search

MHaggis / ShellSweep

ShellSweeping the evil.
Apache License 2.0
52 stars 6 forks source link

ShellSweepPlus.ps1 Errors #1

Open PeterCottontail2023 opened 5 months ago

PeterCottontail2023 commented 5 months ago

Receiving errors when attempting to execute ShellSweepPlus.ps1: 

At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1937 char:45
+ ... { 'pattern' = 'preg_replace\s*\(\s*([\'"`]).*?\\1\s*,\s*([\'"`]).*?\\ ...
+                                            ~~~~~~~~~~~~~~~~~~~~~~
Unexpected token '"`]).*?\\1\s*,\s*([\'"' in expression or statement.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1937 char:45
+     @{ 'pattern' = 'preg_replace\s*\(\s*([\'"`]).*?\\1\s*,\s*([\'"`]) ...
+                                             ~
The hash literal was incomplete.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1937 char:67
+ ... 'pattern' = 'preg_replace\s*\(\s*([\'"`]).*?\\1\s*,\s*([\'"`]).*?\\2\ ...
+                                                                ~~
Unexpected token '`]' in expression or statement.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1937 char:71
+ ... attern' = 'preg_replace\s*\(\s*([\'"`]).*?\\1\s*,\s*([\'"`]).*?\\2\s* ...
+                                                                  ~
Missing property name after reference operator.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1937 char:115
+ ... ,\s*([\'"`]).*?\\2\s*,\s*\$'; 'description' = 'Potential code executi ...
+                                                              ~~~~
Unexpected token 'code' in expression or statement.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1940 char:37
+     @{ 'pattern' = 'pcntl_exec\('; 'description' = 'Use of pcntl_exec ...
+                                     ~~~~~~~~~~~~~~~~~~~
Unexpected token 'description' = 'Use' in expression or statement.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1940 char:37
+     @{ 'pattern' = 'pcntl_exec\('; 'description' = 'Use of pcntl_exec ...
+                                     ~
Missing closing ')' in expression.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1941 char:39
+     @{ 'pattern' = 'posix_setuid\('; 'description' = 'Use of posix_se ...
+                                       ~~~~~~~~~~~~~~~~~~~
Unexpected token 'description' = 'Use' in expression or statement.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1941 char:39
+     @{ 'pattern' = 'posix_setuid\('; 'description' = 'Use of posix_se ...
+                                       ~
Missing closing ')' in expression.
At C:\Users\FNU LNU\Documents\Scripts\ShellSweepPlus.ps1:1942 char:39
+     @{ 'pattern' = 'posix_setgid\('; 'description' = 'Use of posix_se ...
+                                       ~~~~~~~~~~~~~~~~~~~
Unexpected token 'description' = 'Use' in expression or statement.
Not all parse errors were reported.  Correct the reported errors and try again.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnexpectedToken
MHaggis commented 1 month ago

Hey @PeterCottontail2023 ! I haven't updated this one in some time as I moved everything under https://github.com/splunk/ShellSweep . Would you mind trying that version?