@echo off REM ######################################################################## REM windows-data-collection.bat - collects ST&E relevant data REM Jeff A. Odegard, CISSP 15 May 13 REM REM ######################################################################## HOSTNAME >HOSTNAME.txt for /F "eol=; tokens=1* delims= " %%i in (HOSTNAME.txt) do @set HOSTNAME=%%i set OUTDIR=C:\temp\%HOSTNAME% mkdir %OUTDIR% >nul 2>&1 set originaldir=%cd% echo. echo Results will be in %OUTDIR% echo. echo Admin privilege required. Checking access net session >nul 2>&1 if %errorlevel% NEQ 0 ( echo. echo. ERROR: Script must run with administrative privileges! goto end_of_script ) echo. - Success echo. set VERSION="0.1, 15 May 13" echo. | date /t >C:\temp\%HOSTNAME%\date.txt echo. | time /t >C:\temp\%HOSTNAME%\time.txt set dt= set tm= for /F "eol=; tokens=* delims= " %%i in (C:\temp\%HOSTNAME%\date.txt) do @set dt=%%i for /F "eol=; tokens=5 delims= " %%i in (C:\temp\%HOSTNAME%\time.txt) do @set tm=%%i rem This is the way you do string substitution in Batch... set dt=%dt:/=-% set dt=%dt: =% REM set tm=%tm =% REM set tm=%tm: =% del /F C:\temp\%HOSTNAME%\date.txt C:\temp\%HOSTNAME%\time.txt HOSTNAME.txt set OUTBASE=%HOSTNAME%.txt set SUMMARYFILE=%OUTDIR%\%HOSTNAME%-data-collection-summary-%dt%.txt set CHECKSUMS=%OUTDIR%\%HOSTNAME%-checksums-%dt%.txt setlocal enableextensions enabledelayedexpansion REM ######################################################################## REM Data Gathering Starts Here REM ######################################################################## del /f /q c:\temp\%HOSTNAME%\* echo User List | tee.cmd %SUMMARYFILE% wmic useraccount get name,sid 2>&1 > %OUTDIR%\user_list.txt echo Windows Registry Permissions REM This produces a 60Meg file. Need to modify to only pull perms required for STIG echo * DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv >> %SUMMARYFILE% echo * dumpsec.exe HKEY_LOCAL_MACHINE to HKLM-permissions.csv DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv echo * DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv >> %SUMMARYFILE% echo * dumpsec.exe HKEY_USERS to HKU-permissions.csv DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv echo. echo * 1.006, net localgroup "Administrators" | tee.cmd %OUTDIR%\admin_group.txt echo -- net localgroup "Administrators" | tee.cmd %SUMMARYFILE% net localgroup "Administrators" > %OUTDIR%\admin_group.txt echo. echo * 1.007, Backup Operators Group | tee.cmd %OUTDIR%\backup_group.txt echo -- net localgroup "Backup Operators" | tee.cmd %SUMMARYFILE% net localgroup "Backup Operators" > %OUTDIR%\backup_group.txt echo. echo * 2.001, Log File Permissions | tee.cmd %OUTDIR%\log_permissions.txt echo -- icacls C:\Windows\System32\winevt\Logs\Application.evtx | tee.cmd %SUMMARYFILE% icacls C:\Windows\System32\winevt\Logs\Application.evtx > %OUTDIR%\log_permissions.txt echo -- icacls C:\Windows\System32\winevt\Logs\Security.evtx | tee.cmd %SUMMARYFILE% icacls C:\Windows\System32\winevt\Logs\Security.evtx >> %OUTDIR%\log_permissions.txt echo -- icacls C:\Windows\System32\winevt\Logs\System.evtx | tee.cmd %SUMMARYFILE% icacls C:\Windows\System32\winevt\Logs\System.evtx >> %OUTDIR%\log_permissions.txt echo. echo * 2.008 NTFS Requirement | tee.cmd %OUTDIR%\disk_partitions.txt echo list volume > listvol.scr echo -- diskpart /s listvol.scr | tee.cmd %SUMMARYFILE% diskpart /s listvol.scr > %OUTDIR%\disk_partitions.txt del listvol.scr echo * 2.015 File Share ACLs | tee.cmd %OUTDIR%\net_shares.txt echo -- net share | tee.cmd %SUMMARYFILE% net share > %OUTDIR%\net_shares.txt for /F "eol=; tokens=1 delims= " %%i in (%OUTDIR%\net_shares.txt) do ( set mytest=foo if %%i == "2.015" set mytest=bar if "%%i" == "Share" set mytest=bar if "%%i" == "The" set mytest=bar if "%%i" == "-------------------------------------------------------------------------------" set mytest=bar if '%%i' == '*' set mytest =bar if "!mytest!"=="foo" ( echo. - Permissions for %%i echo - net share %%i >> %SUMMARYFILE% net share %%i >> %OUTDIR%\net_shares.txt 2>&1 ) ) echo. echo * 2.005, Unsupported Service Packs | tee.cmd %OUTDIR%\os_info.txt echo -- systeminfo OS Name, Version, Type, Domain, Logon Server | tee.cmd %SUMMARYFILE% systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Logon Server" > %OUTDIR%\os_info.txt echo. echo * 2.019 Security Related Software Patches | tee.cmd %OUTDIR%\hotfixes.txt echo -- wmic /output:hotfixes.txt qfe list | tee.cmd %SUMMARYFILE% wmic qfe list > %OUTDIR%\hotfixes.txt echo. echo * 2.021, Software Certificate Installation Files | tee.cmd %OUTDIR%\certificates.txt echo -- dir /s /b *.p12 *.pfs (C:\) | tee.cmd %SUMMARYFILE% cd C:\ dir /s /b *.p12 *.pfs > %OUTDIR%\certificates.txt cd %originaldir% echo. REM Miscellaneous info echo Miscellaneous Information | tee.cmd %SUMMARYFILE% echo * tasklist.exe - process list | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\tasklist.txt echo -- tasklist.exe | tee.cmd %SUMMARYFILE% tasklist.exe > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * net.exe start - Running Windows Services | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\net-start.txt echo -- net.exe start | tee.cmd %SUMMARYFILE% net.exe start > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * tasklist /svc - Services Associated with Processes | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\tasklist-svc.txt echo -- tasklist.exe /svc | tee.cmd %SUMMARYFILE% tasklist.exe /svc > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * wmic process list full - detailed process information | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\wmic-process-list-full.txt echo -- wmic.exe process list full | tee.cmd %SUMMARYFILE% wmic.exe process list full > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * wmic startup list full - List all startup tasks | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\wmic-startup-list-full.txt echo -- wmic.exe startup list full | tee.cmd %SUMMARYFILE% wmic.exe startup list full > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * reg query - list contents of startup registry keys | tee.cmd %SUMMARYFILE% echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run >> %SUMMARYFILE% set OUTFILE=%OUTDIR%\reg-query-Run.txt echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run | tee.cmd %SUMMARYFILE% reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>&1 > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\reg-query-Runonce.txt echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE% reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce 2>&1 > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\reg-query-Runonce-Ex.txt echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE% reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx 2>&1 > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * netstat -naob - list network services, connections and processes | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\netstat-naob.txt echo -- netstat -naob | tee.cmd %SUMMARYFILE% netstat -naob > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * nbtstat -S - record active NetBIOS connections | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\nbtstat-S.txt echo -- nbtstat -S | tee.cmd %SUMMARYFILE% nbtstat -S > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * nbtstat -c - record cached NetBIOS connections | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\nbtstat-c.txt echo -- nbtstat -c | tee.cmd %SUMMARYFILE% nbtstat -c > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * arp -a - record Arp Table | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\arp-a.txt echo -- arp -a | tee.cmd %SUMMARYFILE% arp -a > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * ipconfig /all - List all network devices | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\ipconfig-all.txt echo -- ipconfig /all | tee.cmd %SUMMARYFILE% ipconfig /all > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * net view \\127.0.0.1 - list file shares | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\file-shares.txt echo -- net view \\127.0.0.1 | tee.cmd %SUMMARYFILE% net view \\127.0.0.1 > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * net sessions - list open NetBIOS sessions | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\net-sessions.txt echo -- net sessions | tee.cmd %SUMMARYFILE% net sessions > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * netsh firewall show config - display firewall configuration | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\netsh-firewall-show-config.txt echo -- netsh firewall show config | tee.cmd %SUMMARYFILE% netsh firewall show config > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * net user - list system users | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\system-users.txt echo -- net user | tee.cmd %SUMMARYFILE% net user > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * net localgroup administrators - list local system administrator accounts | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\local-administrators.txt echo -- net localgroup administrator | tee.cmd %SUMMARYFILE% net localgroup administrators > %OUTFILE% fciv.exe -both "%OUTFILE%" >> %CHECKSUMS% echo * Installed Software | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\installed-software.csv echo -- wmic product get name,version /format:csv | tee.cmd %SUMMARYFILE% wmic product get name,version /format:csv > %OUTFILE% echo * Query the registry for values | tee.cmd %SUMMARYFILE% for /F "eol=; tokens=1,2 delims=," %%i in (reg-values-to-check.txt) do ( echo - reg query "%%i" | tee.cmd %SUMMARYFILE% if "%%j" NEQ "" ( if "%%j" EQU "(Default)" (reg query "%%i" /v 2>&1 >> %OUTDIR%\registry-values.txt ) else (reg query "%%i" /v "%%j" 2>&1 >> %OUTDIR%\registry-values.txt) ) else (reg query "%%i" 2>&1 >> %OUTDIR%\registry-values.txt) ) echo * Gather file version information | tee.cmd %SUMMARYFILE% for /F "eol=; tokens=* delims= " %%i in (files-to-version.txt) do ( echo -- filever.vbs %%i | tee.cmd %SUMMARYFILE% cscript -nologo "%originaldir%\filever.vbs" "%%i" >> %OUTDIR%\file-version-results.txt ) echo * Gather auditing information | tee.cmd %SUMMARYFILE% set OUTFILE=%OUTDIR%\audit_information.csv echo -- auditpol /get /category:* /r auditpol /get /category:* /r > %OUTFILE% echo * Gather Security Policy Information | tee.cmd %SUMMARYFILE% echo -- secedit /export /cfg security_policy.inf /areas SECURITYPOLICY secedit /export /cfg %OUTDIR%\security_policy.inf /areas SECURITYPOLICY /quiet REM Do this last, so they can save off the policy, zip everything up and finish the script. REM echo Security Policy Checks | tee.cmd %SUMMARYFILE% REM echo gpedit.msc will open. REM echo Expand: Computer Configuration REM echo - Windows Settings REM echo -- Security Settings REM echo --- Local Policies REM echo. REM echo * Audit Policy - single click, right click - export list, REM echo -- save as audit_policy.txt REM echo * User Rights - single click, right click - export list, REM echo -- save as user_rights.txt REM echo * Security Options - single click, right click - export list, REM echo -- save as security_options.txt REM echo * Under Account Policies, save Password Policies and Account Lockout Policies REM echo -- save as password_policy.txt REM echo -- save as account_policy.txt REM echo. REM echo Close the Policy editor when you're finished. REM echo * gpedit.msc | tee.cmd %SUMMARYFILE% REM gpedit.msc REM echo. REM ######################################################################## REM End Data Gathering REM ######################################################################## echo Windows data collection complete. Normality has been restored... REM echo Zip and copy %OUTDIR% to the PTL for further analysis. REM dir %OUTDIR% REM PAUSE 7z u -y -tzip DataCollection.zip %OUTDIR% cd %originaldir% :end_of_script cd !originaldir!