【应急基础】————13、VBS遍历目录获取文件Hash

涉及到的代码：https://paste.ubuntu.com/p/7kV7C6xfnk/

' ===================================================
' VBS遍历目录、遍历进程获取hash
' 基于wscript.shell、certutil，理论上支持Windows xp+ 系统
' Code by Rvn0xsy, <Mail:rvn0xsy@gamil.com>
' Blog: payloads.online
' ===================================================
Dim objfs
Dim result
Dim fp
Dim path


result = "result.txt"

Set objfs=CreateObject("scripting.filesystemobject")
Set fp = objfs.OpenTextFile(result,2,True)



Function GetMD5(Filename)
    Dim command,res,md5
    command = "certutil -hashfile "& chr(34) & Filename & chr(34)&" MD5"
    Set oShell = CreateObject("WScript.Shell")
    Set oExec = oShell.Exec(command)
    cmdtext = oExec.StdOut.ReadAll()
    res = split(cmdtext,vbcrlf)
    GetMD5 = Replace(res(1)," ","")
end Function



Function FilesMD5Tree(sPath)  
'遍历一个文件夹下的所有文件夹文件夹  
    Set oFso = CreateObject("Scripting.FileSystemObject")  
    Set oFolder = oFso.GetFolder(sPath)  
    Set oSubFolders = oFolder.SubFolders  
    
    Set oFiles = oFolder.Files  
    For Each oFile In oFiles  
        'WScript.Echo oFile.Path
	fp.write oFile.Path & " : " & GetMD5(oFile.Path) & vbcrlf
	' msgbox GetMD5(oFile.Path)
        ' oFile.Delete  
    Next  
      
    For Each oSubFolder In oSubFolders  
        'WScript.Echo oSubFolder.Path
        'oSubFolder.Delete  
        FilesMD5Tree(oSubFolder.Path)
    Next  

    Set oFolder = Nothing  
    Set oSubFolders = Nothing  
    Set oFso = Nothing  
End Function

Sub ProcessMD5()
fp.write "---------------- Processs ----------------" & vbcrlf
strComputer = "."
Set wmiConnect=Getobject("winmgmts:\\"&strComputer&"\root\cimv2")
Set Items=wmiConnect.execquery("select * from win32_process")
For each colitem in Items
    fp.write colitem.executablepath & " : " & GetMD5(colitem.executablepath)  & vbcrlf
Next
fp.write "---------------- Processs End ----------------" & vbcrlf
end Sub


msgbox "Start Process Foreach ..."

ProcessMD5()
fp.write "[Path MD5]" & vbcrlf
path = inputbox("Path or File :")
FilesMD5Tree(path)
fp.close


' 输出：
' ---------------- Processs ----------------
'  : CertUtil:系统找不到指定的路径。
'  : CertUtil:系统找不到指定的路径。
'  : CertUtil:系统找不到指定的路径。
' C:\Windows\system32\csrss.exe : 60c2862b4bf0fd9f582ef344c2b1ec72
' C:\Windows\system32\wininit.exe : 94355c28c1970635a31b3fe52eb7ceba
' C:\Windows\system32\services.exe : 24acb7e5be595468e3b9aa488b9b4fcb
' C:\Windows\system32\lsass.exe : 0793f40b9b8a1bdd266296409dbd91ea
' C:\Windows\system32\lsm.exe : 9662ee182644511439f1c53745dc1c88
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Program Files\VMware\VMware Tools\vmacthlp.exe : c0abc3906b0b44a1b4fd5e3fea9cb973
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\System32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\System32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\System32\spoolsv.exe : b96c17b5dc1424d56eea3a99e97428cd
' C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe : 5b956473dd9ec5967c6a606a61bb7cb3
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\DFSRs.exe : c087263545318aa5007c46f79ca7509b
' C:\Windows\system32\dns.exe : 048f424d20666d00134f5469b01ca4a7
' C:\Windows\system32\inetsrv\inetinfo.exe : ab55b8a9b13130f638546881ce4425f8
' C:\Windows\System32\ismserv.exe : 50fc561231a9b1efd2b47625be4272b3
' C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe : 3e5a36127e201ddf663176b66828fafe
' C:\Windows\system32\ntfrs.exe : 20c9f6d2a8449d00c72aba9ecf6959f6
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe : 64d88929f985c33dceb14a302f8121c2
' C:\Program Files\VMware\VMware Tools\vmtoolsd.exe : 18da77c49288532fc5b32eb251c69d44
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\dfssvc.exe : cbd618f73f32da9f8a63d3b3e8df12a9
' C:\Windows\System32\vds.exe : 8d6b481601d01a456e75c3210f1830be
' C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe : 65d6589c2e1d328c50b0b0d183089a67
' C:\Windows\system32\wbem\wmiprvse.exe : 619a67c9f617b7e69315bb28ecd5e1df
' C:\Windows\system32\dllhost.exe : a8edb86fc2a4d6d1285e4c70384ac35a
' C:\Windows\System32\msdtc.exe : de0ece52236cfa3ed2dbfc03f28253a8
' C:\Windows\System32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\sppsvc.exe : e17e0188bb90fae42d83e98707efa59c
' C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe : d88040f816fda31c3b466f0fa0918f29
' C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe : d1ceea2b47cb998321c579651ce3e4f8
' C:\Windows\system32\svchost.exe : c78655bc80301d76ed4fef1c1ea40a7d
' C:\Windows\system32\csrss.exe : 60c2862b4bf0fd9f582ef344c2b1ec72
' C:\Windows\system32\winlogon.exe : 1151b1baa6f350b1db6598e0fea7c457
' C:\Windows\system32\taskhost.exe : 517110bd83835338c037269e603db55d
' C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe : e2926a649e4d04c0b18982cbfea3aa4d
' C:\Windows\system32\conhost.exe : bd51024fb014064bc9fe8c715c18392f
' C:\Windows\system32\Dwm.exe : f162d5f5e845b9dc352dd1bad8cef1bc
' C:\Windows\Explorer.EXE : ac4c51eb24aa95b77f705ab159189e24
' C:\Program Files\VMware\VMware Tools\vmtoolsd.exe : 18da77c49288532fc5b32eb251c69d44
' C:\Windows\system32\cmd.exe : 5746bd7e255dd6a8afa06f7c42c1ba41
' C:\Windows\system32\conhost.exe : bd51024fb014064bc9fe8c715c18392f
' C:\Windows\System32\slui.exe : c5ce5ce799387e82b7698a0ee5544a6d
' C:\Windows\system32\NOTEPAD.EXE : f2c7bb8acc97f92e987a2d4087d021b1
' C:\Windows\System32\Notepad.exe : f2c7bb8acc97f92e987a2d4087d021b1
' C:\Windows\system32\NOTEPAD.EXE : f2c7bb8acc97f92e987a2d4087d021b1
' C:\Windows\System32\WScript.exe : 8886e0697b0a93c521f99099ef643450
' ---------------- Processs End ----------------
' [Path MD5]
' C:\Windows\Help\Help\zh-CN\Help.h1c : 663e2e0cb457c08a42ae9e97ff6026e3
' C:\Windows\Help\Help\zh-CN\Help.H1T : 1bb69d3107ac5a263656bee22fd96324
' C:\Windows\Help\Help\zh-CN\Help_AssetId.H1K : 75602f443a891a18c1b8966b3d495cc2
' C:\Windows\Help\Help\zh-CN\Help_BestBet.H1K : e7e48fc3daeb48b3d5a40caf4164a121
' C:\Windows\Help\Help\zh-CN\Help_LinkTerm.H1K : 3e824881fcb5fd7b3637e31defae84a9
' C:\Windows\Help\Help\zh-CN\Help_SubjectTerm.H1K : 8ee075916287657127420efc792a26cf
' C:\Windows\Help\Help\zh-CN\resources.H1S : c583ab5f3ed0488c706567d6e81ccea3
' C:\Windows\Help\Help\zh-CN\server-css.h1s : 44eb7e5f84cf7bf38c6024a119bcb330
' C:\Windows\Help\Help\zh-CN\stopwrds.stp : a9dcb8a9402268fadba28a68eebbfe3f