Audit 7 Script

<# 
                                           
   #              #      # # #     #       # # #
    #            #        #       # #     #
     #     #    #        #       #   #   #
      #	 #  #  #        #       #     # #   
     	#     #       # # #    #Â Â      #Â 
	 
 2018
#>

[Console]::ForegroundColor="White"
[Console]::BackGroundColor="Black"
<#
[System.String]$scriptDirectoryPath  = split-path -parent $MyInvocation.MyCommand.Definition
[System.String]$secpolFilePath       = join-path $scriptDirectoryPath "secedit.log"
[System.String]$reportFilePath       = join-path $scriptDirectoryPath "report-$env:COMPUTERNAME.txt"
[System.String]$exceptionsFilePath   = join-path $scriptDirectoryPath "exceptions-$env:COMPUTERNAME.txt"
#>
[System.String]$culture=(Get-Culture).Name

$PSVersion=$PSVersionTable.PSVersion.Major

[int]$systemRoleID = $(get-wmiObject -Class Win32_ComputerSystem).DomainRole



$systemRoles = @{
                              0         =    " Standalone Workstation    " ;
                              1         =    " Member Workstation        " ;
                              2         =    " Standalone Server         " ;
                              3         =    " Member Server             " ;
                              4         =    " Backup  Domain Controller " ;
                              5         =    " Primary Domain Controller "       
}


$permissionFlags = @{
                            0x1         =     "Read-List";
                            0x2         =     "Write-Create";
                    	    0x4         =     "Append-Create Subdirectory";                  	
                    	   0x20         =     "Execute file-Traverse directory";
                	   0x40         =     "Delete child"
                        0x10000         =     "Delete";                     
                        0x40000         =     "Write access to DACL";
                        0x80000         =     "Write Onwer"
}



$aceTypes = @{ 
                             0           =     "Allow";
                             1           =     "Deny"
 }





function initialize-audit {
    
    #clear-host
     
    $A = (Get-Date -Year 2022 -Month 03 -Day 31  )

 $X = Get-Date

if($X -GT $A -eq 'False')
{
    Write-Warning "Your Licesne Expired."
    sleep -s 4
    return
}
else
{

    Write-Warning "You Can Continue With Your License"
    sleep -s 2
}

sleep -s 2

   
   SecEdit.exe /export /cfg $secpolFilePath /quiet
     
    $start = get-date 
    
    sleep 1 
	
	write-host "Present by Viraj Kishor Mota"
	
	sleep 2
   
 
  write-host "Starting Audit at", $start
    
    "-------------------------------------`n"
   
    
  Write-Host "[?] Checking for System Info - Summary..`n" -ForegroundColor black -BackgroundColor white

    
  #  Get-CimInstance Win32_OperatingSystem | Select-Object  Caption, InstallDate, ServicePackMajorVersion, OSArchitecture, BootDevice,  BuildNumber, CSName | FL
 
   gwmi win32_operatingsystem |  select CSName, caption, OSArchitecture, PSStatus, OSType, Version,
BuildNumber, SystemDirectory | fl *
  
   
   # Get-CimInstance Win32_OperatingSystem | FL *


    Write-Host "[?] Checking for password policy ..`n" -ForegroundColor black -BackgroundColor white 
    net accounts

    sleep 1

    Write-Host "[?] Checking for net shares`n" -ForegroundColor black -BackgroundColor white 
    net share

    sleep 1



    Write-Host "[?] Checking for local groups`n" -ForegroundColor black -BackgroundColor white 
    net localgroup

    Write-Host "[?] Checking for installed programs`n" -ForegroundColor black -BackgroundColor white 
    Get-WmiObject -Class Win32_Product

    sleep 1

    Write-Host "[?] Checking for administrative privileges ..`n" -ForegroundColor black -BackgroundColor white 

    $isAdmin = ([System.Security.Principal.WindowsPrincipal][System.Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    
    if(!$isAdmin){
            
            Write-Warning  "[-] Some of the operations need administrative privileges.`n"
            
            Write-Warning  "[*] Please run the script using an administrative account.`n"
            
            Read-Host "Type any key to continue .."

            exit
    }
    
    write-host "[?] Checking for Default PowerShell version ..`n" -ForegroundColor black -BackgroundColor white 
      sleep 1

    if($PSVersion -lt 2){
       
            Write-Warning  "[!] You have PowerShell v1.0.`n"
        
            Write-Warning  "[!] This script only supports Powershell verion 2 or above.`n"
        
            read-host "Type any key to continue .."
        
            exit  
    }
   
    write-host "       [+] ----->  PowerShell v$PSVersion`n" 
  
    write-host "[?] Detecting system role ..`n" -ForegroundColor black -BackgroundColor white 
  
    $systemRoleID = $(get-wmiObject -Class Win32_ComputerSystem).DomainRole
     
    write-host "       [+] ----->",$systemRoles[[int]$systemRoleID],"`n" 
   
    
    get-LocalSecurityProducts
    
    get-WorldExposedLocalShares 
    
    if($systemRoleID -eq 1){
    	check-LocalMembership
    }
    
   # check-UACLevel
    
   # check-autoruns
    
  #get-ConfigurableServices   	   -display
    
   # get-UnquotedPathServices       -display
    
   # check-HostedServices           -display
    
   # check-DLLHijackability     
    
  #  check-UnattendedInstallFiles
   
    # check-scheduledTasks
   
   <#
     Write-Host "[?] Checking for disk volumnes`n" -ForegroundColor black -BackgroundColor white 
    
    Get-Volume 
    sleep 1
#>
    Write-Host "[?] Checking for screen saver with password protection`n" -ForegroundColor black -BackgroundColor white
   # Get-CimInstance win32_desktop | where name -eq (whoami)
   
   Get-Wmiobject win32_desktop 

    
     $fin = get-date
    
    "`n[!] Done`n"
    
    "`n[!] Thank you!`n"
    "Audit completed in {0} seconds. `n" -f $(New-TimeSpan -Start $start -End $fin ).TotalSeconds
    
}


function get-LocalSecurityProducts
{
      <#    
       .SYNOPSIS		
	   Gets Windows Firewall Profile status and checks for installed third party security products.
			
       .DESCRIPTION
           This function operates by examining registry keys specific to the Windows Firewall and by using the 
        Windows Security Center to get information regarding installed security products. 
	            
       .NOTE
           The documentation in the msdn is not very clear regarding the productState property provided by
        the SecurityCenter2 namespace. For this reason, this function only uses available informations that were obtained by testing 
        different security products againt the Windows API. 
                            
       .LINK
           http://neophob.com/2010/03/wmi-query-windows-securitycenter2
     #>


      $firewallPolicySubkey="HKLM:\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy"
               
      Write-host "`n[?] Checking if Windows Firewall is enabled ..`n"     -ForegroundColor black -BackgroundColor white 
              
      Write-host "       [?] Checking Firewall Profiles ..`n" -ForegroundColor black -BackgroundColor white 
      
      try{
      		
		if(Test-Path -Path $($firewallPolicySubkey+"\StandardProfile")){
              
            		   $enabled = $(Get-ItemProperty -Path $($firewallPolicySubkey+"\StandardProfile") -Name EnableFirewall).EnableFirewall  
              
                           if($enabled -eq 1){$standardProfile="Enabled"}else{$standardProfile="Disabled"}
              
                           "                   [*] Standard Profile  Firewall     :  {0}.`n" -f $standardProfile
                }else{
                    
                                         Write-Warning  "       [-] Could not find Standard Profile Registry Subkey.`n"
              
	        }    
                
                if(Test-Path -Path $($firewallPolicySubkey+"\PublicProfile")){
                   
                           $enabled = $(Get-ItemProperty -Path $($firewallPolicySubkey+"\PublicProfile") -Name EnableFirewall).EnableFirewall  
                           
                           if($enabled -eq 1){$publicProfile="Enabled"}else{$publicProfile="Disabled"}
                           
                           "                   [*] Public   Profile  Firewall     :  {0}.`n" -f $publicProfile
                }else{         
			   Write-Warning "       [-] Could not find Public Profile Registry Subkey.`n"
             
                }

                if(Test-Path -Path $($firewallPolicySubkey+"\DomainProfile")){
                     
                           $enabled = (Get-ItemProperty -Path $($firewallPolicySubkey+"\DomainProfile") -Name EnableFirewall).EnableFirewall  
              
                           if($enabled -eq 1){$domainProfile="Enabled"}else{$domainProfile="Disabled"}
              
                           "                   [*] Domain   Profile  Firewall     :  {0}.`n`n" -f $domainProfile
                }else{       
                          Write-Warning  "       [-] Could not find Private Profile Registry Subkey.`n`n"          
	        }              
               
                 
            
     
      }catch{
              $errorMessage = $_.Exception.Message
            
              $failedItem   = $_.Exception.ItemName

              "[-] Exception : "| Set-Content $exceptionsFilePath
              
              "[*] Error Message : `n",$errorMessage | Set-Content $exceptionsFilePath
              
              "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
      	      Write-Warning -Message "[-] Error : Could not check Windows Firewall registry informations .`n`n"	
      }       
            
      
      $SecurityProvider=@{         
                                "00"     =   "None";
                                "01"     =   "Firewall";
                                "02"     =   "AutoUpdate_Settings";
                                "04"     =   "AntiVirus";           
                                "08"     =   "AntiSpyware";
                                "10"     =   "Internet_Settings";
                                "20"     =   "User_Account_Control";
                                "40"     =   "Service"
      }
               
               
      $RealTimeBehavior = @{                              
                                "00"    =    "Off";
                                "01"    =    "Expired";
                                "10"    =    "ON";
                                "11"    =    "Snoozed"
      }
               
     
      $DefinitionStatus = @{
                                "00"     =     "Up-to-date";
                                "10"     =     "Out-of-date"
               
      }
               
      $securityCenterNS="root\SecurityCenter"
             
      [System.Version]$OSVersion=(Get-WmiObject -class Win32_operatingsystem).Version
              
      if($OSVersion -gt [System.Version]'6.0.0.0'){$SecurityCenterNS+="2"}
              
      # checks for third party firewall products 
 
      Write-host "`n[?] Checking for third party Firewall products .. `n" -ForegroundColor Black -BackgroundColor White
              
      
      try {  
            
             $firewalls= @(Get-WmiObject -Namespace $securityCenterNS -class FirewallProduct)
           
             if($firewalls.Count -eq 0){
           
	            "       [-] No other firewall installed.`n"
             }else{
             
                    "       [+] Found {0} third party firewall products.`n"  -f $($firewalls.Count)    
            
                    Write-host "            [?] Checking for product configuration ...`n" -ForegroundColor black -BackgroundColor white 
            
                    $firewalls| % {
                          
                          # The structure of the API is different depending on the version of the SecurityCenter Namespace
                          if($securityCenterNS.endswith("2")){
                                            
                                       [int]$productState=$_.ProductState
                          
                        	       $hexString=[System.Convert]::toString($productState,16).padleft(6,'0')
                          	
                                       $provider=$hexString.substring(0,2)
                          
                                       $realTimeProtec=$hexString.substring(2,2)
                          
                                       $definition=$hexString.substring(4,2)
                                         
                                       "                     [+] Product Name          : {0}."     -f $_.displayName
                                       "                     [+] Service Type          : {0}."     -f $SecurityProvider[[String]$provider]
                                       "                     [+] State                 : {0}.`n`n" -f $RealTimeBehavior[[String]$realTimeProtec]

                          }else{
                            
                                       "                     [+] Company Name           : {0}."     -f $_.CompanyName
                                       "                     [+] Product Name           : {0}."     -f $_.displayName
                                       "                     [+] State                  : {0}.`n`n" -f $_.enabled

                          }

                    }
              
              }
            
              sleep 2
  
              # checks for antivirus products

              Write-host "`n[?] Checking for installed antivirus products ..`n"-ForegroundColor Black -BackgroundColor white 

              $antivirus=@(Get-WmiObject -Namespace $securityCenterNS -class AntiVirusProduct)
              
              if($antivirus.Count -eq 0){
                
                                "       [-] No antivirus product installed.`n`n"      
              
              }else{
                                "       [+] Found {0} AntiVirus solutions.`n" -f $($antivirus.Count)
              
                                Write-host "            [?] Checking for product configuration ..`n" -ForegroundColor black -BackgroundColor white 
              
             			$antivirus|%{
                                                if($securityCenterNS.endswith("2")){
                                            
                                                	 [int]$productState=$_.ProductState
                                       
                                      			 $hexString=[System.Convert]::toString($productState,16).padleft(6,'0')
                                       
                                                         $provider=$hexString.substring(0,2)
                                       
                                                         $realTimeProtec=$hexString.substring(2,2)
                                       
                                                         $definition=$hexString.substring(4,2)
                                         
                                                         "                     [+] Product Name          : {0}."     -f $_.displayName
                                                         "                     [+] Service Type          : {0}."     -f $SecurityProvider[[String]$provider]
                                                         "                     [+] Real Time Protection  : {0}."     -f $RealTimeBehavior[[String]$realTimeProtec]
                                                         "                     [+] Signature Definitions : {0}.`n`n" -f $DefinitionStatus[[String]$definition]
                                                                     
                                                }else{
                            
                                                         "                     [+] Company Name           : {0}."     -f $_.CompanyName
                                                         "                     [+] Product Name           : {0}."     -f $_.displayName
                                                         "                     [+] Real Time Protection   : {0}."     -f $_.onAccessScanningEnabled
                                                         "                     [+] Product up-to-date     : {0}.`n`n" -f $_.productUpToDate
                                                }

                                }
               
                
              }


              # Checks for antispyware products

	      Write-host "`n[?] Checking for installed antispyware products ..`n"-ForegroundColor Black -BackgroundColor white 
            
              $antispyware=@(Get-WmiObject -Namespace $securityCenterNS -class AntiSpywareProduct)
         
              if($antispyware.Count -eq 0){
          
                                "       [-] No antiSpyware product installed.`n`n"     
         
              }else{
                                "       [+] Found {0} antiSpyware solutions.`n" -f $($antiSpyware.Count)

                                Write-host "            [?] Checking for product configuration ..`n" -ForegroundColor black -BackgroundColor white 
          
                                $antispyware| % {
                		              
					       if($securityCenterNS.endswith("2")){
                                            
                                                         [int]$productState=$_.ProductState
                                         
                                        		 $hexString=[System.Convert]::toString($productState,16).padleft(6,'0')
                                         
                                                         $provider=$hexString.substring(0,2)
                                         
                                                         $realTimeProtec=$hexString.substring(2,2)
                                         
                                                         $definition=$hexString.substring(4,2)
                                         
                                         		 "                     [+] Product Name          : {0}."     -f $_.displayName
                                         		 "                     [+] Service Type          : {0}."     -f $SecurityProvider[[String]$provider]
                                         		 "                     [+] Real Time Protection  : {0}."     -f $RealTimeBehavior[[String]$realTimeProtec]
                                         		 "                     [+] Signature Definitions : {0}.`n`n" -f $DefinitionStatus[[String]$definition]
                                         
                               			}else{
                            
                                         		 "                     [+] Company Name           : {0}."     -f $_.CompanyName
                                         		 "                     [+] Product Name           : {0}."     -f $_.displayName
                                         		 "                     [+] Real Time Protection   : {0}."     -f $_.onAccessScanningEnabled
                                        		 "                     [+] Product up-to-date     : {0}.`n`n" -f $_.productUpToDate
                            
                                                }

                                }

              }

     
      }catch{
              
               $errorMessage = $_.Exception.Message
            
               $failedItem   = $_.Exception.ItemName

              "[-] Exception : "| Set-Content $exceptionsFilePath
              
              "[*] Error Message : `n",$errorMessage | Set-Content $exceptionsFilePath
              
              "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath

              
            
      }

}


function get-WorldExposedLocalShares
{
      <#
       .SYNOPSIS
           Gets informations about local shares and their associated DACLs.

       .DESCRIPTION
           This function checks local file system shares and collects informations about each 
	Access Control Entry (ACE) looking for those targeting the Everyone(Tout le monde) group.
            
       .NOTE
	  This function can be modified in a way that for each share we
        return its corresponding ace objects for further processing.

        .LINK
            https://msdn.microsoft.com/en-us/library/windows/desktop/aa374862(v=vs.85).aspx

      #>

    
        $exists = $false
   
        $rules=@()

        Write-Host "`n[?] Checking for World-exposed local shares ..`n" -ForegroundColor black -BackgroundColor White 

        try{
		  
                     Get-WmiObject -class Win32_share -Filter "type=0"|%{
                  
		    	     $rules=@()
                   
                             $shareName = $_.Name
                 
                             $shareSecurityObj = Get-WmiObject -class Win32_LogicalShareSecuritySetting -Filter "Name='$shareName'"
                   
                             $securityDescriptor = $shareSecurityObj.GetSecurityDescriptor().Descriptor
 
                             ForEach($ace in $securityDescriptor.dacl){
 
                                     # Looking for Everyone group (SID="S-1-1-0") permissions 
                                     $trusteeSID = (New-Object System.Security.Principal.SecurityIdentifier($ace.trustee.SID, 0)).Value.ToString()
                            
                                     
                                     if($trusteeSID -eq "S-1-1-0" -and $aceTypes[[int]$ace.aceType] -eq "Allow"){

                                                $accessMask  = $ace.accessmask
                            
                                                $permissions =""
                            
                                                foreach($flag in $permissionFlags.Keys){

                                                       if($flag -band $accessMask){
                                          
                                                                 $permissions+=$permissionFlags[$flag]
                                          
                                                                 $permissions+="$"
                                                       }
                                                }

                                                $rule = New-Object  PSObject -Property @{
                                
                                                             "ShareName"    =  $shareName     
                           		                     "Trustee"      =  $ace.trustee.Name 
                         		                     "Permissions"  =  $permissions
                                                }

                                                $rules+=$rule

                                                $exists=$true

                                     }
             
                           }

                           if($rules.Count -gt 0){
           
                                     "[*]-----------------------------------------------------------------------------[*]"
                               
                                      $rules| fl ShareName,Trustee,Permissions
            
                           }

                    }

                    if(!$exists){
        
                         "       [-] No local World-exposed shares were found .`n`n"
                    }
      
    
    
    
        }catch{
               
               $errorMessage = $_.Exception.Message
            
               $failedItem   = $_.Exception.ItemName

               "[-] Exception : "| Set-Content $exceptionsFilePath
              
               "[*] Error Message : `n",$errorMessage | Set-Content $exceptionsFilePath
              
               "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
               "[-] Unable to inspect local shares. "
        }

}





$global:local_member = $false

function check-LocalMembership
{
     <#
       .SYNOPSIS
           Gets domain users and groups with local group membership.
                        
       .DESCRIPTION
           This function checks local groups on the machine for domain users/groups who are members in a local group.
        It uses ADSI with the WinNT and LDAP providers to access user and group objects.
                  
       .NOTE 
           The machine must be a domain member. This is needed in order to resolve 
	the identity references of domain members.
            
     #>
           
           try{ 
           
                   write-host "`n[?] Checking for domain users with local group membership ..`n" -ForegroundColor Black -BackgroundColor White 

                   $adsi = [ADSI]"WinNT://$env:COMPUTERNAME"

                   $adsigroups= $adsi.Children|? {$_.SchemaClassName -eq "group"}

                   $adsigroups|%{
	   			
                              check-GroupLocalMembership $_
                   }

                   if($global:local_member -eq $false){
                    
           	                  "       [-] Found no domain user or group with local group membership."
                   }
            
                   "`n`n"
   
          }catch{
          
                   $errorMessage = $_.Exception.Message
            
                   $failedItem   = $_.Exception.ItemName

                   "[-] Exception : "| Set-Content $exceptionsFilePath
              
                   '[*] Error Message : `n',$errorMessage | Set-Content $exceptionsFilePath
              
                   "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
         
          }
   
}


function check-GroupLocalMembership($group)
{
    <# 
       .SYNOPSIS                                  
            Given a specific  ADSI group object, it checks whether it is a local or domain 
        group and looks fro its members.

       .DESCRIPTION                           
            This function is used by the get-LocalMembership function for inspecting nested
        groups membership.
                         
    #>

          $groupName=$group.GetType.Invoke().InvokeMember("Name","GetProperty", $null, $group, $null)
                      
          $GroupMembers = @($group.invoke("Members")) 
	  
	  $GroupMembers|% {                
                       
		       $adspath = $_.GetType.Invoke().InvokeMember("ADsPath", "GetProperty", $null, $_, $null)
                         
		       $sidBytes = $_.GetType.Invoke().InvokeMember("ObjectSID", "GetProperty", $null, $_, $null)
           
              	       $subjectName = (New-Object System.Security.Principal.SecurityIdentifier($sidBytes,0)).Translate([System.Security.Principal.NTAccount])

                       if($_.GetType.Invoke().InvokeMember("class", "GetProperty", $null, $_, $null) -eq "group"){

                                   # check if we have a local group object                                  
                                    if($adspath -match "/$env:COMPUTERNAME/") {

                                                 check-LocalGroupMembership $_

                                    }else{
                                                 # It is a domain group, no further processing needed                                                                                    
                                                 Write-Host "          [+] Domain group ",$subjectName," is a member in the",$groupName,"local group.`n"

                                                 $global:local_member=$true
                                    }


                       }else{
                                     # if not a group, then it must be a user
                                    if( !($adspath -match $env:COMPUTERNAME) ){

                                                   Write-Host "          [+] Domain user  ",$subjectName,"is a member of the",$groupName,"local group.`n"
                                        
                                                   $global:local_member=$true                                             
                                     }
                      }

          }

 


}

function check-UACLevel
{
        <#
           .SYNOPSIS
              Checks current configuration of User Account Control.

           .DESCRIPTION
              This functions inspects registry informations related to UAC configuration 
           and checks whether UAC is enabled and which level of operation is used.

       #>
        
          try{
                  
                  Write-Host "`n[?] Checking for UAC configuration ..`n" -ForegroundColor Black -BackgroundColor White
         
                  $UACRegValues = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
              
                  if([int]$UACRegValues.EnableLUA -eq 1){
             
                               "          [+] UAC is enabled.`n"
                  }else{
               
                               "          [-] UAC is disabled.`n"
               
                  }
                             
                  Write-Host "            [?]Checking for UAC level ..`n" -ForegroundColor black -BackgroundColor white 
  
                  $consentPrompt=$UACregValues.ConsentPromptBehaviorAdmin
              
                  $secureDesktop=$UACregValues.PromptOnSecureDesktop
               
                  if( $consentPrompt -eq 0 -and $secureDesktop -eq 0){
                            
                              "                          [*] UAC Level : Never Notify.`n`n"
          
	          }elseif($consentPrompt -eq 5 -and $secureDesktop -eq 0){
                          
                              "                          [*] UAC Level : Notify only when apps try to make changes (No secure desktop).`n`n"
              
                  }elseif($consentPrompt -eq 5 -and $secureDesktop -eq 1){
                          
                              "                          [*] UAC Level : Notify only when apps try to make changes (secure desktop on).`n`n"
              
                  }elseif($consentPrompt -eq 5 -and $secureDesktop -eq 2){
               
                              "                          [*] UAC Level : Always Notify with secure desktop.`n`n"
                  }

                  
         
         }catch{
         
                 $errorMessage = $_.Exception.Message
            
                 $failedItem   = $_.Exception.ItemName

                 "[-] Exception : "| Set-Content $exceptionsFilePath
              
                 '[*] Error Message : `n',$errorMessage | Set-Content $exceptionsFilePath
              
                 "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
         
        }


}

function check-autoruns {

       <#
         .SYNOPSIS
              Looks for autoruns specified in different places in the registry.
                         
         .DESCRIPTION
              This function inspects common registry keys used for autoruns.
          It examines the properties of these keys and report any found executables along with their pathnames.
                  
       #>


    
         $RegistryKeys = @( 
                            "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute",
                            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify",
                            "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit",
                            "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell",
                            "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell",
                            "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\",
                            "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\",
                            "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\",
                            "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\",
                            "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices",
                            "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce",
                            "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce",
                            "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load",
                            "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows",
                            "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler",
                            "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs"   # DLLs specified in this entry can hijack any process that uses user32.dll 
                            
                             # not sure if it is all we need to check!
                     )


         
         $exits=$false
         sleep -s 10

     Write-Host "`n[?] Checking registry keys for autoruns ..`n" -ForegroundColor Black -BackgroundColor White 

         try{
         
                $RegistryKeys | %{

                             $key = $_

                             if(Test-Path -Path $key){

                                          $executables = @{}

                                          [array]$properties = get-item $key | Select-Object -ExpandProperty Property

                                          if($properties.Count -gt 0){

                                                        "          [*] $key : "

                                                        foreach($exe in $properties) {

                                                                  $executables[$exe]=$($($(Get-ItemProperty $key).$exe)).replace('"','')

                                                        }

                                                        $executables | ft  @{Expression={$_.Name};Label="Executable"}, `
                                                                       @{Expression={$_.Value};Label="Path"}

                                                        $exits=$true
                                          }
                             }
                }



                if($exits -eq $false){

                          "          [-] Found no autoruns ."
                }

                "`n`n"
      
      }catch{
              
               $errorMessage = $_.Exception.Message
            
               $failedItem   = $_.Exception.ItemName

               "[-] Exception : "| Set-Content $exceptionsFilePath
              
               '[*] Error Message : `n',$errorMessage | Set-Content $exceptionsFilePath
              
               "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
      
      
      }

 
 }
 
 


function get-BinaryWritableServices
{
    param([switch]$display)
       
      <#
        .SYNOPSIS
           Gets services whose binaries are writable by Authenticated Users group members.
                    
        .DESCRIPTION
           This function checks services that have writable binaries and returns an array 
         containing service objects.
                
        .RETURNS
           When invoked without the $display switch, returns a hashtable of {name : pathname}
        couples.
         
     #>
        


         [array]$writableServices=@()

         # Services to be ignored are those in system32 subtree
         $services = Get-WmiObject -Class Win32_Service|?{$_.pathname -ne $null -and $_.pathname -notmatch ".*system32.*"}
         
         Write-Host "`n[?] Checking for binary-writable services ..`n" -ForegroundColor Black -BackgroundColor White
         
         try{
     
                if($services){
	 	
                         $services | % {

                                 # We are inspecting write access for Authenticated Users group members (SID = "S-1-5-11") 	
                
                                 $sid = "S-1-5-11"
                 
                                 $pathname = $($_.pathname.subString(0, $_.pathname.toLower().IndexOf(".exe")+4)).trim('"')
                            
                                 $binaryAcl = Get-Acl $pathname           		

                                 foreach($rule in $binaryAcl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])){
                 
                                          if($rule.IdentityReference -eq $sid){

                                                   $accessMask = $rule.FileSystemRights.value__
                        
                                                   if($accessMask -band 0xd0006){
                                    
                                                             $writableServices+=$_
                                                   }
                                          }
                                 }
                       
                         }

                }
         

                if($display){

                        if($writableServices.Count -gt 0){

                                 $writableServices|ft @{Expression={$_.name};Label="Name";width=12}, `
                                                      @{Expression={$_.pathname};Label="Path"}
                
                                                 
                        }else{

                                 "       [-] Found no binary-writable service."
                        }

                }else{

                        return $writableServices

                }
        
                "`n`n"

       
        }catch{
        
              $errorMessage = $_.Exception.Message
            
              $failedItem   = $_.Exception.ItemName

              "[-] Exception : "| Set-Content $exceptionsFilePath
              
              '[*] Error Message : `n',$errorMessage | Set-Content $exceptionsFilePath
              
              "[*] Failed Item   : `n",$failedItem   | Set-Content $exceptionsFilePath
              
        
        }
      

}
 initialize-audit//