Created
October 30, 2018 14:01
-
-
Save matterpreter/68141686d21afae40e536693b223c476 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Collections.Generic; | |
using System.IO; | |
using System.Linq; | |
using System.Management; | |
namespace ComAbandonment | |
{ | |
public class ComAbandonment | |
{ | |
public static void Main() | |
{ | |
try | |
{ | |
ManagementObjectSearcher searcher = | |
new ManagementObjectSearcher("root\\CIMV2", | |
"SELECT * FROM Win32_ClassicCOMClassSetting"); | |
List<string> inprocsvr32 = new List<string>(); | |
//Query all objects for their InProcSvr32 value and if not null, check that the file still exists | |
foreach (ManagementObject queryObj in searcher.Get()) | |
{ | |
object inprocsvrVal = queryObj["InprocServer32"]; | |
string inprocsvrStr = Convert.ToString(inprocsvrVal); | |
string resolvedEnvVars = Environment.ExpandEnvironmentVariables(inprocsvrStr); | |
string path = resolvedEnvVars.Trim('"'); | |
if (path != null) | |
{ | |
if (!File.Exists(path)) | |
{ | |
object clsidVal = queryObj["ComponentID"]; | |
string clsidStr = Convert.ToString(clsidVal); | |
string missingKey = path + "," + clsidStr; | |
if (missingKey.StartsWith("C:")) //This filters out things like combase.dll | |
inprocsvr32.Add(missingKey); | |
} | |
} | |
} | |
List<string> distinct = inprocsvr32.Distinct().ToList(); | |
List<string> cleanList = distinct.Where(s => !string.IsNullOrWhiteSpace(s)).Distinct().ToList(); | |
foreach (string dll in cleanList) { Console.WriteLine(dll); } | |
Console.ReadKey(); | |
} | |
catch (ManagementException e) | |
{ | |
Console.WriteLine("An error occurred while querying for WMI data: " + e.Message); | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment