FatalBulletHit

Connection Blocker

Jan 26th, 2019 (edited)
130
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. <# https://pastebin.com/kGhTXXA8
  2.  
  3. This script will add a network firewall rule which will block inbound and outbound traffic for either one or multiple applications.
  4. You can call this script with the parameter $InputObject or just drag and drop the application(s) and/or folder(s) onto the script.
  5.  
  6. Note:
  7.  
  8.     - You need administration rights
  9.     - Get-ChildItem is recursive
  10.     - For drag and drop you need to change/add these registry values (https://stackoverflow.com/a/14051969/9248774):
  11.    
  12.         [HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\ShellEx\DropHandler]
  13.         @="{60254CA5-953B-11CF-8C96-00AA00B8708C}"
  14.  
  15.         [HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Open\Command]
  16.         @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoLogo -ExecutionPolicy Unrestricted -File \"%1\" %*"
  17.  
  18.  
  19.  
  20. ConnectionBlocker.ps1 [-InputObject] <String[]>
  21.  
  22. ConnectionBlocker.ps1 -InputObject 'C:\folder\application.exe'
  23. ConnectionBlocker.ps1 -InputObject ('.\application1.exe', '.\application2.exe', '.\folder')
  24.  
  25. #>
  26.  
  27. Param (
  28.  
  29.     [Parameter(ValueFromRemainingArguments=$true)]
  30.     [string[]] $InputObject
  31.  
  32. )
  33.  
  34. $Host.UI.RawUI.WindowTitle = 'Connection Blocker'
  35.  
  36. if (!(New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  37.  
  38.     $InputObject | ForEach-Object {
  39.  
  40.         [string]$ArgString += "'$_', "
  41.  
  42.     }
  43.    
  44.     Start-Process PowerShell -ArgumentList ('-NoExit & {0} -InputObject ' -f $PSCommandPath + $ArgString.TrimEnd(', ')) -Verb RunAs
  45.  
  46.     Stop-Process -Id $PID
  47.  
  48. }
  49.  
  50. if ($InputObject.Count -gt 1) {
  51.  
  52.     $InputObject | ForEach-Object {
  53.  
  54.         if ((Get-Item $_) -is [System.IO.DirectoryInfo]) {
  55.  
  56.             Get-ChildItem $_ -File -Recurse -Include *.exe | ForEach-Object {
  57.  
  58.                 New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Inbound -Program $_ -Action Block >$null
  59.                 New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Outbound -Program $_ -Action Block >$null
  60.                 Write-Host "Blocked inbound and outbound traffic for '$_'!"
  61.  
  62.             }
  63.  
  64.         } elseif ((Get-Item $_) -is [System.IO.FileInfo]) {
  65.  
  66.             New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Inbound -Program $_ -Action Block >$null
  67.             New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Outbound -Program $_ -Action Block >$null
  68.             Write-Host "Blocked inbound and outbound traffic for '$_'!"
  69.  
  70.         }
  71.     }
  72.  
  73. } elseif ((Get-Item ($InputObject -as [string])) -is [System.IO.DirectoryInfo]) {
  74.  
  75.     Get-ChildItem ($InputObject -as [string]) -File -Recurse -Include *.exe | ForEach-Object {
  76.  
  77.         New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Inbound -Program $_ -Action Block >$null
  78.         New-NetFirewallRule -DisplayName ($_.Name + ' (Blocked by script)') -Direction Outbound -Program $_ -Action Block >$null
  79.         Write-Host "Blocked inbound and outbound traffic for '$_'!"
  80.  
  81.     }
  82.  
  83. } elseif ((Get-Item ($InputObject -as [string])) -is [System.IO.FileInfo]) {
  84.  
  85.     New-NetFirewallRule -DisplayName ((Get-Item ($InputObject -as [string])).Name + ' (Blocked by script)') -Direction Inbound -Program ($InputObject -as [string]) -Action Block >$null
  86.     New-NetFirewallRule -DisplayName ((Get-Item ($InputObject -as [string])).Name + ' (Blocked by script)') -Direction Outbound -Program ($InputObject -as [string]) -Action Block >$null
  87.     Write-Host "Blocked inbound and outbound traffic for '$InputObject'!"
  88.  
  89. }
  90.  
  91. Write-Host -ForegroundColor Green "`nDone!"
  92. Start-Sleep 3
  93. Stop-Process -Id $PID
Add Comment
Please, Sign In to add comment