1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197
| Option Explicit
' WMI Constants
Const WBEM_RETURN_IMMEDIATELY = &h10
Const WBEM_FORWARD_ONLY = &h20
' Constants and storage arrays for security settings
' GetSecurityDescriptor Return values
Dim objReturnCodes : Set objReturnCodes = CreateObject("Scripting.Dictionary")
Const SUCCESS = 0
Const ACCESS_DENIED = 2
Const UNKNOWN_FAILURE = 8
Const PRIVILEGE_MISSING = 9
Const INVALID_PARAMETER = 21
' Security Descriptor Control Flags
Dim objControlFlags : Set objControlFlags = CreateObject("Scripting.Dictionary")
objControlFlags.Add 32768, "SelfRelative"
objControlFlags.Add 16384, "RMControlValid"
objControlFlags.Add 8192, "SystemAclProtected"
objControlFlags.Add 4096, "DiscretionaryAclProtected"
objControlFlags.Add 2048, "SystemAclAutoInherited"
objControlFlags.Add 1024, "DiscretionaryAclAutoInherited"
objControlFlags.Add 512, "SystemAclAutoInheritRequired"
objControlFlags.Add 256, "DiscretionaryAclAutoInheritRequired"
objControlFlags.Add 32, "SystemAclDefaulted"
objControlFlags.Add 16, "SystemAclPresent"
objControlFlags.Add 8, "DiscretionaryAclDefaulted"
objControlFlags.Add 4, "DiscretionaryAclPresent"
objControlFlags.Add 2, "GroupDefaulted"
objControlFlags.Add 1, "OwnerDefaulted"
' ACE Access Right
Dim objAccessRights : Set objAccessRights = CreateObject("Scripting.Dictionary")
objAccessRights.Add 2032127, "FullControl"
objAccessRights.Add 1048576, "Synchronize"
objAccessRights.Add 524288, "TakeOwnership"
objAccessRights.Add 262144, "ChangePermissions"
objAccessRights.Add 197055, "Modify"
objAccessRights.Add 131241, "ReadAndExecute"
objAccessRights.Add 131209, "Read"
objAccessRights.Add 131072, "ReadPermissions"
objAccessRights.Add 65536, "Delete"
objAccessRights.Add 278, "Write"
objAccessRights.Add 256, "WriteAttributes"
objAccessRights.Add 128, "ReadAttributes"
objAccessRights.Add 64, "DeleteSubdirectoriesAndFiles"
objAccessRights.Add 32, "ExecuteFile"
objAccessRights.Add 16, "WriteExtendedAttributes"
objAccessRights.Add 8, "ReadExtendedAttributes"
objAccessRights.Add 4, "AppendData"
objAccessRights.Add 2, "CreateFiles"
objAccessRights.Add 1, "ReadData"
' ACE Types
Dim objAceTypes : Set objAceTypes = CreateObject("Scripting.Dictionary")
objAceTypes.Add 0, "Allow"
objAceTypes.Add 1, "Deny"
objAceTypes.Add 2, "Audit"
' ACE Flags
Dim objAceFlags : Set objAceFlags = CreateObject("Scripting.Dictionary")
objAceFlags.Add 128, "FailedAccess"
objAceFlags.Add 64, "SuccessfulAccess"
objAceFlags.Add 16, "Inherited"
objAceFlags.Add 8, "InheritOnly"
objAceFlags.Add 4, "NoPropagateInherit"
objAceFlags.Add 2, "ContainerInherit"
objAceFlags.Add 1, "ObjectInherit"
Sub ReadNTFSSecurity(objWMI, strPath)
WScript.Echo " Displaying NTFS Security"
Dim objSecuritySettings : Set objSecuritySettings = _
objWMI.Get("Win32_LogicalFileSecuritySetting='" & strPath & "'")
Dim objSD : objSecuritySettings.GetSecurityDescriptor objSD
Dim strDomain : strDomain = objSD.Owner.Domain
If strDomain <> "" Then strDomain = strDomain & "\"
WScript.Echo " Owner: " & strDomain & objSD.Owner.Name
WScript.Echo " Owner SID: " & objSD.Owner.SIDString
WScript.Echo " Basic Control Flags Value: " & objSD.ControlFlags
WScript.Echo " Control Flags:"
DisplayValues objSD.ControlFlags, objControlFlags
WScript.Echo
Dim objACE
' Display the DACL
WScript.Echo " Discretionary Access Control List:"
For Each objACE in objSD.DACL
DisplayACE objACE
Next
' Display the SACL (if there is one)
If Not IsNull(objSD.SACL) Then
WScript.Echo " System Access Control List:"
For Each objACE in objSD.SACL
DisplayACE objACE
Next
End If
End Sub
Sub ReadShareSecurity(objWMI, strName)
WScript.Echo " Displaying Share Security"
Dim objSecuritySettings : Set objSecuritySettings = _
objWMI.Get("Win32_LogicalShareSecuritySetting='" & strName & "'")
Dim objSD : objSecuritySettings.GetSecurityDescriptor objSD
WScript.Echo " Basic Control Flags Value: " & objSD.ControlFlags
WScript.Echo " Control Flags:"
DisplayValues objSD.ControlFlags, objControlFlags
WScript.Echo
Dim objACE
' Display the DACL
WScript.Echo " Discretionary Access Control List:"
For Each objACE in objSD.DACL
DisplayACE objACE
Next
End Sub
Sub DisplayValues(dblValues, objSecurityEnumeration)
Dim dblValue
For Each dblValue in objSecurityEnumeration
If dblValues >= dblValue Then
WScript.Echo " " & objSecurityEnumeration(dblValue)
dblValues = dblValues - dblValue
End If
Next
End Sub
Sub DisplayACE(objACE)
Dim strDomain : strDomain = objAce.Trustee.Domain
If strDomain <> "" Then strDomain = strDomain & "\"
WScript.Echo " Trustee: " & UCase(strDomain & objAce.Trustee.Name)
WScript.Echo " SID: " & objAce.Trustee.SIDString
WScript.Echo " Basic Access Mask Value: " & objACE.AccessMask
WScript.Echo " Access Rights: "
DisplayValues objACE.AccessMask, objAccessRights
WScript.Echo " Type: " & objAceTypes(objACE.AceType)
WScript.Echo " Basic ACE Flags Value: " & objACE.AceFlags
WScript.Echo " ACE Flags: "
DisplayValues objACE.AceFlags, objAceFlags
WScript.Echo
End Sub
'
' Main Code
'
' The system to execute this script against
Dim strComputer : strComputer = "."
' Connect to WMI
Dim objWMI : Set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
' Return all of the shares (Type = 0 means File Shares only, exclude
' are Administrative, Printer, etc)
Dim colItems : Set colItems = _
objWMI.ExecQuery("SELECT * FROM Win32_Share WHERE Type='0'", "WQL", _
WBEM_RETURN_IMMEDIATELY + WBEM_FORWARD_ONLY)
Dim objItem
For Each objItem in colItems
WScript.Echo
WScript.Echo "Security for " & objItem.Path & _
" (Shared as " & objItem.Name & ")"
ReadNTFSSecurity objWMI, objItem.Path
ReadShareSecurity objWMI, objItem.Name
Next |
Partager