Add logging, turn mimikatz into modern class.
This commit is contained in:
parent
b41c0b0e51
commit
4af4178344
|
@ -1,3 +1,4 @@
|
|||
import logging
|
||||
import socket
|
||||
import sys
|
||||
|
||||
|
@ -6,6 +7,8 @@ from enum import IntEnum
|
|||
|
||||
from network.info import get_host_subnets
|
||||
|
||||
LOG = logging.getLogger(__name__)
|
||||
|
||||
# Linux doesn't have WindowsError
|
||||
try:
|
||||
WindowsError
|
||||
|
@ -56,8 +59,9 @@ class InfoCollector(object):
|
|||
def get_hostname(self):
|
||||
"""
|
||||
Adds the fully qualified computer hostname to the system information.
|
||||
:return: Nothing
|
||||
:return: None. Updates class information
|
||||
"""
|
||||
LOG.debug("Reading hostname")
|
||||
self.info['hostname'] = socket.getfqdn()
|
||||
|
||||
def get_process_list(self):
|
||||
|
@ -65,8 +69,9 @@ class InfoCollector(object):
|
|||
Adds process information from the host to the system information.
|
||||
Currently lists process name, ID, parent ID, command line
|
||||
and the full image path of each process.
|
||||
:return: Nothing
|
||||
:return: None. Updates class information
|
||||
"""
|
||||
LOG.debug("Reading process list")
|
||||
processes = {}
|
||||
for process in psutil.process_iter():
|
||||
try:
|
||||
|
@ -95,6 +100,7 @@ class InfoCollector(object):
|
|||
Adds network information from the host to the system information.
|
||||
Currently updates with a list of networks accessible from host,
|
||||
containing host ip and the subnet range.
|
||||
:return: None
|
||||
:return: None. Updates class information
|
||||
"""
|
||||
LOG.debug("Reading subnets")
|
||||
self.info['network_info'] = {'networks': get_host_subnets()}
|
||||
|
|
|
@ -1,7 +1,11 @@
|
|||
import logging
|
||||
|
||||
from . import InfoCollector
|
||||
|
||||
__author__ = 'uri'
|
||||
|
||||
LOG = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class LinuxInfoCollector(InfoCollector):
|
||||
"""
|
||||
|
@ -12,6 +16,12 @@ class LinuxInfoCollector(InfoCollector):
|
|||
super(LinuxInfoCollector, self).__init__()
|
||||
|
||||
def get_info(self):
|
||||
"""
|
||||
Collect Linux system information
|
||||
Hostname, process list and network subnets
|
||||
:return: Dict of system information
|
||||
"""
|
||||
LOG.debug("Running Linux collector")
|
||||
self.get_hostname()
|
||||
self.get_process_list()
|
||||
self.get_network_info()
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
import ctypes
|
||||
import binascii
|
||||
import ctypes
|
||||
import logging
|
||||
import socket
|
||||
|
||||
|
@ -8,13 +8,14 @@ __author__ = 'itay.mizeretz'
|
|||
LOG = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class MimikatzCollector:
|
||||
class MimikatzCollector(object):
|
||||
"""
|
||||
Password collection module for Windows using Mimikatz.
|
||||
"""
|
||||
|
||||
def __init__(self):
|
||||
try:
|
||||
|
||||
self._isInit = False
|
||||
self._config = __import__('config').WormConfiguration
|
||||
self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name)
|
||||
|
@ -31,9 +32,9 @@ class MimikatzCollector:
|
|||
Gets the logon info from mimikatz.
|
||||
Returns a dictionary of users with their known credentials.
|
||||
"""
|
||||
|
||||
if not self._isInit:
|
||||
return {}
|
||||
LOG.debug("Running mimikatz collector")
|
||||
|
||||
try:
|
||||
entry_count = self._collect()
|
||||
|
|
|
@ -1,5 +1,10 @@
|
|||
from . import InfoCollector
|
||||
import logging
|
||||
|
||||
from mimikatz_collector import MimikatzCollector
|
||||
from . import InfoCollector
|
||||
|
||||
LOG = logging.getLogger(__name__)
|
||||
|
||||
__author__ = 'uri'
|
||||
|
||||
|
||||
|
@ -12,6 +17,13 @@ class WindowsInfoCollector(InfoCollector):
|
|||
super(WindowsInfoCollector, self).__init__()
|
||||
|
||||
def get_info(self):
|
||||
"""
|
||||
Collect Windows system information
|
||||
Hostname, process list and network subnets
|
||||
Tries to read credential secrets using mimikatz
|
||||
:return: Dict of system information
|
||||
"""
|
||||
LOG.debug("Running Windows collector")
|
||||
self.get_hostname()
|
||||
self.get_process_list()
|
||||
self.get_network_info()
|
||||
|
|
Loading…
Reference in New Issue