peass-ng/PEASS-ng · error · DirectoryReadOnlyException

ERROR_FILE_READ_ONLY

ERROR_FILE_READ_ONLY

Error message

({6000}) The file is read-only: [{path}]

What it means

EncryptDecryptFileCore handles Win32 ERROR_FILE_READ_ONLY (6000) by throwing DirectoryReadOnlyException when the target is a folder, otherwise FileReadOnlyException — surfaced as 'The file is read-only: [path]'. EFS cannot encrypt/decrypt read-only items, so AlphaFS reports the specific attribute problem. The message text is the path template; the bracketed index tag (75 vs 76) marks the same throw for the file branch.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/File Class/File Core Methods/File.EncryptDecryptFileCore.cs:108

         if (!success)
         {
            switch ((uint) lastError)
            {
               case Win32Errors.ERROR_ACCESS_DENIED:

                  if (!string.Equals("NTFS", new DriveInfo(path).DriveFormat, StringComparison.OrdinalIgnoreCase))

                     throw new NotSupportedException(string.Format(CultureInfo.InvariantCulture, "The drive does not support NTFS encryption: [{0}]", Path.GetPathRoot(path, false)));

                  break;


               case Win32Errors.ERROR_FILE_READ_ONLY:

                  if (isFolder)
                     throw new DirectoryReadOnlyException(path);

                  else
                     throw new FileReadOnlyException(path);


               default:
                  NativeError.ThrowException(lastError, isFolder, path);
                  break;
            }
         }
      }
   }
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Clear the read-only attribute before calling Encrypt/Decrypt: File.SetAttributes(path, attrs & ~FileAttributes.ReadOnly)
2. Check the attributes before the call and skip or unblock read-only items
3. Catch FileReadOnlyException and report/handle the specific path

Example fix

// before
File.Encrypt(path); // fails if read-only
// after
var attrs = File.GetAttributes(path);
if ((attrs & FileAttributes.ReadOnly) != 0)
    File.SetAttributes(path, attrs & ~FileAttributes.ReadOnly);
File.Encrypt(path);

var attrs = File.GetAttributes(path);
if ((attrs & FileAttributes.ReadOnly) != 0) File.SetAttributes(path, attrs & ~FileAttributes.ReadOnly);

bool IsReadOnlyEntry(string p) => File.GetAttributes(p).HasFlag(FileAttributes.ReadOnly);

try { File.Encrypt(path); }
catch (FileReadOnlyException) { var a = File.GetAttributes(path); File.SetAttributes(path, a & ~FileAttributes.ReadOnly); File.Encrypt(path); }

When it happens

Trigger: Calling File.Encrypt or File.Decrypt on a file whose attributes include ReadOnly; the native call fails with ERROR_FILE_READ_ONLY and isFolder==false.

Common situations: Files copied from read-only media (CD/DVD); files checked out read-only from source control; folders inheriting read-only attributes; automation runs under an account that cannot modify attributes.

Related errors

• Value cannot be null. Parameter name: path
• ERROR_FILE_READ_ONLY
• The drive does not support NTFS encryption: [{0}]
• ERROR_FILE_READ_ONLY
• ERROR_FILE_READ_ONLY

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/0c4b9f15a80a6445. Report an issue: GitHub.