Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Process is killed when PowerShell exits #5

Open
crashingstatic opened this issue Aug 29, 2019 · 4 comments
Open

Process is killed when PowerShell exits #5

crashingstatic opened this issue Aug 29, 2019 · 4 comments

Comments

@crashingstatic
Copy link
Contributor

If a process is being paused by Pause-Process, the Powershell session that invoked Pause-Process needs to remain open for the process to continue to be paused. Once the session exits, the paused process is then terminated.

@crashingstatic
Copy link
Contributor Author

Start-AppBackgroundTask requires a GUID of the task to be performed.
Get-AppBackgroundTask shows that only Windows Packages Families (e.g. "Microsoft.BingSports_8wekyb3d8bbwe") are listed with GUIDs, not individual processes.

@crashingstatic
Copy link
Contributor Author

crashingstatic commented Aug 29, 2019

$job=Start-Job -ScriptBlock {Pause-Process -ID 1288} returned without error but...

Receive-Job -Job $job
The term 'pause-process' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the
name, or if a path was included, verify that the path is correct and try again.
    + CategoryInfo          : ObjectNotFound: (pause-process:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
    + PSComputerName        : localhost
Invoke-Command -ScriptBlock {Start-Job -ScriptBlock {pause-process -ID 1288}}

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command
--     ----            -------------   -----         -----------     --------             -------
5      Job5            BackgroundJob   Running       True            localhost            pause-process -ID 1288

Did not successfully pause PID 1288. Both of these methods would have been problematic due to the requirement that pause-process would have to be loaded as a local module for each session.

@crashingstatic
Copy link
Contributor Author

What if you execute the code remotely without ever spawning powershell.exe in the first place? Would that change anything?

https://github.com/Mr-Un1k0d3r/PowerLessShell

@crashingstatic
Copy link
Contributor Author

Take another look at Kansa. They've added asynchronity and powershell spawning. Watch out for EDR-freak-outs!

https://github.com/davehull/Kansa

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants