Script to get Details From Stolen Property

Download JSON Download Python

Ratings

(0)

Release Time

05/07/2020

Downloads

1032 times

Update Time

11/20/2024

Views

1793 times

Share-it:

Tags

property comodo endpoint security

Description
Screen Shots

Note: Run as Logged in User

This script will do the Following points

1)Get IP address

2)Take Screenshot of screen and send it to email

3)Collect environment information etc etc

4)Wipe the hd clean…

Parameters:

To Email Address ## Provide the To Email address from which the mail to be send

From Email Address ## Provide the From Email address from which the mail to be send

From Email Address Password ## Provide the correct password for your from mail.

SMTP Server Address ## Provide the smtpserver. eg:smtp.gmail.com

SMTP Port ## Provide the port. eg:587

Procedure's Instructions

#To define a particular parameter, replace the 'parameterName' inside itsm.getParameter('parameterName') with that parameter's name
emailto=itsm.getParameter('EmailTo')        ## Provide the To Email address from which the mail to be send# Provide an email where want to send Screenshot.
emailfrom=itsm.getParameter('EmailFrom')    ## Provide the From Email address from which the mail to be send# Provide an email where want to send Screenshot.   
password=itsm.getParameter('Password')	    # Provide the correct password for your from mail.
smtpserver=itsm.getParameter('smtpserver')  # Provide the smtpserver.   eg:smtp.gmail.com
port=itsm.getParameter('port')              # Provide the port.   eg:587

import socket
from urllib2 import urlopen
import ctypes
from subprocess import PIPE, Popen
import os
import ctypes
import re
import random
import time

hostname = socket.gethostname()
ip_address = socket.gethostbyname(hostname)
print "Hostname: ",hostname
print "IP Address: ",ip_address
public_ip = urlopen('http://ip.42.pl/raw').read()
print "Public IP Address: ",public_ip

class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

def ecmd(command):
    with disable_file_system_redirection():
        obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
    out, err = obj.communicate()
    ret=obj.returncode
    print "retret",ret
    if ret==0:
        if out:
            return out
        else:
            return ret
    else:
        if err:
            return err.strip()
        else:
            return ret

command=r'systeminfo'
print "\n*****System Information****\n"
print ecmd(command)

file='C:\\Windows\Temp\Take-ScreenShot.ps1';
emailto='"'+emailto+'"'
emailfrom='"'+emailfrom+'"'
password='"'+password+'"'
smtpserver='"'+smtpserver+'"'
port='"'+port+'"'

input="""
#############################################################################
# Capturing a screenshot
#############################################################################
$timer = (Get-Date -Format yyy-mm-dd-hhmm)
$File = "C:\ProgramData\$env:computername-$env:username-$timer.bmp"
Add-Type -AssemblyName System.Windows.Forms
Add-type -AssemblyName System.Drawing
# Gather Screen resolution information
$Screen = [System.Windows.Forms.SystemInformation]::VirtualScreen
$Width = $Screen.Width
$Height = $Screen.Height
$Left = $Screen.Left
$Top = $Screen.Top
# Create bitmap using the top-left and bottom-right bounds
$bitmap = New-Object System.Drawing.Bitmap $Width, $Height
# Create Graphics object
$graphic = [System.Drawing.Graphics]::FromImage($bitmap)
# Capture screen
$graphic.CopyFromScreen($Left, $Top, 0, 0, $bitmap.Size)
# Save to file
$bitmap.Save($File) 
Write-Output "Screenshot saved to:"
Write-Output $File
$fileType = $file.Substring(($file.IndexOf('.'))+1) #get image file extension

function do_mail ($myhtml) {

$to = %s
$Username = %s
$Password = %s
$SMTPServer = %s
$SMTPPort = %s
$time = Get-Date

$subject = "Screenshot of $env:computername on $time"
$body = @"
<html>
<body>
<img src="cid:$env:computername-$env:username-$timer.jpg">
</body>
</html>
"@
$attachment = New-Object System.Net.Mail.Attachment -ArgumentList $filepath
$attachment.ContentDisposition.Inline = $True
$attachment.ContentDisposition.DispositionType = "Inline"
$fileType = $filepath.Substring(($filepath.IndexOf('.'))+1) #get image file extension
$attachment.ContentType.MediaType = "image/$fileType" #set mediaType based on $file extension
$attachment.ContentId = '$env:computername-$env:username-$timer.jpg'

$message = New-Object System.Net.Mail.MailMessage
$message.IsBodyHTML = $true
$message.subject = $subject
$message.body = $body
$message.to.add($to)
#$message.cc.add($cc)
$message.from = $username
$message.attachments.add($attachment)

$smtp = New-Object System.Net.Mail.SmtpClient($SMTPServer, $SMTPPort);
$smtp.EnableSSL = $true
$smtp.Credentials = New-Object System.Net.NetworkCredential($Username, $Password);
$smtp.send($message)
$attachment.Dispose();
$message.Dispose();
write-host "Email sent to $to"
#Remove-Item $filepath
}

# Try uncommenting the following line if you receive errors about a missing assembly
[void][System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")
function ConvertTo-Jpg
{
  [cmdletbinding()]
  param([Parameter(Mandatory=$true, ValueFromPipeline = $true)] $Path)

process{
    $qualityEncoder = [System.Drawing.Imaging.Encoder]::Quality
    $encoderParams = New-Object System.Drawing.Imaging.EncoderParameters(1)

# Set JPEG quality level here: 0 - 100 (inclusive bounds)
    $encoderParams.Param[0] = New-Object System.Drawing.Imaging.EncoderParameter($qualityEncoder, 50)
    $jpegCodecInfo = [System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | where {$_.MimeType -eq 'image/jpeg'}

if ($Path -is [string]) {
      $Path = get-childitem $Path
    }

$Path | foreach {
      $image = [System.Drawing.Image]::FromFile($($_.FullName))
      $filePath =  "{0}\{1}.jpg" -f $($_.DirectoryName), $($_.BaseName)
      $image.Save($filePath, $jpegCodecInfo, $encoderParams)
      $image.Dispose()
      Write-host "File converted to JPG"
      write-host $filepath

}

do_mail $myhtml

}

#Use function:
# cd to directory with png files
#cd c:\users\$env:username

#Run ConvertTo-Jpg function and send email
Get-ChildItem $file | ConvertTo-Jpg
#Remove BMP
Remove-Item $file
"""%(emailto, emailfrom, password, smtpserver, port)
fobj=open(file,"w");
fobj.write(input);
fobj.close();

class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert  = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

with disable_file_system_redirection():
    out=os.popen(r'powershell.exe -executionpolicy bypass -file C:\Windows\Temp\Take-ScreenShot.ps1').read();
    print out
	
path = os.environ['PROGRAMDATA'] +'\diskscript.txt'

ps_content=r'''

Get-Disk

'''

file_name='get_disk.ps1'
file_path=os.path.join(os.environ['TEMP'], file_name)
with open(file_path, 'wb') as wr:
    wr.write(ps_content)

ecmd('powershell "Set-ExecutionPolicy RemoteSigned"')
list_disk = ecmd('powershell "%s"'%file_path)

for i in list_disk.split('\n')[3:]:
    try:
        if i[0].isdigit():
            print "Selected Disk: ",i[0]
            contents = """
            select disk %s
            clean
            """%(i[0])
            with disable_file_system_redirection(): 
                try:
                    with open(path, 'w') as fiOb:
                        fiOb.write(contents)
                except:
                    print 'Fail: Check your path!!'

if os.path.isfile(path):
                command=r'diskpart /s '+ path
                print ecmd(command)
    except:
        pass

Comments

No Comments.

Script to get Details From Stolen Property

Comments

Leave a Comment