p15693087
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

handle the PartCoponent issue in the report

This commit is contained in:
Oran Nadler 2018-05-08 17:25:46 +03:00
parent 7af6e6473c
commit e672e26f71
1 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
monkey_island/cc/resources/pthmap.py
View File

@ -166,7 +166,7 @@ class Machine(object):
return self.GetDomainRole() in (DsRole_RolePrimaryDomainController, DsRole_RoleBackupDomainController) return self.GetDomainRole() in (DsRole_RolePrimaryDomainController, DsRole_RoleBackupDomainController)
@cache @cache
def GetSidByUsername(self, username): def GetSidByUsername(self, username, domain=None):
doc = self.latest_system_info doc = self.latest_system_info
for user in doc["data"]["Win32_UserAccount"]: for user in doc["data"]["Win32_UserAccount"]:
@ -175,6 +175,9 @@ class Machine(object):
if user["SIDType"] != SidTypeUser: if user["SIDType"] != SidTypeUser:
continue continue
if domain and user["Domain"] != domain:
continue
return eval(user["SID"]) return eval(user["SID"])
@ -319,10 +322,26 @@ class Machine(object):
if "PartComponent" not in group_user.keys(): if "PartComponent" not in group_user.keys():
continue continue
if group_user["PartComponent"]["SIDType"] != SidTypeUser: if type(group_user["PartComponent"]) in (str, unicode):
continue # PartComponent is an id to Win32_UserAccount table
wmi_id = group_user["PartComponent"]
if "cimv2:Win32_UserAccount" not in wmi_id:
continue
# u'\\\\WIN-BFA01FFQFLS\\root\\cimv2:Win32_UserAccount.Domain="MYDOMAIN",Name="WIN-BFA01FFQFLS$"'
username = wmi_id.split('cimv2:Win32_UserAccount.Domain="')[1].split('",Name="')[0]
domain = wmi_id.split('cimv2:Win32_UserAccount.Domain="')[1].split('",Name="')[1][:-1]
sid = self.GetSidByUsername(username, domain)
users[sid] = username
else:
if group_user["PartComponent"]["SIDType"] != SidTypeUser:
continue
users[eval(group_user["PartComponent"]["SID"])] = eval(group_user["PartComponent"]["Name"]) users[eval(group_user["PartComponent"]["SID"])] = eval(group_user["PartComponent"]["Name"])
return users return users