Commit ad274817badab9e188a239cd6936895ca7f9d8ed

Authored by Imanol-Mikel Barba Sabariego
1 parent cf2de849

Implemented edb module. Improved continue dialog on module var fail. Small fixes

digger.py
... ... @@ -60,11 +60,16 @@ def showFinishDialog(allSuccessful):
60 60 elif tag == "Reboot":
61 61 sp.call("reboot", shell=True)
62 62  
  63 + logger.msgLog("Finished excavation of tomb: " + tomb.getPath(),"digger",logger.TYPE_INFO)
63 64 exit(0)
64 65  
65 66 def showContinueDialog(d,msg):
66   - ans = d.yesno(msg + "\n\nDo you want to continue execution without the module?")
67   - return ans == d.OK
  67 + code, tag = d.menu(msg + "\n\nDo you want to retry module configuration or continue execution without the module?",
  68 + choices=[("retry", "Retry configuration"),
  69 + ("continue", "Continue without module")])
  70 + if code != d.OK:
  71 + return "abort"
  72 + return tag
68 73  
69 74 if __name__ == "__main__":
70 75 locale.setlocale(locale.LC_ALL, '')
... ... @@ -77,6 +82,7 @@ if __name__ == "__main__":
77 82 tomb._MACHINE_NAME= value
78 83 logger.logSystems.append(ConsoleLogger())
79 84 logger.logSystems.append(FileLogger(tomb.getPath() + "log.txt"))
  85 + logger.msgLog("Beginning excavation of tomb: " + tomb.getPath(),"digger",logger.TYPE_INFO)
80 86 d.set_background_title("Gravedigger - " + value)
81 87 code, tags = d.checklist("Select modules to execute",
82 88 choices=moduleList + [("all","Execute all modules",False)],
... ... @@ -84,27 +90,41 @@ if __name__ == "__main__":
84 90 if code == d.OK:
85 91 runlist = []
86 92 if "all" in tags:
  93 + logger.msgLog("Selected modules: " + repr(moduleList), "digger", logger.TYPE_INFO)
87 94 for module in moduleList:
88   - try:
89   - mod = prepareModule(module[0])
90   - runlist.append(mod)
91   - except Exception as e:
92   - msg = "Exception raised while preparing module \"" + module[0] + "\": " + str(e)
93   - logger.msgLog(msg, module[0], logger.TYPE_ERROR)
94   - #logger.msgLog(traceback.format_exc(), module[0], logger.TYPE_ERROR)
95   - if(not showContinueDialog(d,msg)):
96   - showFinishDialog(False)
  95 + while True:
  96 + try:
  97 + mod = prepareModule(module[0])
  98 + runlist.append(mod)
  99 + break
  100 + except Exception as e:
  101 + msg = "Exception raised while preparing module \"" + module[0] + "\": " + str(e)
  102 + logger.msgLog(msg, module[0], logger.TYPE_ERROR)
  103 + #logger.msgLog(traceback.format_exc(), module[0], logger.TYPE_ERROR)
  104 + ans = showContinueDialog(d,msg)
  105 + if ans == "abort":
  106 + showFinishDialog(False)
  107 + elif ans == "continue":
  108 + logger.msgLog("Skipping module " + module, "digger", logger.TYPE_INFO)
  109 + break
97 110 else:
  111 + logger.msgLog("Selected modules: " + repr(tags), "digger", logger.TYPE_INFO)
98 112 for tag in tags:
99   - try:
100   - mod = prepareModule(tag)
101   - runlist.append(mod)
102   - except Exception as e:
103   - msg = "Exception raised while preparing module \"" + tag + "\": " + str(e)
104   - logger.msgLog(msg,tag,logger.TYPE_ERROR)
105   - #logger.msgLog(traceback.format_exc(), tag logger.TYPE_ERROR)
106   - if(not showContinueDialog(d,msg)):
107   - showFinishDialog(False)
  113 + while True:
  114 + try:
  115 + mod = prepareModule(tag)
  116 + runlist.append(mod)
  117 + break
  118 + except Exception as e:
  119 + msg = "Exception raised while preparing module \"" + tag + "\": " + str(e)
  120 + logger.msgLog(msg,tag,logger.TYPE_ERROR)
  121 + #logger.msgLog(traceback.format_exc(), tag logger.TYPE_ERROR)
  122 + ans = showContinueDialog(d, msg)
  123 + if ans == "abort":
  124 + showFinishDialog(False)
  125 + elif ans == "continue":
  126 + logger.msgLog("Skipping module " + tag, "digger", logger.TYPE_INFO)
  127 + break
108 128  
109 129 sp.call('clear', shell=True)
110 130 for module in runlist:
... ... @@ -116,6 +136,4 @@ if __name__ == "__main__":
116 136 #logger.msgLog(traceback.format_exc(), module.name, logger.TYPE_ERROR)
117 137  
118 138  
119   - showFinishDialog(True)
120   -
121   -
  139 + showFinishDialog(True)
122 140 \ No newline at end of file
... ...
logger/filelogger.py
... ... @@ -5,7 +5,7 @@ class FileLogger(LogSystem):
5 5  
6 6 def __init__(self,filename):
7 7 self.file = filename
8   - f = open(filename,"w+")
  8 + f = open(filename,"a+")
9 9 f.close()
10 10  
11 11 def writeLog(self,message,module,type = None):
... ...
modules/edb.py 0 โ†’ 100644
  1 +import os
  2 +
  3 +import logger
  4 +import tomb
  5 +import winver
  6 +from modules.module import Module
  7 +from mount import mount,umount
  8 +from runcmd import runProcess
  9 +
  10 +
  11 +def getInstance():
  12 + return RegistryModule()
  13 +
  14 +class RegistryModule(Module):
  15 +
  16 + def __init__(self):
  17 + self.name = "edb"
  18 + self.description = "Extracts Windows EDB file"
  19 + self.requiredVars = ["winvol"]
  20 + self.vars = {}
  21 +
  22 + def run(self):
  23 + path = tomb.getPath() + self.name + "/"
  24 + if(not os.path.exists(path)):
  25 + os.mkdir(path)
  26 + logger.msgLog("Extracting Windows EDB from volumes: " + repr(self.vars['winvol'].value), "edb", logger.TYPE_INFO)
  27 + for vol in self.vars['winvol'].value:
  28 + mntpoint = "/mnt/"
  29 + try:
  30 + mntid = mount("/dev/" + vol)
  31 + except:
  32 + raise
  33 + mntpoint += mntid
  34 + files = []
  35 + if winver.getWindowsDirectory(mntpoint) == None:
  36 + raise Exception("No Windows installation present")
  37 + version = winver.getWindowsVersion(mntpoint)
  38 +
  39 + if version < winver._WIN_XP:
  40 + raise Exception("No Windows Search EDB file in versions prior to Windows 2000")
  41 + elif version < winver._WIN_VISTA:
  42 + files += [mntpoint + "/Documents and Settings/All Users/Application Data/Microsoft/Search/Data/Applications/Windows/Windows.edb"]
  43 + else:
  44 + files += [mntpoint + "/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb"]
  45 +
  46 + runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files)
  47 + try:
  48 + umount(mntid)
  49 + except:
  50 + raise
... ...
modules/evt.py
... ... @@ -23,7 +23,7 @@ class RegistryModule(Module):
23 23 path = tomb.getPath() + self.name + "/"
24 24 if(not os.path.exists(path)):
25 25 os.mkdir(path)
26   - logger.msgLog("Extracting Windows Event Logs from volumes: " + repr(self.vars['winvol'].value), "winreg", logger.TYPE_INFO)
  26 + logger.msgLog("Extracting Windows Event Logs from volumes: " + repr(self.vars['winvol'].value), "evt", logger.TYPE_INFO)
27 27 for vol in self.vars['winvol'].value:
28 28 mntpoint = "/mnt/"
29 29 try:
... ...
vars/ntfsvol.py
1 1 from dialog import Dialog
2   -
  2 +import logger
3 3 from runcmd import runProcess
4 4 from vars.modulevar import Modulevar
5 5  
... ... @@ -21,7 +21,7 @@ class NTFSVol(Modulevar):
21 21 volumes = []
22 22 for res in resultlst:
23 23 output,code = runProcess(["ntfslabel","/dev/" + res])
24   - volumes.append((res,output.decode("utf-8")))
  24 + volumes.append((res,output.decode("utf-8").rstrip()))
25 25 return volumes
26 26  
27 27 def query(self):
... ... @@ -30,6 +30,7 @@ class NTFSVol(Modulevar):
30 30 volumes = self.getNTFSVolumes()
31 31 if(len(volumes) == 0):
32 32 raise Exception("[" + self.name + "] No NTFS Volumes found")
  33 + logger.msgLog("Detected NTFS volumes in " + repr(volumes), "ntfsvol", logger.TYPE_INFO)
33 34 volumeList = []
34 35 for vol in volumes:
35 36 volumeList.append((vol[0],vol[1], False))
... ...
vars/winvol.py
... ... @@ -24,7 +24,7 @@ class WinVol(Modulevar):
24 24 volumes = []
25 25 for res in resultlst:
26 26 output,code = runProcess(["ntfslabel","/dev/" + res])
27   - volumes.append((res,output.decode("utf-8")))
  27 + volumes.append((res,output.decode("utf-8").rstrip()))
28 28 return volumes
29 29  
30 30 def getFATVolumes(self):
... ... @@ -33,7 +33,7 @@ class WinVol(Modulevar):
33 33 volumes = []
34 34 for res in resultlst:
35 35 output,code = runProcess(["dosfslabel","/dev/" + res])
36   - volumes.append((res,output.decode("utf-8")))
  36 + volumes.append((res,output.decode("utf-8").rstrip()))
37 37 return volumes
38 38  
39 39 def getWindowsVolumes(self):
... ... @@ -52,9 +52,9 @@ class WinVol(Modulevar):
52 52 d = Dialog(dialog="dialog", autowidgetsize=True)
53 53 d.set_background_title("[" + self.parentModule + "] Setting variable: winvol")
54 54 volumes = self.getWindowsVolumes()
55   - logger.msgLog("Detected Windows volumes in " + repr(volumes),"winvol",logger.TYPE_INFO)
56 55 if(len(volumes) == 0):
57 56 raise Exception("[" + self.name + "] No Windows Volumes found")
  57 + logger.msgLog("Detected Windows volumes in " + repr(volumes), "winvol", logger.TYPE_INFO)
58 58 volumeList = []
59 59 for vol in volumes:
60 60 volumeList.append((vol[0],vol[1], False))
... ...