Monday, April 7, 2014

Rewrite of Unquoted Path Vulnerability Script

$hash = @{
"FullPath" = "ServiceValue"}
$hash.keys | % {
    $name = $hash.Item($_)
    if(Test-Path ("hklm:\SYSTEM\CurrentControlSet\Services\" + $name)){
        $info = (Get-ItemProperty ("hklm:\SYSTEM\CurrentControlSet\Services\" + $name) -Name ImagePath -EA "SilentlyContinue").ImagePath
        #Check for quotes
        if ($info -eq "`"$_`""){
            #For testing: Write-Host "Has quotes!" $name $info
        }
        #Check for no quotes
        elseif ($info -eq $_){
            Write-Host "NO QUOTES!" $info #For Testing
            Set-ItemProperty ("hklm:\SYSTEM\CurrentControlSet\Services\" + $name) -Name ImagePath -Value "`"$_`""
        }
    }
}

No comments:

Post a Comment

Test Authentication from Linux Console using python3 pexpect

Working with the IT420 lab, you will discover that we need to discover a vulnerable user account.  The following python3 script uses the pex...