2 Commits
1.2 ... main

Author SHA1 Message Date
pyro57000
df9c8899b2 cleaned up the initial comments 2025-10-23 15:16:19 -05:00
pyro57000
ec23b722f1 added some basic filtering 2025-10-20 13:10:55 -05:00
4 changed files with 90 additions and 53 deletions

2
Cargo.lock generated
View File

@@ -257,7 +257,7 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
[[package]] [[package]]
name = "snaferrous" name = "snaferrous"
version = "0.1.0" version = "1.2.0"
dependencies = [ dependencies = [
"clap", "clap",
"colored", "colored",

View File

@@ -1,6 +1,6 @@
[package] [package]
name = "snaferrous" name = "snaferrous"
version = "0.1.0" version = "1.2.0"
edition = "2024" edition = "2024"
[dependencies] [dependencies]

View File

@@ -22,6 +22,12 @@ Options:
-t, --targets <TARGETS> specific targets. should be comma separated. -t, --targets <TARGETS> specific targets. should be comma separated.
-f, --filter_targets <targets> specific targets that should be ingored. Comma separated.
-l, --local scan the current hot's file system (defaults to false)
-d --disable_network disable network file discovery
-v, --verbose echo all found files to the console, regardless of keyword matching. (all files will still be saved to the log file) -v, --verbose echo all found files to the console, regardless of keyword matching. (all files will still be saved to the log file)
-h, --help Print help (see more with '--help') -h, --help Print help (see more with '--help')

View File

@@ -12,24 +12,10 @@ use tokio;
use tokio::sync::mpsc::{channel, Sender}; use tokio::sync::mpsc::{channel, Sender};
/* /*
Author: Kevin (Kaged Pyro) Gunter Author: Kevin (Bu4$t_Py40) Gunter
Purpose: I got tired of snaffler getting caught, so I rewrote it in rust, which edrs have trouble detecting. Purpose: I got tired of snaffler getting caught, so I rewrote it in rust, which edrs have trouble detecting.
*/ */
/*#[derive(Parser, Debug)]
#[command(version, about, long_about = Some("finds shares, but its written in rust which sometimes gets past EDR!"))]
struct Args{
#[arg(short, long, help = "path to save output file Defaults to not saving output.")]
outfile: Option<PathBuf>,
#[arg(short, long, help = "number of threads to use, default to 10. \\nNote thre thread count will be doubled, one set for share finder tasks, and one set for file and infor finding tasks.")]
threads: Option<usize>,
#[arg(short, long, help = "specific targets. should be comma separated.")]
targets: Option<String>,
}*/
#[derive(Parser, Debug)] #[derive(Parser, Debug)]
#[command(version, about, long_about = Some("finds shares, but its written in rust which sometimes gets past EDR!"))] #[command(version, about, long_about = Some("finds shares, but its written in rust which sometimes gets past EDR!"))]
struct Args{ struct Args{
@@ -42,8 +28,17 @@ struct Args{
#[arg(short, long, help = "specific targets. should be comma separated.")] #[arg(short, long, help = "specific targets. should be comma separated.")]
targets: Option<String>, targets: Option<String>,
#[arg(short, long, help = "specific targets that should be ignored. comma separated.")]
filter_targets: Option<String>,
#[arg(short, long, help = "echo all found files to the console, regardless of keyword matching. (all files will still be saved to the log file)")] #[arg(short, long, help = "echo all found files to the console, regardless of keyword matching. (all files will still be saved to the log file)")]
verbose: bool, verbose: bool,
#[arg(short, long, help = "scan only the current host's files")]
local: bool,
#[arg(short, long, help = "disable network discovery")]
diable_network: bool
} }
#[derive(Clone)] #[derive(Clone)]
@@ -151,6 +146,8 @@ async fn task_handler(id: usize, current_task: FinderTask, tx: Sender<Message>){
"it", "it",
"identified", "identified",
"username", "username",
"admin",
"administrator",
]; ];
let mut file_content = String::new(); let mut file_content = String::new();
for extension in &files_to_read{ for extension in &files_to_read{
@@ -273,6 +270,11 @@ print!{
let mut threads = 10; let mut threads = 10;
let mut save = false; let mut save = false;
let mut computers = Vec::new(); let mut computers = Vec::new();
let mut filter_computers = Vec::new();
let mut network = true;
let file_filter = vec![
String::from("ADMIN$")
];
if args.outfile.is_some(){ if args.outfile.is_some(){
outfile = args.outfile.unwrap(); outfile = args.outfile.unwrap();
save = true; save = true;
@@ -280,20 +282,43 @@ print!{
if args.threads.is_some(){ if args.threads.is_some(){
threads = args.threads.unwrap(); threads = args.threads.unwrap();
} }
if args.diable_network{
network = false;
}
if args.targets.is_some(){ if args.targets.is_some(){
println!("gathering the targets you gave me."); println!("gathering the targets you gave me.");
let targets = args.targets.unwrap(); let targets = args.targets.unwrap();
if targets.contains(","){ if targets.contains(","){
let split_targets: Vec<&str> = targets.split(",").collect(); let split_targets: Vec<&str> = targets.split(",").collect();
for target in split_targets{ for target in split_targets{
computers.push(target.to_string()); computers.push(target.trim().to_lowercase());
} }
} }
else{ else{
computers.push(targets); computers.push(targets);
} }
} }
if args.filter_targets.is_some(){
println!("gathering the filter you specified!");
let given_filter = args.filter_targets.unwrap();
let filters: Vec<&str> = given_filter.split(",").collect();
for filter in filters{
filter_computers.push(filter.trim().to_lowercase());
}
}
let hostname_res = Command::new("hostname").output();
if hostname_res.is_ok(){
let hostname_output = hostname_res.unwrap();
if hostname_output.stdout.len() > 0{
let hostname_string = String::from_utf8_lossy(&hostname_output.stdout).to_string();
if args.local{
computers.push(hostname_string.trim().to_lowercase());
}
else{ else{
filter_computers.push(hostname_string.trim().to_lowercase());
}
}
if network{
println!("no targets given, proceeding with domain computer enumeration..."); println!("no targets given, proceeding with domain computer enumeration...");
println!("finding computers..."); println!("finding computers...");
let command_string = String::from("net group \"domain computers\" /domain"); let command_string = String::from("net group \"domain computers\" /domain");
@@ -327,12 +352,16 @@ print!{
for word in words{ for word in words{
let mut computer_name = word.to_string(); let mut computer_name = word.to_string();
computer_name.pop(); computer_name.pop();
computers.push(computer_name); computers.push(computer_name.trim().to_lowercase());
} }
} }
} }
} }
} }
}
if filter_computers.len() > 0{
computers.retain(|x| !filter_computers.iter().any(|y| y==x));
}
let mut tasks = Vec::new(); let mut tasks = Vec::new();
let mut id_counter = 0; let mut id_counter = 0;
for computer in &computers{ for computer in &computers{
@@ -423,10 +452,12 @@ print!{
} }
} }
} }
if !file_filter.contains(&finding.path){
let new_task = FinderTask{id: id_counter, tasktype: TaskType::File, target: finding.path}; let new_task = FinderTask{id: id_counter, tasktype: TaskType::File, target: finding.path};
tasks.push(new_task); tasks.push(new_task);
id_counter += 1; id_counter += 1;
} }
}
TaskType::File => { TaskType::File => {
let new_task = FinderTask{id: id_counter, tasktype: TaskType::Info, target: finding.path}; let new_task = FinderTask{id: id_counter, tasktype: TaskType::Info, target: finding.path};
tasks.push(new_task); tasks.push(new_task);