2

I'm trying to get ACLs and parse into the array reg_perms, the code works fine without the Where-Object{($_.IdentityReference -eq "BUILTIN\Users")

command ='powershell "(Get-Acl \'HKLM:\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon\').Access | Where-Object{($_.IdentityReference -eq "BUILTIN\Users")} | Format-List RegistryRights,AccessControlType,IdentityReference"'

    data = ::Mixlib::ShellOut.new(command).run_command.stdout.strip.gsub(/\r\n?/, "\n")
    reg_perms = data.split("\n\n").each_with_object([]) do |set, arr|
      arr << set.split("\n").map do |f|
        f.split(':').collect(&:strip)
      end.to_h
    end
0

2 Answers 2

0

You are using single quotes for your entire string: '. Then when your string is evaled with double quotes the double quotes around the BUILTIN\Users string are not escaped, this mean you need to escape the double quotes around the ""BUILTIN\Users"" the powershell way or use single quotes \'BUILTIN\Users\' and escape them the ruby way.

This should work:

command ='powershell "(Get-Acl \'HKLM:\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon\').Access | Where-Object{
    ($_.IdentityReference -eq \'BUILTIN\Users\')
} | Format-List RegistryRights,AccessControlType,IdentityReference"'
4
  • Hmm guess that might make sense would have to play with it to fully understand. Your executing process must be evaluating it odd potentially as it see nested qoutes. I am not familiar with Ruby but if they have it you could try a literal string where no escaping is needed and see what happens.
    – jkdba
    Apr 20, 2018 at 0:26
  • Also powershell does not escape quotes via a \, so if that works then Ruby is doing the escaping and it is the source of the issue. Powershells escape character is the tick.
    – jkdba
    Apr 20, 2018 at 0:29
  • Correction to what I said earlier: \" is the safe way to escape literal " inside a "..." command passed to PowerShell from cmd.exe (which could be interactive, from a batch file, or from Chef/Ruby). "" - even though a safe choice PowerShell-internally - works in some cases, but it's not obvious when it fails, so it is best avoided; an example of when "" fails (execute directly from cmd.exe): powershell -nop -command "'>>""BUILTIN\Users""<<'"
    – mklement0
    Apr 20, 2018 at 3:18
  • And, just to demonstrate that \"-escaping does work (even though you wouldn't expect it, given that PowerShell-internally things work differently): powershell -nop -command "'>>\"BUILTIN\Users\"<<'" executed from cmd.exe correctly outputs >>"BUILTIN\Users"<<
    – mklement0
    Apr 20, 2018 at 3:37
0

You're trying to embed "BUILTIN\Users" - a double-quoted string - within the overall double-quoted command string you're passing to the PowerShell executable (powershell "..."), which cannot work, because embedding the same type of quotes in a quoted string requires escaping.

PowerShell, when it is called from outside via its CLI (powershell.exe), requires that embedded " chars. be \"-escaped (even though PowerShell-internally, `" or "" are used).[1]

Since you're using single-quoting on the Ruby (Chef) side (command = '...'), escaping the inner embedded " chars. as \" for the sake of PowerShell is sufficient.

Therefore, replace -eq "BUILTIN\Users" with -eq \"BUILTIN\Users\"; i.e.:

command ='powershell "(Get-Acl \'HKLM:\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon\').Access | Where-Object{($_.IdentityReference -eq \"BUILTIN\Users\")} | Format-List RegistryRights,AccessControlType,IdentityReference"'

Alternatively - given that the content of your quoted string is a literal, you can use single quotes around BUILTIN\Users in the PowerShell command; in that case, however, because on the Ruby side you're using single quotes for the overall command, you need to escape the embedded ' instances as \' for Ruby's benefit:

Therefore, replace -eq "BUILTIN\Users" with -eq \'BUILTIN\Users\'; i.e.:

command ='powershell "(Get-Acl \'HKLM:\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon\').Access | Where-Object{($_.IdentityReference -eq \'BUILTIN\Users\')} | Format-List RegistryRights,AccessControlType,IdentityReference"'

[1] When calling the PowerShell CLI from cmd.exe - be it from the command prompt, a batch file, or via Chef/Ruby - escaping a literal " as "" sometimes , but not always works (try
powershell -Command "'Nat ""King"" Cole'" directly from a cmd.exe command prompt).
Instead, \"-escaping is the safe choice.
`"-escaping, which is the typical PowerShell-internal way to escape " inside "...", never works in this scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.