def test_LsarAddPrivilegesToAccount_LsarRemovePrivilegesFromAccount(self):
dce, rpctransport = self.connect()
policyHandle = self.open_policy(dce)
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request[
'InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo'][
'DomainSid'].formatCanonical()
sid = sid + '-9999'
request = lsad.LsarCreateAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request[
'DesiredAccess'] = MAXIMUM_ALLOWED | lsad.ACCOUNT_ADJUST_PRIVILEGES
resp = dce.request(request)
resp.dump()
accountHandle = resp['AccountHandle']
request = lsad.LsarAddPrivilegesToAccount()
request['AccountHandle'] = accountHandle
request['Privileges']['PrivilegeCount'] = 1
request['Privileges']['Control'] = 0
attribute = lsad.LSAPR_LUID_AND_ATTRIBUTES()
attribute['Luid']['LowPart'] = 0
attribute['Luid']['HighPart'] = 3
attribute['Attributes'] = 3
request['Privileges']['Privilege'].append(attribute)
try:
resp = dce.request(request)
resp.dump()
except Exception:
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
dce.request(request)
return
request = lsad.LsarRemovePrivilegesFromAccount()
request['AccountHandle'] = accountHandle
request['AllPrivileges'] = 1
request['Privileges'] = NULL
resp = dce.request(request)
resp.dump()
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
resp = dce.request(request)
resp.dump()
def test_LsarCreateAccount_LsarDeleteObject(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
sid = sid + '-9999'
request = lsad.LsarCreateAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = resp['AccountHandle']
resp = dce.request(request)
resp.dump()