fixed windows path storing (per volume). Added globeimposter2 module. Added func…

…tionality for registry and file lookup.

fixed windows path storing (per volume). Added globeimposter2 module. Added func…
…tionality for registry and file lookup.
Imanol-Mikel Barba Sabariego
1 parent 956444dd
Showing 5 changed files with 143 additions and 9 deletions
findfile.py
modules/edb.py
modules/globeimposter2.py
regquery.py
winver.py
+import os
+import fnmatch
+
+def find_pattern_all(pattern, path, casesensitive):
+    result = []
+    for root, dirs, files in os.walk(path):
+        for name in files:
+            if sensitive:
+                if fnmatch.fnmatchcase(name,pattern):
+                    result.append(os.path.join(root, name))
+			else:
+                if fnmatch.fnmatch(name.lower(), pattern.lower()):
+                    result.append(os.path.join(root, name))
+    return result
+
+def find_pattern(pattern, path, casesensitive):
+    for root, dirs, files in os.walk(path):
+        for name in files:
+            if sensitive:
+                if fnmatch.fnmatchcase(name,pattern):
+                    return os.path.join(root, name)
+			else:
+                if fnmatch.fnmatch(name.lower(), pattern.lower()):
+                    return os.path.join(root, name)
+    return None
+
+def find_all(name, path):
+    result = []
+    for root, dirs, files in os.walk(path):
+        if name in files:
+            result.append(os.path.join(root, name))
+    return result
+
+def find(name, path):
+    for root, dirs, files in os.walk(path):
+        if name in files:
+            return os.path.join(root, name)
+    return None
@@ -43,7 +43,7 @@ class RegistryModule(Module):
             else:
                 files += [mntpoint + "/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb"]
-            runProcess(["tar","-czvf",path + "evt_" + vol + "_" + str(int(time.time())) + ".tar.gz"] + files)
+            runProcess(["tar","-czvf",path + "edb_" + vol + "_" + str(int(time.time())) + ".tar.gz"] + files)
             try:
                 umount(mntid)
             except:
+import os
+
+import regquery
+import logger
+import tomb
+import winver
+from modules.module import Module
+from mount import mount,umount
+from runcmd import runProcess
+import time
+import findfile
+
+def getInstance():
+    return RegistryModule()
+
+class RegistryModule(Module):
+
+    def __init__(self):
+        self.name = "globeimposter2"
+        self.description = "Detects a Globeimposter 2.0 infection"
+        self.requiredVars = ["ntfsvol","winvol"]
+        self.vars = {}
+
+    def execute(self):
+        path = tomb.getPath() + self.name + "/"
+        if(not os.path.exists(path)):
+            os.mkdir(path)
+        logger.msgLog("Scanning volumes " + repr(self.vars['winvol'].value) + " " + repr(self.vars['ntfsvol'].value) + " for Globeimposter 2.0 infection","globeimposter2", logger.TYPE_INFO)
+        for vol in self.vars['winvol'].value:
+            mntpoint = "/mnt/"
+            try:
+                mntid = mount("/dev/" + vol)
+            except:
+                raise
+            mntpoint += mntid
+            profiles = winver.getUserProfiles(mntpoint)
+            for profile in profiles:
+                hkcu = profile + "/NTUSER.DAT"
+                value = regquery.queryValue(hkcu,"""Software\Microsoft\Windows\CurrentVersion\RunOnce""","CertificatesCheck")
+                if(value != None):
+                    logger.msgLog("FOUND Globeimposter 2.0 value in RunOnce: " + value,"globeimposter2",logger.TYPE_WARNING)
+            #VSS
+
+        for vol in self.vars['ntfsvol'].value:
+            mntpoint = "/mnt/"
+            try:
+                mntid = mount("/dev/" + vol)
+            except:
+                raise
+            mntpoint += mntid
+            result = find_pattern("*.725",mntpoint,False)
+			if(result != None):
+                logger.msgLog("FOUND at least one file with 725 extension: " + result,"globeimposter2",logger.TYPE_WARNING)
+            result = find("RECOVER-FILES.html",mntpoint)
+            if(result != None):
+                logger.msgLog("FOUND ransom letter: " + result,"globeimposter2",logger.TYPE_WARNING)
+from Registry import Registry
+
+def queryValue(hive,keyPath,valueName):
+    reg = Registry.Registry(hive)
+    key = reg.open(keyPath)
+    try:
+        value = str(key.value(valueName).value)
+    except Registry.RegistryValueNotFoundException:
+        value = None
+    return value
+
+def getValues(hive,key):
+    valueList = []
+    reg = Registry.Registry(hive)
+    key = reg.open(keyPath)
+	for value in key.values():
+        valueList.append(value.value_name)
+    return valueList
+
+def getSubkeys(hive,key):
+    subkeyList = []
+    reg = Registry.Registry(hive)
+    key = reg.open(keyPath)
+    for subkey in key.subkeys():
+        subkeyList.append(subkey.name)
+    return subkeyList
+
+def keyExists(hive,key):
+    reg = Registry.Registry(hive)
+    try:
+        key = reg.open(key)
+        return True
+    except Registry.RegistryKeyNotFoundException:
+        return False
@@ -2,6 +2,7 @@ import os
 from runcmd import runProcess
 import re
 import pefile
+import findfile
 _WIN_9x     = 0
 _WIN_ME     = 1
@@ -19,7 +20,7 @@ _WIN_81     = 9
 _WIN_2k12R2 = 9
 _WIN_10     = 10
-
+DETECTED_WINDOWS_PATH = {}
 def getWindowsVersion(path):
     if(os.path.isfile(getWindowsDirectory(path) + "/System32/ntdll.dll")):
@@ -51,13 +52,18 @@ def getWindowsVersion(path):
         return _WIN_9x
 def getWindowsDirectory(path):
-    result,code = runProcess(["find",path,"-xdev","-iname","explorer.exe","-print","-quit"])
-    if(result.decode("utf-8") == ""):
-        return None
-    matches = result.decode("utf-8").splitlines()
-    #WARNING: ONLY CONSIDERING FIRST MATCH
-    #TODO: Improve
-    return os.path.dirname(os.path.realpath(matches[0]))
+    if DETECTED_WINDOWS_PATH[path] is None:
+      result = find_pattern("explorer.exe",path,False)
+      #result,code = runProcess(["find",path,"-xdev","-iname","explorer.exe","-print","-quit"])
+      #if(result.decode("utf-8") == ""):
+      if(len(result) == 0):
+          return None
+      #matches = result.decode("utf-8").splitlines()
+      #WARNING: ONLY CONSIDERING FIRST MATCH
+      #TODO: Improve
+      #return os.path.dirname(os.path.realpath(matches[0]))
+      DETECTED_WINDOWS_PATH[path] = os.path.dirname(os.path.realpath(result))
+    return DETECTED_WINDOWS_PATH[path]
 def getUserProfiles(path):
     version = getWindowsVersion(path)