From 43f99beca74eb8fcfe74441b461ae074c3761eff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Wed, 19 Feb 2020 08:46:01 +0100 Subject: [PATCH] Update --- GPOZaurr.psd1 | 7 +- {Public => Private}/Invoke-GPOZaurr.ps1 | 0 Public/Get-GPOZaurr.ps1 | 7 +- Public/Get-GPOZaurrPassword.ps1 | 119 ++++++++++++------------ Public/Save-GPOZaurrFiles.ps1 | 4 +- 5 files changed, 70 insertions(+), 67 deletions(-) rename {Public => Private}/Invoke-GPOZaurr.ps1 (100%) diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 5a54783..30ff47a 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -3,7 +3,7 @@ # # Generated by: Przemyslaw Klys # -# Generated on: 17.02.2020 +# Generated on: 19.02.2020 # @{ @@ -12,7 +12,7 @@ RootModule = 'GPOZaurr.psm1' # Version number of this module. - ModuleVersion = '0.0.2' + ModuleVersion = '0.0.3' # Supported PSEditions CompatiblePSEditions = 'Desktop' @@ -69,8 +69,7 @@ # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. - FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Invoke-GPOZaurr', - 'Save-GPOZaurrFiles' + FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Save-GPOZaurrFiles' # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() diff --git a/Public/Invoke-GPOZaurr.ps1 b/Private/Invoke-GPOZaurr.ps1 similarity index 100% rename from Public/Invoke-GPOZaurr.ps1 rename to Private/Invoke-GPOZaurr.ps1 diff --git a/Public/Get-GPOZaurr.ps1 b/Public/Get-GPOZaurr.ps1 index 5f483e8..8d99e57 100644 --- a/Public/Get-GPOZaurr.ps1 +++ b/Public/Get-GPOZaurr.ps1 @@ -7,7 +7,6 @@ [System.Collections.IDictionary] $ExtendedForestInformation, [string[]] $GPOPath ) - if (-not $GPOPath) { if (-not $ExtendedForestInformation) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains @@ -16,9 +15,9 @@ } foreach ($Domain in $ForestInformation.Domains) { - Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object { - $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent + Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { + $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain + Get-XMLGPO -XMLContent $XMLContent } } } else { diff --git a/Public/Get-GPOZaurrPassword.ps1 b/Public/Get-GPOZaurrPassword.ps1 index 5479c71..d8c8528 100644 --- a/Public/Get-GPOZaurrPassword.ps1 +++ b/Public/Get-GPOZaurrPassword.ps1 @@ -7,7 +7,6 @@ [System.Collections.IDictionary] $ExtendedForestInformation, [string[]] $GPOPath ) - if (-not $GPOPath) { if (-not $ExtendedForestInformation) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains @@ -19,11 +18,9 @@ -join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies') } } - if (-not $GPOPath) { return } - foreach ($Path in $GPOPath) { #Extract the all XML files in the Folders $Items = Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml @@ -54,61 +51,69 @@ [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length) #Convert Hash variable in a String valute $Password = [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock) - #[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})') - #$GPODetail = Get-GPO -guid $GPOguid - [xml] $XMLContent = $XMLString - - if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) { - Write-Host '' - } - - - [PsCustomObject] @{ - 'Name' = $XMLContent.GPO.Name - 'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath - 'Enabled' = $XMLContent.GPO.GpoStatus - #'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups - 'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name - 'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword - 'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword - 'Password' = $Password - 'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText - - 'Domain' = $XMLContent.GPO.Identifier.Domain - - 'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true } - 'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } - 'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled - 'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false } - 'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension - - 'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true } - 'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled - 'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } - 'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false } - 'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension - - - 'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime - 'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime - 'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime - - 'WMIFilter' = $GPO.WmiFilter.name - 'WMIFilterDescription' = $GPO.WmiFilter.Description - 'Path' = $GPO.Path - #'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } - 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { - [PSCustomObject] @{ - 'User' = $_.trustee.name.'#Text' - 'Permission Type' = $_.type.PermissionType - 'Inherited' = $_.Inherited - 'Permissions' = $_.Standard.GPOGroupedAccessEnum - } - } - - } - #Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName + } else { + $Password = '' } + #[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})') + #$GPODetail = Get-GPO -guid $GPOguid + [xml] $XMLContent = $XMLString + + #if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) { + #Write-Host '' + #} + if ($Password) { + $PasswordStatus = $true + } else { + $PasswordStatus = $false + } + + [PsCustomObject] @{ + 'Name' = $XMLContent.GPO.Name + 'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath + 'Enabled' = $XMLContent.GPO.GpoStatus + 'PasswordStatus' = $PasswordStatus + #'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups + 'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name + 'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword + 'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword + 'Password' = $Password + 'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText + + 'Domain' = $XMLContent.GPO.Identifier.Domain + + 'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true } + 'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } + 'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled + 'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false } + 'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension + + 'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true } + 'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled + 'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } + 'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false } + 'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension + + + 'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime + 'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime + 'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime + + 'WMIFilter' = $GPO.WmiFilter.name + 'WMIFilterDescription' = $GPO.WmiFilter.Description + 'Path' = $GPO.Path + #'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } + 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { + [PSCustomObject] @{ + 'User' = $_.trustee.name.'#Text' + 'Permission Type' = $_.type.PermissionType + 'Inherited' = $_.Inherited + 'Permissions' = $_.Standard.GPOGroupedAccessEnum + } + } + + } + #Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName + } #if($XMLContent.Contains("cpassword") } $Output diff --git a/Public/Save-GPOZaurrFiles.ps1 b/Public/Save-GPOZaurrFiles.ps1 index 2bdf851..4bad711 100644 --- a/Public/Save-GPOZaurrFiles.ps1 +++ b/Public/Save-GPOZaurrFiles.ps1 @@ -15,8 +15,8 @@ } $null = New-Item -ItemType Directory -Path $GPOPath -Force foreach ($Domain in $ForestInformation.Domains) { - Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object { - $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain + Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { + $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain $Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml") $XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode