Skip to content

Instantly share code, notes, and snippets.

@mattweidner

mattweidner/findelevate.py

Forked from riyazwalikar/findelevate.py
Created May 26, 2017 04:58
Show Gist options
  • Save mattweidner/7771ae142343fcf24f96a05b9aa2ead6 to your computer and use it in GitHub Desktop.
Save mattweidner/7771ae142343fcf24f96a05b9aa2ead6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @riyazwalikar riyazwalikar revised this gist May 24, 2017. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion findelevate.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    # Usage: findelevate.py C:\Windows\System32\
    # Needs sigcheck.exe in path [https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx]

    import sys
    import os
    @@ -22,7 +23,7 @@

    i = 0
    for exe in exefiles:
    p = subprocess.Popen(['sigcheck','-m', exe],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    p = subprocess.Popen(['sigcheck', '-nobanner','-m', exe],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    out, err = p.communicate()
    if '<autoElevate>true</autoElevate>' in out:
    print exe.strip()
  2. @riyazwalikar riyazwalikar revised this gist May 24, 2017. 1 changed file with 7 additions and 0 deletions.
    7 changes: 7 additions & 0 deletions findelevate.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,15 @@
    # Usage: findelevate.py C:\Windows\System32\

    import sys
    import os
    import glob
    import subprocess

    if len(sys.argv) < 2:
    print "Usage: findelevate.py <PATH>"
    print "Ex: Usage: findelevate.py C:\\Windows\\System32\\"
    sys.exit()

    d = sys.argv[1]

    if not (d.endswith('\\')):
  3. @riyazwalikar riyazwalikar created this gist May 24, 2017.
    24 changes: 24 additions & 0 deletions findelevate.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,24 @@
    import sys
    import os
    import glob
    import subprocess

    d = sys.argv[1]

    if not (d.endswith('\\')):
    d = d+'\\'

    exefiles = []

    if os.path.isdir(d):
    exefiles = glob.glob(d+'*.exe')

    i = 0
    for exe in exefiles:
    p = subprocess.Popen(['sigcheck','-m', exe],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    out, err = p.communicate()
    if '<autoElevate>true</autoElevate>' in out:
    print exe.strip()
    i = i + 1

    print "Found " + str(i) + " executables with autoElevate set to true!"