[SOLVED] Capturing psexec output running "reg" on a remote machine

[sbonacina]

Dear fellows

I searched through the forum about this issue, tested all the suggestions I found but none helped me.

Issue: in a company environment, with many client PCs, I need to read the remote registry of those PCs to ensure some keys have not been manipulated. For security reasons, access to remote registry has been disabled, WMI too. Thus, I need to use psexec, but I cannot get in any way the remote reg command output.

Here's the code I'm using:

local  $cmdOUT

$PID=Run("psexec \\win7ultimate -u username -p password  -accepteula  reg query ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"" /v Userinit ", "",@SW_MINIMIZE, 0x2)
ProcessWait($PID)

While 1

    $line = StdoutRead($PID)

    If @error = -1 Then ExitLoop

    $cmdOUT &= $line

Wend

ConsoleWrite($cmdOUT)

The only output written on console is:

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Connecting to win7ultimate...


Starting PSEXESVC service on win7ultimate...


Connecting with PsExec service on win7ultimate...


Starting reg on win7ultimate...



reg exited on win7ultimate with error code 0.

Needless to say, the same command run on a command prompt gives a correct output containing the remote key.

I also tried with stderr, but the output is the same as stdout.

What am I doing wrong?

Any help will be appreciated

Thanks for your attention

stefano

 

Edited June 29, 2015 by sbonacina

[jguinch]

Try with both $STDOUT_CHILD and $STDERR_CHILD in your Run command.

Edit : you can also use RegRead to retrieve a value remotly, or WMI to specify a username and password.

Edited June 28, 2015 by jguinch

[BrewManNH]

PSExec is the issue, it isn't using the StdOut to display it's text in the console window. It's a known issue with it. The only way to get it to give you the StdOut text is to run another file script or batch file, on the remote computer using PSExec and get the output from THAT instead of PSExec. You can redirect the output to a text file and open the text file to read the results.

[sbonacina]

Thanks everybody.

I followed BrewManNH suggestion and wrote a separate .BAT file containing the reg query

Then I put psexec in my autoit script to run the bat file, and then to retrieve the file written in the remote system.

Problem solved!

 

Edited June 29, 2015 by sbonacina