sagacity/exec/Target Host Tools/Windows/Windows Data Collection/windows-data-collection.bat

299 lines
13 KiB
Batchfile

@echo off
REM ########################################################################
REM windows-data-collection.bat - collects ST&E relevant data
REM Jeff A. Odegard, CISSP 15 May 13
REM
REM ########################################################################
HOSTNAME >HOSTNAME.txt
for /F "eol=; tokens=1* delims= " %%i in (HOSTNAME.txt) do @set HOSTNAME=%%i
set OUTDIR=C:\temp\%HOSTNAME%
mkdir %OUTDIR% >nul 2>&1
set originaldir=%cd%
echo.
echo Results will be in %OUTDIR%
echo.
echo Admin privilege required. Checking access
net session >nul 2>&1
if %errorlevel% NEQ 0 (
echo.
echo. ERROR: Script must run with administrative privileges!
goto end_of_script
)
echo. - Success
echo.
set VERSION="0.1, 15 May 13"
echo. | date /t >C:\temp\%HOSTNAME%\date.txt
echo. | time /t >C:\temp\%HOSTNAME%\time.txt
set dt=
set tm=
for /F "eol=; tokens=* delims= " %%i in (C:\temp\%HOSTNAME%\date.txt) do @set dt=%%i
for /F "eol=; tokens=5 delims= " %%i in (C:\temp\%HOSTNAME%\time.txt) do @set tm=%%i
rem This is the way you do string substitution in Batch...
set dt=%dt:/=-%
set dt=%dt: =%
REM set tm=%tm =%
REM set tm=%tm: =%
del /F C:\temp\%HOSTNAME%\date.txt C:\temp\%HOSTNAME%\time.txt HOSTNAME.txt
set OUTBASE=%HOSTNAME%.txt
set SUMMARYFILE=%OUTDIR%\%HOSTNAME%-data-collection-summary-%dt%.txt
set CHECKSUMS=%OUTDIR%\%HOSTNAME%-checksums-%dt%.txt
setlocal enableextensions enabledelayedexpansion
REM ########################################################################
REM Data Gathering Starts Here
REM ########################################################################
del /f /q c:\temp\%HOSTNAME%\*
echo User List | tee.cmd %SUMMARYFILE%
wmic useraccount get name,sid 2>&1 > %OUTDIR%\user_list.txt
echo Windows Registry Permissions
REM This produces a 60Meg file. Need to modify to only pull perms required for STIG
echo * DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv >> %SUMMARYFILE%
echo * dumpsec.exe HKEY_LOCAL_MACHINE to HKLM-permissions.csv
DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv
echo * DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv >> %SUMMARYFILE%
echo * dumpsec.exe HKEY_USERS to HKU-permissions.csv
DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv
echo.
echo * 1.006, net localgroup "Administrators" | tee.cmd %OUTDIR%\admin_group.txt
echo -- net localgroup "Administrators" | tee.cmd %SUMMARYFILE%
net localgroup "Administrators" > %OUTDIR%\admin_group.txt
echo.
echo * 1.007, Backup Operators Group | tee.cmd %OUTDIR%\backup_group.txt
echo -- net localgroup "Backup Operators" | tee.cmd %SUMMARYFILE%
net localgroup "Backup Operators" > %OUTDIR%\backup_group.txt
echo.
echo * 2.001, Log File Permissions | tee.cmd %OUTDIR%\log_permissions.txt
echo -- icacls C:\Windows\System32\winevt\Logs\Application.evtx | tee.cmd %SUMMARYFILE%
icacls C:\Windows\System32\winevt\Logs\Application.evtx > %OUTDIR%\log_permissions.txt
echo -- icacls C:\Windows\System32\winevt\Logs\Security.evtx | tee.cmd %SUMMARYFILE%
icacls C:\Windows\System32\winevt\Logs\Security.evtx >> %OUTDIR%\log_permissions.txt
echo -- icacls C:\Windows\System32\winevt\Logs\System.evtx | tee.cmd %SUMMARYFILE%
icacls C:\Windows\System32\winevt\Logs\System.evtx >> %OUTDIR%\log_permissions.txt
echo.
echo * 2.008 NTFS Requirement | tee.cmd %OUTDIR%\disk_partitions.txt
echo list volume > listvol.scr
echo -- diskpart /s listvol.scr | tee.cmd %SUMMARYFILE%
diskpart /s listvol.scr > %OUTDIR%\disk_partitions.txt
del listvol.scr
echo * 2.015 File Share ACLs | tee.cmd %OUTDIR%\net_shares.txt
echo -- net share | tee.cmd %SUMMARYFILE%
net share > %OUTDIR%\net_shares.txt
for /F "eol=; tokens=1 delims= " %%i in (%OUTDIR%\net_shares.txt) do (
set mytest=foo
if %%i == "2.015" set mytest=bar
if "%%i" == "Share" set mytest=bar
if "%%i" == "The" set mytest=bar
if "%%i" == "-------------------------------------------------------------------------------" set mytest=bar
if '%%i' == '*' set mytest =bar
if "!mytest!"=="foo" (
echo. - Permissions for %%i
echo - net share %%i >> %SUMMARYFILE%
net share %%i >> %OUTDIR%\net_shares.txt 2>&1
)
)
echo.
echo * 2.005, Unsupported Service Packs | tee.cmd %OUTDIR%\os_info.txt
echo -- systeminfo OS Name, Version, Type, Domain, Logon Server | tee.cmd %SUMMARYFILE%
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Logon Server" > %OUTDIR%\os_info.txt
echo.
echo * 2.019 Security Related Software Patches | tee.cmd %OUTDIR%\hotfixes.txt
echo -- wmic /output:hotfixes.txt qfe list | tee.cmd %SUMMARYFILE%
wmic qfe list > %OUTDIR%\hotfixes.txt
echo.
echo * 2.021, Software Certificate Installation Files | tee.cmd %OUTDIR%\certificates.txt
echo -- dir /s /b *.p12 *.pfs (C:\) | tee.cmd %SUMMARYFILE%
cd C:\
dir /s /b *.p12 *.pfs > %OUTDIR%\certificates.txt
cd %originaldir%
echo.
REM Miscellaneous info
echo Miscellaneous Information | tee.cmd %SUMMARYFILE%
echo * tasklist.exe - process list | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\tasklist.txt
echo -- tasklist.exe | tee.cmd %SUMMARYFILE%
tasklist.exe > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * net.exe start - Running Windows Services | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\net-start.txt
echo -- net.exe start | tee.cmd %SUMMARYFILE%
net.exe start > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * tasklist /svc - Services Associated with Processes | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\tasklist-svc.txt
echo -- tasklist.exe /svc | tee.cmd %SUMMARYFILE%
tasklist.exe /svc > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * wmic process list full - detailed process information | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\wmic-process-list-full.txt
echo -- wmic.exe process list full | tee.cmd %SUMMARYFILE%
wmic.exe process list full > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * wmic startup list full - List all startup tasks | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\wmic-startup-list-full.txt
echo -- wmic.exe startup list full | tee.cmd %SUMMARYFILE%
wmic.exe startup list full > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * reg query - list contents of startup registry keys | tee.cmd %SUMMARYFILE%
echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run >> %SUMMARYFILE%
set OUTFILE=%OUTDIR%\reg-query-Run.txt
echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run | tee.cmd %SUMMARYFILE%
reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>&1 > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\reg-query-Runonce.txt
echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE%
reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce 2>&1 > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\reg-query-Runonce-Ex.txt
echo -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE%
reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx 2>&1 > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * netstat -naob - list network services, connections and processes | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\netstat-naob.txt
echo -- netstat -naob | tee.cmd %SUMMARYFILE%
netstat -naob > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * nbtstat -S - record active NetBIOS connections | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\nbtstat-S.txt
echo -- nbtstat -S | tee.cmd %SUMMARYFILE%
nbtstat -S > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * nbtstat -c - record cached NetBIOS connections | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\nbtstat-c.txt
echo -- nbtstat -c | tee.cmd %SUMMARYFILE%
nbtstat -c > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * arp -a - record Arp Table | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\arp-a.txt
echo -- arp -a | tee.cmd %SUMMARYFILE%
arp -a > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * ipconfig /all - List all network devices | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\ipconfig-all.txt
echo -- ipconfig /all | tee.cmd %SUMMARYFILE%
ipconfig /all > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * net view \\127.0.0.1 - list file shares | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\file-shares.txt
echo -- net view \\127.0.0.1 | tee.cmd %SUMMARYFILE%
net view \\127.0.0.1 > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * net sessions - list open NetBIOS sessions | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\net-sessions.txt
echo -- net sessions | tee.cmd %SUMMARYFILE%
net sessions > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * netsh firewall show config - display firewall configuration | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\netsh-firewall-show-config.txt
echo -- netsh firewall show config | tee.cmd %SUMMARYFILE%
netsh firewall show config > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * net user - list system users | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\system-users.txt
echo -- net user | tee.cmd %SUMMARYFILE%
net user > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * net localgroup administrators - list local system administrator accounts | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\local-administrators.txt
echo -- net localgroup administrator | tee.cmd %SUMMARYFILE%
net localgroup administrators > %OUTFILE%
fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
echo * Installed Software | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\installed-software.csv
echo -- wmic product get name,version /format:csv | tee.cmd %SUMMARYFILE%
wmic product get name,version /format:csv > %OUTFILE%
echo * Query the registry for values | tee.cmd %SUMMARYFILE%
for /F "eol=; tokens=1,2 delims=," %%i in (reg-values-to-check.txt) do (
echo - reg query "%%i" | tee.cmd %SUMMARYFILE%
if "%%j" NEQ "" (
if "%%j" EQU "(Default)" (reg query "%%i" /v 2>&1 >> %OUTDIR%\registry-values.txt
) else (reg query "%%i" /v "%%j" 2>&1 >> %OUTDIR%\registry-values.txt)
) else (reg query "%%i" 2>&1 >> %OUTDIR%\registry-values.txt)
)
echo * Gather file version information | tee.cmd %SUMMARYFILE%
for /F "eol=; tokens=* delims= " %%i in (files-to-version.txt) do (
echo -- filever.vbs %%i | tee.cmd %SUMMARYFILE%
cscript -nologo "%originaldir%\filever.vbs" "%%i" >> %OUTDIR%\file-version-results.txt
)
echo * Gather auditing information | tee.cmd %SUMMARYFILE%
set OUTFILE=%OUTDIR%\audit_information.csv
echo -- auditpol /get /category:* /r
auditpol /get /category:* /r > %OUTFILE%
echo * Gather Security Policy Information | tee.cmd %SUMMARYFILE%
echo -- secedit /export /cfg security_policy.inf /areas SECURITYPOLICY
secedit /export /cfg %OUTDIR%\security_policy.inf /areas SECURITYPOLICY /quiet
REM Do this last, so they can save off the policy, zip everything up and finish the script.
REM echo Security Policy Checks | tee.cmd %SUMMARYFILE%
REM echo gpedit.msc will open.
REM echo Expand: Computer Configuration
REM echo - Windows Settings
REM echo -- Security Settings
REM echo --- Local Policies
REM echo.
REM echo * Audit Policy - single click, right click - export list,
REM echo -- save as audit_policy.txt
REM echo * User Rights - single click, right click - export list,
REM echo -- save as user_rights.txt
REM echo * Security Options - single click, right click - export list,
REM echo -- save as security_options.txt
REM echo * Under Account Policies, save Password Policies and Account Lockout Policies
REM echo -- save as password_policy.txt
REM echo -- save as account_policy.txt
REM echo.
REM echo Close the Policy editor when you're finished.
REM echo * gpedit.msc | tee.cmd %SUMMARYFILE%
REM gpedit.msc
REM echo.
REM ########################################################################
REM End Data Gathering
REM ########################################################################
echo Windows data collection complete. Normality has been restored...
REM echo Zip and copy %OUTDIR% to the PTL for further analysis.
REM dir %OUTDIR%
REM PAUSE
7z u -y -tzip DataCollection.zip %OUTDIR%
cd %originaldir%
:end_of_script
cd !originaldir!