Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #158 from joncave/groupsxml 

PowerView: Fix Groups.xml parsing for multiple <Group>s
This commit is contained in:
HarmJ0y 2016-07-15 14:07:42 -07:00 committed by GitHub
parent 81ac124f22 325cc849d7
commit 28d118f987
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Recon/PowerView.ps1
View File

@ -6141,13 +6141,13 @@ filter Get-GroupsXML {
[XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop [XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop
# process all group properties in the XML # process all group properties in the XML
$GroupsXMLcontent | Select-Xml "//Groups" | Select-Object -ExpandProperty node | ForEach-Object { $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {
$Groupname = $_.Group.Properties.groupName $Groupname = $_.Properties.groupName
# extract the localgroup sid for memberof # extract the localgroup sid for memberof
$GroupSID = $_.Group.Properties.GroupSid $GroupSID = $_.Properties.groupSid
if(-not $LocalSid) { if(-not $GroupSID) {
if($Groupname -match 'Administrators') { if($Groupname -match 'Administrators') {
$GroupSID = 'S-1-5-32-544' $GroupSID = 'S-1-5-32-544'
} }
@ -6163,7 +6163,7 @@ filter Get-GroupsXML {
} }
# extract out members added to this group # extract out members added to this group
$Members = $_.Group.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object { $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
if($_.sid) { $_.sid } if($_.sid) { $_.sid }
else { $_.name } else { $_.name }
} }
@ -6171,8 +6171,8 @@ filter Get-GroupsXML {
if ($Members) { if ($Members) {
# extract out any/all filters...I hate you GPP # extract out any/all filters...I hate you GPP
if($_.Group.filters) { if($_.filters) {
$Filters = $_.Group.filters.GetEnumerator() | ForEach-Object { $Filters = $_.filters.GetEnumerator() | ForEach-Object {
New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name} New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
} }
} }