Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add param block and use the actual script location for finding YARA #4

Open
nixuno opened this issue Dec 14, 2021 · 2 comments
Open

Comments

@nixuno
Copy link

nixuno commented Dec 14, 2021

Add a param block similar to the following:

[CmdletBinding()]
param (
    [Parameter(Mandatory=$false)][int]$usrScanscope = $env:usrScanscope,
    [Parameter(Mandatory=$false)][bool]$usrUpdateDefs = $env:usrUpdateDefs,
    [Parameter(Mandatory=$false)][char]$usrMitigate = $env:usrMitigate
)

Use this to get the location of the script itself, not the current directory:

$scriptObject = Get-Item -Path $script:PSCommandPath
$script:workingPath = $($scriptObject.DirectoryName)

So that this:

foreach ($iteration in ('yara32.exe','yara64.exe')) {
    if (!(test-path $iteration)) {
        write-host "! ERROR: $iteration not found. It needs to be in the same directory as the script."
        write-host "  Download Yara from https://github.com/virustotal/yara/releases/latest and place them here."
        exit 1
    } else {
        write-host "- Verified presence of $iteration."
    }

becomes this

foreach ($iteration in ('yara32.exe','yara64.exe')) {
    if (!(test-path "$script:workingPath\$iteration")) {
        write-host "! ERROR: $iteration not found. It needs to be in the same directory as the script."
        write-host "  Download Yara from https://github.com/virustotal/yara/releases/latest and place them here."
        exit 1
    } else {
        write-host "- Verified presence of $iteration."
    }

Hope this helps 😊

Edit: Link to the fork which implements these changes: https://github.com/ProVal-Tech/log4shell-tool

@Datto-StanLee
Copy link

Hi;
This is a great resource for people looking to bolster the script, thank you for adding it.
The reason the script is written the way it is is because originally it was intended for use with the Datto RMM solution which does not require the above steps to be taken; however, if we make "generic" scripts in future I will endeavour to bridge this gap a little closer.
I won't close this case so everyone can see it.
Cheers – SL

@nixuno
Copy link
Author

nixuno commented Dec 15, 2021

For completeness sake, and because with the initial proposed edits alone the script would break, I forked the repo and edited the script to include these edits. I'll also edit the initial issue with the link to the fork. https://github.com/ProVal-Tech/log4shell-tool

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants