Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 5a05a02

Browse files
author
Jon Cave
committed
Fix Get-GroupsXML for multiple <Group> tags
Select all <Group> nodes and iterate through them, not just the root <Groups> node.
1 parent 81ac124 commit 5a05a02

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

Recon/PowerView.ps1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6141,12 +6141,12 @@ filter Get-GroupsXML {
61416141
[XML]$GroupsXMLcontent = Get-Content $TargetGroupsXMLPath -ErrorAction Stop
61426142

61436143
# process all group properties in the XML
6144-
$GroupsXMLcontent | Select-Xml "//Groups" | Select-Object -ExpandProperty node | ForEach-Object {
6144+
$GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {
61456145

6146-
$Groupname = $_.Group.Properties.groupName
6146+
$Groupname = $_.Properties.groupName
61476147

61486148
# extract the localgroup sid for memberof
6149-
$GroupSID = $_.Group.Properties.GroupSid
6149+
$GroupSID = $_.Properties.groupSid
61506150
if(-not $LocalSid) {
61516151
if($Groupname -match 'Administrators') {
61526152
$GroupSID = 'S-1-5-32-544'
@@ -6163,16 +6163,16 @@ filter Get-GroupsXML {
61636163
}
61646164

61656165
# extract out members added to this group
6166-
$Members = $_.Group.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
6166+
$Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {
61676167
if($_.sid) { $_.sid }
61686168
else { $_.name }
61696169
}
61706170

61716171
if ($Members) {
61726172

61736173
# extract out any/all filters...I hate you GPP
6174-
if($_.Group.filters) {
6175-
$Filters = $_.Group.filters.GetEnumerator() | ForEach-Object {
6174+
if($_.filters) {
6175+
$Filters = $_.filters.GetEnumerator() | ForEach-Object {
61766176
New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}
61776177
}
61786178
}

0 commit comments

Comments
 (0)