Fix SDDL SID alias table missing ten aliases Windows resolves (Fixes #133)

SDDLToSID was populated from the MS-DTYP 2.5.1.1 sid-token table and was missing
three of its rows, so SDDL using them failed to parse in both ACE trustee
position and inside SID(...) in a conditional expression:

  AC  S-1-15-2-1           All Application Packages
  UD  S-1-5-84-0-0-0-0-0   User Mode Drivers
  WR  S-1-5-33             Write Restricted Code

AC in particular appears in the default DACL of many Windows objects, so
descriptors collected from real systems failed rather than degrading.

Seven further aliases are resolved by Windows but absent from the MS-DTYP table.
Their values were read from the 67-entry alias table in sechost.dll (Windows
Server 2025) at .data RVA 0x99f30, whose record layout is alias at +0x02, RID at
+0x18 and a SID-prefix template selector at +0x1c. The template decode was
validated against 19 aliases with independently known SIDs before being trusted
on these:

  AS  S-1-18-1             Authentication Authority Asserted Identity
  SS  S-1-18-2             Service Asserted Identity
  HO  S-1-5-32-584         BUILTIN\\User Mode Hardware Operators
  SH  S-1-5-32-585         BUILTIN\\OpenSSH Users
  AP  S-1-5-21-0-0-0-525   Protected Users
  KA  S-1-5-21-0-0-0-526   Key Admins
  EK  S-1-5-21-0-0-0-527   Enterprise Key Admins

Domain-relative entries follow the existing placeholder-domain convention in this
map. EK resolves against the forest root domain on Windows rather than the local
domain; that distinction is not representable while the domain is a placeholder
and is noted in the map comment.

Author: p0dalirius

sddl/sid/sid.go

@@ -5,21 +5,28 @@ package sid
 
 var SDDLToSID = map[string]string{
 	// Well-known SIDs
-	"WD": "S-1-1-0",  // Everyone
-	"CO": "S-1-3-0",  // Creator Owner
-	"CG": "S-1-3-1",  // Creator Group
-	"OW": "S-1-3-4",  // Owner Rights
-	"NU": "S-1-5-2",  // Network
-	"IU": "S-1-5-4",  // Interactive
-	"SU": "S-1-5-6",  // Service
-	"AN": "S-1-5-7",  // Anonymous
-	"ED": "S-1-5-9",  // Enterprise Domain Controllers
-	"PS": "S-1-5-10", // Principal Self
-	"AU": "S-1-5-11", // Authenticated Users
-	"RC": "S-1-5-12", // Restricted Code
-	"SY": "S-1-5-18", // Local System
-	"LS": "S-1-5-19", // Local Service
-	"NS": "S-1-5-20", // Network Service
+	"WD": "S-1-1-0",            // Everyone
+	"CO": "S-1-3-0",            // Creator Owner
+	"CG": "S-1-3-1",            // Creator Group
+	"OW": "S-1-3-4",            // Owner Rights
+	"NU": "S-1-5-2",            // Network
+	"IU": "S-1-5-4",            // Interactive
+	"SU": "S-1-5-6",            // Service
+	"AN": "S-1-5-7",            // Anonymous
+	"ED": "S-1-5-9",            // Enterprise Domain Controllers
+	"PS": "S-1-5-10",           // Principal Self
+	"AU": "S-1-5-11",           // Authenticated Users
+	"RC": "S-1-5-12",           // Restricted Code
+	"SY": "S-1-5-18",           // Local System
+	"LS": "S-1-5-19",           // Local Service
+	"NS": "S-1-5-20",           // Network Service
+	"WR": "S-1-5-33",           // Write Restricted Code
+	"UD": "S-1-5-84-0-0-0-0-0", // User Mode Drivers
+
+	// Application-package and asserted-identity authorities
+	"AC": "S-1-15-2-1", // All Application Packages
+	"AS": "S-1-18-1",   // Authentication Authority Asserted Identity
+	"SS": "S-1-18-2",   // Service Asserted Identity
 
 	// BUILTIN groups
 	"BA": "S-1-5-32-544", // BUILTIN\Administrators
@@ -46,6 +53,8 @@ var SDDLToSID = map[string]string{
 	"HA": "S-1-5-32-578", // BUILTIN\Hyper-V Administrators
 	"AA": "S-1-5-32-579", // BUILTIN\Access Control Assistance Operators
 	"RM": "S-1-5-32-580", // BUILTIN\Remote Management Users
+	"HO": "S-1-5-32-584", // BUILTIN\User Mode Hardware Operators
+	"SH": "S-1-5-32-585", // BUILTIN\OpenSSH Users
 
 	// Domain-relative SIDs (using placeholder domain 0-0-0)
 	"LA": "S-1-5-21-0-0-0-500", // Domain Administrator Account
@@ -62,6 +71,9 @@ var SDDLToSID = map[string]string{
 	"RO": "S-1-5-21-0-0-0-498", // Enterprise Read-Only Domain Controllers (SDDL_ENTERPRISE_RO_DCs)
 	"CN": "S-1-5-21-0-0-0-522", // Cloneable Domain Controllers
 	"RS": "S-1-5-21-0-0-0-553", // RAS Servers Group
+	"AP": "S-1-5-21-0-0-0-525", // Protected Users
+	"KA": "S-1-5-21-0-0-0-526", // Key Admins
+	"EK": "S-1-5-21-0-0-0-527", // Enterprise Key Admins (forest root domain)
 
 	// Mandatory integrity levels
 	"LW": "S-1-16-4096",  // Low Integrity Level

sddl/sid/sid_test.go

@@ -32,3 +32,69 @@ func TestSDDLAlias_RO(t *testing.T) {
 		t.Errorf("S-1-5-21-0-0-0-521 must not map to \"RO\" (it is the non-aliased Read-Only Domain Controllers group)")
 	}
 }
+
+// msdtypSidTokens is the complete sid-token list from MS-DTYP 2.5.1.1. Every one
+// of these MUST resolve; "AC", "UD" and "WR" were previously absent.
+var msdtypSidTokens = []string{
+	"DA", "DG", "DU", "ED", "DD", "DC", "BA", "BG", "BU", "LA", "LG", "AO", "BO",
+	"PO", "SO", "AU", "PS", "CO", "CG", "SY", "PU", "WD", "RE", "IU", "NU", "SU",
+	"RC", "WR", "AN", "SA", "CA", "RS", "EA", "PA", "RU", "LS", "NS", "RD", "NO",
+	"MU", "LU", "IS", "CY", "OW", "ER", "RO", "CD", "AC", "RA", "ES", "MS", "UD",
+	"HA", "CN", "AA", "RM", "LW", "ME", "MP", "HI", "SI",
+}
+
+// TestSDDLAliases_MSDTYPCoverage checks that every alias in the MS-DTYP
+// sid-token table resolves to a SID.
+func TestSDDLAliases_MSDTYPCoverage(t *testing.T) {
+	for _, alias := range msdtypSidTokens {
+		if got, ok := SDDLToSID[alias]; !ok || got == "" {
+			t.Errorf("SDDLToSID[%q] missing; MS-DTYP 2.5.1.1 defines it as a sid-token", alias)
+		}
+	}
+}
+
+// TestSDDLAliases_WindowsExtras pins the aliases Windows resolves that the
+// MS-DTYP sid-token table does not list. Values were read from the alias table
+// in sechost.dll (Windows Server 2025), .data RVA 0x99f30.
+func TestSDDLAliases_WindowsExtras(t *testing.T) {
+	want := map[string]string{
+		// Documented by MS-DTYP but previously missing here.
+		"AC": "S-1-15-2-1",
+		"UD": "S-1-5-84-0-0-0-0-0",
+		"WR": "S-1-5-33",
+		// Not in the MS-DTYP sid-token table.
+		"AS": "S-1-18-1",
+		"SS": "S-1-18-2",
+		"HO": "S-1-5-32-584",
+		"SH": "S-1-5-32-585",
+		"AP": "S-1-5-21-0-0-0-525",
+		"KA": "S-1-5-21-0-0-0-526",
+		"EK": "S-1-5-21-0-0-0-527",
+	}
+	for alias, wantSID := range want {
+		got, ok := SDDLToSID[alias]
+		if !ok {
+			t.Errorf("SDDLToSID[%q] missing, want %q", alias, wantSID)
+			continue
+		}
+		if got != wantSID {
+			t.Errorf("SDDLToSID[%q] = %q, want %q", alias, got, wantSID)
+		}
+		if back := SIDToSDDL[wantSID]; back != alias {
+			t.Errorf("SIDToSDDL[%q] = %q, want %q", wantSID, back, alias)
+		}
+	}
+}
+
+// TestSDDLAliases_NoDuplicateSIDs guards the derived reverse map: two aliases
+// sharing a SID would make SIDToSDDL depend on map iteration order.
+func TestSDDLAliases_NoDuplicateSIDs(t *testing.T) {
+	seen := make(map[string]string, len(SDDLToSID))
+	for alias, sidStr := range SDDLToSID {
+		if other, dup := seen[sidStr]; dup {
+			t.Errorf("aliases %q and %q both map to %q; SIDToSDDL[%q] is nondeterministic",
+				other, alias, sidStr, sidStr)
+		}
+		seen[sidStr] = alias
+	}
+}