Removed some PS, added --nops flag to force no PS, edr_query, process…

… color

CIMplant/Commander.cs

@@ -10,7 +10,7 @@ public class Commander
  {
  public string Command, Execute, File, Cmdlet, FileTo, Directory, RegKey, RegSubKey,
  RegVal, RegValType, Service, ServiceBin, Method, Process;
- public bool Reset;
+ public bool Reset, NoPS;
 
  private readonly string[] _shutdown = { "logoff", "reboot", "restart", "power_off", "shutdown" };
  private readonly string[] _fileCommand = { "cat", "copy", "download", "ls", "search", "upload" };
@@ -38,6 +38,7 @@ public Commander()
  this.Reset = Options.Instance.Reset;
  this.Process = Options.Instance.Process;
  this.Method = null;
+ this.NoPS = Options.Instance.NoPS;
  }
 
  public Commander(string command)
@@ -196,15 +197,15 @@ private void ParseCommands()
  "restart", "power_off", "shutdown",
  "vacant_system", "logon_events", "command_exec", "disable_wdigest", "enable_wdigest", "disable_winrm",
  "enable_winrm",
- "reg_mod", "reg_create", "reg_delete", "remote_posh", "sched_job", "service_mod"
+ "reg_mod", "reg_create", "reg_delete", "remote_posh", "sched_job", "service_mod", "edr_query"
  };
 
  public static void DisplayHelp<T>(ParserResult<T> result, IEnumerable<Error> errs)
  {
  HelpText helpText = HelpText.AutoBuild(result, h =>
  {
  h.AdditionalNewLineAfterOption = false;
- h.Heading = "WMI C# Version 0.1"; //change header
+ h.Heading = "WMI C# Version 0.2"; //change header
  h.Copyright = ""; //change copyright text
  h.AutoVersion = false;
  return HelpText.DefaultParsingErrorsHandler(result, h);
@@ -311,6 +312,10 @@ public class Options
  [Option("provider", Required = false, HelpText = "Use InstallUtil to register a WMI provider (Not Currently Working)",
  Default = false)]
  public bool Provider { get; set; }
+
+ [Option("nops", Required = false, HelpText = "Do not allow any PowerShell execution (will die before)",
+ Default = false)]
+ public bool NoPS { get; set; }
 
  [Option("show-commands", Group = "Command", Required = true,
  HelpText = "Displays a list of available commands")]

CIMplant/Connector.cs

@@ -65,6 +65,7 @@ private CimSession DoCimConnection(Planter planter)
  sessionOptions.AddDestinationCredentials(credentials);
  sessionOptions.MaxEnvelopeSize = 256000; // Not sure how else to get around this
  connectedCimSession = CimSession.Create(SystemToConn, sessionOptions);
+
  }
 
  else
@@ -73,9 +74,15 @@ private CimSession DoCimConnection(Planter planter)
  connectedCimSession = CimSession.Create(SystemToConn, options);
  }
 
+ //connectedCimSession.TestConnection();
+
  // Test connection to make sure we're connected
- if (!connectedCimSession.TestConnection())
+ if (!connectedCimSession.TestConnection(out CimInstance instance, out CimException exception))
+ {
  return null;
+ }
+
+
 
  Messenger.GoodMessage("[+] Connected\n");
  return connectedCimSession;