last-byte / PersistenceSniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
Other
1.83k stars 180 forks source link

Case sensitive comparisons #19

Closed indented-automation closed 9 months ago

indented-automation commented 10 months ago

The code in this module makes significant use of .Contains to look for sub-strings. For example:

$exePath.Contains('powershell') -or $exePath.Contains('cmd')

However, the .Contains method of System.String is case-sensitive and, in win PS (.NET Framework), has no overloads available to make ignore case.

This use of .Contains will yield false and you'll miss things:

$exePath = 'c:\somepath\PowerShell.exe'
$exePath.Contains('powershell')

I suggest one of:

last-byte commented 9 months ago

Totally agree, I will fix this in the next release. Sorry for the late reply.

last-byte commented 9 months ago

I fixed the .Contains issue where it impacted the operation of the module by setting the compared strings to lowercase. In many cases it's just a sanity check and it wouldn't have changed anything to switch to another type of operand.