- updated listening ports enumeration check - added process pid + name

2026-07-30 23:50:27 -07:00 · 2021-01-31 18:12:22 +01:00
parent 9a6e5d5831
commit 8a8393dcc8
20 changed files with 697 additions and 12 deletions
@@ -1,8 +1,12 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
+using System.Linq;
 using winPEAS.Helpers;
+using winPEAS.Helpers.Extensions;
 using winPEAS.Info.NetworkInfo;
+using winPEAS.Info.NetworkInfo.Enums;

 namespace winPEAS.Checks
 {
@@ -11,6 +15,12 @@ namespace winPEAS.Checks
        static string commonShares = "[a-zA-Z]+[$]";
        static string badIps = "127.0.0.1";

+        static Dictionary<string, string> colorsN = new Dictionary<string, string>()
+        {
+            { badIps, Beaprint.ansi_color_bad },
+            { @"\[\:\:1\]", Beaprint.ansi_color_bad },
+        };
+
        public void PrintInfo(bool isDebug)
        {
            Beaprint.GreatPrint("Network Information");
@@ -102,27 +112,154 @@ namespace winPEAS.Checks
        }

        void PrintListeningPorts()
+        {
+            Process[] processes = Process.GetProcesses();
+            Dictionary<int, Process> processesByPid = processes.ToDictionary(k => k.Id, v => v);
+
+            PrintListeningPortsTcp(processesByPid);
+            PrintListeningPortsUdp(processesByPid);
+        }
+
+        void PrintListeningPortsTcp(Dictionary<int, Process> processesByPid)
+        {
+            Beaprint.MainPrint("Current TCP Listening Ports");
+            Beaprint.LinkPrint("", "Check for services restricted from the outside");
+
+            PrintListeningPortsTcpIPv4(processesByPid);
+            Beaprint.ColorPrint("", Beaprint.NOCOLOR);
+            PrintListeningPortsTcpIPv6(processesByPid);
+        }
+
+        private void PrintListeningPortsTcpIPv4(Dictionary<int, Process> processesByPid)
        {
            try
            {
-                Beaprint.MainPrint("Current Listening Ports");
-                Beaprint.LinkPrint("", "Check for services restricted from the outside");
-                List<List<string>> conns = NetworkInfoHelper.GetNetConnections();
+                Beaprint.ColorPrint("  Enumerating IPv4 connections\n", Beaprint.LBLUE);

-                Dictionary<string, string> colorsN = new Dictionary<string, string>()
+                string formatString = @"{0,-12} {1,-21} {2,-13} {3,-21} {4,-15} {5,-17} {6,-15} {7}";
+
+                Beaprint.NoColorPrint(
+                    string.Format($"{formatString}\n", "  Protocol", "Local Address", "Local Port", "Remote Address", "Remote Port", "State", "Process ID", "Process Name"));
+
+                foreach (var tcpConnectionInfo in NetworkInfoHelper.GetTcpConnections(IPVersion.IPv4, processesByPid))
                {
-                    { badIps, Beaprint.ansi_color_bad },
-                };
+                    Beaprint.AnsiPrint(
+                        string.Format($"{formatString}",
+                                       "  TCP",
+                                       tcpConnectionInfo.LocalAddress,
+                                       tcpConnectionInfo.LocalPort,
+                                       tcpConnectionInfo.RemoteAddress,
+                                       tcpConnectionInfo.RemotePort,
+                                       tcpConnectionInfo.State.GetDescription(),
+                                       tcpConnectionInfo.ProcessId,
+                                       tcpConnectionInfo.ProcessName
+                                     ),
+                                     colorsN);
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }

-                foreach (List<string> conn in conns)
+        private void PrintListeningPortsTcpIPv6(Dictionary<int, Process> processesByPid)
+        {
+            try
+            {
+                Beaprint.ColorPrint("  Enumerating IPv6 connections\n", Beaprint.LBLUE);
+
+                string formatString = @"{0,-12} {1,-43} {2,-13} {3,-43} {4,-15} {5,-17} {6,-15} {7}";
+
+                Beaprint.NoColorPrint(
+                    string.Format($"{formatString}\n", "  Protocol", "Local Address", "Local Port", "Remote Address", "Remote Port", "State", "Process ID", "Process Name"));
+
+                foreach (var tcpConnectionInfo in NetworkInfoHelper.GetTcpConnections(IPVersion.IPv6, processesByPid))
                {
-                    if (conn[0].Contains("UDP") && conn[1].Contains("0.0.0.0:") && (conn[1].Split(':')[1].Length > 4))
-                        continue; //Delete useless UDP listening ports
+                    Beaprint.AnsiPrint(
+                        string.Format($"{formatString}",
+                                       "  TCP",
+                                       $"[{tcpConnectionInfo.LocalAddress}]",
+                                       tcpConnectionInfo.LocalPort,
+                                       $"[{tcpConnectionInfo.RemoteAddress}]",
+                                       tcpConnectionInfo.RemotePort,
+                                       tcpConnectionInfo.State.GetDescription(),
+                                       tcpConnectionInfo.ProcessId,
+                                       tcpConnectionInfo.ProcessName
+                                     ),
+                                     colorsN);
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }

-                    if (conn[0].Contains("UDP") && conn[1].Contains("[::]:") && (conn[1].Split(']')[1].Length > 4))
-                        continue; //Delete useless UDP listening ports
+        void PrintListeningPortsUdp(Dictionary<int, Process> processesByPid)
+        {
+            Beaprint.MainPrint("Current UDP Listening Ports");
+            Beaprint.LinkPrint("", "Check for services restricted from the outside");

-                    Beaprint.AnsiPrint($"    {conn[0],-10}{conn[1],-23}{conn[2],-23}{conn[3]}", colorsN);
+            PrintListeningPortsUdpIPv4(processesByPid);
+            Beaprint.ColorPrint("", Beaprint.NOCOLOR);
+            PrintListeningPortsUdpIPv6(processesByPid);
+        }
+
+        private void PrintListeningPortsUdpIPv4(Dictionary<int, Process> processesByPid)
+        {
+            try
+            {
+                Beaprint.ColorPrint("  Enumerating IPv4 connections\n", Beaprint.LBLUE);
+
+                string formatString = @"{0,-12} {1,-21} {2,-13} {3,-30} {4,-17} {5}";
+
+                Beaprint.NoColorPrint(
+                    string.Format($"{formatString}\n", "  Protocol", "Local Address", "Local Port", "Remote Address:Remote Port", "Process ID", "Process Name"));
+
+                foreach (var udpConnectionInfo in NetworkInfoHelper.GetUdpConnections(IPVersion.IPv4, processesByPid))
+                {
+                    Beaprint.AnsiPrint(
+                        string.Format($"{formatString}",
+                                       "  UDP",
+                                       udpConnectionInfo.LocalAddress,
+                                       udpConnectionInfo.LocalPort,
+                                       "*:*",   // UDP does not have remote address/port
+                                       udpConnectionInfo.ProcessId,
+                                       udpConnectionInfo.ProcessName
+                                     ),
+                                     colorsN);
+                }
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException(ex.Message);
+            }
+        }
+
+        private void PrintListeningPortsUdpIPv6(Dictionary<int, Process> processesByPid)
+        {
+            try
+            {
+                Beaprint.ColorPrint("  Enumerating IPv6 connections\n", Beaprint.LBLUE);
+
+                string formatString = @"{0,-12} {1,-43} {2,-13} {3,-30} {4,-17} {5}";
+
+                Beaprint.NoColorPrint(
+                    string.Format($"{formatString}\n", "  Protocol", "Local Address", "Local Port", "Remote Address:Remote Port", "Process ID", "Process Name"));
+
+                foreach (var udpConnectionInfo in NetworkInfoHelper.GetUdpConnections(IPVersion.IPv6, processesByPid))
+                {
+                    Beaprint.AnsiPrint(
+                        string.Format($"{formatString}",
+                                       "  UDP",
+                                       $"[{udpConnectionInfo.LocalAddress}]",
+                                       udpConnectionInfo.LocalPort,
+                                       "*:*",   // UDP does not have remote address/port
+                                       udpConnectionInfo.ProcessId,
+                                       udpConnectionInfo.ProcessName
+                                     ),
+                                     colorsN);
                }
            }
            catch (Exception ex)
@@ -0,0 +1,8 @@
+namespace winPEAS.Info.NetworkInfo.Enums
+{
+    public enum IPVersion
+    {
+        IPv4,
+        IPv6
+    }
+}
@@ -0,0 +1,46 @@
+using System.ComponentModel;
+
+namespace winPEAS.Info.NetworkInfo
+{
+    public enum MibTcpState
+    {
+        [Description("None")]
+        NONE = 0,
+
+        [Description("Closed")]
+        CLOSED = 1,
+
+        [Description("Listening")]
+        LISTEN = 2,
+
+        [Description("SYN Sent")]
+        SYN_SENT = 3,
+
+        [Description("SYN Received")]
+        SYN_RCVD = 4,
+
+        [Description("Established")]
+        ESTAB = 5,
+
+        [Description("FIN Wait 1")]
+        FIN_WAIT1 = 6,
+
+        [Description("FIN Wait 2")]
+        FIN_WAIT2 = 7,
+
+        [Description("Close Wait")]
+        CLOSE_WAIT = 8,
+
+        [Description("Closing")]
+        CLOSING = 9,
+
+        [Description("Last ACK")]
+        LAST_ACK = 10,
+
+        [Description("Time Wait")]
+        TIME_WAIT = 11,
+
+        [Description("Delete TCB")]
+        DELETE_TCB = 12
+    }
+}
@@ -0,0 +1,8 @@
+namespace winPEAS.Info.NetworkInfo.Enums
+{
+    public enum Protocol
+    {
+        TCP,
+        UDP
+    }
+}
@@ -0,0 +1,15 @@
+namespace winPEAS.Info.NetworkInfo.Enums
+{
+    public enum TcpTableClass
+    {
+        TCP_TABLE_BASIC_LISTENER,
+        TCP_TABLE_BASIC_CONNECTIONS,
+        TCP_TABLE_BASIC_ALL,
+        TCP_TABLE_OWNER_PID_LISTENER,
+        TCP_TABLE_OWNER_PID_CONNECTIONS,
+        TCP_TABLE_OWNER_PID_ALL,
+        TCP_TABLE_OWNER_MODULE_LISTENER,
+        TCP_TABLE_OWNER_MODULE_CONNECTIONS,
+        TCP_TABLE_OWMER_MODULE_ALL
+    }
+}
@@ -0,0 +1,9 @@
+namespace winPEAS.Info.NetworkInfo.Enums
+{
+    public enum UdpTableClass
+    {
+        UDP_TABLE_BASIC,
+        UDP_TABLE_OWNER_PID,
+        UDP_TABLE_OWNER_MODULE
+    }
+}
@@ -0,0 +1,30 @@
+using System.Net;
+using System.Runtime.InteropServices;
+using winPEAS.Info.NetworkInfo.Enums;
+
+namespace winPEAS.Info.NetworkInfo
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public abstract class NetworkConnection
+    {
+        public virtual Protocol Protocol { get; set; }
+        public virtual IPAddress LocalAddress { get; set; }
+        public virtual ushort LocalPort { get; set; }
+        public virtual int ProcessId { get; set; }
+        public virtual string ProcessName { get; set; }
+
+        public NetworkConnection(
+            Protocol protocol,
+            IPAddress localAddress,
+            ushort localPort,
+            int processId,
+            string processName)
+        {
+            Protocol = protocol;
+            LocalAddress = localAddress;
+            LocalPort = localPort;
+            ProcessId = processId;
+            ProcessName = processName;
+        }
+    }
+}
@@ -1,16 +1,31 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
 using System.Management;
 using System.Net;
 using System.Net.NetworkInformation;
 using System.Runtime.InteropServices;
 using winPEAS.Helpers;
+using winPEAS.Info.NetworkInfo.Enums;
+using winPEAS.Info.NetworkInfo.Structs;

 namespace winPEAS.Info.NetworkInfo
 {
    class NetworkInfoHelper
    {
+        // https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket
+        private const int AF_INET = 2;
+        private const int AF_INET6 = 23;
+
+        [DllImport("iphlpapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
+        private static extern uint GetExtendedTcpTable(IntPtr pTcpTable, ref int pdwSize,
+            bool bOrder, int ulAf, TcpTableClass tableClass, uint reserved = 0);
+
+        [DllImport("iphlpapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
+        private static extern uint GetExtendedUdpTable(IntPtr pUdpTable, ref int pdwSize,
+            bool bOrder, int ulAf, UdpTableClass tableClass, uint reserved = 0);
+
        [DllImport("IpHlpApi.dll")]
        [return: MarshalAs(UnmanagedType.U4)]
        internal static extern int GetIpNetTable(IntPtr pIpNetTable, [MarshalAs(UnmanagedType.U4)]ref int pdwSize, bool bOrder);
@@ -296,6 +311,237 @@ namespace winPEAS.Info.NetworkInfo
                Beaprint.PrintException(ex.Message);
            }
            return results;
+        }       
+
+        public static List<TcpConnectionInfo> GetTcpConnections(IPVersion ipVersion, Dictionary<int, Process> processesByPid = null)
+        {
+            int bufferSize = 0;
+            List<TcpConnectionInfo> tcpTableRecords = new List<TcpConnectionInfo>();
+
+            int ulAf = AF_INET;
+
+            if (ipVersion == IPVersion.IPv6)
+            {
+                ulAf = AF_INET6;
+            }
+
+            // Getting the initial size of TCP table.
+            uint result = GetExtendedTcpTable(IntPtr.Zero, ref bufferSize, true, ulAf, TcpTableClass.TCP_TABLE_OWNER_PID_ALL);
+
+            // Allocating memory as an IntPtr with the bufferSize.
+            IntPtr tcpTableRecordsPtr = Marshal.AllocHGlobal(bufferSize);
+
+            try
+            {
+                // The IntPtr from last call, tcpTableRecoresPtr must be used in the subsequent
+                // call and passed as the first parameter.
+                result = GetExtendedTcpTable(tcpTableRecordsPtr, ref bufferSize, true, ulAf, TcpTableClass.TCP_TABLE_OWNER_PID_ALL);
+
+                // If not zero, the call failed.
+                if (result != 0)
+                { 
+                    return new List<TcpConnectionInfo>(); 
+                }
+
+                // Marshals data fron an unmanaged block of memory to the
+                // newly allocated managed object 'tcpRecordsTable' of type
+                // 'MIB_TCPTABLE_OWNER_PID' to get number of entries of TCP
+                // table structure.
+
+                // Determine if IPv4 or IPv6.
+                if (ipVersion == IPVersion.IPv4)
+                {
+                    MIB_TCPTABLE_OWNER_PID tcpRecordsTable = (MIB_TCPTABLE_OWNER_PID) Marshal.PtrToStructure(tcpTableRecordsPtr, typeof(MIB_TCPTABLE_OWNER_PID));
+
+                    IntPtr tableRowPtr = (IntPtr)((long)tcpTableRecordsPtr + Marshal.SizeOf(tcpRecordsTable.dwNumEntries));
+
+                    // Read and parse the TCP records from the table and store them in list 
+                    // 'TcpConnection' structure type objects.
+                    for (int row = 0; row < tcpRecordsTable.dwNumEntries; row++)
+                    {
+                        MIB_TCPROW_OWNER_PID tcpRow = (MIB_TCPROW_OWNER_PID)Marshal.PtrToStructure(tableRowPtr, typeof(MIB_TCPROW_OWNER_PID));
+
+                        // Add row to list of TcpConnetions.
+                        tcpTableRecords.Add(new TcpConnectionInfo(
+                                                Protocol.TCP,
+                                                new IPAddress(tcpRow.localAddr),
+                                                new IPAddress(tcpRow.remoteAddr),
+                                                BitConverter.ToUInt16(new byte[2] {
+                                                tcpRow.localPort[1],
+                                                tcpRow.localPort[0] }, 0),
+                                                BitConverter.ToUInt16(new byte[2] {
+                                                tcpRow.remotePort[1],
+                                                tcpRow.remotePort[0] }, 0),
+                                                tcpRow.owningPid,
+                                                tcpRow.state,
+                                                GetProcessNameByPid(tcpRow.owningPid, processesByPid)));
+
+                        tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(tcpRow));
+                    }
+                }
+                else if (ipVersion == IPVersion.IPv6)
+                {
+                    MIB_TCP6TABLE_OWNER_PID tcpRecordsTable = (MIB_TCP6TABLE_OWNER_PID) Marshal.PtrToStructure(tcpTableRecordsPtr, typeof(MIB_TCP6TABLE_OWNER_PID));
+
+                    IntPtr tableRowPtr = (IntPtr)((long)tcpTableRecordsPtr + Marshal.SizeOf(tcpRecordsTable.dwNumEntries));
+
+                    // Read and parse the TCP records from the table and store them in list 
+                    // 'TcpConnection' structure type objects.
+                    for (int row = 0; row < tcpRecordsTable.dwNumEntries; row++)
+                    {
+                        MIB_TCP6ROW_OWNER_PID tcpRow = (MIB_TCP6ROW_OWNER_PID)Marshal.PtrToStructure(tableRowPtr, typeof(MIB_TCP6ROW_OWNER_PID));
+
+                        tcpTableRecords.Add(new TcpConnectionInfo(
+                                                Protocol.TCP,
+                                                new IPAddress(tcpRow.localAddr, tcpRow.localScopeId),
+                                                new IPAddress(tcpRow.remoteAddr, tcpRow.remoteScopeId),
+                                                BitConverter.ToUInt16(new byte[2] {
+                                                tcpRow.localPort[1],
+                                                tcpRow.localPort[0] }, 0),
+                                                BitConverter.ToUInt16(new byte[2] {
+                                                tcpRow.remotePort[1],
+                                                tcpRow.remotePort[0] }, 0),
+                                                tcpRow.owningPid,
+                                                tcpRow.state,
+                                                GetProcessNameByPid(tcpRow.owningPid, processesByPid)));
+
+                        tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(tcpRow));
+                    }
+                }
+            }
+            catch (OutOfMemoryException outOfMemoryException)
+            {
+                throw outOfMemoryException;
+            }
+            catch (Exception exception)
+            {
+                throw exception;
+            }
+            finally
+            {
+                Marshal.FreeHGlobal(tcpTableRecordsPtr);
+            }
+
+            return tcpTableRecords != null ? tcpTableRecords.Distinct().ToList() : new List<TcpConnectionInfo>();
+        }
+
+        public static IEnumerable<UdpConnectionInfo> GetUdpConnections(IPVersion ipVersion, Dictionary<int, Process> processesByPid = null)
+        {
+            int bufferSize = 0;
+            List<UdpConnectionInfo> udpTableRecords = new List<UdpConnectionInfo>();
+
+            int ulAf = AF_INET;
+
+            if (ipVersion == IPVersion.IPv6)
+            {
+                ulAf = AF_INET6;
+            }
+
+            // Getting the initial size of UDP table.
+            uint result = GetExtendedUdpTable(IntPtr.Zero, ref bufferSize, true, ulAf, UdpTableClass.UDP_TABLE_OWNER_PID);
+
+            // Allocating memory as an IntPtr with the bufferSize.
+            IntPtr udpTableRecordsPtr = Marshal.AllocHGlobal(bufferSize);
+
+            try
+            {
+                // The IntPtr from last call, udpTableRecoresPtr must be used in the subsequent
+                // call and passed as the first parameter.
+                result = GetExtendedUdpTable(udpTableRecordsPtr, ref bufferSize, true, ulAf, UdpTableClass.UDP_TABLE_OWNER_PID);
+
+                // If not zero, call failed.
+                if (result != 0)
+                {
+                    return new List<UdpConnectionInfo>();
+                }
+
+                // Marshals data fron an unmanaged block of memory to the
+                // newly allocated managed object 'udpRecordsTable' of type
+                // 'MIB_UDPTABLE_OWNER_PID' to get number of entries of TCP
+                // table structure.
+
+                // Determine if IPv4 or IPv6.
+                if (ipVersion == IPVersion.IPv4)
+                {
+                    MIB_UDPTABLE_OWNER_PID udpRecordsTable = (MIB_UDPTABLE_OWNER_PID) Marshal.PtrToStructure(udpTableRecordsPtr, typeof(MIB_UDPTABLE_OWNER_PID));
+                    IntPtr tableRowPtr = (IntPtr)((long)udpTableRecordsPtr + Marshal.SizeOf(udpRecordsTable.dwNumEntries));
+
+                    // Read and parse the UDP records from the table and store them in list 
+                    // 'UdpConnection' structure type objects.
+                    for (int i = 0; i < udpRecordsTable.dwNumEntries; i++)
+                    {
+                        MIB_UDPROW_OWNER_PID udpRow = (MIB_UDPROW_OWNER_PID) Marshal.PtrToStructure(tableRowPtr, typeof(MIB_UDPROW_OWNER_PID));
+                        udpTableRecords.Add(new UdpConnectionInfo(
+                                                Protocol.UDP,
+                                                new IPAddress(udpRow.localAddr),
+                                                BitConverter.ToUInt16(new byte[2] { udpRow.localPort[1],
+                                                udpRow.localPort[0] }, 0),
+                                                udpRow.owningPid,
+                                                GetProcessNameByPid(udpRow.owningPid, processesByPid)));
+
+                        tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(udpRow));
+                    }
+                }
+                else if (ipVersion == IPVersion.IPv6)
+                {
+                    MIB_UDP6TABLE_OWNER_PID udpRecordsTable = (MIB_UDP6TABLE_OWNER_PID)
+                        Marshal.PtrToStructure(udpTableRecordsPtr, typeof(MIB_UDP6TABLE_OWNER_PID));
+                    IntPtr tableRowPtr = (IntPtr)((long)udpTableRecordsPtr +
+                        Marshal.SizeOf(udpRecordsTable.dwNumEntries));
+
+                    // Read and parse the UDP records from the table and store them in list 
+                    // 'UdpConnection' structure type objects.
+                    for (int i = 0; i < udpRecordsTable.dwNumEntries; i++)
+                    {
+                        MIB_UDP6ROW_OWNER_PID udpRow = (MIB_UDP6ROW_OWNER_PID)
+                            Marshal.PtrToStructure(tableRowPtr, typeof(MIB_UDP6ROW_OWNER_PID));
+                        udpTableRecords.Add(new UdpConnectionInfo(
+                                                Protocol.UDP,
+                                                new IPAddress(udpRow.localAddr, udpRow.localScopeId),
+                                                BitConverter.ToUInt16(new byte[2] {
+                                                udpRow.localPort[1],
+                                                udpRow.localPort[0] }, 0),
+                                                udpRow.owningPid,
+                                                GetProcessNameByPid(udpRow.owningPid, processesByPid)));
+                        tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(udpRow));
+                    }
+                }
+            }
+            catch (OutOfMemoryException outOfMemoryException)
+            {
+                throw outOfMemoryException;
+            }
+            catch (Exception exception)
+            {
+                throw exception;
+            }
+            finally
+            {
+                Marshal.FreeHGlobal(udpTableRecordsPtr);
+            }
+
+            return udpTableRecords != null ? udpTableRecords.Distinct().ToList() : new List<UdpConnectionInfo>();
+        }
+
+        private static string GetProcessNameByPid(int pid, Dictionary<int, Process> processesByPid = null)
+        {
+            if (processesByPid != null && processesByPid.ContainsKey(pid))
+            {
+                var process = processesByPid[pid];
+                var processName = process.ProcessName;
+
+                try
+                {
+                    processName = process.MainModule?.FileName;
+                }
+                catch (System.Exception ex)
+                {
+                }
+
+                return processName;
+            }
+
+            return string.Empty;
        }
    }
 }
@@ -0,0 +1,21 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_TCP6ROW_OWNER_PID
+    {
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+        public byte[] localAddr;
+        public uint localScopeId;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] localPort;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+        public byte[] remoteAddr;
+        public uint remoteScopeId;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] remotePort;
+        public MibTcpState state;
+        public int owningPid;
+    }
+}
@@ -0,0 +1,12 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_TCP6TABLE_OWNER_PID
+    {
+        public uint dwNumEntries;
+        [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct, SizeConst = 1)]
+        public MIB_TCP6ROW_OWNER_PID[] table;
+    }
+}
@@ -0,0 +1,17 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_TCPROW_OWNER_PID
+    {
+        public MibTcpState state;
+        public uint localAddr;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] localPort;
+        public uint remoteAddr;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] remotePort;
+        public int owningPid;
+    }
+}
@@ -0,0 +1,12 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_TCPTABLE_OWNER_PID
+    {
+        public uint dwNumEntries;
+        [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct, SizeConst = 1)]
+        public MIB_TCPROW_OWNER_PID[] table;
+    }
+}
@@ -0,0 +1,15 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_UDP6ROW_OWNER_PID
+    {
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+        public byte[] localAddr;
+        public uint localScopeId;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] localPort;
+        public int owningPid;
+    }
+}
@@ -0,0 +1,12 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_UDP6TABLE_OWNER_PID
+    {
+        public uint dwNumEntries;
+        [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct,SizeConst = 1)]
+        public MIB_UDP6ROW_OWNER_PID[] table;
+    }
+}
@@ -0,0 +1,13 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_UDPROW_OWNER_PID
+    {
+        public uint localAddr;
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
+        public byte[] localPort;
+        public int owningPid;
+    }
+}
@@ -0,0 +1,12 @@
+using System.Runtime.InteropServices;
+
+namespace winPEAS.Info.NetworkInfo.Structs
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MIB_UDPTABLE_OWNER_PID
+    {
+        public uint dwNumEntries;
+        [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct,SizeConst = 1)]
+        public MIB_UDPROW_OWNER_PID[] table;
+    }
+}
@@ -0,0 +1,23 @@
+using System.Net;
+using System.Runtime.InteropServices;
+using winPEAS.Info.NetworkInfo.Enums;
+
+namespace winPEAS.Info.NetworkInfo
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public class TcpConnectionInfo : NetworkConnection
+    {
+        public IPAddress RemoteAddress { get; set; }
+        public ushort RemotePort { get; set; }
+        public MibTcpState State { get; set; }
+
+        public TcpConnectionInfo(Protocol protocol, IPAddress localAddress, IPAddress remoteIp, ushort localPort,
+            ushort remotePort, int pId, MibTcpState state, string processName)
+            : base(protocol, localAddress, localPort, pId, processName)
+        {
+            RemoteAddress = remoteIp;
+            RemotePort = remotePort;
+            State = state;
+        }
+    }
+}
@@ -0,0 +1,15 @@
+using System.Net;
+using System.Runtime.InteropServices;
+using winPEAS.Info.NetworkInfo.Enums;
+
+namespace winPEAS.Info.NetworkInfo
+{
+    [StructLayout(LayoutKind.Sequential)]
+    public class UdpConnectionInfo : NetworkConnection
+    {
+        public UdpConnectionInfo(Protocol protocol, IPAddress localAddress, ushort localPort, int pId, string processName)
+             : base(protocol, localAddress, localPort, pId, processName)
+        {
+        }
+    }
+}
@@ -0,0 +1,17 @@
+namespace winPEAS.Info.NetworkInfo
+{
+    // Defined at https://msdn.microsoft.com/en-us/library/cc231199.aspx    
+    internal class Win32Error
+    {
+        public const int Success = 0;
+        public const int NERR_Success = 0;
+        public const int AccessDenied = 0x0000005;
+        public const int NotEnoughMemory = 0x00000008;
+        public const int InsufficientBuffer = 0x0000007A;
+        public const int MoreData = 0x00000EA;
+        public const int NoSuchAlias = 0x0000560;
+        public const int RpcServerUnavailable = 0x0006BA;
+        public const int NERR_GroupNotFound = 0x00008AC;
+        public const int NERR_InvalidComputer = 0x000092F;
+    }
+}
@@ -402,6 +402,23 @@
    <Compile Include="Info\ApplicationInfo\DeviceDrivers.cs" />
    <Compile Include="Info\ApplicationInfo\InstalledApps.cs" />
    <Compile Include="Helpers\Beaprint.cs" />
+    <Compile Include="Info\NetworkInfo\Enums\IPVersion.cs" />
+    <Compile Include="Info\NetworkInfo\Enums\MibTcpState.cs" />
+    <Compile Include="Info\NetworkInfo\Enums\Protocol.cs" />
+    <Compile Include="Info\NetworkInfo\Enums\TcpTableClass.cs" />
+    <Compile Include="Info\NetworkInfo\Enums\UdpTableClass.cs" />
+    <Compile Include="Info\NetworkInfo\NetworkConnection.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_TCP6ROW_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_TCP6TABLE_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_TCPROW_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_TCPTABLE_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_UDP6ROW_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_UDP6TABLE_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_UDPROW_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\Structs\MIB_UDPTABLE_OWNER_PID.cs" />
+    <Compile Include="Info\NetworkInfo\TcpConnectionInfo.cs" />
+    <Compile Include="Info\NetworkInfo\UdpConnectionInfo.cs" />
+    <Compile Include="Info\NetworkInfo\Win32Error.cs" />
    <Compile Include="Info\SystemInfo\CredentialGuard.cs" />
    <Compile Include="Info\SystemInfo\NamedPipes\NamedPipeInfo.cs" />
    <Compile Include="Info\SystemInfo\NamedPipes\NamedPipes.cs" />