u-chan-secrets 3.0.2 → 4.0.0

package/scripts/windows-security/module-audit.ps1

@@ -0,0 +1,36 @@
+# Internal SYSTEM fixture. The caller supplies auditProcessId and auditServiceHome.
+$ErrorActionPreference='Stop'
+Import-Module "$PSHOME\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1"
+$all=@(Get-CimInstance Win32_Process)
+$ids=@($auditProcessId)
+for($i=0;$i -lt $ids.Count;$i++) {
+    $parent=$ids[$i]
+    $ids+=@($all|Where-Object{$_.ParentProcessId -eq $parent}|ForEach-Object{[int]$_.ProcessId})
+}
+$paths=@();$exited=0;$unreadableLive=@()
+foreach($id in $ids) {
+    try {$paths+=@((Get-Process -Id $id -ErrorAction Stop).Modules|ForEach-Object{$_.FileName})}
+    catch {if(Get-Process -Id $id -ErrorAction SilentlyContinue){$unreadableLive+=$id}else{$exited++}}
+}
+$paths=@($paths|Sort-Object -Unique)
+$servicePrefix=[IO.Path]::GetFullPath($auditServiceHome).TrimEnd('\')+'\'
+$windowsPrefix=[IO.Path]::GetFullPath($env:windir).TrimEnd('\')+'\'
+$outside=@($paths|Where-Object{-not $_.StartsWith($servicePrefix,[StringComparison]::OrdinalIgnoreCase)-and -not $_.StartsWith($windowsPrefix,[StringComparison]::OrdinalIgnoreCase)})
+$defender=0;$unsafe=@()
+foreach($file in $outside) {
+    $item=Get-Item -LiteralPath $file -Force
+    $signature=Get-AuthenticodeSignature -LiteralPath $file
+    $acl=$item.GetAccessControl()
+    $owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+    $trustedOwner=$owner -in @('S-1-5-18','S-1-5-32-544') -or $owner.StartsWith('S-1-5-80-')
+    $bad=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{
+        $_.AccessControlType -eq 'Allow' -and ($_.FileSystemRights -band 0xD0156) -and $_.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544') -and -not $_.IdentityReference.Value.StartsWith('S-1-5-80-')
+    })
+    if($file.StartsWith('C:\ProgramData\Microsoft\Windows Defender\Platform\',[StringComparison]::OrdinalIgnoreCase)-and -not ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)-and $trustedOwner -and $signature.Status -eq 'Valid' -and $signature.SignerCertificate.Subject -match 'O=Microsoft Corporation' -and $bad.Count -eq 0){$defender++}else{$unsafe+=$file}
+}
+@{
+    processes=$ids.Count;modules=$paths.Count;outside=$unsafe;verifiedDefenderModules=$defender
+    unreadableLive=$unreadableLive.Count;exitedBeforeInspection=$exited
+    bitwardenObserved=($paths -contains (Join-Path $auditServiceHome 'bin\bw.exe'))
+    browserObserved=(@($paths|Where-Object{$_.StartsWith((Join-Path $servicePrefix 'bin\browser\'),[StringComparison]::OrdinalIgnoreCase)}).Count -gt 0)
+}|ConvertTo-Json -Compress

package/scripts/windows-security/public-channel.ps1

@@ -0,0 +1,31 @@
+# Internal admin fixture. Inputs are a fixed ProgramData root and a validated run UUID directory.
+$ErrorActionPreference='Stop'
+$admins=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$acl=New-Object Security.AccessControl.DirectorySecurity
+$acl.SetOwner($admins)
+$acl.SetAccessRuleProtection($true,$false)
+foreach($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
+    $rights=if($sid -eq 'S-1-5-32-545'){'ReadAndExecute'}else{'FullControl'}
+    $id=New-Object Security.Principal.SecurityIdentifier($sid)
+    $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($id,$rights,'ContainerInherit,ObjectInherit','None','Allow')))
+}
+function Assert-ProbeChannel([string]$target) {
+    $item=Get-Item -LiteralPath $target -Force
+    if(-not $item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)){throw 'Public channel is redirected'}
+    $current=$item.GetAccessControl()
+    if($current.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Public channel has untrusted owner'}
+    foreach($rule in $current.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])) {
+        if($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band 0xD0156) -and $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Public channel is writable by an untrusted identity'}
+    }
+}
+# Parent delete-child access could otherwise override the protected root's DACL.
+$parent=(Get-Item -LiteralPath ([IO.Path]::GetDirectoryName($probePublicRoot)) -Force).GetAccessControl()
+foreach($rule in $parent.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])) {
+    if($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band 0x40) -and -not ($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -and $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544') -and -not $rule.IdentityReference.Value.StartsWith('S-1-5-80-')){throw 'Public channel parent permits untrusted deletion'}
+}
+if(-not [IO.Directory]::Exists($probePublicRoot)){[IO.Directory]::CreateDirectory($probePublicRoot,$acl)|Out-Null}
+# Validate after creation as CreateDirectory may return an existing directory after a race.
+Assert-ProbeChannel $probePublicRoot
+if([IO.Directory]::Exists($probeRunDirectory)-or [IO.File]::Exists($probeRunDirectory)){throw 'Run UUID has already been used'}
+[IO.Directory]::CreateDirectory($probeRunDirectory,$acl)|Out-Null
+Assert-ProbeChannel $probeRunDirectory

package/scripts/windows-security/result-policy.d.mts

@@ -0,0 +1,2 @@
+export function accepted(native: unknown, attacker: unknown, runId?: string): boolean
+export function moduleAuditSucceeded(audit: unknown): boolean

package/scripts/windows-security/result-policy.mjs

@@ -0,0 +1,9 @@
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+export function accepted(native, attacker, runId) {
+  if (!uuid.test(runId ?? '') || !native || !attacker) return false
+  const expected = ['nonElevated', 'hookPositiveControl', 'capturePositiveControl', 'desktopReadDenied', 'desktopHookDenied', 'desktopSwitchDenied', 'replyPipeConnectDenied', 'replyPipeSpoofDenied']
+  return native.ok === true && native.runId === runId && attacker.runId === runId && expected.every(k => attacker[k] === 'True') && attacker.postClickAccepted === 'False' && attacker.replyPipeConnected === 'False' && attacker.printWindowSawMarker === 'False' && attacker.screenCaptureSawMarker === 'False' && attacker.protectedCanaryEvents === '0'
+}
+export function moduleAuditSucceeded(audit) {
+  return !!audit && Number.isInteger(audit.modules) && audit.modules > 0 && audit.unreadableLive === 0 && Array.isArray(audit.outside) && audit.outside.length === 0 && audit.bitwardenObserved === true && audit.browserObserved === true
+}