shadow1ng/fscan · error

powershell_exec_failed: %w, command_output: %s

Error message

powershell_exec_failed: %w, command_output: %s

What it means

Scan builds a PowerShell script that registers a WMI permanent event subscription (filter, consumer, binding) and executes it with 'powershell -NoProfile -Command'. If the powershell process itself exits non-zero, the error plus captured combined output are reported as 'powershell_exec_failed'.

Source

Thrown at plugins/local/winwmi.go:67

} catch { Write-Output "[FAIL] EventFilter: $_" }
try {
  $c = ([wmiclass]"\\.\root\subscription:CommandLineEventConsumer").CreateInstance()
  $c.Name = "%s"; $c.ExecutablePath = "%s"; $c.CommandLineTemplate = "%s"
  $c.Put() | Out-Null; $ok++; Write-Output "[OK] Consumer"
} catch { Write-Output "[FAIL] Consumer: $_" }
try {
  $fi = Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter "Name='%s'"
  $co = Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -Filter "Name='%s'"
  $b = ([wmiclass]"\\.\root\subscription:__FilterToConsumerBinding").CreateInstance()
  $b.Filter = $fi.__PATH; $b.Consumer = $co.__PATH
  $b.Put() | Out-Null; $ok++; Write-Output "[OK] Binding"
} catch { Write-Output "[FAIL] Binding: $_" }
Write-Output "TOTAL:$ok"`,
		filterName, consumerName, absPath, absPath, filterName, consumerName)

	out, err := exec.Command("powershell", "-NoProfile", "-Command", ps).CombinedOutput()
	if err != nil {
		session.LogError(i18n.Tr("error_generic", fmt.Errorf("%s: %w, %s: %s", i18n.GetText("powershell_exec_failed"), err, i18n.GetText("command_output"), strings.TrimSpace(string(out)))))
	}
	result := string(out)

	var output strings.Builder
	successCount := 0
	for _, line := range strings.Split(result, "\n") {
		line = strings.TrimSpace(line)
		if strings.HasPrefix(line, "[OK]") || strings.HasPrefix(line, "[FAIL]") {
			output.WriteString(line + "\n")
		}
		if strings.HasPrefix(line, "[OK]") {
			successCount++
		}
	}

	if successCount > 0 {
		session.LogSuccess(i18n.Tr("winwmi_success", successCount))
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Install PowerShell (pwsh/powershell) or run from a Windows host with it on PATH
2. Run the tool elevated (Administrator) — WMI permanent events need admin
3. Relax execution policy / exclusions if policy blocks the command
4. Inspect command_output in the error message for the specific PS error

Example fix

// before
out, err := exec.Command("powershell", "-NoProfile", "-Command", ps).CombinedOutput()
// after (prefer pwsh when available)
shell := "powershell"
if _, lookErr := exec.LookPath("pwsh"); lookErr == nil { shell = "pwsh" }
out, err := exec.Command(shell, "-NoProfile", "-Command", ps).CombinedOutput()

if _, err := exec.LookPath("powershell"); err != nil {
    return fmt.Errorf("powershell not on PATH: %w", err)
}

out, err := exec.Command("powershell", "-NoProfile", "-Command", ps).CombinedOutput()
if err != nil {
    log.Printf("powershell failed: %v; output: %s", err, string(out))
}

When it happens

Trigger: powershell is not on PATH, script execution is blocked by policy/AppLocker, the WMI namespace/principal privileges are insufficient, or the process fails to start for any reason, causing exec.Command(...).CombinedOutput() to return err != nil.

Common situations: Running on Linux/macOS where powershell is missing, PowerShell restricted by execution policy or AMSI, missing admin rights to create WMI __EventFilter/ActiveScriptEventConsumer, or output containing an error string the parser does not expect.

Related errors

• local_pe_not_specified
• local_pe_not_found

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/54e9e581554591c3. Report an issue: GitHub.