diff --git a/winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs b/winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs index b43cffc..bccea25 100644 --- a/winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs @@ -125,6 +125,7 @@ namespace winPEAS.Checks PrintUsersDocsKeys, PrintRecentFiles, PrintRecycleBin, + PrintHiddenFilesAndFolders, PrintOtherUsersInterestingFiles }.ForEach(action => CheckRunner.Run(action, isDebug)); } @@ -541,5 +542,106 @@ namespace winPEAS.Checks Beaprint.PrintException(ex.Message); } } + + void PrintHiddenFilesAndFolders() + { + HashSet excludedFilenames = new HashSet() + { + "cache.bin", + "container.dat", + "desktop.ini", + "iconcache.db", + "ntuser.ini", + "ntuser.dat", + "ntuser.dat.log1", + "ntuser.dat.log2", + "pof.dat.log1", + "pof.dat.log2", + "privateregistry.bin.log1", + "privateregistry.bin.log2", + "settings.dat.log1", + "settings.dat.log2", + "thumbs.db", + "user.dat.log1", + "user.dat.log2", + "userclasses.dat", + "userclasses.dat.log1", + "userclasses.dat.log2", + "usrclass.dat", + "usrclass.dat.log1", + "usrclass.dat.log2", + }; + + HashSet excludedExtensions = new HashSet() + { + ".blf", + ".igpi", + ".regtrans-ms", + ".search-ms", + ".suo", + }; + + HashSet excludedKnownFolders = new HashSet() + { + "accountpictures", + "appdata", + "application data", + "cookies", + "desktop", + "documents", + "intelgraphicsprofiles", + "libraries", + "local settings", + "my documents", + "nethood", + "printhood", + "recent", + "recent", + "sendto", + "start menu", + "templates", + }; + + var systemDrive = Environment.GetEnvironmentVariable("SystemDrive"); + + Beaprint.MainPrint($"Searching hidden files or folders in {systemDrive}\\Users home (can be slow)\n"); + + foreach (var file in SearchHelper.RootDirUsers) + { + try + { + if (File.GetAttributes(file.FullPath).HasFlag(FileAttributes.Hidden)) + { + if (file.Extension != null && excludedExtensions.Contains(file.Extension.ToLower())) + { + continue; + } + + if (file.Filename != null && excludedFilenames.Contains(file.Filename.ToLower())) + { + continue; + } + + // skip well known folders + if (excludedKnownFolders.Contains(Path.GetFileName(file.FullPath).ToLower())) + { + continue; + } + + if (file.FullPath.ToLower().Contains("microsoft")) + { + continue; + } + + Beaprint.BadPrint($" {file.FullPath}"); + } + } + catch (PathTooLongException ex) { } + catch (Exception ex) + { + // & other exceptions + } + } + } } } diff --git a/winPEAS/winPEASexe/winPEAS/Helpers/CheckRunner.cs b/winPEAS/winPEASexe/winPEAS/Helpers/CheckRunner.cs index 07f2d17..e4b7621 100644 --- a/winPEAS/winPEASexe/winPEAS/Helpers/CheckRunner.cs +++ b/winPEAS/winPEASexe/winPEAS/Helpers/CheckRunner.cs @@ -7,23 +7,22 @@ namespace winPEAS.Helpers { public static void Run(Action action, bool isDebug, string description = null) { - var timer = new Stopwatch(); - - if (isDebug) + if (!isDebug) { - timer.Start(); + action(); } - - action(); - - if (isDebug) + else { + var timer = new Stopwatch(); + + timer.Start(); + action(); timer.Stop(); TimeSpan timeTaken = timer.Elapsed; string descriptionText = string.IsNullOrEmpty(description) ? string.Empty : $"[{description}] "; string log = $"{descriptionText}Execution took : {timeTaken.Minutes:00}m:{timeTaken.Seconds:00}s:{timeTaken.Milliseconds:000}"; - + Beaprint.PrintDebugLine(log); } } diff --git a/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs b/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs index ace7329..3129853 100644 --- a/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs +++ b/winPEAS/winPEASexe/winPEAS/Helpers/Search/SearchHelper.cs @@ -10,14 +10,12 @@ namespace winPEAS.Helpers.Search { static class SearchHelper { - private static List RootDirUsers; + public static List RootDirUsers; private static List RootDirCurrentUser; private static List ProgramFiles; private static List ProgramFilesX86; private static List DocumentsAndSettings; private static List GroupPolicyHistory; - // private static List GroupPolicyHistoryLegacy; - public static List GetFilesFast(string folder, string pattern = "*", HashSet excludedDirs = null, bool isFoldersIncluded = false) { @@ -32,14 +30,7 @@ namespace winPEAS.Helpers.Search bool shouldAdd = true; string startDirLower = startDir.FullName.ToLower(); - foreach (var excludedDirPattern in excludedDirs) - { - if (Regex.IsMatch(startDirLower, excludedDirPattern, RegexOptions.IgnoreCase)) - { - shouldAdd = false; - break; - } - } + shouldAdd = !excludedDirs.Contains(startDirLower); if (shouldAdd) { @@ -171,7 +162,7 @@ namespace winPEAS.Helpers.Search // c:\users string rootUsersSearchPath = $"{systemDrive}\\Users\\"; - SearchHelper.RootDirUsers = SearchHelper.GetFilesFast(rootUsersSearchPath, globalPattern); + SearchHelper.RootDirUsers = SearchHelper.GetFilesFast(rootUsersSearchPath, globalPattern, isFoldersIncluded: true); // c:\users\current_user string rootCurrentUserSearchPath = Environment.GetEnvironmentVariable("USERPROFILE"); diff --git a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user index 985c97c..d708e65 100755 --- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user +++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj.user @@ -8,7 +8,7 @@ applicationsinfo - cmd fast + debug fast