{"action":"created","issue":{"url":"https://api.github.com/repos/M2Team/Privexec/issues/11","repository_url":"https://api.github.com/repos/M2Team/Privexec","labels_url":"https://api.github.com/repos/M2Team/Privexec/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/M2Team/Privexec/issues/11/comments","events_url":"https://api.github.com/repos/M2Team/Privexec/issues/11/events","html_url":"https://github.com/M2Team/Privexec/issues/11","id":393500886,"node_id":"MDU6SXNzdWUzOTM1MDA4ODY=","number":11,"title":"Request: Manually Add Capability SIDs","user":{"login":"WildByDesign","id":26308319,"node_id":"MDQ6VXNlcjI2MzA4MzE5","avatar_url":"https://avatars3.githubusercontent.com/u/26308319?v=4","gravatar_id":"","url":"https://api.github.com/users/WildByDesign","html_url":"https://github.com/WildByDesign","followers_url":"https://api.github.com/users/WildByDesign/followers","following_url":"https://api.github.com/users/WildByDesign/following{/other_user}","gists_url":"https://api.github.com/users/WildByDesign/gists{/gist_id}","starred_url":"https://api.github.com/users/WildByDesign/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WildByDesign/subscriptions","organizations_url":"https://api.github.com/users/WildByDesign/orgs","repos_url":"https://api.github.com/users/WildByDesign/repos","events_url":"https://api.github.com/users/WildByDesign/events{/privacy}","received_events_url":"https://api.github.com/users/WildByDesign/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-12-21T15:39:12Z","updated_at":"2018-12-22T03:00:25Z","closed_at":"2018-12-22T02:56:18Z","author_association":"NONE","body":"At the moment, it is not possible to add AppContainer Capabilities aside from the main Well Known SID types. In a previous issue, we had discussed this and realized that it needs more time to figure out and more development in that regard.\r\n\r\nFor right now, it would be a nice feature if we could manually add some Capability SIDs. Possibly in the user interface, maybe have another button in which we can add a list of other Capability SIDs and type/copy those SIDs in manually.\r\n\r\nFor example, I figured out a way to determine Capability SIDs by using @tyranid 's Token Viewer program from https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools repo combined with some command line flags for Chromium browser.\r\n\r\nSome Capability SIDs that I have discovered thus far are:\r\n\r\n> broadFileSystemAccess\r\nS-1-15-3-1024-3247244612-4072385457-573406302-3159362907-4108726569-214783218-394353107-2658650418\r\ninternetExplorer\r\nS-1-15-3-1024-3074157858-2547534938-2297668728-3066639066-623563824-3135784797-1864023905-3488129466\r\nconstrainedImpersonation\r\nS-1-15-3-1024-1604681682-535129537-3273749797-3666938095-336295784-2177615760-2743807136-2867270584\r\nrunFullTrust\r\nS-1-15-3-1024-1365790099-2797813016-1714917928-519942599-2377126242-1094757716-3949770552-3596009590\r\nregistryRead*\r\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\r\nlpacAppExperience\r\nS-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622\r\n\r\nBut of course there are many more.  Therefore, if we had an option in the user interface to manually add Capability SIDs that would be very handy for the time being."},"comment":{"url":"https://api.github.com/repos/M2Team/Privexec/issues/comments/449540402","html_url":"https://github.com/M2Team/Privexec/issues/11#issuecomment-449540402","issue_url":"https://api.github.com/repos/M2Team/Privexec/issues/11","id":449540402,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0OTU0MDQwMg==","user":{"login":"fcharlie","id":6904176,"node_id":"MDQ6VXNlcjY5MDQxNzY=","avatar_url":"https://avatars0.githubusercontent.com/u/6904176?v=4","gravatar_id":"","url":"https://api.github.com/users/fcharlie","html_url":"https://github.com/fcharlie","followers_url":"https://api.github.com/users/fcharlie/followers","following_url":"https://api.github.com/users/fcharlie/following{/other_user}","gists_url":"https://api.github.com/users/fcharlie/gists{/gist_id}","starred_url":"https://api.github.com/users/fcharlie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fcharlie/subscriptions","organizations_url":"https://api.github.com/users/fcharlie/orgs","repos_url":"https://api.github.com/users/fcharlie/repos","events_url":"https://api.github.com/users/fcharlie/events{/privacy}","received_events_url":"https://api.github.com/users/fcharlie/received_events","type":"User","site_admin":false},"created_at":"2018-12-22T03:00:25Z","updated_at":"2018-12-22T03:00:25Z","author_association":"COLLABORATOR","body":"@WildByDesign This issue is confirmed, Privexec does not support rescap, which means that the new Capabilities parsing is only OK in wsudo."}}
{"actor":{"display_login":"fcharlie"}}