def test_hLsarAddPrivilegesToAccount_hLsarRemovePrivilegesFromAccount(
self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy2(
dce, policyHandle,
lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo'][
'DomainSid'].formatCanonical()
sid = sid + '-9999'
resp = lsad.hLsarCreateAccount(dce, policyHandle, sid)
accountHandle = resp['AccountHandle']
attributes = list()
attribute = lsad.LSAPR_LUID_AND_ATTRIBUTES()
attribute['Luid']['LowPart'] = 0
attribute['Luid']['HighPart'] = 3
attribute['Attributes'] = 3
attributes.append(attribute)
try:
resp = lsad.hLsarAddPrivilegesToAccount(dce, accountHandle,
attributes)
resp.dump()
except:
resp = lsad.hLsarDeleteObject(dce, accountHandle)
return
resp = lsad.hLsarRemovePrivilegesFromAccount(dce, accountHandle, NULL,
1)
resp.dump()
resp = lsad.hLsarDeleteObject(dce, accountHandle)
resp.dump()
def test_LsarAddPrivilegesToAccount_LsarRemovePrivilegesFromAccount(self):
dce, rpctransport = self.connect()
policyHandle = self.open_policy(dce)
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request[
'InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo'][
'DomainSid'].formatCanonical()
sid = sid + '-9999'
request = lsad.LsarCreateAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request[
'DesiredAccess'] = MAXIMUM_ALLOWED | lsad.ACCOUNT_ADJUST_PRIVILEGES
resp = dce.request(request)
resp.dump()
accountHandle = resp['AccountHandle']
request = lsad.LsarAddPrivilegesToAccount()
request['AccountHandle'] = accountHandle
request['Privileges']['PrivilegeCount'] = 1
request['Privileges']['Control'] = 0
attribute = lsad.LSAPR_LUID_AND_ATTRIBUTES()
attribute['Luid']['LowPart'] = 0
attribute['Luid']['HighPart'] = 3
attribute['Attributes'] = 3
request['Privileges']['Privilege'].append(attribute)
try:
resp = dce.request(request)
resp.dump()
except Exception:
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
dce.request(request)
return
request = lsad.LsarRemovePrivilegesFromAccount()
request['AccountHandle'] = accountHandle
request['AllPrivileges'] = 1
request['Privileges'] = NULL
resp = dce.request(request)
resp.dump()
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
resp = dce.request(request)
resp.dump()