Back Door Admin Discovery and Removal

''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''       
' List local administrators across a network domain
'Copyright GPLv2  TechandWebGuy.com 
' Related Article with attachments 
'  http://webandtechguy.com/technology-blog/scripting-blog/90-vbs-scripting/90-checking-for-backdoor-admin-accounts-on-ad-domain
'Free use - just leave this in your script - its only fair
'REPLACE | with 
' If you want to debug the just remove the ' from the 'WScript.Echo
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Set Global Variables 
 
Dim oDomain, strComputer,oLocalGroup,Item,IsOnline
Dim filesys, testfile, strUser, WshEnv, WshShell, newUser, strLine
 
'Set variables for writing to text files
Const ForReading = 1, ForWriting = 2, ForAppending = 8
 
 
Set filesys = CreateObject("Scripting.FileSystemObject") 
 
' Set the path for the output file.  The d$ is an admin share that I use for getting write access.  I use this for security reasons.
Set testfile = filesys.OpenTextFile("||server|d$|Share|LocalAdminList.csv", ForAppending, True)
 
'This file is for pulling a list of computers - I used another script to make this
'There are no spaces before or after the computer name in this file.  You can use notepad++ to search and remove ZERO's.  
'Find example at my website - see link at to of script
Set sourceFile = filesys.OpenTextFile("||domain|NETLOGON|Scripts|Computer|ComputerList.txt", ForReading, True)
 
On Error Resume Next
'This will read the computerList.txt file and pull one line at a time for reading
Do Until sourceFile.AtEndOfStream
strNextLine = sourceFile.Readline
	If strNextLine <> "" Then
		IsOnline=PcOnline(strNextLine)
 
		'If so then list the local Administrators
		If IsOnline = true Then
			' WScript.Echo strNextLine
			  Set oLocalGroup = GetObject("WinNT://" & strNextLine & "/Administrators,group")
			  testfile.Write strNextLine & ", " & date() &", " & time()
			  For Each item In oLocalGroup.Members
				' Write it to a CSV File 
				returnName()
				testfile.Write ", " & newUser
			  Next
			  testfile.Write ", " &VBCRLF
		End If
	Else
	testfile.Close
	End If
Loop
'Closes the file
testfile.Close
 
'This lets you know the script is done
WScript.Echo "Done"
' This ends the Script 
WScript.Quit
 
 
 
 
Function returnName()
' Local Variable
Dim count
        ' This section removes the leading section from the Account type - it will only show the name 
	Trim(item.ADsPath)
	count = Len(item.ADsPath)
        ' You may need to change this from 14 to another size depending on the name of the domain
	fromRight = count - 14
	newUser = Right(item.ADsPath, fromRight)
	'WScript.Echo fromRight
	'WScript.Echo newUser
 
End Function 
 
 
Function PcOnline (strComputer)
'Check if the remote machine is online.
    Dim objPing,objStatus
 
    Set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}")._
        ExecQuery("select Replysize from Win32_PingStatus where address = '" & strComputer & "'")
 
    For Each objStatus in objPing
        If  IsNull(objStatus.ReplySize) Then
            PcOnline=False
           ' Wscript.Echo strComputer & " is NOT available"
         Else
            PcOnline = True
            'Wscript.Echo strComputer & " is responding to a ping"
          End If
    Next
    Set objPing=Nothing
    Set objStatus=Nothing
End Function
 
 

''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''       
' List local administrators across a network domain
'Copyright GPLv2  TechandWebGuy.com 
' Related Article with attachments 
'  http://webandtechguy.com/technology-blog/scripting-blog/90-vbs-scripting/90-checking-for-backdoor-admin-accounts-on-ad-domain
'Free use - just leave this in your script - its only fair
' If you want to debug the just remove the ' from the 'Debug
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Add the list of computers here
strMachines = "computer1;Techandwebguy-computer;domain-computer1"
'List the users you found here
strUser = "backdooradmin;anotheruser;ronpaul"
 
aMachines = split(strMachines, ";")
aUsers = split(strUser, ";")
 
 
 
 For Each machine in aMachines
    Set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}")._
        ExecQuery("select * from Win32_PingStatus where address = '"_
            & machine & "'")
    For Each objStatus in objPing
        If IsNull(objStatus.StatusCode) or objStatus.StatusCode<>0 Then 
           ' Debug "The Computer is OFF"
        Else
		For Each users in aUsers 
			setDelete()
			'Debug "The Computer is ON"
		Next
		End If
 
    Next
Next
WScript.Echo "The Script is done running.  "
WScript.Quit
 
 
 
function setDelete()
Dim copyAccount,objComputer
	On Error Resume Next
	Set objComputer = GetObject("WinNT://" & machine & "")
	If Err = 0 Then
 
		objComputer.Delete "user", users
		returnDel = "True"
		objExcel.Cells(intRow, colDelete).Value = "Completed"
		'Debug "Deleted Local user: " & user & " if the existed on the target machine"
	Else
		'Debug("TheDelete account Failed with the Error of: ")
		DisplayErrorInfo
	End If
End function
 
Sub Debug( myText )
  ' Uncomment the next line to turn off debugging
  ' Exit Sub
 
  If Not IsObject( objIEDebugWindow ) Then
    Set objIEDebugWindow = CreateObject( "InternetExplorer.Application" )
    objIEDebugWindow.Navigate "about:blank"
    objIEDebugWindow.Visible = True
    objIEDebugWindow.ToolBar = True
    objIEDebugWindow.Width   = 600
    objIEDebugWindow.Height  = 400
    objIEDebugWindow.Left    = 10
    objIEDebugWindow.Top     = 10
    Do While objIEDebugWindow.Busy
      WScript.Sleep 100
    Loop
    objIEDebugWindow.Document.Title = "IE Debug Window" & Date & Time
    objIEDebugWindow.Document.Body.InnerHTML = _
                 "<b>" & Now & "</b></br>"
  End If
  objIEDebugWindow.Document.Body.InnerHTML = _
                   objIEDebugWindow.Document.Body.InnerHTML _
                   & myText & "<br>" & vbCrLf
End Sub