Artifacts/IIS/Discover.ps1

<#
.SYNOPSIS
Scans for presence of the Internet Information Services (IIS) Web Server
 
.PARAMETER MountPath
The path where the Windows image was mounted to.
 
.PARAMETER OutputPath
The filesystem path where the discovery manifest will be emitted.
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string] $MountPath,
    [Parameter(Mandatory = $true)]
    [string] $OutputPath
)

function GetWebsites {
    ### Helper function to obtain list of virtual directories
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string] $MountPath
    )

    $IISConfig = [xml](Get-Content -Path $MountPath\Windows\System32\inetsrv\config\applicationHost.config)
    $Sites = $IISConfig.configuration.'system.applicationHost'.sites
    $Websites = ForEach ($site in $sites) {        
        [PSCustomObject]@{ 
            Name = $site.site.name; 
            PhysicalPath = $site.site.application.virtualDirectory.physicalPath;
            MountPath = $MountPath;
            }
        }
    return $Websites 
}

function GetHttpHandlerMappings {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string] $MountPath
    )

    $IISConfig = [xml](Get-Content -Path $MountPath\Windows\System32\inetsrv\config\applicationHost.config)

    $HandlerList = $IISConfig.configuration.'system.webServer'.handlers.add

    foreach ($Handler in $HandlerList) {
        Write-Output -InputObject ([PSCustomObject]@{
            Name = $Handler.name
            Path = $Handler.path
            Verb = $Handler.verb
            })
    }
}

$ArtifactName = Split-Path -Path $PSScriptRoot -Leaf
Write-Verbose -Message ('Started discovering {0} artifact' -f $ArtifactName)

### Path to the manifest
$Manifest = '{0}\{1}.json' -f $OutputPath, $ArtifactName

### Create a HashTable to store the results (this will get persisted to JSON)
$ManifestResult = @{
    Name = 'IIS'
    Status = ''
}

$IIS = Get-WindowsOptionalFeature -FeatureName IIS-WebServer -Path $MountPath 

if ($IIS.State -eq 'Enabled') {
    Write-Verbose -Message 'IIS service is present on the system'
    $ManifestResult.Status = 'Present'
    $ManifestResult.Websites = GetWebsites -MountPath $MountPath
    $ManifestResult.HttpHandlers = GetHttpHandlerMappings -MountPath $MountPath
}
else {
    Write-Verbose -Message 'IIS service is NOT present on the system'
    $ManifestResult.Status = 'Absent'
}

### Write the result to the manifest file
$ManifestResult | ConvertTo-Json | Set-Content -Path $Manifest

Write-Verbose -Message ('Finished discovering {0} artifact' -f $ArtifactName)