Initial commit

2026-04-24 17:41:53 +08:00
commit 7105e8b165
94 changed files with 8141 additions and 0 deletions
--- a/scripts/powershell/recon.ps1
+++ b/scripts/powershell/recon.ps1
@@ -0,0 +1,91 @@
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$ErrorActionPreference = 'SilentlyContinue'
+
+function Section($title) {
+    Write-Host ''
+    Write-Host ('=' * 6) $title ('=' * 6) -ForegroundColor Cyan
+}
+
+Section 'Computer'
+Get-ComputerInfo -Property CsName,CsDomain,CsManufacturer,CsModel,
+    WindowsProductName,OsVersion,OsBuildNumber,OsArchitecture,OsInstallDate,
+    CsNumberOfProcessors,CsNumberOfLogicalProcessors,OsTotalVisibleMemorySize,
+    CsUserName,TimeZone | Format-List
+
+Section 'Boot Time'
+(Get-CimInstance Win32_OperatingSystem).LastBootUpTime
+
+Section 'Local Users'
+Get-LocalUser | Select-Object Name,Enabled,LastLogon,Description | Format-Table -AutoSize
+
+Section 'Administrators Group'
+Get-LocalGroupMember -Group Administrators |
+    Select-Object Name,ObjectClass,PrincipalSource | Format-Table -AutoSize
+
+Section 'Disks'
+Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,
+    @{n='Size(GB)';e={[math]::Round($_.Size / 1GB, 1)}},
+    @{n='Free(GB)';e={[math]::Round($_.SizeRemaining / 1GB, 1)}} |
+    Format-Table -AutoSize
+
+Section 'IPv4 Addresses'
+Get-NetIPAddress -AddressFamily IPv4 |
+    Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } |
+    Select-Object InterfaceAlias,IPAddress,PrefixLength | Format-Table -AutoSize
+
+Section 'Listening TCP Ports'
+Get-NetTCPConnection -State Listen |
+    Select-Object LocalAddress,LocalPort,OwningProcess |
+    Sort-Object LocalPort -Unique | Format-Table -AutoSize
+
+Section 'Firewall Profiles'
+Get-NetFirewallProfile |
+    Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction |
+    Format-Table -AutoSize
+
+Section 'SMB Shares'
+Get-SmbShare | Select-Object Name,Path,Description | Format-Table -AutoSize
+
+Section 'Defender'
+Get-MpComputerStatus |
+    Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,
+        AMEngineVersion,AntivirusSignatureLastUpdated | Format-List
+
+Section 'Installed Apps (non-Microsoft)'
+$uninstallPaths = @(
+    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
+    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+)
+Get-ItemProperty $uninstallPaths |
+    Where-Object { $_.DisplayName -and $_.Publisher -notmatch 'Microsoft' } |
+    Select-Object DisplayName,DisplayVersion,Publisher,InstallDate |
+    Sort-Object DisplayName | Format-Table -AutoSize
+
+Section 'Startup Commands'
+Get-CimInstance Win32_StartupCommand |
+    Select-Object Name,Command,Location,User | Format-Table -AutoSize
+
+Section 'Scheduled Tasks (non-Microsoft, enabled)'
+Get-ScheduledTask |
+    Where-Object { $_.State -ne 'Disabled' -and $_.TaskPath -notlike '\Microsoft\*' } |
+    Select-Object TaskPath,TaskName,State | Format-Table -AutoSize
+
+Section 'SSH Services'
+Get-Service sshd,ssh-agent | Format-Table Name,Status,StartType -AutoSize
+
+Section 'Recent Logons (Security 4624, last 48h)'
+Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-48)} -MaxEvents 50 |
+    ForEach-Object {
+        $xml = [xml]$_.ToXml()
+        $d = @{}
+        $xml.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
+        [pscustomobject]@{
+            Time      = $_.TimeCreated
+            LogonType = $d['LogonType']
+            User      = "$($d['TargetDomainName'])\$($d['TargetUserName'])"
+            IP        = $d['IpAddress']
+            Process   = $d['ProcessName']
+        }
+    } |
+    Where-Object { $_.User -notmatch 'SYSTEM|ANONYMOUS|LOCAL SERVICE|NETWORK SERVICE|DWM-|UMFD-|\$$' } |
+    Format-Table -AutoSize