<filename>tools/modifyCertTemplate/src/constants.py

KNOWN_SIDS = {
    "S-1-0": "Null Authority",
    "S-1-0-0": "Nobody",
    "S-1-1": "World Authority",
    "S-1-1-0": "Everyone",
    "S-1-2": "Local Authority",
    "S-1-2-0": "Local",
    "S-1-3": "Creator Authority",
    "S-1-3-0": "Creator Owner",
    "S-1-3-1": "Creator Group",
    "S-1-3-4": "Owner Rights",
    "S-1-4": "Non-unique Authority",
    "S-1-5": "NT Authority",
    "S-1-5-1": "Dialup",
    "S-1-5-2": "Network",
    "S-1-5-3": "Batch",
    "S-1-5-4": "Interactive",
    "S-1-5-5-X-Y": "Logon Session",
    "S-1-5-6": "Service",
    "S-1-5-7": "Anonymous",
    "S-1-5-9": "Enterprise Domain Controllers",
    "S-1-5-10": "Principal Self",
    "S-1-5-11": "Authenticated Users",
    "S-1-5-12": "Restricted Code",
    "S-1-5-13": "Terminal Server Users",
    "S-1-5-14": "Remote Interactive Logon",
    "S-1-5-17": "IUSR",
    "S-1-5-18": "Local System",
    "S-1-5-19": "NT Authority Local Service",
    "S-1-5-20": "NT Authority Network Service",
    "S-1-5-32-544": "Administrators",
    "S-1-5-32-545": "Users",
    "S-1-5-32-546": "Guests",
    "S-1-5-32-547": "Power Users",
    "S-1-5-32-548": "Account Operators",
    "S-1-5-32-549": "Server Operators",
    "S-1-5-32-550": "Print Operators",
    "S-1-5-32-551": "Backup Operators",
    "S-1-5-32-552": "Replicators",
    "S-1-5-32-582": "Storage Replica Administrators",
    "S-1-5-64-10": "NTLM Authentication",
    "S-1-5-64-14": "SChannel Authentication",
    "S-1-5-64-21": "Digest Authentication",
    "S-1-5-80": "NT Service",
}

KNOWN_RIDS = {
    "500": "Administrator",
    "501": "Guest",
    "502": "KRBTGT",
    "512": "Domain Admins",
    "513": "Domain Users",
    "514": "Domain Guests",
    "515": "Domain Computers",
    "516": "Domain Controllers",
    "517": "Cert Publishers",
    "518": "Schema Admins",
    "519": "Enterprise Admins",
    "520": "Group Policy Creator Owners",
    "526": "Key Admins",
    "527": "Enterprise Key Admins",
    "553": "RAS and IAS Servers",
}

# https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L191
ACCESS_MASK_FLAGS = {
    'GENERIC_READ': ('GenericRead', 0x80000000),
    'GENERIC_WRITE': ('GenericWrite', 0x40000000),
    'GENERIC_EXECUTE': ('GenericExecute', 0x20000000),
    'GENERIC_ALL': ('GenericAll', 0x10000000),
    'MAXIMUM_ALLOWED': ('MaximumAllowed', 0x02000000),
    'ACCESS_SYSTEM_SECURITY': ('AccessSystemSecurity', 0x01000000),
    'SYNCHRONIZE': ('Synchronize', 0x00100000),
    'WRITE_OWNER': ('WriteOwner', 0x00080000),
    'WRITE_DACL': ('WriteDacl', 0x00040000),
    'READ_CONTROL': ('ReadControl', 0x00020000),
    'DELETE': ('Delete', 0x00010000)
}


# https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L233
ACCESS_ALLOWED_OBJECT_ACE_FLAGS = {
    'ADS_RIGHT_DS_CONTROL_ACCESS': ('ExtendedRight', 0x00000100),
    'ADS_RIGHT_DS_CREATE_CHILD': ('CreateChild', 0x00000001),
    'ADS_RIGHT_DS_DELETE_CHILD'  : ('DeleteChild', 0x00000002),
    'ADS_RIGHT_DS_READ_PROP': ('ReadProperty', 0x00000010),
    'ADS_RIGHT_DS_WRITE_PROP': ('WriteProperty', 0x00000020),
    'ADS_RIGHT_DS_DELETE_TREE': ('DeleteTree', 0x00000040),
    'ADS_RIGHT_DS_SELF': ('Self', 0x00000008)
}

<filename>tools/modifyCertTemplate/src/constants.py

KNOWN_SIDS = {
    "S-1-0": "Null Authority",
    "S-1-0-0": "Nobody",
    "S-1-1": "World Authority",
    "S-1-1-0": "Everyone",
    "S-1-2": "Local Authority",
    "S-1-2-0": "Local",
    "S-1-3": "Creator Authority",
    "S-1-3-0": "Creator Owner",
    "S-1-3-1": "Creator Group",
    "S-1-3-4": "Owner Rights",
    "S-1-4": "Non-unique Authority",
    "S-1-5": "NT Authority",
    "S-1-5-1": "Dialup",
    "S-1-5-2": "Network",
    "S-1-5-3": "Batch",
    "S-1-5-4": "Interactive",
    "S-1-5-5-X-Y": "Logon Session",
    "S-1-5-6": "Service",
    "S-1-5-7": "Anonymous",
    "S-1-5-9": "Enterprise Domain Controllers",
    "S-1-5-10": "Principal Self",
    "S-1-5-11": "Authenticated Users",
    "S-1-5-12": "Restricted Code",
    "S-1-5-13": "Terminal Server Users",
    "S-1-5-14": "Remote Interactive Logon",
    "S-1-5-17": "IUSR",
    "S-1-5-18": "Local System",
    "S-1-5-19": "NT Authority Local Service",
    "S-1-5-20": "NT Authority Network Service",
    "S-1-5-32-544": "Administrators",
    "S-1-5-32-545": "Users",
    "S-1-5-32-546": "Guests",
    "S-1-5-32-547": "Power Users",
    "S-1-5-32-548": "Account Operators",
    "S-1-5-32-549": "Server Operators",
    "S-1-5-32-550": "Print Operators",
    "S-1-5-32-551": "Backup Operators",
    "S-1-5-32-552": "Replicators",
    "S-1-5-32-582": "Storage Replica Administrators",
    "S-1-5-64-10": "NTLM Authentication",
    "S-1-5-64-14": "SChannel Authentication",
    "S-1-5-64-21": "Digest Authentication",
    "S-1-5-80": "NT Service",
}

KNOWN_RIDS = {
    "500": "Administrator",
    "501": "Guest",
    "502": "KRBTGT",
    "512": "Domain Admins",
    "513": "Domain Users",
    "514": "Domain Guests",
    "515": "Domain Computers",
    "516": "Domain Controllers",
    "517": "Cert Publishers",
    "518": "Schema Admins",
    "519": "Enterprise Admins",
    "520": "Group Policy Creator Owners",
    "526": "Key Admins",
    "527": "Enterprise Key Admins",
    "553": "RAS and IAS Servers",
}

# https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L191
ACCESS_MASK_FLAGS = {
    'GENERIC_READ': ('GenericRead', 0x80000000),
    'GENERIC_WRITE': ('GenericWrite', 0x40000000),
    'GENERIC_EXECUTE': ('GenericExecute', 0x20000000),
    'GENERIC_ALL': ('GenericAll', 0x10000000),
    'MAXIMUM_ALLOWED': ('MaximumAllowed', 0x02000000),
    'ACCESS_SYSTEM_SECURITY': ('AccessSystemSecurity', 0x01000000),
    'SYNCHRONIZE': ('Synchronize', 0x00100000),
    'WRITE_OWNER': ('WriteOwner', 0x00080000),
    'WRITE_DACL': ('WriteDacl', 0x00040000),
    'READ_CONTROL': ('ReadControl', 0x00020000),
    'DELETE': ('Delete', 0x00010000)
}


# https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L233
ACCESS_ALLOWED_OBJECT_ACE_FLAGS = {
    'ADS_RIGHT_DS_CONTROL_ACCESS': ('ExtendedRight', 0x00000100),
    'ADS_RIGHT_DS_CREATE_CHILD': ('CreateChild', 0x00000001),
    'ADS_RIGHT_DS_DELETE_CHILD'  : ('DeleteChild', 0x00000002),
    'ADS_RIGHT_DS_READ_PROP': ('ReadProperty', 0x00000010),
    'ADS_RIGHT_DS_WRITE_PROP': ('WriteProperty', 0x00000020),
    'ADS_RIGHT_DS_DELETE_TREE': ('DeleteTree', 0x00000040),
    'ADS_RIGHT_DS_SELF': ('Self', 0x00000008)
}

# https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L191 # https://github.com/SecureAuthCorp/impacket/blob/master/impacket/ldap/ldaptypes.py#L233