From c436882f4d1f7c1201bd6a96418ca1b34ceacdc1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 22 Sep 2020 19:49:34 +0100 Subject: [PATCH] Windows: Fix up the sids JSON slightly --- .../plugins/windows/sids_and_privileges.json | 70 +++++++++---------- 1 file changed, 35 insertions(+), 35 deletions(-) diff --git a/volatility/framework/plugins/windows/sids_and_privileges.json b/volatility/framework/plugins/windows/sids_and_privileges.json index 21cb7709f..0378699ac 100644 --- a/volatility/framework/plugins/windows/sids_and_privileges.json +++ b/volatility/framework/plugins/windows/sids_and_privileges.json @@ -573,40 +573,40 @@ ["S-1-5-21-[0-9-]+-553$", "Remote Access Services (RAS)"] ], "privileges":{ - 2: ['SeCreateTokenPrivilege', "Create a token object"], - 3: ['SeAssignPrimaryTokenPrivilege', "Replace a process-level token"], - 4: ['SeLockMemoryPrivilege', "Lock pages in memory"], - 5: ['SeIncreaseQuotaPrivilege', "Increase quotas"], - 6: ['SeMachineAccountPrivilege', "Add workstations to the domain"], - 7: ['SeTcbPrivilege', "Act as part of the operating system"], - 8: ['SeSecurityPrivilege', "Manage auditing and security log"], - 9: ['SeTakeOwnershipPrivilege', "Take ownership of files/objects"], - 10: ['SeLoadDriverPrivilege', "Load and unload device drivers"], - 11: ['SeSystemProfilePrivilege', "Profile system performance"], - 12: ['SeSystemtimePrivilege', "Change the system time"], - 13: ['SeProfileSingleProcessPrivilege', "Profile a single process"], - 14: ['SeIncreaseBasePriorityPrivilege', "Increase scheduling priority"], - 15: ['SeCreatePagefilePrivilege', "Create a pagefile"], - 16: ['SeCreatePermanentPrivilege', "Create permanent shared objects"], - 17: ['SeBackupPrivilege', "Backup files and directories"], - 18: ['SeRestorePrivilege', "Restore files and directories"], - 19: ['SeShutdownPrivilege', "Shut down the system"], - 20: ['SeDebugPrivilege', "Debug programs"], - 21: ['SeAuditPrivilege', "Generate security audits"], - 22: ['SeSystemEnvironmentPrivilege', "Edit firmware environment values"], - 23: ['SeChangeNotifyPrivilege', "Receive notifications of changes to files or directories"], - 24: ['SeRemoteShutdownPrivilege', "Force shutdown from a remote system"], - 25: ['SeUndockPrivilege', "Remove computer from docking station"], - 26: ['SeSyncAgentPrivilege', "Synch directory service data"], - 27: ['SeEnableDelegationPrivilege', "Enable user accounts to be trusted for delegation"], - 28: ['SeManageVolumePrivilege', "Manage the files on a volume"], - 29: ['SeImpersonatePrivilege', "Impersonate a client after authentication"], - 30: ['SeCreateGlobalPrivilege', "Create global objects"], - 31: ['SeTrustedCredManAccessPrivilege', "Access Credential Manager as a trusted caller"], - 32: ['SeRelabelPrivilege', "Modify the mandatory integrity level of an object"], - 33: ['SeIncreaseWorkingSetPrivilege', "Allocate more memory for user applications"], - 34: ['SeTimeZonePrivilege', "Adjust the time zone of the computer's internal clock"], - 35: ['SeCreateSymbolicLinkPrivilege', "Required to create a symbolic link"], - 36: ["SeDelegateSessionUserImpersonatePrivilege", "Obtain an impersonation token for another user in the same session."] + "2": ["SeCreateTokenPrivilege", "Create a token object"], + "3": ["SeAssignPrimaryTokenPrivilege", "Replace a process-level token"], + "4": ["SeLockMemoryPrivilege", "Lock pages in memory"], + "5": ["SeIncreaseQuotaPrivilege", "Increase quotas"], + "6": ["SeMachineAccountPrivilege", "Add workstations to the domain"], + "7": ["SeTcbPrivilege", "Act as part of the operating system"], + "8": ["SeSecurityPrivilege", "Manage auditing and security log"], + "9": ["SeTakeOwnershipPrivilege", "Take ownership of files/objects"], + "10": ["SeLoadDriverPrivilege", "Load and unload device drivers"], + "11": ["SeSystemProfilePrivilege", "Profile system performance"], + "12": ["SeSystemtimePrivilege", "Change the system time"], + "13": ["SeProfileSingleProcessPrivilege", "Profile a single process"], + "14": ["SeIncreaseBasePriorityPrivilege", "Increase scheduling priority"], + "15": ["SeCreatePagefilePrivilege", "Create a pagefile"], + "16": ["SeCreatePermanentPrivilege", "Create permanent shared objects"], + "17": ["SeBackupPrivilege", "Backup files and directories"], + "18": ["SeRestorePrivilege", "Restore files and directories"], + "19": ["SeShutdownPrivilege", "Shut down the system"], + "20": ["SeDebugPrivilege", "Debug programs"], + "21": ["SeAuditPrivilege", "Generate security audits"], + "22": ["SeSystemEnvironmentPrivilege", "Edit firmware environment values"], + "23": ["SeChangeNotifyPrivilege", "Receive notifications of changes to files or directories"], + "24": ["SeRemoteShutdownPrivilege", "Force shutdown from a remote system"], + "25": ["SeUndockPrivilege", "Remove computer from docking station"], + "26": ["SeSyncAgentPrivilege", "Synch directory service data"], + "27": ["SeEnableDelegationPrivilege", "Enable user accounts to be trusted for delegation"], + "28": ["SeManageVolumePrivilege", "Manage the files on a volume"], + "29": ["SeImpersonatePrivilege", "Impersonate a client after authentication"], + "30": ["SeCreateGlobalPrivilege", "Create global objects"], + "31": ["SeTrustedCredManAccessPrivilege", "Access Credential Manager as a trusted caller"], + "32": ["SeRelabelPrivilege", "Modify the mandatory integrity level of an object"], + "33": ["SeIncreaseWorkingSetPrivilege", "Allocate more memory for user applications"], + "34": ["SeTimeZonePrivilege", "Adjust the time zone of the computer's internal clock"], + "35": ["SeCreateSymbolicLinkPrivilege", "Required to create a symbolic link"], + "36": ["SeDelegateSessionUserImpersonatePrivilege", "Obtain an impersonation token for another user in the same session."] } } \ No newline at end of file