Extract BITS jobs from QMGR queue and store them as pipe-delimited records.
This is forked from ANSSI bits_parser to refactor as a simple Python 2.7 script.
QMGR queues are usually .dat files located in the folder
%%ALLUSERSPROFILE%%\Microsoft\Network\Downloader
on a Windows system.
Once those files have been located (e.g. qmgr0.dat
and qmgr1.dat
) you
can run bits_jobs_parser.py by issuing the following command passing the directory
containing the files:
python bits_jobs_parser.py C:\ProgramData\Microsoft\Network\Downloader\
Finding your naughty BITS [DFRWS USA 2015, Matthew Geiger]
BITSInject [DEFCON 2017, Dor Azouri]
ANSSI bits_parser [Project forked]