Escaping powershell command

[MikeM2468]

I've got a working PHP script that changes Active Directory passwords. The one problem I have is that I can't pass a password with a & in it because it breaks the powershell command. Is there a good way to escape that?
Here is what I'm running:

$adpwchange = shell_exec("powershell import-module activedirectory ; Set-ADAccountPassword -identity $login -reset -newpassword (convertto-securestring -asplaintext '$password' -force) < NUL");

 

[jpadie]

would shellescapearg() be what you are looking for? note that it enquotes the argument, so you should not double enquote yourself

 

[MikeM2468]

I'm not having any luck putting that anywhere.

 

[jpadie]

shell_exec("powershell import-module activedirectory ; Set-ADAccountPassword -identity " . escapeshellarg($login) ." -reset -newpassword (convertto-securestring -asplaintext " . escapeshellarg($password) ." -force) < NUL");

i'm guessing as I don't use windows I'm afraid. perhaps the ampersand is an illegal character in windows passwords?

 

[MikeM2468]

No, it's legal. Powershell, however, sees it as an escape character. The above didn't work either.

 

[jpadie]

please try echoing the command string to the screen and then copying it directly into a powershell window. logically powershell should also refuse that as the data is precisely the same.

a brief research suggests that the ampersand is not an escape/special character in powershell, nor in active directory (see this link ). So I am not convinced that we've found the actual problem yet! Might it be an issue with encoding? i.e. input in utf8 and it should be piped through in ascii? if so perhaps utf8_decode()? or even html_entity_decode if it is possible that the input came in over a GET or urlencoded input.

 

[MikeM2468]

If I echo the output and then throw that at the command line I get what I expect. It stops at the & and thinks the rest is a new command.

 

[jpadie]

still clutching at strings as no windows in my world!

i have two possibilities. the first is enquoting the password in double quotes.

$login =  'mylogin';
$password = 'mypassword';
$command = 'powershell ';
$args = array(
		'import-module ActiveDirectory;',
		'Set-ADAccountPassword -identity ' . $login . ' -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "' . $password . '" -force)',
		);
		
$output = shell_exec( $command . implode(' ', $args) . ' < NUL');
print_r($output);

the second is creating a script and then using php to call the script

$query = shell_exec("powershell -command " . escapeshellarg('c:\path\to\script.ps') . " -username '$username' -password '$newPassword' < NUL");

 

[MikeM2468]

I think I need to focus on getting the command to work from the Windows command line first. Then come back to see how to format it properly with PHP.

 

[jpadie]

ah. yes. I thought you were working from a known good position and trying to make it work with php.

definitely get the command line version working first. I think the path of least resistance would be to create a powershell function that uses LDAP to change the password that takes two arguments. plenty of examples on the web.

also could you just use the net user command rather than powershell ?

 

[MikeM2468]

I figured out the powershell part. The & needs to be escaped with a ^. Now the question is how do I find and prefix & in the password field with ^ in PHP? Looks like I'll also need to escape ^ with ^ in the event it is used.

 

[jpadie]

Wow. How surreal!

Assuming this is just the password part use str_replace('&','^&', $password).

 

[MikeM2468]

Is there a way to catch the output of shell_exec()? Something isn't passing correctly. Does it see ^ as something special?

 

[jpadie]

Shell_exec returns all output. So everything is captured. I do not know what the effect of piping to null is on a windows computer but try deleting that bit if you are not getting any response.

I do not believe that a carat is a special character outside of regex. I'm still massively surprised that power shell uses a carat as a method of escaping special characters.

 

[MikeM2468]

If I run the command with the substituted variables at the cli, it works ok. shell_exec() is passing it in a way that isn't working. But with no output to see what the error is, I can't troubleshoot it.

If I remember correctly, without the NUL, powershell never exits.