Ejemplo n.º 1
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [ ("kernel32.dll", "CreateFileW", CreateFileW_handler),
              ("kernel32.dll", "CreateFileA", CreateFileA_handler),
              ("kernel32.dll", "CopyFileA", CopyFileA_handler),
              ("kernel32.dll", "CreateDirectoryA", CreateDirectoryA_handler),
              ("kernel32.dll", "DeleteFileA", DeleteFileA_handler),
              ("kernel32.dll", "fclose", fclose_handler),
              ("kernel32.dll", "fopen", fopen_handler),
              ("kernel32.dll", "fwrite", fwrite_handler),
              ("kernel32.dll", "GetSystemDirectoryA", GetSystemDirectoryA_handler),
              ("kernel32.dll", "GetTempPathA", GetTempPathA_handler),
              ("kernel32.dll", "_hwrite", hwrite_handler),
              ("kernel32.dll", "_lclose", lclose_handler),
              ("kernel32.dll", "_lcreat", lcreat_handler),
              ("kernel32.dll", "_lwrite", lwrite_handler),
              ("kernel32.dll", "MoveFileExW", MoveFileExW_handler),
              ("kernel32.dll", "ReadFile", ReadFile_handler),
              ("kernel32.dll", "WriteFile", WriteFile_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 2
0
def init():
    """Initialize all hooks/handlers defined in this file"""

    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")
    LoadLibrary("msvcrt.dll")

    hooks = [ ("kernel32.dll", "CloseHandle", CloseHandle_handler),
              ("kernel32.dll", "CreateProcessA", CreateProcessA_handler),
              ("kernel32.dll", "CreateProcessW", CreateProcessW_handler),
              ("kernel32.dll", "CreateRemoteThread", CreateRemoteThread_handler),
              ("kernel32.dll", "CreateThread", CreateThread_handler),
              ("kernel32.dll", "ExitProcess", ExitProcess_handler),
              ("kernel32.dll", "ExitThread", ExitThread_handler),
              ("msvcrt.dll", "_execv", execv_handler),
              ("kernel32.dll", "GetTickCount", GetTickCount_handler),
              ("kernel32.dll", "OpenProcess", OpenProcess_handler),
              ("kernel32.dll", "SetUnhandledExceptionFilter",\
                SetUnhandledExceptionFilter_handler),
              ("kernel32.dll", "ShellExecuteA", ShellExecuteA_handler),
              ("kernel32.dll", "ShellExecuteW", ShellExecuteW_handler),
              ("kernel32.dll", "Sleep", Sleep_handler),
              ("kernel32.dll", "TerminateProcess", TerminateProcess_handler),
              ("kernel32.dll", "WaitForSingleObject", \
               WaitForSingleObject_handler),
              ("kernel32.dll", "WinExec", WinExec_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name, func_name, handler):
            logging.error("Failed to register hook for %s" % func_name)

    return
Ejemplo n.º 3
0
def init():
    """Initialize all hooks/handlers defined in this file"""

    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [
        ("kernel32.dll", "CreateFileW", CreateFileW_handler),
        ("kernel32.dll", "CreateFileA", CreateFileA_handler),
        ("kernel32.dll", "CopyFileA", CopyFileA_handler),
        ("kernel32.dll", "CreateDirectoryA", CreateDirectoryA_handler),
        ("kernel32.dll", "DeleteFileA", DeleteFileA_handler),
        ("kernel32.dll", "fclose", fclose_handler),
        ("kernel32.dll", "fopen", fopen_handler),
        ("kernel32.dll", "fwrite", fwrite_handler),
        ("kernel32.dll", "GetSystemDirectoryA", GetSystemDirectoryA_handler),
        ("kernel32.dll", "GetTempPathA", GetTempPathA_handler),
        ("kernel32.dll", "_hwrite", hwrite_handler),
        ("kernel32.dll", "_lclose", lclose_handler),
        ("kernel32.dll", "_lcreat", lcreat_handler),
        ("kernel32.dll", "_lwrite", lwrite_handler),
        ("kernel32.dll", "MoveFileExW", MoveFileExW_handler),
        ("kernel32.dll", "ReadFile", ReadFile_handler),
        ("kernel32.dll", "WriteFile", WriteFile_handler),
    ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name, func_name, handler):
            logging.error("Failed to register hook for %s" % func_name)

    return
Ejemplo n.º 4
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    GetProcAddress = ctypes.windll.kernel32.GetProcAddress
    LoadLibrary("ws2_32.dll")
    LoadLibrary("wininet.dll")
    t = LoadLibrary("urlmon.dll")
    logging.debug("urlmon %x" % GetProcAddress(t, "URLDownloadToFileA"))

    hooks = [ ("ws2_32.dll", "accept", accept_handler),
              ("ws2_32.dll", "bind", bind_handler),
              ("ws2_32.dll", "closesocket", closesocket_handler),
              ("ws2_32.dll", "connect", connect_handler),
              ("wininet.dll", "InternetOpenUrlW", InternetOpenUrlW_handler),
              ("ws2_32.dll", "listen", listen_handler),
              ("ws2_32.dll", "recv", recv_handler),
              ("ws2_32.dll", "recvfrom", recvfrom_handler),
              ("ws2_32.dll", "send", send_handler),
              ("ws2_32.dll", "sendto", sendto_handler),
              ("ws2_32.dll", "socket", socket_handler),
              ("ws2_32.dll", "WSASocketA", WSASocketA_handler),
              ("ws2_32.dll", "WSAStartup", WSAStartup_handler),
              ("urlmon.dll", "URLDownloadToFileA", URLDownloadToFileA_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return     
Ejemplo n.º 5
0
def init():
    """ initializes this module and registers hooks for API functions that
        can lead to the creation of new processes and threads
    """
    logging.info("remote execution tracking active.")
    if not pybox.register_hook("kernel32.dll", "CreateProcessInternalW",
                               cb_create_process_internal_w):
        logging.error("Failed to register hook for CreateProcessInternalW")

    if not pybox.register_hook("kernel32.dll", "CreateRemoteThread",
                               cb_create_r_thread):
        logging.error("Failed to register hook for CreateRemoteThread")

    if not pybox.register_hook("kernel32.dll", "ResumeThread",
                               cb_resume_thread):
        logging.error("Failed to register hook for CreateRemoteThread")

    return
Ejemplo n.º 6
0
def init(): 
    """ initializes this module and registers hooks for API functions that
        can lead to the creation of new processes and threads
    """
    logging.info("remote execution tracking active.")
    if not pybox.register_hook("kernel32.dll",
                     "CreateProcessInternalW",
                     cb_create_process_internal_w):
        logging.error("Failed to register hook for CreateProcessInternalW")
        
    if not pybox.register_hook("kernel32.dll",
                     "CreateRemoteThread",
                     cb_create_r_thread):
        logging.error("Failed to register hook for CreateRemoteThread") 

    if not pybox.register_hook("kernel32.dll",
                     "ResumeThread",
                     cb_resume_thread):
        logging.error("Failed to register hook for CreateRemoteThread") 


    return
def init():
    """Initialize all hooks/handlers defined in this file"""

    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [
        ("kernel32.dll", "CreateMutexW", CreateMutexW_handler),
        ("kernel32.dll", "OpenMutexW", OpenMutexW_handler),
        ("kernel32.dll", "ReleaseMutex", ReleaseMutex_handler),
    ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name, func_name, handler):
            logging.error("Failed to register hook for %s" % func_name)

    return
Ejemplo n.º 8
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("user32.dll")

    hooks = [ ("user32.dll", "FindWindowW", FindWindowW_handler),
              ("kernel32.dll", "GetVersion", GetVersion_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 9
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [ ("kernel32.dll", "CreateMutexW", CreateMutexW_handler),
              ("kernel32.dll", "OpenMutexW", OpenMutexW_handler),
              ("kernel32.dll", "ReleaseMutex", ReleaseMutex_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 10
0
def init():
    """Initialize all hooks/handlers defined in this file"""

    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("advapi32.dll")

    hooks = [
        ("advapi32.dll", "RegCreateKeyW", RegCreateKeyW_handler),
        ("advapi32.dll", "RegDeleteKeyW", RegDeleteKeyW_handler),
        ("advapi32.dll", "RegEnumKeyExW", RegEnumKeyExW_handler),
        ("advapi32.dll", "RegEnumValueW", RegEnumValueW_handler),
        ("advapi32.dll", "RegOpenKeyExW", RegOpenKeyExW_handler),
        ("advapi32.dll", "RegSetValueExW", RegSetValueExW_handler),
        ("advapi32.dll", "RegSetKeyValueW", RegSetKeyValueW_handler),
    ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name, func_name, handler):
            logging.error("Failed to register hook for %s" % func_name)

    return
Ejemplo n.º 11
0
def init():
    """Initialize all hooks/handlers defined in this file"""

    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [ ("kernel32.dll", "LoadLibraryA", LoadLibraryA_handler),
              ("kernel32.dll", "GetProcAddress", GetProcAddress_handler),
              ("kernel32.dll", "malloc", malloc_handler),
              ("kernel32.dll", "memset", memset_handler),
              ("kernel32.dll", "ReadProcessMemory", ReadProcessMemory_handler),
              ("kernel32.dll", "VirtualAllocEx", VirtualAllocEx_handler),
              ("kernel32.dll", "WriteProcessMemory", \
               WriteProcessMemory_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name, func_name, handler):
            logging.error("Failed to register hook for %s" % func_name)

    return
Ejemplo n.º 12
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("advapi32.dll")

    hooks = [ ("advapi32.dll", "OpenSCManagerW", OpenSCManagerW_handler),
              ("advapi32.dll", "CreateServiceA", CreateServiceA_handler),
              ("advapi32.dll", "CreateServiceW", CreateServiceW_handler),
              ("advapi32.dll", "OpenServiceW", OpenServiceW_handler),
              ("advapi32.dll", "StartServiceW", StartServiceW_handler),
              ("advapi32.dll", "ControlService", ControlService_handler),
              ("advapi32.dll", "DeleteService", DeleteService_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 13
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("advapi32.dll")

    hooks = [ ("advapi32.dll", "RegCreateKeyW", RegCreateKeyW_handler),
              ("advapi32.dll", "RegDeleteKeyW", RegDeleteKeyW_handler),
              ("advapi32.dll", "RegEnumKeyExW", RegEnumKeyExW_handler),
              ("advapi32.dll", "RegEnumValueW", RegEnumValueW_handler),
              ("advapi32.dll", "RegOpenKeyExW", RegOpenKeyExW_handler),
              ("advapi32.dll", "RegSetValueExW", RegSetValueExW_handler),
              ("advapi32.dll", "RegSetKeyValueW", RegSetKeyValueW_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 14
0
def init():
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")

    hooks = [ ("kernel32.dll", "LoadLibraryA", LoadLibraryA_handler),
              ("kernel32.dll", "GetProcAddress", GetProcAddress_handler),
              ("kernel32.dll", "malloc", malloc_handler),
              ("kernel32.dll", "memset", memset_handler),
              ("kernel32.dll", "ReadProcessMemory", ReadProcessMemory_handler),
              ("kernel32.dll", "VirtualAllocEx", VirtualAllocEx_handler),
              ("kernel32.dll", "WriteProcessMemory", \
               WriteProcessMemory_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return
Ejemplo n.º 15
0
def init(): 
    """Initialize all hooks/handlers defined in this file"""
    
    # ensure that required libraries are loaded
    LoadLibrary = ctypes.windll.kernel32.LoadLibraryA
    LoadLibrary("kernel32.dll")
    LoadLibrary("msvcrt.dll")

    hooks = [ ("kernel32.dll", "CloseHandle", CloseHandle_handler),
              ("kernel32.dll", "CreateProcessA", CreateProcessA_handler),
              ("kernel32.dll", "CreateProcessW", CreateProcessW_handler),
              ("kernel32.dll", "CreateRemoteThread", CreateRemoteThread_handler),
              ("kernel32.dll", "CreateThread", CreateThread_handler),
              ("kernel32.dll", "ExitProcess", ExitProcess_handler),
              ("kernel32.dll", "ExitThread", ExitThread_handler),
              ("msvcrt.dll", "_execv", execv_handler),
              ("kernel32.dll", "GetTickCount", GetTickCount_handler),
              ("kernel32.dll", "OpenProcess", OpenProcess_handler),
              ("kernel32.dll", "SetUnhandledExceptionFilter",\
                SetUnhandledExceptionFilter_handler),
              ("kernel32.dll", "ShellExecuteA", ShellExecuteA_handler),
              ("kernel32.dll", "ShellExecuteW", ShellExecuteW_handler),
              ("kernel32.dll", "Sleep", Sleep_handler),
              ("kernel32.dll", "TerminateProcess", TerminateProcess_handler),
              ("kernel32.dll", "WaitForSingleObject", \
               WaitForSingleObject_handler),
              ("kernel32.dll", "WinExec", WinExec_handler),
              ]

    for (dll_name, func_name, handler) in hooks:
        if not pybox.register_hook(dll_name,
                                   func_name,
                                   handler):
            logging.error("Failed to register hook for %s" % func_name)
            
    return