def do_ziplist(self, line): try: line = str(line) import zipfile l = line.split(" ") if (l[0] == ""): self.help_ziplist() else: id, size = get_id_size(line) if in_range(id): response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) fp = StringIO.StringIO(response) fp.write(response) zfp = zipfile.ZipFile(fp, "r") self.retval = " " + str(len(zfp.namelist())) + \ " Files found in zip object {} ({}):".format( str(id),name) + newLine for cnt, fl in enumerate(zfp.namelist()): self.retval += " [Z] " + str(cnt + 1) + " : " + fl cnt += 1 self.retval += newLine except Exception,e: self.retval = "Error unzipping object: " + str(e)
def do_ziplist(self, line): try: line = str(line) import zipfile l = line.split(" ") if (l[0] == ""): self.help_ziplist() else: id, size = get_id_size(line) if in_range(id): response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) fp = StringIO.StringIO(response) fp.write(response) zfp = zipfile.ZipFile(fp, "r") self.retval = " " + str(len(zfp.namelist())) + \ " Files found in zip object {} ({}):".format( str(id),name) + newLine for cnt, fl in enumerate(zfp.namelist()): self.retval += " [Z] " + str(cnt + 1) + " : " + fl cnt += 1 self.retval += newLine except Exception, e: self.retval = "Error unzipping object: " + str(e)
def do_jsbeautify(self,line): try: import jsbeautifier l = line.split(" ") if len(l) < 2: self.help_jsbeautify() else: OPTIONS = ['slice','obj'] option = l[0] if option not in OPTIONS: print "Invalid option" return False id = l[1] response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) if option == "slice": offset = int(l[2]) length = l[3] bytes, length = get_bytes(response,offset,length) js_bytes = bytes res = jsbeautifier.beautify(js_bytes) print res if option == "obj": res = jsbeautifier.beautify(response) obj_num = CTCore.add_object("jsbeautify",res,id=id) print " JavaScript Beautify of object {} ({}) successful!".format(str(id), name) print " New object created: {}".format(obj_num) + newLine except Exception,e: print str(e)
def do_vt(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_vt() else: id = int(l[0]) body, sz = get_response_size(id, "all") name = CTCore.get_name(id) print " VirusTotal result for object {} ({}):".format( str(id), name) + newLine import hashlib hash = hashlib.md5( StringIO.StringIO(body).getvalue()).hexdigest() vtdata = CTCore.send_to_vt(hash, CTCore.APIKEY) if vtdata[0] != -1: jsonDict = vtdata[1] if jsonDict.has_key('response_code'): if jsonDict['response_code'] == 1: if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \ and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'): print " Detection: {}/{}".format( jsonDict['positives'], jsonDict['total']) print " Last Analysis Date: {}".format( jsonDict['scan_date']) print " Report Link: {}".format( jsonDict['permalink']) + newLine if jsonDict['positives'] > 0: print " Scan Result:" for av in jsonDict['scans']: av_res = jsonDict['scans'][av] if av_res.has_key( 'detected') and av_res.has_key( 'version' ) and av_res.has_key( 'result' ) and av_res.has_key('update'): if av_res['detected']: print "\t{}\t{}\t{}\t{}".format( av, av_res['result'], av_res['version'], av_res['update']) else: print " Missing elements in Virus Total Response" else: print " File not found in VirusTotal" else: print " Response from VirusTotal isn't valid" else: print vtdata[1] print "" except Exception, e: print str(e)
def do_find(self, line): try: line = str(line) l = line.split(" ") if len(l) < 2: self.help_find() else: pattern = " ".join(l[1:]) if l[0].lower() == "all": self.retval = "Searching '{}' in all objects:".format( pattern) for i in range(0, len(CTCore.objects)): response, size = CTCore.get_response_and_size(i, "all") name = CTCore.get_name(i) search_res = find_pattern(response, pattern) if len(search_res) > 0: self.retval += newLine + " {} [{}]:".format( name, str(i)) for res in search_res: self.retval += " " + res self.retval += newLine else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) self.retval = "Searching '{}' in object {} ({}):".format( pattern, id, name) self.retval += newLine search_res = find_pattern(response, pattern) if len(search_res) > 0: for res in search_res: self.retval += res else: self.retval += " No Results found" self.retval += newLine except Exception, e: self.retval = str(e)
def do_hexdump(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_hexdump() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) print "Displaying hexdump of object {} ({}) body [{} bytes]:".format(id, name, size) print newLine + hexdump(response) + newLine except Exception,e: print str(e)
def do_hexdump(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_hexdump() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) print "Displaying hexdump of object {} ({}) body [{} bytes]:".format( id, name, size) print newLine + hexdump(response) + newLine except Exception, e: print str(e)
def do_body(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_body() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) print "Displaying body of object {} ({}) [{} bytes]:".format(id, name, size) CTCore.show_errors() print newLine + response except Exception,e: print str(e)
def do_head(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_head() else: id = int(l[0]) header = get_head(id) name = CTCore.get_name(id) print "Displaying header of object {} ({}):".format(str(id), name) print newLine + header except Exception,e: print str(e)
def do_req(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_req() else: id, size = get_id_size(line) request, size = CTCore.get_request_size(id, "all") name = CTCore.get_name(id) print "Displaying request for object {} ({}) [{} bytes]:".format(id, name, size) CTCore.show_errors() print newLine + request except Exception,e: print str(e)
def do_find(self,line): try: l = line.split(" ") if len(l) < 2: self.help_find() else: pattern = " ".join(l[1:]) if l[0].lower() == "all": print "Searching '{}' in all objects:".format(pattern) for i in range(0,len(CTCore.objects)): response, size = CTCore.get_response_and_size(i, "all") name = CTCore.get_name(i) search_res = find_pattern(response, pattern) if len(search_res) > 0: print newLine + " {} [{}]:".format(name,str(i)) for res in search_res: print " " + res print "" else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print "Searching '{}' in object {} ({}):".format(pattern, id, name) print "" search_res = find_pattern(response, pattern) if len(search_res) > 0: for res in search_res: print res else: print " No Results found" print "" except Exception,e: print str(e)
def do_vt(self,line): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_vt() else: if not CTCore.VT_APIKEY: print newLine + "No Virus Total API key found, please enter your API key:", CTCore.VT_APIKEY = raw_input() id = int(l[0]) body, sz = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) self.retval = " VirusTotal result for object {} ({}):".format(str(id),name) + newLine hash = hashlib.md5(StringIO.StringIO(body).getvalue()).hexdigest() vtdata = CTCore.send_to_vt(hash, CTCore.VT_APIKEY) if vtdata[0] != -1: jsonDict = vtdata[1] if jsonDict.has_key('response_code'): if jsonDict['response_code'] == 1: if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \ and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'): self.retval += " Detection: {}/{}".format(jsonDict['positives'], jsonDict['total']) self.retval += " Last Analysis Date: {}".format(jsonDict['scan_date']) self.retval += " Report Link: {}".format(jsonDict['permalink']) + newLine if jsonDict['positives'] > 0: self.retval += " Scan Result:" for av in jsonDict['scans']: av_res = jsonDict['scans'][av] if av_res.has_key('detected') and av_res.has_key('version') and av_res.has_key('result') and av_res.has_key('update'): if av_res['detected']: self.retval += "\t{}\t{}\t{}\t{}".format(av, av_res['result'], av_res['version'], av_res['update']) else: self.retval += " Missing elements in Virus Total Response" else: self.retval += " File not found in VirusTotal" else: self.retval += " Response from VirusTotal isn't valid" else: self.retval += vtdata[1] self.retval += newLine except Exception,e: self.retval = str(e)
def do_body(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_body() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) print "Displaying body of object {} ({}) [{} bytes]:".format( id, name, size) CTCore.show_errors() print newLine + response except Exception, e: print str(e)
def do_strings(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_strings() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print "Strings found in object {} ({}) [{} bytes]:".format(id, name, size) strings = CTCore.get_strings(response) print (newLine.join(str for str in strings)) except Exception,e: print str(e)
def do_head(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_head() else: id = int(l[0]) header = get_head(id) name = CTCore.get_name(id) print "Displaying header of object {} ({}):".format( str(id), name) print newLine + header except Exception, e: print str(e)
def do_req(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_req() else: id, size = get_id_size(line) request, size = CTCore.get_request_size(id, "all") name = CTCore.get_name(id) print "Displaying request for object {} ({}) [{} bytes]:".format( id, name, size) CTCore.show_errors() print newLine + request except Exception, e: print str(e)
def do_strings(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_strings() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print "Strings found in object {} ({}) [{} bytes]:".format( id, name, size) strings = CTCore.get_strings(response) print(newLine.join(str for str in strings)) except Exception, e: print str(e)
def do_hexdump(self, line, xor=None, custsize=None): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_hexdump() else: id, size = get_id_size(line) if custsize: size = custsize response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) self.retval = "Displaying hexdump of object {} ({}) body [{} bytes]:".format(id, name, size) self.retval += newLine + hexdump(response) + newLine except Exception,e: self.retval = str(e)
def do_hexdump(self, line, xor=None, custsize=None): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_hexdump() else: id, size = get_id_size(line) if custsize: size = custsize response, size = CTCore.get_response_and_size(id, size) name = CTCore.get_name(id) self.retval = "Displaying hexdump of object {} ({}) body [{} bytes]:".format( id, name, size) self.retval += newLine + hexdump(response) + newLine except Exception, e: self.retval = str(e)
def do_iframes(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_resp() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) parser = CTCore.CapTipperHTMLParser("iframe") print "Searching for iframes in object {} ({})...".format(str(id),name) parser.feed(response) parser.print_iframes() print "" except Exception,e: print str(e)
def do_vt(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_vt() else: id = int(l[0]) body, sz = get_response_size(id, "all") name = CTCore.get_name(id) print " VirusTotal result for object {} ({}):".format(str(id),name) + newLine import hashlib hash = hashlib.md5(StringIO.StringIO(body).getvalue()).hexdigest() vtdata = CTCore.send_to_vt(hash, CTCore.APIKEY) if vtdata[0] != -1: jsonDict = vtdata[1] if jsonDict.has_key('response_code'): if jsonDict['response_code'] == 1: if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \ and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'): print " Detection: {}/{}".format(jsonDict['positives'], jsonDict['total']) print " Last Analysis Date: {}".format(jsonDict['scan_date']) print " Report Link: {}".format(jsonDict['permalink']) + newLine if jsonDict['positives'] > 0: print " Scan Result:" for av in jsonDict['scans']: av_res = jsonDict['scans'][av] if av_res.has_key('detected') and av_res.has_key('version') and av_res.has_key('result') and av_res.has_key('update'): if av_res['detected']: print "\t{}\t{}\t{}\t{}".format(av, av_res['result'], av_res['version'], av_res['update']) else: print " Missing elements in Virus Total Response" else: print " File not found in VirusTotal" else: print " Response from VirusTotal isn't valid" else: print vtdata[1] print "" except Exception,e: print str(e)
def do_iframes(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_resp() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) parser = CTCore.srcHTMLParser("iframe") print "Searching for iframes in object {} ({})...".format( str(id), name) parser.feed(response) parser.print_objects() print "" except Exception, e: print str(e)
def do_iframes(self,line,tag="iframe"): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_resp() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) parser = CTCore.srcHTMLParser(tag) self.retval = "Searching for iframes in object {} ({})...".format(str(id),name) parser.feed(response) self.retval += "{} found{}".format(len(parser.tags), newLine) return parser except Exception,e: self.retval = str(e)
def do_slice(self,line): try: l = line.split(" ") if len(l) < 3: self.help_slice() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) offset = int(l[1]) length = l[2] bytes, length = get_bytes(response,offset,length) print "Displaying {} of bytes from offset {} in object {} ({}):".format(length, offset, id, name) print "" print bytes print "" except Exception,e: print str(e)
def do_ungzip(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_ungzip() else: id = l[0] body, sz = get_response_size(id, "all") name = CTCore.get_name(id) import gzip decomp = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(body)) page = decomp.read() obj_num = CTCore.add_object("ungzip",page,id=id) print " GZIP Decompression of object {} ({}) successful!".format(str(id), name) print " New object created: {}".format(obj_num) + newLine except Exception,e: print str(e)
def do_iframes(self, line, tag="iframe"): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_resp() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) parser = CTCore.srcHTMLParser(tag) self.retval = "Searching for iframes in object {} ({})...".format( str(id), name) parser.feed(response) self.retval += "{} found{}".format(len(parser.tags), newLine) return parser except Exception, e: self.retval = str(e)
def do_slice(self, line): try: l = line.split(" ") if len(l) < 3: self.help_slice() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) offset = int(l[1]) length = l[2] bytes, length = get_bytes(response, offset, length) print "Displaying {} of bytes from offset {} in object {} ({}):".format( length, offset, id, name) print "" print bytes print "" except Exception, e: print str(e)
def do_ungzip(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_ungzip() else: id = l[0] body, sz = get_response_size(id, "all") name = CTCore.get_name(id) import gzip decomp = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(body)) page = decomp.read() obj_num = CTCore.add_object("ungzip", page, id=id) print " GZIP Decompression of object {} ({}) successful!".format( str(id), name) print " New object created: {}".format(obj_num) + newLine except Exception, e: print str(e)
def do_peinfo(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_peinfo() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print "Displaying PE info of object {} ({}) [{} bytes]:".format(id, name, size) if len(l) > 1 and l[1].lower() == "-p": print "Checking for packers..." pescan = PEScanner(response, '', peid_sigs="userdb.txt") else: pescan = PEScanner(response, '', '') out = pescan.collect() print '\n'.join(out) except Exception,e: print str(e)
def do_ziplist(self, line): try: import zipfile l = line.split(" ") if (l[0] == ""): self.help_ziplist() else: id, size = get_id_size(line) response, size = get_response_size(id, "all") name = CTCore.get_name(id) fp = StringIO.StringIO(response) fp.write(response) zfp = zipfile.ZipFile(fp, "r") print " " + str(len(zfp.namelist())) + " Files found in zip object {} ({}):".format(str(id),name) + newLine cnt = 1 for fl in zfp.namelist(): print " [Z] " + str(cnt) + " : " + fl cnt += 1 print "" except Exception,e: print "Error unzipping object: " + str(e)
def do_hashes(self,line): try: l = line.split(" ") if (l[0] == ""): self.help_hashes() else: id = int(l[0]) body, sz = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print " Hashes of object {} ({}):".format(str(id),name) + newLine for alg in hashlib.algorithms: hashfunc = getattr(hashlib, alg) hash = hashfunc(StringIO.StringIO(body).getvalue()).hexdigest() print " {0:8} : {1}".format(alg, hash) print "" except Exception,e: print str(e)
def do_peinfo(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_peinfo() else: id, size = get_id_size(line) response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print "Displaying PE info of object {} ({}) [{} bytes]:".format( id, name, size) if len(l) > 1 and l[1].lower() == "-p": print "Checking for packers..." pescan = PEScanner(response, '', peid_sigs="userdb.txt") else: pescan = PEScanner(response, '', '') out = pescan.collect() print '\n'.join(out) except Exception, e: print str(e)
def do_jsbeautify(self, line): try: line = str(line) import jsbeautifier l = line.split(" ") if len(l) < 2: self.help_jsbeautify() else: OPTIONS = ['slice', 'obj'] option = l[0] if option not in OPTIONS: self.retval = "Invalid option" return False id = l[1] response, size = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) if option == "slice": offset = int(l[2]) length = l[3] bytes, length = get_bytes(response, offset, length) js_bytes = bytes res = jsbeautifier.beautify(js_bytes) self.retval = res if option == "obj": res = jsbeautifier.beautify(response) obj_num = CTCore.add_object("jsbeautify", res, id=id) self.retval = " JavaScript Beautify of object {} ({}) successful!".format( str(id), name) self.retval += " New object created: {}".format( obj_num) + newLine except Exception, e: self.retval = str(e)
def do_ziplist(self, line): try: import zipfile l = line.split(" ") if (l[0] == ""): self.help_ziplist() else: id, size = get_id_size(line) response, size = get_response_size(id, "all") name = CTCore.get_name(id) fp = StringIO.StringIO(response) fp.write(response) zfp = zipfile.ZipFile(fp, "r") print " " + str(len(zfp.namelist( ))) + " Files found in zip object {} ({}):".format( str(id), name) + newLine cnt = 1 for fl in zfp.namelist(): print " [Z] " + str(cnt) + " : " + fl cnt += 1 print "" except Exception, e: print "Error unzipping object: " + str(e)
def do_hashes(self, line): try: l = line.split(" ") if (l[0] == ""): self.help_hashes() else: id = int(l[0]) body, sz = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) print " Hashes of object {} ({}):".format(str(id), name) + newLine for alg in hashlib.algorithms: hashfunc = getattr(hashlib, alg) hash = hashfunc( StringIO.StringIO(body).getvalue()).hexdigest() print " {0:8} : {1}".format(alg, hash) print "" except Exception, e: print str(e)
def do_vt(self, line): try: line = str(line) l = line.split(" ") if (l[0] == ""): self.help_vt() else: if not CTCore.VT_APIKEY: print newLine + "No Virus Total API key found, please enter your API key:", CTCore.VT_APIKEY = raw_input() id = int(l[0]) body, sz = CTCore.get_response_and_size(id, "all") name = CTCore.get_name(id) self.retval = " VirusTotal result for object {} ({}):".format( str(id), name) + newLine hash = hashlib.md5( StringIO.StringIO(body).getvalue()).hexdigest() vtdata = CTCore.send_to_vt(hash, CTCore.VT_APIKEY) if vtdata[0] != -1: jsonDict = vtdata[1] if jsonDict.has_key('response_code'): if jsonDict['response_code'] == 1: if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \ and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'): self.retval += " Detection: {}/{}".format( jsonDict['positives'], jsonDict['total']) self.retval += " Last Analysis Date: {}".format( jsonDict['scan_date']) self.retval += " Report Link: {}".format( jsonDict['permalink']) + newLine if jsonDict['positives'] > 0: self.retval += " Scan Result:" for av in jsonDict['scans']: av_res = jsonDict['scans'][av] if av_res.has_key( 'detected') and av_res.has_key( 'version' ) and av_res.has_key( 'result' ) and av_res.has_key('update'): if av_res['detected']: self.retval += "\t{}\t{}\t{}\t{}".format( av, av_res['result'], av_res['version'], av_res['update']) else: self.retval += " Missing elements in Virus Total Response" else: self.retval += " File not found in VirusTotal" else: self.retval += " Response from VirusTotal isn't valid" else: self.retval += vtdata[1] self.retval += newLine except Exception, e: self.retval = str(e)
def get_name_by_id(self, id): name = CTCore.get_name(id) return name