wip: prototype for config permissions

Author: superlinkx

cmd/install_windows.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"time"
 
@@ -50,6 +51,7 @@ func installCmdImpl(cmd *cobra.Command, args []string) {
 			DisplayName:      constants.DisplayName,
 			Description:      constants.Description,
 			StartType:        mgr.StartAutomatic,
+			ServiceStartName: constants.ServiceStartName,
 			DelayedAutoStart: true,
 		}
 		recoveryActions = []mgr.RecoveryAction{
@@ -125,12 +127,41 @@ func installService(name string, config mgr.Config, recoveryActions []mgr.Recove
 
 		if err := createService(wsm, name, exe, config, recoveryActions, args...); err != nil {
 			return err
+		} else if err := setACLs(); err != nil {
+			return err
 		} else {
 			return nil
 		}
 	}
 }
 
+func setACLs() error {
+	var (
+		dataDir = config.SystemConfigDirs()[0]
+	)
+
+	if err := runICACLS([]string{dataDir, "/grant", "NT Authority\\SYSTEM:(OI)(CI)F", "/q"}); err != nil {
+		return err
+	} else if err := runICACLS([]string{dataDir, "/grant", "Builtin\\Administrators:(OI)(CI)F", "/q"}); err != nil {
+		return err
+	} else if err := runICACLS([]string{dataDir, "/grant", "NT Service\\" + constants.DisplayName + ":(OI)(CI)RX", "/q"}); err != nil {
+		return err
+	} else if err := runICACLS([]string{dataDir, "/inheritance:r"}); err != nil {
+		return err
+	} else {
+		return nil
+	}
+}
+
+func runICACLS(args []string) error {
+	cmd := exec.Command("icacls.exe", args...)
+	err := cmd.Run()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func createService(wsm *mgr.Mgr, name string, exe string, config mgr.Config, recoveryActions []mgr.RecoveryAction, args ...string) error {
 	if service, err := wsm.OpenService(name); err == nil {
 		service.Close()

constants/misc.go

@@ -27,6 +27,7 @@ var Version string = "v0.0.0"
 const (
 	Name                 string = "azurehound"
 	DisplayName          string = "AzureHound"
+	ServiceStartName     string = "NT Service\\AzureHound"
 	Description          string = "The official tool for collecting Azure data for BloodHound and BloodHound Enterprise"
 	AuthorRef            string = "Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io"
 	AzPowerShellClientID string = "1950a258-227b-4e31-a9cf-717495945fc2"