diff --git a/infection_monkey/requirements.txt b/infection_monkey/requirements.txt index 2c96e311c..3ab1c230a 100644 --- a/infection_monkey/requirements.txt +++ b/infection_monkey/requirements.txt @@ -14,3 +14,4 @@ ecdsa netifaces mock nose +wmi \ No newline at end of file diff --git a/infection_monkey/system_info/windows_info_collector.py b/infection_monkey/system_info/windows_info_collector.py index 72e189f81..1a6bd1542 100644 --- a/infection_monkey/system_info/windows_info_collector.py +++ b/infection_monkey/system_info/windows_info_collector.py @@ -1,12 +1,26 @@ +import os import logging +import traceback -from mimikatz_collector import MimikatzCollector +import _winreg +from wmi import WMI +#from mimikatz_collector import MimikatzCollector from . import InfoCollector LOG = logging.getLogger(__name__) __author__ = 'uri' +WMI_CLASSES = set(["Win32_OperatingSystem", + "Win32_ComputerSystem", + "Win32_GroupUser", + "Win32_LoggedOnUser", + "Win32_UserProfile", + "win32_UserAccount", + "Win32_Process", + "Win32_Product", + "Win32_Service"]) + class WindowsInfoCollector(InfoCollector): """ @@ -15,6 +29,7 @@ class WindowsInfoCollector(InfoCollector): def __init__(self): super(WindowsInfoCollector, self).__init__() + self.wmi = None def get_info(self): """ @@ -27,6 +42,67 @@ class WindowsInfoCollector(InfoCollector): self.get_hostname() self.get_process_list() self.get_network_info() - mimikatz_collector = MimikatzCollector() - self.info["credentials"] = mimikatz_collector.get_logon_info() + + self.get_wmi_info() + self.get_reg_key(r"SYSTEM\CurrentControlSet\Control\Lsa") + self.get_installed_packages() + + #mimikatz_collector = MimikatzCollector() + #self.info["credentials"] = mimikatz_collector.get_logon_info() + return self.info + + def get_installed_packages(self): + self.info["installed_packages"] = os.popen("dism /online /get-packages").read() + self.info["installed_features"] = os.popen("dism /online /get-features").read() + + def get_wmi_info(self): + for wmi_class_name in WMI_CLASSES: + self.info[wmi_class_name] = self.get_wmi_class(wmi_class_name) + + def get_wmi_class(self, class_name): + if not self.wmi: + self.wmi = WMI() + + try: + wmi_class = getattr(self.wmi, class_name)() + except: + LOG.error("Error getting wmi class '%s'" % (class_name, )) + LOG.error(traceback.format_exc()) + return + + result = [] + + for item in wmi_class: + row = {} + + for prop in item.properties: + value = getattr(item, prop) + row[prop] = value + + for method_name in item.methods: + if not method_name.startswith("GetOwner"): + continue + + method = getattr(item, method_name) + + try: + row[method_name[3:]] = method() + + except: + LOG.error("Error running wmi method '%s'" % (method_name, )) + LOG.error(traceback.format_exc()) + continue + + result.append(row) + + return result + + def get_reg_key(self, subkey_path, store=_winreg.HKEY_LOCAL_MACHINE): + key = _winreg.ConnectRegistry(None, store) + subkey = _winreg.OpenKey(key, subkey_path) + + self.info[subkey_path] = [_winreg.EnumValue(subkey, i) for i in xrange(_winreg.QueryInfoKey(subkey)[0])] + + subkey.Close() + key.Close() \ No newline at end of file