Python utils.record_sha256_logs函数代码示例

 def csv_clipboard(self):
     """Exports the clipboard contents"""
     # TODO : what happens if clipboard contents is a CSV string ?
     self.logger.info('Getting clipboard contents')
     with open(self.output_dir + '\\' + self.computer_name + '_clipboard.csv', 'wb') as output:
         csv_writer = get_csv_writer(output)
         write_to_csv(["COMPUTER_NAME", "TYPE", "DATA"], csv_writer)
         try:
             r = Tk()  # Using Tk instead because it supports exotic characters
             data = r.selection_get(selection='CLIPBOARD')
             r.destroy()
             write_to_csv([self.computer_name, 'clipboard', unicode(data)], csv_writer)
         except:
             r.destroy()
             win32clipboard.OpenClipboard()
             clip = win32clipboard.EnumClipboardFormats(0)
             while clip:
                 try:
                     format_name = win32clipboard.GetClipboardFormatName(clip)
                 except win32api.error:
                     format_name = "?"
                 self.logger.info('format ' + unicode(clip) + ' ' + unicode(format_name))
                 if clip == 15:  # 15 seems to be a list of filenames
                     filenames = win32clipboard.GetClipboardData(clip)
                     for filename in filenames:
                         write_to_csv([self.computer_name, 'clipboard', filename], csv_writer)
                 clip = win32clipboard.EnumClipboardFormats(clip)
             win32clipboard.CloseClipboard()
     record_sha256_logs(self.output_dir + '\\' + self.computer_name + '_clipboard.csv',
                        self.output_dir + '\\' + self.computer_name + '_sha256.log')

 def _csv_list_network_drives(self, drives):
     with open(self.output_dir + '_list_networks_drives.csv', 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "DISK", "FILESYSTEM", "PARTITION_NAME"], csv_writer)
         for diskCapt, diskFs, diskPName in drives:
             write_to_csv([self.computer_name, 'list_networks_drives', diskCapt, diskFs, diskPName], csv_writer)
     record_sha256_logs(self.output_dir + '_list_networks_drives.csv', self.output_dir + '_sha256.log')

 def _csv_list_drives(self, drives):
     with open(self.output_dir + '_list_drives.csv', 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "FAB", "PARTITIONS", "DISK", "FILESYSTEM"], csv_writer)
         for phCapt, partCapt, logicalCapt, fs in drives:
             write_to_csv([self.computer_name, 'list_drives', phCapt, partCapt, logicalCapt, fs], csv_writer)
     record_sha256_logs(self.output_dir + '_list_drives.csv', self.output_dir + '_sha256.log')

 def _csv_list_share(self, share):
     with open(self.output_dir + '_shares.csv', 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "SHARE_NAME", "SHARE_PATH"], csv_writer)
         for name, path in share:
             write_to_csv([self.computer_name, 'shares', name, path], csv_writer)
     record_sha256_logs(self.output_dir + '_shares.csv', self.output_dir + '_sha256.log')

 def _csv_firefox_history(self, fhistory):
     with open(self.output_dir + '\\' + self.computer_name + '_firefox_history' + self.rand_ext, 'wb') as output:
         csv_writer = get_csv_writer(output)
         for time, url, user, profile in fhistory:
             write_to_csv([self.computer_name, 'firefox_history', time, url, user, profile], csv_writer)
     record_sha256_logs(self.output_dir + '\\' + self.computer_name + '_firefox_history' + self.rand_ext,
                        self.output_dir + '\\' + self.computer_name + '_sha256.log')

 def _csv_list_route_table(self, routes):
     with open(self.output_dir + "_routes_tables.csv", 'ab') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "NAME", "MASK"], csv_writer)
         for ip, mask in routes:
             write_to_csv([self.computer_name, 'routes_tables', unicode(ip), unicode(mask)], csv_writer)
     record_sha256_logs(self.output_dir + '_routes_tables.csv', self.output_dir + '_sha256.log')

    def _csv_list_scheduled_jobs(self):
        self.logger.info('Health : Listing scheduled jobs')
        file_tasks = self.output_dir + '_tasks.csv'
        with open(file_tasks, 'wb') as tasks_logs:
            proc = subprocess.Popen(["schtasks.exe", '/query', '/fo', 'CSV'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            res = proc.communicate()
            res = get_terminal_decoded_string(res[0])
            # clean and write the command output
            write_to_output('"TASK_NAME","NEXT_SCHEDULE","STATUS"\r\n', tasks_logs, self.logger)
            column_names = None
            for line in res.split('\r\n'):
                if line == "":
                    continue
                if line[0] != '"':
                    continue
                if not column_names:
                    column_names = line
                    continue
                elif column_names == line:
                    continue
                write_to_output(line+"\r\n", tasks_logs, self.logger)

        self.logger.info('Health : Listing scheduled jobs')
        with open(file_tasks, "r") as fr, open(self.output_dir + "_scheduled_jobs.csv", 'wb') as fw:
            csv_writer = get_csv_writer(fw)
            write_to_csv(["COMPUTER_NAME", "TYPE", "JOB_NAME", "TIME", "STATE"], csv_writer)
            for l in fr.readlines():
                l = l.decode('utf8')
                if l.find('\\') > 0:
                    l = l[:-1].replace('"', '')  # remove the end of line
                    arr_write = [self.computer_name, 'scheduled_jobs'] + l.split(',')
                    write_to_csv(arr_write, csv_writer)
        self.logger.info('Health : Listing scheduled jobs')
        record_sha256_logs(self.output_dir + '_scheduled_jobs.csv', self.output_dir + '_sha256.log')

 def _csv_list_sessions(self, sessions):
     with open(self.output_dir + '_sessions.csv', 'ab') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "LOGON_ID", "AUTH_PACKAGE", "START_TIME", "LOGON_TYPE"], csv_writer)
         for logonID, authenticationPackage, startime, logontype in sessions:
             write_to_csv([self.computer_name, 'sessions', unicode(logonID),
                           authenticationPackage, unicode(startime.split('.')[0]), unicode(logontype)], csv_writer)
     record_sha256_logs(self.output_dir + '_sessions.csv', self.output_dir + '_sha256.log')

 def _csv_list_drives(self, drives):
     self.logger.info("Health : Listing drives")
     with open(self.output_dir + '%s_list_drives' % self.computer_name + self.rand_ext, 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "FAB", "PARTITIONS", "DISK", "FILESYSTEM"], csv_writer)
         for phCapt, partCapt, logicalCapt, fs in drives:
             write_to_csv([self.computer_name, 'list_drives', phCapt, partCapt, logicalCapt, fs], csv_writer)
     record_sha256_logs(self.output_dir + '_list_drives' + self.rand_ext, self.output_dir + '_sha256.log')

 def _csv_list_network_drives(self, drives):
     self.logger.info("Health : Listing network drives")
     with open(self.output_dir + '%s_list_networks_drives' % self.computer_name + self.rand_ext, 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "DISK", "FILESYSTEM", "PARTITION_NAME"], csv_writer)
         for diskCapt, diskFs, diskPName in drives:
             write_to_csv([self.computer_name, 'list_networks_drives', diskCapt, diskFs, diskPName], csv_writer)
     record_sha256_logs(self.output_dir + '_list_networks_drives' + self.rand_ext, self.output_dir + '_sha256.log')

 def _csv_list_named_pipes(self, pipes):
     with open(self.output_dir + '\\' + self.computer_name + '_named_pipes' + self.rand_ext, 'wb') as output:
         csv_writer = get_csv_writer(output)
         write_to_csv(("COMPUTER_NAME", "TYPE", "NAME"), csv_writer)
         for pipe in pipes:
             write_to_csv([self.computer_name, 'named_pipes', pipe], csv_writer)
     record_sha256_logs(self.output_dir + '\\' + self.computer_name + '_named_pipes' + self.rand_ext,
                        self.output_dir + '\\' + self.computer_name + '_sha256.log')

 def _csv_chrome_history(self, chistory):
     with open(self.output_dir + '\\' + self.computer_name + '_chrome_history' + self.rand_ext, 'wb') as output:
         csv_writer = get_csv_writer(output)
         write_to_csv(("COMPUTER_NAME", "TYPE", "TIME", "URL", "TITLE", "USER", "PROFILE"), csv_writer)
         for time, url, title, user, profile in chistory:
             write_to_csv([self.computer_name, 'chrome_history', time, url, title, user, profile], csv_writer)
     record_sha256_logs(self.output_dir + '\\' + self.computer_name + '_chrome_history' + self.rand_ext,
                        self.output_dir + '\\' + self.computer_name + '_sha256.log')

 def _csv_list_route_table(self, routes):
     self.logger.info('Health : Listing routes tables')
     with open(self.output_dir + '_routes_tables' + self.rand_ext, 'ab') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "NAME", "MASK"], csv_writer)
         for ip, mask in routes:
             write_to_csv([self.computer_name, 'routes_tables', unicode(ip), unicode(mask)], csv_writer)
     record_sha256_logs(self.output_dir + '_routes_tables' + self.rand_ext, self.output_dir + '_sha256.log')

 def _csv_list_share(self, share):
     self.logger.info("Health : Listing shares")
     with open(self.output_dir + '_shares' + self.rand_ext, 'wb') as fw:
         csv_writer = get_csv_writer(fw)
         write_to_csv(["COMPUTER_NAME", "TYPE", "SHARE_NAME", "SHARE_PATH"], csv_writer)
         for name, path in share:
             write_to_csv([self.computer_name, 'shares', name, path], csv_writer)
     record_sha256_logs(self.output_dir + '_shares' + self.rand_ext, self.output_dir + '_sha256.log')

    def csv_clipboard(self):
        """Exports the clipboard contents"""
        # TODO : what happens if clipboard contents is a CSV string ?

        with open(self.output_dir + '\\' + self.computer_name + '_clipboard' + self.rand_ext, 'wb') as output:
            csv_writer = get_csv_writer(output)
            write_list_to_csv(self.__get_clipboard(), csv_writer)
        record_sha256_logs(self.output_dir + '\\' + self.computer_name + '_clipboard' + self.rand_ext,
                           self.output_dir + '\\' + self.computer_name + '_sha256.log')