Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Fri Mar 29, 2024 4:34 pm

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 2 posts ] 
Author Message
PostPosted: Tue Apr 15, 2014 10:38 am 
Offline
Newbie

Joined: Fri Apr 04, 2014 10:59 am
Posts: 10
Hey guys,

Encountered an issue with the script on a Windows Server 2003 (SP2), 32-bit.
Specifically, this portion:

[code]if (cint(local_windows_build_number) > 2222 and not local_windows_build_number = "3000") then
for each oProc in getObject( "winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2").instancesOf("Win32_Process")
if lcase(oProc.name) = "wscript.exe" _
or lcase(oProc.name) = "cscript.exe" Then
sCmdLine = oProc.commandLine
if instr(1, sCmdLine, "\" & sScriptName, vbTextCompare) > 0 _
or instr(1, sCmdLine, " " & sScriptName, vbTextCompare) > 0 _
or instr(1, sCmdLine, """" & sScriptName, vbTextCompare) > 0 then
nPID = oProc.processId
end if
end if
next
end if[/code]

The output hangs on:

[code]C:\audit>cscript audit_windows.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

starting audit - .
Not pinging target, attempting to audit.[/code]

I am not particularly sure why it hangs, but removing the code block fixes the issue and it proceeds as normal. I tried to echo in the foreach loop and nothing would spit out, so it seems it isn't actually finding anything to loop through. Any ideas?


Top
 Profile  
Reply with quote  
PostPosted: Wed Apr 16, 2014 1:30 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
This may be indicative of WMI being corrupt on the affected machine. The script could probably handle this better but the code you've removed is not really useful so you won't notice it's gone.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 2 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group