gfoss / psrecon Goto Github PK

if you collect the informations from a remote system, most of the data is useless because the script is reading informations from the current security context which is of course my own remote login and not the user currently logged on the infected computer. To do a good and full investigation it would be important to get informations about the user who triggered the infection...

any solution for that?

when i run psrecon.ps1, it doesn`t work. it remind me that line 1010 of psrecon.ps1 lack of expression after word " , " charactor :35 why?

Hi,
I the -share option doesn't seem to be working.

Command is: .\psrecon.ps1 -remote -target 10.34.142.236 -share -netShare \10.88.133.128\share

and keep getting back:
"You must get the data off of the remote host...
Try using the -sendEmail parameter."

I copied the script from raw and line 1010: $emailLinkRegex had unknown characters around the pattern string.

On PowerShell v4 that variable will generate parse errors unless it's wrapped in quotes: "([a-zA-Z]{3,})://([\w-]+.)+[\w-]+(/[\w- ./?%&=])?"

Looking at it in the ACE editor it doesn't show any quotes around the string.

Is that fixable?

Trying to create SRP for LogRhythm and getting this error:

General Validations

1. There is some problem with the xml. Either a node is not properly formed or some attribute value is missing.

Can someone tell me what this means and how to fix it?