trustedsec / CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files
GNU General Public License v2.0
1.26k stars 218 forks source link

Fix cacls crash on null dacl. #98

Closed PaulWhitingS2 closed 1 year ago

PaulWhitingS2 commented 1 year ago

According to MSDN:

A value of TRUE for lpbDaclPresent does not mean that pDacl is not NULL. That is, lpbDaclPresent can be TRUE while pDacl is NULL, meaning that a NULL DACL is in effect. A NULL DACL implicitly allows all access to an object and is not the same as an empty DACL. An empty DACL permits no access to an object.

Attempting to run cacls on a shared folder in VMWare runs into this edge case.