Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix Get-GroupsXML for multiple <Group> tags 

Select all <Group> nodes and iterate through them, not just the root
<Groups> node.
This commit is contained in:
Jon Cave 2016-06-27 17:52:28 +02:00
parent 81ac124f22
commit 5a05a024b6
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Recon/PowerView.ps1
View File

@ -6141,12 +6141,12 @@ filter Get-GroupsXML {
[XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop
# process all group properties in the XML
$GroupsXMLcontent | Select-Xml "//Groups" | Select-Object -ExpandProperty node | ForEach-Object {
$GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {
$Groupname = $_.Group.Properties.groupName
$Groupname = $_.Properties.groupName
# extract the localgroup sid for memberof
$GroupSID = $_.Group.Properties.GroupSid
$GroupSID = $_.Properties.groupSid
if(-not $LocalSid) {
if($Groupname -match 'Administrators') {
$GroupSID = 'S-1-5-32-544'
@ -6163,7 +6163,7 @@ filter Get-GroupsXML {
}
# extract out members added to this group
$Members = $_.Group.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
$Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
if($_.sid) { $_.sid }
else { $_.name }
}
@ -6171,8 +6171,8 @@ filter Get-GroupsXML {
if ($Members) {
# extract out any/all filters...I hate you GPP
if($_.Group.filters) {
$Filters = $_.Group.filters.GetEnumerator() | ForEach-Object {
if($_.filters) {
$Filters = $_.filters.GetEnumerator() | ForEach-Object {
New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
}
}