Alternative implementation for Get-AppSID about windowsfirewallruleset HOT 3 CLOSED

This is a masterpiece!

You have no idea how well this fit's into existing code, it even helped me to find one bug which I would probably never discover and it's now gone.

I'm not sure if I understand how is output the same as Get-Acl... and to test the rest of code but it's well worth the effort,
Although the "filesystem" check is still there but in another function instead, the check is needed for disabled user accounts and server editions.

I'll make sure to add credits to you into script (not sure what copyright to put though?)

Commit is here 70002ef and for now not in release yet, thanks again!

from windowsfirewallruleset.

Great, I thought you'd appreciate it. 👍🏻

I don't think this is copyrightable at all. It just creates a SHA-256 hash of the lowercased PackageFamilyName. This might be a implementation detail, but I don't think Microsoft is going to change that any time soon. Here's one reference I found on page 13: https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Ding-Cutting-Edge-Microsoft-Browser-Security-From-People-Who-Owned-It-wp.pdf

If you'd like to make a native API call, here's yet another solution, which is based on a public API called DeriveAppContainerSidFromAppContainerName. I originally thought this gave a different SID, but it seems you have to lowercase the PackageFamilyName yourself.

$interop = @"
using System;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;

namespace Userenv {
    public class NativeInterop {
        [DllImport("userenv", SetLastError = true)]
        private static extern int DeriveAppContainerSidFromAppContainerName(
            [In, MarshalAs(UnmanagedType.LPWStr)] string appContainerName,
            out IntPtr appContainerSid);

        [DllImport("advapi32", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern bool ConvertSidToStringSid(IntPtr pSid, out string strSid);

        [DllImport("advapi32", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr FreeSid(IntPtr pSid);

        public static string GetAppContainerSidFromAppContainerName(string appContainerName)
        {
            IntPtr appContainerSid;
            if (DeriveAppContainerSidFromAppContainerName(appContainerName, out appContainerSid) == 0)
            {
                string stringSid;
                var converted = ConvertSidToStringSid(appContainerSid, out stringSid);

                if (FreeSid(appContainerSid) != IntPtr.Zero)
                {
                    throw new InvalidOperationException("Could not free the SID");
                }

                if (converted)
                {
                    return stringSid;
                }
            }

            return null;
        }
    }
}
"@
Add-Type -TypeDefinition $interop

[Userenv.NativeInterop]::GetAppContainerSidFromAppContainerName("Microsoft.MicrosoftEdge_8wekyb3d8bbwe".ToLowerInvariant())
S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194

If anyone else ends up here, please note that the firewall rules for packages are not user specific as the Windows Firewall with Advanced Security user interface might indicate.

from windowsfirewallruleset.

Thank you for reference material, it helps to see why this works, I think I'll just stick with first version, it's simpler and does the job.

from windowsfirewallruleset.