_middle += [
    'a16',    'admins_group_sidA',      # Administrators group SID
    'a16',    'admins_group_sidB',      # Administrators group SID again
  ]

  # Build footer section based on sizes in header section
  sam_struct_groups_c_footer = [
    'a%d' % c['group_name_length'],                                                     'group_name',
    'a%d' % (c['group_desc_offset'] - c['group_name_offset'] - c['group_name_length']), nil,
    'a%d' % c['group_desc_length'],                                                     'group_desc',
    'a%d' % (c['sids_offset'] - c['group_desc_offset'] - c['group_desc_length']), nil,
    'a%d' % c['sids_length'],                                                           'sids'
  ]

  sam_struct_groups_c = [] + SAM_STRUCT_GROUPS_C_HEADER + sam_struct_groups_c_middle + sam_struct_groups_c_footer
  c = BinaryStruct.decode(bin, sam_struct_groups_c)

  @debug_str += "        Middle:\n" if @debug_str
  'perm1'.upto("perm#{c['num_permissions']}") do |sect_name|
    # Clean up the SID values
    c["#{sect_name}_sid"] = Accounts.rawBinaryToSids(c["#{sect_name}_sid"])[0]

    if @debug_str
      @debug_str += "          #{sect_name}_length#{' ' * (9 - sect_name.length + 2)}- %s\n" % c["#{sect_name}_length"].to_s
      @debug_str += "          #{sect_name}_perms#{' ' * (9 - sect_name.length + 3)}- %s\n" % Accounts.rawBinaryToRegBinary(c["#{sect_name}_perms"])
      @debug_str += "          #{sect_name}_sid#{' ' * (9 - sect_name.length + 5)}- %s\n" % c["#{sect_name}_sid"].to_s
    end
  end
  if @debug_str
    @debug_str += "          admins_group_sidA - %s\n" % Accounts.rawBinaryToSids(c['admins_group_sidA'])
    @debug_str += "          admins_group_sidB - %s\n" % Accounts.rawBinaryToSids(c['admins_group_sidB'])
  end

  # Clean up Unicode string fields
  c['group_name'].UnicodeToUtf8!.tr!("\0", "")
  c['group_name'] = nil if c['group_name'].length == 0
  c['group_desc'].UnicodeToUtf8!.tr!("\0", "")
  c['group_desc'] = nil if c['group_desc'].length == 0

  # Clean up SID values
  c['sids'] = Accounts.rawBinaryToSids(c['sids'])

  if @debug_str
    @debug_str += "        Footer:\n"
    @debug_str += "          group_name        - '%s'\n" % c['group_name']
    @debug_str += "          group_desc        - '%s'\n" % c['group_desc']
    @debug_str += "          sids              - #{c['sids'].length == 0 ? "None" : "%s#{"\n                              %s" * (c['sids'].length - 1)}" % c['sids']}\n"
    @debug_str += "\n\n"
  end

  c
end

#process_users_f(data) ⇒ Object 



392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 392

def process_users_f(data)
  f = BinaryStruct.decode(MSRegHive.regBinaryToRawBinary(data), SAM_STRUCT_USERS_F)

  @debug_str += "        last_logon              - %s - " % f['last_logon'].to_s if @debug_str
  f['last_logon'] = process_users_f_date(f['last_logon'])
  @debug_str += "%s\n" % (f['last_logon'].nil? ? "Never" : f['last_logon']) if @debug_str

  @debug_str += "        last_pw_set             - %s - " % f['last_pw_set'].to_s if @debug_str
  f['last_pw_set'] = process_users_f_date(f['last_pw_set'])
  @debug_str += "%s\n" % (f['last_pw_set'].nil? ? "Not Change" : f['last_pw_set']) if @debug_str

  @debug_str += "        account_expires         - %s - " % f['account_expires'].to_s if @debug_str
  f['account_expires'] = process_users_f_date(f['account_expires'])
  @debug_str += "%s\n" % (f['account_expires'].nil? ? "Not set to expire" : f['account_expires']) if @debug_str

  @debug_str += "        last_wrong_pw           - %s - " % f['last_wrong_pw'].to_s if @debug_str
  f['last_wrong_pw'] = process_users_f_date(f['last_wrong_pw'])
  @debug_str += "%s\n" % (f['last_wrong_pw'].nil? ? "Not Wrong" : f['last_wrong_pw']) if @debug_str

  @debug_str += "        user_num                - %s\n" % f['user_num'].to_s if @debug_str

  @debug_str += "        logon_ok_account_active - 0x%02x\n" % f['logon_ok_account_active'] if @debug_str
  f['logon_ok'], f['account_active'] = (f['logon_ok_account_active'])
  @debug_str += "          logon_ok              - %s\n" % f['logon_ok'].to_s if @debug_str
  @debug_str += "          account_active        - %s\n" % f['account_active'].to_s if @debug_str

  @debug_str += "        pw_never_expire         - 0x%02x\n" % f['pw_never_expire'] if @debug_str
  f['pw_never_expire'] = process_users_f_pw_never_expire(f['pw_never_expire'])
  @debug_str += "          pw_never_expire       - %s\n" % f['pw_never_expire'].to_s if @debug_str

  @debug_str += "        country_code            - %s - " % f['country_code'] if @debug_str
  f['country_code'] = process_users_f_country_code(f['country_code'])
  @debug_str += "%s\n" % (f['country_code'].nil? ? "Unknown" : f['country_code']) if @debug_str

  @debug_str += "        invalid_pw_count        - %s\n" % f['invalid_pw_count'].to_s if @debug_str
  @debug_str += "        num_logons              - %s\n" % f['num_logons'].to_s if @debug_str

  f
end

#process_users_f_country_code(data) ⇒ Object 



474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 474

def process_users_f_country_code(data)
  country_code = case data
                 when 0 then 'System Default'
                 when 1 then 'United States'
                 when 2 then 'Canada (French)'
                 when 3 then 'Latin America'
                 when 31 then 'Netherlands'
                 when 32 then 'Belgium'
                 when 33 then 'France'
                 when 34 then 'Spain'
                 when 39 then 'Italy'
                 when 41 then 'Switzerland'
                 when 44 then 'United Kingdom'
                 when 45 then 'Denmark'
                 when 46 then 'Sweden'
                 when 47 then 'Norway'
                 when 49 then 'Germany'
                 when 61 then 'Australia'
                 when 81 then 'Japan'
                 when 82 then 'Korea'
                 when 86 then 'China (PRC)'
                 when 88 then 'Taiwan'
                 when 99 then 'Asia'
                 when 351 then 'Portugal'
                 when 358 then 'Finland'
                 when 785 then 'Arabic'
                 when 972 then 'Hebrew'
                 end

  country_code
end

#process_users_f_date(date) ⇒ Object 



432
433
434
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 432

def process_users_f_date(date)
  date == 0 || date == 0x7FFFFFFFFFFFFFFF ? nil : MSRegHive.wtime2time(date)
end

#process_users_f_logon_ok_account_active(data) ⇒ Object 



436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 436

def (data)
  logon_ok = data >> 4
  logon_ok = case logon_ok
             when 0, 2, 6, 8, 10, 12, 14 then false  # Username or Password invalid
             when 1, 3, 4 then true                  # Logon OK
             when 5, 7, 13, 15 then false            # Logon error message 1
             when 9, 11 then false                   # Logon error message 2
             end

   = data & 0x0F
   = case 
                   when 0 then true                        # Active; Password Required; Logon OK
                   when 4 then true                        # Password Not Required; Logon OK
                   when 2, 6, 8, 10, 12, 14 then true      # Logon OK
                   when 1 then false                       # Not Active; Account Disabled / Inactive
                   when 3, 5, 7, 9, 11, 13, 15 then false  # Account Disabled / Inactive"
                   end

  return logon_ok, 
end

#process_users_f_pw_never_expire(data) ⇒ Object 



457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 457

def process_users_f_pw_never_expire(data)
  pw_never_expire = data & 0x0F
  pw_never_expire = case pw_never_expire
                    when 0 then true                        # Secpol Time; Unlocking; Logon OK
                    when 2 then true                        # Never; GUI Setting; Password Never Expires; Logon OK
                    when 8 then true                        # Logon OK
                    when 10 then true                       # Password Never Expires; Logon OK
                    when 3, 7, 11, 15 then true             # Password Never Expires; Logon Error Message"
                    when 1, 5, 9, 13 then false             # Logon Error Message
                    when 6, 14 then true                    # Password Never Expires; Logon OK - Reset to X-4 though
                    when 4 then true                        # Lockout; Password Never Expires; Logon OK - Reset to X-4 though
                    when 12 then true                       # Logon OK - Reset to X-4 though
                    end

  pw_never_expire
end

#process_users_v(data) ⇒ Object 



506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 506

def process_users_v(data)
  bin = MSRegHive.regBinaryToRawBinary(data)
  header_size = SIZEOF_SAM_STRUCT_USERS_V_HEADER
  v = BinaryStruct.decode(bin[0...header_size], SAM_STRUCT_USERS_V_HEADER)

  if @debug_str
    @debug_str += "        Header:\n"
    @debug_str += "          username_offset      - 0x%08x\n" % v['username_offset']
    @debug_str += "          username_length      - %s\n" % v['username_length'].to_s
    @debug_str += "          fullname_offset      - 0x%08x\n" % v['fullname_offset']
    @debug_str += "          fullname_length      - %s\n" % v['fullname_length'].to_s
    @debug_str += "          comment_offset       - 0x%08x\n" % v['comment_offset']
    @debug_str += "          comment_length       - %s\n" % v['comment_length'].to_s
    @debug_str += "          user_comment_offset  - 0x%08x\n" % v['user_comment_offset']
    @debug_str += "          user_comment_length  - %s\n" % v['user_comment_length'].to_s
    @debug_str += "          unknown1_offset      - 0x%08x\n" % v['unknown1_offset']
    @debug_str += "          unknown1_length      - %s\n" % v['unknown1_length'].to_s
    @debug_str += "          homedir_offset       - 0x%08x\n" % v['homedir_offset']
    @debug_str += "          homedir_length       - %s\n" % v['homedir_length'].to_s
    @debug_str += "          homedir_conn_offset  - 0x%08x\n" % v['homedir_conn_offset']
    @debug_str += "          homedir_conn_length  - %s\n" % v['homedir_conn_length'].to_s
    @debug_str += "          script_path_offset   - 0x%08x\n" % v['script_path_offset']
    @debug_str += "          script_path_length   - %s\n" % v['script_path_length'].to_s
    @debug_str += "          profile_path_offset  - 0x%08x\n" % v['profile_path_offset']
    @debug_str += "          profile_path_length  - %s\n" % v['profile_path_length'].to_s
    @debug_str += "          workstations_offset  - 0x%08x\n" % v['workstations_offset']
    @debug_str += "          workstations_length  - %s\n" % v['workstations_length'].to_s
    @debug_str += "          hours_allowed_offset - 0x%08x\n" % v['hours_allowed_offset']
    @debug_str += "          hours_allowed_length - %s\n" % v['hours_allowed_length'].to_s
    @debug_str += "          unknown2_offset      - 0x%08x\n" % v['unknown2_offset']
    @debug_str += "          unknown2_length      - %s\n" % v['unknown2_length'].to_s
    @debug_str += "          LM_pw_hash_offset    - 0x%08x\n" % v['LM_pw_hash_offset']
    @debug_str += "          LM_pw_hash_length    - %s\n" % v['LM_pw_hash_length'].to_s
    @debug_str += "          NT_pw_hash_offset    - 0x%08x\n" % v['NT_pw_hash_offset']
    @debug_str += "          NT_pw_hash_length    - %s\n" % v['NT_pw_hash_length'].to_s
    @debug_str += "          unknown3_offset      - 0x%08x\n" % v['unknown3_offset']
    @debug_str += "          unknown3_length      - %s\n" % v['unknown3_length'].to_s
    @debug_str += "          unknown4_offset      - 0x%08x\n" % v['unknown4_offset']
    @debug_str += "          unknown4_length      - %s\n" % v['unknown4_length'].to_s
    @debug_str += "          num_permissions      - %s\n" % v['num_permissions'].to_s
  end

  # Build middle section based on the num_permissions
  sam_struct_users_v_middle = []

  # Do a sanity check for the permissions section
  return nil if v['num_permissions'] > 100 || v['num_permissions'] <= 0

  sect_start = header_size
  'perm1'.upto("perm#{v['num_permissions']}") do |sect_name|
    bin_data = bin[sect_start + 2...sect_start + 4]
    return nil if bin_data.nil?
    sect_size = bin_data.unpack('S')[0]

    sam_struct_users_v_middle += [
      'a2',                 nil,                    # UNKNOWN
      'S',                  "#{sect_name}_length",  # Length of block for permissions?
      'a4',                 "#{sect_name}_perms",   # Permissions
      "a#{sect_size - 8}",  "#{sect_name}_sid",     # SID
    ]

    sect_start += sect_size
  end

  sam_struct_users_v_middle += [
    'a16',    'admins_group_sidA',      # Administrators group SID
    'a16',    'admins_group_sidB',      # Administrators group SID again
  ]

  # Build footer section based on sizes in header section
  sam_struct_users_v_footer = [
    'a%d' % v['username_length'],                                                                 'username',
    'a%d' % (v['fullname_offset'] - v['username_offset'] - v['username_length']),      nil,
    'a%d' % v['fullname_length'],                                                                 'fullname',
    'a%d' % (v['comment_offset'] - v['fullname_offset'] - v['fullname_length']),      nil,
    'a%d' % v['comment_length'],                                                                  'comment',
    'a%d' % (v['user_comment_offset'] - v['comment_offset'] - v['comment_length']),       nil,
    'a%d' % v['user_comment_length'],                                                             'user_comment',
    'a%d' % (v['unknown1_offset'] - v['user_comment_offset'] - v['user_comment_length']),  nil,
    'a%d' % v['unknown1_length'],                                                                 'unknown1',
    'a%d' % (v['homedir_offset'] - v['unknown1_offset'] - v['unknown1_length']),      nil,
    'a%d' % v['homedir_length'],                                                                  'homedir',
    'a%d' % (v['homedir_conn_offset'] - v['homedir_offset'] - v['homedir_length']),       nil,
    'a%d' % v['homedir_conn_length'],                                                             'homedir_conn',
    'a%d' % (v['script_path_offset'] - v['homedir_conn_offset'] - v['homedir_conn_length']),  nil,
    'a%d' % v['script_path_length'],                                                              'script_path',
    'a%d' % (v['profile_path_offset'] - v['script_path_offset'] - v['script_path_length']),   nil,
    'a%d' % v['profile_path_length'],                                                             'profile_path',
    'a%d' % (v['workstations_offset'] - v['profile_path_offset'] - v['profile_path_length']),  nil,
    'a%d' % v['workstations_length'],                                                             'workstations',
    'a%d' % (v['hours_allowed_offset'] - v['workstations_offset'] - v['workstations_length']),  nil,
    'a%d' % v['hours_allowed_length'],                                                            'hours_allowed',
    'a%d' % (v['unknown2_offset'] - v['hours_allowed_offset'] - v['hours_allowed_length']), nil,
    'a%d' % v['unknown2_length'],                                                                 'unknown2',
    'a%d' % (v['LM_pw_hash_offset'] - v['unknown2_offset'] - v['unknown2_length']),      nil,
    'a%d' % v['LM_pw_hash_length'],                                                               'LM_pw_hash',
    'a%d' % (v['NT_pw_hash_offset'] - v['LM_pw_hash_offset'] - v['LM_pw_hash_length']),    nil,
    'a%d' % v['NT_pw_hash_length'],                                                               'NT_pw_hash',
    'a%d' % (v['unknown3_offset'] - v['NT_pw_hash_offset'] - v['NT_pw_hash_length']),    nil,
    'a%d' % v['unknown3_length'],                                                                 'unknown3',
    'a%d' % (v['unknown4_offset'] - v['unknown3_offset'] - v['unknown3_length']),      nil,
    'a%d' % v['unknown4_length'],                                                                 'unknown4',
  ]

  struct_sam_users_v = [] + SAM_STRUCT_USERS_V_HEADER + sam_struct_users_v_middle + sam_struct_users_v_footer
  v = BinaryStruct.decode(bin, struct_sam_users_v)

  @debug_str += "        Middle:\n" if @debug_str

  'perm1'.upto("perm#{v['num_permissions']}") do |sect_name|
    # Clean up the SID values
    v["#{sect_name}_sid"] = Accounts.rawBinaryToSids(v["#{sect_name}_sid"])[0]

    if @debug_str
      @debug_str += "          #{sect_name}_length#{' ' * (9 - sect_name.length + 5)}- %s\n" % v["#{sect_name}_length"].to_s
      @debug_str += "          #{sect_name}_perms#{' ' * (9 - sect_name.length + 6)}- %s\n" % Accounts.rawBinaryToRegBinary(v["#{sect_name}_perms"])
      @debug_str += "          #{sect_name}_sid#{' ' * (9 - sect_name.length + 8)}- %s\n" % v["#{sect_name}_sid"].to_s
    end
  end
  if @debug_str
    @debug_str += "          admins_group_sidA    - %s\n" % Accounts.rawBinaryToSids(v['admins_group_sidA'])
    @debug_str += "          admins_group_sidB    - %s\n" % Accounts.rawBinaryToSids(v['admins_group_sidB'])
  end

  # Clean up Unicode string fields
  v['username'].UnicodeToUtf8!.tr!("\0", "")
  v['username'] = nil if v['username'].length == 0
  v['fullname'].UnicodeToUtf8!.tr!("\0", "")
  v['fullname'] = nil if v['fullname'].length == 0
  v['comment'].UnicodeToUtf8!.tr!("\0", "")
  v['comment'] = nil if v['comment'].length == 0
  v['user_comment'].UnicodeToUtf8!.tr!("\0", "")
  v['user_comment'] = nil if v['user_comment'].length == 0
  v['homedir'].UnicodeToUtf8!.tr!("\0", "")
  v['homedir'] = nil if v['homedir'].length == 0
  v['homedir_conn'].UnicodeToUtf8!.tr!("\0", "")
  v['homedir_conn'] = nil if v['homedir_conn'].length == 0
  v['script_path'].UnicodeToUtf8!.tr!("\0", "")
  v['script_path'] = nil if v['script_path'].length == 0
  v['profile_path'].UnicodeToUtf8!.tr!("\0", "")
  v['profile_path'] = nil if v['profile_path'].length == 0
  v['workstations'].UnicodeToUtf8!.tr!("\0", "")
  v['workstations'] = nil if v['workstations'].length == 0

  if @debug_str
    @debug_str += "        Footer:\n"
    @debug_str += "          username             - '%s'\n" % v['username']
    @debug_str += "          fullname             - '%s'\n" % v['fullname']
    @debug_str += "          comment              - '%s'\n" % v['comment']
    @debug_str += "          user_comment         - '%s'\n" % v['user_comment']
    @debug_str += "          unknown1             - '%s'\n" % v['unknown1']
    @debug_str += "          homedir              - '%s'\n" % v['homedir']
    @debug_str += "          homedir_conn         - '%s'\n" % v['homedir_conn']
    @debug_str += "          script_path          - '%s'\n" % v['script_path']
    @debug_str += "          profile_path         - '%s'\n" % v['profile_path']
    @debug_str += "          workstations         - '%s'\n" % v['workstations']
    @debug_str += "          hours_allowed        - '%s'\n" % v['hours_allowed']
    @debug_str += "          unknown2             - '%s'\n" % v['unknown2']
    @debug_str += "          LM_pw_hash           - %s\n" % Accounts.rawBinaryToRegBinary(v['LM_pw_hash'])
    @debug_str += "          NT_pw_hash           - %s\n" % Accounts.rawBinaryToRegBinary(v['NT_pw_hash'])
    @debug_str += "          unknown3             - '%s'\n" % v['unknown3']
    @debug_str += "          unknown4             - '%s'\n" % v['unknown4']

    @debug_str += "\n\n"
  end

  v
end

#to_xml(doc = nil) ⇒ Object 



176
177
178
179
180
181
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 176

def to_xml(doc = nil)
  doc = MiqXml.createDoc(nil) unless doc
  usersToXml(doc)
  groupsToXml(doc)
  doc
end

#usersToXml(doc = nil) ⇒ Object 



183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
 
# File 'lib/metadata/util/win32/Win32Accounts.rb', line 183

def usersToXml(doc = nil)
  doc = MiqXml.createDoc(nil) unless doc
  unless @users.empty?
    node = doc.add_element("users")
    @users.each do |u|
      u_groups = u.delete('groups')
      user = node.add_element("user", u)

      u_groups.each do |g|
        user.add_element('member_of_group', 'name' => g)
      end unless u_groups.nil?
    end
  end
  doc
end