Add None checks around read_sid (#989)

fox-it · Jan 15, 2025 · bc0b9b8 · bc0b9b8
1 parent 3df28eb
commit bc0b9b8
Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/dissect/target/plugins/os/windows/credential/credhist.py b/dissect/target/plugins/os/windows/credential/credhist.py
@@ -125,7 +125,7 @@ def _parse(self) -> Iterator[CredHistEntry]:
                 yield CredHistEntry(
                     version=entry.dwVersion,
                     guid=UUID(bytes_le=entry.guidLink),
-                    user_sid=read_sid(entry.pSid),
+                    user_sid=read_sid(entry.pSid) if entry.pSid else None,
                     hash_alg=HashAlgorithm.from_id(entry.algHash),
                     cipher_alg=cipher_alg,
                     sha1=None,

diff --git a/dissect/target/plugins/os/windows/generic.py b/dissect/target/plugins/os/windows/generic.py
@@ -611,11 +611,12 @@ def sid(self) -> Iterator[ComputerSidRecord]:
 
         try:
             key = self.target.registry.key("HKLM\\SECURITY\\Policy\\PolMachineAccountS")
+            raw_sid = key.value("(Default)").value
 
             yield ComputerSidRecord(
                 ts=key.timestamp,
                 sidtype="Domain",
-                sid=read_sid(key.value("(Default)").value),
+                sid=read_sid(raw_sid) if raw_sid else None,
                 _target=self.target,
             )
         except (RegistryError, struct.error):