%&&@@@&&                                                                                  
                    &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%                         
                    &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%

+ AMSIProviders          - Providers registered for AMSI
+ AntiVirus              - Registered antivirus (via WMI)
+ AppLocker              - AppLocker settings, if installed
  ARPTable               - Lists the current ARP table and adapter information (equivalent to arp -a)
  AuditPolicies          - Enumerates classic and advanced audit policy settings
+ AuditPolicyRegistry    - Audit settings via the registry
+ AutoRuns               - Auto run executables/scripts/programs
  azuread                - Return AzureAD info
  Certificates           - Finds user and machine personal certificate files
  CertificateThumbprints - Finds thumbprints for all certificate store certs on the system
+ ChromiumBookmarks      - Parses any found Chrome/Edge/Brave/Opera bookmark files
+ ChromiumHistory        - Parses any found Chrome/Edge/Brave/Opera history files
+ ChromiumPresence       - Checks if interesting Chrome/Edge/Brave/Opera files exist
+ CloudCredentials       - AWS/Google/Azure/Bluemix cloud credential files
+ CloudSyncProviders     - All configured Office 365 endpoints (tenants and teamsites) which are synchronised by OneDrive.
  CredEnum               - Enumerates the current user's saved credentials using CredEnumerate()
+ CredGuard              - CredentialGuard configuration
  dir                    - Lists files/folders. By default, lists users' downloads, documents, and desktop folders (arguments == [directory] [maxDepth] [regex] [boolIgnoreErrors]
+ DNSCache               - DNS cache entries (via WMI)
+ DotNet                 - DotNet versions
+ DpapiMasterKeys        - List DPAPI master keys
  EnvironmentPath        - Current environment %PATH$ folders and SDDL information
+ EnvironmentVariables   - Current environment variables
+ ExplicitLogonEvents    - Explicit Logon events (Event ID 4648) from the security event log. Default of 7 days, argument == last X days.
  ExplorerMRUs           - Explorer most recently used files (last 7 days, argument == last X days)
+ ExplorerRunCommands    - Recent Explorer "run" commands
  FileInfo               - Information about a file (version information, timestamps, basic PE info, etc. argument(s) == file path(s)
+ FileZilla              - FileZilla configuration files
+ FirefoxHistory         - Parses any found FireFox history files
+ FirefoxPresence        - Checks if interesting Firefox files exist
+ Hotfixes               - Installed hotfixes (via WMI)
  IdleTime               - Returns the number of seconds since the current user's last input.
+ IEFavorites            - Internet Explorer favorites
  IETabs                 - Open Internet Explorer tabs
+ IEUrls                 - Internet Explorer typed URLs (last 7 days, argument == last X days)
+ InstalledProducts      - Installed products via the registry
  InterestingFiles       - "Interesting" files matching various patterns in the user's folder. Note: takes non-trivial time.
+ InterestingProcesses   - "Interesting" processes - defensive products and admin tools
  InternetSettings       - Internet settings including proxy configs and zones configuration
+ KeePass                - Finds KeePass configuration files
+ LAPS                   - LAPS settings, if installed
+ LastShutdown           - Returns the DateTime of the last system shutdown (via the registry).
  LocalGPOs              - Local Group Policy settings applied to the machine/local users
+ LocalGroups            - Non-empty local groups, "-full" displays all groups (argument == computername to enumerate)
+ LocalUsers             - Local users, whether they're active/disabled, and pwd last set (argument == computername to enumerate)
+ LogonEvents            - Logon events (Event ID 4624) from the security event log. Default of 10 days, argument == last X days.
+ LogonSessions          - Windows logon sessions
  LOLBAS                 - Locates Living Off The Land Binaries and Scripts (LOLBAS) on the system. Note: takes non-trivial time.
+ LSASettings            - LSA settings (including auth packages)
+ MappedDrives           - Users' mapped drives (via WMI)
  McAfeeConfigs          - Finds McAfee configuration files
  McAfeeSiteList         - Decrypt any found McAfee SiteList.xml configuration files.
  MicrosoftUpdates       - All Microsoft updates (via COM)
  MTPuTTY                - MTPuTTY configuration files
  NamedPipes             - Named pipe names, any readable ACL information and associated process information.
+ NetworkProfiles        - Windows network profiles
+ NetworkShares          - Network shares exposed by the machine (via WMI)
+ NTLMSettings           - NTLM authentication settings
  OfficeMRUs             - Office most recently used file list (last 7 days)
  OneNote                - List OneNote backup files
+ OptionalFeatures       - List Optional Features/Roles (via WMI)
  OracleSQLDeveloper     - Finds Oracle SQLDeveloper connections.xml files
+ OSInfo                 - Basic OS info (i.e. architecture, OS version, etc.)
+ OutlookDownloads       - List files downloaded by Outlook
+ PoweredOnEvents        - Reboot and sleep schedule based on the System event log EIDs 1, 12, 13, 42, and 6008. Default of 7 days, argument == last X days.
+ PowerShell             - PowerShell versions and security settings
+ PowerShellEvents       - PowerShell script block logs (4104) with sensitive data.
+ PowerShellHistory      - Searches PowerShell console history files for sensitive regex matches.
  Printers               - Installed Printers (via WMI)
+ ProcessCreationEvents  - Process creation logs (4688) with sensitive data.
  Processes              - Running processes with file info company names that don't contain 'Microsoft', "-full" enumerates all processes
+ ProcessOwners          - Running non-session 0 process list with owners. For remote use.
+ PSSessionSettings      - Enumerates PS Session Settings from the registry
+ PuttyHostKeys          - Saved Putty SSH host keys
+ PuttySessions          - Saved Putty configuration (interesting fields) and SSH host keys
  RDCManFiles            - Windows Remote Desktop Connection Manager settings files
+ RDPSavedConnections    - Saved RDP connections stored in the registry
+ RDPSessions            - Current incoming RDP sessions (argument == computername to enumerate)
+ RDPsettings            - Remote Desktop Server/Client Settings
  RecycleBin             - Items in the Recycle Bin deleted in the last 30 days - only works from a user context!
  reg                    - Registry key values (HKLM\Software by default) argument == [Path] [intDepth] [Regex] [boolIgnoreErrors]
  RPCMappedEndpoints     - Current RPC endpoints mapped
+ SCCM                   - System Center Configuration Manager (SCCM) settings, if applicable
+ ScheduledTasks         - Scheduled tasks (via WMI) that aren't authored by 'Microsoft', "-full" dumps all Scheduled tasks
  SearchIndex            - Query results from the Windows Search Index, default term of 'passsword'. (argument(s) == <search path> <pattern1,pattern2,...>
  SecPackageCreds        - Obtains credentials from security packages
+ SecureBoot             - Secure Boot configuration
  SecurityPackages       - Enumerates the security packages currently available using EnumerateSecurityPackagesA()
  Services               - Services with file info company names that don't contain 'Microsoft', "-full" dumps all processes
+ SlackDownloads         - Parses any found 'slack-downloads' files
+ SlackPresence          - Checks if interesting Slack files exist
+ SlackWorkspaces        - Parses any found 'slack-workspaces' files
+ SuperPutty             - SuperPutty configuration files
+ Sysmon                 - Sysmon configuration from the registry
+ SysmonEvents           - Sysmon process creation logs (1) with sensitive data.
  TcpConnections         - Current TCP connections and their associated processes and services
  TokenGroups            - The current token's local and domain groups
  TokenPrivileges        - Currently enabled token privileges (e.g. SeDebugPrivilege/etc.)
+ UAC                    - UAC system policies via the registry
  UdpConnections         - Current UDP connections and associated processes and services
  UserRightAssignments   - Configured User Right Assignments (e.g. SeDenyNetworkLogonRight, SeShutdownPrivilege, etc.) argument == computername to enumerate
  WifiProfile            - Enumerates the saved Wifi profiles and extract the ssid, authentication type, cleartext key/passphrase (when possible)
+ WindowsAutoLogon       - Registry autologon information
  WindowsCredentialFiles - Windows credential DPAPI blobs
+ WindowsDefender        - Windows Defender settings (including exclusion locations)
+ WindowsEventForwarding - Windows Event Forwarding (WEF) settings via the registry
+ WindowsFirewall        - Non-standard firewall rules, "-full" dumps all (arguments == allow/deny/tcp/udp/in/out/domain/private/public)
  WindowsVault           - Credentials saved in the Windows Vault (i.e. logins from Internet Explorer and Edge).
+ WMI                    - Runs a specified WMI query
  WMIEventConsumer       - Lists WMI Event Consumers
  WMIEventFilter         - Lists WMI Event Filters
  WMIFilterBinding       - Lists WMI Filter to Consumer Bindings
+ WSUS                   - Windows Server Update Services (WSUS) settings, if applicable

You can invoke command groups with         "Seatbelt.exe <group>"


Or command groups except specific commands "Seatbelt.exe <group> -Command"

    azuread, Certificates, CertificateThumbprints, ChromiumPresence, CloudCredentials, 
    CloudSyncProviders, CredEnum, dir, DpapiMasterKeys, 
    ExplorerMRUs, ExplorerRunCommands, FileZilla, FirefoxPresence, 
    IdleTime, IEFavorites, IETabs, IEUrls, 
    KeePass, MappedDrives, MTPuTTY, OfficeMRUs, 
    OneNote, OracleSQLDeveloper, PowerShellHistory, PuttyHostKeys, 
    PuttySessions, RDCManFiles, RDPSavedConnections, SecPackageCreds, 
    SlackDownloads, SlackPresence, SlackWorkspaces, SuperPutty, 
    TokenGroups, WindowsCredentialFiles, WindowsVault

    AMSIProviders, AntiVirus, AppLocker, ARPTable, AuditPolicies, 
    AuditPolicyRegistry, AutoRuns, Certificates, CertificateThumbprints, 
    CredGuard, DNSCache, DotNet, EnvironmentPath, 
    EnvironmentVariables, Hotfixes, InterestingProcesses, InternetSettings, 
    LAPS, LastShutdown, LocalGPOs, LocalGroups, 
    LocalUsers, LogonSessions, LSASettings, McAfeeConfigs, 
    NamedPipes, NetworkProfiles, NetworkShares, NTLMSettings, 
    OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, 
    Processes, PSSessionSettings, RDPSessions, RDPsettings, 
    SCCM, SecureBoot, Services, Sysmon, 
    TcpConnections, TokenPrivileges, UAC, UdpConnections, 
    UserRightAssignments, WifiProfile, WindowsAutoLogon, WindowsDefender, 
    WindowsEventForwarding, WindowsFirewall, WMI, WMIEventConsumer, 
    WMIEventFilter, WMIFilterBinding, WSUS

    SlackDownloads, SlackPresence, SlackWorkspaces

    ChromiumBookmarks, ChromiumHistory, ChromiumPresence

    AMSIProviders, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, 
    DNSCache, DotNet, DpapiMasterKeys, EnvironmentVariables, 
    ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, 
    InterestingProcesses, KeePass, LastShutdown, LocalGroups, 
    LocalUsers, LogonEvents, LogonSessions, LSASettings, 
    MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, 
    OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, 
    ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, 
    RDPSavedConnections, RDPSessions, RDPsettings, SecureBoot, 
    Sysmon, WindowsDefender, WindowsEventForwarding, WindowsFirewall
    

    ChromiumBookmarks, ChromiumHistory, ExplicitLogonEvents, FileInfo, FirefoxHistory, 
    InstalledProducts, InterestingFiles, LogonEvents, LOLBAS, 
    McAfeeSiteList, MicrosoftUpdates, OutlookDownloads, PowerShellEvents, 
    Printers, ProcessCreationEvents, ProcessOwners, RecycleBin, 
    reg, RPCMappedEndpoints, ScheduledTasks, SearchIndex, 
    SecurityPackages, SysmonEvents

**注意:** 针对用户的搜索在未提权时对当前用户运行，在提权时对所有用户运行。

## 命令组

**注意：** 许多命令默认会进行某种过滤。提供 `-full` 参数可防止过滤输出。此外，命令组 `all` 将运行所有当前检查。

例如，以下命令将运行所有检查并返回所有输出：

`Seatbelt.exe -group=all -full`

### system

运行检查，挖掘关于系统的有趣数据。

执行方式：`Seatbelt.exe -group=system`

| Command | Description |
| ----------- | ----------- |
| AMSIProviders | 为AMSI注册的提供程序 |
| AntiVirus | 已注册的防病毒软件（通过WMI） |
| AppLocker | AppLocker设置（若已安装） |
| ARPTable | 列出当前ARP表及适配器信息（相当于 arp -a） |
| AuditPolicies | 枚举经典和高级审核策略设置 |
| AuditPolicyRegistry | 通过注册表获取审核设置 |
| AutoRuns | 自动运行的可执行程序/脚本/程序 |
| Certificates | 用户和计算机个人证书文件 |
| CertificateThumbprints | 系统中所有证书存储证书的指纹 |
| CredGuard | CredentialGuard配置 |
| DNSCache | DNS缓存条目（通过WMI） |
| DotNet | .NET版本 |
| EnvironmentPath | 当前环境%PATH$文件夹及SDDL信息 |
| EnvironmentVariables | 当前用户环境变量 |
| Hotfixes | 已安装的热补丁（通过WMI） |
| InterestingProcesses | “有趣”的进程——防御产品和管理工具 |
| InternetSettings | 互联网设置，包括代理配置 |
| LAPS | LAPS设置（若已安装） |
| LastShutdown | 返回上次系统关闭的日期时间（通过注册表） |
| LocalGPOs | 应用于计算机/本地用户的本地组策略设置 |
| LocalGroups | 非空本地组，“full”显示所有组（参数==要枚举的计算机名） |
| LocalUsers | 本地用户，是否启用/禁用，及密码最后设置时间（参数==要枚举的计算机名） |
| LogonSessions | 安全事件日志中的登录事件（事件ID 4624）。默认最近10天，参数==最近X天。 |
| LSASettings | LSA设置（包括身份验证包） |
| McAfeeConfigs | 查找McAfee配置文件 |
| NamedPipes | 命名管道名称及任何可读的ACL信息 |
| NetworkProfiles | Windows网络配置文件 |
| NetworkShares | 计算机暴露的网络共享（通过WMI） |
| NTLMSettings | NTLM身份验证设置 |
| OptionalFeatures | 待办 |
| OSInfo | 基本操作系统信息（如架构、操作系统版本等） |
| PoweredOnEvents | 基于系统事件日志EID 1、12、13、42和6008的重启和睡眠计划。默认最近7天，参数==最近X天。 |
| PowerShell | PowerShell版本及安全设置 |
| Processes | 运行中的进程，其文件信息公司名称不包含“Microsoft”，“full”枚举所有进程 |
| PSSessionSettings | 从注册表枚举PS会话设置 |
| RDPSessions | 当前传入的RDP会话（参数==要枚举的计算机名） |
| RDPsettings | 远程桌面服务器/客户端设置 |
| SCCM | 系统中心配置管理器（SCCM）设置（若适用） |
| Services | 服务，其文件信息公司名称不包含“Microsoft”，“full”转储所有进程 |
| Sysmon | 从注册表获取Sysmon配置 |
| TcpConnections | 当前TCP连接及其关联进程和服务 |
| TokenPrivileges | 当前启用的令牌特权（如SeDebugPrivilege等） |
| UAC | 通过注册表获取UAC系统策略 |
| UdpConnections | 当前UDP连接及其关联进程和服务 |
| UserRightAssignments | 配置的用户权限分配（如SeDenyNetworkLogonRight、SeShutdownPrivilege等），参数==要枚举的计算机名 |
| WifiProfile | 待办 |
| WindowsAutoLogon | 注册表自动登录信息 |
| WindowsDefender | Windows Defender设置（包括排除位置） |
| WindowsEventForwarding | 通过注册表获取Windows事件转发（WEF）设置 |
| WindowsFirewall | 非标准防火墙规则，“full”转储所有规则（参数== allow/deny/tcp/udp/in/out/domain/private/public） |
| WMIEventConsumer | 列出WMI事件消费者 |
| WMIEventFilter | 列出WMI事件过滤器 |
| WMIFilterBinding | 列出WMI过滤器到消费者的绑定 |
| WSUS | Windows Server Update Services（WSUS）设置（若适用） |

### user

运行检查，挖掘关于当前登录用户（若未提权）或所有用户（若提权）的有趣数据。

执行方式：`Seatbelt.exe -group=user`

| Command | Description |
| ----------- | ----------- |
| Certificates | 用户和计算机个人证书文件 |
| CertificateThumbprints | 系统中所有证书存储证书的指纹 |
| ChromiumPresence | 检查是否存在有趣的Chrome/Edge/Brave/Opera文件 |
| CloudCredentials | AWS/Google/Azure云凭证文件 |
| CloudSyncProviders | 待办 |
| CredEnum | 使用CredEnumerate()枚举当前用户已保存的凭据 |
| dir | 列出文件/文件夹。默认列出用户的下载、文档和桌面文件夹（参数== \<目录\> \<深度\> \<正则表达式\>） |
| DpapiMasterKeys | 列出DPAPI主密钥 |
| Dsregcmd | 待办 |
| ExplorerMRUs | 资源管理器最近使用的文件（最近7天，参数==最近X天） |
| ExplorerRunCommands | 最近的资源管理器“运行”命令 |
| FileZilla | FileZilla配置文件 |
| FirefoxPresence | 检查是否存在有趣的Firefox文件 |
| IdleTime | 返回自当前用户上次输入以来的秒数 |
| IEFavorites | Internet Explorer收藏夹 |
| IETabs | 打开的Internet Explorer标签页 |
| IEUrls | Internet Explorer输入的URL（最近7天，参数==最近X天） |
| KeePass | 待办 |
| MappedDrives | 用户映射的驱动器（通过WMI） |
| OfficeMRUs | Office最近使用的文件列表（最近7天） |
| OneNote | 待办 |
| OracleSQLDeveloper | 待办 |
| PowerShellHistory | 遍历每个本地用户，尝试读取其PowerShell控制台历史记录，若成功则打印 |
| PuttyHostKeys | 已保存的Putty SSH主机密钥 |
| PuttySessions | 已保存的Putty配置（有趣字段）及SSH主机密钥 |
| RDCManFiles | Windows远程桌面连接管理器设置文件 |
| RDPSavedConnections | 存储在注册表中的已保存RDP连接 |
| SecPackageCreds | 从安全包获取凭据 |
| SlackDownloads | 解析任何找到的'slack-downloads'文件 |
| SlackPresence | 检查是否存在有趣的Slack文件 |
| SlackWorkspaces | 解析任何找到的'slack-workspaces'文件 |
| SuperPutty | SuperPutty配置文件 |
| TokenGroups | 当前令牌的本地和域组 |
| WindowsCredentialFiles | Windows凭据DPAPI blob |
| WindowsVault | Windows保管库中保存的凭据（如Internet Explorer和Edge的登录信息） |

### misc

运行所有杂项检查。

执行方式：`Seatbelt.exe -group=misc`

| Command | Description |
| ----------- | ----------- |
| ChromiumBookmarks | 解析任何找到的Chrome/Edge/Brave/Opera书签文件 |
| ChromiumHistory | 解析任何找到的Chrome/Edge/Brave/Opera历史记录文件 |
| ExplicitLogonEvents | 安全事件日志中的显式登录事件（事件ID 4648）。默认最近7天，参数==最近X天。 |
| FileInfo | 文件信息（版本信息、时间戳、基本PE信息等，参数==文件路径） |
| FirefoxHistory | 解析任何找到的FireFox历史记录文件 |
| InstalledProducts | 通过注册表获取已安装的产品 |
| InterestingFiles | 用户文件夹中匹配各种模式的“有趣”文件。注意：需要较多时间。 |
| LogonEvents | 安全事件日志中的登录事件（事件ID 4624）。默认最近10天，参数==最近X天。 |
| LOLBAS | 定位系统上的Living Off The Land Binaries and Scripts (LOLBAS)。注意：需要较多时间。 |
| McAfeeSiteList | 解密任何找到的McAfee SiteList.xml配置文件。 |
| MicrosoftUpdates | 所有Microsoft更新（通过COM） |
| OutlookDownloads | 列出由Outlook下载的文件 |
| PowerShellEvents | 包含敏感数据的PowerShell脚本块日志（4104）。 |
| Printers | 已安装的打印机（通过WMI） |
| ProcessCreationEvents | 包含敏感数据的进程创建日志（4688）。 |
| ProcessOwners | 非会话0的运行中进程列表及其所有者。用于远程使用。 |
| RecycleBin | 回收站中最近30天内删除的项目——仅从用户上下文有效！ |
| reg | 注册表键值（默认HKLM\Software）参数== [Path] [intDepth] [Regex] [boolIgnoreErrors] |
| RPCMappedEndpoints | 当前RPC端点映射 |
| ScheduledTasks | 非由“Microsoft”创作的计划任务（通过WMI），“full”转储所有计划任务 |
| SearchIndex | Windows搜索索引的查询结果，默认搜索词为'passsword'。（参数== \<搜索路径\> \<模式1,模式2,...\>） |
| SecurityPackages | 使用EnumerateSecurityPackagesA()枚举当前可用的安全包 |
| SysmonEvents | 包含敏感数据的Sysmon进程创建日志（1）。 |

### 附加命令组

执行方式：`Seatbelt.exe -group=GROUPNAME`

| Alias | Description |
| ----------- | ----------- |
| Slack | 运行以“Slack*”开头的模块 |
| Chromium | 运行以“Chromium*”开头的模块 |
| Remote | 运行以下模块（用于远程系统）：AMSIProviders, AntiVirus, AuditPolicyRegistry, ChromiumPresence, CloudCredentials, DNSCache, DotNet, DpapiMasterKeys, EnvironmentVariables, ExplicitLogonEvents, ExplorerRunCommands, FileZilla, Hotfixes, InterestingProcesses, KeePass, LastShutdown, LocalGroups, LocalUsers, LogonEvents, LogonSessions, LSASettings, MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings, OptionalFeatures, OSInfo, PoweredOnEvents, PowerShell, ProcessOwners, PSSessionSettings, PuttyHostKeys, PuttySessions, RDPSavedConnections, RDPSessions, RDPsettings, Sysmon, WindowsDefender, WindowsEventForwarding, WindowsFirewall |

## 命令参数

接受参数的命令在其描述中有所注明。要向命令传递参数，请将命令和参数用双引号括起来。

例如，以下命令返回最近30天的4624登录事件：

`Seatbelt.exe "LogonEvents 30"`

以下命令会查询注册表三层深度，仅返回与正则表达式 `.*defini.*` 匹配的键/值名称/值，并忽略任何出现的错误。

`Seatbelt.exe "reg \"HKLM\SOFTWARE\Microsoft\Windows Defender\" 3 .*defini.* true"`

## 输出

Seatbelt 可以使用 `-outputfile="C:\Path\file.txt"` 参数将输出重定向到文件。如果文件路径以.json结尾，输出将是结构化的json。

例如，以下命令将系统检查的结果输出到txt文件：

`Seatbelt.exe -group=system -outputfile="C:\Temp\system.txt"`

## 远程枚举

在帮助菜单中标注了+的命令可以针对另一个系统远程运行。这是通过WMI查询WMI类以及WMI的StdRegProv进行注册表枚举来执行的。

要枚举远程系统，请提供 `-computername=COMPUTER.DOMAIN.COM` - 可以使用 `-username=DOMAIN\USER -password=PASSWORD` 指定备用用户名和密码。

例如，以下命令针对远程系统运行远程相关检查：

`Seatbelt.exe -group=remote -computername=192.168.230.209 -username=THESHIRE\sam -password="yum \"po-ta-toes\""`

## 构建自己的模块

Seatbelt 的结构是完全模块化的，允许将额外的命令模块放入文件结构并动态加载。

有一个带注释的命令模块模板位于 `.\Seatbelt\Commands\Template.cs` 可供参考。构建完成后，将模块放在逻辑文件位置，在Visual Studio解决方案资源管理器中将其包含到项目中，然后编译。

## 编译说明

我们不打算发布Seatbelt的二进制文件，因此您需要自行编译。

Seatbelt 已针对 .NET 3.5 和 4.0 构建，使用 C# 8.0 特性，并兼容 [Visual Studio Community Edition](https://visualstudio.microsoft.com/downloads/)。只需打开项目的 .sln 文件，选择“release”，然后构建。要更改目标 .NET 框架版本，[修改项目设置](https://github.com/GhostPack/Seatbelt/issues/27) 并重新构建项目。

## 致谢

Seatbelt 融入了各种收集项、C# 代码片段以及研究中发现的部分 PoC，以实现其功能。这些想法、片段和作者在源代码的适当位置进行了标注，包括：* [@andrewchiles](https://twitter.com/andrewchiles) 的 [HostEnum.ps1](https://github.com/threatexpress/red-team-scripts/blob/master/HostEnum.ps1) 脚本和 [@tifkin\_](https://twitter.com/tifkin_) 的 [Get-HostProfile.ps1](https://github.com/leechristensen/Random/blob/master/PowerShellScripts/Get-HostProfile.ps1) 为许多要收集的工件提供了灵感。
* Boboes 关于 [NetLocalGroupGetMembers 的代码](https://stackoverflow.com/questions/33935825/pinvoke-netlocalgroupgetmembers-runs-into-fatalexecutionengineerror/33939889#33939889)
* [ambyte 将映射驱动器号转换为网络路径的代码](https://gist.github.com/ambyte/01664dc7ee576f69042c)
* [Igor Korkhov 检索当前令牌组信息的代码](https://stackoverflow.com/questions/2146153/how-to-get-the-logon-sid-in-c-sharp/2146418#2146418)
* [RobSiklos 判断主机是否为虚拟机的片段](https://stackoverflow.com/questions/498371/how-to-detect-if-my-application-is-running-in-a-virtual-machine/11145280#11145280)
* [JGU 关于文件/文件夹 ACL 权限比较的片段](https://stackoverflow.com/questions/1410127/c-sharp-test-if-user-has-write-access-to-a-folder/21996345#21996345)
* [Rod Stephens 用于递归文件枚举的模式](http://csharphelper.com/blog/2015/06/find-files-that-match-multiple-patterns-in-c/)
* [SwDevMan81 用于枚举当前令牌权限的片段](https://stackoverflow.com/questions/4349743/setting-size-of-token-privileges-luid-and-attributes-array-returned-by-gettokeni)
* [Jared Atkinson 关于 Kerberos 票据缓存的 PowerShell 工作](https://github.com/Invoke-IR/ACE/blob/master/ACE-Management/PS-ACE/Scripts/ACE_Get-KerberosTicketCache.ps1)
* [darkmatter08 的 Kerberos C# 片段](https://www.dreamincode.net/forums/topic/135033-increment-memory-pointer-issue/)
* 众多 [PInvoke.net](https://www.pinvoke.net/) 示例 <3
* [Jared Hill 出色的 CodeProject 文章，使用本地安全机构枚举用户会话](https://www.codeproject.com/Articles/18179/Using-the-Local-Security-Authority-to-Enumerate-Us)
* [Fred 关于查询 ARP 缓存的代码](https://social.technet.microsoft.com/Forums/lync/en-US/e949b8d6-17ad-4afc-88cd-0019a3ac9df9/powershell-alternative-to-arp-a?forum=ITCG)
* [ShuggyCoUk 关于查询 TCP 连接表的片段](https://stackoverflow.com/questions/577433/which-pid-listens-on-a-given-port-in-c-sharp/577660#577660)
* [yizhang82 使用反射通过 C# 与 COM 对象交互的示例](https://gist.github.com/yizhang82/a1268d3ea7295a8a1496e01d60ada816)
* [@djhohnstein](https://twitter.com/djhohnstein) 的 [SharpWeb 项目](https://github.com/djhohnstein/SharpWeb/blob/master/Edge/SharpEdge.cs)
* [@djhohnstein](https://twitter.com/djhohnstein) 的 [EventLogParser 项目](https://github.com/djhohnstein/EventLogParser)
* [@cmaddalena](https://twitter.com/cmaddalena) 的 [SharpCloud 项目](https://github.com/chrismaddalena/SharpCloud)，BSD 3-Clause 许可证
* [@_RastaMouse](https://twitter.com/_RastaMouse) 的 [Watson 项目](https://github.com/rasta-mouse/Watson/)，GPL 许可证
* [@_RastaMouse](https://twitter.com/_RastaMouse) 关于 [AppLocker 枚举的工作](https://rastamouse.me/2018/09/enumerating-applocker-config/)
* [@peewpw](https://twitter.com/peewpw) 的 [Invoke-WCMDump 项目](https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.ps1)，GPL 许可证
* TrustedSec 的 [HoneyBadger 项目](https://github.com/trustedsec/HoneyBadger/tree/master/modules/post/windows/gather)，BSD 3-Clause 许可证
* CENTRAL Solutions 的 [用户权限分配审计项目](https://www.centrel-solutions.com/support/tools.aspx?feature=auditrights)，无许可证
* 收集创意灵感来源于 [@ukstufus](https://twitter.com/ukstufus) 的 [Reconerator](https://github.com/stufus/reconerator)
* Office MRU 位置和时间戳解析信息来自 Dustin Hurlbut 的白皮书 [Microsoft Office 2007, 2010 - Registry Artifacts](https://ad-pdf.s3.amazonaws.com/Microsoft_Office_2007-2010_Registry_ArtifactsFINAL.pdf)
* [Windows 命令列表](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands)，用于构造敏感正则表达式
* [Ryan Ries 用于枚举映射 RPC 端点的代码](https://stackoverflow.com/questions/21805038/how-do-i-pinvoke-rpcmgmtepeltinqnext)
* [Chris Haas 关于 EnumerateSecurityPackages() 的帖子](https://stackoverflow.com/a/5941873)
* [darkoperator](https://github.com/ghostpack/seatbelt/blob/HEAD/carlos_perez) 在 [HoneyBadger 项目](https://github.com/trustedsec/HoneyBadger) 上的工作
* [@airzero24](https://twitter.com/airzero24) 在 [WMI 注册表枚举](https://github.com/airzero24/WMIReg) 上的工作
* Alexandru 关于 [RegistryKey.OpenBaseKey 替代方案的回答](https://stackoverflow.com/questions/26217199/what-are-some-alternatives-to-registrykey-openbasekey-in-net-3-5)
* Tomas Vera 关于 [JavaScriptSerializer 的帖子](http://www.tomasvera.com/programming/using-javascriptserializer-to-parse-json-objects/)
* Marc Gravell 关于 [递归列出文件/文件夹的说明](https://stackoverflow.com/a/929418)
* [@mattifestation](https://twitter.com/mattifestation) 的 [Sysmon 规则解析器](https://github.com/mattifestation/PSSysmonTools/blob/master/PSSysmonTools/Code/SysmonRuleParser.ps1#L589-L595)
* 部分灵感来自 spolnik 的 [Simple.CredentialsManager 项目](https://github.com/spolnik/Simple.CredentialsManager)，Apache 2 许可证
* [这篇关于 Credential Guard 设置的帖子](https://www.tenforums.com/tutorials/68926-verify-if-device-guard-enabled-disabled-windows-10-a.html)
* [这个关于网络配置文件信息的帖子](https://social.technet.microsoft.com/Forums/windows/en-US/b0e13a16-51a6-4aca-8d44-c85e097f882b/nametype-in-nla-information-for-a-network-profile)
* Mark McKinnon 关于 [解码 DateCreated 和 DateLastConnected SSID 值的帖子](http://cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html)
* 这篇 Specops 关于 [组策略缓存的帖子](https://specopssoft.com/blog/things-work-group-policy-caching/)
* sa_ddam213 在 StackOverflow 上关于 [枚举回收站中项目的帖子](https://stackoverflow.com/questions/18071412/list-filenames-in-the-recyclebin-with-c-sharp-without-using-any-external-files)
* Kirill Osenkov 用于 [托管程序集检测的代码](https://stackoverflow.com/a/15608028)
* [Mono 项目](https://github.com/mono/linux-packaging-mono/blob/d356d2b7db91d62b80a61eeb6fbc70a402ac3cac/external/corefx/LICENSE.TXT) 提供的 SecBuffer/SecBufferDesc 类
* [Elad Shamir](https://twitter.com/elad_shamir) 及其 [Internal-Monologue](https://github.com/eladshamir/Internal-Monologue/) 项目，[Vincent Le Toux](https://twitter.com/mysmartlogon) 及其 [DetectPasswordViaNTLMInFlow](https://github.com/vletoux/DetectPasswordViaNTLMInFlow/) 项目，以及 Lee Christensen 的这个 [GetNTLMChallenge](https://github.com/leechristensen/GetNTLMChallenge/) 项目。它们均为 SecPackageCreds 命令提供了灵感。
* @leftp 和 @eksperience 的 [Gopher 项目](https://github.com/EncodeGroup/Gopher) 为 FileZilla 和 SuperPutty 命令提供了灵感
* @funoverip 提供的原始 McAfee SiteList.xml 解密代码

我们已尽力做到引用周全，但如果遗漏了某人或某处，请告知我们！