from cc.services.pth_report_utils import PassTheHashReport, Machine class PTHReportService(object): def __init__(self): pass @staticmethod def get_duplicated_password_nodes(pth): usernames_lists = [] usernames_per_sid_list = [] dups = dict(map(lambda x: (x, len(pth.GetSidsBySecret(x))), pth.GetAllSecrets())) for secret, count in sorted(dups.iteritems(), key=lambda (k, v): (v, k), reverse=True): if count <= 1: continue for sid in pth.GetSidsBySecret(secret): usernames_per_sid_list.append(pth.GetUsernameBySid(sid)) usernames_lists.append(usernames_per_sid_list) return usernames_lists @staticmethod def get_shared_local_admins_nodes(pth): dups = dict(map(lambda x: (x, len(pth.GetSharedAdmins(x))), pth.machines)) shared_admin_machines = [] for m, count in sorted(dups.iteritems(), key=lambda (k, v): (v, k), reverse=True): if count <= 0: continue shared_admin_account_list = [] for sid in pth.GetSharedAdmins(m): shared_admin_account_list.append(pth.GetUsernameBySid(sid)) machine = { 'ip': m.GetIp(), 'hostname': m.GetHostName(), 'domain': m.GetDomainName(), 'services_names': m.GetCriticalServicesInstalled(), 'user_count': count, 'admins_accounts': shared_admin_account_list } shared_admin_machines.append(machine) return shared_admin_machines @staticmethod def get_strong_users_on_crit_services(pth): threatening = dict(map(lambda x: (x, len(pth.GetThreateningUsersByVictim(x))), pth.GetCritialServers())) strong_users_crit_list = [] for m, count in sorted(threatening.iteritems(), key=lambda (k, v): (v, k), reverse=True): if count <= 0: continue threatening_users_attackers_dict = {} for sid in pth.GetThreateningUsersByVictim(m): username = pth.GetUsernameBySid(sid) threatening_users_attackers_dict[username] = [] for mm in pth.GetAttackersBySid(sid): if m == mm: continue threatening_users_attackers_dict[username] = mm.GetIp() machine = { 'ip': m.GetIp(), 'hostname': m.GetHostName(), 'domain': m.GetDomainName(), 'services_names': m.GetCriticalServicesInstalled(), 'user_count': count, 'threatening_users': threatening_users_attackers_dict } strong_users_crit_list.append(machine) return strong_users_crit_list @staticmethod def get_strong_users_on_non_crit_services(pth): threatening = dict(map(lambda x: (x, len(pth.GetThreateningUsersByVictim(x))), pth.GetNonCritialServers())) strong_users_non_crit_list = [] for m, count in sorted(threatening.iteritems(), key=lambda (k, v): (v, k), reverse=True): if count <= 0: continue threatening_users_attackers_dict = {} for sid in pth.GetThreateningUsersByVictim(m): username = pth.GetUsernameBySid(sid) threatening_users_attackers_dict[username] = [] for mm in pth.GetAttackersBySid(sid): if m == mm: continue threatening_users_attackers_dict[username] = mm.GetIp() machine = { 'ip': m.GetIp(), 'hostname': m.GetHostName(), 'domain': m.GetDomainName(), 'services_names': m.GetNonCritialServers(), 'user_count': count, 'threatening_users': threatening_users_attackers_dict } strong_users_non_crit_list.append(machine) return strong_users_non_crit_list @staticmethod def generate_map_nodes(pth): return [{"id": x, "label": Machine(x).GetIp()} for x in pth.vertices] @staticmethod def generate_map_edges(pth): return [{"id": str(s) + str(t), "from": s, "to": t, "label": label} for s, t, label in pth.edges] @staticmethod def get_report(): pth = PassTheHashReport() report = \ { 'report_info': { 'same_password': PTHReportService.get_duplicated_password_nodes(pth), 'local_admin_shared': PTHReportService.get_shared_local_admins_nodes(pth), 'strong_users_on_crit_services': PTHReportService.get_strong_users_on_crit_services(pth), 'strong_users_on_non_crit_services': PTHReportService.get_strong_users_on_non_crit_services(pth) }, 'map': { 'nodes': PTHReportService.generate_map_nodes(pth), 'edges': PTHReportService.generate_map_edges(pth) } } return report # print """