# SD Resolving feature
Using --resolve-sd, you can resolve the security descriptor to obtain a humanly understandable permission set.

## Structure
Below is a permission displayed using bloodyAD:
```
Type: == ALLOWED_OBJECT == # Describe if it's an allow, deny or auditing permission
Trustee: jane.doe # Subject able to use the permission
Right: WRITE_DACL # Type of right the trustee can use
ObjectType: Self # Type of object it applies (Self is a bloodyAD notation to refer to the SD's object)
InheritedObjectType: account # Which type of object inherit this permission
Flags: INHERIT_ONLY|CONTAINER_INHERIT # Specify special behavior
```

## Merging
A security descriptor contains an Access Control List (ACL) composed with Access Control Entries (ACE), each containing a permission description. If ACEs can be, they will be merged in the output to help the reader.

## Resolving
Trustees' SID and Objects/Rights's GUID are resolved using a dictionnary of constants and by querying the Active Directory. *It doesn't support resolving forest/trust SIDs for the moment*. If a User/Computer/Group had direct (not inherited) permissions on an object and it is deleted, the SID will not resolve (need Administrative rights to see deleted objects).

## Constant Names
Constant names outputed tend to be as close as possible from original names while trying to be more concise and less confusing. When a set of constants is equivalent to another constant, **only** this constant will be outputed (e.g GENERIC_ALL={all permissions except SYNCHRONIZE and ACCESS_SYSTEM_SECURITY}). Below is a list of the constant names used and their official microsoft name and meaning.

### Rights

| bloodyAD names | Official AD names | Description |
| -------------- | ----------------- | ----------- |
| CREATE_CHILD | RIGHT_DS_CREATE_CHILD | Create child objects of the object |
| DELETE_CHILD | RIGHT_DS_DELETE_CHILD | Delete child objects of the object |
| DELETE_TREE | RIGHT_DS_DELETE_TREE | Delete object and its subtree using Delete-Tree operation (LDAP_SERVER_TREE_DELETE_OID) |
| LIST_CHILD | RIGHT_DS_LIST_CONTENT | If not set, user can't see child objects but can see grand child objects if set on a child object |
| LIST_OBJECT | RIGHT_DS_LIST_OBJECT | If both set on parent and object, makes object visible even if LIST_CHILD not set. Works only if dSHeuristics third bit sets to 1 |
| READ_PROP | RIGHT_DS_READ_PROPERTY | Read object properties (SD not included) |
| READ_SD | RIGHT_READ_CONTROL | Read Security Descriptor (SACL not included) |
| WRITE_VALIDATED | RIGHT_DS_WRITE_PROPERTY_EXTENDED | Write only validated attributes (see [MS-ADTS] - 5.1.3.2 for validated write list) |
| WRITE_PROP | RIGHT_DS_WRITE_PROPERTY | Write properties (SD not included) |
| WRITE_DACL | RIGHT_WRITE_DAC | Modify SD DACL a.k.a object permissions |
| WRITE_OWNER | RIGHT_WRITE_OWNER | Set self as owner (can't set others as owners) |
| DELETE | RIGHT_DELETE | Delete object |
| CONTROL_ACCESS | RIGHT_DS_CONTROL_ACCESS | Performing special right described in ACE object type |
| GENERIC_EXECUTE | RIGHT_GENERIC_EXECUTE | READ_SD|LIST_CHILD |
| GENERIC_READ | RIGHT_GENERIC_READ | READ_SD|READ_PROP|LIST_OBJECT|LIST_CHILD |
| GENERIC_WRITE | RIGHT_GENERIC_WRITE | READ_SD|WRITE_PROP|WRITE_VALIDATED |
| GENERIC_ALL | RIGHT_GENERIC_ALL | All permissions except ACCESS_SYSTEM_SECURITY and SYNCHRONIZE |
| ACCESS_SYSTEM_SECURITY | | |
| SYNCHRONIZE | | |

More info: [MS-ADTS] - 5.1.3.2
 
### Controls
bloodyAD names are official names with `ADS_SD_CONTROL_SE_` prefix removed for clarity.

| bloodyAD names | Description |
| -------------- | ----------- |
| DACL_PRESENT | SD contains DACL (ACL containing permissions) |
| SACL_PRESENT | SD contains SACL (ACL containing audit rules) |
| DACL_AUTO_INHERITED | DACL supports automatic propagation of inheritable ACEs to child objects |
| SACL_AUTO_INHERITED | SACL supports automatic propagation of inheritable ACEs to child objects |
| SE_DACL_PROTECTED | Protects the DACL of the security descriptor from being modified by inheritable ACEs |
| SE_SACL_PROTECTED | Protects the SACL of the security descriptor from being modified by inheritable ACEs |

-- Not important flags --

| bloodyAD names | Description |
| -------------- | ----------- |
| GROUP_DEFAULTED | Group SID was generated by a default mechanism |
| OWNER_DEFAULTED | Owner SID was generated by a default mechanism |
| DACL_DEFAULTED | SD uses a default DACL built from creator's access token |
| SACL_DEFAULTED | SD uses a default SACL built from creator's access token |
| DACL_AUTO_INHERIT_REQ | Tells to permission provider to propagate DACL to child objects if inheritance requirements are fulfilled |
| SACL_AUTO_INHERIT_REQ | Tells to permission provider to propagate DACL to child objects if inheritance requirements are fulfilled |
| SELF_RELATIVE | SD is in a self-relative format |

More info: https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_sd_control_enum

### ACE Flags
bloodyAD names are official names with `_ACE` and `_ACE_FLAG` suffix removed for clarity.

| bloodyAD names | Description |
| -------------- | ----------- |
| CONTAINER_INHERIT | Child objects which are containers (e.g. Organizational Unit) will inherit this ACE |
| OBJECT_INHERIT | Child objects which are **not** containers (e.g. computers) will inherit this ACE |
| NO_PROPAGATE_INHERIT | Disable INHERIT_* flags* effect |
| INHERIT_ONLY_ACE | Apply ACE only on child not current object |
| INHERITED_ACE | ACE inherited from parent |
| SUCCESSFUL_ACCESS | Generate success access attempts messages to provider(for audit ACEs only) |
| FAILED_ACCESS | Generate fail access attempts messages to provider (for audit ACEs only)

More info: [MS-DTYP] - 2.4.4.1

### ACE Types
bloodyAD names are official names with `ACCESS_` prefix and `_ACE_TYPE` suffix removed for clarity.
COnstant names are self-explanatory.

More info: [MS-DTYP] - 2.4.4.1

### Note
Null DACL in SD means everyone has all permissions. Empty DACL means no one has permissions.

More info: [MS-ADTS] - 5.1.3.3.1
