コード例 #1
0
ファイル: START_VM.py プロジェクト: elfland/HackTeam-test-av2
def get_status(vm):
    from AVMaster import vm_manager
    # [19/12/13 11:09:23] Seppia: pid=1432, owner=WIN7-NOAV\avtest, cmd=vmtoolsd.exe
    # pid=1776, owner=NT AUTHORITY\SYSTEM, cmd=vmtoolsd.exe
    # pid=712, owner=NT AUTHORITY\SYSTEM, cmd=TrustedInstaller.exe
    # pid=1376, owner=WIN7-NOAV\avtest, cmd=wuauclt.exe
    # pid=1408, owner=WIN7-NOAV\avtest, cmd=wuauclt.exe
    # [19/12/13 11:09:53] Seppia: questa e' una vm che sta facendo aggiornamento, con i vmwaretools partiti (user logged on)

    user_logged = False
    vm_tools = False
    install = False
    try:
        processes = vm_manager.execute(vm, "list_processes")
    except:
        logging.exception("cannot get processes")
        #processes = vm_manager.execute(vm, "listProcesses");
        #logging.debug("listProcesses: %s" % processes)

    if not processes:
        try:
            sleep(60)
            logging.debug("trying listProcesses")
            procs = vm_manager.execute(vm, "listProcesses")
            if config.verbose:
                logging.debug("listProcesses: %s" % procs)
            processes = helper.convert_processes(procs)
        except:
            logging.exception("listProcesses")

    if not processes:
        return "NOT-STARTED"

    try:
        if config.verbose:
            logging.debug("%s, list_processes: %s" %
                          (vm, [(p["name"], p["owner"]) for p in processes]))

        for process in processes:
            if process["owner"].endswith("avtest"):
                user_logged = True
                if process["name"] == "vmtoolsd.exe":
                    # owner=WIN7-NOAV\avtest, cmd=VMwareTray.exe
                    vm_tools = True
            if process["name"] == "wuauclt.exe" or process[
                    "name"] == "TrustedInstaller.exe":
                install = True
        # explorer, vmware solo se logged in
    except:
        logging.exception("error")

    if vm_tools:
        return "LOGGED-IN"
    if install:
        return "INSTALL"
    if not user_logged:
        return "LOGGED-OFF"
    else:
        return "NO-VM-TOOLS"
コード例 #2
0
ファイル: START_VM.py プロジェクト: BwRy/test-av2
def get_status(vm):
    from AVMaster import vm_manager
    # [19/12/13 11:09:23] Seppia: pid=1432, owner=WIN7-NOAV\avtest, cmd=vmtoolsd.exe
    # pid=1776, owner=NT AUTHORITY\SYSTEM, cmd=vmtoolsd.exe
    # pid=712, owner=NT AUTHORITY\SYSTEM, cmd=TrustedInstaller.exe
    # pid=1376, owner=WIN7-NOAV\avtest, cmd=wuauclt.exe
    # pid=1408, owner=WIN7-NOAV\avtest, cmd=wuauclt.exe
    # [19/12/13 11:09:53] Seppia: questa e' una vm che sta facendo aggiornamento, con i vmwaretools partiti (user logged on)

    user_logged = False
    vm_tools = False
    install = False
    try:
        processes = vm_manager.execute(vm, "list_processes");
    except:
        logging.exception("cannot get processes")
        #processes = vm_manager.execute(vm, "listProcesses");
        #logging.debug("listProcesses: %s" % processes)

    if not processes:
        try:
            sleep(60)
            logging.debug("trying listProcesses")
            procs = vm_manager.execute(vm, "listProcesses");
            if config.verbose:
                logging.debug("listProcesses: %s" % procs)
            processes = helper.convert_processes(procs)
        except:
            logging.exception("listProcesses")

    if not processes:
        return "NOT-STARTED"

    try:
        if config.verbose:
            logging.debug("%s, list_processes: %s" % (vm, [ (p["name"],p["owner"]) for p in processes] ))

        for process in processes:
            if process["owner"].endswith("avtest"):
                user_logged = True
                if process["name"] == "vmtoolsd.exe":
                    # owner=WIN7-NOAV\avtest, cmd=VMwareTray.exe
                    vm_tools = True
            if process["name"] == "wuauclt.exe" or process["name"] == "TrustedInstaller.exe":
                install = True
        # explorer, vmware solo se logged in
    except:
        logging.exception("error")

    if vm_tools:
        return "LOGGED-IN"
    if install:
        return "INSTALL"
    if not user_logged:
        return "LOGGED-OFF"
    else:
        return "NO-VM-TOOLS"
コード例 #3
0
ファイル: test_commands.py プロジェクト: BwRy/test-av2
def test_START_VM():
    procs = """Process list: 40
pid=0, owner=, cmd=[System Process]
pid=4, owner=NT AUTHORITY\SYSTEM, cmd=System
pid=264, owner=NT AUTHORITY\SYSTEM, cmd=smss.exe
pid=360, owner=NT AUTHORITY\SYSTEM, cmd=csrss.exe
pid=400, owner=NT AUTHORITY\SYSTEM, cmd=wininit.exe
pid=412, owner=NT AUTHORITY\SYSTEM, cmd=csrss.exe
pid=480, owner=NT AUTHORITY\SYSTEM, cmd=services.exe
pid=488, owner=NT AUTHORITY\SYSTEM, cmd=lsass.exe
pid=500, owner=NT AUTHORITY\SYSTEM, cmd=lsm.exe
pid=508, owner=NT AUTHORITY\SYSTEM, cmd=winlogon.exe
pid=624, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=696, owner=NT AUTHORITY\NETWORK SERVICE, cmd=svchost.exe
pid=748, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=844, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=872, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=896, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=396, owner=NT AUTHORITY\NETWORK SERVICE, cmd=svchost.exe
pid=316, owner=NT AUTHORITY\SYSTEM, cmd=spoolsv.exe
pid=1048, owner=NT AUTHORITY\SYSTEM, cmd=sched.exe
pid=1084, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=1232, owner=NT AUTHORITY\SYSTEM, cmd=avguard.exe
pid=1308, owner=NT AUTHORITY\SYSTEM, cmd=cmd.exe
pid=1316, owner=NT AUTHORITY\SYSTEM, cmd=rubyw.exe
pid=1472, owner=WIN7AVIRA\avtest, cmd=taskhost.exe
pid=1556, owner=WIN7AVIRA\avtest, cmd=Dwm.exe
pid=1564, owner=WIN7AVIRA\avtest, cmd=Explorer.EXE
pid=1732, owner=WIN7AVIRA\avtest, cmd=VMwareTray.exe
pid=1764, owner=WIN7AVIRA\avtest, cmd=vmtoolsd.exe
pid=1856, owner=WIN7AVIRA\avtest, cmd=cmd.exe
pid=1864, owner=WIN7AVIRA\avtest, cmd=conhost.exe
pid=1884, owner=WIN7AVIRA\avtest, cmd=python.exe
pid=1924, owner=NT AUTHORITY\SYSTEM, cmd=cmd.exe
pid=1940, owner=NT AUTHORITY\SYSTEM, cmd=conhost.exe
pid=1972, owner=NT AUTHORITY\SYSTEM, cmd=ruby.exe
pid=2012, owner=NT AUTHORITY\SYSTEM, cmd=vmtoolsd.exe
pid=1352, owner=, cmd=taskhost.exe
pid=1372, owner=WIN7AVIRA\avtest, cmd=Updater.exe
pid=948, owner=WIN7AVIRA\avtest, cmd=avgnt.exe
pid=1936, owner=NT AUTHORITY\NETWORK SERVICE, cmd=WmiPrvSE.exe
pid=2064, owner=, cmd=dllhost.exe"""
    processes = helper.convert_processes(procs)
    assert processes
    for p in processes:
        assert len(p) == 3
        assert "pid" in p.keys()
        assert "owner" in p.keys()
        assert "name" in p.keys()
コード例 #4
0
def test_START_VM():
    procs = """Process list: 40
pid=0, owner=, cmd=[System Process]
pid=4, owner=NT AUTHORITY\SYSTEM, cmd=System
pid=264, owner=NT AUTHORITY\SYSTEM, cmd=smss.exe
pid=360, owner=NT AUTHORITY\SYSTEM, cmd=csrss.exe
pid=400, owner=NT AUTHORITY\SYSTEM, cmd=wininit.exe
pid=412, owner=NT AUTHORITY\SYSTEM, cmd=csrss.exe
pid=480, owner=NT AUTHORITY\SYSTEM, cmd=services.exe
pid=488, owner=NT AUTHORITY\SYSTEM, cmd=lsass.exe
pid=500, owner=NT AUTHORITY\SYSTEM, cmd=lsm.exe
pid=508, owner=NT AUTHORITY\SYSTEM, cmd=winlogon.exe
pid=624, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=696, owner=NT AUTHORITY\NETWORK SERVICE, cmd=svchost.exe
pid=748, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=844, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=872, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=896, owner=NT AUTHORITY\SYSTEM, cmd=svchost.exe
pid=396, owner=NT AUTHORITY\NETWORK SERVICE, cmd=svchost.exe
pid=316, owner=NT AUTHORITY\SYSTEM, cmd=spoolsv.exe
pid=1048, owner=NT AUTHORITY\SYSTEM, cmd=sched.exe
pid=1084, owner=NT AUTHORITY\LOCAL SERVICE, cmd=svchost.exe
pid=1232, owner=NT AUTHORITY\SYSTEM, cmd=avguard.exe
pid=1308, owner=NT AUTHORITY\SYSTEM, cmd=cmd.exe
pid=1316, owner=NT AUTHORITY\SYSTEM, cmd=rubyw.exe
pid=1472, owner=WIN7AVIRA\avtest, cmd=taskhost.exe
pid=1556, owner=WIN7AVIRA\avtest, cmd=Dwm.exe
pid=1564, owner=WIN7AVIRA\avtest, cmd=Explorer.EXE
pid=1732, owner=WIN7AVIRA\avtest, cmd=VMwareTray.exe
pid=1764, owner=WIN7AVIRA\avtest, cmd=vmtoolsd.exe
pid=1856, owner=WIN7AVIRA\avtest, cmd=cmd.exe
pid=1864, owner=WIN7AVIRA\avtest, cmd=conhost.exe
pid=1884, owner=WIN7AVIRA\avtest, cmd=python.exe
pid=1924, owner=NT AUTHORITY\SYSTEM, cmd=cmd.exe
pid=1940, owner=NT AUTHORITY\SYSTEM, cmd=conhost.exe
pid=1972, owner=NT AUTHORITY\SYSTEM, cmd=ruby.exe
pid=2012, owner=NT AUTHORITY\SYSTEM, cmd=vmtoolsd.exe
pid=1352, owner=, cmd=taskhost.exe
pid=1372, owner=WIN7AVIRA\avtest, cmd=Updater.exe
pid=948, owner=WIN7AVIRA\avtest, cmd=avgnt.exe
pid=1936, owner=NT AUTHORITY\NETWORK SERVICE, cmd=WmiPrvSE.exe
pid=2064, owner=, cmd=dllhost.exe"""
    processes = helper.convert_processes(procs)
    assert processes
    for p in processes:
        assert len(p) == 3
        assert "pid" in p.keys()
        assert "owner" in p.keys()
        assert "name" in p.keys()