Show CMD window on target computer

Comments

11 comments

  • Colby Bouma

    What is the command that you're trying to run?

    1
    Comment actions Permalink
  • First Last

    Thanks for replying, I have just opened a case for this...

    The command is:

    for /f "tokens=2" %u in ('query session ^| findstr /R "^>"') do move c:\users\%u\downloads\filename.txt "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\new_filename.ovpn"
    The error is '\users\ufilename.txt was unexpected at this time'

    Similar issue with powershell

    1
    Comment actions Permalink
  • First Last

    If using a powershell step I get the error:

    You cannot call a method on a null-valued expression.
    At C:\Windows\AdminArsenal\PDQDeployRunner\service-1\exec\vpnconfig.ps1:1 char:19

     

    it doesn't like the variable, but the same works fine if run manually on the target machine using the same creds as pdq deploy user

    1
    Comment actions Permalink
  • Colby Bouma

    Deploy executes Command steps as a batch file, so variables need 2 % symbols: https://ss64.com/nt/for.html

    I would need to see your PowerShell code to diagnose it.

    1
    Comment actions Permalink
  • First Last

    yeah I tried with 2 % symbols, but will try that again.

    poweshell is:

    $CurrentUser = & {(get-wmiobject Win32_ComputerSystem).UserName.Split('\')[1]}
    Move-Item "c:\users\$CurrentUser\downloads\filename.txt" -Destination "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\new_filename.ovpn"
    Error is 'You cannot call a method on a null-valued expression.

    1
    Comment actions Permalink
  • Colby Bouma

    I'm not sure what it doesn't like about the first line of your PowerShell script. The & is unnecessary, but works fine when I tested it. However, it can be simplified to just 1 line:

    Move-Item "$env:USERPROFILE\downloads\filename.txt" -Destination "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\new_filename.ovpn"
    1
    Comment actions Permalink
  • First Last

    Thanks

    USERPROFILE is producing the deploy username rather than the logged on user so the path to file is not found

    1
    Comment actions Permalink
  • Colby Bouma

    Oh! I misunderstood what the first line was trying to do.

    I tried tweaking your script again. If this throws "Split-Path : Cannot bind argument to parameter 'Path' because it is null.", then I suspect you may be running against a target that doesn't have a user logged in, so UserName is empty.

    $CurrentUser = (Get-CimInstance Win32_ComputerSystem).UserName | Split-Path -Leaf
    Move-Item "C:\Users\$CurrentUser\downloads\filename.txt" -Destination "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\new_filename.ovpn"
    1
    Comment actions Permalink
  • First Last

    The target has a logged in user, although when I tested the previous command step again with 2 % symbols and made it show the output is was 0.

    I will try the PS.

    Thanks again!

    1
    Comment actions Permalink
  • First Last

    yeah I got the "Split-Path : Cannot bind argument to parameter" error, strange. I'm wondering if it's anything to do with it being a remote desktop session I have logged in on the target.

    1
    Comment actions Permalink
  • First Last

    Yep it's down to the logged in user being via RDP, it's working when I test logged in to the console on a VM.

    Thanks Colby for your excellent help with this!

    1
    Comment actions Permalink

Please sign in to leave a comment.