Missing ACE
g0h4n opened this issue · comments
Quentin Texier commented
Some ACEs were missing on one of my labs.
The padding was not taken into consideration on the ACE datas part.
And found ACE with null SID like DOMAIN-S-0-0
struct ACE {
uint8 AceType;
uint8 AceFlags;
uint16 AceSize;
char Data[AceSize - 4];
};
I found my error which was about the size of the data retrieved by RustHound for an ACE.
I changed completely the code of secdesc.rs to fixed the error and to use the new version of nom7 as suricata does to parse the network packet data.