Commit ad274817badab9e188a239cd6936895ca7f9d8ed
1 parent
cf2de849
Implemented edb module. Improved continue dialog on module var fail. Small fixes
Showing
6 changed files
with
99 additions
and
30 deletions
digger.py
... | ... | @@ -60,11 +60,16 @@ def showFinishDialog(allSuccessful): |
60 | 60 | elif tag == "Reboot": |
61 | 61 | sp.call("reboot", shell=True) |
62 | 62 | |
63 | + logger.msgLog("Finished excavation of tomb: " + tomb.getPath(),"digger",logger.TYPE_INFO) | |
63 | 64 | exit(0) |
64 | 65 | |
65 | 66 | def showContinueDialog(d,msg): |
66 | - ans = d.yesno(msg + "\n\nDo you want to continue execution without the module?") | |
67 | - return ans == d.OK | |
67 | + code, tag = d.menu(msg + "\n\nDo you want to retry module configuration or continue execution without the module?", | |
68 | + choices=[("retry", "Retry configuration"), | |
69 | + ("continue", "Continue without module")]) | |
70 | + if code != d.OK: | |
71 | + return "abort" | |
72 | + return tag | |
68 | 73 | |
69 | 74 | if __name__ == "__main__": |
70 | 75 | locale.setlocale(locale.LC_ALL, '') |
... | ... | @@ -77,6 +82,7 @@ if __name__ == "__main__": |
77 | 82 | tomb._MACHINE_NAME= value |
78 | 83 | logger.logSystems.append(ConsoleLogger()) |
79 | 84 | logger.logSystems.append(FileLogger(tomb.getPath() + "log.txt")) |
85 | + logger.msgLog("Beginning excavation of tomb: " + tomb.getPath(),"digger",logger.TYPE_INFO) | |
80 | 86 | d.set_background_title("Gravedigger - " + value) |
81 | 87 | code, tags = d.checklist("Select modules to execute", |
82 | 88 | choices=moduleList + [("all","Execute all modules",False)], |
... | ... | @@ -84,27 +90,41 @@ if __name__ == "__main__": |
84 | 90 | if code == d.OK: |
85 | 91 | runlist = [] |
86 | 92 | if "all" in tags: |
93 | + logger.msgLog("Selected modules: " + repr(moduleList), "digger", logger.TYPE_INFO) | |
87 | 94 | for module in moduleList: |
88 | - try: | |
89 | - mod = prepareModule(module[0]) | |
90 | - runlist.append(mod) | |
91 | - except Exception as e: | |
92 | - msg = "Exception raised while preparing module \"" + module[0] + "\": " + str(e) | |
93 | - logger.msgLog(msg, module[0], logger.TYPE_ERROR) | |
94 | - #logger.msgLog(traceback.format_exc(), module[0], logger.TYPE_ERROR) | |
95 | - if(not showContinueDialog(d,msg)): | |
96 | - showFinishDialog(False) | |
95 | + while True: | |
96 | + try: | |
97 | + mod = prepareModule(module[0]) | |
98 | + runlist.append(mod) | |
99 | + break | |
100 | + except Exception as e: | |
101 | + msg = "Exception raised while preparing module \"" + module[0] + "\": " + str(e) | |
102 | + logger.msgLog(msg, module[0], logger.TYPE_ERROR) | |
103 | + #logger.msgLog(traceback.format_exc(), module[0], logger.TYPE_ERROR) | |
104 | + ans = showContinueDialog(d,msg) | |
105 | + if ans == "abort": | |
106 | + showFinishDialog(False) | |
107 | + elif ans == "continue": | |
108 | + logger.msgLog("Skipping module " + module, "digger", logger.TYPE_INFO) | |
109 | + break | |
97 | 110 | else: |
111 | + logger.msgLog("Selected modules: " + repr(tags), "digger", logger.TYPE_INFO) | |
98 | 112 | for tag in tags: |
99 | - try: | |
100 | - mod = prepareModule(tag) | |
101 | - runlist.append(mod) | |
102 | - except Exception as e: | |
103 | - msg = "Exception raised while preparing module \"" + tag + "\": " + str(e) | |
104 | - logger.msgLog(msg,tag,logger.TYPE_ERROR) | |
105 | - #logger.msgLog(traceback.format_exc(), tag logger.TYPE_ERROR) | |
106 | - if(not showContinueDialog(d,msg)): | |
107 | - showFinishDialog(False) | |
113 | + while True: | |
114 | + try: | |
115 | + mod = prepareModule(tag) | |
116 | + runlist.append(mod) | |
117 | + break | |
118 | + except Exception as e: | |
119 | + msg = "Exception raised while preparing module \"" + tag + "\": " + str(e) | |
120 | + logger.msgLog(msg,tag,logger.TYPE_ERROR) | |
121 | + #logger.msgLog(traceback.format_exc(), tag logger.TYPE_ERROR) | |
122 | + ans = showContinueDialog(d, msg) | |
123 | + if ans == "abort": | |
124 | + showFinishDialog(False) | |
125 | + elif ans == "continue": | |
126 | + logger.msgLog("Skipping module " + tag, "digger", logger.TYPE_INFO) | |
127 | + break | |
108 | 128 | |
109 | 129 | sp.call('clear', shell=True) |
110 | 130 | for module in runlist: |
... | ... | @@ -116,6 +136,4 @@ if __name__ == "__main__": |
116 | 136 | #logger.msgLog(traceback.format_exc(), module.name, logger.TYPE_ERROR) |
117 | 137 | |
118 | 138 | |
119 | - showFinishDialog(True) | |
120 | - | |
121 | - | |
139 | + showFinishDialog(True) | |
122 | 140 | \ No newline at end of file | ... | ... |
logger/filelogger.py
modules/edb.py
0 โ 100644
1 | +import os | |
2 | + | |
3 | +import logger | |
4 | +import tomb | |
5 | +import winver | |
6 | +from modules.module import Module | |
7 | +from mount import mount,umount | |
8 | +from runcmd import runProcess | |
9 | + | |
10 | + | |
11 | +def getInstance(): | |
12 | + return RegistryModule() | |
13 | + | |
14 | +class RegistryModule(Module): | |
15 | + | |
16 | + def __init__(self): | |
17 | + self.name = "edb" | |
18 | + self.description = "Extracts Windows EDB file" | |
19 | + self.requiredVars = ["winvol"] | |
20 | + self.vars = {} | |
21 | + | |
22 | + def run(self): | |
23 | + path = tomb.getPath() + self.name + "/" | |
24 | + if(not os.path.exists(path)): | |
25 | + os.mkdir(path) | |
26 | + logger.msgLog("Extracting Windows EDB from volumes: " + repr(self.vars['winvol'].value), "edb", logger.TYPE_INFO) | |
27 | + for vol in self.vars['winvol'].value: | |
28 | + mntpoint = "/mnt/" | |
29 | + try: | |
30 | + mntid = mount("/dev/" + vol) | |
31 | + except: | |
32 | + raise | |
33 | + mntpoint += mntid | |
34 | + files = [] | |
35 | + if winver.getWindowsDirectory(mntpoint) == None: | |
36 | + raise Exception("No Windows installation present") | |
37 | + version = winver.getWindowsVersion(mntpoint) | |
38 | + | |
39 | + if version < winver._WIN_XP: | |
40 | + raise Exception("No Windows Search EDB file in versions prior to Windows 2000") | |
41 | + elif version < winver._WIN_VISTA: | |
42 | + files += [mntpoint + "/Documents and Settings/All Users/Application Data/Microsoft/Search/Data/Applications/Windows/Windows.edb"] | |
43 | + else: | |
44 | + files += [mntpoint + "/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb"] | |
45 | + | |
46 | + runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files) | |
47 | + try: | |
48 | + umount(mntid) | |
49 | + except: | |
50 | + raise | ... | ... |
modules/evt.py
... | ... | @@ -23,7 +23,7 @@ class RegistryModule(Module): |
23 | 23 | path = tomb.getPath() + self.name + "/" |
24 | 24 | if(not os.path.exists(path)): |
25 | 25 | os.mkdir(path) |
26 | - logger.msgLog("Extracting Windows Event Logs from volumes: " + repr(self.vars['winvol'].value), "winreg", logger.TYPE_INFO) | |
26 | + logger.msgLog("Extracting Windows Event Logs from volumes: " + repr(self.vars['winvol'].value), "evt", logger.TYPE_INFO) | |
27 | 27 | for vol in self.vars['winvol'].value: |
28 | 28 | mntpoint = "/mnt/" |
29 | 29 | try: | ... | ... |
vars/ntfsvol.py
1 | 1 | from dialog import Dialog |
2 | - | |
2 | +import logger | |
3 | 3 | from runcmd import runProcess |
4 | 4 | from vars.modulevar import Modulevar |
5 | 5 | |
... | ... | @@ -21,7 +21,7 @@ class NTFSVol(Modulevar): |
21 | 21 | volumes = [] |
22 | 22 | for res in resultlst: |
23 | 23 | output,code = runProcess(["ntfslabel","/dev/" + res]) |
24 | - volumes.append((res,output.decode("utf-8"))) | |
24 | + volumes.append((res,output.decode("utf-8").rstrip())) | |
25 | 25 | return volumes |
26 | 26 | |
27 | 27 | def query(self): |
... | ... | @@ -30,6 +30,7 @@ class NTFSVol(Modulevar): |
30 | 30 | volumes = self.getNTFSVolumes() |
31 | 31 | if(len(volumes) == 0): |
32 | 32 | raise Exception("[" + self.name + "] No NTFS Volumes found") |
33 | + logger.msgLog("Detected NTFS volumes in " + repr(volumes), "ntfsvol", logger.TYPE_INFO) | |
33 | 34 | volumeList = [] |
34 | 35 | for vol in volumes: |
35 | 36 | volumeList.append((vol[0],vol[1], False)) | ... | ... |
vars/winvol.py
... | ... | @@ -24,7 +24,7 @@ class WinVol(Modulevar): |
24 | 24 | volumes = [] |
25 | 25 | for res in resultlst: |
26 | 26 | output,code = runProcess(["ntfslabel","/dev/" + res]) |
27 | - volumes.append((res,output.decode("utf-8"))) | |
27 | + volumes.append((res,output.decode("utf-8").rstrip())) | |
28 | 28 | return volumes |
29 | 29 | |
30 | 30 | def getFATVolumes(self): |
... | ... | @@ -33,7 +33,7 @@ class WinVol(Modulevar): |
33 | 33 | volumes = [] |
34 | 34 | for res in resultlst: |
35 | 35 | output,code = runProcess(["dosfslabel","/dev/" + res]) |
36 | - volumes.append((res,output.decode("utf-8"))) | |
36 | + volumes.append((res,output.decode("utf-8").rstrip())) | |
37 | 37 | return volumes |
38 | 38 | |
39 | 39 | def getWindowsVolumes(self): |
... | ... | @@ -52,9 +52,9 @@ class WinVol(Modulevar): |
52 | 52 | d = Dialog(dialog="dialog", autowidgetsize=True) |
53 | 53 | d.set_background_title("[" + self.parentModule + "] Setting variable: winvol") |
54 | 54 | volumes = self.getWindowsVolumes() |
55 | - logger.msgLog("Detected Windows volumes in " + repr(volumes),"winvol",logger.TYPE_INFO) | |
56 | 55 | if(len(volumes) == 0): |
57 | 56 | raise Exception("[" + self.name + "] No Windows Volumes found") |
57 | + logger.msgLog("Detected Windows volumes in " + repr(volumes), "winvol", logger.TYPE_INFO) | |
58 | 58 | volumeList = [] |
59 | 59 | for vol in volumes: |
60 | 60 | volumeList.append((vol[0],vol[1], False)) | ... | ... |