Add logging, turn mimikatz into modern class.

This commit is contained in:
Daniel Goldberg 2017-12-31 13:46:07 +02:00
parent b41c0b0e51
commit 4af4178344
4 changed files with 36 additions and 7 deletions

View File

@ -1,3 +1,4 @@
import logging
import socket import socket
import sys import sys
@ -6,6 +7,8 @@ from enum import IntEnum
from network.info import get_host_subnets from network.info import get_host_subnets
LOG = logging.getLogger(__name__)
# Linux doesn't have WindowsError # Linux doesn't have WindowsError
try: try:
WindowsError WindowsError
@ -56,8 +59,9 @@ class InfoCollector(object):
def get_hostname(self): def get_hostname(self):
""" """
Adds the fully qualified computer hostname to the system information. Adds the fully qualified computer hostname to the system information.
:return: Nothing :return: None. Updates class information
""" """
LOG.debug("Reading hostname")
self.info['hostname'] = socket.getfqdn() self.info['hostname'] = socket.getfqdn()
def get_process_list(self): def get_process_list(self):
@ -65,8 +69,9 @@ class InfoCollector(object):
Adds process information from the host to the system information. Adds process information from the host to the system information.
Currently lists process name, ID, parent ID, command line Currently lists process name, ID, parent ID, command line
and the full image path of each process. and the full image path of each process.
:return: Nothing :return: None. Updates class information
""" """
LOG.debug("Reading process list")
processes = {} processes = {}
for process in psutil.process_iter(): for process in psutil.process_iter():
try: try:
@ -95,6 +100,7 @@ class InfoCollector(object):
Adds network information from the host to the system information. Adds network information from the host to the system information.
Currently updates with a list of networks accessible from host, Currently updates with a list of networks accessible from host,
containing host ip and the subnet range. containing host ip and the subnet range.
:return: None :return: None. Updates class information
""" """
LOG.debug("Reading subnets")
self.info['network_info'] = {'networks': get_host_subnets()} self.info['network_info'] = {'networks': get_host_subnets()}

View File

@ -1,7 +1,11 @@
import logging
from . import InfoCollector from . import InfoCollector
__author__ = 'uri' __author__ = 'uri'
LOG = logging.getLogger(__name__)
class LinuxInfoCollector(InfoCollector): class LinuxInfoCollector(InfoCollector):
""" """
@ -12,6 +16,12 @@ class LinuxInfoCollector(InfoCollector):
super(LinuxInfoCollector, self).__init__() super(LinuxInfoCollector, self).__init__()
def get_info(self): def get_info(self):
"""
Collect Linux system information
Hostname, process list and network subnets
:return: Dict of system information
"""
LOG.debug("Running Linux collector")
self.get_hostname() self.get_hostname()
self.get_process_list() self.get_process_list()
self.get_network_info() self.get_network_info()

View File

@ -1,5 +1,5 @@
import ctypes
import binascii import binascii
import ctypes
import logging import logging
import socket import socket
@ -8,13 +8,14 @@ __author__ = 'itay.mizeretz'
LOG = logging.getLogger(__name__) LOG = logging.getLogger(__name__)
class MimikatzCollector: class MimikatzCollector(object):
""" """
Password collection module for Windows using Mimikatz. Password collection module for Windows using Mimikatz.
""" """
def __init__(self): def __init__(self):
try: try:
self._isInit = False self._isInit = False
self._config = __import__('config').WormConfiguration self._config = __import__('config').WormConfiguration
self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name) self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name)
@ -31,9 +32,9 @@ class MimikatzCollector:
Gets the logon info from mimikatz. Gets the logon info from mimikatz.
Returns a dictionary of users with their known credentials. Returns a dictionary of users with their known credentials.
""" """
if not self._isInit: if not self._isInit:
return {} return {}
LOG.debug("Running mimikatz collector")
try: try:
entry_count = self._collect() entry_count = self._collect()

View File

@ -1,5 +1,10 @@
from . import InfoCollector import logging
from mimikatz_collector import MimikatzCollector from mimikatz_collector import MimikatzCollector
from . import InfoCollector
LOG = logging.getLogger(__name__)
__author__ = 'uri' __author__ = 'uri'
@ -12,6 +17,13 @@ class WindowsInfoCollector(InfoCollector):
super(WindowsInfoCollector, self).__init__() super(WindowsInfoCollector, self).__init__()
def get_info(self): def get_info(self):
"""
Collect Windows system information
Hostname, process list and network subnets
Tries to read credential secrets using mimikatz
:return: Dict of system information
"""
LOG.debug("Running Windows collector")
self.get_hostname() self.get_hostname()
self.get_process_list() self.get_process_list()
self.get_network_info() self.get_network_info()