| 1532 | |
| 1533 | |
| 1534 | class SECURITY_DESCRIPTOR(_NTLMPayloadPacket): |
| 1535 | OFFSET = 20 |
| 1536 | _NTLM_PAYLOAD_FIELD_NAME = "Data" |
| 1537 | fields_desc = [ |
| 1538 | ByteField("Revision", 0x01), |
| 1539 | ByteField("Sbz1", 0x00), |
| 1540 | FlagsField( |
| 1541 | "Control", |
| 1542 | 0x00, |
| 1543 | -16, |
| 1544 | [ |
| 1545 | "OWNER_DEFAULTED", |
| 1546 | "GROUP_DEFAULTED", |
| 1547 | "DACL_PRESENT", |
| 1548 | "DACL_DEFAULTED", |
| 1549 | "SACL_PRESENT", |
| 1550 | "SACL_DEFAULTED", |
| 1551 | "DACL_TRUSTED", |
| 1552 | "SERVER_SECURITY", |
| 1553 | "DACL_COMPUTED", |
| 1554 | "SACL_COMPUTED", |
| 1555 | "DACL_AUTO_INHERITED", |
| 1556 | "SACL_AUTO_INHERITED", |
| 1557 | "DACL_PROTECTED", |
| 1558 | "SACL_PROTECTED", |
| 1559 | "RM_CONTROL_VALID", |
| 1560 | "SELF_RELATIVE", |
| 1561 | ], |
| 1562 | ), |
| 1563 | LEIntField("OwnerSidOffset", None), |
| 1564 | LEIntField("GroupSidOffset", None), |
| 1565 | LEIntField("SACLOffset", None), |
| 1566 | LEIntField("DACLOffset", None), |
| 1567 | _NTLMPayloadField( |
| 1568 | "Data", |
| 1569 | OFFSET, |
| 1570 | [ |
| 1571 | ConditionalField( |
| 1572 | PacketField("OwnerSid", WINNT_SID(), WINNT_SID), |
| 1573 | lambda pkt: pkt.OwnerSidOffset != 0, |
| 1574 | ), |
| 1575 | ConditionalField( |
| 1576 | PacketField("GroupSid", WINNT_SID(), WINNT_SID), |
| 1577 | lambda pkt: pkt.GroupSidOffset != 0, |
| 1578 | ), |
| 1579 | ConditionalField( |
| 1580 | PacketField("SACL", WINNT_ACL(), WINNT_ACL), |
| 1581 | lambda pkt: pkt.Control.SACL_PRESENT, |
| 1582 | ), |
| 1583 | ConditionalField( |
| 1584 | PacketField("DACL", WINNT_ACL(), WINNT_ACL), |
| 1585 | lambda pkt: pkt.Control.DACL_PRESENT, |
| 1586 | ), |
| 1587 | ], |
| 1588 | offset_name="Offset", |
| 1589 | ), |
| 1590 | ] |
| 1591 |
no test coverage detected
searching dependent graphs…