Refactored powershell_history module to fix case sensitivity

Pennyw0rth · Feb 25, 2025 · b14830f · b14830f
1 parent a53a1ce
commit b14830f
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/nxc/modules/powershell_history.py b/nxc/modules/powershell_history.py
@@ -36,8 +36,10 @@ def on_admin_login(self, context, connection):
                             buf = BytesIO()
                             connection.conn.getFile("C$", file_path, buf.write)
                             buf.seek(0)
-                            file_content = buf.read().decode("utf-8", errors="ignore").lower()                
-                            keywords = [keyword.upper() for keyword in self.sensitive_keywords if keyword in file_content]
+                            file_content = buf.read().decode("utf-8", errors="ignore")
+                            # Use temporary lowercase version for searching
+                            file_content_lower = file_content.lower()
+                            keywords = [keyword.upper() for keyword in self.sensitive_keywords if keyword.lower() in file_content_lower]
                             if len(keywords):
                                 context.log.highlight(f"C:\\{file_path} [ {' '.join(keywords)} ]")
                             else: