2

In a sort of small mitigation for a large network for the exploit of replacing utilman.exe on windows repair, by cmd.exe, then changing user password, I'm doing a small script based on EventSentry tool that will detect that utilman.exe is changed and I can attach an action to it. But this detect will take place after the attacker already logged in to the local computer. So, I'm doing a script that will change access rights, and blocking delete and rename of utilman.exe and I want to add the password change for the current logged user and then log off.

This is what I have so far:

 @ECHO off
 takeown /f c:\windows\system32\utilman.exe
 icacls c:\windows\system32\utilman.exe /deny *S-1-1-0:(DE,WD,AD,RX)
 net user [NeedToGetLogedUser] 123456
 shutdown -L

The action that I attach will execute this script under another user (not the actual logged user). So I need to get the actual current user logged to the computer instead of the user that this script will run under.

I was thinking of:

C:\Users\MyUser>query user
USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>MyUser              console             1  Active      none   7/9/2020 6:27 PM

But I can't figure out how to parse the result just to get "MyUser" alone (using findstr) to use it with the net user command.

4
  • You need something like awk of UNIX world in Windows. You can have the same result using powershell, is this an option for you? – Krackout Jul 24 '20 at 13:15
  • Powershell could be a plan B, some powershell scripting is blocked because security policy. but if there is no other option I could use it. – Deftoner Jul 24 '20 at 13:18
  • Why are people still cobbling together batch scripts? Powershell has been around for 13 years now, and at least two thirds of that time it's been mature enough to be used for everyday work. It's so much more powerful and easy to use than batch. – Gerald Schneider Jul 24 '20 at 13:18
  • I guess the question is not related about if batch of powershell is good. ;) but sadly, in mid and high security networks powershell scripting must be disabled or restricted in order to meet PCI, STIG and another security standards. I would love to use powershell – Deftoner Jul 24 '20 at 13:36
3

for /F "tokens=2 delims==" %f in ('wmic computersystem get username /value ^| find "="') do set "ConsoleUser=%f"

Output:

" \>set "ConsoleUser=COMPUTERORDOMAINNAME\username

When run in a batch file, replace % with %%

for /F "tokens=2 delims==" %%f in ('wmic computersystem get username /value ^| find "="') do set "ConsoleUser=%%f"
echo %ConsoleUser%

3
  • Thanks for the reply! for some reason in command line or batch file I get "| was unexpected at this time." I guess it does not like the pipe – Deftoner Jul 24 '20 at 14:10
  • I found that ^ is needed: for /F "tokens=2 delims==" %f in ('wmic computersystem get username /value ^| find "="') do set "ConsoleUser=%f" – Deftoner Jul 24 '20 at 14:31
  • @Deftoner: yes, that is odd, it must have been stripped out when I pasted it in. – Greg Askew Jul 24 '20 at 14:36
1

Thanks for all replies. It helped me to find the solution. I ended up doing this script that works perfect for what I need :)

@ECHO off
set ConsoleUser=None
takeown /f c:\windows\system32\utilman.exe
icacls c:\windows\system32\utilman.exe /deny *S-1-1-0:(DE,WD,AD,RX)
for /F "tokens=1" %%f in ('query user ^| find ">"') do set "ConsoleUser=%%f"
net user %ConsoleUser:~1% 123456
shutdown -L

This script will limit the execution, deletion and rename of utilman.exe, will reset the password of the user that is logged in and then log the user off. So attacker cant modify utilman.exe again or execute it, and password of the user was changed.

Thanks again!

1
  • If anybody is curious, this is the article/script that I wrote based on this code. THANKS lnkd.in/expq4_y – Deftoner Aug 31 '20 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.