WindowsAccountUtils.java

Go to the documentation of this file.

/*
 * Sleuth Kit Data Model
 *
 * Copyright 2021-2022 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.datamodel;

import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.apache.commons.lang3.StringUtils;
import com.google.common.collect.HashBasedTable;
import com.google.common.collect.Table;
import java.util.Locale;

final class WindowsAccountUtils {
        

        final static String SPECIAL_WINDOWS_BACK_UP_POSTFIX = ".bak";
        
        // Windows sometimes uses a special NULL sid, when a users actual SID is unknown.
        // Our SID comparisons should ignore it, and treat it as a null/blank. 
        final static String WINDOWS_NULL_SID = "S-1-0-0";
        
        // Windows uses SIDs for groups as well as users. 
        // We dont want to create "User" account for group SIDs.
        // The lists here help us identify and weed out group SIDs when creating accounts.
        private static final Set<String> GROUP_SIDS = ImmutableSet.of(
                        "S-1-1-0",      // Everyone
                        "S-1-2-0",      // Local - anyone who has logged on locally
                        "S-1-2-1",      // Console Logon
                        
                        "S-1-3-1",      // Creator
                        "S-1-3-4",      // Owner rights
                        
                        "S-1-5-1",      // Dialup
                        "S-1-5-2",      // Network
                        "S-1-5-3",      // Batch
                        "S-1-5-4",      // Interactive
                        "S-1-5-6",      // Service
                        "S-1-5-7",      // Anonymous
                        "S-1-5-9",      // Enterprise Domain Controllers
                        
                        "S-1-5-11",     // Authenticated Users
                        "S-1-5-12",     // Restricted Code - not a group but not a user SID either
                        "S-1-5-13",     // Terminal Server Users
                        "S-1-5-14",     // Remote Interactive Logon
                        
                        "S-1-5-15",     // This Organization
                        
                        "S-1-5-80-0",   // All Services
                        "S-1-5-83-0",   // NT Virtual Machine\Virtual Machines
                        "S-1-5-90-0"    // Windows Manager\Windows Manager Group
                                
        );
        
        // Any SIDs with the following prefixes are group SID and should be excluded.
        private static final Set<String> GROUP_SID_PREFIX = ImmutableSet.of(
                        "S-1-5-32",             // Builtin
                        "S-1-5-87"              // Task ID prefix
                        
        );
        
        // SIDS that begin with a domain SID prefix and have on of these 
        private static final String NTAUTHORITY_SID_PREFIX = "S-1-5";   
        private static final String NTAUTHORITY_REALM_NAME = "NT AUTHORITY";
        
        
        private static final Set<String> DOMAIN_GROUP_SID_SUFFIX = ImmutableSet.of(
                        "-512",         // Domain Admins
                        "-513",         // Domain Users
                        
                        "-514",         // Domain Guests
                        "-515",         // Domain Computers     
                        "-516",         // Domain Controllers
                        "-517",         // Cert Publishers
                        
                        "-518",         // Schema Admins
                        "-519",         // Enterprise Admins
                        "-520",         // Group Policy Creator Owners
                        
                        "-526",         // Key Admins
                        "-527",         // Enterprise Key Admins
                        
                        "-533",         // RAS and IAS Servers
                        
                        // Windows 2008 and later
                        "-498",         // Enterprise Read-only Domain Controllers
                        "-521",         // Read-only Domain Controllers
                        "-571",         // Allowed RODC Password Replication Group
                        "-572",         // Denied RODC Password Replication Group
                        
                        // Windows 2012 and later
                        "-522"          // Cloneable Domain Controllers
        );
        
        
        public static class WellKnownSidInfo {

                WellKnownSidInfo(boolean isUserSID, String addr, String realmName, String loginName, String description) {
                        this.realmAddr = addr;
                        this.isUserSID = isUserSID;
                        this.realmName = realmName;
                        this.loginName =  this.isUserSID ? loginName : "";
                        this.description = description;
                }
                
                private final String realmAddr;         // realm identifier - S-1-5-18
                private final boolean isUserSID;        // is this a realm SID or a user SID
                private final String realmName;         // realm name 
                private final String loginName;         // user login name, may be empty
                private final String description;       // description 

                public String getRealmAddr() {
                        return realmAddr;
                }

                public boolean isIsUserSID() {
                        return isUserSID;
                }

                public String getRealmName() {
                        return realmName;
                }

                public String getLoginName() {
                        return loginName;
                }

                public String getDescription() {
                        return description;
                }
                
                
        }
        
        // These windows SID indicate well known windows accounts.
        // Well known SIDs and account are handled slightly differently from the regular accounts:
        //  - We can assume and fill in SID from given account name, and vice versa.
        //  - We map account names in foreign languages (some known set) to english names, for these well known accounts. 
        private static final Map<String, WellKnownSidInfo> SPECIAL_SIDS_MAP =  ImmutableMap.<String, WellKnownSidInfo>builder() 
                        .put("S-1-5-17", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "IUSR", "IIS Default Account"))                    
                        .put("S-1-5-18", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "SYSTEM", "Local System Account"))
                        .put("S-1-5-19", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "LOCAL SERVICE", "Local Service Account"))
                        .put("S-1-5-20", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "NETWORK SERVICE", "Network Service Account"))
                        .build();
                

        // These SID prefixes indicate well known windows accounts.
        //  - We can fill in the login names for these SID, as well as account user description.
        private static final Map<String, WellKnownSidInfo> SPECIAL_SID_PREFIXES_MAP = ImmutableMap.<String, WellKnownSidInfo>builder() 
                        .put("S-1-5-80", new WellKnownSidInfo(false, "S-1-5-80", "NT SERVICE", "", "NT Service Virtual Account"))
                        .put("S-1-5-82", new WellKnownSidInfo(false, "S-1-5-82", "IIS APPPOOL", "", "IIS AppPool Virtual Account"))
                        .put("S-1-5-83", new WellKnownSidInfo(false, "S-1-5-83", "NT VIRTUAL MACHINE", "", "Virtual Machine Virtual Account") )
                        .put("S-1-5-90", new WellKnownSidInfo(false, "S-1-5-90", "Window Manager", "", "Windows Manager Virtual Account"))
                        .put("S-1-5-94", new WellKnownSidInfo(false, "S-1-5-94", "WinRM Virtual Users", "", "Windows Remoting Virtual Account"))
                        .put("S-1-5-96",  new WellKnownSidInfo(false, "S-1-5-96", "Font Driver Host", "", "Font Driver Host Virtual Account"))
                        .build();
                        
        
        // Looks for security identifier prefixes of the form S-<number>-<number>-<number>
        // More information on security identifier architecture can be found at: 
        // https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers
        // A number of accounts in the range S-1-5-80-* to S-1-5-111-* are special. 
        private static final Pattern WINDOWS_SPECIAL_ACCOUNT_PREFIX_REGEX = Pattern.compile("^[sS]\\-1\\-5\\-(\\d+)\\-");
        
                        
        // This map reverse maps some of the Well know account names (realm name &login name) to their well known SIDs. 
        private static final Table<String, String, String> SPECIAL_ACCOUNTS_TO_SID_MAP = HashBasedTable.create();
        static {
                SPECIAL_ACCOUNTS_TO_SID_MAP.put(NTAUTHORITY_REALM_NAME, "SYSTEM", "S-1-5-18");
                SPECIAL_ACCOUNTS_TO_SID_MAP.put(NTAUTHORITY_REALM_NAME, "LOCAL SERVICE", "S-1-5-19");
                SPECIAL_ACCOUNTS_TO_SID_MAP.put(NTAUTHORITY_REALM_NAME, "NETWORK SERVICE", "S-1-5-20");
        }
        
        // A mapping of various well known realm names to their English names.  
        // We store only english names in the database for well known SIDs.  
        // Input names provided by client are first mapped to english before lookup or insert. 
        private static final Map<String, String> REALM_NAME_TO_ENGLISH_MAP =  ImmutableMap.<String, String>builder() 
                        .put("NT AUTHORITY", NTAUTHORITY_REALM_NAME)    // to facilitate a quick hit on the english name
                        .put("NT-AUTORIT�T", NTAUTHORITY_REALM_NAME)
                        .put("AUTORITE NT", NTAUTHORITY_REALM_NAME)
                        .put("NT INSTANS", NTAUTHORITY_REALM_NAME)
                        .build();

        // A mapping of various well known realm names to their English names.  
        // We store only english names in the database for well known SIDs.  
        // Input names provided by client are first mapped to english before lookup or insert. 
        private static final Map<String, String> LOGINNAME_TO_ENGLISH_MAP =  ImmutableMap.<String, String>builder() 
                        .put("SYSTEM", "SYSTEM")        // to facilitate a quick hit on the english name
                        .put("SYST�ME", "SYSTEM")
                        
                        .put("LOCAL SERVICE", "LOCAL SERVICE")
                        .put("LOKALER DIENST", "LOCAL SERVICE")
                        .put("SERVICE LOCAL", "LOCAL SERVICE")
                        .put("SERVIZIO LOCALE", "LOCAL SERVICE")
                        .put("SERVICIO LOC", "LOCAL SERVICE")
                        
                        .put("NETWORK SERVICE", "NETWORK SERVICE")
                        .put("NETZWERKDIENST", "NETWORK SERVICE")
                        .put("N�TVERKSTJ�NST", "NETWORK SERVICE")
                        .put("SERVICE R�SEAU", "NETWORK SERVICE")
                        .put("SERVIZIO DI RETE", "NETWORK SERVICE")
                        .put("SERVICIO DE RED", "NETWORK SERVICE")
                        .build();
        
        static boolean isWindowsWellKnownSid(String sid) {
                
                String tempSID = stripWindowsBackupPostfix(sid);
                if (SPECIAL_SIDS_MAP.containsKey(tempSID)) {
                        return true;
                }
                for (String specialPrefix: SPECIAL_SID_PREFIXES_MAP.keySet()) {
                        if (tempSID.startsWith(specialPrefix)) {
                                return true;
                        }
                }
                
                Matcher match = WINDOWS_SPECIAL_ACCOUNT_PREFIX_REGEX.matcher(tempSID);
                if (match.find()) {
                        Integer domainIdentifier = Integer.valueOf(match.group(1));
                        // All the prefixes in the range S-1-5-80 to S-1-5-111 are special
                        if (domainIdentifier != null && domainIdentifier >= 80 && domainIdentifier <= 111) {
                                return true;
                        }
                }
                
                return false;
        }
        
        static boolean isWindowsWellKnownAccountName(String loginName, String realmName) {
                
                String resolvedRealmName = toWellknownEnglishRealmName(realmName);
                String resolvedLoginName = toWellknownEnglishLoginName(loginName);
                if (StringUtils.isBlank(resolvedRealmName) ||  StringUtils.isBlank(resolvedLoginName)) {
                        return false;
                }
                
                return SPECIAL_ACCOUNTS_TO_SID_MAP.contains(resolvedRealmName.toUpperCase(), resolvedLoginName.toUpperCase());
                
        }
        
        private static String getWindowsWellKnownSidRealmAddr(String sid) throws TskCoreException {
                String tempSID = stripWindowsBackupPostfix(sid);

                if (SPECIAL_SIDS_MAP.containsKey(tempSID)) {
                        return SPECIAL_SIDS_MAP.get(tempSID).getRealmAddr();
                }
                
                for (Entry<String, WellKnownSidInfo> specialPrefixEntry : SPECIAL_SID_PREFIXES_MAP.entrySet()) {
                        if (tempSID.startsWith(specialPrefixEntry.getKey())) {
                                return specialPrefixEntry.getValue().getRealmAddr();
                        }
                }

                Matcher match = WINDOWS_SPECIAL_ACCOUNT_PREFIX_REGEX.matcher(tempSID);
                if (match.find()) {
                        Integer domainIdentifier = Integer.valueOf(match.group(1));
                        // All the prefixes in the range S-1-5-80 to S-1-5-111 are special
                        if (domainIdentifier != null && domainIdentifier >= 80 && domainIdentifier <= 111) {
                                String realmAddr = String.format("%s-%d", NTAUTHORITY_SID_PREFIX, domainIdentifier);
                                return realmAddr;
                        }
                }
                
                return "";
        }
        private static WellKnownSidInfo getWindowsWellKnownInfo(String sid) {
                String tempSID = stripWindowsBackupPostfix(sid);
                
                if (SPECIAL_SIDS_MAP.containsKey(tempSID)) {
                        return SPECIAL_SIDS_MAP.get(tempSID);
                }
                for (Entry<String, WellKnownSidInfo> specialPrefixEntry: SPECIAL_SID_PREFIXES_MAP.entrySet()) {
                        if (tempSID.startsWith(specialPrefixEntry.getKey())) {
                                return specialPrefixEntry.getValue();
                        }
                }
                return null;
        }
        
        static String getWindowsWellKnownSidFullName(String sid) {
                WellKnownSidInfo wellKnownSidInfo = getWindowsWellKnownInfo(sid);
                return Objects.nonNull(wellKnownSidInfo) ? wellKnownSidInfo.getDescription() : "";
        }
        
        static String getWindowsWellKnownSidRealmName(String sid) {
                
                if (StringUtils.isNotBlank(sid) && sid.equals(NTAUTHORITY_SID_PREFIX)) {
                        return NTAUTHORITY_REALM_NAME;
                }
                
                WellKnownSidInfo wellKnownSidInfo = getWindowsWellKnownInfo(sid);
                return Objects.nonNull(wellKnownSidInfo) 
                                ? wellKnownSidInfo.getRealmName() 
                                : null;
        }
        
        static String getWindowsWellKnownSidLoginName(String sid) {
                
                WellKnownSidInfo wellKnownSidInfo = getWindowsWellKnownInfo(sid);
                return Objects.nonNull(wellKnownSidInfo) 
                                ? wellKnownSidInfo.getLoginName()
                                : null;
        }
        
        
        static String getWindowsWellKnownAccountSid( String loginName, String realmName) {
                
                String resolvedRealmName = toWellknownEnglishRealmName(realmName);
                String resolvedLoginName = toWellknownEnglishLoginName(loginName);
                if (StringUtils.isBlank(resolvedRealmName) ||  StringUtils.isBlank(resolvedLoginName)) {
                        return null;
                }
                
                return SPECIAL_ACCOUNTS_TO_SID_MAP.get(resolvedRealmName.toUpperCase(), resolvedLoginName.toUpperCase());
                
        }
        
        static String toWellknownEnglishRealmName(String name) {
                return StringUtils.isNotBlank(name)
                                ? REALM_NAME_TO_ENGLISH_MAP.getOrDefault(name.toUpperCase(), name)
                                : null;
        }

        static String toWellknownEnglishLoginName(String name) {
                return StringUtils.isNotBlank(name)
                                ? LOGINNAME_TO_ENGLISH_MAP.getOrDefault(name.toUpperCase(), name)
                                : null;
        }
                
        static boolean isWindowsUserSid(String sid) {
                
                String tempSID = stripWindowsBackupPostfix(sid);
                
                if (GROUP_SIDS.contains(tempSID)) {
                        return false;
                }
                
                for (String prefix: GROUP_SID_PREFIX) {
                        if (tempSID.startsWith(prefix)) {
                                return false;
                        }
                }
                
                // check for domain groups - they have a domains specific identifier but have a fixed prefix and suffix
                if (tempSID.startsWith(NTAUTHORITY_SID_PREFIX)) {
                        for (String suffix : DOMAIN_GROUP_SID_SUFFIX) {
                                if (tempSID.endsWith(suffix)) {
                                        return false;
                                }
                        }
                }
                
                return true;
                
        }
        
        public static String getWindowsRealmAddress(String sid) throws TskCoreException {
                
                String realmAddr;
                String tempSID = stripWindowsBackupPostfix(sid);
                
                if ( isWindowsWellKnownSid(tempSID)) {
                        realmAddr = getWindowsWellKnownSidRealmAddr(sid);
                } else {
                        // SIDs should have at least 4 components: S-1-A-S
                        // A: authority identifier
                        // S: one or more sub-authority identifiers (RIDs)
                        if (org.apache.commons.lang3.StringUtils.countMatches(tempSID, "-") < 3) {
                                throw new TskCoreException(String.format("Invalid SID %s for a host/domain", tempSID));
                        }
                        // get the sub authority SID
                        realmAddr = sid.substring(0, tempSID.lastIndexOf('-'));
                }

                return realmAddr;
        }
        
        private static String stripWindowsBackupPostfix(String sid) {
                String tempSID = sid;
                
                if(tempSID.endsWith(SPECIAL_WINDOWS_BACK_UP_POSTFIX)) {
                        tempSID = tempSID.replace(SPECIAL_WINDOWS_BACK_UP_POSTFIX, "");
                }
                
                return tempSID;
        }
        
}