swap powershell write to command instead

Signed-off-by: si458 <simonsmith5521@gmail.com>

si458 committed Nov 6, 2024 at 15:37 UTC 7d59210d059d5667735771c3b1bb3b39559a97e0
4 files changed +13 -13
agents/meshcore.js
+1 -1
@@ -249,7 +249,7 @@ function lockDesktop(uid) {
249 case 'win32':
250 {
251 var options = { type: 1, uid: uid };
252 - var child = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'RunDll32.exe user32.dll,LockWorkStation'], options);
252 + var child = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'RunDll32.exe user32.dll,LockWorkStation'], options);
253 child.waitExit();
254 }
255 break;
agents/modules_meshcore/computer-identifiers.js
+9 -8
@@ -431,11 +431,12 @@ function windows_volumes()
431 p1._p2 = p2;
432 p2._p1 = p1;
433
434 - var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
434 + var cmd = '"Get-Volume | Select-Object -Property DriveLetter,FileSystemLabel,FileSystemType,Size,SizeRemaining,DriveType | ConvertTo-Csv -NoTypeInformation"';
435 + var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd]);
436 p1.child = child;
437 child.promise = p1;
438 child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
438 - child.stdin.write('Get-Volume | Select-Object -Property DriveLetter,FileSystemLabel,FileSystemType,Size,SizeRemaining,DriveType | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
439 + child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
440 child.on('exit', function (c)
441 {
442 var a, i, tokens, key;
@@ -466,12 +467,13 @@ function windows_volumes()
467 var ret = j.r;
468 var tokens = j.t;
469
469 - var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
470 + var cmd = '"Get-BitLockerVolume | Select-Object -Property MountPoint,VolumeStatus,ProtectionStatus | ConvertTo-Csv -NoTypeInformation"';
471 + var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd]);
472 p2.child = child;
473 child.promise = p2;
474 child.tokens = tokens;
475 child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
474 - child.stdin.write('Get-BitLockerVolume | Select-Object -Property MountPoint,VolumeStatus,ProtectionStatus | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
476 + child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
477 child.on('exit', function ()
478 {
479 var i;
@@ -486,7 +488,7 @@ function windows_volumes()
488 ret[key].protectionStatus = tokens[2].split('"')[1];
489 try {
490 var foundIDMarkedLine = false, foundMarkedLine = false, identifier = '', password = '';
489 - var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'manage-bde -protectors -get ', tokens[0].split('"')[1], ' -Type recoverypassword'], {});
491 + var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'manage-bde -protectors -get ', tokens[0].split('"')[1], ' -Type recoverypassword'], {});
492 keychild.stdout.str = ''; keychild.stdout.on('data', function (c) { this.str += c.toString(); });
493 keychild.waitExit();
494 var lines = keychild.stdout.str.trim().split('\r\n');
@@ -801,13 +803,12 @@ function hexToAscii(hexString) {
803 function win_chassisType()
804 {
805 // needs to be replaced with win-wmi but due to bug in win-wmi it doesnt handle arrays correctly
804 - var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-'], {});
806 + var cmd = '"Get-CimInstance Win32_SystemEnclosure | Select-Object -ExpandProperty ChassisTypes"';
807 + var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd], {});
808 if (child == null) { return ([]); }
809 child.descriptorMetadata = 'process-manager';
810 child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
811 child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
809 - child.stdin.write('Get-CimInstance Win32_SystemEnclosure| Select-Object -ExpandProperty ChassisTypes\r\n');
810 - child.stdin.write('exit\r\n');
812 child.waitExit();
813 try {
814 return (parseInt(child.stdout.str));
agents/modules_meshcore/win-info.js
+2 -3
@@ -243,12 +243,11 @@ function installedApps()
243 function defender(){
244 var promise = require('promise');
245 var ret = new promise(function (a, r) { this._resolve = a; this._reject = r; });
246 - ret.child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-'], {});
246 + var cmd = '"Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,IsTamperProtected | ConvertTo-JSON"';
247 + ret.child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', cmd], {});
248 ret.child.promise = ret;
249 ret.child.stdout.str = ''; ret.child.stdout.on('data', function (c) { this.str += c.toString(); });
250 ret.child.stderr.str = ''; ret.child.stderr.on('data', function (c) { this.str += c.toString(); });
250 - ret.child.stdin.write('Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,IsTamperProtected | ConvertTo-JSON\r\n');
251 - ret.child.stdin.write('exit\r\n');
251 ret.child.on('exit', function (c) {
252 if (this.stdout.str == '') { this.promise._resolve({}); return; }
253 var abc = JSON.parse(this.stdout.str.trim())
agents/recoverycore.js
+1 -1
@@ -870,7 +870,7 @@ function onTunnelControlData(data, ws) {
870 if (process.platform == 'win32') {
871 MeshServerLog("Locking remote user out of desktop", ws.httprequest);
872 var child = require('child_process');
873 - child.execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'RunDll32.exe user32.dll,LockWorkStation'], { type: 1 });
873 + child.execFile(process.env['windir'] + '\\system32\\cmd.exe', ['cmd', '/c', 'RunDll32.exe user32.dll,LockWorkStation'], { type: 1 });
874 }
875 } catch (e) { }
876 break;