Added logging. Added better error handling and displaying. Implemented evt module

Imanol-Mikel Barba Sabariego
1 parent 6320acf4
Showing 14 changed files with 248 additions and 55 deletions
digger.py
logger/consolelogger.py
logger/filelogger.py
logger/logger.py
logger/logsystem.py
modules/evt.py
modules/info.py
modules/mft.py
module.py → modules/module.py
modules/winreg.py
vars/__init__.py
modulevar.py → vars/modulevar.py
vars/ntfsvol.py
vars/winvol.py
 #! /usr/bin/env python3
  
+import sys
+
+sys.path.append('modules')
+sys.path.append('vars')
+sys.path.append('logger')
+
 import locale
 from dialog import Dialog
 import glob
 import os
-import sys
 import subprocess as sp
 import tomb
 import traceback
-
-sys.path.append('modules')
-sys.path.append('vars')
+import logger
+from consolelogger import ConsoleLogger
+from filelogger import FileLogger
  
 def getModules():
     choiceList = []
@@ -37,52 +42,80 @@ def prepareModule(moduleName):
         module.getVars()
         return module
     except Exception as e:
-        raise Exception("[" + moduleName + "] " + str(e))
-
-locale.setlocale(locale.LC_ALL, '')
-d = Dialog(dialog="dialog",autowidgetsize=True)
-d.set_background_title("Gravedigger")
-
-moduleList = getModules()
-code,value = d.inputbox("Input computer's name")
-if code == d.OK:
-    tomb._MACHINE_NAME= value
-    d.set_background_title("Gravedigger - " + value)
-    code, tags = d.checklist("Select modules to execute",
-                         choices=moduleList + [("all","Execute all modules",False)],
-                         title="Module selection")
+        raise
+
+def showFinishDialog(allSuccessful):
+    msg = ""
+    if(allSuccessful):
+        msg = "All modules finished execution"
+    else:
+        msg = "Some or all modules failed execution. Please check the logs."
+
+    code, tag = d.menu(msg, choices=[("Poweroff", "Shutdown the computer"),
+                                     ("Reboot", "Reboot the computer"),
+                                     ("Restart", "Run Gravedigger again")])
+    if (code == d.OK):
+        if tag == "Poweroff":
+            sp.call("poweroff", shell=True)
+        elif tag == "Reboot":
+            sp.call("reboot", shell=True)
+
+    exit(0)
+
+def showContinueDialog(d,msg):
+    ans = d.yesno(msg + "\n\nDo you want to continue execution without the module?")
+    return ans == d.OK
+
+if __name__ == "__main__":
+    locale.setlocale(locale.LC_ALL, '')
+    d = Dialog(dialog="dialog",autowidgetsize=True)
+    d.set_background_title("Gravedigger")
+
+    moduleList = getModules()
+    code,value = d.inputbox("Input computer's name")
     if code == d.OK:
-        runlist = []
-        try:
+        tomb._MACHINE_NAME= value
+        logger.logSystems.append(ConsoleLogger())
+        logger.logSystems.append(FileLogger(tomb.getPath() + "log.txt"))
+        d.set_background_title("Gravedigger - " + value)
+        code, tags = d.checklist("Select modules to execute",
+                             choices=moduleList + [("all","Execute all modules",False)],
+                             title="Module selection")
+        if code == d.OK:
+            runlist = []
             if "all" in tags:
                 for module in moduleList:
-                    runlist.append(prepareModule(module[0]))
+                    try:
+                        mod = prepareModule(module[0])
+                        runlist.append(mod)
+                    except Exception as e:
+                        msg = "Exception raised while preparing module \"" + module[0] + "\": " + str(e)
+                        logger.msgLog(msg, module[0], logger.TYPE_ERROR)
+                        #logger.msgLog(traceback.format_exc(), module[0],  logger.TYPE_ERROR)
+                        if(not showContinueDialog(d,msg)):
+                            showFinishDialog(False)
             else:
                 for tag in tags:
-                    runlist.append(prepareModule(tag))
+                    try:
+                        mod = prepareModule(tag)
+                        runlist.append(mod)
+                    except Exception as e:
+                        msg = "Exception raised while preparing module \"" + tag + "\": " + str(e)
+                        logger.msgLog(msg,tag,logger.TYPE_ERROR)
+                        #logger.msgLog(traceback.format_exc(), tag logger.TYPE_ERROR)
+                        if(not showContinueDialog(d,msg)):
+                            showFinishDialog(False)
  
             sp.call('clear', shell=True)
-
             for module in runlist:
-                print("Running " + module.name + "...")
+                logger.msgLog("Running " + module.name + "...", "digger", logger.TYPE_INFO)
                 try:
                     module.run()
                 except Exception as e:
-                    print("Exception raised while running " + module.name + ": " + str(e))
-                    traceback.print_exc()
+                    logger.msgLog("Exception raised while running \"" + module.name + "\": " + str(e), module.name, logger.TYPE_ERROR)
+                    #logger.msgLog(traceback.format_exc(), module.name, logger.TYPE_ERROR)
  
-            code, tag = d.menu("All modules finished execution",choices=[("Poweroff","Shutdown the computer"),
-                                                                         ("Reboot","Reboot the computer"),
-                                                                         ("Restart","Run Gravedigger again")])
-            if(code == d.OK):
-                if tag == "Poweroff":
-                    sp.call("poweroff",shell=True)
-                elif tag == "Reboot":
-                    sp.call("reboot", shell=True)
  
-
-        except Exception as e:
-            print("Exception raised while preparing module: " + str(e))
-            traceback.print_exc()
+            showFinishDialog(True)
  
  
+import datetime
+from logsystem import LogSystem
+
+BASH_YLW_TEXT = '\033[33m'
+BASH_RED_TEXT = '\033[31m'
+BASH_RESET_TEXT = '\033[0m'
+
+class ConsoleLogger(LogSystem):
+
+	def writeLog(self,message,module,type = None):
+		if(type == None):
+			type = self.TYPE_INFO
+		time = str(datetime.datetime.now())
+
+		if(type == self.TYPE_ERROR):
+			print(time + " [" + module + "] " + BASH_RED_TEXT + "ERROR: " + message + BASH_RESET_TEXT)
+
+		elif(type == self.TYPE_WARNING):
+			print(time + " [" + module + "] " + BASH_YLW_TEXT + "WARNING: " + message + BASH_RESET_TEXT)
+
+		elif(type == self.TYPE_INFO):
+			print(time + " [" + module + "] " + "INFO: " + message)
+
+		else:
+			print(message)
 \ No newline at end of file
+import datetime
+from logsystem import LogSystem
+
+class FileLogger(LogSystem):
+
+    def __init__(self,filename):
+        self.file = filename
+        f = open(filename,"w+")
+        f.close()
+
+    def writeLog(self,message,module,type = None):
+        if(type == None):
+            type = self.TYPE_INFO
+        time = str(datetime.datetime.now())
+
+        if(type == self.TYPE_ERROR):
+            f = open(self.file,"a+")
+            f.write(time + " [" + module + "] " + "ERROR: " + message + "\n")
+            f.close()
+
+        elif(type == self.TYPE_WARNING):
+            f = open(self.file,"a+")
+            f.write(time + " [" + module + "] " + "WARNING: " + message + "\n")
+            f.close()
+
+        elif(type == self.TYPE_INFO):
+            f = open(self.file,"a+")
+            f.write(time + " [" + module + "] " + "INFO: " + message + "\n")
+            f.close()
+
+        else:
+            f = open(self.file,"a+")
+            f.write(message + "\n")
+            f.close()
 \ No newline at end of file
+logSystems = []
+TYPE_INFO = 0
+TYPE_WARNING = 1
+TYPE_ERROR = 2
+
+def msgLog(message,module,type=None):
+    for system in logSystems:
+        system.writeLog(message,module,type)
 \ No newline at end of file
+from abc import ABCMeta, abstractmethod
+
+class LogSystem(object):
+    __metaclass__ = ABCMeta
+
+    TYPE_INFO = 0
+    TYPE_WARNING = 1
+    TYPE_ERROR = 2
+
+    @abstractmethod
+    def writeLog(self,message,module,type):
+        pass
 \ No newline at end of file
+import os
+
+import logger
+import tomb
+import winver
+from modules.module import Module
+from mount import mount,umount
+from runcmd import runProcess
+
+
+def getInstance():
+    return RegistryModule()
+
+class RegistryModule(Module):
+
+    def __init__(self):
+        self.name = "evt"
+        self.description = "Extracts Windows Event Viewer files"
+        self.requiredVars = ["winvol"]
+        self.vars = {}
+
+    def run(self):
+        path = tomb.getPath() + self.name + "/"
+        if(not os.path.exists(path)):
+            os.mkdir(path)
+        logger.msgLog("Extracting Windows Event Logs from volumes: " + repr(self.vars['winvol'].value), "winreg", logger.TYPE_INFO)
+        for vol in self.vars['winvol'].value:
+            mntpoint = "/mnt/"
+            try:
+                mntid = mount("/dev/" + vol)
+            except:
+                raise
+            mntpoint += mntid
+            files = []
+            windir = winver.getWindowsDirectory(mntpoint)
+            if windir == None:
+                raise Exception("No Windows installation present")
+            version = winver.getWindowsVersion(mntpoint)
+
+            if version < winver._WIN_2k:
+                raise Exception("No EVT files in Windows versions prior to Windows 2000")
+            elif version < winver._WIN_VISTA:
+                files += [windir + "/System32/config/*.evt"]
+                files += [windir + "/System32/config/*.Evt"]
+                files += [windir + "/System32/config/*.EVT"]
+            else:
+                    files += [windir + "/System32/winevt/Logs" ]
+
+            runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files)
+            try:
+                umount(mntid)
+            except:
+                raise
-from module import Module
-from runcmd import runProcess
-import tomb
 import os
  
+import tomb
+from modules.module import Module
+from runcmd import runProcess
+
+
 def getInstance():
     return INFOModule()
  
-from module import Module
-from runcmd import runProcess
-import tomb
 import os
  
+import logger
+import tomb
+from modules.module import Module
+from runcmd import runProcess
+
+
 def getInstance():
     return MFTModule()
  
@@ -18,6 +21,7 @@ class MFTModule(Module):
         path = tomb.getPath() + self.name + "/"
         if(not os.path.exists(path)):
             os.mkdir(path)
+            logger.msgLog("Extracting MFT from volumes: " + repr(self.vars['ntfsvol'].value), "mft", logger.TYPE_INFO)
         for vol in self.vars['ntfsvol'].value:
             result,code = runProcess(["icat","/dev/" + vol,"0"])
             mftbin = open(path + vol + ".bin",'wb')
@@ -16,4 +16,7 @@ class Module(object):
         for var in self.requiredVars:
             modvar = __import__(var).getInstance(self.name)
             modvar.query()
-            self.vars[modvar.name] = modvar
 \ No newline at end of file
+            self.vars[modvar.name] = modvar
+
+    def __str__(self):
+        return self.name
 \ No newline at end of file
-from module import Module
-import tomb
 import os
+
+import logger
+import tomb
 import winver
-from runcmd import runProcess
+from modules.module import Module
 from mount import mount,umount
+from runcmd import runProcess
+
  
 def getInstance():
     return RegistryModule()
@@ -20,9 +23,13 @@ class RegistryModule(Module):
         path = tomb.getPath() + self.name + "/"
         if(not os.path.exists(path)):
             os.mkdir(path)
+        logger.msgLog("Extracting Windows registry from volumes: " + repr(self.vars['winvol'].value), "winreg", logger.TYPE_INFO)
         for vol in self.vars['winvol'].value:
             mntpoint = "/mnt/"
-            mntid = mount("/dev/" + vol)
+            try:
+                mntid = mount("/dev/" + vol)
+            except:
+                raise
             mntpoint += mntid
             files = []
             windir = winver.getWindowsDirectory(mntpoint)
@@ -58,4 +65,7 @@ class RegistryModule(Module):
                             files += [profile + "/AppData/Local/Microsoft/Windows/UsrClass.dat"]
  
             runProcess(["tar","-czvf",path + "winreg_" + vol + ".tar.gz"] + files)
-            umount(mntid)
+            try:
+                umount(mntid)
+            except:
+                raise
@@ -13,4 +13,7 @@ class Modulevar(object):
  
     @abstractmethod
     def query(self):
-        pass
 \ No newline at end of file
+        pass
+
+    def __str__(self):
+        return self.name
 \ No newline at end of file
-from modulevar import Modulevar
 from dialog import Dialog
+
 from runcmd import runProcess
+from vars.modulevar import Modulevar
+
  
 def getInstance(modname):
     return NTFSVol(modname)
@@ -27,7 +29,7 @@ class NTFSVol(Modulevar):
         d.set_background_title("[" + self.parentModule + "] Setting variable: ntfsvol")
         volumes = self.getNTFSVolumes()
         if(len(volumes) == 0):
-            raise Exception("[" + self.name + "] No Windows Volumes found")
+            raise Exception("[" + self.name + "] No NTFS Volumes found")
         volumeList = []
         for vol in volumes:
             volumeList.append((vol[0],vol[1], False))
-from modulevar import Modulevar
 from dialog import Dialog
-from runcmd import runProcess
+
+import logger
 import winver
 from mount import mount,umount
+from runcmd import runProcess
+from vars.modulevar import Modulevar
+
  
 def getInstance(modname):
     return WinVol(modname)
@@ -49,6 +52,7 @@ class WinVol(Modulevar):
         d = Dialog(dialog="dialog", autowidgetsize=True)
         d.set_background_title("[" + self.parentModule + "] Setting variable: winvol")
         volumes = self.getWindowsVolumes()
+        logger.msgLog("Detected Windows volumes in " + repr(volumes),"winvol",logger.TYPE_INFO)
         if(len(volumes) == 0):
             raise Exception("[" + self.name + "] No Windows Volumes found")
         volumeList = []