Skip to content

dacledit.py: Split -inheritance into -object-inherit and -container-inherit #2143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
int3x wants to merge 2 commits into
base: master
Choose a base branch
from
+18 −13
Open

dacledit.py: Split -inheritance into -object-inherit and -container-inherit #2143

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c3ca50
dacledit.py: Split -inheritance into -object-inherit and -container-i…
int3x Mar 14, 2026
c713b06
revert shebang
int3x Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 18 additions & 13 deletions examples/dacledit.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,9 +239,10 @@ def __init__(self, ldap_server, ldap_session, args):
self.rights = args.rights
self.rights_guid = args.rights_guid
self.filename = args.filename
self.inheritance = args.inheritance
if self.inheritance:
logging.info("NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU")
self.object_inherit = args.object_inherit
self.container_inherit = args.container_inherit
if self.object_inherit or self.container_inherit:
logging.info("NB: objects with adminCount=1 will not inherit ACEs from their parent container/OU")

logging.debug('Initializing domainDumper()')
cnf = ldapdomaindump.domainDumpConfig()
Expand Down Expand Up @@ -657,10 +658,12 @@ def create_ace(self, access_mask, sid, ace_type):
else:
nace['AceType'] = ldaptypes.ACCESS_DENIED_ACE.ACE_TYPE
acedata = ldaptypes.ACCESS_DENIED_ACE()
if self.inheritance:
nace['AceFlags'] = ldaptypes.ACE.OBJECT_INHERIT_ACE + ldaptypes.ACE.CONTAINER_INHERIT_ACE
else:
nace['AceFlags'] = 0x00
ace_flags = 0x00
if self.object_inherit:
ace_flags |= ldaptypes.ACE.OBJECT_INHERIT_ACE
if self.container_inherit:
ace_flags |= ldaptypes.ACE.CONTAINER_INHERIT_ACE
nace['AceFlags'] = ace_flags
acedata['Mask'] = ldaptypes.ACCESS_MASK()
acedata['Mask']['Mask'] = access_mask
acedata['Sid'] = ldaptypes.LDAP_SID()
Expand All @@ -684,10 +687,12 @@ def create_object_ace(self, privguid, sid, ace_type, force_mask=None):
else:
nace['AceType'] = ldaptypes.ACCESS_DENIED_OBJECT_ACE.ACE_TYPE
acedata = ldaptypes.ACCESS_DENIED_OBJECT_ACE()
if self.inheritance:
nace['AceFlags'] = ldaptypes.ACE.OBJECT_INHERIT_ACE + ldaptypes.ACE.CONTAINER_INHERIT_ACE
else:
nace['AceFlags'] = 0x00
ace_flags = 0x00
if self.object_inherit:
ace_flags |= ldaptypes.ACE.OBJECT_INHERIT_ACE
if self.container_inherit:
ace_flags |= ldaptypes.ACE.CONTAINER_INHERIT_ACE
nace['AceFlags'] = ace_flags
acedata['Mask'] = ldaptypes.ACCESS_MASK()
# WriteMembers not an extended right, we need read and write mask on the attribute (https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c79a383c-2b3f-4655-abe7-dcbb7ce0cfbe)
# force_mask in the case we give the -rights-guid option
Expand Down Expand Up @@ -744,8 +749,8 @@ def parse_args():
dacl_parser.add_argument('-rights', choices=['FullControl', 'ResetPassword', 'WriteMembers', 'DCSync', 'Custom'], nargs='?', default='FullControl', help='Rights to write/remove in the target DACL (default: FullControl)')
dacl_parser.add_argument('-rights-guid', type=str, help='Manual GUID representing the right to write/remove')
dacl_parser.add_argument('-mask', nargs='?', default=None, help='Force access mask, possible values: readwrite, write, self, allext, 0xXXXXX. Useful with -rights Custom or --rights-guid where the mask is different of read+write.')
dacl_parser.add_argument('-inheritance', action="store_true", help='Enable the inheritance in the ACE flag with CONTAINER_INHERIT_ACE and OBJECT_INHERIT_ACE. Useful when target is a Container or an OU, '
'ACE will be inherited by objects within the container/OU (except objects with adminCount=1)')
dacl_parser.add_argument('-object-inherit', action="store_true", help='Set OBJECT_INHERIT_ACE flag: ACE is inherited by non-container child objects (except objects with adminCount=1)')
dacl_parser.add_argument('-container-inherit', action="store_true", help='Set CONTAINER_INHERIT_ACE flag: ACE is inherited by child container objects such as OUs (except objects with adminCount=1)')

if len(sys.argv) == 1:
parser.print_help()
Expand Down