No ACL input available error

[forensic65x]

I am receiving the following error below.

Not sure if its related but I am running it from a non-domain member system.

I specified the domain, username and password and it successfully bound to AD.

....
[] Getting schema classes...
[] Found 4729 schema classes
[] Getting extended rights from schema...
[] Found 142 extended rights
[*] Running SharpHound v2.0.0...
Get-SharpHoundACL : [Get-SharpHoundACL] No ACL input available.
At \github\Invoke-ACLPwn\Invoke-ACLPwn.ps1:1724 char:17

• ... InputPath = Get-SharpHoundACL -sharpHoundLocation $sharpHoundLocation ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-SharpHoundACL

[stock99]

Run into similar issue just now. I tried different sharphound.exe. Not how to fix it...

---

Invoke-Runas :
Mmm, something went wrong! GetLastError returned:
At C:\test\AD_assessment\pwnacl\august sharp\Invoke-ACLPwn.ps1:836 char:9
+         Invoke-Runas -User $global:ldapConnInfo.sAMAccountName -Passw ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-Runas

Invoke-Runas : ==> The operation completed successfully
At C:\test\AD_assessment\pwnacl\august sharp\Invoke-ACLPwn.ps1:836 char:9
+         Invoke-Runas -User $global:ldapConnInfo.sAMAccountName -Passw ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-Runas

Get-SharpHoundACL : [Get-SharpHoundACL] No ACL input available.
At C:\test\AD_assessment\pwnacl\august sharp\Invoke-ACLPwn.ps1:1724 char:17
+ ... InputPath = Get-SharpHoundACL -sharpHoundLocation $sharpHoundLocation ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-SharpHoundACL

[stock99]

it turns out that line 1436 trying to check if sharphound.exe is running but didn't work. So if one remove the ".exe" from "ShardHound.exe" from line 1436. That will stop the program exit prematurely.
$p = Get-Process '*SharpHound'

ps: btw. I am running windows 10. So this might be working on win7(didn't test.. just guessing).

[senseworld]

I haven't been able to retrieve the ACLs from SharpHound even after removing the exe from line 1436. The machine I'm running it on doesn't produce any output when running the exe anyway but does map the domain when running the ps1 script.

[gioulisapo]

I have ran at the same issue, the comment by @stock99 didn't fix it:

.\Invoke-ACLPwn.ps1 -SharpHoundLocation C:\Users\svc-alfresco\Documents\SharpHound.exe -mimiKatzLocation C:\Users\svc-alfresco\Documents\mimikatz.exe -Username 'svc-alfresco' -Password s3rvice -Domain htb.local -userAccountToPwn Administrator
Access denied
At C:\Users\svc-alfresco\Documents\Invoke-ACLPwn.ps1:1116 char:22
+ ...    $partOfDomain = (Get-WmiObject -Class Win32_ComputerSystem).PartOf ...
+                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
[*]     Checking if we can bind to AD...
[*]     Succesfully bound to AD with supplied info.
[*]     Finding primary DC...
[*]     Found PDC 'FOREST.htb.local'
[*]     Finding Naming context for Configururation and Schema stores partitions...
[*]     Found configstore: CN=Configuration,DC=htb,DC=local
[*]     Found schemastore: CN=Schema,CN=Configuration,DC=htb,DC=local
[*]     Retrieving groupmembership for user svc-alfresco...
[*]     User 'svc-alfresco' is member of 4 group(s)
[*]     Getting schema classes...
[*]     Found 4537 schema classes
[*]     Getting extended rights from schema...
[*]     Found 143 extended rights
[*]     Running ...
You cannot call a method on a null-valued expression.
At C:\Users\svc-alfresco\Documents\Invoke-ACLPwn.ps1:1399 char:9
+     if ($sharphoundVersion.ToLower().Contains("sharphound v2")){
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
[Get-SharpHoundACL] No ACL input available.
At C:\Users\svc-alfresco\Documents\Invoke-ACLPwn.ps1:1724 char:17
+ ... InputPath = Get-SharpHoundACL -sharpHoundLocation $sharpHoundLocation ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-SharpHoundACL

[emptyArrayLLC]

Same Issue as @stock99 but his fix didn't change anything for me. Latest Win 10 version.

[0xm4ud]

@gioulisapo have u found a way to fix it, bud ?

[TommyWhite]

Faced with same issue.
I am not an expert in these internals, but looks like issue raise because of calling option that does not exist.

SharpHound 3.0.0.0
Copyright   2019
                                                                                                        
ERROR(S):
       Option 'CSVPrefix' is unknown.

[kpomeroy1979]

Has anyone found a fix for this issue? Seems the developer does not respond.

[d0ryy]

Fixed the issues that were causing that error. I tried this against HTB: Forest and it worked. Might not work in production environments though.
https://github.com/d0ryy/Invoke-ACLPwn

All credit to fox-it. All I did was do some cleaning up on this specific error.

[Lowjack-LeMou]

Fix didn't work for me, but identified the issue (at least on my system) : The sharphound command uses the --NoSaveCache option, which throws an error when running the sharphound command directly (v1.0.3). Removing the --NoSaveCache option on line 1413 solved the issue for me !

[d0ryy]

Fix didn't work for me, but identified the issue (at least on my system) : The sharphound command uses the --NoSaveCache option, which throws an error when running the sharphound command directly (v1.0.3). Removing the --NoSaveCache option on line 1413 solved the issue for me !

Nice catch. Removed that from my fork. Hopefully that fixes it for you.

[mostwanted002]

I'm on the same HTB challenge and this seemed to work! :D

[OmniSl4sh]

To solve this, you have to download and use the older sharphound (v2) ingestor. It requires .NET 3.5 though.

I learned this from the code (lines 1387-1405)

below, you can see it's checking if sharphound is version 2 or not based on the help output.

function Is-NewSharphoundVersion([string]$sharphoundLocation){

    $result = $false

    # Dirty hack to get sharphound version :(
    $tmpPath = [system.IO.Path]::GetTempPath()
    Start-process -wait -WindowStyle Hidden -filePath $sharphoundLocation -ArgumentList "-h" -RedirectStandardError "$tmpPath\out2.txt"

    $sharpHoundHelp = Get-Content "$tmpPath\out2.txt"    
    $sharphoundVersion = ($sharpHoundHelp -split '`r`n')[0]
    Write-Status "Running $($sharphoundVersion)..." 

    if ($sharphoundVersion.ToLower().Contains("sharphound v2")){
        $result = $true
    }

    Remove-Item "$tmpPath\out2.txt"
    return $result
}

later on (1412-1418) if it doesn't find the version to be 2, it still uses parameters that don't exist in the latest version: --CSVPrefix and --NoSaveCache

    if ($isNewVersion){
        $fileName = "{0}.zip" -f [datetime]::Now.ToFileTime()
        $arg = "$($global:ldapConnInfo.domain) -c acl --ZipFileName $($fileName) --NoSaveCache"
    } else {
        $fileName = "{0}" -f [datetime]::Now.ToFileTime()
        $arg = "-d $($global:ldapConnInfo.domain) -c acl --CSVPrefix $($fileName) --NoSaveCache"
    }

so, once you use the v2 binary, it works normally:

[*]     Integrated login, using account 'john.smith'
[*]     Checking if we can bind to AD...
[*]     Succesfully bound to AD with supplied info.
[*]     Finding primary DC...
[*]     Found PDC 'DC1.LAB.local'
[*]     Finding Naming context for Configururation and Schema stores partitions...
[*]     Found configstore: CN=Configuration,DC=LAB,DC=local
[*]     Found schemastore: CN=Schema,CN=Configuration,DC=LAB,DC=local
[*]     Retrieving groupmembership for user john.smith...
[*]     User 'john.smith' is member of 0 group(s)
[*]     Getting schema classes...
[*]     Found 1778 schema classes
[*]     Getting extended rights from schema...
[*]     Found 81 extended rights
[*]     Running SharpHound v2.0.0...
[*]     Found 449 ACLs
[*]     Parsing ACL. This might take a while...
[*]     Processed 25 ACLs so far...
[*]     Processed 50 ACLs so far...
[*]     Processed 75 ACLs so far...
[*]     No chain found :(