예제 #1
0
    def do_ziplist(self, line):
        try:
            line = str(line)
            import zipfile
            l = line.split(" ")
            if (l[0] == ""):
                self.help_ziplist()
            else:
                id, size = get_id_size(line)
                if in_range(id):
                    response, size = CTCore.get_response_and_size(id, "all")
                    name = CTCore.get_name(id)
                    fp = StringIO.StringIO(response)
                    fp.write(response)
                    zfp = zipfile.ZipFile(fp, "r")
                    self.retval = " " + str(len(zfp.namelist())) + \
                                  " Files found in zip object {} ({}):".format(
                                      str(id),name) + newLine

                    for cnt, fl in enumerate(zfp.namelist()):
                        self.retval += " [Z] " + str(cnt + 1) + " : " + fl
                        cnt += 1
                    self.retval += newLine
        except Exception,e:
            self.retval = "Error unzipping object: " + str(e)
예제 #2
0
    def do_ziplist(self, line):
        try:
            line = str(line)
            import zipfile
            l = line.split(" ")
            if (l[0] == ""):
                self.help_ziplist()
            else:
                id, size = get_id_size(line)
                if in_range(id):
                    response, size = CTCore.get_response_and_size(id, "all")
                    name = CTCore.get_name(id)
                    fp = StringIO.StringIO(response)
                    fp.write(response)
                    zfp = zipfile.ZipFile(fp, "r")
                    self.retval = " " + str(len(zfp.namelist())) + \
                                  " Files found in zip object {} ({}):".format(
                                      str(id),name) + newLine

                    for cnt, fl in enumerate(zfp.namelist()):
                        self.retval += " [Z] " + str(cnt + 1) + " : " + fl
                        cnt += 1
                    self.retval += newLine
        except Exception, e:
            self.retval = "Error unzipping object: " + str(e)
예제 #3
0
    def do_jsbeautify(self,line):
        try:
            import jsbeautifier
            l = line.split(" ")
            if len(l) < 2:
                self.help_jsbeautify()
            else:
                OPTIONS = ['slice','obj']
                option = l[0]

                if option not in OPTIONS:
                    print "Invalid option"
                    return False

                id = l[1]
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                if option == "slice":
                    offset = int(l[2])
                    length = l[3]

                    bytes, length = get_bytes(response,offset,length)
                    js_bytes = bytes
                    res = jsbeautifier.beautify(js_bytes)
                    print res

                if option == "obj":
                    res = jsbeautifier.beautify(response)
                    obj_num = CTCore.add_object("jsbeautify",res,id=id)
                    print " JavaScript Beautify of object {} ({}) successful!".format(str(id), name)
                    print " New object created: {}".format(obj_num) + newLine

        except Exception,e:
            print str(e)
예제 #4
0
    def do_vt(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_vt()
            else:
                id = int(l[0])
                body, sz = get_response_size(id, "all")
                name = CTCore.get_name(id)

                print " VirusTotal result for object {} ({}):".format(
                    str(id), name) + newLine

                import hashlib

                hash = hashlib.md5(
                    StringIO.StringIO(body).getvalue()).hexdigest()
                vtdata = CTCore.send_to_vt(hash, CTCore.APIKEY)
                if vtdata[0] != -1:
                    jsonDict = vtdata[1]
                    if jsonDict.has_key('response_code'):
                        if jsonDict['response_code'] == 1:
                            if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \
                            and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'):
                                print " Detection: {}/{}".format(
                                    jsonDict['positives'], jsonDict['total'])
                                print " Last Analysis Date: {}".format(
                                    jsonDict['scan_date'])
                                print " Report Link: {}".format(
                                    jsonDict['permalink']) + newLine
                                if jsonDict['positives'] > 0:
                                    print " Scan Result:"

                                    for av in jsonDict['scans']:
                                        av_res = jsonDict['scans'][av]
                                        if av_res.has_key(
                                                'detected') and av_res.has_key(
                                                    'version'
                                                ) and av_res.has_key(
                                                    'result'
                                                ) and av_res.has_key('update'):
                                            if av_res['detected']:
                                                print "\t{}\t{}\t{}\t{}".format(
                                                    av, av_res['result'],
                                                    av_res['version'],
                                                    av_res['update'])
                            else:
                                print " Missing elements in Virus Total Response"
                        else:
                            print " File not found in VirusTotal"

                    else:
                        print " Response from VirusTotal isn't valid"
                else:
                    print vtdata[1]
            print ""

        except Exception, e:
            print str(e)
예제 #5
0
    def do_find(self, line):
        try:
            line = str(line)
            l = line.split(" ")
            if len(l) < 2:
                self.help_find()
            else:
                pattern = " ".join(l[1:])
                if l[0].lower() == "all":
                    self.retval = "Searching '{}' in all objects:".format(
                        pattern)
                    for i in range(0, len(CTCore.objects)):
                        response, size = CTCore.get_response_and_size(i, "all")
                        name = CTCore.get_name(i)

                        search_res = find_pattern(response, pattern)
                        if len(search_res) > 0:
                            self.retval += newLine + " {} [{}]:".format(
                                name, str(i))
                            for res in search_res:
                                self.retval += "   " + res
                    self.retval += newLine
                else:
                    id, size = get_id_size(line)
                    response, size = CTCore.get_response_and_size(id, "all")
                    name = CTCore.get_name(id)

                    self.retval = "Searching '{}' in object {} ({}):".format(
                        pattern, id, name)
                    self.retval += newLine

                    search_res = find_pattern(response, pattern)
                    if len(search_res) > 0:
                        for res in search_res:
                            self.retval += res
                    else:
                        self.retval += "     No Results found"
                    self.retval += newLine
        except Exception, e:
            self.retval = str(e)
예제 #6
0
 def do_hexdump(self,line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_hexdump()
         else:
             id, size = get_id_size(line)
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             print "Displaying hexdump of object {} ({}) body [{} bytes]:".format(id, name, size)
             print newLine + hexdump(response) + newLine
     except Exception,e:
         print str(e)
예제 #7
0
 def do_hexdump(self, line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_hexdump()
         else:
             id, size = get_id_size(line)
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             print "Displaying hexdump of object {} ({}) body [{} bytes]:".format(
                 id, name, size)
             print newLine + hexdump(response) + newLine
     except Exception, e:
         print str(e)
예제 #8
0
 def do_body(self, line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_body()
         else:
             id, size = get_id_size(line)
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             print "Displaying body of object {} ({}) [{} bytes]:".format(id, name, size)
             CTCore.show_errors()
             print newLine + response
     except Exception,e:
         print str(e)
예제 #9
0
    def do_head(self,line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_head()
            else:
                id = int(l[0])
                header = get_head(id)
                name = CTCore.get_name(id)

                print "Displaying header of object {} ({}):".format(str(id), name)
                print newLine + header
        except Exception,e:
            print str(e)
예제 #10
0
 def do_req(self, line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_req()
         else:
             id, size = get_id_size(line)
             request, size = CTCore.get_request_size(id, "all")
             name = CTCore.get_name(id)
             print "Displaying request for object {} ({}) [{} bytes]:".format(id, name, size)
             CTCore.show_errors()
             print newLine + request
     except Exception,e:
         print str(e)
예제 #11
0
    def do_find(self,line):
        try:
            l = line.split(" ")
            if len(l) < 2:
                self.help_find()
            else:
                pattern = " ".join(l[1:])
                if l[0].lower() == "all":
                    print "Searching '{}' in all objects:".format(pattern)
                    for i in range(0,len(CTCore.objects)):
                        response, size = CTCore.get_response_and_size(i, "all")
                        name = CTCore.get_name(i)

                        search_res = find_pattern(response, pattern)
                        if len(search_res) > 0:
                            print newLine + " {} [{}]:".format(name,str(i))
                            for res in search_res:
                                print "   " + res
                    print ""
                else:
                    id, size = get_id_size(line)
                    response, size = CTCore.get_response_and_size(id, "all")
                    name = CTCore.get_name(id)


                    print "Searching '{}' in object {} ({}):".format(pattern, id, name)
                    print ""

                    search_res = find_pattern(response, pattern)
                    if len(search_res) > 0:
                        for res in search_res:
                            print res
                    else:
                        print "     No Results found"
                    print ""
        except Exception,e:
            print str(e)
예제 #12
0
    def do_vt(self,line):
        try:
            line = str(line)
            l = line.split(" ")
            if (l[0] == ""):
                self.help_vt()
            else:
                if not CTCore.VT_APIKEY:
                    print newLine + "No Virus Total API key found, please enter your API key:",
                    CTCore.VT_APIKEY = raw_input()

                id = int(l[0])
                body, sz = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                self.retval = " VirusTotal result for object {} ({}):".format(str(id),name) + newLine

                hash = hashlib.md5(StringIO.StringIO(body).getvalue()).hexdigest()
                vtdata = CTCore.send_to_vt(hash, CTCore.VT_APIKEY)
                if vtdata[0] != -1:
                    jsonDict = vtdata[1]
                    if jsonDict.has_key('response_code'):
                        if jsonDict['response_code'] == 1:
                            if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \
                            and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'):
                                self.retval += " Detection: {}/{}".format(jsonDict['positives'], jsonDict['total'])
                                self.retval += " Last Analysis Date: {}".format(jsonDict['scan_date'])
                                self.retval += " Report Link: {}".format(jsonDict['permalink']) + newLine
                                if jsonDict['positives'] > 0:
                                    self.retval += " Scan Result:"

                                    for av in jsonDict['scans']:
                                        av_res = jsonDict['scans'][av]
                                        if av_res.has_key('detected') and av_res.has_key('version') and av_res.has_key('result') and av_res.has_key('update'):
                                            if av_res['detected']:
                                                self.retval += "\t{}\t{}\t{}\t{}".format(av, av_res['result'], av_res['version'], av_res['update'])
                            else:
                                self.retval += " Missing elements in Virus Total Response"
                        else:
                            self.retval += " File not found in VirusTotal"

                    else:
                        self.retval += " Response from VirusTotal isn't valid"
                else:
                    self.retval += vtdata[1]

                self.retval += newLine
        except Exception,e:
            self.retval = str(e)
예제 #13
0
 def do_body(self, line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_body()
         else:
             id, size = get_id_size(line)
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             print "Displaying body of object {} ({}) [{} bytes]:".format(
                 id, name, size)
             CTCore.show_errors()
             print newLine + response
     except Exception, e:
         print str(e)
예제 #14
0
    def do_strings(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_strings()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print "Strings found in object {} ({}) [{} bytes]:".format(id, name, size)
                strings = CTCore.get_strings(response)
                print (newLine.join(str for str in strings))
        except Exception,e:
            print str(e)
예제 #15
0
    def do_head(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_head()
            else:
                id = int(l[0])
                header = get_head(id)
                name = CTCore.get_name(id)

                print "Displaying header of object {} ({}):".format(
                    str(id), name)
                print newLine + header
        except Exception, e:
            print str(e)
예제 #16
0
 def do_req(self, line):
     try:
         l = line.split(" ")
         if (l[0] == ""):
             self.help_req()
         else:
             id, size = get_id_size(line)
             request, size = CTCore.get_request_size(id, "all")
             name = CTCore.get_name(id)
             print "Displaying request for object {} ({}) [{} bytes]:".format(
                 id, name, size)
             CTCore.show_errors()
             print newLine + request
     except Exception, e:
         print str(e)
예제 #17
0
    def do_strings(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_strings()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print "Strings found in object {} ({}) [{} bytes]:".format(
                    id, name, size)
                strings = CTCore.get_strings(response)
                print(newLine.join(str for str in strings))
        except Exception, e:
            print str(e)
예제 #18
0
 def do_hexdump(self, line, xor=None, custsize=None):
     try:
         line = str(line)
         l = line.split(" ")
         if (l[0] == ""):
             self.help_hexdump()
         else:
             id, size = get_id_size(line)
             if custsize:
                 size = custsize
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             self.retval = "Displaying hexdump of object {} ({}) body [{} bytes]:".format(id, name, size)
             self.retval += newLine + hexdump(response) + newLine
     except Exception,e:
         self.retval = str(e)
예제 #19
0
 def do_hexdump(self, line, xor=None, custsize=None):
     try:
         line = str(line)
         l = line.split(" ")
         if (l[0] == ""):
             self.help_hexdump()
         else:
             id, size = get_id_size(line)
             if custsize:
                 size = custsize
             response, size = CTCore.get_response_and_size(id, size)
             name = CTCore.get_name(id)
             self.retval = "Displaying hexdump of object {} ({}) body [{} bytes]:".format(
                 id, name, size)
             self.retval += newLine + hexdump(response) + newLine
     except Exception, e:
         self.retval = str(e)
예제 #20
0
    def do_iframes(self,line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_resp()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                parser = CTCore.CapTipperHTMLParser("iframe")
                print "Searching for iframes in object {} ({})...".format(str(id),name)
                parser.feed(response)
                parser.print_iframes()
                print ""
        except Exception,e:
            print str(e)
예제 #21
0
    def do_vt(self,line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_vt()
            else:
                id = int(l[0])
                body, sz = get_response_size(id, "all")
                name = CTCore.get_name(id)

                print " VirusTotal result for object {} ({}):".format(str(id),name) + newLine

                import hashlib

                hash = hashlib.md5(StringIO.StringIO(body).getvalue()).hexdigest()
                vtdata = CTCore.send_to_vt(hash, CTCore.APIKEY)
                if vtdata[0] != -1:
                    jsonDict = vtdata[1]
                    if jsonDict.has_key('response_code'):
                        if jsonDict['response_code'] == 1:
                            if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \
                            and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'):
                                print " Detection: {}/{}".format(jsonDict['positives'], jsonDict['total'])
                                print " Last Analysis Date: {}".format(jsonDict['scan_date'])
                                print " Report Link: {}".format(jsonDict['permalink']) + newLine
                                if jsonDict['positives'] > 0:
                                    print " Scan Result:"

                                    for av in jsonDict['scans']:
                                        av_res = jsonDict['scans'][av]
                                        if av_res.has_key('detected') and av_res.has_key('version') and av_res.has_key('result') and av_res.has_key('update'):
                                            if av_res['detected']:
                                                print "\t{}\t{}\t{}\t{}".format(av, av_res['result'], av_res['version'], av_res['update'])
                            else:
                                print " Missing elements in Virus Total Response"
                        else:
                            print " File not found in VirusTotal"

                    else:
                        print " Response from VirusTotal isn't valid"
                else:
                    print vtdata[1]
            print ""

        except Exception,e:
            print str(e)
예제 #22
0
    def do_iframes(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_resp()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                parser = CTCore.srcHTMLParser("iframe")
                print "Searching for iframes in object {} ({})...".format(
                    str(id), name)
                parser.feed(response)
                parser.print_objects()
                print ""
        except Exception, e:
            print str(e)
예제 #23
0
    def do_iframes(self,line,tag="iframe"):
        try:
            line = str(line)
            l = line.split(" ")
            if (l[0] == ""):
                self.help_resp()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                parser = CTCore.srcHTMLParser(tag)
                self.retval = "Searching for iframes in object {} ({})...".format(str(id),name)
                parser.feed(response)
                self.retval += "{} found{}".format(len(parser.tags), newLine)
                return parser
        except Exception,e:
            self.retval = str(e)
예제 #24
0
    def do_slice(self,line):
        try:
            l = line.split(" ")
            if len(l) < 3:
                self.help_slice()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)
                offset = int(l[1])
                length = l[2]
                bytes, length = get_bytes(response,offset,length)

                print "Displaying {} of bytes from offset {} in object {} ({}):".format(length, offset, id, name)
                print ""
                print bytes
                print ""
        except Exception,e:
            print str(e)
예제 #25
0
    def do_ungzip(self,line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_ungzip()
            else:
                id = l[0]
                body, sz = get_response_size(id, "all")
                name = CTCore.get_name(id)
                import gzip

                decomp = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(body))
                page = decomp.read()

                obj_num = CTCore.add_object("ungzip",page,id=id)
                print " GZIP Decompression of object {} ({}) successful!".format(str(id), name)
                print " New object created: {}".format(obj_num) + newLine
        except Exception,e:
            print str(e)
예제 #26
0
    def do_iframes(self, line, tag="iframe"):
        try:
            line = str(line)
            l = line.split(" ")
            if (l[0] == ""):
                self.help_resp()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                parser = CTCore.srcHTMLParser(tag)
                self.retval = "Searching for iframes in object {} ({})...".format(
                    str(id), name)
                parser.feed(response)
                self.retval += "{} found{}".format(len(parser.tags), newLine)
                return parser
        except Exception, e:
            self.retval = str(e)
예제 #27
0
    def do_slice(self, line):
        try:
            l = line.split(" ")
            if len(l) < 3:
                self.help_slice()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)
                offset = int(l[1])
                length = l[2]
                bytes, length = get_bytes(response, offset, length)

                print "Displaying {} of bytes from offset {} in object {} ({}):".format(
                    length, offset, id, name)
                print ""
                print bytes
                print ""
        except Exception, e:
            print str(e)
예제 #28
0
    def do_ungzip(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_ungzip()
            else:
                id = l[0]
                body, sz = get_response_size(id, "all")
                name = CTCore.get_name(id)
                import gzip

                decomp = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(body))
                page = decomp.read()

                obj_num = CTCore.add_object("ungzip", page, id=id)
                print " GZIP Decompression of object {} ({}) successful!".format(
                    str(id), name)
                print " New object created: {}".format(obj_num) + newLine
        except Exception, e:
            print str(e)
예제 #29
0
    def do_peinfo(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_peinfo()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print "Displaying PE info of object {} ({}) [{} bytes]:".format(id, name, size)
                if len(l) > 1 and l[1].lower() == "-p":
                    print "Checking for packers..."
                    pescan = PEScanner(response, '', peid_sigs="userdb.txt")
                else:
                    pescan = PEScanner(response, '', '')

                out = pescan.collect()
                print '\n'.join(out)
        except Exception,e:
            print str(e)
예제 #30
0
 def do_ziplist(self, line):
     try:
         import zipfile
         l = line.split(" ")
         if (l[0] == ""):
             self.help_ziplist()
         else:
             id, size = get_id_size(line)
             response, size = get_response_size(id, "all")
             name = CTCore.get_name(id)
             fp = StringIO.StringIO(response)
             fp.write(response)
             zfp = zipfile.ZipFile(fp, "r")
             print " " + str(len(zfp.namelist())) + " Files found in zip object {} ({}):".format(str(id),name) + newLine
             cnt = 1
             for fl in zfp.namelist():
                 print " [Z] " + str(cnt) + " : " + fl
                 cnt += 1
             print ""
     except Exception,e:
         print "Error unzipping object: " + str(e)
예제 #31
0
    def do_hashes(self,line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_hashes()
            else:
                id = int(l[0])
                body, sz = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print " Hashes of object {} ({}):".format(str(id),name) + newLine

                for alg in hashlib.algorithms:
                    hashfunc = getattr(hashlib, alg)
                    hash = hashfunc(StringIO.StringIO(body).getvalue()).hexdigest()
                    print " {0:8}  :   {1}".format(alg, hash)

                print ""

        except Exception,e:
            print str(e)
예제 #32
0
    def do_peinfo(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_peinfo()
            else:
                id, size = get_id_size(line)
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print "Displaying PE info of object {} ({}) [{} bytes]:".format(
                    id, name, size)
                if len(l) > 1 and l[1].lower() == "-p":
                    print "Checking for packers..."
                    pescan = PEScanner(response, '', peid_sigs="userdb.txt")
                else:
                    pescan = PEScanner(response, '', '')

                out = pescan.collect()
                print '\n'.join(out)
        except Exception, e:
            print str(e)
예제 #33
0
    def do_jsbeautify(self, line):
        try:
            line = str(line)
            import jsbeautifier
            l = line.split(" ")
            if len(l) < 2:
                self.help_jsbeautify()
            else:
                OPTIONS = ['slice', 'obj']
                option = l[0]

                if option not in OPTIONS:
                    self.retval = "Invalid option"
                    return False

                id = l[1]
                response, size = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                if option == "slice":
                    offset = int(l[2])
                    length = l[3]

                    bytes, length = get_bytes(response, offset, length)
                    js_bytes = bytes
                    res = jsbeautifier.beautify(js_bytes)
                    self.retval = res

                if option == "obj":
                    res = jsbeautifier.beautify(response)
                    obj_num = CTCore.add_object("jsbeautify", res, id=id)
                    self.retval = " JavaScript Beautify of object {} ({}) successful!".format(
                        str(id), name)
                    self.retval += " New object created: {}".format(
                        obj_num) + newLine

        except Exception, e:
            self.retval = str(e)
예제 #34
0
 def do_ziplist(self, line):
     try:
         import zipfile
         l = line.split(" ")
         if (l[0] == ""):
             self.help_ziplist()
         else:
             id, size = get_id_size(line)
             response, size = get_response_size(id, "all")
             name = CTCore.get_name(id)
             fp = StringIO.StringIO(response)
             fp.write(response)
             zfp = zipfile.ZipFile(fp, "r")
             print " " + str(len(zfp.namelist(
             ))) + " Files found in zip object {} ({}):".format(
                 str(id), name) + newLine
             cnt = 1
             for fl in zfp.namelist():
                 print " [Z] " + str(cnt) + " : " + fl
                 cnt += 1
             print ""
     except Exception, e:
         print "Error unzipping object: " + str(e)
예제 #35
0
    def do_hashes(self, line):
        try:
            l = line.split(" ")
            if (l[0] == ""):
                self.help_hashes()
            else:
                id = int(l[0])
                body, sz = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                print " Hashes of object {} ({}):".format(str(id),
                                                          name) + newLine

                for alg in hashlib.algorithms:
                    hashfunc = getattr(hashlib, alg)
                    hash = hashfunc(
                        StringIO.StringIO(body).getvalue()).hexdigest()
                    print " {0:8}  :   {1}".format(alg, hash)

                print ""

        except Exception, e:
            print str(e)
예제 #36
0
    def do_vt(self, line):
        try:
            line = str(line)
            l = line.split(" ")
            if (l[0] == ""):
                self.help_vt()
            else:
                if not CTCore.VT_APIKEY:
                    print newLine + "No Virus Total API key found, please enter your API key:",
                    CTCore.VT_APIKEY = raw_input()

                id = int(l[0])
                body, sz = CTCore.get_response_and_size(id, "all")
                name = CTCore.get_name(id)

                self.retval = " VirusTotal result for object {} ({}):".format(
                    str(id), name) + newLine

                hash = hashlib.md5(
                    StringIO.StringIO(body).getvalue()).hexdigest()
                vtdata = CTCore.send_to_vt(hash, CTCore.VT_APIKEY)
                if vtdata[0] != -1:
                    jsonDict = vtdata[1]
                    if jsonDict.has_key('response_code'):
                        if jsonDict['response_code'] == 1:
                            if jsonDict.has_key('scans') and jsonDict.has_key('scan_date') \
                            and jsonDict.has_key('total') and jsonDict.has_key('positives') and jsonDict.has_key('permalink'):
                                self.retval += " Detection: {}/{}".format(
                                    jsonDict['positives'], jsonDict['total'])
                                self.retval += " Last Analysis Date: {}".format(
                                    jsonDict['scan_date'])
                                self.retval += " Report Link: {}".format(
                                    jsonDict['permalink']) + newLine
                                if jsonDict['positives'] > 0:
                                    self.retval += " Scan Result:"

                                    for av in jsonDict['scans']:
                                        av_res = jsonDict['scans'][av]
                                        if av_res.has_key(
                                                'detected') and av_res.has_key(
                                                    'version'
                                                ) and av_res.has_key(
                                                    'result'
                                                ) and av_res.has_key('update'):
                                            if av_res['detected']:
                                                self.retval += "\t{}\t{}\t{}\t{}".format(
                                                    av, av_res['result'],
                                                    av_res['version'],
                                                    av_res['update'])
                            else:
                                self.retval += " Missing elements in Virus Total Response"
                        else:
                            self.retval += " File not found in VirusTotal"

                    else:
                        self.retval += " Response from VirusTotal isn't valid"
                else:
                    self.retval += vtdata[1]

                self.retval += newLine
        except Exception, e:
            self.retval = str(e)
예제 #37
0
파일: CTPlugin.py 프로젝트: um-dsp/MalEvol
 def get_name_by_id(self, id):
     name = CTCore.get_name(id)
     return name
예제 #38
0
 def get_name_by_id(self, id):
     name = CTCore.get_name(id)
     return name