Imanol-Mikel Barba Sabariego / gravedigger · Commits

Commit 47b49017a163ae1dc8bb51434a44dc75d43acde3

Authored by Imanol-Mikel Barba Sabariego
1 parent 00dcf762

Fixed errors

Inline Side-by-side
Showing 5 changed files with 23 additions and 23 deletions
digger.py
  View file @47b4901
... ... @@ -38,7 +38,7 @@ def getModules():
38 38 del module
39 39 sys.modules.pop(modname)
40 40 except Exception as e:
41   - print("Exception raised while importing " + modname)
  41 + logger.msgLog("Exception raised while importing " + modname + ": " + str(e),"digger",logger.TYPE_ERROR)
42 42 return choiceList
43 43  
44 44 def prepareModule(moduleName):
... ... @@ -124,14 +124,13 @@ if __name__ == "__main__":
124 124 locale.setlocale(locale.LC_ALL, '')
125 125 d = Dialog(dialog="dialog",autowidgetsize=True)
126 126 d.set_background_title("Gravedigger")
127   -
128   - moduleList = getModules()
129 127 code,value = d.inputbox("Input computer's name")
130 128 if code == d.OK:
131 129 tomb._MACHINE_NAME= value
132 130 logger.logSystems.append(ConsoleLogger())
133 131 logger.logSystems.append(FileLogger(tomb.getPath() + "log.txt"))
134 132 logger.msgLog("Beginning excavation of tomb: " + tomb.getPath(),"digger",logger.TYPE_INFO)
  133 + moduleList = getModules()
135 134 d.set_background_title("Gravedigger - " + value)
136 135 code, tags = d.checklist("Select modules to execute",
137 136 choices=moduleList + [("all","Execute all modules",False)],
... ...
findfile.py
  View file @47b4901
... ... @@ -5,10 +5,10 @@ def find_pattern_all(pattern, path, casesensitive):
5 5 result = []
6 6 for root, dirs, files in os.walk(path):
7 7 for name in files:
8   - if sensitive:
  8 + if casesensitive:
9 9 if fnmatch.fnmatchcase(name,pattern):
10 10 result.append(os.path.join(root, name))
11   - else:
  11 + else:
12 12 if fnmatch.fnmatch(name.lower(), pattern.lower()):
13 13 result.append(os.path.join(root, name))
14 14 return result
... ... @@ -16,10 +16,10 @@ def find_pattern_all(pattern, path, casesensitive):
16 16 def find_pattern(pattern, path, casesensitive):
17 17 for root, dirs, files in os.walk(path):
18 18 for name in files:
19   - if sensitive:
  19 + if casesensitive:
20 20 if fnmatch.fnmatchcase(name,pattern):
21 21 return os.path.join(root, name)
22   - else:
  22 + else:
23 23 if fnmatch.fnmatch(name.lower(), pattern.lower()):
24 24 return os.path.join(root, name)
25 25 return None
... ...
modules/globeimposter2.py
  View file @47b4901
... ... @@ -36,9 +36,10 @@ class RegistryModule(Module):
36 36 profiles = winver.getUserProfiles(mntpoint)
37 37 for profile in profiles:
38 38 hkcu = profile + "/NTUSER.DAT"
39   - value = regquery.queryValue(hkcu,"""Software\Microsoft\Windows\CurrentVersion\RunOnce""","CertificatesCheck")
40   - if(value != None):
41   - logger.msgLog("FOUND Globeimposter 2.0 value in RunOnce: " + value,"globeimposter2",logger.TYPE_WARNING)
  39 + if(os.path.isfile(hkcu)):
  40 + value = regquery.queryValue(hkcu,"""Software\Microsoft\Windows\CurrentVersion\RunOnce""","CertificatesCheck")
  41 + if(value != None):
  42 + logger.msgLog("FOUND Globeimposter 2.0 value in RunOnce: " + value,"globeimposter2",logger.TYPE_WARNING)
42 43 #VSS
43 44  
44 45 for vol in self.vars['ntfsvol'].value:
... ... @@ -48,9 +49,9 @@ class RegistryModule(Module):
48 49 except:
49 50 raise
50 51 mntpoint += mntid
51   - result = find_pattern("*.725",mntpoint,False)
52   - if(result != None):
  52 + result = findfile.find_pattern("*.725",mntpoint,False)
  53 + if(result != None):
53 54 logger.msgLog("FOUND at least one file with 725 extension: " + result,"globeimposter2",logger.TYPE_WARNING)
54   - result = find("RECOVER-FILES.html",mntpoint)
  55 + result = findfile.find("RECOVER-FILES.html",mntpoint)
55 56 if(result != None):
56 57 logger.msgLog("FOUND ransom letter: " + result,"globeimposter2",logger.TYPE_WARNING)
... ...
regquery.py
  View file @47b4901
1 1 from Registry import Registry
2 2  
3   -def queryValue(hive,keyPath,valueName):
  3 +def queryValue(hive,key,valueName):
4 4 reg = Registry.Registry(hive)
5   - key = reg.open(keyPath)
  5 + key = reg.open(key)
6 6 try:
7 7 value = str(key.value(valueName).value)
8   - except Registry.RegistryValueNotFoundException:
  8 + except Registry.RegistryParse.RegistryStructureDoesNotExist:
9 9 value = None
10 10 return value
11 11  
12 12 def getValues(hive,key):
13 13 valueList = []
14 14 reg = Registry.Registry(hive)
15   - key = reg.open(keyPath)
16   - for value in key.values():
17   - valueList.append(value.value_name)
  15 + key = reg.open(key)
  16 + for value in key.values():
  17 + valueList.append(value.value)
18 18 return valueList
19 19  
20 20 def getSubkeys(hive,key):
21 21 subkeyList = []
22 22 reg = Registry.Registry(hive)
23   - key = reg.open(keyPath)
  23 + key = reg.open(key)
24 24 for subkey in key.subkeys():
25 25 subkeyList.append(subkey.name)
26 26 return subkeyList
... ...
winver.py
  View file @47b4901
... ... @@ -52,11 +52,11 @@ def getWindowsVersion(path):
52 52 return _WIN_9x
53 53  
54 54 def getWindowsDirectory(path):
55   - if DETECTED_WINDOWS_PATH[path] is None:
56   - result = find_pattern("explorer.exe",path,False)
  55 + if path not in DETECTED_WINDOWS_PATH:
  56 + result = findfile.find_pattern("explorer.exe",path,False)
57 57 #result,code = runProcess(["find",path,"-xdev","-iname","explorer.exe","-print","-quit"])
58 58 #if(result.decode("utf-8") == ""):
59   - if(len(result) == 0):
  59 + if result is None:
60 60 return None
61 61 #matches = result.decode("utf-8").splitlines()
62 62 #WARNING: ONLY CONSIDERING FIRST MATCH
... ...