NetSPI/PowerHuntShares

Date format

sleewharry opened this issue · 8 comments

hello,
It seems that tool can not recognize share creation date. Error is:
[*][08/15/2022 12:41] - Identified top 5 share names.
Cannot convert value "16.07.2016 8:04:24 AM" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."

thanks!

Hey @sleewharry,

Thanks for the call out! I have not run into that in the lab or during testing. Can you tell me what version of Windows and PowerShell you are running?

Hi @nullbind
OS: Windows 10 Version 2004 (OS Build 19041.450)
PS: 5.1.19041.1

This is the line that PS is complaining about:
$ExPrivCreationLastn = $ExcessiveSharePrivs | Where-Object {([Datetime]$_.CreationDate.trim() -ge $StartDateAccess -and [Datetime]$_.CreationDate.trim() -le $EndDateAccess)}

2022-08-24 15_46_56-Window

Hello, I have the exact same problem, I don't know a lot about powershell but it looks like an issue about the locale

Impossible de convertir la valeur « 26/08/2022 10:32:46 » en type « System.DateTime ». Erreur : « La chaîne n'a pas été reconnue en tant que DateTime valide. »
Au caractère Ligne:4844 : 54
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument : (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastParseTargetInvocationWithFormatProvider

Hello,
I've modified ligne 553 to 568 and added the following code to the date to string conversion
"{0:MM/dd/yyyy HH:mm:ss}" -f

This seem to have made the trick on my computer that mix french and english language, I am sure there is a better way to do it.

                  # Creation date
                  $CreationdDateObject = Get-Item "\\$TargetAsset\$CurrentShareName" -ErrorAction SilentlyContinue | Select CreationTime
                  $CreationdDate = ("{0:MM/dd/yyyy HH:mm:ss}" -f ($CreationdDateObject.CreationTime)).ToString()
                  $CreationdDateYear = $CreationdDateObject.CreationTime.Year.ToString()

                  # Last modified date
                  $TargetPath = $_.Path
                  $LastModifiedDateObject = Get-Item "\\$TargetAsset\$CurrentShareName" -ErrorAction SilentlyContinue | Select-Object LastWriteTime
                  $LastModifiedDate = ("{0:MM/dd/yyyy HH:mm:ss}" -f ($LastModifiedDateObject.LastWriteTime)).ToString()
                  $LastModifiedDateYear  = $LastModifiedDate.split(' ')[0].split('/')[2]

                  # Last accessed date
                  $TargetPath = $_.Path
                  $LastAccessDateObject = Get-Item "\\$TargetAsset\$CurrentShareName" -ErrorAction SilentlyContinue | Select-Object LastAccessTime
                  $LastAccessDate = ("{0:MM/dd/yyyy HH:mm:ss}" -f ($LastAccessDateObject.LastAccessTime)).ToString()
                  $LastAccessDateYear = $LastAccessDate.split(' ')[0].split('/')[2]

Hi,

Thanks @jegillet-debug: the fix is working for me too (French locale)

Hey Everyone,

I'll try to get that fixed in the near future. Thanks for reaching out and sharing the solution!

Danish locals here. Windows 11. PowerShell 7.3.6

Cannot convert value "26-04-2023 13:29:31" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
At (...path...)\PowerHuntShares.psm1:4844 char:54
+ ... ere-Object {([Datetime]$_.LastAccessDate.trim() -ge $startDate -and [ ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastParseTargetInvocationWithFormatProvider