Пример #1
0
def test(filename):
    with open(filename) as f:
        t = f.read()

    print hex_dump(t)

    l = SHITEMLIST(t, 0, False)
    for index, item in enumerate(l.items()):
        print "item:", index
        print "type:", item.__class__.__name__
        print "name:", item.name()
Пример #2
0
def test(filename):
    with open(filename) as f:
        t = f.read()

    print hex_dump(t)

    l = SHITEMLIST(t, 0, False)
    for index, item in enumerate(l.items()):
        print "item:", index
        print "type:", item.__class__.__name__
        print "name:", item.name()
        print "mtime:", item.m_date()
Пример #3
0
def test(filename):
    r = Registry.Registry(filename)
    k = r.open("Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\1\\0\\0")
    v = k.value("0")

    print hex_dump(v.value())

    l = SHITEMLIST(v.value(), 0, False)
    for index, item in enumerate(l.items()):
        print "item:", index
        print "type:", item.__class__.__name__
        print "name:", item.name()

        # its a SHITEM_FILEENTRY
        print "short name:", item.short_name()
        print "off long name:", item._off_long_name
        print "off long name size:", item._off_long_name_size
        print "long name size:", hex(item.long_name_size())
Пример #4
0
def test(filename):
    r = Registry.Registry(filename)
    k = r.open("Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\1\\0\\0")
    v = k.value("0")

    print hex_dump(v.value())

    l = SHITEMLIST(v.value(), 0, False)
    for index, item in enumerate(l.items()):
        print "item:", index
        print "type:", item.__class__.__name__
        print "name:", item.name()

        # its a SHITEM_FILEENTRY
        print "short name:", item.short_name()
        print "off long name:", item._off_long_name
        print "off long name size:", item._off_long_name_size
        print "long name size:", hex(item.long_name_size())
        print "mtime:", item.m_date()
Пример #5
0
    def shellbag_rec(key, bag_prefix, path_prefix):
        """
        Function to recursively parse the BagMRU Registry key structure.
        Arguments:
        `key`: The current 'BagsMRU' key to recurse into.
        `bag_prefix`: A string containing the current subkey path of
            the relevant 'Bags' key. It will look something like '1\\2\\3\\4'.
        `path_prefix` A string containing the current human-readable,
            file system path so far constructed.
        Throws:
        """
        debug("Considering BagMRU key %s" % (key.path()))
        debug_increase_indent()
        try:
            # First, consider the current key, and extract shellbag items
            slot = key.value("NodeSlot").value()
            for bag in bags_key.subkey(str(slot)).subkeys():
                for value in [value for value in bag.values() if
                              "ItemPos" in value.name()]:
                    buf = value.value()
                    debug("Slot %s ITEMPOS @ %s" % (str(slot), value.name()))

                    block = Block(buf, 0x0, False)
                    offset = 0x10

                    while True:
                        offset += 0x8
                        size = block.unpack_word(offset)
                        if size == 0:
                            break
                        elif size < 0x15:
                            pass
                        else:
                            item = ITEMPOS_FILEENTRY(buf, offset, False)
                            debug("Name: " + item.name())
                            shellbags.append({
                                "path": path_prefix + "\\" + item.name(),
                                "mtime": item.m_date(),
                                "atime": item.a_date(),
                                "crtime": item.cr_date(),
                                "source":  bag.path() + " @ " + hex(item.offset()),
                                "regsource": bag.path() + "\\" + value.name(),
                                "klwt": key.timestamp()
                            })
                        offset += size
        except Registry.RegistryValueNotFoundException:
            debug("Registry.RegistryValueNotFoundException")
            pass
        except Registry.RegistryKeyNotFoundException:
            debug("Registry.RegistryKeyNotFoundException")
            pass
        except:
            debug("Unexpected error %s" % sys.exc_info()[0])

        # Next, recurse into each BagMRU key
        for value in [value for value in key.values()
                      if re.match("\d+", value.name())]:
            debug("BagMRU value %s (%s)" % (value.name(),
                                            key.path()))
            try:  # TODO(wb): removeme
                l = SHITEMLIST(value.value(), 0, False)
                for item in l.items():
                    # assume there is only one entry in the value, or take the last
                    # as the path component
                    debug("Name: " + item.name())
                    path = path_prefix + "\\" + item.name()
                    shellbags.append({
                        "path":  path,
                        "mtime": item.m_date(),
                        "atime": item.a_date(),
                        "crtime": item.cr_date(),
                        "source": key.path() + " @ " + hex(item.offset()),
                        "regsource": key.path() + "\\" + value.name(),
                        "klwt":  key.timestamp()
                    })
            except OverrunBufferException:
                print key.path()
                print value.name()
                raise


            shellbag_rec(key.subkey(value.name()),
                         bag_prefix + "\\" + value.name(),
                         path)
        debug_decrease_indent()
Пример #6
0
    def shellbag_rec(key, bag_prefix, path_prefix):
        """
        Function to recursively parse the BagMRU Registry key structure.
        Arguments:
        `key`: The current 'BagsMRU' key to recurse into.
        `bag_prefix`: A string containing the current subkey path of
            the relevant 'Bags' key. It will look something like '1\\2\\3\\4'.
        `path_prefix` A string containing the current human-readable,
            file system path so far constructed.
        Throws:
        """
        try:
            # First, consider the current key, and extract shellbag items
            slot = key.value("NodeSlot").value()
            for bag in bags_key.subkey(str(slot)).subkeys():
                for value in [
                        value for value in bag.values()
                        if "ItemPos" in value.name()
                ]:
                    buf = value.value()

                    block = SHITEMLIST(buf, 0x0, False)
                    offset = 0x10

                    while True:
                        offset += 0x8
                        size = block.unpack_word(offset)
                        if size == 0:
                            break
                        elif size < 0x15:
                            pass
                        else:
                            item = block.get_item(offset)
                            shellbags.append({
                                "path":
                                path.encode("ascii", "replace"),
                                "mtime":
                                str(item.m_date()),
                                "atime":
                                str(item.a_date()),
                                "crtime":
                                str(item.cr_date()),
                                "key_path":
                                (key.path() + "\\" + value.name()).encode(
                                    "ascii", "replace"),
                                "@timestamp":
                                str(key.timestamp())
                            })
                        offset += size
        except Registry.RegistryValueNotFoundException:
            g_logger.warning("Registry.RegistryValueNotFoundException")
            pass
        except Registry.RegistryKeyNotFoundException:
            g_logger.warning("Registry.RegistryKeyNotFoundException")
            pass
        except:
            g_logger.warning("Unexpected error %s" % sys.exc_info()[0])

        # Next, recurse into each BagMRU key
        for value in [
                value for value in key.values()
                if re.match("\d+", value.name())
        ]:
            path = ""
            try:  # TODO(wb): removeme
                l = SHITEMLIST(value.value(), 0, False)
                for item in l.items():
                    # assume there is only one entry in the value, or take the last
                    # as the path component
                    path = path_prefix + "\\" + item.name()
                    shellbags.append({
                        "path":
                        path.encode("ascii", "replace"),
                        "mtime":
                        str(item.m_date()),
                        "atime":
                        str(item.a_date()),
                        "crtime":
                        str(item.cr_date()),
                        "key_path": (key.path() + "\\" + value.name()).encode(
                            "ascii", "replace"),
                        "@timestamp":
                        str(key.timestamp())
                    })
            except OverrunBufferException:
                print key.path()
                print value.name()
                raise

            shellbag_rec(key.subkey(value.name()),
                         bag_prefix + "\\" + value.name(), path)
Пример #7
0
    def shellbag_rec(hive, key, bag_prefix, path_prefix):
        try:
            # First, consider the current key, and extract shellbag items
            result, valueNames, valueTypes = objRegistry.EnumValues(
                hDefKey=hive, sSubKeyName=key)
            if result == 0:
                if valueTypes == None or len(valueTypes) == 0:
                    pass
                else:
                    for x in range(0, len(valueNames)):
                        if valueNames[x] == "NodeSlot" and valueTypes[
                                x] == _winreg.REG_DWORD:
                            result, slot = objRegistry.GetDWORDValue(
                                hDefKey=hive,
                                sSubKeyName=key,
                                sValueName=valueNames[x])
                            slot = str(slot)
                            if result == 0:
                                result, subkeys = objRegistry.EnumKey(
                                    hDefKey=hive,
                                    sSubKeyName=bags_key + "\\" + slot)
                                if result == 0:
                                    for bag in subkeys:
                                        result, valueNames2, valueTypes2 = objRegistry.EnumValues(
                                            hDefKey=hive,
                                            sSubKeyName=bags_key + "\\" +
                                            slot + "\\" + bag)
                                        if result == 0:
                                            if valueTypes2 == None or len(
                                                    valueTypes2) == 0:
                                                pass
                                            else:
                                                for x in range(
                                                        0, len(valueNames2)):
                                                    if "ItemPos" in valueNames2[
                                                            x] and valueTypes2[
                                                                x] == _winreg.REG_BINARY:
                                                        result, itemPos = objRegistry.GetBinaryValue(
                                                            hDefKey=hive,
                                                            sSubKeyName=bags_key
                                                            + "\\" + slot +
                                                            "\\" + bag,
                                                            sValueName=
                                                            valueNames2[x])
                                                        if result == 0:
                                                            cachebin = ""
                                                            for decimal in itemPos:
                                                                cachebin += chr(
                                                                    decimal)
                                                            buf = cachebin
                                                            block = Block(
                                                                buf, 0x0,
                                                                False)
                                                            offset = 0x10

                                                            while True:
                                                                offset += 0x8
                                                                size = block.unpack_word(
                                                                    offset)
                                                                if size == 0:
                                                                    break
                                                                elif size < 0x15:
                                                                    pass
                                                                else:
                                                                    item = ITEMPOS_FILEENTRY(
                                                                        buf,
                                                                        offset,
                                                                        False)
                                                                    shellbags.append({
                                                                        "path":
                                                                        path_prefix
                                                                        +
                                                                        "\\" +
                                                                        item.
                                                                        name(),
                                                                        "mtime":
                                                                        item.
                                                                        m_date(
                                                                        ),
                                                                        "atime":
                                                                        item.
                                                                        a_date(
                                                                        ),
                                                                        "crtime":
                                                                        item.
                                                                        cr_date(
                                                                        )
                                                                    })
                                                                offset += size
        except Exception as ex:
            print ex

        # Next, recurse into each BagMRU key
        result, valueNames, valueTypes = objRegistry.EnumValues(
            hDefKey=hive, sSubKeyName=key)
        if result == 0:
            if valueTypes == None or len(valueTypes) == 0:
                pass
            else:
                for x in range(0, len(valueNames)):
                    if re.match("\d+", valueNames[x]
                                ) and valueTypes[x] == _winreg.REG_BINARY:
                        result, reg_value = objRegistry.GetBinaryValue(
                            hDefKey=hive,
                            sSubKeyName=key,
                            sValueName=valueNames[x])
                        if result == 0:
                            cachebin = ""
                            for decimal in reg_value:
                                cachebin += chr(decimal)
                            buf = cachebin
                            try:
                                l = SHITEMLIST(buf, 0, False)
                                for item in l.items():
                                    # assume there is only one entry in the value, or take the last
                                    # as the path component
                                    path = path_prefix + "\\" + item.name()
                                    shellbags.append({
                                        "path": path,
                                        "mtime": item.m_date(),
                                        "atime": item.a_date(),
                                        "crtime": item.cr_date()
                                    })
                            except OverrunBufferException as ex:
                                raise
                            shellbag_rec(hive, key + "\\" + valueNames[x],
                                         bag_prefix + "\\" + valueNames[x],
                                         path)
Пример #8
0
	def shellbag_rec(hive,key,bag_prefix,path_prefix):
		try:
			# First, consider the current key, and extract shellbag items
			result,valueNames,valueTypes = objRegistry.EnumValues(hDefKey=hive,sSubKeyName=key)
			if result == 0:
				if valueTypes == None or len(valueTypes) == 0:
					pass
				else:
					for x in range(0,len(valueNames)):
						if valueNames[x] == "NodeSlot" and valueTypes[x] == _winreg.REG_DWORD:
							result,slot = objRegistry.GetDWORDValue(hDefKey=hive,sSubKeyName=key,sValueName=valueNames[x])
							slot = str(slot)
							if result == 0:
								result,subkeys = objRegistry.EnumKey(hDefKey=hive,sSubKeyName=bags_key+"\\"+slot)
								if result == 0:
									for bag in subkeys:
										result,valueNames2,valueTypes2 = objRegistry.EnumValues(hDefKey=hive,sSubKeyName=bags_key+"\\"+slot+"\\"+bag)
										if result == 0:
											if valueTypes2 == None or len(valueTypes2) == 0:
												pass
											else:
												for x in range(0,len(valueNames2)):
													if "ItemPos" in valueNames2[x] and valueTypes2[x] == _winreg.REG_BINARY:
														result,itemPos = objRegistry.GetBinaryValue(hDefKey=hive,sSubKeyName=bags_key+"\\"+slot+"\\"+bag,sValueName=valueNames2[x])
														if result == 0:
															cachebin = ""
															for decimal in itemPos:
																cachebin += chr(decimal)
															buf = cachebin
															block = Block(buf, 0x0, False)
															offset = 0x10

															while True:
																offset += 0x8
																size = block.unpack_word(offset)
																if size == 0:
																	break
																elif size < 0x15:
																	pass
																else:
																	item = ITEMPOS_FILEENTRY(buf, offset, False)
																	shellbags.append({
																		"path": path_prefix + "\\" + item.name(),
																		"mtime": item.m_date(),
																		"atime": item.a_date(),
																		"crtime": item.cr_date()
																	})
																offset += size
		except Exception as ex:
			print ex

		# Next, recurse into each BagMRU key
		result,valueNames,valueTypes = objRegistry.EnumValues(hDefKey=hive,sSubKeyName=key)
		if result == 0:
			if valueTypes == None or len(valueTypes) == 0:
				pass
			else:
				for x in range(0,len(valueNames)):
					if re.match("\d+", valueNames[x]) and valueTypes[x] == _winreg.REG_BINARY:
						result,reg_value = objRegistry.GetBinaryValue(hDefKey=hive,sSubKeyName=key,sValueName=valueNames[x])
						if result == 0:
							cachebin = ""
							for decimal in reg_value:
								cachebin += chr(decimal)
							buf = cachebin
							try:
								l = SHITEMLIST(buf, 0, False)
								for item in l.items():
									# assume there is only one entry in the value, or take the last
									# as the path component
									path = path_prefix + "\\" + item.name()
									shellbags.append({
										"path": path,
										"mtime": item.m_date(),
										"atime": item.a_date(),
										"crtime": item.cr_date()
									})
							except OverrunBufferException as ex:
								raise
							shellbag_rec(hive, key+"\\"+valueNames[x],bag_prefix + "\\" + valueNames[x],path)
Пример #9
0
def parse_shellbags(bagmru_key, bags_key, key, bag_pre, path_pre):
    try:
        slot = key.value("NodeSlot").value()
        for bag in bags_key.subkey(str(slot)).subkeys():
            for val in [
                    val for val in bag.values() if "ItemPos" in val.name()
            ]:
                buf = val.value()

                blk = SHITEMLIST(buf, 0, False)
                offset = 0x10

                while True:
                    offset += 0x8
                    size = block.unpack_word(offset)
                    if size == 0:
                        break
                    elif size < 0x15:
                        pass
                    else:
                        item = blk.get_item(offset)
                        shellbag_list.append({
                            "path":
                            path_pre + "\\" + item.name(),
                            "mtime":
                            cvtDate(item.m_date()),
                            "atime":
                            cvtDate(item.a_date()),
                            "crtime":
                            cvtDate(item.cr_date()),
                            "source":
                            bag.path() + " @ " + hex(item.offset()),
                            "regsource":
                            bag.path() + "\\" + val.name(),
                            "klwt":
                            cvtDate(key.timestamp())
                        })
                    offset += size
    except Registry.RegistryValueNotFoundException:
        pass
    except Registry.RegistryKeyNotFoundException:
        print "[-] no key"
        pass
    except:
        print "[-] error"

    for val in [val for val in key.values() if re.match("\d+", val.name())]:
        path = ""
        try:
            lst = SHITEMLIST(val.value(), 0, False)
            for item in lst.items():
                path = path_pre + "\\" + item.name()
                shellbag_list.append({
                    "path":
                    path,
                    "mtime":
                    cvtDate(item.m_date()),
                    "atime":
                    cvtDate(item.a_date()),
                    "crtime":
                    cvtDate(item.cr_date()),
                    "source":
                    key.path() + " @ " + hex(item.offset()),
                    "klwt":
                    cvtDate(key.timestamp())
                })
        except OverrunBufferException:
            print key.path()
            print val.name()
            raise

        parse_shellbags(bagmru_key, bags_key, key.subkey(val.name()),
                        bag_pre + "\\" + val.name(), path)