VectorBCO / windows-path-enumerate

Script for fix Windows path enumerate vulnerability
GNU General Public License v3.0
73 stars 18 forks source link

Use cases documentation #24

Open VectorBCO opened 4 years ago

VectorBCO commented 4 years ago

Is your feature request related to a problem? Please describe. Use case scenarios should be described in documentation (wiki) How to use topics:

Additional context Links on wiki docs should be added to the main readme.md page

NickStudy commented 3 years ago

Do you have an examples how to run this from SCCM? I am interesting to know invoke-command also.

NickStudy commented 3 years ago

Can you respond to my question please?

VectorBCO commented 3 years ago

Unfortunately right now I do not have SCCM right now, so have no chance prepare exact scenario but in general it looks like this:

  1. download file and place it somewhere on a domain share with Authenticated Users read permission
    • normally \DomainName\NetLogon could be used
  2. Prepare package and configure to run PowerShell (full path preffered)
  3. Provide arguments for PowerShell.exe: -ExecutionPolicy 'ByPass' -Command ". \DomainName\NetLogon\ Windows_Path_Enumerate.ps1 -FixUninstall -CreateBackup -WhatIf"
  4. Configure detection method as 'File exists' and file path 'C:\Temp\ServicesFix-3.4.Log'
  5. Now this package could be deployedon some test group and checked results, was log and backups created or not, is log showing right things or not etc. If everything Ok, then -WhatIf switch from step 3 could be removed and now deployment will fix services and uninstall strings if any will be found.

This sample described in Example 2 and here

NickStudy commented 3 years ago

ServicesFix log said it need to use the x64 powershell. I tried with System32 and also Syswow64 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ByPass -Command ". \DomainName\NetLogon Windows_Path_Enumerate.ps1 -FixUninstall" also with syswow64

I am trying with Invoke-Command -ComputerName pc1 -FilePath "C:\ps1file -FixUninstall" i got error as 'the value of the filepath must be windows powershell. I am noob but like to try this script for remote computer.

VectorBCO commented 3 years ago

NickStudy, you could try this path for sccm pachage: %SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe

More info here

Through Invoke-Command it could be done like this:

$Session = New-PSSession -ComputerName 'Server1'
Copy-Item -Path "C:\LocalPath\Windows_Path_Enumerate.ps1" -Destination "C:\Temp\" -ToSession $Session
Invoke-Command -Session $Session -ScriptBlock {
   . C:\Temp\Windows_Path_Enumerate.ps1 -FixUninstall
}

new-pssession copy-item invoke-command

VectorBCO commented 3 years ago

If you could provide some screenshots from sccm configuration I will be very appreciated, this will help prepare exact instruction

NickStudy commented 3 years ago

Hi, I used the sysnative. It give 32bit installer error and also 0x1 error running from sccm. Your Invoke command works! I want to run for more than 1 computer. I tried as $Computers = Get-Content C:\list.txt $Session = New-PSSession -ComputerName $Computers and then continue with same lines from you. It did not work. Help me please. Thanks!!!

VectorBCO commented 3 years ago

Copy-Item accept only 1 session in a moment so you need iterate though your list. It will looks like this

$Computers = Get-Content C:\list.txt
$Sessions = New-PSSession -ComputerName $Computers
Foreach ($Session in $Sessions){
   Copy-Item -Path "C:\LocalPath\Windows_Path_Enumerate.ps1" -Destination "C:\Temp\" -ToSession $Session
}
Invoke-Command -Session $Sessions -ScriptBlock {
   . C:\Temp\Windows_Path_Enumerate.ps1 -FixUninstall
}
NickStudy commented 3 years ago

I will do, thanks!

NickStudy commented 3 years ago

There is a key call 'Uninstall Path', it needs the quotes too but not in the script. How do I add that?

VectorBCO commented 3 years ago

There is a key call 'Uninstall Path', it needs the quotes too but not in the script. How do I add that?

what do you mean? if some path should be fixed but its not, please provide exact path and value

VectorBCO commented 3 years ago

@NickStudy how is going?