fix win7+server2008r2 powershell/wmi
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Nov 30, 2024 at 13:50 UTC
c41eb72a2c21a268b9fda7f5710b630852cb051f
3 files changed
+66
-92
agents/meshcore.js
-1
@@ -4047,7 +4047,6 @@ function processConsoleCommand(cmd, args, rights, sessionid) {
4047
if (require('computer-identifiers').volumes_promise != null) {
4048
var p = require('computer-identifiers').volumes_promise();
4049
p.then(function (res) { sendConsoleText(JSON.stringify(cleanGetBitLockerVolumeInfo(res), null, 1), this.session); });
4050
- response = "Please wait...";
4050
} else if (require('computer-identifiers').volumes != null) {
4051
sendConsoleText(JSON.stringify(cleanGetBitLockerVolumeInfo(require('computer-identifiers').volumes()), null, 1), this.session);
4052
}
agents/modules_meshcore/computer-identifiers.js
+60
-89
@@ -426,98 +426,69 @@ function windows_volumes()
426
{
427
var promise = require('promise');
428
var p1 = new promise(function (res, rej) { this._res = res; this._rej = rej; });
429
- var p2 = new promise(function (res, rej) { this._res = res; this._rej = rej; });
430
-
431
- p1._p2 = p2;
432
- p2._p1 = p1;
433
-
434
- var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
435
- p1.child = child;
436
- child.promise = p1;
437
- child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
438
- child.stdin.write('Get-Volume | Select-Object -Property DriveLetter,FileSystemLabel,FileSystemType,Size,SizeRemaining,DriveType | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
439
- child.on('exit', function (c)
440
- {
441
- var a, i, tokens, key;
442
- var ret = {};
443
-
444
- a = this.stdout.str.trim().split('\r\n');
445
- for (i = 1; i < a.length; ++i)
446
- {
447
- tokens = a[i].split(',');
448
- if (tokens[0] != '' && tokens[1] != undefined)
449
- {
450
- ret[tokens[0].split('"')[1]] =
451
- {
452
- name: tokens[1].split('"')[1],
453
- type: tokens[2].split('"')[1],
454
- size: tokens[3].split('"')[1],
455
- sizeremaining: tokens[4].split('"')[1],
456
- removable: tokens[5].split('"')[1] == 'Removable',
457
- cdrom: tokens[5].split('"')[1] == 'CD-ROM'
458
- };
459
- }
429
+ var ret = {};
430
+ var values = require('win-wmi').query('ROOT\\CIMV2', 'SELECT * FROM Win32_LogicalDisk', ['DeviceID', 'VolumeName', 'FileSystem', 'Size', 'FreeSpace', 'DriveType']);
431
+ if(values[0]){
432
+ for (var i = 0; i < values.length; ++i) {
433
+ var drive = values[i]['DeviceID'].slice(0,-1);
434
+ ret[drive] = {
435
+ name: (values[i]['VolumeName'] ? values[i]['VolumeName'] : ""),
436
+ type: (values[i]['FileSystem'] ? values[i]['FileSystem'] : "Unknown"),
437
+ size: (values[i]['Size'] ? values[i]['Size'] : 0),
438
+ sizeremaining: (values[i]['FreeSpace'] ? values[i]['FreeSpace'] : 0),
439
+ removable: (values[i]['DriveType'] == 2),
440
+ cdrom: (values[i]['DriveType'] == 5)
441
+ };
442
}
461
- this.promise._res({ r: ret, t: tokens });
462
- });
463
-
464
- p1.then(function (j)
465
- {
466
- var ret = j.r;
467
- var tokens = j.t;
468
-
469
- var child = require('child_process').execFile(process.env['windir'] + '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe', ['powershell', '-noprofile', '-nologo', '-command', '-']);
470
- p2.child = child;
471
- child.promise = p2;
472
- child.tokens = tokens;
473
- child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
474
- child.stdin.write('Get-BitLockerVolume | Select-Object -Property MountPoint,VolumeStatus,ProtectionStatus | ConvertTo-Csv -NoTypeInformation\r\nexit\r\n');
475
- child.on('exit', function ()
476
- {
477
- var i;
478
- var a = this.stdout.str.trim().split('\r\n');
479
- for (i = 1; i < a.length; ++i)
480
- {
481
- tokens = a[i].split(',');
482
- key = tokens[0].split(':').shift().split('"').pop();
483
- if (ret[key] != null)
484
- {
485
- ret[key].volumeStatus = tokens[1].split('"')[1];
486
- ret[key].protectionStatus = tokens[2].split('"')[1];
487
- try {
488
- var foundIDMarkedLine = false, foundMarkedLine = false, identifier = '', password = '';
489
- var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'manage-bde -protectors -get ', tokens[0].split('"')[1], ' -Type recoverypassword'], {});
490
- keychild.stdout.str = ''; keychild.stdout.on('data', function (c) { this.str += c.toString(); });
491
- keychild.waitExit();
492
- var lines = keychild.stdout.str.trim().split('\r\n');
493
- for (var x = 0; x < lines.length; x++) { // Loop each line
494
- var abc = lines[x].trim();
495
- var englishidpass = (abc !== '' && abc.includes('Numerical Password:')); // English ID
496
- var germanidpass = (abc !== '' && abc.includes('Numerisches Kennwort:')); // German ID
497
- var frenchidpass = (abc !== '' && abc.includes('Mot de passe num')); // French ID
498
- var englishpass = (abc !== '' && abc.includes('Password:') && !abc.includes('Numerical Password:')); // English Password
499
- var germanpass = (abc !== '' && abc.includes('Kennwort:') && !abc.includes('Numerisches Kennwort:')); // German Password
500
- var frenchpass = (abc !== '' && abc.includes('Mot de passe :') && !abc.includes('Mot de passe num')); // French Password
501
- if (englishidpass || germanidpass || frenchidpass|| englishpass || germanpass || frenchpass) {
502
- var nextline = lines[x + 1].trim();
503
- if (x + 1 < lines.length && (nextline !== '' && (nextline.startsWith('ID:') || nextline.startsWith('ID :')) )) {
504
- identifier = nextline.replace('ID:','').replace('ID :', '').trim();
505
- foundIDMarkedLine = true;
506
- }else if (x + 1 < lines.length && nextline !== '') {
507
- password = nextline;
508
- foundMarkedLine = true;
509
- }
443
+ }
444
+ try {
445
+ values = require('win-wmi').query('ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption', 'SELECT * FROM Win32_EncryptableVolume', ['DriveLetter','ConversionStatus','ProtectionStatus']);
446
+ if(values[0]){
447
+ for (var i = 0; i < values.length; ++i) {
448
+ var drive = values[i]['DriveLetter'].slice(0,-1);
449
+ var statuses = {
450
+ 0: 'FullyDecrypted',
451
+ 1: 'FullyEncrypted',
452
+ 2: 'EncryptionInProgress',
453
+ 3: 'DecryptionInProgress',
454
+ 4: 'EncryptionPaused',
455
+ 5: 'DecryptionPaused'
456
+ };
457
+ ret[drive].volumeStatus = statuses.hasOwnProperty(values[i].ConversionStatus) ? statuses[values[i].ConversionStatus] : 'FullyDecrypted';
458
+ ret[drive].protectionStatus = (values[i].ProtectionStatus == 0 ? 'Off' : (values[i].ProtectionStatus == 1 ? 'On' : 'Unknown'));
459
+ try {
460
+ var foundIDMarkedLine = false, foundMarkedLine = false, identifier = '', password = '';
461
+ var keychild = require('child_process').execFile(process.env['windir'] + '\\system32\\cmd.exe', ['/c', 'manage-bde -protectors -get ', drive, ' -Type recoverypassword'], {});
462
+ keychild.stdout.str = ''; keychild.stdout.on('data', function (c) { this.str += c.toString(); });
463
+ keychild.waitExit();
464
+ var lines = keychild.stdout.str.trim().split('\r\n');
465
+ for (var x = 0; x < lines.length; x++) { // Loop each line
466
+ var abc = lines[x].trim();
467
+ var englishidpass = (abc !== '' && abc.includes('Numerical Password:')); // English ID
468
+ var germanidpass = (abc !== '' && abc.includes('Numerisches Kennwort:')); // German ID
469
+ var frenchidpass = (abc !== '' && abc.includes('Mot de passe num')); // French ID
470
+ var englishpass = (abc !== '' && abc.includes('Password:') && !abc.includes('Numerical Password:')); // English Password
471
+ var germanpass = (abc !== '' && abc.includes('Kennwort:') && !abc.includes('Numerisches Kennwort:')); // German Password
472
+ var frenchpass = (abc !== '' && abc.includes('Mot de passe :') && !abc.includes('Mot de passe num')); // French Password
473
+ if (englishidpass || germanidpass || frenchidpass|| englishpass || germanpass || frenchpass) {
474
+ var nextline = lines[x + 1].trim();
475
+ if (x + 1 < lines.length && (nextline !== '' && (nextline.startsWith('ID:') || nextline.startsWith('ID :')) )) {
476
+ identifier = nextline.replace('ID:','').replace('ID :', '').trim();
477
+ foundIDMarkedLine = true;
478
+ }else if (x + 1 < lines.length && nextline !== '') {
479
+ password = nextline;
480
+ foundMarkedLine = true;
481
}
482
}
512
- ret[key].identifier = (foundIDMarkedLine ? identifier : ''); // Set Bitlocker Identifier
513
- ret[key].recoveryPassword = (foundMarkedLine ? password : ''); // Set Bitlocker Password
514
- } catch(ex) { }
515
- }
483
+ }
484
+ ret[drive].identifier = (foundIDMarkedLine ? identifier : ''); // Set Bitlocker Identifier
485
+ ret[drive].recoveryPassword = (foundMarkedLine ? password : ''); // Set Bitlocker Password
486
+ } catch(ex) { } // just carry on as we cant get bitlocker key
487
}
517
- this.promise._res(ret);
518
- });
519
- });
520
- return (p2);
488
+ }
489
+ p1._res(ret);
490
+ } catch (ex) { p1._res(ret); } // just return volumes as cant get encryption/bitlocker
491
+ return (p1);
492
}
493
494
function windows_identifiers()
@@ -806,7 +777,7 @@ function win_chassisType()
777
child.descriptorMetadata = 'process-manager';
778
child.stdout.str = ''; child.stdout.on('data', function (c) { this.str += c.toString(); });
779
child.stderr.str = ''; child.stderr.on('data', function (c) { this.str += c.toString(); });
809
- child.stdin.write('Get-CimInstance Win32_SystemEnclosure| Select-Object -ExpandProperty ChassisTypes\r\n');
780
+ child.stdin.write('Get-WmiObject Win32_SystemEnclosure | Select-Object -ExpandProperty ChassisTypes\r\n');
781
child.stdin.write('exit\r\n');
782
child.waitExit();
783
try {
agents/modules_meshcore/win-info.js
+6
-2
@@ -251,8 +251,12 @@ function defender(){
251
ret.child.stdin.write('exit\r\n');
252
ret.child.on('exit', function (c) {
253
if (this.stdout.str == '') { this.promise._resolve({}); return; }
254
- var abc = JSON.parse(this.stdout.str.trim())
255
- this.promise._resolve({ RealTimeProtection: abc.RealTimeProtectionEnabled, TamperProtected: abc.IsTamperProtected });
254
+ try {
255
+ var abc = JSON.parse(this.stdout.str.trim());
256
+ this.promise._resolve({ RealTimeProtection: abc.RealTimeProtectionEnabled, TamperProtected: abc.IsTamperProtected });
257
+ } catch (ex) {
258
+ this.promise._resolve({}); return;
259
+ }
260
});
261
return (ret);
262
}