diff --git a/winPEAS/winPEASexe/winPEAS/Checks/NetworkInfo.cs b/winPEAS/winPEASexe/winPEAS/Checks/NetworkInfo.cs index a0c6d9d..3e2ec69 100644 --- a/winPEAS/winPEASexe/winPEAS/Checks/NetworkInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Checks/NetworkInfo.cs @@ -1,8 +1,12 @@ using System; using System.Collections.Generic; +using System.Diagnostics; using System.IO; +using System.Linq; using winPEAS.Helpers; +using winPEAS.Helpers.Extensions; using winPEAS.Info.NetworkInfo; +using winPEAS.Info.NetworkInfo.Enums; namespace winPEAS.Checks { @@ -11,6 +15,12 @@ namespace winPEAS.Checks static string commonShares = "[a-zA-Z]+[$]"; static string badIps = "127.0.0.1"; + static Dictionary colorsN = new Dictionary() + { + { badIps, Beaprint.ansi_color_bad }, + { @"\[\:\:1\]", Beaprint.ansi_color_bad }, + }; + public void PrintInfo(bool isDebug) { Beaprint.GreatPrint("Network Information"); @@ -102,27 +112,154 @@ namespace winPEAS.Checks } void PrintListeningPorts() + { + Process[] processes = Process.GetProcesses(); + Dictionary processesByPid = processes.ToDictionary(k => k.Id, v => v); + + PrintListeningPortsTcp(processesByPid); + PrintListeningPortsUdp(processesByPid); + } + + void PrintListeningPortsTcp(Dictionary processesByPid) + { + Beaprint.MainPrint("Current TCP Listening Ports"); + Beaprint.LinkPrint("", "Check for services restricted from the outside"); + + PrintListeningPortsTcpIPv4(processesByPid); + Beaprint.ColorPrint("", Beaprint.NOCOLOR); + PrintListeningPortsTcpIPv6(processesByPid); + } + + private void PrintListeningPortsTcpIPv4(Dictionary processesByPid) { try { - Beaprint.MainPrint("Current Listening Ports"); - Beaprint.LinkPrint("", "Check for services restricted from the outside"); - List> conns = NetworkInfoHelper.GetNetConnections(); + Beaprint.ColorPrint(" Enumerating IPv4 connections\n", Beaprint.LBLUE); - Dictionary colorsN = new Dictionary() + string formatString = @"{0,-12} {1,-21} {2,-13} {3,-21} {4,-15} {5,-17} {6,-15} {7}"; + + Beaprint.NoColorPrint( + string.Format($"{formatString}\n", " Protocol", "Local Address", "Local Port", "Remote Address", "Remote Port", "State", "Process ID", "Process Name")); + + foreach (var tcpConnectionInfo in NetworkInfoHelper.GetTcpConnections(IPVersion.IPv4, processesByPid)) { - { badIps, Beaprint.ansi_color_bad }, - }; + Beaprint.AnsiPrint( + string.Format($"{formatString}", + " TCP", + tcpConnectionInfo.LocalAddress, + tcpConnectionInfo.LocalPort, + tcpConnectionInfo.RemoteAddress, + tcpConnectionInfo.RemotePort, + tcpConnectionInfo.State.GetDescription(), + tcpConnectionInfo.ProcessId, + tcpConnectionInfo.ProcessName + ), + colorsN); + } + } + catch (Exception ex) + { + Beaprint.PrintException(ex.Message); + } + } - foreach (List conn in conns) + private void PrintListeningPortsTcpIPv6(Dictionary processesByPid) + { + try + { + Beaprint.ColorPrint(" Enumerating IPv6 connections\n", Beaprint.LBLUE); + + string formatString = @"{0,-12} {1,-43} {2,-13} {3,-43} {4,-15} {5,-17} {6,-15} {7}"; + + Beaprint.NoColorPrint( + string.Format($"{formatString}\n", " Protocol", "Local Address", "Local Port", "Remote Address", "Remote Port", "State", "Process ID", "Process Name")); + + foreach (var tcpConnectionInfo in NetworkInfoHelper.GetTcpConnections(IPVersion.IPv6, processesByPid)) { - if (conn[0].Contains("UDP") && conn[1].Contains("0.0.0.0:") && (conn[1].Split(':')[1].Length > 4)) - continue; //Delete useless UDP listening ports + Beaprint.AnsiPrint( + string.Format($"{formatString}", + " TCP", + $"[{tcpConnectionInfo.LocalAddress}]", + tcpConnectionInfo.LocalPort, + $"[{tcpConnectionInfo.RemoteAddress}]", + tcpConnectionInfo.RemotePort, + tcpConnectionInfo.State.GetDescription(), + tcpConnectionInfo.ProcessId, + tcpConnectionInfo.ProcessName + ), + colorsN); + } + } + catch (Exception ex) + { + Beaprint.PrintException(ex.Message); + } + } - if (conn[0].Contains("UDP") && conn[1].Contains("[::]:") && (conn[1].Split(']')[1].Length > 4)) - continue; //Delete useless UDP listening ports + void PrintListeningPortsUdp(Dictionary processesByPid) + { + Beaprint.MainPrint("Current UDP Listening Ports"); + Beaprint.LinkPrint("", "Check for services restricted from the outside"); - Beaprint.AnsiPrint($" {conn[0],-10}{conn[1],-23}{conn[2],-23}{conn[3]}", colorsN); + PrintListeningPortsUdpIPv4(processesByPid); + Beaprint.ColorPrint("", Beaprint.NOCOLOR); + PrintListeningPortsUdpIPv6(processesByPid); + } + + private void PrintListeningPortsUdpIPv4(Dictionary processesByPid) + { + try + { + Beaprint.ColorPrint(" Enumerating IPv4 connections\n", Beaprint.LBLUE); + + string formatString = @"{0,-12} {1,-21} {2,-13} {3,-30} {4,-17} {5}"; + + Beaprint.NoColorPrint( + string.Format($"{formatString}\n", " Protocol", "Local Address", "Local Port", "Remote Address:Remote Port", "Process ID", "Process Name")); + + foreach (var udpConnectionInfo in NetworkInfoHelper.GetUdpConnections(IPVersion.IPv4, processesByPid)) + { + Beaprint.AnsiPrint( + string.Format($"{formatString}", + " UDP", + udpConnectionInfo.LocalAddress, + udpConnectionInfo.LocalPort, + "*:*", // UDP does not have remote address/port + udpConnectionInfo.ProcessId, + udpConnectionInfo.ProcessName + ), + colorsN); + } + } + catch (Exception ex) + { + Beaprint.PrintException(ex.Message); + } + } + + private void PrintListeningPortsUdpIPv6(Dictionary processesByPid) + { + try + { + Beaprint.ColorPrint(" Enumerating IPv6 connections\n", Beaprint.LBLUE); + + string formatString = @"{0,-12} {1,-43} {2,-13} {3,-30} {4,-17} {5}"; + + Beaprint.NoColorPrint( + string.Format($"{formatString}\n", " Protocol", "Local Address", "Local Port", "Remote Address:Remote Port", "Process ID", "Process Name")); + + foreach (var udpConnectionInfo in NetworkInfoHelper.GetUdpConnections(IPVersion.IPv6, processesByPid)) + { + Beaprint.AnsiPrint( + string.Format($"{formatString}", + " UDP", + $"[{udpConnectionInfo.LocalAddress}]", + udpConnectionInfo.LocalPort, + "*:*", // UDP does not have remote address/port + udpConnectionInfo.ProcessId, + udpConnectionInfo.ProcessName + ), + colorsN); } } catch (Exception ex) diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/IPVersion.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/IPVersion.cs new file mode 100644 index 0000000..af39a87 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/IPVersion.cs @@ -0,0 +1,8 @@ +namespace winPEAS.Info.NetworkInfo.Enums +{ + public enum IPVersion + { + IPv4, + IPv6 + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/MibTcpState.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/MibTcpState.cs new file mode 100644 index 0000000..c139ec8 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/MibTcpState.cs @@ -0,0 +1,46 @@ +using System.ComponentModel; + +namespace winPEAS.Info.NetworkInfo +{ + public enum MibTcpState + { + [Description("None")] + NONE = 0, + + [Description("Closed")] + CLOSED = 1, + + [Description("Listening")] + LISTEN = 2, + + [Description("SYN Sent")] + SYN_SENT = 3, + + [Description("SYN Received")] + SYN_RCVD = 4, + + [Description("Established")] + ESTAB = 5, + + [Description("FIN Wait 1")] + FIN_WAIT1 = 6, + + [Description("FIN Wait 2")] + FIN_WAIT2 = 7, + + [Description("Close Wait")] + CLOSE_WAIT = 8, + + [Description("Closing")] + CLOSING = 9, + + [Description("Last ACK")] + LAST_ACK = 10, + + [Description("Time Wait")] + TIME_WAIT = 11, + + [Description("Delete TCB")] + DELETE_TCB = 12 + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/Protocol.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/Protocol.cs new file mode 100644 index 0000000..fb799ee --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/Protocol.cs @@ -0,0 +1,8 @@ +namespace winPEAS.Info.NetworkInfo.Enums +{ + public enum Protocol + { + TCP, + UDP + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/TcpTableClass.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/TcpTableClass.cs new file mode 100644 index 0000000..39512fc --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/TcpTableClass.cs @@ -0,0 +1,15 @@ +namespace winPEAS.Info.NetworkInfo.Enums +{ + public enum TcpTableClass + { + TCP_TABLE_BASIC_LISTENER, + TCP_TABLE_BASIC_CONNECTIONS, + TCP_TABLE_BASIC_ALL, + TCP_TABLE_OWNER_PID_LISTENER, + TCP_TABLE_OWNER_PID_CONNECTIONS, + TCP_TABLE_OWNER_PID_ALL, + TCP_TABLE_OWNER_MODULE_LISTENER, + TCP_TABLE_OWNER_MODULE_CONNECTIONS, + TCP_TABLE_OWMER_MODULE_ALL + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/UdpTableClass.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/UdpTableClass.cs new file mode 100644 index 0000000..e7af097 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Enums/UdpTableClass.cs @@ -0,0 +1,9 @@ +namespace winPEAS.Info.NetworkInfo.Enums +{ + public enum UdpTableClass + { + UDP_TABLE_BASIC, + UDP_TABLE_OWNER_PID, + UDP_TABLE_OWNER_MODULE + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkConnection.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkConnection.cs new file mode 100644 index 0000000..59ab91f --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkConnection.cs @@ -0,0 +1,30 @@ +using System.Net; +using System.Runtime.InteropServices; +using winPEAS.Info.NetworkInfo.Enums; + +namespace winPEAS.Info.NetworkInfo +{ + [StructLayout(LayoutKind.Sequential)] + public abstract class NetworkConnection + { + public virtual Protocol Protocol { get; set; } + public virtual IPAddress LocalAddress { get; set; } + public virtual ushort LocalPort { get; set; } + public virtual int ProcessId { get; set; } + public virtual string ProcessName { get; set; } + + public NetworkConnection( + Protocol protocol, + IPAddress localAddress, + ushort localPort, + int processId, + string processName) + { + Protocol = protocol; + LocalAddress = localAddress; + LocalPort = localPort; + ProcessId = processId; + ProcessName = processName; + } + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkInfoHelper.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkInfoHelper.cs index 32f109f..b07c2b1 100644 --- a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkInfoHelper.cs +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/NetworkInfoHelper.cs @@ -1,16 +1,31 @@ using System; using System.Collections.Generic; +using System.Diagnostics; using System.Linq; using System.Management; using System.Net; using System.Net.NetworkInformation; using System.Runtime.InteropServices; using winPEAS.Helpers; +using winPEAS.Info.NetworkInfo.Enums; +using winPEAS.Info.NetworkInfo.Structs; namespace winPEAS.Info.NetworkInfo { class NetworkInfoHelper { + // https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket + private const int AF_INET = 2; + private const int AF_INET6 = 23; + + [DllImport("iphlpapi.dll", CharSet = CharSet.Auto, SetLastError = true)] + private static extern uint GetExtendedTcpTable(IntPtr pTcpTable, ref int pdwSize, + bool bOrder, int ulAf, TcpTableClass tableClass, uint reserved = 0); + + [DllImport("iphlpapi.dll", CharSet = CharSet.Auto, SetLastError = true)] + private static extern uint GetExtendedUdpTable(IntPtr pUdpTable, ref int pdwSize, + bool bOrder, int ulAf, UdpTableClass tableClass, uint reserved = 0); + [DllImport("IpHlpApi.dll")] [return: MarshalAs(UnmanagedType.U4)] internal static extern int GetIpNetTable(IntPtr pIpNetTable, [MarshalAs(UnmanagedType.U4)]ref int pdwSize, bool bOrder); @@ -296,6 +311,237 @@ namespace winPEAS.Info.NetworkInfo Beaprint.PrintException(ex.Message); } return results; + } + + public static List GetTcpConnections(IPVersion ipVersion, Dictionary processesByPid = null) + { + int bufferSize = 0; + List tcpTableRecords = new List(); + + int ulAf = AF_INET; + + if (ipVersion == IPVersion.IPv6) + { + ulAf = AF_INET6; + } + + // Getting the initial size of TCP table. + uint result = GetExtendedTcpTable(IntPtr.Zero, ref bufferSize, true, ulAf, TcpTableClass.TCP_TABLE_OWNER_PID_ALL); + + // Allocating memory as an IntPtr with the bufferSize. + IntPtr tcpTableRecordsPtr = Marshal.AllocHGlobal(bufferSize); + + try + { + // The IntPtr from last call, tcpTableRecoresPtr must be used in the subsequent + // call and passed as the first parameter. + result = GetExtendedTcpTable(tcpTableRecordsPtr, ref bufferSize, true, ulAf, TcpTableClass.TCP_TABLE_OWNER_PID_ALL); + + // If not zero, the call failed. + if (result != 0) + { + return new List(); + } + + // Marshals data fron an unmanaged block of memory to the + // newly allocated managed object 'tcpRecordsTable' of type + // 'MIB_TCPTABLE_OWNER_PID' to get number of entries of TCP + // table structure. + + // Determine if IPv4 or IPv6. + if (ipVersion == IPVersion.IPv4) + { + MIB_TCPTABLE_OWNER_PID tcpRecordsTable = (MIB_TCPTABLE_OWNER_PID) Marshal.PtrToStructure(tcpTableRecordsPtr, typeof(MIB_TCPTABLE_OWNER_PID)); + + IntPtr tableRowPtr = (IntPtr)((long)tcpTableRecordsPtr + Marshal.SizeOf(tcpRecordsTable.dwNumEntries)); + + // Read and parse the TCP records from the table and store them in list + // 'TcpConnection' structure type objects. + for (int row = 0; row < tcpRecordsTable.dwNumEntries; row++) + { + MIB_TCPROW_OWNER_PID tcpRow = (MIB_TCPROW_OWNER_PID)Marshal.PtrToStructure(tableRowPtr, typeof(MIB_TCPROW_OWNER_PID)); + + // Add row to list of TcpConnetions. + tcpTableRecords.Add(new TcpConnectionInfo( + Protocol.TCP, + new IPAddress(tcpRow.localAddr), + new IPAddress(tcpRow.remoteAddr), + BitConverter.ToUInt16(new byte[2] { + tcpRow.localPort[1], + tcpRow.localPort[0] }, 0), + BitConverter.ToUInt16(new byte[2] { + tcpRow.remotePort[1], + tcpRow.remotePort[0] }, 0), + tcpRow.owningPid, + tcpRow.state, + GetProcessNameByPid(tcpRow.owningPid, processesByPid))); + + tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(tcpRow)); + } + } + else if (ipVersion == IPVersion.IPv6) + { + MIB_TCP6TABLE_OWNER_PID tcpRecordsTable = (MIB_TCP6TABLE_OWNER_PID) Marshal.PtrToStructure(tcpTableRecordsPtr, typeof(MIB_TCP6TABLE_OWNER_PID)); + + IntPtr tableRowPtr = (IntPtr)((long)tcpTableRecordsPtr + Marshal.SizeOf(tcpRecordsTable.dwNumEntries)); + + // Read and parse the TCP records from the table and store them in list + // 'TcpConnection' structure type objects. + for (int row = 0; row < tcpRecordsTable.dwNumEntries; row++) + { + MIB_TCP6ROW_OWNER_PID tcpRow = (MIB_TCP6ROW_OWNER_PID)Marshal.PtrToStructure(tableRowPtr, typeof(MIB_TCP6ROW_OWNER_PID)); + + tcpTableRecords.Add(new TcpConnectionInfo( + Protocol.TCP, + new IPAddress(tcpRow.localAddr, tcpRow.localScopeId), + new IPAddress(tcpRow.remoteAddr, tcpRow.remoteScopeId), + BitConverter.ToUInt16(new byte[2] { + tcpRow.localPort[1], + tcpRow.localPort[0] }, 0), + BitConverter.ToUInt16(new byte[2] { + tcpRow.remotePort[1], + tcpRow.remotePort[0] }, 0), + tcpRow.owningPid, + tcpRow.state, + GetProcessNameByPid(tcpRow.owningPid, processesByPid))); + + tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(tcpRow)); + } + } + } + catch (OutOfMemoryException outOfMemoryException) + { + throw outOfMemoryException; + } + catch (Exception exception) + { + throw exception; + } + finally + { + Marshal.FreeHGlobal(tcpTableRecordsPtr); + } + + return tcpTableRecords != null ? tcpTableRecords.Distinct().ToList() : new List(); + } + + public static IEnumerable GetUdpConnections(IPVersion ipVersion, Dictionary processesByPid = null) + { + int bufferSize = 0; + List udpTableRecords = new List(); + + int ulAf = AF_INET; + + if (ipVersion == IPVersion.IPv6) + { + ulAf = AF_INET6; + } + + // Getting the initial size of UDP table. + uint result = GetExtendedUdpTable(IntPtr.Zero, ref bufferSize, true, ulAf, UdpTableClass.UDP_TABLE_OWNER_PID); + + // Allocating memory as an IntPtr with the bufferSize. + IntPtr udpTableRecordsPtr = Marshal.AllocHGlobal(bufferSize); + + try + { + // The IntPtr from last call, udpTableRecoresPtr must be used in the subsequent + // call and passed as the first parameter. + result = GetExtendedUdpTable(udpTableRecordsPtr, ref bufferSize, true, ulAf, UdpTableClass.UDP_TABLE_OWNER_PID); + + // If not zero, call failed. + if (result != 0) + { + return new List(); + } + + // Marshals data fron an unmanaged block of memory to the + // newly allocated managed object 'udpRecordsTable' of type + // 'MIB_UDPTABLE_OWNER_PID' to get number of entries of TCP + // table structure. + + // Determine if IPv4 or IPv6. + if (ipVersion == IPVersion.IPv4) + { + MIB_UDPTABLE_OWNER_PID udpRecordsTable = (MIB_UDPTABLE_OWNER_PID) Marshal.PtrToStructure(udpTableRecordsPtr, typeof(MIB_UDPTABLE_OWNER_PID)); + IntPtr tableRowPtr = (IntPtr)((long)udpTableRecordsPtr + Marshal.SizeOf(udpRecordsTable.dwNumEntries)); + + // Read and parse the UDP records from the table and store them in list + // 'UdpConnection' structure type objects. + for (int i = 0; i < udpRecordsTable.dwNumEntries; i++) + { + MIB_UDPROW_OWNER_PID udpRow = (MIB_UDPROW_OWNER_PID) Marshal.PtrToStructure(tableRowPtr, typeof(MIB_UDPROW_OWNER_PID)); + udpTableRecords.Add(new UdpConnectionInfo( + Protocol.UDP, + new IPAddress(udpRow.localAddr), + BitConverter.ToUInt16(new byte[2] { udpRow.localPort[1], + udpRow.localPort[0] }, 0), + udpRow.owningPid, + GetProcessNameByPid(udpRow.owningPid, processesByPid))); + + tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(udpRow)); + } + } + else if (ipVersion == IPVersion.IPv6) + { + MIB_UDP6TABLE_OWNER_PID udpRecordsTable = (MIB_UDP6TABLE_OWNER_PID) + Marshal.PtrToStructure(udpTableRecordsPtr, typeof(MIB_UDP6TABLE_OWNER_PID)); + IntPtr tableRowPtr = (IntPtr)((long)udpTableRecordsPtr + + Marshal.SizeOf(udpRecordsTable.dwNumEntries)); + + // Read and parse the UDP records from the table and store them in list + // 'UdpConnection' structure type objects. + for (int i = 0; i < udpRecordsTable.dwNumEntries; i++) + { + MIB_UDP6ROW_OWNER_PID udpRow = (MIB_UDP6ROW_OWNER_PID) + Marshal.PtrToStructure(tableRowPtr, typeof(MIB_UDP6ROW_OWNER_PID)); + udpTableRecords.Add(new UdpConnectionInfo( + Protocol.UDP, + new IPAddress(udpRow.localAddr, udpRow.localScopeId), + BitConverter.ToUInt16(new byte[2] { + udpRow.localPort[1], + udpRow.localPort[0] }, 0), + udpRow.owningPid, + GetProcessNameByPid(udpRow.owningPid, processesByPid))); + tableRowPtr = (IntPtr)((long)tableRowPtr + Marshal.SizeOf(udpRow)); + } + } + } + catch (OutOfMemoryException outOfMemoryException) + { + throw outOfMemoryException; + } + catch (Exception exception) + { + throw exception; + } + finally + { + Marshal.FreeHGlobal(udpTableRecordsPtr); + } + + return udpTableRecords != null ? udpTableRecords.Distinct().ToList() : new List(); + } + + private static string GetProcessNameByPid(int pid, Dictionary processesByPid = null) + { + if (processesByPid != null && processesByPid.ContainsKey(pid)) + { + var process = processesByPid[pid]; + var processName = process.ProcessName; + + try + { + processName = process.MainModule?.FileName; + } + catch (System.Exception ex) + { + } + + return processName; + } + + return string.Empty; } } } diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6ROW_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6ROW_OWNER_PID.cs new file mode 100644 index 0000000..b1c5272 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6ROW_OWNER_PID.cs @@ -0,0 +1,21 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_TCP6ROW_OWNER_PID + { + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] + public byte[] localAddr; + public uint localScopeId; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] localPort; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] + public byte[] remoteAddr; + public uint remoteScopeId; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] remotePort; + public MibTcpState state; + public int owningPid; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6TABLE_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6TABLE_OWNER_PID.cs new file mode 100644 index 0000000..89fcf85 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCP6TABLE_OWNER_PID.cs @@ -0,0 +1,12 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_TCP6TABLE_OWNER_PID + { + public uint dwNumEntries; + [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct, SizeConst = 1)] + public MIB_TCP6ROW_OWNER_PID[] table; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPROW_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPROW_OWNER_PID.cs new file mode 100644 index 0000000..9757ef0 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPROW_OWNER_PID.cs @@ -0,0 +1,17 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_TCPROW_OWNER_PID + { + public MibTcpState state; + public uint localAddr; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] localPort; + public uint remoteAddr; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] remotePort; + public int owningPid; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPTABLE_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPTABLE_OWNER_PID.cs new file mode 100644 index 0000000..09d887c --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_TCPTABLE_OWNER_PID.cs @@ -0,0 +1,12 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_TCPTABLE_OWNER_PID + { + public uint dwNumEntries; + [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct, SizeConst = 1)] + public MIB_TCPROW_OWNER_PID[] table; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6ROW_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6ROW_OWNER_PID.cs new file mode 100644 index 0000000..da452b5 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6ROW_OWNER_PID.cs @@ -0,0 +1,15 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_UDP6ROW_OWNER_PID + { + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] + public byte[] localAddr; + public uint localScopeId; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] localPort; + public int owningPid; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6TABLE_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6TABLE_OWNER_PID.cs new file mode 100644 index 0000000..aadf10d --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDP6TABLE_OWNER_PID.cs @@ -0,0 +1,12 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_UDP6TABLE_OWNER_PID + { + public uint dwNumEntries; + [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct,SizeConst = 1)] + public MIB_UDP6ROW_OWNER_PID[] table; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPROW_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPROW_OWNER_PID.cs new file mode 100644 index 0000000..b2eca7c --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPROW_OWNER_PID.cs @@ -0,0 +1,13 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_UDPROW_OWNER_PID + { + public uint localAddr; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] localPort; + public int owningPid; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPTABLE_OWNER_PID.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPTABLE_OWNER_PID.cs new file mode 100644 index 0000000..24d85dd --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Structs/MIB_UDPTABLE_OWNER_PID.cs @@ -0,0 +1,12 @@ +using System.Runtime.InteropServices; + +namespace winPEAS.Info.NetworkInfo.Structs +{ + [StructLayout(LayoutKind.Sequential)] + public struct MIB_UDPTABLE_OWNER_PID + { + public uint dwNumEntries; + [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct,SizeConst = 1)] + public MIB_UDPROW_OWNER_PID[] table; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/TcpConnectionInfo.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/TcpConnectionInfo.cs new file mode 100644 index 0000000..e08b56c --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/TcpConnectionInfo.cs @@ -0,0 +1,23 @@ +using System.Net; +using System.Runtime.InteropServices; +using winPEAS.Info.NetworkInfo.Enums; + +namespace winPEAS.Info.NetworkInfo +{ + [StructLayout(LayoutKind.Sequential)] + public class TcpConnectionInfo : NetworkConnection + { + public IPAddress RemoteAddress { get; set; } + public ushort RemotePort { get; set; } + public MibTcpState State { get; set; } + + public TcpConnectionInfo(Protocol protocol, IPAddress localAddress, IPAddress remoteIp, ushort localPort, + ushort remotePort, int pId, MibTcpState state, string processName) + : base(protocol, localAddress, localPort, pId, processName) + { + RemoteAddress = remoteIp; + RemotePort = remotePort; + State = state; + } + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/UdpConnectionInfo.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/UdpConnectionInfo.cs new file mode 100644 index 0000000..73ae1d6 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/UdpConnectionInfo.cs @@ -0,0 +1,15 @@ +using System.Net; +using System.Runtime.InteropServices; +using winPEAS.Info.NetworkInfo.Enums; + +namespace winPEAS.Info.NetworkInfo +{ + [StructLayout(LayoutKind.Sequential)] + public class UdpConnectionInfo : NetworkConnection + { + public UdpConnectionInfo(Protocol protocol, IPAddress localAddress, ushort localPort, int pId, string processName) + : base(protocol, localAddress, localPort, pId, processName) + { + } + } +} diff --git a/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Win32Error.cs b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Win32Error.cs new file mode 100644 index 0000000..6da3c18 --- /dev/null +++ b/winPEAS/winPEASexe/winPEAS/Info/NetworkInfo/Win32Error.cs @@ -0,0 +1,17 @@ +namespace winPEAS.Info.NetworkInfo +{ + // Defined at https://msdn.microsoft.com/en-us/library/cc231199.aspx + internal class Win32Error + { + public const int Success = 0; + public const int NERR_Success = 0; + public const int AccessDenied = 0x0000005; + public const int NotEnoughMemory = 0x00000008; + public const int InsufficientBuffer = 0x0000007A; + public const int MoreData = 0x00000EA; + public const int NoSuchAlias = 0x0000560; + public const int RpcServerUnavailable = 0x0006BA; + public const int NERR_GroupNotFound = 0x00008AC; + public const int NERR_InvalidComputer = 0x000092F; + } +} diff --git a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj index 032c93d..59f2360 100755 --- a/winPEAS/winPEASexe/winPEAS/winPEAS.csproj +++ b/winPEAS/winPEASexe/winPEAS/winPEAS.csproj @@ -402,6 +402,23 @@ + + + + + + + + + + + + + + + + +