last-byte / PersistenceSniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
Other
1.89k stars 185 forks source link

Parse-NetUser function is not locale-agnostic #20

Closed eirnym closed 11 months ago

eirnym commented 11 months ago

Thank you for your great tool

I found that on non-English Windows localisation, I have false positives from the first and the last line (a record per word). The screenshot below shows current users and a different line on the bottom.

I suggest to rewrite Parse-NetUser function filter out anything above ------, empty lines and don't parse the last line. E.g. on next line parse previous line if any. This would harden this function and won't rely on English locale messages.

To translate some messages: Konta użytkowników dla - User accounts for Gość - Guest Domyślny użytkownik - Default user Polecenie zostało wykonane pomyślnie. - The command completed

Green boxes on a screenshot hide private information like username and computer name.

2023-10-18_11_09_4682078-000030-Wiersz polecenia

last-byte commented 11 months ago

Copy, I'll look into it and make sure to fix it in the next release. Thanks for the contribution 😄

last-byte commented 11 months ago

Hi, this issue has been fixed in version 1.14.0. I modified Parse-NetUser so that it discards lines which end with a dot, a thing that happens only to the "The command completed..." line.

eirnym commented 11 months ago

Are you sure that any username can't end with a dot?

last-byte commented 11 months ago

Looks like so to me Screenshot 2023-11-07 215442