{"version":1,"pages":[{"id":"-MGYVi3fndUb1t1qP5cl","title":"Windows访问控制","pathname":"/windows-access-control","siteSpaceId":"sitesp_386xJ","description":"本项目主要把理解的Windows访问控制内容进行输出整理，并结合上安全问题来讲解。在学习并整理的过程中发现WIndows的认证内容繁多，访问控制只是其冰山一角，后续也会考虑以访问控制为基础继续完善本项目，将整个认证梳理为文，为后来之人提供研究基础。"},{"id":"-MGYiUOCxymR5hJOgEbi","title":"1. Windows访问控制模型","pathname":"/windows-access-control/1.-windows-fang-wen-kong-zhi-mo-xing","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYY4EgZOnoxdIl-b6z","title":"（一）Access Token","pathname":"/windows-access-control/access-token","siteSpaceId":"sitesp_386xJ","description":"Access Token:与特定的windows账户关联，账户环境下启动的所有进程都会获得该令牌的副本，进程中的线程默认获得这个令牌。"},{"id":"-MGYc_f9RXTjugx2zLfx","title":"（二）安全描述符（SD）","pathname":"/windows-access-control/er-an-quan-miao-shu-fu","siteSpaceId":"sitesp_386xJ","description":"安全描述符，与被访问对象关联。由对象所有者的SID、所属组的SID、DACL、SACL、一组控制Bit组成。"},{"id":"-MGYcCnyj8_Ucl7rdQVk","title":"（三）ACL","pathname":"/windows-access-control/san-acl","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYcmGZvAWIShiMyqcL","title":"（四）ACE","pathname":"/windows-access-control/si-ace","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYcmwdsXfmpP_TTEhT","title":"（五）访问权限与权限码","pathname":"/windows-access-control/wu-fang-wen-quan-xian-yu-quan-xian-ma","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYcnfIIpLPKdeyMCxw","title":"（六）集权策略","pathname":"/windows-access-control/liu-ji-quan-ce-lve","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYco1Q3Dbg9kUOhn_x","title":"（七）安全标识符（SID）","pathname":"/windows-access-control/qi-an-quan-biao-shi-fu","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYdLmqOrxtIqGhTowu","title":"（八）其他","pathname":"/windows-access-control/ba-qi-ta","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYXhkhsF40_nUGORD2","title":"2. SDDL","pathname":"/windows-access-control/security-descriptor-definition-language","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYfaAwRIo5ruXA8Rf3","title":"（一）基于条件表达式ACE的SDDL","pathname":"/windows-access-control/security-descriptor-definition-language-for-conditional-aces","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYfa5EWlM6arNbhr-j","title":"（二）ACE字符串","pathname":"/windows-access-control/ace-strings","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYf_uF1vjpcWVjd35I","title":"（三）SID字符串","pathname":"/windows-access-control/sid-strings","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MGYal7_5Gb1iOAK4TF-","title":"3. 权限控制其他内容","pathname":"/windows-access-control/quan-xian-kong-zhi-qi-ta-nei-rong","siteSpaceId":"sitesp_386xJ","description":""},{"id":"-MIdIwZAv-6ti3y63NEj","title":"4. AD中的ACL","pathname":"/windows-access-control/4.-ad-zhong-de-acl","siteSpaceId":"sitesp_386xJ","description":"Active Directory（AD）对象安全描述符是一个尚未开发的攻击环境，攻击者和防御者都经常忽略它们。尽管AD安全描述符错误配置可以提供许多有助于提升域权限的路径，但它们也为隐蔽部署Active Directory持久性提供了独特的机会。通常很难确定特定的AD安全描述符错误配置是故意设置的还是偶然实现的。"}]}