From fed24a87b41c80843f74d0176033cf9ced9c569c Mon Sep 17 00:00:00 2001 From: 0rion <45885529+0rion5@users.noreply.github.com> Date: Thu, 17 Jan 2019 19:29:40 -0700 Subject: [PATCH] Update Info.ps1 Gets COM& Serial Device PID&VID if doing a walk about and want to collect info on HID/PID&VID + MI for future use. just a thought #Get - Com & Serial Devices $COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table "COM & SERIAL DEVICES" "==================================================================" + ($COMDevices | Out-String) "" --- payloads/library/recon/InfoGrabber/info.ps1 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/payloads/library/recon/InfoGrabber/info.ps1 b/payloads/library/recon/InfoGrabber/info.ps1 index 8ceb4e5a..ba4e2c97 100644 --- a/payloads/library/recon/InfoGrabber/info.ps1 +++ b/payloads/library/recon/InfoGrabber/info.ps1 @@ -41,6 +41,9 @@ $driveType = @{ 5="Compact disk "} $Hdds = Get-WmiObject Win32_LogicalDisk | select DeviceID, VolumeName, @{Name="DriveType";Expression={$driveType.item([int]$_.DriveType)}}, FileSystem,VolumeSerialNumber,@{Name="Size_GB";Expression={"{0:N1} GB" -f ($_.Size / 1Gb)}}, @{Name="FreeSpace_GB";Expression={"{0:N1} GB" -f ($_.FreeSpace / 1Gb)}}, @{Name="FreeSpace_percent";Expression={"{0:N1}%" -f ((100 / ($_.Size / $_.FreeSpace)))}} | Format-Table DeviceID, VolumeName,DriveType,FileSystem,VolumeSerialNumber,@{ Name="Size GB"; Expression={$_.Size_GB}; align="right"; }, @{ Name="FreeSpace GB"; Expression={$_.FreeSpace_GB}; align="right"; }, @{ Name="FreeSpace %"; Expression={$_.FreeSpace_percent}; align="right"; } +#Get - Com & Serial Devices +$COMDevices = Get-Wmiobject Win32_USBControllerDevice | ForEach-Object{[Wmi]($_.Dependent)} | Select-Object Name, DeviceID, Manufacturer | Sort-Object -Descending Name | Format-Table + # Check RDP $RDP if ((Get-ItemProperty "hklm:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections -eq 0) { @@ -148,13 +151,15 @@ $computerSystem.Name "=================================================================="+ (Get-WmiObject win32_bios| out-string) - "Local-user:" "=================================================================="+ ($luser| out-string) "HDDs:" "=================================================================="+ ($Hdds| out-string) +"COM & SERIAL DEVICES" +"==================================================================" + ($COMDevices | Out-String) + "Network: " "==================================================================" "Computers MAC address: " + $computerMAC