Windows isn't easier than Linux - Windows Permissions

I always heard people say that Linux is harder than Windows. Sure, but only if we're talking about everyday use.

I've finished the Linux fundamentals module on HackTheBox and was about to start "Windows Fundamentals" thinking "it's Windows, how hard could it possibly be? What are they going to show me? The GUI?"

What was about to come next caught me off guard: Windows is straight up confusing, and if you ask me what I think to be the most difficult concept to grasp I'd probably say "Windows Permissions"

Here I'll talk about NTFS permissions, not that service permissions are much better but I don't want to make the post confusing by talking about everything

Comparison - Linux Permissions

ls -l The output of this command would be something like:

-rwxr-xr--

Well, that is pretty straightforward, don't you think? For the ones who don't yet know what does that mean or those who need a refresher let's break it down:

• - indicates that the resource is a file

• rwx the first 3 characters are associated to the user who owns the file, "rwx" literally stands for read, write and execute. In this case the user has every permission

• r-x are for the users who are in the group(s) of the owner

• r-- other users have only the permission to read

Now, about Windows, a tool used for permissions is icacls, an example:
Command: icacls c:\Users
Output

c:\Users NT AUTHORITY\SYSTEM:(OI)(CI)(F)
         BUILTIN\Administrators:(OI)(CI)(F)
         BUILTIN\Users:(RX)
         BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
         Everyone:(RX)
         Everyone:(OI)(CI)(IO)(GR,GE)

Too many random letters and...duplicates? Why is (almost) everything shown twice? And... what is this?

ACL

Well, answering the last question first (I know you're usually supposed to start from the first) every line is an ACE (Access Control Entry), part of an ACL (Access Control List). Before thinking "oh, the names are pretty straightforward, I got it", let me tell you that there are two types of ACL

• DACL (Discretionary Access Control List): the one we are looking at now: basically tells who can access a resource and who can't, which actions they can perform and how those permissions are propagated to subfolders (we're just missing the "why" but for that ask the admin)

• SACL (System Access Control List): logs access attempts. We don't care about this now

(Basic) Permissions

Before you may ask yourself (or maybe you already did) whether there are also advanced permissions, I hate to break the news but yes, there are. We will talk about that later though.

There are 6 types of Windows basic permissions:

1. Full Access (F)
2. Read-Only Access (R)
3. Write-Only Access (W)
4. Read and Execute Access (RX)
5. Modify Access (M)
6. Delete Access (D)

And...7? I mean there's only No Access (N) left which isn't really a permission

• A little plot twist: if you look at the Windows GUI you won't find "delete" in the basic permissions but you'll find "list folder contents" (not listed here). With icacls things are different: delete is a permission of its own, and list folder contents is part of RX

So, let's consider a part of our output

c:\Users ...
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
...

BUILTIN\Users often groups users with no special permissions that can perform basic tasks

• The first line tells us the permissions, while the second line isn't about Windows changing its mind but tells us the inheritance

Inheritance

What is inheritance? it's simply the way permissions are passed to subfolders. Which children folders receive automatically what from their parent? Do they receive some permissions at all from them?
In our case we can see:

• OI -> Object-Inherit, only files inherit the permissions
• CI -> Container-Inherit, folders inherit the permissions
• IO -> specifies which permissions the data / subfolders should get from the parent but the parent is excluded. The specified permissions, in this case are GR, GE which are advanced permissions

Points of confusion

A few things that quite confused me...

• Files inherit permissions, containers inherit permissions and then...Inherit only? so are they inheriting or not?
  The answer is that files and folders are just inheriting the permissions we choose

• The duplicates we've seen before (e.g. for BUILTIN\Users) aren't everywhere, some users only have one line, are they special or what? Kind of. They have the same access to subfolders as the main folder

I'll admit I understood this while writing this post, I guess you never stop learning (or never actually start understanding)

Special (advanced) permissions

Imagine that you have the permission to work but it's divided into "permission to go to your workplace and work from a PC there" and "permission to do the tasks you're supposed to do". This doesn't make sense at first. Let's say that your contract states that you can work remote-only: now you can't just go there and demand a PC!

This is what Windows special permissions are about, they're "special" in the sense that they are granular. Every basic permission is made up of multiple special permissions but when I first learned this they had just given me two separate lists so I found it hard to find a correlation between the two things, so I'll group them here:

• The basic read permission is made up of:
  • List folder / Read data
  • Read attributes
  • Read extended attributes
  • Read permissions
• The basic write permission is made up of:
  • Create files / Write data
  • Create folders / append data
  • Write attributes
  • Write extended attributes
• List folder contents and Read & Execute are made up of:
  • All read permissions
  • Traverse folder / execute file special permission
• Modify (and Delete):
  • All read permissions
  • All write permissions + delete (resources and attributes)
• Full control: all 13 permissions (all of the above + take ownership and change ownership)

Windows is easy until you start learning how it works under the hood. On Linux "everything is a file", on Windows "everything is a mess"