Skip to content

Commit

Permalink
Update Parse-PolicyFile.ps1
Browse files Browse the repository at this point in the history
  • Loading branch information
@gtworek
gtworek authored Sep 26, 2019
1 parent ebc5386 commit 9b03ac5
Showing 1 changed file with 154 additions and 27 deletions.
181 changes: 154 additions & 27 deletions GPO/Parse-PolicyFile.ps1
View file
Original file line number Diff line number Diff line change
@@ -1,61 +1,188 @@
$polregtypes = ("REG_NONE","REG_SZ","REG_EXPAND_SZ","REG_BINARY","REG_DWORD","REG_DWORD_BIG_ENDIAN","REG_LINK","REG_MULTI_SZ","REG_RESOURCE_LIST","REG_FULL_RESOURCE_DESCRIPTOR","REG_RESOURCE_REQUIREMENTS_LIST","REG_QWORD")
$polblobsize = 1024 #limit of data size before we stop trying to display data and simply say "(BLOB)"

if ($file -eq $null)
{
$file2 = (dir *.pol)[0]
$polFile = (dir *.pol)[0]
}
else
{
$file2 = $file
$polFile = $file
}
$arrtmp2=@()

if (Test-Path ($file2.FullName))
if (Test-Path ($polFile.FullName))
{
$polbytes = [System.IO.File]::ReadAllBytes($file2.FullName)
$text = [System.Text.Encoding]::ASCII.GetString($polbytes, 0, 4)
if ($text -cne "PReg")
$polbytes = [System.IO.File]::ReadAllBytes($polFile.FullName)
if (([System.Text.Encoding]::ASCII.GetString($polbytes, 0, 4)) -cne "PReg")
{
Write-Host ("[???] Not looking like POL file "+$file2.FullName) -ForegroundColor Red
Write-Host ("[??? POL] Not looking like POL file "+$polFile.FullName) -ForegroundColor Red
$polrow = New-Object psobject
$polrow | Add-Member -Name "FullName" -MemberType NoteProperty -Value $file2.FullName
$polrow | Add-Member -Name "FullName" -MemberType NoteProperty -Value $polFile.FullName
$polrow | Add-Member -Name "Root" -MemberType NoteProperty -Value "???"
$polrow | Add-Member -Name "Key" -MemberType NoteProperty -Value "???"
$polrow | Add-Member -Name "Value" -MemberType NoteProperty -Value "???"
$polrow | Add-Member -Name "Data" -MemberType NoteProperty -Value "???"
}
else
{
#Root (HKLM/HKCU) to be determined from name, ? for unknown, stupid but works
#Root (HKLM/HKCU) to be determined from name, ? for unknown. stupid but works
$POLroot = "?"
if ($file2.FullName -like "*}_Machine_Registry.pol")
if ($polFile.FullName -like "*}_Machine_Registry.pol")
{
$POLroot = "HKLM"
}
if ($file2.FullName -like "*}_User_Registry.pol")
if ($polFile.FullName -like "*}_User_Registry.pol")
{
$POLroot = "HKCU"
}
#[key;value;type;size;data] - let's extract key, value and data. Type and size to be ignored as not very interesting.
#assuming all pol files are unicode. let me know if you find different one.
#[key;value;type;size;data]
$polbytes = $polbytes[8..($polbytes.Count)]
$PolStrings = [System.Text.Encoding]::Unicode.GetString($polbytes)
foreach ($polstrtmp in ($PolStrings -split "\["))
{
$polstrtmp2 = $polstrtmp -split ";"

$polip=0
$polstrtmp=""

$polrow = New-Object psobject
$polrow | Add-Member -Name "FullName" -MemberType NoteProperty -Value $file2.FullName
$polrow | Add-Member -Name "FullName" -MemberType NoteProperty -Value $polFile.FullName
$polrow | Add-Member -Name "Root" -MemberType NoteProperty -Value $POLroot
$polrow | Add-Member -Name "Key" -MemberType NoteProperty -Value $polstrtmp2[0]
$polrow | Add-Member -Name "Value" -MemberType NoteProperty -Value $polstrtmp2[1]
$polrow | Add-Member -Name "Data" -MemberType NoteProperty -Value $polstrtmp2[4]
$arrtmp2 += $polrow
$polrow | Add-Member -Name "Key" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Value" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Type" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Data" -MemberType NoteProperty -Value "??"
$polip2 = 0 #field

while ($true)
{
switch ($polip2)
{
0 #key
{
if (($polbytes[0+$polip] -eq 0) -and ($polbytes[1+$polip] -eq 0) -and ($polbytes[2+$polip] -eq 59) -and ($polbytes[3+$polip] -eq 0)) #00;0
{
if ($polstrtmp[0] -eq "[")
{
$polstrtmp = $polstrtmp.Substring(1)
}
$polrow.Key = $polstrtmp
$polstrtmp = ""
$polip2 = 1
$polip += 2 #skip ";"
}
else
{
$polstrtmp += [System.Text.Encoding]::Unicode.GetString($polbytes[(0+$polip)..(1+$polip)])
}
break
} #1

1 #value
{
if ($polbytes[0+$polip] -or $polbytes[1+$polip])
{
$polstrtmp += [System.Text.Encoding]::Unicode.GetString($polbytes[(0+$polip)..(1+$polip)])
}
else #weve got data, save
{
$polrow.Value = $polstrtmp
$polstrtmp = ""
$polip2 = 2
$polip += 2 #skip ";"
}
break
} #1

2 #type
{
if (($polbytes[4+$polip] -eq 59) -and ($polbytes[5+$polip] -eq 0)) #....;0
{
if (($polbytes[$polip+1]) -or ($polbytes[$polip+2]) -or ($polbytes[$polip+3]))
{
Write-Host "[??? POL] Non-zero MSB for type." -ForegroundColor Red
}
$polrow.Type = $polregtypes[$polbytes[$polip]]
$polstrtmp = ""
$polip2 = 3
$polip += 4 #skip "00;0"
}
else
{
Write-Host "[??? POL] Unusually long type field." -ForegroundColor Red
}
break
} #2

3 #size
{
if (($polbytes[4+$polip] -eq 59) -and ($polbytes[5+$polip] -eq 0)) #....;0
{
$poldatasize = 256*256*256*$polbytes[3+$polip] + 256*256*$polbytes[2+$polip] + 256*$polbytes[1+$polip] + $polbytes[$polip]
$polstrtmp = ""
$polip2 = 4
$polip += 4 #skip "..;0"
}
else
{
Write-Host "[??? POL] Unusually long size field." -ForegroundColor Red
}
break
} #3

4 #data
{
$poldata = $polbytes[($polip)..($polip+$poldatasize-1)]
if ($poldatasize -gt $polblobsize)
{
$polrow.Data = "(BLOB)"
}
else
{
if (($polrow.Type -eq "REG_MULTI_SZ") -or ($polrow.Type -eq "REG_SZ"))
{
$poldata = $poldata[0..($poldata.Count-3)]
$polrow.Data = ([System.Text.Encoding]::Unicode.GetString($poldata))
}
if ($polrow.Type -eq "REG_DWORD")
{
$polrow.Data = ("0x"+(($poldata[3..0]|ForEach-Object ToString X2) -join ''))
}
}
$polip += $poldatasize #skip
if ($polbytes[$polip] -ne 93) #simple check if we point to the closing "]"
{
Write-Host "[??? POL] Something strange happened." -ForegroundColor Red
}
$arrtmp2 += $polrow
$polrow = New-Object psobject #re-init data for row
$polrow | Add-Member -Name "FullName" -MemberType NoteProperty -Value $polFile.FullName
$polrow | Add-Member -Name "Root" -MemberType NoteProperty -Value $POLroot
$polrow | Add-Member -Name "Key" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Value" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Type" -MemberType NoteProperty -Value "??"
$polrow | Add-Member -Name "Data" -MemberType NoteProperty -Value "??"
$polip2 = 0 #reset field number
break
} #4

default
{
Write-Host "[??? POL] Something strange happened." -ForegroundColor Red
} #default
} #switch

$polip += 2
if ($polbytes.Count -le $polip)
{
break
}
} #while
} #else PReg
if ($file -eq $null)
{
$arrtmp2 | Out-GridView
}
}
if ($file -eq $null)
{
$arrtmp2 | Out-GridView
}
} #file exists
else
{
Write-Host ("[???] Cannot find the file for parsing") -ForegroundColor Red
Write-Host ("[??? POL] Cannot find the file for parsing") -ForegroundColor Red
}

0 comments on commit 9b03ac5

Please sign in to comment.