search

PowerShellMafia / PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework
Other
11.78k stars 4.59k forks source link

Get-ModifiableServiceFile false positives due to arguments #223

Closed Quiark closed 7 years ago

Quiark commented 7 years ago

I'm getting the following results, for example:

Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
ModifiableFile                  : C:\

ServiceName                     : Steam Client Service
Path                            : "C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService

But the files or folders are not writeable. The reason they are listed is that Get-ModifiablePath will receive the path including the argument (such as /svc) and then treat this as two path items. The second one is writeable so it reports the result even though the main path is not.

FuzzySecurity commented 7 years ago

I am unable to reproduce this issue, can you please check out the latest version in the Dev branch to test. I tried to implement your use case, see the screenshot below:

image

Quiark commented 7 years ago

It seems ok with dev branch code. But I also changed permissions on c:\ so that may have fixed it...

FuzzySecurity commented 7 years ago

Cool, I wanted to make sure. If it turns out there is still some issue here, please reopen the ticket!