windowsprivcheck.py 文件源码

def check_processes():
    pids = win32process.EnumProcesses()
    # TODO also check out WMI.  It might not be running, but it could help if it is:  
    #      http://groups.google.com/group/comp.lang.python/browse_thread/thread/1f50065064173ccb
    # TODO process explorer can find quite a lot more information than this script.  This script has several problems:
    # TODO I can't open 64-bit processes for a 32-bit app.  I get this error:
    # ERROR: can't open 6100: 299 EnumProcessModules, Only part of a ReadProcessMemory
    #        or WriteProcessMemory request was completed.
    # TODO I can't seem to get the name of elevated processes (user running as me, but with admin privs)
    # TODO I can't get details of certain processes runnign as SYSTEM on xp (e.g. pid 4 "system", csrss.exe)
    # TODO should be able to find name (and threads?) for all processes.  Not necessarily path.

    for pid in sorted(pids):
        # TODO there's a security descriptor for each process accessible via GetSecurityInfo according to http://msdn.microsoft.com/en-us/library/ms684880%28VS.85%29.aspx
        # TODO could we connect with PROCESS_QUERY_LIMITED_INFORMATION instead on Vista+
        try:
            ph = win32api.OpenProcess(win32con.PROCESS_VM_READ | win32con.PROCESS_QUERY_INFORMATION , False, pid)
        except:
            # print "ERROR: can't connected to PID " + str(pid)
            sys.stdout.write("?")
            continue
        else:
            user = "unknown\\unknown"
            try:
                tokenh = win32security.OpenProcessToken(ph, win32con.TOKEN_QUERY)
            except:
                pass
            else:
                sidObj, intVal = win32security.GetTokenInformation(tokenh, TokenUser)
                #source = win32security.GetTokenInformation(tokenh, TokenSource)
                if sidObj:
                    accountName, domainName, accountTypeInt = win32security.LookupAccountSid(remote_server, sidObj)
                    # print "pid=%d accountname=%s domainname=%s wow64=%s" % (pid, accountName, domainName, win32process.IsWow64Process(ph))
                    user = domainName + "\\" + accountName

            # print "PID %d is running as %s" % (pid, user)
            sys.stdout.write(".")
            try:
                mhs = win32process.EnumProcessModules(ph)
                # print mhs
            except:
                continue

            mhs = list(mhs)
            exe = win32process.GetModuleFileNameEx(ph, mhs.pop(0))
            weak_perms = check_weak_write_perms(exe, 'file')
            # print_weak_perms("PID " + str(pid) + " running as " + user + ":", weak_perms)
            if weak_perms:
                save_issue("WPC016", "weak_perms_exes", weak_perms)
                sys.stdout.write("!")

            for mh in mhs:
                # print "PID %d (%s) has loaded module: %s" % (pid, exe, win32process.GetModuleFileNameEx(ph, mh))
                dll = win32process.GetModuleFileNameEx(ph, mh)
                weak_perms = check_weak_write_perms(dll, 'file')
                # print_weak_perms("DLL used by PID " + str(pid) + " running as " + user + " (" + exe + "):", weak_perms)
                if weak_perms:
                    save_issue("WPC016", "weak_perms_dlls", weak_perms)
                    sys.stdout.write("!")
    print