forked from p15670423/monkey
Add logging, turn mimikatz into modern class.
This commit is contained in:
parent
b41c0b0e51
commit
4af4178344
|
@ -1,3 +1,4 @@
|
||||||
|
import logging
|
||||||
import socket
|
import socket
|
||||||
import sys
|
import sys
|
||||||
|
|
||||||
|
@ -6,6 +7,8 @@ from enum import IntEnum
|
||||||
|
|
||||||
from network.info import get_host_subnets
|
from network.info import get_host_subnets
|
||||||
|
|
||||||
|
LOG = logging.getLogger(__name__)
|
||||||
|
|
||||||
# Linux doesn't have WindowsError
|
# Linux doesn't have WindowsError
|
||||||
try:
|
try:
|
||||||
WindowsError
|
WindowsError
|
||||||
|
@ -56,8 +59,9 @@ class InfoCollector(object):
|
||||||
def get_hostname(self):
|
def get_hostname(self):
|
||||||
"""
|
"""
|
||||||
Adds the fully qualified computer hostname to the system information.
|
Adds the fully qualified computer hostname to the system information.
|
||||||
:return: Nothing
|
:return: None. Updates class information
|
||||||
"""
|
"""
|
||||||
|
LOG.debug("Reading hostname")
|
||||||
self.info['hostname'] = socket.getfqdn()
|
self.info['hostname'] = socket.getfqdn()
|
||||||
|
|
||||||
def get_process_list(self):
|
def get_process_list(self):
|
||||||
|
@ -65,8 +69,9 @@ class InfoCollector(object):
|
||||||
Adds process information from the host to the system information.
|
Adds process information from the host to the system information.
|
||||||
Currently lists process name, ID, parent ID, command line
|
Currently lists process name, ID, parent ID, command line
|
||||||
and the full image path of each process.
|
and the full image path of each process.
|
||||||
:return: Nothing
|
:return: None. Updates class information
|
||||||
"""
|
"""
|
||||||
|
LOG.debug("Reading process list")
|
||||||
processes = {}
|
processes = {}
|
||||||
for process in psutil.process_iter():
|
for process in psutil.process_iter():
|
||||||
try:
|
try:
|
||||||
|
@ -95,6 +100,7 @@ class InfoCollector(object):
|
||||||
Adds network information from the host to the system information.
|
Adds network information from the host to the system information.
|
||||||
Currently updates with a list of networks accessible from host,
|
Currently updates with a list of networks accessible from host,
|
||||||
containing host ip and the subnet range.
|
containing host ip and the subnet range.
|
||||||
:return: None
|
:return: None. Updates class information
|
||||||
"""
|
"""
|
||||||
|
LOG.debug("Reading subnets")
|
||||||
self.info['network_info'] = {'networks': get_host_subnets()}
|
self.info['network_info'] = {'networks': get_host_subnets()}
|
||||||
|
|
|
@ -1,7 +1,11 @@
|
||||||
|
import logging
|
||||||
|
|
||||||
from . import InfoCollector
|
from . import InfoCollector
|
||||||
|
|
||||||
__author__ = 'uri'
|
__author__ = 'uri'
|
||||||
|
|
||||||
|
LOG = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
class LinuxInfoCollector(InfoCollector):
|
class LinuxInfoCollector(InfoCollector):
|
||||||
"""
|
"""
|
||||||
|
@ -12,6 +16,12 @@ class LinuxInfoCollector(InfoCollector):
|
||||||
super(LinuxInfoCollector, self).__init__()
|
super(LinuxInfoCollector, self).__init__()
|
||||||
|
|
||||||
def get_info(self):
|
def get_info(self):
|
||||||
|
"""
|
||||||
|
Collect Linux system information
|
||||||
|
Hostname, process list and network subnets
|
||||||
|
:return: Dict of system information
|
||||||
|
"""
|
||||||
|
LOG.debug("Running Linux collector")
|
||||||
self.get_hostname()
|
self.get_hostname()
|
||||||
self.get_process_list()
|
self.get_process_list()
|
||||||
self.get_network_info()
|
self.get_network_info()
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
import ctypes
|
|
||||||
import binascii
|
import binascii
|
||||||
|
import ctypes
|
||||||
import logging
|
import logging
|
||||||
import socket
|
import socket
|
||||||
|
|
||||||
|
@ -8,13 +8,14 @@ __author__ = 'itay.mizeretz'
|
||||||
LOG = logging.getLogger(__name__)
|
LOG = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
class MimikatzCollector:
|
class MimikatzCollector(object):
|
||||||
"""
|
"""
|
||||||
Password collection module for Windows using Mimikatz.
|
Password collection module for Windows using Mimikatz.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def __init__(self):
|
def __init__(self):
|
||||||
try:
|
try:
|
||||||
|
|
||||||
self._isInit = False
|
self._isInit = False
|
||||||
self._config = __import__('config').WormConfiguration
|
self._config = __import__('config').WormConfiguration
|
||||||
self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name)
|
self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name)
|
||||||
|
@ -31,9 +32,9 @@ class MimikatzCollector:
|
||||||
Gets the logon info from mimikatz.
|
Gets the logon info from mimikatz.
|
||||||
Returns a dictionary of users with their known credentials.
|
Returns a dictionary of users with their known credentials.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
if not self._isInit:
|
if not self._isInit:
|
||||||
return {}
|
return {}
|
||||||
|
LOG.debug("Running mimikatz collector")
|
||||||
|
|
||||||
try:
|
try:
|
||||||
entry_count = self._collect()
|
entry_count = self._collect()
|
||||||
|
|
|
@ -1,5 +1,10 @@
|
||||||
from . import InfoCollector
|
import logging
|
||||||
|
|
||||||
from mimikatz_collector import MimikatzCollector
|
from mimikatz_collector import MimikatzCollector
|
||||||
|
from . import InfoCollector
|
||||||
|
|
||||||
|
LOG = logging.getLogger(__name__)
|
||||||
|
|
||||||
__author__ = 'uri'
|
__author__ = 'uri'
|
||||||
|
|
||||||
|
|
||||||
|
@ -12,6 +17,13 @@ class WindowsInfoCollector(InfoCollector):
|
||||||
super(WindowsInfoCollector, self).__init__()
|
super(WindowsInfoCollector, self).__init__()
|
||||||
|
|
||||||
def get_info(self):
|
def get_info(self):
|
||||||
|
"""
|
||||||
|
Collect Windows system information
|
||||||
|
Hostname, process list and network subnets
|
||||||
|
Tries to read credential secrets using mimikatz
|
||||||
|
:return: Dict of system information
|
||||||
|
"""
|
||||||
|
LOG.debug("Running Windows collector")
|
||||||
self.get_hostname()
|
self.get_hostname()
|
||||||
self.get_process_list()
|
self.get_process_list()
|
||||||
self.get_network_info()
|
self.get_network_info()
|
||||||
|
|
Loading…
Reference in New Issue