seguridad/3.- Ejercicios/23_06_08_get_logs.ps1

$logs_files = (
"$env:WINDIR\setupact.log",
"$env:WINDIR\setuperr.log",
"$env:WINDIR\WindowsUpdate.log",
"$env:WINDIR\Debug\mrt.log",
"$env:WINDIR\security\logs\scecomp.old",
"$env:WINDIR\SoftwareDistribution\ReportingEvents.log",
"$env:WINDIR\Logs\CBS\CBS.log",
"$env:APPDATA\setupapi.log",
"$env:WINDIR\INF\setupapi.dev.log",
"$env:WINDIR\INF\setupapi.app.log",
"$env:SYSTEMROOT\`$Windows.~BT\Sources\Panther\*.log",
"$env:SYSTEMROOT\`$Windows.~BT\Sources\Panther\*.xml",
"$env:WINDIR\PANTHER\*.log",
"$env:WINDIR\PANTHER\*.xml",
"$env:WINDIR\INF\setupapi.dev.log",
"$env:WINDIR\INF\setupapi.app.log",
"$env:WINDIR\Performance\Winsat\winsat.log",
"$env:WINDIR\System32\config\*",
"$env:WINDIR\System32\winevt\Logs\*",
"$env:PROGRAMDATA\\Microsoft\Windows Defender\Support\*"
)

$thishost = hostname
$timestamp = (Get-Date -Format "yyMMddHHmmss")
$path = (Get-Location).Path + '\'
$dir = $path + '\logs_' + $thishost + "_" + $timestamp
$hash_file = 'logs_' + $thishost + "_" + $timestamp + "\hashes.txt"
$zip = 'logs_' + $thishost + "_" + $timestamp + ".zip"
$localzip = $path + $zip
$ftp = 'ftp://ftp.holaformacion.com/ALUMNOS/Antonio/'
$ftpuser = "cod1.holaformacion.com"
$ftppasswd = "Atrium12022"
$remotefile = $ftp + $zip

New-Item -Path $dir -ItemType Directory

foreach ($file in $logs_files)
    {
    if ((Test-Path $file) -ne $false) 
        {
        $hash = Get-FileHash $file
        Write-Output $hash.Hash
        Add-Content $hash_file $file
        Add-Content $hash_file $hash.Hash
        Add-Content $hash_file "`n"
        Copy-Item $file -Destination $dir -Force
        }
    else 
        {
        Write-Output $file + "fichero no encontrado"
        }
    }
Compress-Archive -Path $dir -DestinationPath $localzip

Write-Output $remotefile
Write-Output $zip

$client = New-Object System.Net.WebClient
$client.Credentials = New-Object System.Net.NetworkCredential($ftpuser,$ftppasswd)
$client.UploadFile($remotefile, $localzip)