Function Get-HostsFile {
.SYNOPSIS
Retrieves the contents of a hosts file on a specified system.
.DESCRIPTION
Retrieves the contents of a hosts file on a specified system.
.PARAMETER ComputerName
The computers to access.
.NOTES
Name: Get-HostsFile
Author: Boe Prox
DateCreated: 15Mar2011
1.1 - 2011-03-17 - Jason Archer
Improved pipeline support (and fixed positional usage).
Added custom object creation and incremental output (better performance and cleaner code).
For local host, use local path.
Added error messages for error conditions.
1.0 - 2011-03-15 - Boe Prox
Initial release.
.LINK
http://boeprox.wordpress.com
.EXAMPLE
Get-HostsFile "server1"
Description
-----------
Retrieves the contents of the hosts file on 'server1'.
#>
[CmdletBinding()]
Param(
[Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
[ValidateNotNull()]
[string[]]$ComputerName = "localhost"
)
Begin {
$PSBoundParameters.GetEnumerator() | Foreach-Object {
Write-Verbose "Parameter: $_"
}
}
Process {
Write-Verbose "Starting process of computers"
ForEach ($c in $ComputerName ) {
Write-Verbose "Testing connection of $c"
If (Test-Connection -ComputerName $c -Quiet -Count 1) {
Write-Verbose "Validating path to hosts file"
if ($c -eq "localhost") {
$root = "C:"
} else {
$root = "\\$c\C`$"
}
If (Test-Path "$root\Windows\system32\drivers\etc\hosts") {
Switch -regex -file ("$root\Windows\system32\drivers\etc\hosts") {
"^#\w+" {
}
"^\d\w+" {
Write-Verbose "Adding IPV4 information to collection"
$new = $_.Split("") | Where-Object {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $new[0]
IPV6 = $null
Hostname = $new[1]
Notes = $notes
}
}
Default {
If (!("\s+" -match $_ -OR $_.StartsWith("#"))) {
Write-Verbose "Adding IPV6 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $null
IPV6 = $new[0]
Hostname = $new[1]
Notes = $notes
}
}
}
}
} ElseIf (Test-Path "$root\WinNT\system32\drivers\etc\hosts") {
Switch -regex -file ("$root\WinNT\system32\drivers\etc\hosts") {
"^#\w+" {
}
"^\d\w+" {
Write-Verbose "Adding IPV4 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $new[0]
IPV6 = $null
Hostname = $new[1]
Notes = $notes
}
}
Default {
If (!("\s+" -match $_ -OR $_.StartsWith("#"))) {
Write-Verbose "Adding IPV6 information to collection"
$new = $_.Split("") | ? {$_ -ne ""}
If ($new[2] -eq $null) {
$notes = $null
} Else {
$notes = $new[2]
}
New-Object PSObject -Property @{
ComputerName = $c
IPV4 = $null
IPV6 = $new[0]
Hostname = $new[1]
Notes = $notes
}
}
}
}
} Else {
## TODO: Could use the properly localized path not found error
Write-Error "Unable to locate host file on computer: $c"
}
} Else {
## TODO: Could use the properly localized can not locate host error
Write-Error "Unable to locate computer: $c"
}
}
}
}
Další tip který vyšel na powertips
GET-WMIOBJECT WIN32_NETWORKADAPTER | foreach { $_.Disable() }
Vypne všechny sitove adaptersy - Physical, Logical, všechny a GET-WMIOBJECT WIN32_NETWORKADAPTER | foreach { $_.Enable() }
všechny povolí
Filtr na fyzicke neboli where { $_.PhysicalAdapter –eq $TRUE} a přikaz níže zakáže pouze fyzicke adaptery
GET-WMIOBJECT WIN32_NETWORKADAPTER | where { $_.PhysicalAdapter –eq $TRUE} | foreach { $_.Disable() }
Co se týče filtrace tak fantazii se meze nekladou…
V jednom postu byl zminěn koncept integrace powershellu a HTML5,našel jsem tam mimo jine toto
iex (New-Object Net.WebClient).DownloadString("http://bit.ly/e0Mw9w")
vložte do powershellu a budete překvapeni stejně jako já.
Dnes jsem při upravování výstupu pro netstat v powershellu narazil v jine souvislosti na zajimavý ps1 script pro nmap.
http://blogs.sans.org/windows-security/2009/06/11/powershell-script-to-parse-nmap-xml-output/
Jeden z možných vystupů ktere exportuje potom vypadá takto
Další variantou jak najednou ziskat zakladní informace o PC a dal s nimi pracovat je vystup ogv.
Spuštění potom můžeme řešit přes ps1,execute in powershell a –NOEXIT,nebo přes dejme tomu vytvořeni funkce a spouštění scriptu nazvem funkce až ho chceme spustit,nebo cestou ke scriptu.Každopaádně admin mode bych preferoval.Na videu je varianta kdy udělame ps1 script obsahujici jenom přikazy a spouštime zadáním cesty k němu.
Varianta dvě zkopirujeme do okna powershellu nasledující
function audit
{Get-process|select-object *|ogv
Get-WmiObject Win32_Process | ForEach-Object { $ownerraw = $_.GetOwner(); $owner = '{0}\{1}' -f $ownerraw.domain, $ownerraw.user; $_ | Add-Member NoteProperty Owner $owner -PassThru } | Select-Object Name, Owner|ogv
Get-service|select-object *|ogv
Get-WmiObject Win32_Service | sort -property Name | select Name, State, ProcessId, Description, StartName |ogv
get-wmiobject Win32_QuickFixEngineering | sort -property HotFixID | select -property HotFixID, Description|ogv
get-wmiobject Win32_Desktop | sort -property Name | select Name, BorderWidth, Caption, CoolSwitch, CursorBlinkRate, Description, DragFullWindows, GridGranularity, IconSpacing, IconTitleFaceName, IconTitleSize, IconTitleWrap, Pattern, ScreenSaverActive, ScreenSaverExecutable, ScreenSaverSecure, ScreenSaverTimeout, SettingID, Wallpaper, WallpaperStretched, WallpaperTiled|ogv
get-wmiobject Win32_Environment | sort -property Name | select -property Name, Status, SystemVariable, UserName|ogv
get-wmiobject Win32_StartupCommand | sort -property Name | select -property Name, Location, Command|ogv
get-wmiobject Win32_BootConfiguration | select -property Name, BootDirectory, Description, LastDrive, ScratchDirectory, TempDirectory|ogv
get-wmiobject Win32_LogonSession | sort -property LogonId | select -property LogonId, LoginType, AuthenticationPackage, Description, InstallDate, StartTime|ogv
Get-EventLog -list|ogv
get-wmiobject Win32_ComputerSystem | select Name, Description, @{Label="DNS Host Name"; Expression={$_.DNSHostName}}, Domain, Manufacturer, Model, @{Label="# Processors";Expression={$_.NumberOfProcessors}}, @{Label="System Type";Expression={$_.SystemType}}, @{Label="Physical Memory";Expression={"{0,12:n0} MB" -f ($_.TotalPhysicalMemory/1mb)}}|ogv
get-wmiobject Win32_BIOS | select Name, Manufacturer, ReleaseDate, SerialNumber|ogv
get-wmiobject Win32_PhysicalMemory | select @{Label="Device Location";Expression={$_.DeviceLocator}}, DataWidth, @{Label="Capacity";Expression={"{0,12:n0} MB" -f ($_.Capacity/1mb)}}, PartNumber, SerialNumber, Speed|ogv
get-wmiobject Win32_IP4RouteTable | sort Destination | select Destination, Mask, NextHop, Age |ogv
get-wmiobject Win32_NetworkAdapterConfiguration | sort Description | select Description, DHCPEnabled, IPEnabled, ServiceName, SettingID|ogv
get-wmiobject Win32_NetworkAdapter | sort Name | select Name, Manufacturer, PhysicalAdapter, ServiceName, PNPDeviceID|ogv
get-wmiobject Win32_NetworkClient | select Name, Description, Manufacturer, Status|ogv
get-wmiobject Win32_NetworkLoginProfile -filter "NOT Name LIKE 'NT AUTHORITY%'" | sort Name | select Name, Comment, NumberOfLogons, LastLogon|ogv
get-wmiobject Win32_NetworkProtocol | sort Name | select Name, Description|ogv
get-wmiobject Win32_Printer | sort Name | select Name, Comment, DriverName, Location, Network, PortName, ShareName|ogv
get-wmiobject Win32_PrintJob | select Document, @{Label="Status";Expression={$_.JobStatus}}, Owner, @{Label="Pages";Expression={$_.TotalPages}}, @{Label="Submitted";Expression={[System.Management.ManagementDateTimeconverter]::ToDateTime($_.TimeSubmitted)}}|ogv
get-wmiobject Win32_PrinterDriver | sort Name | select Name, DriverPath|ogv
get-wmiobject Win32_DiskPartition | sort Name | select Name, @{Label="Size";Expression={"{0,12:n0} MB" -f ($_.Size/1mb)}}, @{Label="Primary?";Expression={$_.PrimaryPartition}}, @{Label="Boot?";Expression={$_.BootPartition}}|ogv
get-wmiobject Win32_LogicalDisk | select Name, Description, FileSystem, @{Label="Size";Expression={"{0,12:n0} MB" -f ($_.Size/1mb)}}, @{Label="Free Space";Expression={"{0,12:n0} MB" -f ($_.FreeSpace/1mb)}}, ProviderName|ogv
get-wmiobject Win32_MappedLogicalDisk | select Name, Description, FileSystem, @{Label="Size";Expression={"{0,12:n0} MB" -f ($_.Size/1mb)}}, @{Label="Free Space";Expression={"{0,12:n0} MB" -f ($_.FreeSpace/1mb)}}, ProviderName|ogv
get-wmiobject Win32_DiskDrive | sort Name | select Name, Model, MediaType, InterfaceType, Partitions, @{Label="Size";Expression={"{0,12:n0} MB" -f ($_.Size/1mb)}}|ogv
get-wmiobject Win32_Share | sort Name | select Name, Path, Status|ogv
Get-Content $env:windir\windowsupdate.log -encoding utf8 | Where-Object { $_ -like '*successfully installed*'} | Foreach-Object { $infos = $_.Split("`t"); $result = @{}; $result.Date = [DateTime]$infos[6].Remove($infos[6].LastIndexOf(":")); $result.Product = $infos[-1].SubString($infos[-1].LastIndexOf(":")+2); New-Object PSobject -property $result }|ogv
Get-Alias | Group-Object Definition|ogv
}
Odentrujeme a napišeme audit.
Video
Další variantou je použit Powershell ISE,pro něj addon ISE MENU CREATOR a viz. obrazky niže.
Nedefinujeme si klavesovou zkratku a pouštime potom prostě klavesovou zkratkou.
