Skip to content

Commit 39ba11d

Browse files
book4yibook4yi
authored
Add files via upload
1 parent c1f9723 commit 39ba11d

File tree

1 file changed

+259
-0
lines changed

1 file changed

+259
-0
lines changed

‎Winscan.bat

+259
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
@echo off
2+
color 0f
3+
::call:colorys调用底部:colorys
4+
::02为颜色设置，0指定输出文字背景颜色，2指定文字颜色
5+
::输出不能包含符号 / : ? * " > < | \
6+
cd %~dp0
7+
for /f "delims=" %%A in ('dir /s /b %WINDIR%\system32\*htable.xsl') do set "var=%%A"
8+
if not exist ./eventlog/ (md eventlog)
9+
if not exist ./schtasks/ (md schtasks)
10+
if not exist ./Prefetch/ (md Prefetch)
11+
if not exist ./hive/ (md hive)
12+
if not exist ./CryptnetURLCache/ (md CryptnetURLCache)
13+
if exist out.html (del out.html)
14+
::reg query HKLM\SAM\SAM\Domains\Account\Users\Names
15+
call:colorys 0A "[+] 正在查询系统相关信息："
16+
@echo.
17+
wmic OS get Caption,CSDVersion,OSArchitecture,Version
18+
wmic computersystem list brief
19+
call:colorys 0A "[+] 正在查询系统补丁情况，并写入文件："
20+
wmic qfe get Description,HotFixID,InstalledOn /format:"%var%" >> out.html
21+
@echo.
22+
call:colorys 0A "[+] 正在查询系统账户和用户组，并写入文件："
23+
@echo.
24+
wmic UserAccount get name,description,sid,disabled
25+
wmic UserAccount get Description,Disabled,LocalAccount,Lockout,Name,PasswordChangeable,PasswordExpires,PasswordRequired,SID,Status /format:"%var%" >> out.html
26+
wmic group get Description,Domain,Name,SID,Status /format:"%var%" >> out.html
27+
wmic volume get Label,DeviceID,DriveLetter,FileSystem,FreeSpace /format:"%var%" >> out.html
28+
call:colorys 0A "[+] 正在检查域密码策略："
29+
@echo.
30+
Net accounts /domain
31+
@echo.
32+
call:colorys 0A "[+] 检查管理员组："
33+
@echo.
34+
net localgroup administrators
35+
net group "domain admins" /domain
36+
@echo.
37+
call:colorys 0A "[+] 检查用户上次登录时间："
38+
@echo.
39+
wmic netlogin get name,lastlogon,badpasswordcount
40+
call:colorys 0A "[+] 检查重要的注册表项："
41+
@echo.
42+
::SSP
43+
reg query hklm\system\currentcontrolset\control\lsa /v "Security Packages"
44+
::WDigest，1代表开启，0代表明文密码不会出现在内存中
45+
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential
46+
@echo.
47+
call:colorys 0A "[+] 检查RDP保存的凭证："
48+
@echo.
49+
reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers" /s
50+
reg query "HKCU\Software\Microsoft\Terminal Server Client\Servers" /s > rdp_certificate.txt
51+
call:colorys 0A "[+] 检查是否开启远程桌面服务："
52+
::开启则返回0x00
53+
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
54+
call:colorys 0A "[+] 检查本机共享列表，并写入文件："
55+
net share
56+
Wmic share get name,path,status /format:"%var%" >> out.html
57+
call:colorys 0A "[+] 检查系统启动信息，并写入文件："
58+
@echo.
59+
wmic startup get command,caption,Location,User
60+
wmic startup get command,caption,Location,User /format:"%var%" >> out.html
61+
@echo.
62+
call:colorys 0A "[+] 检查已安装反病毒软件："
63+
@echo.
64+
wmic /namespace:\\root\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe
65+
@echo.
66+
call:colorys 0A "[+] 检查防火墙配置，并写入文件："
67+
netsh firewall show config
68+
netsh firewall show config > firewall_config.txt
69+
@echo.
70+
call:colorys 0A "[+] 检查Defender检测到的活动和过去的恶意软件威胁："
71+
@echo.
72+
powershell Get-MpThreatDetection
73+
call:colorys 0A "[+] 正在拷贝防火墙日志和evtx："
74+
@echo.
75+
if exist %windir%\system32\logfiles\firewall\pfirewall.log (copy /Y %windir%\system32\logfiles\firewall\pfirewall.log)
76+
copy /Y "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%%4Operational.evtx" .\eventlog\
77+
@echo.
78+
call:colorys 0A "[+] 检查已安装软件，并写入文件："
79+
@echo.
80+
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayName | findstr DisplayName
81+
wmic PRODUCT get Description,InstallDate,InstallLocation,Vendor,Version /format:"%var%" >> out.html
82+
@echo.
83+
call:colorys 0A "[+] 检查计划任务，拷贝日志和计划任务文件"
84+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"
85+
schtasks /query /fo LIST /v > .\schtasks\schtasks.txt
86+
for %%i in (C:\Windows\System32\Tasks\*) do copy /Y %%i schtasks\
87+
::for %%i in (C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskSche*) do copy /Y %%i schtasks\
88+
copy /Y C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%%4Operational.evtx .\eventlog\
89+
copy /Y C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%%4Security.evtx .\eventlog\
90+
@echo.
91+
call:colorys 0A "[+] 检查服务状态，并写入文件："
92+
powershell Get-Service
93+
powershell $aa="gwmi win32_service | ft -Property Name, DisplayName, PathName, User, State > service.txt";$aa
94+
wmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName /format:"%var%" >> out.html
95+
call:colorys 0A "[+] 检查自启动服务："
96+
@echo.
97+
::RunSrvicese:win7、win10、2012
98+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
99+
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
100+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
101+
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
102+
reg query HKCU\SOFTWARE\Microsoft\Windows\Currention\RunOnce
103+
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceVers
104+
@echo.
105+
call:colorys 0A "[+] 检查自启动目录："
106+
@echo.
107+
dir /a "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
108+
dir /a "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
109+
dir /a "%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup"
110+
@echo.
111+
call:colorys 0A "[+] 检查注册表启动项，写入文件中："
112+
@echo.
113+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\run >qidong.txt
114+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce >>qidong.txt
115+
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>qidong.txt
116+
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce >>qidong.txt
117+
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run >>qidong.txt
118+
reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce >>qidong.txt
119+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run >>qidong.txt
120+
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run >>qidong.txt
121+
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartMenu >>qidong.txt
122+
reg query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load >>qidong.txt
123+
@echo.
124+
call:colorys 0A "[+] 检查网络连接（ipc$ 命名管道连接），并写入文件："
125+
@echo.
126+
net use
127+
wmic netuse get ConnectionState,Description,DisplayType,LocalName,Name,Persistent,RemoteName,ResourceType,Status,UserName /format:"%var%" >> out.html
128+
call:colorys 0A "[+] 检查是否启用Windows剪切板历史记录：(0x1代表启用，适用Win10）："
129+
@echo.
130+
reg query HKEY_CURRENT_USER\Software\Microsoft\Clipboard /v EnableClipboardHistory
131+
@echo.
132+
call:colorys 0A "[+] 检查用户登录初始化、管理员自动登录："
133+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
134+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
135+
call:colorys 0A "[+] 检查Logon Scripts:"
136+
reg query HKCU\Environment /v UserInitMprLogonScript
137+
@echo.
138+
call:colorys 0A "[+] 检查屏幕保护程序："
139+
reg query "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE
140+
@echo.
141+
call:colorys 0A "[+] 检查AppInit_DLLs："
142+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
143+
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
144+
call:colorys 0A "[+] 检查COM劫持，并写入文件："
145+
::通过修改注册表键值，使特定的clsid指向恶意的dll，程序运行时就会加载恶意的dll
146+
reg query HKCU\Software\Classes\CLSID /s /t REG_SZ > 32os_32pe_and_64os_64pe.txt
147+
reg query HKCU\Software\Classes\Wow6432Node\CLSID /s /t REG_SZ > x86OS_x64pe.txt
148+
@echo.
149+
call:colorys 0A "[+] 检查shim数据库是否被劫持："
150+
@echo.
151+
::主要解决应用兼容性问题的解决方法，执行被劫持的程序时自动加载数据库中恶意模块（dll，shellcode等）
152+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom"
153+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" /s
154+
dir /a /b C:\Windows\AppPatch\Custom
155+
dir /a /b C:\Windows\AppPatch\Custom\Custom64
156+
@echo.
157+
call:colorys 0A "[+] 检查进程注入："
158+
@echo.
159+
reg query "HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls"
160+
@echo.
161+
call:colorys 0A "[+] 检查exe文件启动相关注册表："
162+
reg query HKLM\software\classes\exefile\shell\open\command
163+
call:colorys 0A "[+] 检查Lsa，用于hash传递攻击："
164+
reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin
165+
call:colorys 0A "[+] 检查映像劫持："
166+
rem 适用于windows 2008/win7
167+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" -s -f ".exe" -v Debugger
168+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /f ".exe" /v GlobalFlag
169+
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit"
170+
@echo.
171+
call:colorys 0A "[+] 查询接受最终用户许可协议的程序："
172+
reg query HKCU\Software\SysInternals
173+
@echo.
174+
call:colorys 0A "[+] 查询安全模式启动相关注册表："
175+
@echo.
176+
reg query HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /v AlternateShell
177+
call:colorys 0A "[+] 查询powershell命令记录，拷贝中："
178+
@echo.
179+
::适用于powershell高版本
180+
if exist %appdata%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt type %appdata%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
181+
copy /Y C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%%4Operational.evtx .\eventlog\
182+
@echo.
183+
call:colorys 0A "[+] 检查IE浏览器记录："
184+
reg query "HKCU\SOFTWARE\Microsoft\Internet Explorer\TypedURLs"
185+
call:colorys 0A "[+] 检查CryptnetURLCache，查看certutil下载记录："
186+
::利用工具：CryptnetURLCacheParser
187+
@echo.
188+
if exist C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache (xcopy /s /q /h /o /y C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache .\CryptnetUrlCache\)
189+
if exist C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache (xcopy /s /q /h /o /y C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache .\CryptnetUrlCache\)
190+
if exist %USERPROFILE%\AppData\LocalLow\Microsoft\CryptnetUrlCache (xcopy /s /q /h /o /y %USERPROFILE%\AppData\LocalLow\Microsoft\CryptnetUrlCache .\CryptnetUrlCache\ )
191+
@echo.
192+
call:colorys 0A "[+] 检查最近访问的文件，写入文件中："
193+
@echo.
194+
dir /a %AppData%\Microsoft\Windows\Recent > Recent.txt
195+
if exist "%SYSTEMROOT%\Documents and Settings\%USERPROFILE%\Recent\" (dir /a %SYSTEMROOT%\Documents and Settings\%USERPROFILE%\Recent\ >>Recent.txt)
196+
dir /a %USERPROFILE%\AppData\Roaming\Microsoft\Office\Recent\ >>Recent.txt
197+
@echo.
198+
call:colorys 0A "[+] 检查"我的电脑、此电脑、计算机"的任意文件夹地址栏内的历史记录："
199+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
200+
call:colorys 0A "[+] 检查【运行】的历史记录："
201+
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
202+
call:colorys 0A "[+] 检查网络连接情况，并写入文件："
203+
@echo.
204+
netstat -anob | findstr ESTABLISHED
205+
::适用于Win10，Win7不适用
206+
powershell $aa="Get-NetTCPConnection | select LocalAddress,localport,remoteaddress,remoteport,state,@{name=\"process\";Expression={(get-process -id $_.OwningProcess).ProcessName}}, @{Name=\"cmdline\";Expression={(Get-WmiObject Win32_Process -filter \"ProcessId = $($_.OwningProcess)\").commandline}} | sort Remoteaddress -Descending | ft -wrap -autosize > network_tcp.txt";$aa
207+
@echo.
208+
call:colorys 0A "[+] 检查DNS缓存记录，并写入文件中："
209+
::适用win10，win7不适用
210+
@echo.
211+
powershell $aa="Get-DnsClientCache |ft -wrap -autosize";$aa
212+
ipconfig /displaydns > dns_cache.txt
213+
call:colorys 0A "[+] 检查进程，写入文件中："
214+
wmic process get name,ParentProcessId,processid,executablepath,CreationDate,commandline /format:"%var%" >> out.html
215+
wmic process get name,parentprocessid,processid,executablepath,CreationDate,commandline /format:csv > process.csv
216+
powershell $aa="gwmi win32_process | Select Name, ProcessID, @{n='Owner';e={$_.GetOwner().User}},CommandLine | ft -wrap -autosize > process_ps.txt";$aa
217+
@echo.
218+
call:colorys 0A "[+] 调查取证——导出SAM、SECURITY、SYSTEM（记录系统运行的可执行文件的完整路径和最后的执行日期）："
219+
::可用Registry Explorer对SYSTEM文件进行分析，AppCompatCache记录程序的修改时间，一定程度上可以确定程序的最迟运行时间
220+
@echo.
221+
reg save hklm\system .\hive\SYSTEM /Y
222+
reg save hklm\sam .\hive\SAM /Y
223+
reg save hklm\security .\hive\SECURITY /Y
224+
call:colorys 0A "[+] 调查取证——收集 Sysmon 日志："
225+
if exist C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%%4Operational.evtx (copy /Y "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%%4Operational.evtx" .\eventlog\)
226+
call:colorys 0A "[+] 调查取证——检查BAM（记录系统运行的可执行文件的完整路径和最后的执行日期，适用于Win10），写入文件中："
227+
@echo.
228+
reg query "HKLM\SYSTEM\CurrentControlSet\Services\bam\state\UserSettings" /s > BAM.txt
229+
call:colorys 0A "[+] 调查取证——SRUM (System Resource Usage Monitor)，拷贝中："
230+
if exist C:\Windows\System32\sru\SRUDB.dat (copy /Y C:\Windows\System32\sru\SRUDB.dat)
231+
@echo.
232+
call:colorys 0A "[+] 调查取证——MUICache (从exe文件的版本资源中提取应用程序名、公司名)，写入文件中："
233+
reg query "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" > MuiCache.txt
234+
@echo.
235+
call:colorys 0A "[+] 调查取证——ShimCache (跟踪文件路径、上次修改时间和是否被执行)，注册表导出中："
236+
@echo.
237+
reg export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" ShimCache.reg /Y
238+
call:colorys 0A "[+] 调查取证——Prefetch (会保存文件第一次和最后一次运行日期、路径和执行次数等信息)，拷贝中"
239+
@echo.
240+
::for %%i in (C:\Windows\Prefetch\*) do copy /Y %%i Prefetch\
241+
xcopy /s /q /h /o /y C:\Windows\Prefetch .\Prefetch\
242+
call:colorys 0A "[+] 检查系统日志是否有开启："
243+
reg query HKLM\SYSTEM\CurrentControlSet\services\eventlog
244+
call:colorys 0A "[+] 正在导出系统日志："
245+
if exist .\eventlog\system.evtx (del .\eventlog\system.evtx)
246+
wevtutil epl System .\eventlog\system.evtx
247+
if exist .\eventlog\Application.evtx (del .\eventlog\Application.evtx)
248+
wevtutil epl Application .\eventlog\Application.evtx
249+
if exist .\eventlog\Security.evtx (del .\eventlog\Security.evtx)
250+
wevtutil epl Security .\eventlog\Security.evtx
251+
rem 远程桌面日志，筛选1149
252+
if exist .\eventlog\TerminalServices.evtx (del .\eventlog\TerminalServices.evtx)
253+
wevtutil epl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational .\eventlog\TerminalServices.evtx
254+
@echo.
255+
pause
256+
::把以下代码放到批处理底部用call调用
257+
:colorys
258+
pushd %tmp%&echo CCAICCAI>%2-&certutil /f /decode %2- %2- 1>nul 2>nul
259+
findstr /a:%1 . %2- \ 2>nul&del /q /f %2- 1>nul 2>nul&popd&exit /b

0 commit comments

Comments
 (0)