From 9befcdbdbd8a22af0ede09f17c50ff1e74fb8e53 Mon Sep 17 00:00:00 2001
From: Thumbscrew <james@intmain.co.uk>
Date: Fri, 1 Nov 2019 08:20:21 +0000
Subject: [PATCH] Init commit

---
 .gitignore                       |   1 +
 PSWinFW.psd1                     | Bin 0 -> 8004 bytes
 PSWinFW.psm1                     |  14 +++
 README.md                        |  29 ++++++
 public/Get-PSFirewallLog.ps1     | 148 +++++++++++++++++++++++++++++++
 public/Get-PSFirewallLogPath.ps1 | 100 +++++++++++++++++++++
 tests/PathRetrieval.ps1          |   5 ++
 7 files changed, 297 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 PSWinFW.psd1
 create mode 100644 PSWinFW.psm1
 create mode 100644 README.md
 create mode 100644 public/Get-PSFirewallLog.ps1
 create mode 100644 public/Get-PSFirewallLogPath.ps1
 create mode 100644 tests/PathRetrieval.ps1

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..dbe9c82
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.vscode/
\ No newline at end of file
diff --git a/PSWinFW.psd1 b/PSWinFW.psd1
new file mode 100644
index 0000000000000000000000000000000000000000..2f46ce637e6ffcf3e2b6e4e80092c80b1f5443e0
GIT binary patch
literal 8004
zcmeI1Yfl?T6o%(>rTzy?e1KF1l9J|9sZuC}Kt<9hkhEWoZ*>E<YnwP}mA~Hhedg?8
zcD!pa2&Ag2to7bz&b;S-&g|cRt%NVb7hxqd!pkrW?QkAWLq~UKp&16DAG*4mgsGl%
z^?n@Rl*g@x*WoDqtdWDTr}Jt-&#Au9{DF?K=uLHQi^56x6u#5>M?E`>^c!J6uGiLD
zEv<8=F`XqS4MiJD_rq4$)c;fcf1~pQT^R!YIi7_-<JoZ?X`Qi9k0Nhp8SlpDN#v=i
zQJ*SYclFNX)D+^0X1DYtaX8c6H2kW0{P#7YD$$JsVI#cJ{GmqX8u(swRttGL>UU9+
z6H$cohK}<>R%m7@9px(~P1$PY73OK#diTSIq-R?6RgbjFNI&G_Iz;QwrA_!WG?NQ{
zb~N%#<B>;SnnY4{;~RlBpM|w>FVoFI*wyoMNzLqKDtg>wkH72O5k+*;*ZNo&t90X&
zva}QL@bMzN4Mx}ad?G73(X1^|c%t)qcqGed$!^xe!|+(YEnPj;m~Zuzw~xh7S9cFJ
z<AIJXt=^iG)V9!p!7S)9eSj$+ZMd%TiCi;D(u2sqt@|NLrM)DI6-hFu^GclJm!_Xp
zNp29{>llWa{;LQ^S{q;LiE|<a@xpuoD(ELgkHs2t9P`vnE^CtYJ<)ORZfJ$JP!e~3
z)4Cgaw=KIk)j46o@5aJ_C5;1eX=`N8!ESt?qJjHX(jJoNM*C}t7kl5-O4vSjI1=rl
zsGB`{gj?i^XnxU}#%tM2p@Q|p#Z>=&o#6xi8%5kj)3X?3_Vk{SGrcugoa$XqBaxHM
z!HZfNL&UI{POP6+<nl7k=}X4Mm_}T6tX1meV;LYJc^xsa%8|5#$D$dmp%>}G0Z8#@
z!@P{#Ry3=Qa(yhz^_;9a*X(l0@oCG0w}*PapqY@F{&U=Sp@+NVW*J>9#}lLQOC*oZ
zh$9=}mGaK9uJ-iC;?zuU$BIzbwJ2i7v8>bbGhU3nx=mu~WIKF^IPxL-6h7{LV;;_k
zI-6`1UjANGhKdnbe>q>0uLtsqPvXfl?XI3p#UZ|4<?r?+OB4pT)ml_PM2Ayxh<~2z
z+>7tWG3pWXEFY{XQyi*ZArdD^adnmV{`+KYoGc^L*W#55k351U5;>_0ThVr~5%R)$
zlt@F>%&RERPWW2meo=MtC|+$#hHYIxyn*!GKB`Ez7viXoC8;XHrm+KJKh-Jq7FSf>
z*gO>+yn4k)2C-b^*3*;43^kryW3inah^z+DUM%zDSL6(&X7kImp-O&&rq{^{qx1bn
zn97-=oFU-@UaNKFcGOo#Sg1kCoR{+qH&hj7&3A#j9#K8|yhHJh0}j>{F-GF$LA0c#
zLu?Y=nb&&GcWt$zo~Xsgs(_$FHok3*rC3(RKT(_=DoU39Xpz>A6%j{~k9wXzN}s0%
z=Tt^!uet7KF}@Mgu5W9;{&g_#Mf<ioitJ$BVXmvY#$Cp69qjYIRP|A!9lX%T6C=z&
z$Qr(1z}vj4D!-*8K%?}?$j0VdMfyhb=6m1GtP`$Ujz<OZq~n?AqTZ+WVm?b%Jh+YD
zPWX5c@6aHYO4VB*mx%1XAA<c^<b=m@@!a-L$Qg{KE=GQE>YZ&vRXTP;7m4Sx_kpAb
zx|*LsOu}=m9&wMh-irMR*06rrDB#<~Z|hH>POW4;v+ogDtz(&tr~x{-qR+lcLgwXF
zX`-v=nI!A=up@Nsf}{U+Ft3BwmC`Z!=TclOd;FzQ{8qISf*q~L9hp5@AUVVP#Y5?@
zSM<mEp3J*wqwI0ne$Gv`29_$VdhDy=tGQmC4j&Bk^EXBC-}PPFlekPeW;eMM>t$c9
zrgqiI@5qX<7ph?DU8{+27DGLX?}}PWJ;glLWpN$KA}sz|20{v_!dcEh*b4iREp>_3
z+Yn>xcWF~rbA;vGl2)saZ0UWDrd$);90~qP9!RUyqoC62$Bxx9Mq6C7C+C_10lkdh
zdqyeC?6$LZ-T{&y$wz1lYqDOHj-e^!RBoVU*LYV~hMitzqRNgti$Y}`Qn{D=YbfVd
zz#XxVkxn!1GV@iUzLPhv$z_^QnFi9=1&_2j_C=$7^orI#7OGy<N>kQ45`M3hrcpxm
zwTR0V{~?dtZX5dz$-Z;FA|-r|Jxi(ps|%31?MNVhDD{K~Ut)}PPbLY+?B^VN)gpbI
zpBcZc<E^~@Q0K%QtHL#LWl-?rb=D&8%h|2G0zQ)Hyp25gj&|B%^BI1=92-_^);SZx
z6Cw0HqAE)I$D#J7ZFitva@G;~m>eT^K9v<r^o46vKWe}a>inAFj~IJ9y0-nBO?k<2
z_(9({j&;R)o6&P@XES}3TO_HfE~rB3ouJPZF&}=+#_&?4u()rp=N8!>6f|>QFV_dT
z0V}l3#_kGHjp&tnj{3a=*Q%dEu$UT_TmItavp(xNGoOoR@`kON`*$@qA#ILDv&#`W
zMU%yJK(HSrF_IJqvCl9cI=H}8?<1h7n~nc5cb;#?@`a)snzFQ0N!z}0@T9NmKJ`An
ze`s9`8Y%Zt*5_T-OA)_*Dk2dw!On>ZwnNF?VjM(ox5NWQci*vE&pOCPtah<p!*AAE
X<#I=wJ=4#)!8d(IRYspLzF7VP0I(Yj

literal 0
HcmV?d00001

diff --git a/PSWinFW.psm1 b/PSWinFW.psm1
new file mode 100644
index 0000000..4043b47
--- /dev/null
+++ b/PSWinFW.psm1
@@ -0,0 +1,14 @@
+# Get public and private function definition files.
+$Public = @( Get-ChildItem -Path $PSScriptRoot\Public\*.ps1 -ErrorAction SilentlyContinue -Recurse )
+$Private = @( Get-ChildItem -Path $PSScriptRoot\Private\*.ps1 -ErrorAction SilentlyContinue -Recurse )
+
+# Dot source the files
+Foreach ($import in @($Public + $Private)) {
+    Try {
+        . $import.fullname
+    } Catch {
+        Write-Error -Message "Failed to import function $($import.fullname): $_"
+    }
+}
+
+Export-ModuleMember -Function '*' -Alias '*'
\ No newline at end of file
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..7553e31
--- /dev/null
+++ b/README.md
@@ -0,0 +1,29 @@
+# **PSWinFW (beta)**
+
+**Note: Module is WIP. Testing is done in a domain environment (not sure how it will fair on standalone machines). Pull Requests welcome.**
+
+## **Description**
+A powershell module for retrieving Windows Firewall logs and displaying them in a nicer, more useful format.
+
+## **Installation**
+```
+git clone https://github.com/Thumbscrew/PSWinFW.git
+Import-Module PSWinFW\PSWinFW.psm1
+```
+## **Example Usage**
+Get last 1000 Windows Firewall log lines at a specific path:
+```powershell
+Get-PSFirewallLog -Path C:\Windows\system32\logfiles\firewall\pfirewall.log -Tail 1000
+```
+Get Windows Firewall log by specifying the log directory and filename separately:
+```powershell
+Get-PSFirewallLog -LogDirectory C:\Windows\system32\logfiles\firewall\ -LogFileName domainfw.log
+```
+Get Windows Firewall log by retrieving the path automatically from the registry on the local machine:
+```powershell
+Get-PSFirewallLog -LogProfile Domain
+```
+Get Windows Firewall log on a remote computer using the Remote Registry service to get the log path:
+```powershell
+Get-PSFirewallLog -LogProfile Public -ComputerName MyRemoteComputer -Verbose
+```
\ No newline at end of file
diff --git a/public/Get-PSFirewallLog.ps1 b/public/Get-PSFirewallLog.ps1
new file mode 100644
index 0000000..e55e033
--- /dev/null
+++ b/public/Get-PSFirewallLog.ps1
@@ -0,0 +1,148 @@
+function Get-PSFirewallLog {
+    [CmdletBinding(DefaultParameterSetName = 'direct')]
+    param (
+        # Path to firewall log. Defaults to $ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log if parameter not supplied.
+        [Parameter(Mandatory = $false, Position = 0, ValueFromPipeline, ParameterSetName = 'direct')]
+        [string]
+        $Path = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log",
+
+        # Path to firewall log directory. Defaults to $ENV:SystemRoot\system32\LogFiles\Firewall\ if parameter not supplied.
+        [Parameter(Mandatory = $false, ParameterSetName = 'indirect')]
+        [string]
+        $LogDirectory = "$ENV:SystemRoot\system32\LogFiles\Firewall\",
+
+        # Log file name.
+        [Parameter(Mandatory = $true, ParameterSetName = 'indirect')]
+        [string]
+        $LogFileName,
+
+        # Retrieve a profile's log using registry settings of the local machine
+        [Parameter(Mandatory = $true, ParameterSetName = 'auto')]
+        [Parameter(ParameterSetName = 'remote')]
+        [ValidateSet('Public','Private','Domain')]
+        [string]
+        $LogProfile,
+
+        # Number of firewall events to retrieve. Defaults to 0 (All events).
+        [Parameter(Mandatory = $false)]
+        [int]
+        $Tail = 0,
+
+        # Include extended TCP information (TCP Flags, TCP Sequence Number, TCP ACK Number, TCP Window Size). Defaults to false.
+        [Parameter(Mandatory = $false)]
+        [switch]
+        $IncludeTcpInfo,
+
+        # Include extended ICMP information (ICMP Type and Code). Defaults to false.
+        [Parameter(Mandatory = $false)]
+        [switch]
+        $IncludeIcmpInfo,
+
+        # Include Info field. Defaults to false.
+        [Parameter(Mandatory = $false)]
+        [switch]
+        $IncludeInfo,
+
+        # ComputerName to retrieve log from
+        [Parameter(Mandatory = $false, ParameterSetName = 'remote')]
+        [string]
+        $ComputerName
+    )
+    
+    begin {
+        if($PSCmdlet.ParameterSetName -eq 'auto') {
+            # $Path = [Environment]::ExpandEnvironmentVariables((Get-ItemProperty -Path ("HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\{0}Profile\Logging" -f $LogProfile) -Name "LogFilePath").LogFilePath)
+            $Path = Get-PSFirewallLogPath -LogProfile $LogProfile -Verbose:$VerbosePreference
+        }
+        elseif($PSCmdlet.ParameterSetName -eq 'remote') {
+            $Path = Get-PSFirewallLogPath -LogProfile $LogProfile -ComputerName $ComputerName -Verbose:$VerbosePreference
+        }
+    }
+    
+    process {
+
+        if($PSCmdlet.ParameterSetName -eq 'indirect') {
+            # Check for trailing slash and add if necessary
+            if(!$LogDirectory.EndsWith('\')) {
+                $LogDirectory += '\'
+            }
+
+            $logPath = $LogDirectory + $LogFileName
+        }
+        else {
+            $logPath = $Path
+        }
+
+        if(Test-Path $logPath) {
+            $log = Get-Content $logPath
+
+            if($log.Length -gt 0) {
+                # Remove header lines
+                $log = $log[5..($log.Length - 1)]
+
+                if($Tail -gt 0) {
+                    $startIndex = if($Tail -lt $log.Length) { $log.Length - $Tail } else { 0 }
+                    
+                    $log = $log[$startIndex..($log.Length - 1)]
+                }
+
+                $members = @{
+                    "Date" = 0
+                    "Time" = 1
+                    "Action" = 2
+                    "Protocol" = 3
+                    "SourceIP" = 4
+                    "DestinationIP" = 5
+                    "SourcePort" = 6
+                    "DestinationPort" = 7
+                    "Size" = 8
+                }
+
+                if($IncludeTcpInfo) {
+                    $tcpMembers = @{
+                        "TcpFlags" = 9
+                        "TcpSyn" = 10
+                        "TcpAck" = 11
+                        "TcpWin" = 12
+                    }
+
+                    $members += $tcpMembers
+                }
+
+                if($IncludeIcmpInfo) {
+                    $icmpMembers = @{
+                        "IcmpType" = 13
+                        "IcmpCode" = 14
+                    }
+
+                    $members += $icmpMembers
+                }
+
+                if($IncludeInfo) {
+                    $members += @{ "Info" = 15 }
+                }
+
+                $members += @{ "Path" = 16 }
+
+                $log | ForEach-Object {
+                    $line = $_
+                    $split = $line -split ('\s')
+
+                    $fwEvent = New-Object PSCustomObject
+
+                    foreach($member in $members.GetEnumerator() | Sort-Object Value) {
+                        $fwEvent | Add-Member NoteProperty -Name $member.Name -Value $split[$member.Value]
+                    }
+
+                    $fwEvent
+                }
+            }
+            else {
+                Write-Error "File $logPath has zero length."
+            }
+        }
+        else {
+            Write-Error "Failed to retrieve log at $logPath."
+        }
+    }
+}
\ No newline at end of file
diff --git a/public/Get-PSFirewallLogPath.ps1 b/public/Get-PSFirewallLogPath.ps1
new file mode 100644
index 0000000..f542c17
--- /dev/null
+++ b/public/Get-PSFirewallLogPath.ps1
@@ -0,0 +1,100 @@
+function Get-PSFirewallLogPath {
+    param(
+        # Log Profile to retrieve path for
+        [Parameter(Mandatory = $true)]
+        [ValidateSet('Public','Private','Domain')]
+        [string]
+        $LogProfile,
+
+        # Remote Host to retrieve from
+        [Parameter(Mandatory = $false, ParameterSetName = 'remote')]
+        [string]
+        $ComputerName
+    )
+
+    process {
+        $serviceName = "RemoteRegistry"
+
+        if($PSCmdlet.ParameterSetName -eq 'remote') {
+            $startTypeChanged = $false
+            $statusChanged = $false
+
+            Write-Verbose "Retrieving path from registry on host $ComputerName."
+            $remoteRegistry = Get-Service -ComputerName $ComputerName -Name $serviceName
+            
+            if($remoteRegistry.StartType -eq "Disabled") {
+                Write-Verbose "$serviceName service is Disabled. Attempting to change to Manual startup."
+                Set-Service -StartupType "Manual" -Name $serviceName -ComputerName $ComputerName
+                $modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
+
+                if($modifiedRemoteRegistry.StartType -ne "Manual") {
+                    Write-Warning "Unable to change startup of $serviceName on host $ComputerName."
+                    return $null
+                }
+                else {
+                    Write-Verbose "$serviceName startup changed to Manual."
+                    $startTypeChanged = $true
+                }
+            }
+
+            if($remoteRegistry.Status -ne "Running") {
+                Write-Verbose "$serviceName service is not running. Attempting to start."
+                Set-Service -Status "Running" -Name $serviceName -ComputerName $ComputerName
+                $modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
+
+                if($modifiedRemoteRegistry.Status -eq "Stopped") {
+                    Write-Warning "Unable to start $serviceName service on host $ComputerName."
+                    return $null
+                }
+                else {
+                    Write-Verbose "$serviceName service started OK."
+                    $statusChanged = $true
+                }
+            }
+
+            $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $ComputerName)
+            $regKey = $reg.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\{0}Profile\Logging" -f $LogProfile)
+            $localPath = [Environment]::ExpandEnvironmentVariables($RegKey.GetValue("LogFilePath"))
+
+            # Set Remote Registry back the way we found it if we had to change it
+
+            if($statusChanged) {
+                Write-Verbose ("Reverting status of $serviceName Service to {0}." -f $remoteRegistry.Status)
+                # Set-Service -Name $serviceName -ComputerName $ComputerName -Status $remoteRegistry.Status
+                # Need to use Invoke-Command as Set-Service won't stop a service that has dependancies
+                Invoke-Command -ComputerName $ComputerName -ScriptBlock { Stop-Service -Name "RemoteRegistry" }
+                
+                # Verify that service has been restored to its original state.
+                $revertedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
+                if($remoteRegistry.Status -ne $revertedRemoteRegistry.Status) {
+                    Write-Warning "Failed to revert $serviceName status to $($remoteRegistry.Status)!"
+                }
+            }
+
+            if($startTypeChanged) {
+                Write-Verbose ("Reverting Startup of $serviceName Service to {0}." -f $remoteRegistry.StartType)
+                Set-Service -Name $serviceName -ComputerName $ComputerName -StartupType $remoteRegistry.StartType
+                
+                # Verify that service has been restored to its original state.
+                if($remoteRegistry.StartType -ne $revertedRemoteRegistry.StartType) {
+                    Write-Warning "Failed to revert startup type of $serviceName to $($remoteRegistry.StartType)!"
+                }
+            }
+
+            # Do the conversion to UNC path
+            $path = "\\$ComputerName\" + $localPath.replace(':', '$')
+
+            return $path
+        }
+        else {
+            # Get local registry key entry
+            $path = [Environment]::ExpandEnvironmentVariables((Get-ItemProperty -Path ("HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\{0}Profile\Logging" -f $LogProfile) -Name "LogFilePath").LogFilePath)
+
+            if($null -eq $path) {
+                $path = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log"
+            }
+
+            return $path
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/PathRetrieval.ps1 b/tests/PathRetrieval.ps1
new file mode 100644
index 0000000..7c6b980
--- /dev/null
+++ b/tests/PathRetrieval.ps1
@@ -0,0 +1,5 @@
+Import-Module .\PSWinFW.psm1 -Force
+
+$path = Get-PSFirewallLogPath -LogProfile Public -ComputerName stb603970 -Verbose
+
+Write-Host $path
\ No newline at end of file