15 replies to this topic

[extreme]

I found a solution that will grep the local hard drive if you specify C:\ for ex. at http://unxutils.sourceforge.net/ but I haven't found any Windows solution that can search through networked computers..


Also, is there a GREP solution that will automatically search entire hard drive, and not just scan subdirs of manualy specified disks?

[bonarez]

What are you trying to accomplish, grep file names or contents?

There's no solution to grep an entire networked hdd that I know of, but on windows it could be scripted if you enumerate the pc's, disks and their folders/files, then perform a regex on it.

Don't expect it to be fast though..

[extreme]

What are you trying to accomplish, grep file names or contents?

There's no solution to grep an entire networked hdd that I know of, but on windows it could be scripted if you enumerate the pc's, disks and their folders/files, then perform a regex on it.

Don't expect it to be fast though..

I want to grep CONTENT of files... The more features the better(like scanning inside ZIP, RAR file etc.)
For ex. my Windows network has following shares:
\\Win7COMP\$c
\\WorkStation\$d

I would like to grep them, but I haven't found software that can do it.. GREP software from http://unxutils.sourceforge.net/ can only scan local hard drives, one at a time..
POWERGREP can scan networked computers, but it's commercial.. :/

[bonarez]

I can prolly write a script that does regular expressions on text files, even speed up things by remoting execution to the machines themselves provided they 'talk the language'. But digging into archives and stuff. That's an entire project all together..

[Edu]

this may sound obvious but have you tried associating a drive letter to a network share, anonymously accessible, using eg. the command "net use" ?

This could do the trick.

[extreme]

Yeah, tried mapping, but doesn't work :/ Invalid argument...

[infiltrator]

I want to grep CONTENT of files... The more features the better(like scanning inside ZIP, RAR file etc.)
For ex. my Windows network has following shares:
\\Win7COMP\$c
\\WorkStation\$d

I would like to grep them, but I haven't found software that can do it.. GREP software from http://unxutils.sourceforge.net/ can only scan local hard drives, one at a time..
POWERGREP can scan networked computers, but it's commercial.. :/

From what I understood you want to search through the contents of files. What if the fie is encrypted? I guess you won't be able to find what you are looking for.

[Glyph]

Sounds like DLP to me.

[extreme]

Well, if it's encrypted, then it's covered in penetration testing point of view...

Have to ask What's DLP?

[DidierStevens]

Have to ask What's DLP?

Data Loss Prevention https://secure.wikim...ention_software

[illwill]

yea i havent found any good apps to do this, tried the mapped drive trick too and still same result

[No Dice]

Typically this can only be accomplished with agents installed on the hosts (HBSS, Mandiant) or a relevant NAC suite like Symantec and so on that reports back to an appliance(s). I’ve had to grep FW archives on network shares for domains which can take hours if not days.

[infiltrator]

Since we are all talking about DLP, I have found this nice article in the Computer world that talks about DLP.

http://www.computerw...leaks_headline/

[bonarez]

I’ve had to grep FW archives on network shares for domains which can take hours if not days.

Like said, We could probably speed things up. When we're talking windows machines, supporting winrm, we could speed this up by letting the remote machines do the grep. That way time to scan could be reduced to almost the same as doing it locally..

Winrm is not installed by default afaik though. If you can distribute this prior to do a scan like that > should work..

[No Dice]

Like said, We could probably speed things up. When we're talking windows machines, supporting winrm, we could speed this up by letting the remote machines do the grep.

I hear you bonarez and have been testing this out on a 2K8 & 2k3 DC using Group Policy for the push and tested grep queries (PowerShell Community Extensions Read-Archive) via powershell (on the host remotely) and so far everything’s working out. I’ve set up a basic starter policy using all the defaults for testing purposes but will work on a more stringent policy after a few more weeks of FW changes and adding Certs, changing ports, https, scripts, permissions etc…