'
116 | self.USBContent = '
'
117 | self.forensics = forensics
118 | self.Panorama = open(PanoramaReportPage, 'w')
119 | self.write(header)
120 | self.writeContent(topLogo)
121 | self.writeOSDetails()
122 | self.write(ReportMenu)
123 | self.writeOS()
124 | self.writeNetwork()
125 | self.writeSecurity()
126 | self.writeUSB()
127 | self.closeReportFile()
128 |
129 | def write(self, string, line=1):
130 | self.Panorama.write(string+"
\n")
131 |
132 | def writeContent(self, string):
133 | self.Panorama.write(string+"\n")
134 |
135 | def writeTitle(self, title):
136 | self.Panorama.write('
\
137 |
'+title+'
')
138 |
139 | def writeOSDetails(self):
140 | self.write("Hostname: "+self.forensics.hostname)
141 | self.write("Serial number: "+self.forensics.serialnumber)
142 | self.write("OS: "+self.forensics.OS["ProductName"]+" "+self.forensics.OS["SP"]+" "+self.forensics.OS["Bit"])
143 | self.write("OS Install date: "+self.forensics.OS["InstallDate"])
144 | self.write("Num of hotfixes: "+str(self.forensics.installedHotfixes["Sum"]))
145 | self.write("Firewall status: "+(self.forensics.Firewall["Status"]))
146 | self.write('
') # this is close the top
147 |
148 | def writeOS(self):
149 | self.writeContent(self.OSContent)
150 | self.writeTitle("Users")
151 | for user in self.forensics.Users:
152 | if user not in ["Guest", "DefaultAccount"]:
153 | self.write("
"+user+"")
154 | for value in self.forensics.Users[user]:
155 | self.write((value)+": "+(str(self.forensics.Users[user][value])))
156 | self.write(" ")
157 | self.write(closeTitle)
158 |
159 |
160 | self.writeTitle("Commands on startup")
161 | if len(self.forensics.CommandsOnStartup) != 0:
162 | table = ("
Command | Process active now |
")
163 | for command,active in self.forensics.CommandsOnStartup.iteritems():
164 | try:
165 | table += ("%s | %s |
\n" % (command,(str(active))))
166 | except:
167 | print "ERROR: 6349"
168 | print command
169 | self.write(table+"
")
170 | else:
171 | self.write("Empty")
172 | self.write(closeTitle)
173 |
174 |
175 | self.writeTitle("Task scheduler")
176 | if len(self.forensics.Tasks) != 0:
177 | table = ("
Name | Execute date | Status |
")
178 | for task in self.forensics.Tasks:
179 | table+= ""+task["TaskName"]+" | "+task["Next Run Time"]+" | "+task["Status"]+" |
"
180 | self.write(table+"
")
181 | else:
182 | self.write("Empty")
183 | self.write(closeTitle)
184 |
185 |
186 | self.writeTitle("Installed softwares")
187 | rowCount = 0
188 | if len(self.forensics.SoftwareList) != 0:
189 | blacklist = ['utorrent', 'teraterm', 'logmein', 'flashfxp', 'bittorrent', 'bitorrent', 'tor','teamviewer','skype','icq','emule','kazaa','dropbox','apple','itunes','wireless','havij','popcorn', 'torbrowser', 'logmett', 'join.me', 'popcorn time']
190 | table = "
"
191 | for software in self.forensics.SoftwareList:
192 | if rowCount == 3:
193 | table += ("\n")
194 | rowCount = 0
195 | try:
196 | if software.lower() in blacklist:
197 | table += ('{} | \n'.format(software.encode('utf-8')))
198 | else:
199 | table += ('{} | \n'.format(software.encode('utf-8')))
200 | rowCount += 1
201 | except:
202 | pass
203 | self.write(table+"
")
204 | else:
205 | self.write('Empty')
206 | self.write(closeTitle)
207 |
208 |
209 | self.writeTitle("Recently used files")
210 | rowCount = 0
211 | if len(self.forensics.Recent) != 0:
212 | table = "
"
213 | for each in self.forensics.Recent:
214 | if rowCount == 3:
215 | table += ("\n")
216 | rowCount = 0
217 | table += ('{} | \n'.format(each.replace("\\","\\\\"), each.rsplit("\\",1)[1].replace(".lnk","")))
218 | rowCount += 1
219 |
220 | self.write(table+"
")
221 | else:
222 | self.write('0 Recent files')
223 | self.write(closeTitle)
224 |
225 |
226 | self.writeTitle("Active processes")
227 | if len(self.forensics.Processes) != 0:
228 | table = ("
Name | ID | Communicating |
")
229 | for pid,name in self.forensics.Processes.iteritems():
230 | if name.strip() not in ["System", "System Idle Process"]:
231 | if str(self.forensics.Netstat).find(str(name+"', 'PID': '"+str(pid))) == -1:
232 | table += (""+name+" | "+str(pid)+" | No |
\n")
233 | else:
234 | table += (""+name+" | "+str(pid)+" | Yes |
\n")
235 | self.write(table+"
")
236 | else:
237 | self.write("ERR")
238 | self.write(closeTitle)
239 |
240 | self.writeContent(closeContent)
241 |
242 | def writeNetwork(self):
243 | self.writeContent(self.NetworkContent)
244 |
245 | self.writeTitle("Network cards")
246 | if len(self.forensics.NetworkCards) != 0:
247 | wirelessWords = ["wireless", "802"]
248 | for card in self.forensics.NetworkCards:
249 | writed = 0
250 | for word in wirelessWords:
251 | if card.lower().find(word) != -1 and writed == 0:
252 | self.write('
'+card+"")
253 | writed = 1
254 | if writed == 0:
255 | self.write(card)
256 | else:
257 | self.write("Empty")
258 | self.write(closeTitle)
259 |
260 |
261 | self.writeTitle("IP Address")
262 | if len(self.forensics.IPs) != 0:
263 | for ip,Dict in self.forensics.IPs.iteritems():
264 | if ip == "Current":
265 | ips = ""
266 | for addr in Dict:
267 | if len(addr) < 16:
268 | ips += "IPv4 - "+addr+"
"
269 | else:
270 | ips += "IPv6 - "+addr+"
"
271 | self.write("
Currently IPs:"+ips)
272 | else:
273 | singleIP = "
"+ip+""
274 | for key, value in Dict.iteritems():
275 | singleIP += "
"+(key) + ": " + value
276 | self.write(singleIP)
277 | else:
278 | self.write("Empty")
279 | self.write(closeTitle)
280 |
281 |
282 | self.writeTitle("MAC Address")
283 | if len(self.forensics.MACs) != 0:
284 | for mac in self.forensics.MACs:
285 | self.write(mac)
286 | else:
287 | self.write("Empty")
288 | self.write(closeTitle)
289 |
290 |
291 | if len(self.forensics.LocalNetworkMachines) != 0:
292 | self.writeTitle("Net view")
293 | for host in self.forensics.LocalNetworkMachines:
294 | self.write(host)
295 | self.write(closeTitle)
296 |
297 |
298 | self.writeTitle("Netstat")
299 | if len(self.forensics.Netstat) != 0:
300 | table = "
Local | Target | ID | Process | Status |
\n"
301 | for connection in self.forensics.Netstat:
302 | table += ''+connection["Local"]+' | '+connection["Remote"]+' | '+connection["PID"]+' | '+connection["appName"]+' | '+(connection["Status"])+' |
\n'
303 | self.write(table+"
")
304 | else:
305 | self.write("Empty")
306 | self.write(closeTitle)
307 |
308 |
309 | self.writeTitle("ARP Table")
310 | if len(self.forensics.ArpTable) != 0:
311 | for interface, Dict in self.forensics.ArpTable.iteritems():
312 | table = "
"+interface+" |
---|
IP | MAC | Type |
\n"
313 | for known in Dict:
314 | table += ""+known["IP"] + " | " + known["MAC"] + " | " + known["Type"] + " |
\n"
315 | self.write(table+"
")
316 | else:
317 | self.write("Empty")
318 | self.write(closeTitle)
319 |
320 |
321 | self.writeTitle("Hosts file")
322 | if len(self.forensics.HostsFile) != 0:
323 | table = "
Domain | Target IP |
"
324 | for counter, entry in self.forensics.HostsFile.iteritems():
325 | if entry["TargetIP"] not in ["0.0.0.0", "127.0.0.1"]:
326 | table += ""+entry["RequestedDomain"]+" | "+entry["TargetIP"]+" |
"
327 | self.write(table+"
")
328 | else:
329 | self.write("Empty")
330 | self.write(closeTitle)
331 |
332 |
333 | self.writeContent(closeContent)
334 |
335 | def writeSecurity(self):
336 | self.writeContent(self.SecurityContent)
337 |
338 | self.writeTitle("McAfee")
339 | if self.forensics.McAfee["Installed"] == 0:
340 | self.write("McAfee not installed")
341 | else:
342 | self.write("Version: McAfee "+self.forensics.McAfee["Version"])
343 | self.write("DAT date: "+self.forensics.McAfee["DatDate"])
344 | self.write("Weekly sched: "+(str(self.forensics.McAfee["WeeklySched"])))
345 | self.write("Action: "+(self.forensics.McAfee["Action"]))
346 | self.write("Last scan: "+self.forensics.McAfee["lastScan"])
347 | self.write("Num quarantine files: "+str(len(self.forensics.McAfee["quarantine"])))
348 |
349 | if len(self.forensics.McAfee["quarantine"]) != 0:
350 | self.write("
Quarantine files:")
351 | for File in self.forensics.McAfee["quarantine"]:
352 | self.write(File)
353 |
354 | if len(self.forensics.McAfee["Exclusions"]) != 0:
355 | self.write("
Exclusions:")
356 | for role in self.forensics.McAfee["Exclusions"]:
357 | if role[0] == "3":
358 | self.write("Skip file: "+role.rsplit("|",1)[1])
359 | elif role[0] == "4":
360 | self.write("Skip format: "+role.rsplit("|",1)[1])
361 | elif role[0] in ["0","1","2"]:
362 | self.write("Skip files older than "+role.rsplit("|",1)[1]+' days')
363 | else:
364 | self.write(role)
365 |
366 | self.write("
Logs:")
367 | if len(self.forensics.McAfee["Logs"]) != 0:
368 | for log in self.forensics.McAfee["Logs"]:
369 | self.write("
Path: "+log["Path"])
370 | self.write("
Time: "+log["Date"])
371 | self.write("
Description: "+log["Description"])
372 | self.write("
Action taken: "+(log["Action"].strip()))
373 | self.write("
Process: "+log["Process"])
374 | self.write("
MD5: "+log["Hash"].strip("(MD5)"))
375 | self.write("")
376 | else:
377 | self.write("No interesting logs")
378 | self.write(closeTitle)
379 |
380 |
381 | self.writeTitle("Firewall")
382 | self.write("
Status: "+self.forensics.Firewall["Status"]+"
")
383 | self.write("
Allowed applications:")
384 | if len(self.forensics.Firewall["Rules"]) != 0:
385 | table = "
Name | Active | Action |
"
386 | for rule in self.forensics.Firewall["Rules"]:
387 | table += ""+rule["Name"]+" | "+rule["Active"]+" | "+rule["Action"]+" |
"
388 | self.write(table+"
")
389 | else:
390 | self.write("Empty")
391 | self.write(closeTitle)
392 |
393 |
394 | self.writeTitle("Hotfixes")
395 | if len(self.forensics.installedHotfixes) != 0:
396 | for date,hotfixList in self.forensics.installedHotfixes["Dict"].iteritems(): # the first one is the sum number
397 | self.write("
Date: "+date)
398 | self.write("
Packages installed: "+", ".join(hotfixList))
399 | else:
400 | self.write("Empty")
401 | self.write(closeTitle)
402 |
403 |
404 | self.writeContent(closeContent)
405 |
406 | def writeUSB(self):
407 | self.writeContent(self.USBContent)
408 |
409 | self.writeTitle("USB list")
410 | knownDict = {'belkin': 'smart', 'meizu': 'smart', 'galaxy': 'smart', 'lg': 'smart', 'tablet': 'smart', 'flash': 'storage', 'black': 'smart', 'dlink': 'network', 'smart': 'smart', 'sm-g920': 'smart', 'g4': 'smart', 'g3': 'smart', 'gadget': 'smart', 'nokia': 'smart', 'watch': 'smart', 'dell': 'smart', 'toshiba': 'storage', 'band': 'network', 'sony': 'smart', 'lumia': 'smart', 'motorola': 'smart', 'xbox': 'smart', 'blackberry': 'smart', 'google': 'smart', 'htc': 'smart', 'portable': 'storage', '256gb': 'storage', 'bluetooth': 'network', 'hitachi': 'storage', 'gt-i9300': 'smart', 'huawei': 'smart', 'cdram': 'disk', 'net': 'network', 'wd': 'storage', '128gb': 'storage', 'dualband': 'network', 'ipod': 'smart', '4gb': 'storage', 'web': 'smart', 'sandisk': 'storage', 'tplink': 'network', '8gb': 'storage', 'apple': 'smart', 'corsair': 'storage', 'linux': 'smart', 'gt-i9200': 'smart', 'jetflash': 'storage', '802.11': 'network', 'camera': 'camera', 'iphone': 'smart', 'safenet': 'license', 'gt-i9100t': 'smart', 'webcam': 'camera', 'floppy': 'storage', '64gb': 'storage', 'wireless': 'network', 'phone': 'smart', '32gb': 'storage', 'datatravel': 'storage', 'ipad': 'smart', 'patriot': 'storage', 'sm-g900i': 'smart', 'sm-g900f': 'smart', 'budget': 'smart', 'windows': 'smart', '802.11ac': 'network', 'cam': 'camera', '16gb': 'storage', '802.11a': 'network', 'transcend': 'storage', 'ac': 'network', '802.11b': 'network', '802.11g': 'network', 'nexus': 'smart', 'kingston': 'storage', 'canon': 'camera', '802.11n': 'network', 'sm-g920i': 'smart', 'tab': 'smart', 'acer': 'smart', 'sm-g920f': 'smart', 'cddvd': 'disk', 'gt-i9100': 'smart', 'dvdram': 'disk', 'generic': 'storage', 'storage': 'storage', 'note': 'smart', 'android': 'smart', 'lan': 'network', 'nic': 'network', 'powershot': 'camera', 'tp-link': 'network', 'ethernet': 'network', 'nikon': 'camera', 'linksys': 'network', 'samsung': 'smart', 'mobile': 'smart', 'sm-g900': 'smart', 'd-link': 'network', 'link': 'network', 'oneplus': 'smart'}
411 | for x,usb in self.forensics.USB.iteritems():
412 | if "HID" not in usb['name'] and "Composite" not in usb['name'] and "HID" not in usb['type']:
413 | writeUSB = "
"+usb['name']+""
414 | for word in usb['name'].split():
415 | # Try to say what is the USB
416 | if word.lower() in knownDict:
417 | writeUSB += "
Description: "+knownDict[word.lower()]+" device"
418 | break
419 |
420 | # Type of the USB:
421 | writeUSB += "
Type: "+usb['type']
422 | writeUSB += "
Serial number: "+usb['serial']
423 | writeUSB += "
Date: "+usb['ldate']
424 |
425 | self.write(writeUSB)
426 | self.write(closeTitle)
427 |
428 |
429 | self.writeTitle("USBDeview")
430 | self.write('
> Open the original table <')
431 | self.write(closeTitle)
432 |
433 | self.writeContent(closeContent)
434 |
435 | def closeReportFile(self):
436 | self.Panorama.close()
437 |
438 | def openReport(self):
439 | startfile(PanoramaReportPage)
440 |
441 |
442 |
443 | topLogo = '
\
444 |
\
445 |
'
446 |
447 | ReportMenu = """
448 | """
454 |
455 | FilesMenu = """
456 | """
461 |
462 | header = """
463 |
464 |
465 |
466 |
Panorama - Fast incident overview
467 |
552 |
553 |
575 | """
576 |
--------------------------------------------------------------------------------
/src/utils/TXT.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | import sys
3 | from os import startfile
4 | from os.path import getctime
5 | from datetime import datetime
6 |
7 | from common.paths import *
8 |
9 | reload(sys)
10 | sys.setdefaultencoding("utf-8")
11 |
12 | def timestamp2date(timestamp, hour):
13 | mydate = datetime.fromtimestamp(int(timestamp))
14 | if hour == 1:
15 | return mydate.strftime("%H:%M %d-%m-%Y")
16 | else:
17 | return mydate.strftime("%d-%m-%Y")
18 |
19 |
20 | class TextReport:
21 | def __init__(self, forensics):
22 | self.forensics = forensics
23 | self.Panorama = open(txtPanoramaReportPage, 'w')
24 | self.writeHeader()
25 | self.write("Report created: "+str(datetime.now())+"\n")
26 | self.writeOSDetails()
27 | self.writeOS()
28 | self.writeNetwork()
29 | self.writeSecurity()
30 | self.writeUSB()
31 | self.closeReportFile()
32 |
33 | def write(self, string, line=1):
34 | self.Panorama.write("\t"+string+"\n")
35 |
36 | def writeContent(self, string):
37 | self.Panorama.write(string+"\n")
38 |
39 | def writeTitle(self, title):
40 | self.Panorama.write("\n\n"+title+':\n')
41 |
42 | def writeHeader(self):
43 | header = """--Panorama--\nFast incident overview\n\n
44 | Contact: almogcn@gmail.com
45 | Offical page: https://github.com/AlmCo/Panorama\n\n
46 | ===================================================\n\n"""
47 | self.writeContent(header)
48 |
49 | def writeOSDetails(self):
50 | self.write("Hostname: "+self.forensics.hostname)
51 | self.write("Serial number: "+self.forensics.serialnumber)
52 | self.write("OS: "+self.forensics.OS["ProductName"]+" "+self.forensics.OS["SP"]+" "+self.forensics.OS["Bit"])
53 | self.write("OS Install date: "+self.forensics.OS["InstallDate"])
54 | self.write("Num of hotfixes: "+str(self.forensics.installedHotfixes["Sum"]))
55 | self.write("Firewall status: "+(self.forensics.Firewall["Status"]))
56 |
57 | def writeOS(self):
58 | self.writeTitle("Users")
59 | for user in self.forensics.Users:
60 | if user not in ["Guest", "DefaultAccount"]:
61 | self.write(user)
62 | for value in self.forensics.Users[user]:
63 | self.write("\t"+(value)+": "+(str(self.forensics.Users[user][value])))
64 | self.write(" ")
65 |
66 |
67 | self.writeTitle("Commands on startup")
68 | if len(self.forensics.CommandsOnStartup) != 0:
69 | for command,active in self.forensics.CommandsOnStartup.iteritems():
70 | try:
71 | self.write(command+" | active: "+str(active))
72 | except:
73 | print "ERROR: 6349"
74 | print command
75 | else:
76 | self.write("Empty")
77 |
78 |
79 | self.writeTitle("Task scheduler")
80 | if len(self.forensics.Tasks) != 0:
81 | for task in self.forensics.Tasks:
82 | self.write(task["TaskName"]+" | NextRun: "+task["Next Run Time"]+" | Status: "+task["Status"])
83 | else:
84 | self.write("Empty")
85 |
86 |
87 | self.writeTitle("Installed softwares")
88 | if len(self.forensics.SoftwareList) != 0:
89 | for software in self.forensics.SoftwareList:
90 | self.write(software)
91 | else:
92 | self.write('Empty')
93 |
94 |
95 | self.writeTitle("Recently used files")
96 | if len(self.forensics.Recent) != 0:
97 | for each in self.forensics.Recent:
98 | self.write(each)
99 | else:
100 | self.write('Empty')
101 |
102 |
103 | self.writeTitle("Active processes")
104 | if len(self.forensics.Processes) != 0:
105 | for pid,name in self.forensics.Processes.iteritems():
106 | if name.strip() not in ["System", "System Idle Process"]:
107 | if str(self.forensics.Netstat).find(str(name+"', 'PID': '"+str(pid))) == -1:
108 | self.write(name+" | PID: "+str(pid)+" | Communicating: No")
109 | else:
110 | self.write(name+" | PID: "+str(pid)+" | Communicating: Yes")
111 | else:
112 | self.write("ERR")
113 |
114 |
115 | def writeNetwork(self):
116 |
117 | self.writeTitle("Network cards")
118 | if len(self.forensics.NetworkCards) != 0:
119 | for card in self.forensics.NetworkCards:
120 | self.write(card)
121 | else:
122 | self.write("Empty")
123 |
124 |
125 | self.writeTitle("IP Address")
126 | if len(self.forensics.IPs) != 0:
127 | for ip,Dict in self.forensics.IPs.iteritems():
128 | if ip == "Current":
129 | for addr in Dict:
130 | if len(addr) < 16:
131 | self.write("Currently IPv4: "+addr)
132 | else:
133 | self.write("Currently IPv6: "+addr)
134 | else:
135 | self.write("\n\t"+ip)
136 | for key, value in Dict.iteritems():
137 | self.write("\t"+(key) + ": " + value)
138 | else:
139 | self.write("Empty")
140 |
141 |
142 | self.writeTitle("MAC Address")
143 | if len(self.forensics.MACs) != 0:
144 | for mac in self.forensics.MACs:
145 | self.write(mac)
146 | else:
147 | self.write("Empty")
148 |
149 |
150 | if len(self.forensics.LocalNetworkMachines) != 0:
151 | self.writeTitle("Net view")
152 | for host in self.forensics.LocalNetworkMachines:
153 | self.write(host)
154 |
155 |
156 | self.writeTitle("Netstat")
157 | if len(self.forensics.Netstat) != 0:
158 | for connection in self.forensics.Netstat:
159 | self.write('Local: '+connection["Local"]+' | Target: '+connection["Remote"]+' | PID: '+connection["PID"]+' | App: '+connection["appName"]+' | Status: '+(connection["Status"]))
160 | else:
161 | self.write("Empty")
162 |
163 |
164 | self.writeTitle("ARP Table")
165 | if len(self.forensics.ArpTable) != 0:
166 | for interface, Dict in self.forensics.ArpTable.iteritems():
167 | self.write("\n\tInterface: "+interface)
168 | for known in Dict:
169 | self.write("IP: "+known["IP"] + " | MAC: " + known["MAC"] + " | Type: " + known["Type"])
170 | else:
171 | self.write("Empty")
172 |
173 |
174 | self.writeTitle("Hosts file")
175 | if len(self.forensics.HostsFile) != 0:
176 | for counter, entry in self.forensics.HostsFile.iteritems():
177 | if entry["TargetIP"] not in ["0.0.0.0", "127.0.0.1"]:
178 | self.write("Domain: "+entry["RequestedDomain"]+" | Target IP: "+entry["TargetIP"])
179 | else:
180 | self.write("Empty")
181 |
182 |
183 |
184 | def writeSecurity(self):
185 |
186 | self.writeTitle("McAfee")
187 | if self.forensics.McAfee["Installed"] == 0:
188 | self.write("McAfee not installed")
189 | else:
190 | self.write("Version: McAfee "+self.forensics.McAfee["Version"])
191 | self.write("DAT date: "+self.forensics.McAfee["DatDate"])
192 | self.write("Weekly sched: "+(str(self.forensics.McAfee["WeeklySched"])))
193 | self.write("Action: "+(self.forensics.McAfee["Action"]))
194 | self.write("Last scan: "+self.forensics.McAfee["lastScan"])
195 | self.write("Num quarantine files: "+str(len(self.forensics.McAfee["quarantine"])))
196 |
197 | if len(self.forensics.McAfee["quarantine"]) != 0:
198 | self.write("\n\tQuarantine files:")
199 | for File in self.forensics.McAfee["quarantine"]:
200 | self.write("\t"+File)
201 |
202 | if len(self.forensics.McAfee["Exclusions"]) != 0:
203 | self.write("\n\tExclusions:")
204 | for role in self.forensics.McAfee["Exclusions"]:
205 | if role[0] == "3":
206 | self.write("\tSkip file: "+role.rsplit("|",1)[1])
207 | elif role[0] == "4":
208 | self.write("\tSkip format: "+role.rsplit("|",1)[1])
209 | elif role[0] in ["0","1","2"]:
210 | self.write("\tSkip files older than "+role.rsplit("|",1)[1]+' days')
211 | else:
212 | self.write("\t"+role)
213 |
214 | self.write("\n\tLogs:")
215 | if len(self.forensics.McAfee["Logs"]) != 0:
216 | for log in self.forensics.McAfee["Logs"]:
217 | self.write("\tPath: "+log["Path"])
218 | self.write("\tTime: "+log["Date"])
219 | self.write("\tDescription: "+log["Description"])
220 | self.write("\tAction taken: "+(log["Action"].strip()))
221 | self.write("\tProcess: "+log["Process"])
222 | self.write("\tMD5: "+log["Hash"].strip("(MD5)"))
223 | self.write("")
224 | else:
225 | self.write("No interesting logs")
226 |
227 |
228 | self.writeTitle("Firewall")
229 | self.write("Status: "+self.forensics.Firewall["Status"])
230 | self.write("Allowed applications:")
231 | if len(self.forensics.Firewall["Rules"]) != 0:
232 | for rule in self.forensics.Firewall["Rules"]:
233 | self.write("\t"+rule["Name"]+" | Status: "+rule["Active"]+" | Action: "+rule["Action"])
234 | else:
235 | self.write("Empty")
236 |
237 |
238 | self.writeTitle("Hotfixes")
239 | if len(self.forensics.installedHotfixes) != 0:
240 | for date,hotfixList in self.forensics.installedHotfixes["Dict"].iteritems(): # the first one is the sum number
241 | self.write("\n\tDate: "+date)
242 | self.write("Packages installed: "+", ".join(hotfixList))
243 | else:
244 | self.write("Empty")
245 |
246 |
247 |
248 | def writeUSB(self):
249 |
250 | self.writeTitle("USB list")
251 | for x,usb in self.forensics.USB.iteritems():
252 | if "HID" not in usb['name'] and "Composite" not in usb['name'] and "HID" not in usb['type']:
253 | # Type of the USB:
254 | self.write(usb['name'] + " | Type: "+usb['type'] + " | Serial number: " + usb['serial'] + " | Date: " + usb['ldate'])
255 |
256 |
257 |
258 | def closeReportFile(self):
259 | self.Panorama.close()
260 |
261 | def openReport(self):
262 | startfile(PanoramaReportPage)
263 |
--------------------------------------------------------------------------------
/src/utils/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/AlmCo/Panorama/0e78524ab694d595a42cf9e200f22881a2e7cd58/src/utils/__init__.py
--------------------------------------------------------------------------------
/src/utils/forensic.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 |
3 | import sys
4 |
5 | from utils.HTML import timestamp2date
6 | from lib.Registry import *
7 | from common.paths import *
8 | from utils.parsers import *
9 | from utils.getters import *
10 |
11 | # To do:
12 | # Networks the computer was joined
13 | # Mapped shares
14 |
15 | reload(sys)
16 | sys.setdefaultencoding("utf-8")
17 |
18 | class Forensic:
19 | def __init__(self):
20 | self.hostname = readName(r"SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName",'ComputerName')
21 | self.OS = {}
22 | self.serialnumber = ""
23 | self.Firewall = {}
24 | self.installedHotfixes = {} # Install date : [KBs]
25 | self.McAfee = {}
26 | self.USB = {}
27 | self.NetworkCards = {} # Card name : Type
28 | self.Users = {} # Dict of Dicts = Username {Admin, Password last set, Last logon, Password required, Account active, Password expires}
29 | self.SoftwareList = set() # Uniqe list of Installed softwares
30 | self.IPs = {} # Dict of IP : Date, DHCPServer
31 | self.MACs = set() # Uniqe list of MAC address
32 | self.Processes = {} # Dict of PID : Name
33 | self.CommandsOnStartup = {} # Dict of name of the command : if its currently running
34 | self.Netstat = [] # List of Dict's of all connections - Dict includes: ip addresses, protocol, app name, pid and status
35 | self.Tasks = [] # List of Dict's of all tasks - Dict includes: name, next run date and status
36 | self.HostsFile = {} # Dict's of all entries - Dict includes: counted number, requested domain and target ip
37 | self.LocalNetworkMachines = [] # List of hostnames on the network
38 | self.ArpTable = {} # Dict of ARP table by interface, every interface have his own arp table
39 | self.Recent = [] # List of recent files
40 |
41 | def fOS(self):
42 | # Fills the OS dict by the description
43 | try:
44 | self.OS["ProductName"] = readName(r"SOFTWARE\Microsoft\Windows NT\CurrentVersion",'ProductName')
45 | except:
46 | self.OS["ProductName"] = "0"
47 |
48 | try:
49 | self.OS["SP"] = getServicePack()
50 | except:
51 | self.OS["ProductName"] = "0"
52 |
53 | try:
54 | self.OS["Bit"] = getOSArch()
55 | except:
56 | self.OS["Bit"] = "0"
57 |
58 | try:
59 | self.OS["InstallDate"] = timestamp2date(readName(r"SOFTWARE\Microsoft\Windows NT\CurrentVersion",'InstallDate'), 1)
60 | except:
61 | self.OS["InstallDate"] = "0"
62 |
63 | def fSerialNumber(self):
64 | # Extract the embeded serial number by WMIC
65 | try:
66 | wmicSerial = cmd("wmic bios get serialnumber")[1]
67 | if wmicSerial not in ["To be filled by O.E.M.", "Default string"]:
68 | self.serialnumber = wmicSerial
69 | else:
70 | self.serialnumber = "000000"
71 | except:
72 | self.serialnumber = "000000"
73 |
74 | def fHotfixs(self):
75 | # Parse all of the installed hotfixes into a dict:
76 | # TO DO: Parse it out from the registry to avoid the CMD command.
77 | # Example of return: {'Sum': 4, 'Dict': {'1/14/2016': ['KB2425227', 'KB2533552', 'KB2534366', 'KB971412']}}
78 | self.installedHotfixes = {"Sum":0, "Dict":{}}
79 | try:
80 | kblist = cmd("wmic qfe get hotfixid,installedon")
81 | for i in kblist:
82 | try:
83 | if i[:2] == "KB":
84 | self.installedHotfixes["Sum"] += 1
85 | kbNum,installDate = i.split()
86 | if installDate in self.installedHotfixes["Dict"]:
87 | self.installedHotfixes["Dict"][installDate].append(kbNum)
88 | else:
89 | self.installedHotfixes["Dict"][installDate] = []
90 | self.installedHotfixes["Dict"][installDate].append(kbNum)
91 | except:
92 | pass
93 | except Exception as e:
94 | print e
95 | self.installedHotfixes["Sum"] = -1 # Return -1 to report the error
96 |
97 | def fFirewall(self):
98 | # Checks firewall status
99 | try:
100 | StandardProfile = readName(r"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile",'EnableFirewall')
101 | except:
102 | StandardProfile = "0" # Never was enabled so the reg key wasnt created
103 |
104 | if StandardProfile.find("1") != -1:
105 | self.Firewall["Status"] = "ON"
106 | else:
107 | self.Firewall["Status"] = "OFF"
108 |
109 | # Load the firewall rules:
110 | self.Firewall["Rules"] = []
111 | try:
112 | rulesDict = readValues(r"SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules")
113 | for name, value in rulesDict.iteritems():
114 | try:
115 | rule = parseFirewallRule(value)
116 | if rule["Active"] == "TRUE" and rule["Action"] == "Allow" and "FirewallAPI.dll" not in rule["Name"]:
117 | self.Firewall["Rules"].append(rule)
118 | except:
119 | pass
120 | except:
121 | pass # No rules
122 |
123 | def fMcAfee(self):
124 | try:
125 | self.McAfee["Installed"] = 1
126 | if "64" in self.OS["Bit"]:
127 | self.McAfee["Version"] = readName(r"Software\Wow6432Node\McAfee\DesktopProtection",'szProductVer')
128 | self.McAfee["DatDate"] = parseMcAfeeDatDate(readName(r"Software\Wow6432Node\McAfee\AVEngine",'AVDatDate'))
129 | else:
130 | self.McAfee["Version"] = readName(r"Software\McAfee\DesktopProtection",'szProductVer')
131 | self.McAfee["DatDate"] = parseMcAfeeDatDate(readName(r"Software\McAfee\AVEngine",'AVDatDate'))
132 |
133 | self.McAfee["LogDir"] = readName(r"SYSTEM\CurrentControlSet\Control\Session Manager\Environment",'DEFLOGDIR')
134 | self.McAfee["WeeklySched"] = getMcAfeeSchedStatus(self.OS["Bit"]) # Registry path is diffrent from 64Bit to 32Bit
135 | self.McAfee["Action"] = getMcAfeeAction(self.OS["Bit"]) # Registry path is diffrent from 64Bit to 32Bit
136 | self.McAfee["Exclusions"] = getMcAfeeExclusions(self.OS["Bit"]) # Registry path is diffrent from 64Bit to 32Bit
137 | self.McAfee["lastScan"] = parseMcAfeeLastScanDate(self.McAfee["LogDir"])
138 | self.McAfee["Logs"] = parseMcAfeeLogs(self.McAfee["LogDir"])
139 | self.McAfee["quarantine"] = listdir("C:\quarantine")
140 | except:
141 | self.McAfee["Installed"] = 0
142 |
143 |
144 | def fUSB(self):
145 | cmd(PanoramaDir+"\USBDeview.exe /shtml "+PanoramaDir+"\usbdeview.html")
146 | try:
147 | self.USB = parseUSB(PanoramaDir+"\usbdeview.html")
148 | except:
149 | pass
150 |
151 | def fNetworkCards(self):
152 | # Check on USB plugs:
153 | networds = ['wireless','lan','bluetooth','ethernet','802.11','nic','802.11n','802.11a','802.11ac','802.11g','802.11b','net','tplink','tp-link','linksys','dlink','d-link','link','band','dualband','dsl','netstick']
154 | for uid,usb in self.USB.iteritems():
155 | try:
156 | usbname = usb["name"]+" - "+usb["type"]
157 | if any(word in usbname.lower() for word in networds):
158 | self.NetworkCards[usbname] = "Wireless"
159 | except:
160 | pass
161 |
162 | # Check on registry
163 | try:
164 | networkCards = readKeys(r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards")
165 | for card in networkCards:
166 | try:
167 | cardName = readName(r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\%s" % card, "Description")
168 | self.NetworkCards[cardName] = "Network"
169 | except:
170 | pass
171 | except:
172 | pass
173 |
174 | def fUsers(self):
175 | wantedDetails = ["Password last set", "Last logon", "Password required", "Account active", "Password expires"]
176 | try:
177 | usersList = parseUsers(cmd("net user"))
178 | for user in usersList:
179 | self.Users[user] = {}
180 | userDetails = cmd("net user "+user)
181 |
182 | # Check if this user in administrators group
183 | if str(userDetails).find("Administrators") != -1:
184 | self.Users[user]["admin"] = "Yes"
185 | else:
186 | self.Users[user]["admin"] = "No"
187 |
188 | for line in userDetails:
189 | for lineInfo in line.split("\t"):
190 | try:
191 | valueName = lineInfo.split(" ")[0]
192 | if valueName in wantedDetails:
193 | self.Users[user][valueName] = lineInfo.rsplit(" ",1)[1]
194 | except:
195 | pass
196 | except:
197 | pass
198 |
199 | def fSoftwareList(self):
200 | try:
201 | # Registry Uninstall path:
202 | for software in readKeys(r"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"):
203 | if "{" != software[0]:
204 | try:
205 | software = readName(r"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",'DisplayName')
206 | except:
207 | pass # No display name - take the key name
208 | self.SoftwareList.add(software)
209 | except:
210 | pass
211 |
212 | # Installed DIRs and merage the set lists:
213 | try:
214 | self.SoftwareList |= set(listdir("C:\Program Files"))
215 | except:
216 | pass
217 |
218 |
219 | if "64" in self.OS["Bit"]:
220 | try:
221 | self.SoftwareList |= set(listdir("C:\Program Files (x86)"))
222 | except:
223 | pass
224 |
225 | try:
226 | self.SoftwareList |= set(listdir(appdata))
227 | except:
228 | pass
229 |
230 | try:
231 | self.SoftwareList |= set(listdir(appdata.replace("Roaming","Local")))
232 | except:
233 | pass
234 |
235 | try:
236 | self.SoftwareList |= set(listdir(appdata.replace("Roaming","LocalLow")))
237 | except:
238 | pass
239 |
240 | def fIPs(self):
241 | try:
242 | for ip in readKeys(r"SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces"):
243 | try:
244 | try:
245 | ipAddress = readName(r"SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\%s" % ip, 'DhcpIPAddress')
246 | except:
247 | ipAddress = readName(r"SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\%s" % ip, 'IPAddress')
248 |
249 | ipAddress = ipAddress.strip(" []'u")
250 | if ipAddress != "0.0.0.0":
251 | self.IPs[ipAddress] = {}
252 | self.IPs[ipAddress]["Time"] = timestamp2date(readName(r"SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\%s" % ip, 'LeaseObtainedTime'), 1)
253 | self.IPs[ipAddress]["DhcpServer"] = readName(r"SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\%s" % ip, 'DhcpServer')
254 |
255 | except:
256 | pass # Not really used IP address
257 | except:
258 | pass
259 |
260 | try:
261 | self.IPs["Current"] = getCurrentIPs()
262 | except:
263 | pass
264 |
265 | def fMACs(self):
266 | try:
267 | for MAC in cmd('ipconfig /all | find "Physical Address"'):
268 | try:
269 | self.MACs.add(MAC.split(":",1)[1])
270 | except:
271 | pass
272 | except:
273 | pass
274 |
275 | def fProcesses(self):
276 | whitelist = ["audiodg.exe","conhost.exe","csrss.exe","lsass.exe","lsm.exe","MSCamS64.exe","McTray.exe","alg.exe","naPrdMgr.exe","OSPPSVC.EXE","PresentationFontCache.exe","SearchIndexer.exe","services.exe","smss.exe","spoolsv.exe","svchost.exe","System","SystemIdleProcess","UNS.exe","wininit.exe","WmiApSrv.exe","WmiPrvSE.exe","wmpnetwk.exe","WUDFHost.exe","chrome.exe","atiesrxx.exe","stacsv64.exe","tasklist.exe","conhost.exe","SmartMenu.exe","explorer.exe","explore.exe","taskhost.exe","cmd.exe","LogonUI.exe","jusched.exe","dllhost.exe","taskeng.exe","TrustedInstaller.exe","shstat.exe","winlogon.exe","ctfmon.exe","mcshield.exe","WLIDSVC.EXE","notepad.exe","VsTskMgr.exe","mfeann.exe","RtkNGUI64.exe","mfevtps.exe"]
277 | try:
278 | for proc in getActiveProcesses():
279 | try:
280 | pid, pname = parseProc(proc)
281 | self.Processes[pid] = pname
282 | except:
283 | pass
284 | except:
285 | pass
286 |
287 | def fCommandsOnStartup(self):
288 | # Registry of x86 Bit:
289 | try:
290 | run = readValues(r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
291 | for name,command in run.iteritems():
292 | self.CommandsOnStartup[command] = 0
293 | except:
294 | pass
295 |
296 | try:
297 | runonce = readValues(r"SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
298 | for name,command in runonce.iteritems():
299 | self.CommandsOnStartup[command] = 0
300 | except:
301 | pass
302 |
303 | # Registry of x64 Bit:
304 | if "64" in self.OS["Bit"]:
305 | try:
306 | run = readValues(r"SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run")
307 | for name,command in run.iteritems():
308 | self.CommandsOnStartup[command] = 0
309 | except:
310 | pass
311 |
312 | try:
313 | runonce = readValues(r"SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce")
314 | for name,command in runonce.iteritems():
315 | self.CommandsOnStartup[command] = 0
316 | except:
317 | pass
318 |
319 | try:
320 | # Startup folder of user AppData:
321 | startupDirPath = appdata+"\Microsoft\Windows\Start Menu\Programs\Startup"
322 | if isdir(startupDirPath):
323 | startupDir = listdir(startupDirPath)
324 | for sFile in startupDir:
325 | try:
326 | if sFile != "desktop.ini":
327 | self.CommandsOnStartup[sFile] = 0
328 | except:
329 | pass
330 | except:
331 | pass
332 |
333 | try:
334 | # Check which of the startup commands are running right now:
335 | for command in self.CommandsOnStartup:
336 | try:
337 | if (str(self.Processes).lower()).find(command.rsplit(".",-1)[0].rsplit("\\",1)[1].lower()) != -1:
338 | self.CommandsOnStartup[command] = 1
339 | except Exception as e:
340 | print e
341 | except:
342 | pass
343 |
344 | def fNetStat(self):
345 | try:
346 | netstatTable = cmd("netstat -no")[3:]
347 | for line in netstatTable:
348 | try:
349 | connection = filter(None,line.split(" "))
350 | self.Netstat.append(parseConnection(connection, self.Processes))
351 | except:
352 | pass
353 | except:
354 | pass
355 |
356 | def fTasks(self):
357 | try:
358 | for task in getTaskschList():
359 | try:
360 | if "\Microsoft\Windows" not in task: # Hide all defaults
361 | parsedTask = parseTask(task)
362 | if parsedTask and parsedTask not in self.Tasks:
363 | self.Tasks.append(parsedTask)
364 | except:
365 | pass
366 | except:
367 | pass
368 |
369 | def fHosts(self):
370 | try:
371 | HostsFileContent = getHostsFileContent()
372 | count = 0
373 | for line in HostsFileContent:
374 | try:
375 | if line[0] != "#":
376 | try:
377 | ip, domain = parseHosts(line)
378 | self.HostsFile[count] = {}
379 | self.HostsFile[count]["TargetIP"] = ip
380 | self.HostsFile[count]["RequestedDomain"] = domain
381 | count += 1
382 | except:
383 | pass
384 | except:
385 | pass
386 | except:
387 | pass
388 |
389 | def fLocalNetworkMachines(self):
390 | try:
391 | for hostname in cmd("net view")[3:-1]:
392 | try:
393 | self.LocalNetworkMachines.append(hostname.strip().replace("\\\\",""))
394 | except:
395 | pass
396 | except:
397 | pass
398 |
399 | def fArpTable(self):
400 | try:
401 | arptable = getArpTable()
402 | for interface in arptable:
403 | try:
404 | localIP = interface.split("Interface:")[1].split("--")[0].strip()
405 | self.ArpTable[localIP] = []
406 | for line in interface.split("Type")[1].split("\n"):
407 | if len(line) > 1: self.ArpTable[localIP].append(parseArpTableLine(line))
408 | except:
409 | pass
410 | except:
411 | pass
412 |
413 | def fRecent(self):
414 | try:
415 | RecentDirPath = appdata+"\Microsoft\Windows\Recent"
416 | if isdir(RecentDirPath):
417 | listRecentDirPath = listdir(RecentDirPath)
418 | for rfile in listRecentDirPath:
419 | try:
420 | self.Recent.append(appdata+"\Microsoft\Windows\Recent\%s" % rfile.decode('iso8859_8').replace("?","\\"))
421 | except:
422 | pass
423 | except:
424 | pass
425 |
426 |
427 |
428 | forensic = Forensic()
--------------------------------------------------------------------------------
/src/utils/getters.py:
--------------------------------------------------------------------------------
1 | from os import popen
2 |
3 | from lib.Registry import *
4 |
5 | def cmd(command):
6 | # Using for single command from cmd
7 | return popen(command).read().strip().split("\n")
8 |
9 | def getServicePack():
10 | # Parse the service pack of the system
11 | spDict = {"0":"SP0", "256":"SP1", "512":"SP2", "768":"SP3", "1024":"SP4"}
12 | try:
13 | sp = readName(r"SYSTEM\CurrentControlSet\Control\Windows",'CSDVersion')
14 | return spDict[str(sp)]
15 | except:
16 | return "SP0"
17 |
18 | def getOSArch():
19 | # Parse how many Bit this processor
20 | if "86" in readName(r"SYSTEM\CurrentControlSet\Control\Session Manager\Environment",'PROCESSOR_ARCHITECTURE'):
21 | return "32Bit"
22 | else:
23 | return "64Bit"
24 |
25 | def getMcAfeeSchedStatus(Bit):
26 | # Checks if full scan schedule is set at least for every 7 days
27 | if "64" in Bit: # 64Bit host
28 | if int(readName(r"Software\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'bSchedEnabled')) == 1:
29 | if int(readName(r"Software\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Weekly_maskDaysOfWeek')) != 0 and int(readName(r"Software\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Weekly_nRepeatWeeks')) == 1: return 1
30 | if int(readName(r"Software\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Daily_nRepeatDays')) < 8: return 1
31 | return 0
32 | else: # x32Bit host
33 | if int(readName(r"Software\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'bSchedEnabled')) == 1:
34 | if int(readName(r"Software\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Weekly_maskDaysOfWeek')) != 0 and int(readName(r"Software\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Weekly_nRepeatWeeks')) == 1: return 1
35 | if int(readName(r"Software\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'Daily_nRepeatDays')) < 8: return 1
36 | return 0
37 |
38 | def getMcAfeeAction(Bit):
39 | if "64" in Bit: # 64Bit host
40 | if readName(r"SOFTWARE\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'uAction_Program') in ["4","5"]: return "Delete"
41 | if readName(r"SOFTWARE\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'uAction') in ["4","5"]: return "Delete"
42 | return "Scan"
43 | else: # x32Bit host
44 | if readName(r"SOFTWARE\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'uAction_Program') in ["4","5"]: return "Delete"
45 | if readName(r"SOFTWARE\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}",'uAction') in ["4","5"]: return "Delete"
46 | return "Scan"
47 |
48 | def getMcAfeeExclusions(Bit):
49 | if "64" in Bit: # 64Bit host
50 | query = readValues(r"SOFTWARE\Wow6432Node\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}")
51 | else: # x32Bit host
52 | query = readValues(r"SOFTWARE\McAfee\DesktopProtection\Tasks\{21221C11-A06D-4558-B833-98E8C7F6C4D2}")
53 |
54 | Exclusions = []
55 | for name, value in query.iteritems():
56 | if name.lower()[:13] == "excludeditem_":
57 | Exclusions.append(value)
58 | return Exclusions
59 |
60 | def getCurrentIPs():
61 | LiveIPs = []
62 | current = cmd('ipconfig | find "IP"')[1:] # the 1: is to avoid the first printed junk line
63 | for ip in current:
64 | try:
65 | LiveIPs.append(ip.split(":",1)[1].strip())
66 | except Exception as e:
67 | print e
68 | return LiveIPs
69 |
70 | def getActiveProcesses():
71 | return popen("tasklist /FO LIST").read().strip().split("\n\n")
72 |
73 | def getTaskschList():
74 | return popen("schtasks /Query /FO LIST").read().strip().split("\n\n")
75 |
76 | def getHostsFileContent():
77 | return open("c:\windows\system32\drivers\etc\hosts",'r').readlines()
78 |
79 | def getArpTable():
80 | return popen("arp -a").read().strip().split("\n\n")
--------------------------------------------------------------------------------
/src/utils/parsers.py:
--------------------------------------------------------------------------------
1 | import re
2 |
3 | def parseFirewallRule(line):
4 | # Recive the value from the registry and return parsed dict of the rule
5 | rule = {}
6 | rule["Active"] = line.split("Active=")[1].split("|")[0]
7 | rule["App"] = line.split("App=")[1].split("|")[0]
8 | rule["Name"] = line.split("Name=")[1].split("|")[0]
9 | rule["Action"] = line.split("Action=")[1].split("|")[0]
10 | return rule
11 |
12 | def parseMcAfeeDatDate(date):
13 | # Convert the date 2016/12/31 into 31/12/2016
14 | date = date.split("/")
15 | return date[2]+"/"+date[1]+"/"+date[0]
16 |
17 | def parseMcAfeeLastScanDate(path):
18 | # Reads the end of the file OnDemandScanLog from DEFLOGDIR and parse the last date
19 | offset = 0
20 | line = ''
21 | with open(path+"\\"+"OnDemandScanLog.txt") as f:
22 | while True:
23 | offset -= 1
24 | f.seek(offset, 2)
25 | nextline = f.next()
26 | if nextline == '\n' and line.strip():
27 | return line.split("\t")[1].rsplit(":",1)[0] + " " + line.split("\t")[0]
28 | break
29 | else:
30 | line = nextline
31 |
32 | def parseMcAfeeLogs(path):
33 | # Extract the suspicios logs
34 | KnownLogfilesNames = ['AccessProtectionLog.txt','OnAccessScanLog.txt','OnDemandScanLog.txt']
35 | Logs = []
36 | for logfile in KnownLogfilesNames:
37 | try:
38 | logfile = open(path+"\\"+logfile,'r').read()
39 | for line in logfile.split("\n"):
40 | parsedLine = {}
41 | if "trojan" in line.lower() or "deleted)" in line.lower() or "no action taken" in line.lower() or "unwanted program" in line.lower():
42 | if "scan timed out" not in line.lower():
43 | line = line.split("\t")
44 | parsedLine["Date"] = line[0]
45 | parsedLine["Time"] = line[1]
46 | parsedLine["Action"] = line[2]
47 | parsedLine["Process"] = line[4]
48 | parsedLine["Path"] = line[5]
49 | parsedLine["Description"] = line[6]
50 | parsedLine["Hash"] = line[7]
51 | Logs.append(parsedLine)
52 | except:
53 | pass
54 | return Logs
55 |
56 | def parseUSB(path):
57 | # Build a dict of all USBs connections
58 | uid = 0
59 | USB = {}
60 | USBfile = open(path, 'r').read().split("")
61 | for usb in USBfile:
62 | try:
63 | if "]*)[$<]", usb)
68 | #get the usb title:
69 | if "0000" in usbparse[1]:
70 | usbname = usbparse[2]
71 | else:
72 | usbname=usbparse[1]+" - "+usbparse[2]
73 | #set the usb name:
74 | USB[uid]['name']=usbname
75 | #get the usb type:
76 | usbtype = usbparse[3]
77 | USB[uid]['type']=usbtype
78 | #get the usb serial:
79 | usbserial = usbparse[9]
80 | USB[uid]['serial']=usbserial
81 | #get the first date:
82 | usbfdate = usbparse[10]
83 | USB[uid]['fdate']=usbfdate.replace(" ","|")
84 | #get the last date:
85 | usbldate = usbparse[11]
86 | USB[uid]['ldate']=usbldate.replace(" ","|")
87 | except:
88 | pass
89 | return USB
90 |
91 | def parseUsers(output):
92 | return output[3:][:-1][0].split() # Remove 2 first line and 1 last line
93 |
94 | def parseProc(proc):
95 | PID = ""
96 | Name = ""
97 | for line in proc.split("\n"):
98 | lineName = line.split(":",1)[0]
99 | if lineName == "PID":
100 | PID = line.split(":",1)[1].strip()
101 | if lineName == "Image Name":
102 | Name = line.split(":",1)[1].strip()
103 |
104 | return PID, Name
105 |
106 | def parseConnection(line, Processes):
107 | connection = {}
108 | # Index: 0=Protocol, 1=Local, 2=Remote, 3=Status, 4=PID
109 | connection["Local"] = line[1].strip()
110 | connection["Remote"] = line[2].strip()
111 | connection["Status"] = line[3].strip()
112 | connection["Protocol"] = line[0].strip()
113 | connection["PID"] = line[4].strip()
114 | connection["appName"] = Processes[line[4].strip()]
115 | return connection
116 |
117 | def parseTask(Task):
118 | wantedDetails = ["TaskName", "Next Run Time", "Status"]
119 | parsedTask = {}
120 | for line in Task.split("\n"):
121 | if line.split(":")[0] in wantedDetails:
122 | parsedTask[line.split(":")[0]] = line.split(":")[1].strip()
123 |
124 | return parsedTask
125 |
126 | def parseHosts(hostLine):
127 | return hostLine.split(" ")[0], hostLine.rsplit(" ",1)[1].strip()
128 |
129 | def parseArpTableLine(line):
130 | parsedLine = {}
131 | for value in line.split():
132 | if "." in value:
133 | parsedLine["IP"] = value
134 | elif "-" in value:
135 | parsedLine["MAC"] = value
136 | else:
137 | parsedLine["Type"] = value
138 | return parsedLine
--------------------------------------------------------------------------------
|