GhostPack / SharpUp

SharpUp is a C# port of various PowerUp functionality.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Modifiable Services false positives for explicit AccessDenied DACLs

e0x70i opened this issue · comments

commented

Noticed false positives for a number of services, for example most McAfee services.

image

Checked the ACL and it turns out they have an explicit access denied for the authenticated users SID.

This can probably be fixed by checking the ACE type.

Some jank debug shows the access control type is "AccessDenied" for the false positive sid.

Console.WriteLine("DACL for SID: " + ace.SecurityIdentifier);
                               Console.WriteLine(ace.AccessMask);
                               Console.WriteLine(ace.AceType);

image

Ace types: https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.acetype?view=netframework-4.7.2

Fixed by #15 ;)