PowerShellMafia/PowerSploit

Get-ModifiableServiceFile false positives due to arguments

Closed this issue · 3 comments

I'm getting the following results, for example:

Path                            : "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
ModifiableFile                  : C:\

ServiceName                     : Steam Client Service
Path                            : "C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService

But the files or folders are not writeable. The reason they are listed is that Get-ModifiablePath will receive the path including the argument (such as /svc) and then treat this as two path items. The second one is writeable so it reports the result even though the main path is not.

I am unable to reproduce this issue, can you please check out the latest version in the Dev branch to test. I tried to implement your use case, see the screenshot below:

image

It seems ok with dev branch code. But I also changed permissions on c:\ so that may have fixed it...

Cool, I wanted to make sure. If it turns out there is still some issue here, please reopen the ticket!