danzek · April 14, 2021 12:35 · Mar 22, 2018 · Mar 22, 2018 · Mar 22, 2018 · Mar 22, 2018
diff --git a/sid.py b/sid.py
@@ -16,6 +16,8 @@
     s = SID(filter_sid)
     print(s)  # S-1-5-21-3111613574-2524581245-2586426736-500
 
+## MIT License
+
 Copyright (c) 2018 Dan O'Day <[email protected]>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation 

diff --git a/sid.py b/sid.py
@@ -18,10 +18,17 @@
 
 Copyright (c) 2018 Dan O'Day <[email protected]>
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
-WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation 
+files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, 
+modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the 
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE 
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 """
 
 import struct

diff --git a/sid.py b/sid.py
@@ -1,6 +1,20 @@
 #!/usr/bin/env python
 """
-Module containing class to parse and return normalized Windows SID string given byte array / int array containing SID
+Module containing class to parse and return formatted SID string given list of integers containing SID from byte array
+
+This was made for formatting the CreatorSID from the Microsoft Windows CIM (WMI) repository database in the standard 
+Windows SID format ("S-1-5-21-<RID>-<RID>...). For instance, if using a script such as [`python-cim`](https://github.com/fireeye/flare-wmi/tree/master/python-cim) 
+[filter-to-consumer bindings](https://github.com/fireeye/flare-wmi/blob/master/python-cim/samples/show_filtertoconsumerbindings.py), 
+to extract CreatorSID using that script, you would add `'CreatorSID'` to the filter or consumer properties like so:
+
+    filter_sid = filter.properties["CreatorSID"].value
+    consumer_sid = consumer.properties["CreatorSID"].value
+
+The output from either of these statements could then be used to initialize a SID object to get the formatted Windows 
+SID string:
+
+    s = SID(filter_sid)
+    print(s)  # S-1-5-21-3111613574-2524581245-2586426736-500
 
 Copyright (c) 2018 Dan O'Day <[email protected]>
 

diff --git a/sid.py b/sid.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+"""
+Module containing class to parse and return normalized Windows SID string given byte array / int array containing SID
+
+Copyright (c) 2018 Dan O'Day <[email protected]>
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+"""
+
+import struct
+
+
+class SID(object):
+    """
+    Return normalized Windows SID string given byte array (list of ints) containing SID
+
+    See:
+    - https://technet.microsoft.com/en-us/library/cc962011.aspx
+    - https://msdn.microsoft.com/en-us/library/windows/desktop/aa379597(v=vs.85).aspx
+    - https://blogs.msdn.microsoft.com/oldnewthing/20040315-00/?p=40253
+    - https://www.nirsoft.net/kernel_struct/vista/SID.html
+    - https://www.nirsoft.net/kernel_struct/vista/SID_IDENTIFIER_AUTHORITY.html
+
+    NirSoft C representation of structs:
+
+        typedef struct _SID
+        {
+             UCHAR Revision;
+             UCHAR SubAuthorityCount;
+             SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
+             ULONG SubAuthority[1];
+        } SID, *PSID;
+
+        typedef struct _SID_IDENTIFIER_AUTHORITY
+        {
+             UCHAR Value[6];
+        } SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;
+
+    ## Example Usage
+
+    Example usage. Drop module into import path and use like so:
+
+        from sid import SID
+
+        # ba = byte array containing SID
+        ba = [1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 134, 116, 119, 185, 125, 13, 122, 150, 112, 189, 41, 154, 244, 1, 0, 0]
+        s = SID(ba)
+        print s  # S-1-5-21-3111613574-2524581245-2586426736-500
+
+    """
+    def __init__(self, sid_byte_array):
+        self.sid_byte_array = sid_byte_array
+        self.revision_level = self.sid_byte_array[0]
+        self.subauthority_count = self.sid_byte_array[1]
+        self.identifier_authority = self._unpack_bytes_big_endian(self.sid_byte_array[2:8])
+        self.subauthorities = []
+
+        # current index in sid byte array
+        i = 8  # initial starting position
+        for rid in xrange(self.subauthority_count):
+            self.subauthorities.append(struct.unpack('<L', ''.join([chr(e) for e in self.sid_byte_array[i:i+4]])))
+            i += 4
+
+    def _unpack_bytes_big_endian(self, n):
+        """
+        Convert arbitrary number of bytes to int (big endian)
+
+        The struct unpack() method only works with bytes provided with lengths divisible by powers of 2. I could pad
+        the 48-bit (6-byte) identifier authority value but instead I'm just reimplementing unpack to work with any
+        number of bytes since it's easy math
+
+        :param n: list containing bytes to be converted to int (big endian)
+        :return: int value of bytes n (big endian)
+        """
+        r = 0
+        for b in n:
+            r = r * 256 + int(b)
+        return r
+
+    def __str__(self):
+        """
+        Prints SID in standard format
+
+        :return: SID string in standard format
+        """
+        sid = "S-{0}-{1}".format(self.revision_level, self.identifier_authority)
+        for rid in self.subauthorities:
+            sid += "-{0}".format(str(rid[0]))
+        return sid
No results found