Refactor Permissions & Add Options

README.md

@@ -62,6 +62,8 @@ The key incantations are:
 
 `-a`   Skips file enumeration, just gives you a list of listable shares on the target hosts.
 
+`-g`   Skips file enumeration, just gives you a list of shares and folders on the target hosts. (combine with `-w `for the most useful results)
+
 `-u`   Makes Snaffler pull a list of account names from AD, choose the ones that look most-interesting, and then use them in a search rule.
 
 `-d`   Domain to search for computers to search for shares on to search for files in. Easy.
@@ -80,6 +82,8 @@ The key incantations are:
 
 `-p` Path to a directory full of .toml formatted rules. Snaffler will load all of these in place of the default ruleset.
 
+`-w` Log everything (currently just logs directories walked but not marked for snaffling)
+
 ## What does any of this log output mean?
 
 Hopefully this annotated example will help:

SnaffCore/Classifiers/DirClassifier.cs

@@ -1,4 +1,7 @@
-using SnaffCore.Concurrency;
+using System.IO;
+using SnaffCore.Classifiers.EffectiveAccess;
+using SnaffCore.Concurrency;
+using static SnaffCore.Config.Options;
 
 namespace SnaffCore.Classifiers
 {
@@ -20,6 +23,11 @@ public DirResult ClassifyDir(string dir)
                 Triage = ClassifierRule.Triage,
                 ScanDir = true,
             };
+
+            DirectoryInfo dirInfo = new DirectoryInfo(dir);
+            EffectivePermissions effPerms = new EffectivePermissions(MyOptions.CurrentUser);
+            dirResult.RwStatus = effPerms.CanRw(dirInfo);
+
             // check if it matches
             TextClassifier textClassifier = new TextClassifier(ClassifierRule);
             TextResult textResult = textClassifier.TextMatch(dir);
@@ -30,6 +38,10 @@ public DirResult ClassifyDir(string dir)
                 {
                     case MatchAction.Discard:
                         dirResult.ScanDir = false;
+                        if (MyOptions.LogEverything)
+                        {
+                            Mq.DirResult(dirResult);
+                        }
                         return dirResult;
                     case MatchAction.Snaffle:
                         dirResult.Triage = ClassifierRule.Triage;
@@ -40,6 +52,12 @@ public DirResult ClassifyDir(string dir)
                         return null;
                 }
             }
+
+            if (MyOptions.LogEverything)
+            {
+                Mq.DirResult(dirResult);
+            }
+
             return dirResult;
         }
     }
@@ -48,6 +66,7 @@ public class DirResult
     {
         public bool ScanDir { get; set; }
         public string DirPath { get; set; }
+        public RwStatus RwStatus { get; set; }
         public Triage Triage { get; set; }
     }
 }

SnaffCore/Classifiers/EffectiveAccess.cs

@@ -1,5 +1,10 @@
 
 
+using System;
+using System.IO;
+using System.Security.AccessControl;
+using System.Security.Principal;
+
 namespace SnaffCore.Classifiers.EffectiveAccess
 {
     public class RwStatus
@@ -9,4 +14,71 @@ public class RwStatus
         public bool CanModify { get; set; }
     }
 
+    public class EffectivePermissions
+    {
+        private readonly string _username;
+
+        public EffectivePermissions(string username)
+        {
+            _username = username;
+        }
+
+        public RwStatus CanRw(AuthorizationRuleCollection acl)
+        {
+            RwStatus rwStatus = new RwStatus();
+
+            try
+            {
+                foreach (FileSystemAccessRule rule in acl)
+                {
+                    if (rule.IdentityReference.Value.Equals(_username, StringComparison.OrdinalIgnoreCase))
+                    {
+                        if (((rule.FileSystemRights & FileSystemRights.Read) == FileSystemRights.Read) ||
+                            ((rule.FileSystemRights & FileSystemRights.ReadAndExecute) == FileSystemRights.ReadAndExecute) ||
+                            ((rule.FileSystemRights & FileSystemRights.ReadData) == FileSystemRights.ReadData) ||
+                            ((rule.FileSystemRights & FileSystemRights.ListDirectory) == FileSystemRights.ListDirectory))
+                        {
+                            rwStatus.CanRead = true;
+                        }
+                        if (((rule.FileSystemRights & FileSystemRights.Write) == FileSystemRights.Write) ||
+                            ((rule.FileSystemRights & FileSystemRights.Modify) == FileSystemRights.Modify) ||
+                            ((rule.FileSystemRights & FileSystemRights.FullControl) == FileSystemRights.FullControl) ||
+                            ((rule.FileSystemRights & FileSystemRights.TakeOwnership) == FileSystemRights.TakeOwnership) ||
+                            ((rule.FileSystemRights & FileSystemRights.ChangePermissions) == FileSystemRights.ChangePermissions) ||
+                            ((rule.FileSystemRights & FileSystemRights.AppendData) == FileSystemRights.AppendData) ||
+                            ((rule.FileSystemRights & FileSystemRights.WriteData) == FileSystemRights.WriteData) ||
+                            ((rule.FileSystemRights & FileSystemRights.CreateFiles) == FileSystemRights.CreateFiles) ||
+                            ((rule.FileSystemRights & FileSystemRights.CreateDirectories) == FileSystemRights.CreateDirectories))
+                        {
+                            rwStatus.CanWrite = true;
+                        }
+                        if (((rule.FileSystemRights & FileSystemRights.Modify) == FileSystemRights.Modify) ||
+                            ((rule.FileSystemRights & FileSystemRights.FullControl) == FileSystemRights.FullControl) ||
+                            ((rule.FileSystemRights & FileSystemRights.TakeOwnership) == FileSystemRights.TakeOwnership) ||
+                            ((rule.FileSystemRights & FileSystemRights.ChangePermissions) == FileSystemRights.ChangePermissions))
+                        {
+                            rwStatus.CanModify = true;
+                        }
+                    }
+                }
+            }
+            catch (UnauthorizedAccessException) { }
+
+            return rwStatus;
+        }
+
+        public RwStatus CanRw(FileInfo fileInfo)
+        {
+            FileSecurity fileSecurity = fileInfo.GetAccessControl();
+            AuthorizationRuleCollection acl = fileSecurity.GetAccessRules(true, true, typeof(NTAccount));
+            return CanRw(acl);
+        }
+
+        public RwStatus CanRw(DirectoryInfo dirInfo)
+        {
+            DirectorySecurity dirSecurity = dirInfo.GetAccessControl();
+            AuthorizationRuleCollection acl = dirSecurity.GetAccessRules(true, true, typeof(NTAccount));
+            return CanRw(acl);
+        }
+    }
 }

SnaffCore/Classifiers/FileResult.cs

@@ -14,19 +14,8 @@ public class FileResult
 
         public FileResult(FileInfo fileInfo)
         {
-            //EffectivePermissions effPerms = new EffectivePermissions(MyOptions.CurrentUser);
-
-            // get an aggressively simplified version of the file's ACL
-            //this.RwStatus = effPerms.CanRw(fileInfo);
-            try
-            {
-                File.OpenRead(fileInfo.FullName);
-                this.RwStatus = new RwStatus() { CanRead = true, CanModify = false, CanWrite = false };
-            }
-            catch (Exception e)
-            {
-                this.RwStatus = new RwStatus() { CanModify = false, CanRead = false, CanWrite = false };
-            }
+            EffectivePermissions effPerms = new EffectivePermissions(MyOptions.CurrentUser);
+            this.RwStatus = effPerms.CanRw(fileInfo);
 
             // nasty debug
             this.FileInfo = fileInfo;
@@ -56,58 +45,5 @@ public void SnaffleFile(FileInfo fileInfo, string snafflePath)
             Directory.CreateDirectory(snaffleDirPath);
             File.Copy(sourcePath, (Path.Combine(snafflePath, cleanedPath)), true);
         }
-
-        /*
-        public static EffectivePermissions.RwStatus CanRw(FileInfo fileInfo)
-        {
-            BlockingMq Mq = BlockingMq.GetMq();
-
-            try
-            {
-                EffectivePermissions.RwStatus rwStatus = new EffectivePermissions.RwStatus { CanWrite = false, CanRead = false, CanModify = false };
-                EffectivePermissions effPerms = new EffectivePermissions();
-                string dir = fileInfo.DirectoryName;
-
-                // we hard code this otherwise it tries to do some madness where it uses RPC with a share server to check file access, then fails if you're not admin on that host.
-                string hostname = "localhost";
-
-                string whoami = WindowsIdentity.GetCurrent().Name;
-
-                string[] accessStrings = effPerms.GetEffectivePermissions(fileInfo, whoami);
-
-                string[] readRights = new string[] { "Read", "ReadAndExecute", "ReadData", "ListDirectory" };
-                string[] writeRights = new string[] { "Write", "Modify", "FullControl", "TakeOwnership", "ChangePermissions", "AppendData", "WriteData", "CreateFiles", "CreateDirectories" };
-                string[] modifyRights = new string[] { "Modify", "FullControl", "TakeOwnership", "ChangePermissions" };
-
-                foreach (string access in accessStrings)
-                {
-                    if (access == "FullControl")
-                    {
-                        rwStatus.CanModify = true;
-                        rwStatus.CanRead = true;
-                        rwStatus.CanWrite = true;
-                    }
-                    if (readRights.Contains(access)){
-                        rwStatus.CanRead = true;
-                    }
-                    if (writeRights.Contains(access))
-                    {
-                        rwStatus.CanWrite = true;
-                    }
-                    if (modifyRights.Contains(access))
-                    {
-                        rwStatus.CanModify = true;
-                    }
-                }
-
-                return rwStatus;
-            }
-            catch (Exception e)
-            {
-                Mq.Error(e.ToString());
-                return new EffectivePermissions.RwStatus { CanWrite = false, CanRead = false }; ;
-            }
-        }
-        */
     }
 }

SnaffCore/Classifiers/ShareClassifier.cs

@@ -1,4 +1,5 @@
-using SnaffCore.Concurrency;
+using SnaffCore.Classifiers.EffectiveAccess;
+using SnaffCore.Concurrency;
 using System;
 using System.IO;
 using static SnaffCore.Config.Options;
@@ -32,11 +33,18 @@ public bool ClassifyShare(string share)
                         // in this context snaffle means 'send a report up the queue, and scan the share further'
                         if (IsShareReadable(share))
                         {
+                            // is this supposed to be here?
+                            DirectoryInfo shareInfo = new DirectoryInfo(share);
+
+                            EffectivePermissions effPerms = new EffectivePermissions(MyOptions.CurrentUser);
+                            RwStatus rwStatus = effPerms.CanRw(shareInfo);
+
                             ShareResult shareResult = new ShareResult()
                             {
                                 Triage = ClassifierRule.Triage,
                                 Listable = true,
-                                SharePath = share
+                                SharePath = share,
+                                RwStatus = rwStatus
                             };
                             Mq.ShareResult(shareResult);
                         }
@@ -76,9 +84,7 @@ public class ShareResult
         public string SharePath { get; set; }
         public string ShareComment { get; set; }
         public bool Listable { get; set; }
-        public bool RootWritable { get; set; }
-        public bool RootReadable { get; set; }
-        public bool RootModifyable { get; set; }
+        public RwStatus RwStatus { get; set; }
         public Triage Triage { get; set; } = Triage.Gray; 
     }
 }

SnaffCore/Config/Options.cs

@@ -23,6 +23,8 @@ public partial class Options
         public bool ScanSysvol { get; set; } = true;
         public bool ScanNetlogon { get; set; } = true;
         public bool ScanFoundShares { get; set; } = true;
+        public bool ScanFoundFiles { get; set; } = true;
+        public bool LogEverything { get; set; } = false;
         public int InterestLevel { get; set; } = 0;
         public bool DfsOnly { get; set; } = false;
         public bool DfsShareDiscovery { get; set; } = false;

SnaffCore/ShareFind/ShareFinder.cs

@@ -19,7 +19,7 @@ public class ShareFinder
         private BlockingMq Mq { get; set; }
         private BlockingStaticTaskScheduler TreeTaskScheduler { get; set; }
         private TreeWalker TreeWalker { get; set; }
-        //private EffectivePermissions effectivePermissions { get; set; } = new EffectivePermissions(MyOptions.CurrentUser);
+        private EffectivePermissions EffectivePermissions { get; set; } = new EffectivePermissions(MyOptions.CurrentUser);
 
         public ShareFinder()
         {
@@ -94,7 +94,8 @@ internal void GetComputerShares(string computer)
                         {
                             Listable = true,
                             SharePath = shareName,
-                            ShareComment = hostShareInfo.shi1_remark.ToString()
+                            ShareComment = hostShareInfo.shi1_remark.ToString(),
+                            RwStatus = new RwStatus()
                         };
 
                         // Try to find this computer+share in the list of DFS targets
@@ -159,26 +160,13 @@ internal void GetComputerShares(string computer)
                             // Share is readable, report as green  (the old default/min of the Triage enum )
                             shareResult.Triage = Triage.Green;
 
-                            try
-                            {
-                                DirectoryInfo dirInfo = new DirectoryInfo(shareResult.SharePath);
-
-                                //EffectivePermissions.RwStatus rwStatus = effectivePermissions.CanRw(dirInfo);
-
-                                shareResult.RootModifyable = false;
-                                shareResult.RootWritable = false;
-                                shareResult.RootReadable = true;
+                            DirectoryInfo dirInfo = new DirectoryInfo(shareResult.SharePath);
+                            RwStatus rwStatus = EffectivePermissions.CanRw(dirInfo);
+                            shareResult.RwStatus = rwStatus;
 
-                                /*
-                                 if (rwStatus.CanWrite || rwStatus.CanModify)
-                                {
-                                    triage = Triage.Yellow;
-                                }
-                                */
-                            }
-                            catch (System.UnauthorizedAccessException e)
+                            if (rwStatus.CanWrite || rwStatus.CanModify)
                             {
-                                Mq.Error("Failed to get permissions on " + shareResult.SharePath);
+                                shareResult.Triage = Triage.Yellow;
                             }
 
                             if (MyOptions.ScanFoundShares)