From 3d0d32d9ee6af70f0dfd5ecfe809a49a65d6822d Mon Sep 17 00:00:00 2001
From: b33f <ru.boonen@gmail.com>
Date: Thu, 10 Aug 2017 22:05:41 +0100
Subject: Path array fix for Get-ModifiablePath

This is a fix for:
https://github.com/PowerShellMafia/PowerSploit/issues/248
---
 Privesc/PowerUp.ps1 | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Privesc/PowerUp.ps1 b/Privesc/PowerUp.ps1
index 2680986..062045c 100644
--- a/Privesc/PowerUp.ps1
+++ b/Privesc/PowerUp.ps1
@@ -2069,7 +2069,13 @@ https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/wind
     if ($VulnServices) {
         ForEach ($Service in $VulnServices) {
 
-            $ModifiableFiles = $Service.pathname.Split(' ') | Get-ModifiablePath
+            $SplitPathArray = $Service.pathname.Split(' ')
+            $ConcatPathArray = @()
+            for ($i=0;$i -lt $SplitPathArray.Count; $i++) {
+                        $ConcatPathArray += $SplitPathArray[0..$i] -join ' '
+            }
+
+            $ModifiableFiles = $ConcatPathArray | Get-ModifiablePath
 
             $ModifiableFiles | Where-Object {$_ -and $_.ModifiablePath -and ($_.ModifiablePath -ne '')} | Foreach-Object {
                 $CanRestart = Test-ServiceDaclPermission -PermissionSet 'Restart' -Name $Service.name
-- 
cgit v1.2.3