Question

Ok, so I’m not super familiar with using For /F. I can modify it if the file is static and has a set ammount of lines that i can skip and then pull data from. I’m currently trying to modify an .XML file. The file will have varying ammounts of lines, but will always have the following

</SyncWindow>
</AutoSyncWindows>
<SyncServiceConnections />
<DaysToRetainRecordedData>90</DaysToRetainRecordedData>
<SyncRestartRequired>false</SyncRestartRequired>
- <LastGroupsSynced>

The value for <DaysToRetainRecordedData>90</DaysToRetainRecordedData> may differ, for example <DaysToRetainRecordedData>30</DaysToRetainRecordedData>

Using tokens, what would be the most efficient way to search that .XML file for that line and overwrite it with the following <DaysToRetainRecordedData>0</DaysToRetainRecordedData>

I can not overwrite the entire .XML file as they have unique server keys that will vary from machine to machine.So I need to be able to find that line and edit the value to 0.
Any thoughts? If For /F is not the most efficient way to go, I can move to VBS if need be. But it would have to be called from pure shellcode and would make things a bit more complex.

Answer 1

The most elegant, flexible and safe way to do this would be to download msxsl.exe and then use a tiny XSLT stylesheet to modify only the value you want in the XML:

<!-- DaysToRetainRecordedData.xsl -->
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:param name="newValue" select="0" />

  <!-- this template copies your input XML unchanged -->
  <xsl:template match="node()|@*">
    <xsl:copy>
      <xsl:apply-templates select="node()|@*" />
    </xsl:copy>
  </xsl:template>

  <!-- this template changes one single value -->
  <xsl:template match="DaysToRetainRecordedData/text()">
    <xsl:value-of select="$newValue" />
  </xsl:template>
</xsl:stylesheet>

Call that on the command line with:

msxsl.exe input.xml DaysToRetainRecordedData.xsl –o output.xml newValue=0

The command line parameter newValue will show up in the XSL program.