Powershell Megathread: Verb-Noun Scripting is the future

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Powershell Megathread: Verb-Noun Scripting is the future

«‹›94 »

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

I'm trying to pull security logs from a bunch of DCs to find out where an account is being used, my script is:

code:

Get-EventLog -LogName Security | ?{$_.entrytype -eq "FailureAudit" -and $_.message -match "Account Name: username"}

The issue is that I'm not getting anything back, if I drop this part "-and $_.message -match "Account Name: username"" I get all FailureAudits just fine, so obviously it's something with the end part, but I'm just not sure what.

I've also changed the Account Name to something I saw show up in the logs but it still returns nothing, as well as just using the $_.message -match "Account Name: username" part with nothing returned so obviously I'm using something incorrectly in there, but I'm just shamelessly stealing the end part from google searches as I'm not finding any good information on how to pipe and filter on different eventlog fields.

MF_James fucked around with this message at 23:02 on May 1, 2018

# ? May 1, 2018 22:59

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 10:27

The Fool: Oct 16, 2003

Try -like or -contains

E: also, I like to wrap comparisons in ()�s, but it shouldn�t be necessary

Ex: ((x -eq y) -and (z -like w))

The Fool fucked around with this message at 23:04 on May 1, 2018

# ? May 1, 2018 23:02

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

MF_James posted:

I'm trying to pull security logs from a bunch of DCs to find out where an account is being used, my script is:
code:
Get-EventLog -LogName Security | ?{$_.entrytype -eq "FailureAudit" -and $_.message -match "Account Name: username"}
The issue is that I'm not getting anything back, if I drop this part "-and $_.message -match "Account Name: username"" I get all FailureAudits just fine, so obviously it's something with the end part, but I'm just not sure what.

I've also changed the Account Name to something I saw show up in the logs but it still returns nothing.

How's this:

code:

Get-EventLog -LogName Security | ?{($_.entrytype -eq "FailureAudit") -and ($_.message -match "Account Name: username")}

You might also try

code:

Get-EventLog -LogName Security | ?{($_.entrytype -eq "FailureAudit") -and ($_.message -like "Account Name: username")}

# ? May 1, 2018 23:02

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Still not working, it seems there's something wrong with this statement ($_.message -like "Account Name: username"), it's unable to match anything even if I KNOW there's something to match, so there's some sort of syntax problem.

fake edit:

got it with this Get-EventLog -LogName Security | ?{($_.entrytype -eq "FailureAudit") -and ($_.message -match "Account Name:\s*username")}

Seems it goes out to regex which requires the \s to evaluate properly

# ? May 1, 2018 23:10

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

MF_James posted:

Still not working, it seems there's something wrong with this statement ($_.message -like "Account Name: username"), it's unable to match anything even if I KNOW there's something to match, so there's some sort of syntax problem.

fake edit:

got it with this Get-EventLog -LogName Security | ?{($_.entrytype -eq "FailureAudit") -and ($_.message -match "Account Name:\s*username")}

Seems it goes out to regex which requires the \s to evaluate properly

That it's \s* leads me to believe that there's either zero or more than one whitespace characters there, or that it's not a space

# ? May 1, 2018 23:18

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Yeah, I assume there's more than one whitespace character there.

# ? May 1, 2018 23:39

PBS: Sep 21, 2015

Do you have to include the Account Name: bit, or can you just match on the username?

# ? May 2, 2018 00:51

mystes: May 31, 2006

MF_James posted:

Yeah, I assume there's more than one whitespace character there.

In situations like this it can be helpful to look at the sequence of unicode code points for the string by doing something like "[Int[]]s.ToCharArray()" (if s is your string)

I guess if you know it's all ascii you can also just use format-hex.

# ? May 2, 2018 01:11

Nth Doctor: Sep 7, 2010; Darkrai used Dream Eater!
It's super effective!

I have what I hope is a silly question about Powershell vs. Powershell Core.
My boss is a Mac user and asked for me to give him access to a tool we wrote using powershell that tests our web services for basic functionality.
I see that Powershell Core is available for macs, so I tried running my script with pwsh and got this error:

pre:

Invoke-WebRequest : The format of value 'text/xml; charset=utf-8' is invalid.
At C:\test.ps1:9 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], FormatException
+ FullyQualifiedErrorId : System.FormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Here's my script, edited down to the Hello World version:

code:

$bodyContent = @"
        <soap:Envelope />
"@

$authorizationHeader = "Basic asdf"
$headers = @{ Authorization = $authorizationHeader }
$endpoint = "http://httpbin.org/anything"
$contentType = "text/xml; charset=utf-8"
$response = Invoke-WebRequest `
    -Method POST `
    -Uri $endpoint `
    -ContentType $contentType `
    -Headers $headers `
    -Body $bodyContent
Write-Host $response

The script runs just fine with powershell.exe

If I changed $contentType to just "text/xml" it works fine as well. Am I being paranoid about the lack of charset information? How should I be formatting the $contentType value if I were to keep the charset?

# ? May 10, 2018 16:31

Toshimo: Aug 23, 2012; He's outta line...

But he's right!

Nth Doctor posted:

I have what I hope is a silly question about Powershell vs. Powershell Core.
My boss is a Mac user and asked for me to give him access to a tool we wrote using powershell that tests our web services for basic functionality.
I see that Powershell Core is available for macs, so I tried running my script with pwsh and got this error:
pre:
Invoke-WebRequest : The format of value 'text/xml; charset=utf-8' is invalid.
At C:\test.ps1:9 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], FormatException
+ FullyQualifiedErrorId : System.FormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Here's my script, edited down to the Hello World version:
code:
$bodyContent = @"
        <soap:Envelope />
"@

$authorizationHeader = "Basic asdf"
$headers = @{ Authorization = $authorizationHeader }
$endpoint = "http://httpbin.org/anything"
$contentType = "text/xml; charset=utf-8"
$response = Invoke-WebRequest `
    -Method POST `
    -Uri $endpoint `
    -ContentType $contentType `
    -Headers $headers `
    -Body $bodyContent
Write-Host $response
The script runs just fine with powershell.exe

If I changed $contentType to just "text/xml" it works fine as well. Am I being paranoid about the lack of charset information? How should I be formatting the $contentType value if I were to keep the charset?

Try:
$contentType = "text/xml; charset=utf-8;"

# ? May 10, 2018 17:33

Nth Doctor: Sep 7, 2010; Darkrai used Dream Eater!
It's super effective!

Toshimo posted:

Try:
$contentType = "text/xml; charset=utf-8;"

Good thought and something I didn't try earlier, but no dice:

pre:

pwsh ./test.ps1
Invoke-WebRequest : The format of value 'text/xml; charset=utf-8;' is invalid.
At C:\test.ps1:9 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], FormatException
+ FullyQualifiedErrorId : System.FormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

# ? May 10, 2018 17:38

Toshimo: Aug 23, 2012; He's outta line...

But he's right!

Nth Doctor posted:

Good thought and something I didn't try earlier, but no dice:

pre:

pwsh ./test.ps1
Invoke-WebRequest : The format of value 'text/xml; charset=utf-8;' is invalid.
At C:\test.ps1:9 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], FormatException
+ FullyQualifiedErrorId : System.FormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

[-SkipHeaderValidation]

-SkipHeaderValidation
Indicates the cmdlet should add headers to the request without validation.

This switch should be used for sites that require header values that do not conform to standards. Specifying this switch disables validation to allow the value to be passed unchecked. When specified, all headers are added without validation.

This will disable validation for values passed to both the -Headers and -UserAgent parameters.

# ? May 10, 2018 17:43

Volguus: Mar 3, 2009

Powershell is just wrong here. "content-type: application/json;charset=UTF-8" is a correct content-type header value.

# ? May 10, 2018 17:46

Nth Doctor: Sep 7, 2010; Darkrai used Dream Eater!
It's super effective!

Toshimo posted:

[-SkipHeaderValidation]

-SkipHeaderValidation
Indicates the cmdlet should add headers to the request without validation.

This switch should be used for sites that require header values that do not conform to standards. Specifying this switch disables validation to allow the value to be passed unchecked. When specified, all headers are added without validation.

This will disable validation for values passed to both the -Headers and -UserAgent parameters.

That one doesn't appear to work, either.

# ? May 10, 2018 17:47

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Can you use Set-Content -Encoding UTF8 later on?
Could you put content-type: application/json;charset=UTF-8 in the $headers array instead of using the -ContentType parameter?

# ? May 10, 2018 17:55

Volguus: Mar 3, 2009

On the second thought, wait a minute. A JSON needs to have the charset specified because JSON is an idiotic format. An XML specifies its own encoding via the declaration:

code:

<?xml version="1.0" encoding="UTF-8" standalone="no" ?>

So, you don't have to set it in the header. Though, the client shouldn't yell, it should be fine, but yes it is a bit superfluous.

# ? May 10, 2018 18:04

Nth Doctor: Sep 7, 2010; Darkrai used Dream Eater!
It's super effective!

At this point it's just a nagging papercut of a problem for me since I can safely remove the charset and my testing script works fine.

Changing the content type to application/json; charset... Gives me the same error.
Mobile or I'd include by current snippet.
The code I posted in my OP should be runnable by anyone, should you want to experiment. I switched it to httpbin.org for that purpose.

# ? May 10, 2018 19:30

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

When I run it inside of pwsh on Ubuntu, I get a similar but different error:

code:

Invoke-WebRequest : The cmdlet cannot run because the -ContentType parameter is not a valid Content-Type header. Specify a valid Content-Type for -ContentType, then retry. To suppress header validation, supply the -SkipHeaderValidation parameter.
At line:1 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidArgument: (text/xml; charset=utf-8:String) [Invoke-WebRequest], ValidationMetadataException
+ FullyQualifiedErrorId : WebCmdletContentTypeException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Using -SkipHeaderValidation allowed it to go through. According to $PSVersionTable.GitCommitId I'm on version v6.1.0-preview.2. Is that version available for you?

# ? May 10, 2018 20:07

Nth Doctor: Sep 7, 2010; Darkrai used Dream Eater!
It's super effective!

anthonypants posted:

When I run it inside of pwsh on Ubuntu, I get a similar but different error:

code:

Invoke-WebRequest : The cmdlet cannot run because the -ContentType parameter is not a valid Content-Type header. Specify a valid Content-Type for -ContentType, then retry. To suppress header validation, supply the -SkipHeaderValidation parameter.
At line:1 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidArgument: (text/xml; charset=utf-8:String) [Invoke-WebRequest], ValidationMetadataException
+ FullyQualifiedErrorId : WebCmdletContentTypeException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Using -SkipHeaderValidation allowed it to go through. According to $PSVersionTable.GitCommitId I'm on version v6.1.0-preview.2. Is that version available for you?

Yes, I installed that today and saw a similar error but did not try the skipheader on the preview

# ? May 10, 2018 21:17

Video Nasty: Jun 17, 2003

Nth Doctor posted:

I have what I hope is a silly question about Powershell vs. Powershell Core.
My boss is a Mac user and asked for me to give him access to a tool we wrote using powershell that tests our web services for basic functionality.
I see that Powershell Core is available for macs, so I tried running my script with pwsh and got this error:

This might actually be something going on with .NET variations according to this: https://github.com/PowerShell/PowerShell/issues/1919

# ? May 10, 2018 23:41

Pile Of Garbage: May 28, 2007

Nth Doctor posted:

I have what I hope is a silly question about Powershell vs. Powershell Core.
My boss is a Mac user and asked for me to give him access to a tool we wrote using powershell that tests our web services for basic functionality.
I see that Powershell Core is available for macs, so I tried running my script with pwsh and got this error:
pre:
Invoke-WebRequest : The format of value 'text/xml; charset=utf-8' is invalid.
At C:\test.ps1:9 char:13
+ $response = Invoke-WebRequest `
+             ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], FormatException
+ FullyQualifiedErrorId : System.FormatException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Here's my script, edited down to the Hello World version:
code:
$bodyContent = @"
        <soap:Envelope />
"@

$authorizationHeader = "Basic asdf"
$headers = @{ Authorization = $authorizationHeader }
$endpoint = "http://httpbin.org/anything"
$contentType = "text/xml; charset=utf-8"
$response = Invoke-WebRequest `
    -Method POST `
    -Uri $endpoint `
    -ContentType $contentType `
    -Headers $headers `
    -Body $bodyContent
Write-Host $response
The script runs just fine with powershell.exe

If I changed $contentType to just "text/xml" it works fine as well. Am I being paranoid about the lack of charset information? How should I be formatting the $contentType value if I were to keep the charset?

This is probably because the MediaTypeHeaderValue class has separate properties for media type and character set. The ContentType parameter is less a traditional Content-Type header represented as a string and more refers specifically to the individual media type property. The constructor for the class specifies that it can be passed a string consisting of only the media type without character set.

# ? May 11, 2018 04:15

Revalis Enai: Apr 21, 2003; <img src="https://fi.somethingawful.com/customtitles/title-revalis_enai.gif"><br>Wait, what's my phone number again?; Fun Shoe

I just learned that I could work with csv data with powershell. I've been doing it via Google Apps Script but it's slow and has execute time limit.

I'm looking to match one csv file to another based on the ItemCode and then populate sales data if they match. My main csv looks like this:

code:

ItemCode ItemName Sales1 Sales2
001       Pen     
002       Book
003       Paper

Csv with sales data looks like:

code:

ItemCode ItemName Sales
001      Pen        5
003      Paper      6

At the end it would look like:

code:

ItemCode ItemName Sales1 Sales2
001       Pen       5
002       Book
003       Paper     6

Then the next sales data would do the same, but populate the sales on Sales2 column, and so on.

Revalis Enai fucked around with this message at 22:39 on May 15, 2018

# ? May 15, 2018 19:50

The Fool: Oct 16, 2003

If you're language agnostic about it, Python + Pandas may be a better choice.

If you still want to use powershell, check out this blog post: http://ramblingcookiemonster.github.io/Join-Object/

# ? May 15, 2018 19:59

mystes: May 31, 2006

Revalis Enai posted:

I just learned that I could work with csv data with powershell. I've been doing it via Google Apps Script but it's slow and has execute time limit.

I'm looking to match one csv file to another based on the ItemCode and then populate sales data if they match. My main csv looks like this:
code:
ItemCode,ItemName,Sales1,Sales2,
001       Pen     
002       Book
003       Paper
Csv with sales data looks like:
code:
ItemCode,ItemName,Sales
001      Pen        5
003      Paper      6
At the end it would look like:
code:
ItemCode,ItemName,Sales1,Sales2
001       Pen       5
002       Book
003       Paper     6
Then the next sales data would do the same, but populate the sales on Sales2 column, and so on.

You really have the headers comma separated but the other rows tab or space separated?

# ? May 15, 2018 21:45

Revalis Enai: Apr 21, 2003; <img src="https://fi.somethingawful.com/customtitles/title-revalis_enai.gif"><br>Wait, what's my phone number again?; Fun Shoe

mystes posted:

You really have the headers comma separated but the other rows tab or space separated?

Sorry, they are all comma separated, I decided to space out the data to make it easier on the eyes but forgot about the headers.

quote:

If you're language agnostic about it, Python + Pandas may be a better choice.

If you still want to use powershell, check out this blog post: http://ramblingcookiemonster.github.io/Join-Object/

Thanks for the info, I did mess around with some SQL so I'm a bit familiar with joins, going to see if I can figure it out.

Revalis Enai fucked around with this message at 22:38 on May 15, 2018

# ? May 15, 2018 22:20

mystes: May 31, 2006

I guess do something like this (changing it based on how your files are named):

code:

$items = @{}
foreach ($row in Import-CSV main.csv) {
$items[$row.Itemcode] = $row
}
$n = 1
foreach ($csv in (ls sales*.csv)) {
foreach ($row in import-csv $csv) {
$items[$row.Itemcode].("Sales" + $n) = $row.Sales
}
$n += 1
}
$items.Values | Export-Csv -NoTypeInformation out.csv

Edit: This is assuming you already have columns sales1...salesn for each file as in your example and you don't care what order the sales csv files are added in. The syntax is slightly more complicated if you need to add new columns.

mystes fucked around with this message at 22:57 on May 15, 2018

# ? May 15, 2018 22:53

Revalis Enai: Apr 21, 2003; <img src="https://fi.somethingawful.com/customtitles/title-revalis_enai.gif"><br>Wait, what's my phone number again?; Fun Shoe

The Join-Object function worked really well. I've been messing around with SQL so this helped me better understand how joins work, and with a few adjustments I was able to get the result I was looking for.
Much appreciate the help. I'm also going to explore Python since it seem to be able to do what I'm doing in Powershell and more.

# ? May 17, 2018 19:42

PierreTheMime: Dec 9, 2004; Hero of hormagaunts everywhere!; Buglord

Sorry this is a fairly basic question but for the life of me I cannot find a good example of how to update individual access rules for an ACL. I'm trying to set up a user with specific read/write/delete access for files only (essentially just removing "Create Folders / append data" and "Delete" from the Advanced permissions area. Making ruleset for basic permissions is simple enough, but what is the command to modify the FileSystemRights for the special permissions?

# ? May 17, 2018 21:52

sloshmonger: Mar 21, 2013

PierreTheMime posted:

Sorry this is a fairly basic question but for the life of me I cannot find a good example of how to update individual access rules for an ACL. I'm trying to set up a user with specific read/write/delete access for files only (essentially just removing "Create Folders / append data" and "Delete" from the Advanced permissions area. Making ruleset for basic permissions is simple enough, but what is the command to modify the FileSystemRights for the special permissions?

I'm not quite sure what you're asking, but let's assume you are defining the ACL similar to this

code:

$objACLFullControl = [System.Security.AccessControl.FileSystemRights]::FullControl
$objACL = New-Object System.Security.AccessControl.FileSystemAccessRule ($objAdGroup.SamAccountName,$objACLFullControl,('ContainerInherit, ObjectInherit'),'None','Allow')

Then you just need to define a FileSystemRights object with the permissions you want to give. Check the MSDN below for what is available.
You may need to do this multiple time if you're granting multiple advanced permissions -- I haven't done that myself.

See: FileSystemAccessRule https://msdn.microsoft.com/en-us/library/system.security.accesscontrol.filesystemaccessrule(v=vs.110).aspx
or
FileSystemRights https://msdn.microsoft.com/en-us/library/system.security.accesscontrol.filesystemrights(v=vs.110).aspx

# ? May 17, 2018 22:41

PierreTheMime: Dec 9, 2004; Hero of hormagaunts everywhere!; Buglord

I'm not sure where they got the chart for on this site, but the special permissions can be applied as literal keywords in Powershell which is far easier than the method I'd found a while back and could no longer hunt down.

code:

$WriteAccess = New-Object System.Security.AccessControl.FileSystemAccessRule($UserAccount,"ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions","ContainerInherit,ObjectInherit","None","Allow")

does the trick for what I was looking for.

# ? May 18, 2018 14:39

The Fool: Oct 16, 2003

PSA: Be aware of typing.

# ? May 18, 2018 23:21

Methanar: Sep 26, 2013; by the sex ghost

Using floating point for money?

# ? May 18, 2018 23:42

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Methanar posted:

Using floating point for money?

Yeesh, really. Use decimal.

# ? May 18, 2018 23:55

The Fool: Oct 16, 2003

Noted and fixed.

In this script the floats(now decimals) are just used in a couple conditions. The actual data is all strings coming from one csv to another.

# ? May 19, 2018 00:24

Pile Of Garbage: May 28, 2007

The Fool posted:

PSA: Be aware of typing.

Well yeah, it's a dynamically typed language...

Also I hope you're not doing serious financial poo poo in PS...

# ? May 20, 2018 10:22

The Fool: Oct 16, 2003

I'm literally just merging two CSV's, the conditions in my screenshot are from the VSCode debugger and are watching some code that I wrote to do some sanity checks. (making sure the files selected have the expected data, follows the spec from the vendor, the data isn't obviously bad, etc)

Maybe I'll think twice about posting some quirk that amuses me next time.

# ? May 21, 2018 19:16

Dirt Road Junglist: Oct 8, 2010; We will be cruel
And through our cruelty
They will know who we are

Hypothetical question: let's say a company has been blocking the use of Powershell for years, and their security team has made it their directive to keep blocking Powershell for security reasons.

If someone were to argue against this blanket block, how would they argue against it? As in, what's the size of the security hole being punched in Windows endpoints by allowing users/unknown entities to run cmdlets?

# ? May 21, 2018 21:02

Zaepho: Oct 31, 2013

Dirt Road Junglist posted:

Hypothetical question: let's say a company has been blocking the use of Powershell for years, and their security team has made it their directive to keep blocking Powershell for security reasons.

If someone were to argue against this blanket block, how would they argue against it? As in, what's the size of the security hole being punched in Windows endpoints by allowing users/unknown entities to run cmdlets?

Powershell only allows you to do things you already have rights to do. Also, it essentially encapsulates .Net so to really block things you'd have to block .Net. Which of course you would never do because it's pretty much essential.

Also, Powershell is becoming more and more necessary from an administrative standpoint so not using it hamstrings your ability to effectively manage things. For example, there are settings in Exchange that are only accessible via Powershell.

Also, do they block VBscript, Batch/CMD, Windows Scripting Host? If not, they're only making life more difficult rather than more secure.

# ? May 21, 2018 21:17

mystes: May 31, 2006

Dirt Road Junglist posted:

Hypothetical question: let's say a company has been blocking the use of Powershell for years, and their security team has made it their directive to keep blocking Powershell for security reasons.

If someone were to argue against this blanket block, how would they argue against it? As in, what's the size of the security hole being punched in Windows endpoints by allowing users/unknown entities to run cmdlets?

Assuming they're just using group policy, that does absolutely nothing because anyone can still run powershell scripts with a simple command line option.

If it's pointless they might as well let people who know what they're doing use powershell.

And there are other ways to run powershell. Unless they are preventing use of vbscript, csc.exe, etc. and using a software restriction policy to only allow whitelisted programs, it's pretty pointless.

mystes fucked around with this message at 21:29 on May 21, 2018

# ? May 21, 2018 21:24

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 10:27

nielsm: Jun 1, 2009

Zaepho posted:

Powershell only allows you to do things you already have rights to do. Also, it essentially encapsulates .Net so to really block things you'd have to block .Net. Which of course you would never do because it's pretty much essential.

This. If PowerShell lets someone do a thing they should not have permissions to do, it's not PowerShell that's at fault. The permissions on the affected thing were set up were wrong to begin with.

(Also, fun fact: A base installation of the .NET framework includes a full functioning C# compiler, C:\Windows\Microsoft.NET\Framework\version\csc.exe. Anyone who can create files and run arbitrary programs can use that to compile their own code and do anything PS could be used for.)

# ? May 21, 2018 21:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Powershell Megathread: Verb-Noun Scripting is the future

«‹›94 »