davehull / Kansa

A Powershell incident response framework
Apache License 2.0
1.56k stars 266 forks source link

ProcNModules.ps1 Errors for 'file not found' #132

Closed jvaldezjr1 closed 9 years ago

jvaldezjr1 commented 9 years ago

When I updated the ProcNModules script a few weeks ago, I didn't notice any errors it was producing. However, I've run the script on win 7 hosts recently and I've started to get feedback for certain DLLs not being found (screenshot below):

screen shot 2015-09-11 at 11 56 30 am

Research into this led to me to find that some of these cmdlet calls are the problem:

    if (Test-Path $FilePath) {
        $FileName = Get-ChildItem $FilePath | Select-Object -ExpandProperty Fullname
...
        $o.CreateUTC = (Get-Item $Module).CreationTimeUtc
        $o.LastAccessUTC = (Get-Item $Module).LastAccessTimeUtc
        $o.LastWriteUTC = (Get-Item $Module).LastWriteTimeUtc

Specifically Get-Item and Get-ChildItem will not access hidden (and system for Get-ChildItem) files, even with an administrative PS session. The fix is to specify the -Force parameter. https://technet.microsoft.com/en-us/library/hh849788.aspx https://technet.microsoft.com/en-us/library/hh849800.aspx

I'll update this module accordingly, but I wonder if this may exist throughout the code base if Get-Item or Get-ChildItem are used and try to collect data from hidden and/or system files. Can you flag it as a bug and assign it to me to resolve?

davehull commented 9 years ago

Fixed.