Friday, February 26, 2010

First Python Script - Simple Windows Query Tool

Decided to take up Python based on rave reviews from all the programmers I work with. For my first go at it, I wrote a simple little program that will remotely grab information off of remote Windows machines as part of investigations. This was written in Python 3.x so I can't guarantee compatibility with Python 2.x.

The program makes calls to the PSTools suite as well as Nmap so make sure that both are installed and listed in your environmental variable path.

When run, the program will scan the remote target using Nmap looking for well known Windows ports. If it sees the remote workstation online, it will continue to grab a wealth of information from the target and store that information into individual text files.

"""
HostQuery.py
Author: Skid Rock 02.26.2010
Target Users: Individuals Conducting Windows Machine Investigations
Target System: Remote Windows Workstations
Syntax: HostQuery.py <enter>
"""

version = 0.1

import sys,os,string,time

machine = input('\nPlease Enter Workstation IP Address:')
os.system("nmap -sS " + machine + " -p 135,139,445 > scan.txt")

for line in open("scan.txt"):
if "Host is up" in line:
print ("\nHost " + machine + " appears to be online, grabbing information...\n")
os.system("psinfo -sc \\\\" + machine + " >" + machine + ".info.txt")
os.system("pslist \\\\" + machine + " >" + machine + ".list.txt")
os.system("psloggedon \\\\" + machine + " >" + machine + ".loggedon.txt")
os.system("psfile \\\\" + machine + " >" + machine + ".file.txt")
os.system("psloglist \\\\" + machine + " -d 7 -s Security >" + machine + ".eventlog.txt")
os.system("psexec \\\\" + machine + " netstat -bnv >" + machine + ".netstat.txt")
print ("\n\nCommand Completed Successfully...\n")
exit
else:
if "Host seems down." in line:
print ("\n\nHost " + machine + " appears down, or is not a Windows based OS, exiting...\n")
exit

No comments:

Post a Comment