{"record":{"id":"54e9e581554591c3","repo":"shadow1ng/fscan","slug":"powershell-exec-failed-w-command-output-s","errorCode":null,"errorMessage":"powershell_exec_failed: %w, command_output: %s","messagePattern":"powershell_exec_failed: %w, command_output: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winwmi.go","lineNumber":67,"sourceCode":"} catch { Write-Output \"[FAIL] EventFilter: $_\" }\ntry {\n  $c = ([wmiclass]\"\\\\.\\root\\subscription:CommandLineEventConsumer\").CreateInstance()\n  $c.Name = \"%s\"; $c.ExecutablePath = \"%s\"; $c.CommandLineTemplate = \"%s\"\n  $c.Put() | Out-Null; $ok++; Write-Output \"[OK] Consumer\"\n} catch { Write-Output \"[FAIL] Consumer: $_\" }\ntry {\n  $fi = Get-WmiObject -Namespace root\\subscription -Class __EventFilter -Filter \"Name='%s'\"\n  $co = Get-WmiObject -Namespace root\\subscription -Class CommandLineEventConsumer -Filter \"Name='%s'\"\n  $b = ([wmiclass]\"\\\\.\\root\\subscription:__FilterToConsumerBinding\").CreateInstance()\n  $b.Filter = $fi.__PATH; $b.Consumer = $co.__PATH\n  $b.Put() | Out-Null; $ok++; Write-Output \"[OK] Binding\"\n} catch { Write-Output \"[FAIL] Binding: $_\" }\nWrite-Output \"TOTAL:$ok\"`,\n\t\tfilterName, consumerName, absPath, absPath, filterName, consumerName)\n\n\tout, err := exec.Command(\"powershell\", \"-NoProfile\", \"-Command\", ps).CombinedOutput()\n\tif err != nil {\n\t\tsession.LogError(i18n.Tr(\"error_generic\", fmt.Errorf(\"%s: %w, %s: %s\", i18n.GetText(\"powershell_exec_failed\"), err, i18n.GetText(\"command_output\"), strings.TrimSpace(string(out)))))\n\t}\n\tresult := string(out)\n\n\tvar output strings.Builder\n\tsuccessCount := 0\n\tfor _, line := range strings.Split(result, \"\\n\") {\n\t\tline = strings.TrimSpace(line)\n\t\tif strings.HasPrefix(line, \"[OK]\") || strings.HasPrefix(line, \"[FAIL]\") {\n\t\t\toutput.WriteString(line + \"\\n\")\n\t\t}\n\t\tif strings.HasPrefix(line, \"[OK]\") {\n\t\t\tsuccessCount++\n\t\t}\n\t}\n\n\tif successCount > 0 {\n\t\tsession.LogSuccess(i18n.Tr(\"winwmi_success\", successCount))\n\t}","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winwmi.go#L49-L85","documentation":"Scan builds a PowerShell script that registers a WMI permanent event subscription (filter, consumer, binding) and executes it with 'powershell -NoProfile -Command'. If the powershell process itself exits non-zero, the error plus captured combined output are reported as 'powershell_exec_failed'.","triggerScenarios":"powershell is not on PATH, script execution is blocked by policy/AppLocker, the WMI namespace/principal privileges are insufficient, or the process fails to start for any reason, causing exec.Command(...).CombinedOutput() to return err != nil.","commonSituations":"Running on Linux/macOS where powershell is missing, PowerShell restricted by execution policy or AMSI, missing admin rights to create WMI __EventFilter/ActiveScriptEventConsumer, or output containing an error string the parser does not expect.","solutions":["Install PowerShell (pwsh/powershell) or run from a Windows host with it on PATH","Run the tool elevated (Administrator) — WMI permanent events need admin","Relax execution policy / exclusions if policy blocks the command","Inspect command_output in the error message for the specific PS error"],"exampleFix":"// before\nout, err := exec.Command(\"powershell\", \"-NoProfile\", \"-Command\", ps).CombinedOutput()\n// after (prefer pwsh when available)\nshell := \"powershell\"\nif _, lookErr := exec.LookPath(\"pwsh\"); lookErr == nil { shell = \"pwsh\" }\nout, err := exec.Command(shell, \"-NoProfile\", \"-Command\", ps).CombinedOutput()","handlingStrategy":"try-catch","validationCode":"if _, err := exec.LookPath(\"powershell\"); err != nil {\n    return fmt.Errorf(\"powershell not on PATH: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"powershell\", \"-NoProfile\", \"-Command\", ps).CombinedOutput()\nif err != nil {\n    log.Printf(\"powershell failed: %v; output: %s\", err, string(out))\n}","preventionTips":["Verify powershell availability with exec.LookPath at startup","Run with administrator privileges for WMI event subscriptions","Keep a PowerShell execution-policy exemption for automation hosts","Capture and review CombinedOutput to diagnose PS-side failures"],"tags":["powershell","process-execution","wmi"],"backgroundTag":"command-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}