Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

winpeas crashes when run using PsExec and log option is specified #256

Open
Doctor-Venom opened this issue Jan 5, 2022 · 1 comment
Open

Comments

@Doctor-Venom
Copy link

Issue description

running winPEASany.exe with PSEXEC and specifying the "log" option makes winpeas crash

Steps to reproduce the issue

The following works:

  1. "PsExec64.exe" -l -accepteula -nobanner ""winPEASany.exe"""
  2. "PsExec64.exe" -l -accepteula -nobanner ""winPEASany.exe -lolbas"""

But the following does not work:

  1. "PsExec64.exe" -l -accepteula -nobanner ""winPEASany.exe log"""
  2. "PsExec64.exe" -l -accepteula -nobanner ""winPEASany.exe log="c:/temp/out.txt""""
  3. "PsExec64.exe" -l -accepteula -nobanner ""winPEASany.exe -lolbas log"""
    the error returned by PsExec is "winPEASany.exe exited with error code 0."
    *Note that running winpeas without PsExec with the same arguments works normally.

If winpeas, did you use a clean or obfuscated winpeas, and for which architecture?

tried both clean and obfuscated winPEASany

Is there any AV / Threat protection in the system?

No

Please, indicate the OS, the OS version, and the kernel version (build number in case of Windows)

windows 10

@Doctor-Venom
Copy link
Author

Doctor-Venom commented Jan 6, 2022

I have also tried another way (using powershell) to do the same, and got the same problem:

This works:

$pass = ConvertTo-SecureString 's3curedolboebP@ss69' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('pwnedfAGG',$pass)
Start-Process -FilePath "winPEASany.exe" -ArgumentList "-lolbas" -Credential $cred -WorkingDirectory "C:\"

But this does not:

$pass = ConvertTo-SecureString 's3curedolboebP@ss69' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('pwnedfAGG',$pass)
Start-Process -FilePath "winPEASany.exe" -ArgumentList "-lolbas log" -Credential $cred -WorkingDirectory "C:\"

and this one:

$pass = ConvertTo-SecureString 's3curedolboebP@ss69' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('pwnedfAGG',$pass)
Start-Process -FilePath "winPEASany.exe" -ArgumentList "-lolbas log='C:\Users\CO_TES~1\AppData\Local\Temp'" -Credential $cred -WorkingDirectory "C:\"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant