itm4n / PrivescCheck

Privilege Escalation Enumeration Script for Windows
BSD 3-Clause "New" or "Revised" License
2.79k stars 416 forks source link

Get-ScheduledTaskList: handle multiple <Exec> entries #10

Closed SAERXCIT closed 3 years ago

SAERXCIT commented 3 years ago

Hi!

As discussed in issue #8, I tried implementing a solution to the multiple <Exec> entries problem for Get-ScheduledTaskList.

The element Command of type String became Commands of type System.Collections.ArrayList, which is a breaking change for projects operating on this output.

I also had to change the checks operating on the output of Get-ScheduledTaskList, basically adding a ForEach-Objects on the Commands element and creating a new PSObject from scratch instead of adding elements to the CurrentTask object. This has the benefit of correcting a bug happening when multiple results exist for the same task: the first Add-Members work as expected, but further Add-Members for subsequent results of the same CurrentTask do not work, as the function Add-Member does not allow overwriting by default. This results in the ModifiablePath, IdentityReference, and Permissions elements not being updated (and errors in the console), which for the user means the same result is outputted multiple times.

In any case if you chose not to merge this PR, can you please add the -Force option to these Add-Members so that their value is updated for subsequent results of the same task.

Cheers! :upside_down_face:

itm4n commented 3 years ago

Thanks for your PR. I think there is an easier way to handle this. I already know how to implement it, I just need to find the time to work on this. 🙂

itm4n commented 3 years ago

Done! 🙂

My solution is very simple. I iterate the Actions list, and for each item, I create a completely new Task object. As a result, a Task that has more than one Exec Action will appear several times in the final list with the same Name. A Task with, let's say 2 command lines, will therefore be treated as 2 different Task objects. But that's not an issue at all.