swap powershell write to command instead
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Nov 6, 2024 at 15:37 UTC
7d59210d059d5667735771c3b1bb3b39559a97e0
4 files changed
+13
-13
agents/meshcore.js
+1
-1
@@ -249,7 +249,7 @@ function lockDesktop(uid) {
249
case 'win32':
250
{
251
var options = { type: 1, uid: uid };
252
- var child = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'RunDll32.exe user32.dll,LockWorkStation'], options);
252
+ var child = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'RunDll32.exe user32.dll,LockWorkStation'], options);
253
child.waitExit();
254
}
255
break;
agents/modules_meshcore/computer-identifiers.js
+9
-8
@@ -431,11 +431,12 @@ function windows_volumes()
431
p1._p2 = p2;
432
p2._p1 = p1;
433
434
- var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
434
+ var cmd = '"Get-Volume | Select-Object -Property DriveLetter,FileSystemLabel,FileSystemType,Size,SizeRemaining,DriveType | ConvertTo-Csv -NoTypeInformation"';
435
+ var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd]);
436
p1.child = child;
437
child.promise = p1;
438
child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
438
- child.stdin.write('Get-Volume | Select-Object -Property DriveLetter,FileSystemLabel,FileSystemType,Size,SizeRemaining,DriveType | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
439
+ child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
440
child.on('exit', function (c)
441
{
442
var a, i, tokens, key;
@@ -466,12 +467,13 @@ function windows_volumes()
467
var ret = j.r;
468
var tokens = j.t;
469
469
- var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
470
+ var cmd = '"Get-BitLockerVolume | Select-Object -Property MountPoint,VolumeStatus,ProtectionStatus | ConvertTo-Csv -NoTypeInformation"';
471
+ var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd]);
472
p2.child = child;
473
child.promise = p2;
474
child.tokens = tokens;
475
child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
474
- child.stdin.write('Get-BitLockerVolume | Select-Object -Property MountPoint,VolumeStatus,ProtectionStatus | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
476
+ child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
477
child.on('exit', function ()
478
{
479
var i;
@@ -486,7 +488,7 @@ function windows_volumes()
488
ret[key].protectionStatus = tokens[2].split('"')[1];
489
try {
490
var foundIDMarkedLine = false, foundMarkedLine = false, identifier = '', password = '';
489
- var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'manage-bde -protectors -get ', tokens[0].split('"')[1], ' -Type recoverypassword'], {});
491
+ var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'manage-bde -protectors -get ', tokens[0].split('"')[1], ' -Type recoverypassword'], {});
492
keychild.stdout.str = ''; keychild.stdout.on('data', function (c) { this.str += c.toString(); });
493
keychild.waitExit();
494
var lines = keychild.stdout.str.trim().split('\r\n');
@@ -801,13 +803,12 @@ function hexToAscii(hexString) {
803
function win_chassisType()
804
{
805
// needs to be replaced with win-wmi but due to bug in win-wmi it doesnt handle arrays correctly
804
- var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-'], {});
806
+ var cmd = '"Get-CimInstance Win32_SystemEnclosure | Select-Object -ExpandProperty ChassisTypes"';
807
+ var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd], {});
808
if (child == null) { return ([]); }
809
child.descriptorMetadata = 'process-manager';
810
child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
811
child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
809
- child.stdin.write('Get-CimInstance Win32_SystemEnclosure| Select-Object -ExpandProperty ChassisTypes\r\n');
810
- child.stdin.write('exit\r\n');
812
child.waitExit();
813
try {
814
return (parseInt(child.stdout.str));
agents/modules_meshcore/win-info.js
+2
-3
@@ -243,12 +243,11 @@ function installedApps()
243
function defender(){
244
var promise = require('promise');
245
var ret = new promise(function (a, r) { this._resolve = a; this._reject = r; });
246
- ret.child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-'], {});
246
+ var cmd = '"Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,IsTamperProtected | ConvertTo-JSON"';
247
+ ret.child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd], {});
248
ret.child.promise = ret;
249
ret.child.stdout.str = ''; ret.child.stdout.on('data', function (c) { this.str += c.toString(); });
250
ret.child.stderr.str = ''; ret.child.stderr.on('data', function (c) { this.str += c.toString(); });
250
- ret.child.stdin.write('Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,IsTamperProtected | ConvertTo-JSON\r\n');
251
- ret.child.stdin.write('exit\r\n');
251
ret.child.on('exit', function (c) {
252
if (this.stdout.str == '') { this.promise._resolve({}); return; }
253
var abc = JSON.parse(this.stdout.str.trim())
agents/recoverycore.js
+1
-1
@@ -870,7 +870,7 @@ function onTunnelControlData(data, ws) {
870
if (process.platform == 'win32') {
871
MeshServerLog("Locking remote user out of desktop", ws.httprequest);
872
var child = require('child_process');
873
- child.execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'RunDll32.exe user32.dll,LockWorkStation'], { type: 1 });
873
+ child.execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'RunDll32.exe user32.dll,LockWorkStation'], { type: 1 });
874
}
875
} catch (e) { }
876
break;