cargo build --release

cargo build

gargamel.exe -c 192.168.42.47 -u Jano --psexec -o testResults

gargamel.exe -c 192.168.42.47 -u Jano --psexec -p nbusr123 -o testResults

gargamel.exe -c JanovPC -u Jano -d WORKSPACE --psexec -o testResults

gargamel.exe -c JanovPC -u Jano -d WORKSPACE --psexec -p nbusr123 -o testResults

gargamel.exe -c 192.168.42.47 -u Jano --psexec --rdp -o testResults

gargamel.exe -c 192.168.42.47 -u Jano --psexec -o testResults -m

gargamel.exe -c 192.168.42.47 -u Jano --psexec -o testResults -m --no-events-search --no-evidence-search --no-registry-search                                                          

# Will be run using any method
ipconfig
# Will run only when launching with at least one of --all, --psexec, --wmi methods
:psexec:wmi ipconfig -all

gargamel.exe -c 192.168.42.47 -u Jano --psexec -o testResults -e custom-commands.txt                                                           

C:\Users\Public\sss*
C:\Users\Jano\danove.pdf 
# This line and the next one will be ignored
# C:\Users\Jano\somBajecny.pptx  

gargamel.exe -c 192.168.42.47 -u Jano --psexec -o testResults -s custom-files.txt                                                           

USAGE:
    gargamel.exe [FLAGS] [OPTIONS] --user <user>

FLAGS:
    -a, --all                   Acquire evidence from Windows machine using all supported methods (PsExec, PsRemote,
                                WMI, RDP).
        --no-events-search      Disables Windows event logs acquisition.
        --no-evidence-search    Disables acquisition of evidence that can be usually downloaded quickly (like ipconfig,
                                firewall status etc..)
        --no-registry-search    Disables target registry acquisition.
    -h, --help                  Prints help information
    -m, --mem-image             Optional: Memory dump of a target Windows machine.
        --local                 Acquire evidence from local machine.
        --nla                   Optional: Use network level authentication when using RDP. (Windows targets only)
        --no-7z                 Optional: Disable 7zip compression for registry & memory images.This will significantly
                                decrease the running time, but WMI and RDP connections will probably not work properly.
                                    (Windows targets only)
        --psexec                Acquire evidence from Windows machine using PsExec. Requires both PsExec64.exe and
                                paexec.exe in the current directory or in the path.
        --psrem                 Acquire evidence from Windows machine using PowerShell. Requires both PsExec64.exe and
                                paexec.exe in the current directory or in the path.
        --rdp                   Acquire evidence from Windows machine using RDP. Requires SharpRDP.exe in the current
                                directory or in the path.
        --ssh                   Acquire evidence from Linux machine using SSH. Requires both plink.exe and pscp.exe in
                                the current directory or in the path.
    -V, --version               Prints version information
        --wmi                   Acquire evidence from Windows machine using WMI. Requires WMImplant.ps1 in the current
                                directory or in the path and PowerShell 3.0+ on the host machine.Note: It is necessary
                                to disable Windows Defender real-time protection (other AVs not tested).

OPTIONS:
    -c, --computer <computer>                        Remote computer address/name. [default: 127.0.0.1]
    -u, --user <user>                                Remote user name
    -d, --domain <domain>                            Optional: Remote Windows domain
    -o, --output <local-store-directory>
            Name of local directory to store the evidence [default: evidence-output]

    -p, --password <password>
            Optional: Remote user password. Skipping this option will prompt a possibility to put a password in hidden
            way.To specify an empty password use `-p ""`

        --redownload <re-download>
            Optional: Download and DELETE specified file from target computer. Use this in case of previous failed
            partially completed operation. For just downloading a file (without deleting it) please use a `search`
            switch. If you specify a 7zip chunk (.7z.[chunk-number], e.g. .7z.004), then it will also automatically try to
            download subsequent chunks.Use also with --psexec --psrem, --rdp, --wmi, --all

    -r, --remote-storage <remote-store-directory>
            Name of remote directory to be used as a temporary storage. (Windows targets only) [default:
            C:\Users\Public]

    -e, --commands <custom-command-path>             Optional: File with custom commands to execute on remote computer

    -s, --search <search-files-path>
            Optional: File with files names to be searched on remote computer. File names supports also `*` and `?`
            wildcards on file names (but not yet parent directories).

        --key <ssh-key>                              Optional: Name/path of SSH private key file. (Linux target only)

        --timeout <timeout>
            Optional: Timeout in seconds for long running operations.This option is a workaround for a bug in
            WMImplant.ps1 amd SharpRDP.exe where finishing of a long running operation cannot sometimes properly close
            the connection leaving the Gargamel in seemingly frozen state or executing the next operation with the
            previous one unfinished on target site.Increasing this timeout may solve issues when acquiring registry or
            memory image from target machine. [default: 300]