def testFindsKeyWithLiteralAndModificationTimeConditions(self): modification_time = rdf_file_finder.FileFinderModificationTimeCondition( min_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch( 1247546054 - 1), max_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch( 1247546054 + 1)) vlm = rdf_file_finder.FileFinderContentsLiteralMatchCondition( bytes_before=10, bytes_after=10, literal="Windows Sidebar\\Sidebar.exe") client_id = self.SetupClient(0) session_id = self.RunFlow(client_id, [self.runkey], [ registry.RegistryFinderCondition( condition_type=registry.RegistryFinderCondition.Type. MODIFICATION_TIME, modification_time=modification_time), registry.RegistryFinderCondition( condition_type=registry.RegistryFinderCondition.Type. VALUE_LITERAL_MATCH, value_literal_match=vlm) ]) results = self.GetResults(session_id) self.assertEqual(len(results), 1) # We expect Sidebar and MctAdmin keys here (see # test_data/client_fixture.py). self.assertEqual( results[0].stat_entry.AFF4Path(client_id), "aff4:/C.1000000000000000/registry/HKEY_USERS/S-1-5-20/" "Software/Microsoft/Windows/CurrentVersion/Run/Sidebar")
def testFindsNothingIfModiciationTimeConditionMatchesNothing(self): modification_time = rdf_file_finder.FileFinderModificationTimeCondition( min_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch(0), max_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch(1)) client_id = self.SetupClient(0) session_id = self.RunFlow(client_id, [self.runkey], [ registry.RegistryFinderCondition( condition_type=registry.RegistryFinderCondition.Type .MODIFICATION_TIME, modification_time=modification_time) ]) self.assertFalse(flow_test_lib.GetFlowResults(client_id, session_id))
def testModificationTimeConditionWithDifferentActions(self): expected_files = ["dpkg.log", "dpkg_false.log"] non_expected_files = ["auth.log"] change_time = rdfvalue.RDFDatetime.FromSecondsSinceEpoch(1444444440) modification_time_condition = rdf_file_finder.FileFinderCondition( condition_type=rdf_file_finder.FileFinderCondition.Type .MODIFICATION_TIME, modification_time=rdf_file_finder.FileFinderModificationTimeCondition( min_last_modified_time=change_time)) for action in self.CONDITION_TESTS_ACTIONS: self.RunFlowAndCheckResults( action=action, conditions=[modification_time_condition], expected_files=expected_files, non_expected_files=non_expected_files)
def testFindsKeysIfModificationTimeConditionMatches(self): modification_time = rdf_file_finder.FileFinderModificationTimeCondition( min_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch( 1247546054 - 1), max_last_modified_time=rdfvalue.RDFDatetime.FromSecondsSinceEpoch( 1247546054 + 1)) client_id = self.SetupClient(0) session_id = self.RunFlow(client_id, [self.runkey], [ registry.RegistryFinderCondition( condition_type=registry.RegistryFinderCondition.Type .MODIFICATION_TIME, modification_time=modification_time) ]) results = flow_test_lib.GetFlowResults(client_id, session_id) self.assertLen(results, 2) # We expect Sidebar and MctAdmin keys here (see # test_data/client_fixture.py). basenames = [os.path.basename(r.stat_entry.pathspec.path) for r in results] self.assertCountEqual(basenames, ["Sidebar", "MctAdmin"])
def testPassesAllConditionsToClientFileFinderWhenAllConditionsSpecified( self): modification_time = rdf_file_finder.FileFinderModificationTimeCondition( min_last_modified_time=rdfvalue.RDFDatetime.Now(), ) access_time = rdf_file_finder.FileFinderAccessTimeCondition( min_last_access_time=rdfvalue.RDFDatetime.Now(), ) inode_change_time = rdf_file_finder.FileFinderInodeChangeTimeCondition( min_last_inode_change_time=rdfvalue.RDFDatetime.Now(), ) size = rdf_file_finder.FileFinderSizeCondition(min_file_size=42, ) ext_flags = rdf_file_finder.FileFinderExtFlagsCondition( linux_bits_set=42, ) contents_regex_match = ( rdf_file_finder.FileFinderContentsRegexMatchCondition( regex=b"foo", )) contents_literal_match = ( rdf_file_finder.FileFinderContentsLiteralMatchCondition( literal=b"bar", )) flow_id = flow_test_lib.StartFlow( file.CollectMultipleFiles, client_id=self.client_id, path_expressions=["/some/path"], modification_time=modification_time, access_time=access_time, inode_change_time=inode_change_time, size=size, ext_flags=ext_flags, contents_regex_match=contents_regex_match, contents_literal_match=contents_literal_match, ) children = data_store.REL_DB.ReadChildFlowObjects( self.client_id, flow_id) self.assertLen(children, 1) child = children[0] self.assertEqual(child.flow_class_name, file_finder.ClientFileFinder.__name__) # We expect 7 condition-attributes to be converted # to 7 FileFinderConditions. self.assertLen(child.args.conditions, 7) def _GetCondition(condition_type): for c in child.args.conditions: if c.condition_type == condition_type: return c.UnionCast() raise RuntimeError( f"Condition of type {condition_type} not found.") self.assertEqual( _GetCondition( rdf_file_finder.FileFinderCondition.Type.MODIFICATION_TIME), modification_time) self.assertEqual( _GetCondition( rdf_file_finder.FileFinderCondition.Type.ACCESS_TIME), access_time) self.assertEqual( _GetCondition( rdf_file_finder.FileFinderCondition.Type.INODE_CHANGE_TIME), inode_change_time) self.assertEqual( _GetCondition(rdf_file_finder.FileFinderCondition.Type.SIZE), size) self.assertEqual( _GetCondition(rdf_file_finder.FileFinderCondition.Type.EXT_FLAGS), ext_flags) self.assertEqual( _GetCondition( rdf_file_finder.FileFinderCondition.Type.CONTENTS_REGEX_MATCH), contents_regex_match) self.assertEqual( _GetCondition(rdf_file_finder.FileFinderCondition.Type. CONTENTS_LITERAL_MATCH), contents_literal_match)