Open-AudIT

What's on your network?
It is currently Wed Jan 24, 2018 7:32 pm

All times are UTC + 10 hours




Post new topic Reply to topic  [ 2 posts ] 
Author Message
PostPosted: Tue Apr 15, 2014 10:38 am 
Offline
Newbie

Joined: Fri Apr 04, 2014 10:59 am
Posts: 10
Hey guys,

Encountered an issue with the script on a Windows Server 2003 (SP2), 32-bit.
Specifically, this portion:

Code:
if (cint(local_windows_build_number) > 2222 and not local_windows_build_number = "3000") then
   for each oProc in getObject( "winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2").instancesOf("Win32_Process")
      if lcase(oProc.name) = "wscript.exe" _
         or lcase(oProc.name) = "cscript.exe" Then
         sCmdLine = oProc.commandLine
         if  instr(1, sCmdLine, "\" & sScriptName, vbTextCompare) > 0 _
            or instr(1, sCmdLine, " " & sScriptName, vbTextCompare) > 0 _
            or instr(1, sCmdLine, """" & sScriptName, vbTextCompare) > 0 then
               nPID = oProc.processId
         end if
      end if
   next
end if


The output hangs on:

Code:
C:\audit>cscript audit_windows.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

starting audit - .
Not pinging target, attempting to audit.


I am not particularly sure why it hangs, but removing the code block fixes the issue and it proceeds as normal. I tried to echo in the foreach loop and nothing would spit out, so it seems it isn't actually finding anything to loop through. Any ideas?


Top
 Profile  
Reply with quote  
PostPosted: Wed Apr 16, 2014 1:30 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1229
This may be indicative of WMI being corrupt on the affected machine. The script could probably handle this better but the code you've removed is not really useful so you won't notice it's gone.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group