263 lines
10 KiB
PostScript
263 lines
10 KiB
PostScript
|
@include "PSPHelpers.epm";
|
||
|
|
@include "PerlFunctions.epm";
|
||
|
|
string $strTmp;
|
||
|
|
|
||
|
|
echo "\n\tStarting CA eTrust configuration change check...";
|
||
|
|
@echo off;
|
||
|
|
@record on;
|
||
|
|
#The struct is defined in PSPHelpers.epm
|
||
|
|
metaData @metaData;
|
||
|
|
#initialize the struct
|
||
|
|
init(@metaData);
|
||
|
|
|
||
|
|
# get PSP information to record in pspInformation.txt
|
||
|
|
|
||
|
|
#initially set version to unknown for newer install possibility
|
||
|
|
@metaData.$version="unknown";
|
||
|
|
|
||
|
|
# Security Suite
|
||
|
|
if(`regquery -hive L -subkey "software\\computerassociates\\eTrust Suite Personal" -value version`) {
|
||
|
|
# record suite information
|
||
|
|
@metaData.$vendor="CA";
|
||
|
|
@metaData.$product="Internet Security Suite";
|
||
|
|
@metaData.$version=GetCmdData("value_data");
|
||
|
|
|
||
|
|
# check if PSP changed
|
||
|
|
if(@metaData.$history) {
|
||
|
|
if(checkConfig("etrust:@metaData.$version",@metaData)) {
|
||
|
|
echo "\r\rNo change in PSP configs.\r\r";
|
||
|
|
} else {
|
||
|
|
echo "\r\r!!!!!!!!!!!!!!!!!\rChanged PSP configs since last time\r!!!!!!!!!!!!!!!!!\r\r";
|
||
|
|
}
|
||
|
|
}else{
|
||
|
|
echo "\r\rNo PSP history found.\r\r";
|
||
|
|
createConfig("etrust:@metaData.$version",@metaData);
|
||
|
|
}
|
||
|
|
|
||
|
|
# format the version string
|
||
|
|
$strTmp=split(".",@metaData.$version);
|
||
|
|
if($strTmp[0] == "3") {
|
||
|
|
@metaData.$version="2007 (@metaData.$version)";
|
||
|
|
} else if($strTmp[0] == "4") {
|
||
|
|
@metaData.$version="2008 (@metaData.$version)";
|
||
|
|
} else if($strTmp[0] == "5") {
|
||
|
|
@metaData.$version="2009 (@metaData.$version)";
|
||
|
|
}
|
||
|
|
|
||
|
|
echo "Target is running @metaData.$vendor @metaData.$product @metaData.$version\n";
|
||
|
|
}
|
||
|
|
|
||
|
|
# anti-virus section
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ComputerAssociates\\eTrust Suite Personal\\av" -value version`) {
|
||
|
|
$strTmp = GetCmdData("value_data");
|
||
|
|
echo "Target is running CA eTrust Antivirus $strTmp";
|
||
|
|
|
||
|
|
# check if suite not installed; version still unknown
|
||
|
|
if (@metaData.$version == "unknown") {
|
||
|
|
@metaData.$vendor="CA";
|
||
|
|
@metaData.$product="Antivirus";
|
||
|
|
@metaData.$version=$strTmp;
|
||
|
|
|
||
|
|
if(@metaData.$history) {
|
||
|
|
if(checkConfig("etrust:@metaData.$version",@metaData)) {
|
||
|
|
echo "\r\rNo change in PSP configs.\r\r";
|
||
|
|
} else {
|
||
|
|
echo "\r\r!!!!!!!!!!!!!!!!!\rChanged PSP configs since last time\r!!!!!!!!!!!!!!!!!\r\r";
|
||
|
|
}
|
||
|
|
}else{
|
||
|
|
echo "\r\rNo PSP history found.\r\r";
|
||
|
|
createConfig("etrust:@metaData.$version",@metaData);
|
||
|
|
}
|
||
|
|
} else { @metaData.$information = "@metaData.$information, AntiVirus_$strTmp"; }
|
||
|
|
|
||
|
|
# get latest virus update signature date
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ComputerAssociates\\anti-virus\\install" -value programpath`) {
|
||
|
|
string $strInstallPath=GetCmdData("value_data");
|
||
|
|
`getfileattribs -file "$strInstallPath\\vet.dat"`;
|
||
|
|
$strTmp = GetCmdData("modifiedtime");
|
||
|
|
string $strDate = GetCmdData("modifieddate");
|
||
|
|
echo "\t Last Virus Signature Update: $strDate $strTmp \n";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# anti-spyware section
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ComputerAssociates\\eTrust Suite Personal\\pp" -value version`) {
|
||
|
|
$strTmp = GetCmdData("value_data");
|
||
|
|
echo "Target is running CA eTrust Antispyware $strTmp";
|
||
|
|
echo "\t** Setting noInject true (no PWDUMP) **\n";
|
||
|
|
safety();
|
||
|
|
|
||
|
|
# check if suite not installed; version still unknown
|
||
|
|
if (@metaData.$version == "unknown") {
|
||
|
|
@metaData.$vendor="CA";
|
||
|
|
@metaData.$product="Anti-Spyware";
|
||
|
|
@metaData.$version=$strTmp;
|
||
|
|
|
||
|
|
if(@metaData.$history) {
|
||
|
|
if(checkConfig("etrust:@metaData.$version",@metaData)) {
|
||
|
|
echo "\r\rNo change in PSP configs.\r\r";
|
||
|
|
} else {
|
||
|
|
echo "\r\r!!!!!!!!!!!!!!!!!\rChanged PSP configs since last time\r!!!!!!!!!!!!!!!!!\r\r";
|
||
|
|
}
|
||
|
|
}else{
|
||
|
|
echo "\r\rNo PSP history found.\r\r";
|
||
|
|
createConfig("etrust:@metaData.$version",@metaData);
|
||
|
|
}
|
||
|
|
} else { @metaData.$information = "@metaData.$information, AntiSpyware_$strTmp"; }
|
||
|
|
}
|
||
|
|
|
||
|
|
#firewall section
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ComputerAssociates\\eTrust Suite Personal\\pfw" -value version`) {
|
||
|
|
string $strVersion = GetCmdData("value_data");
|
||
|
|
string $strMajorVersion = split(".",$strVersion);
|
||
|
|
$strMajorVersion = $strMajorVersion[0];
|
||
|
|
echo "Target is running CA eTrust Personal Firewall $strVersion";
|
||
|
|
|
||
|
|
# check if anything else installed; version still unknown
|
||
|
|
if (@metaData.$version == "unknown") {
|
||
|
|
@metaData.$vendor="CA";
|
||
|
|
@metaData.$product="CA Personal Firewall";
|
||
|
|
@metaData.$version=$strTmp;
|
||
|
|
|
||
|
|
if(@metaData.$history) {
|
||
|
|
if(checkConfig("etrust:@metaData.$version",@metaData)) {
|
||
|
|
echo "\r\rNo change in PSP configs.\r\r";
|
||
|
|
} else {
|
||
|
|
echo "\r\r!!!!!!!!!!!!!!!!!\rChanged PSP configs since last time\r!!!!!!!!!!!!!!!!!\r\r";
|
||
|
|
}
|
||
|
|
}else{
|
||
|
|
echo "\r\rNo PSP history found.\r\r";
|
||
|
|
createConfig("etrust:@metaData.$version",@metaData);
|
||
|
|
}
|
||
|
|
} else { @metaData.$information = "@metaData.$information, Firewall_$strTmp"; }
|
||
|
|
|
||
|
|
# for fw version 10 (2008)
|
||
|
|
if ($strMajorVersion == "10") {
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value aplog`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "1") { echo "\tFirewall Logging On (default): Events are logged to fwflog."; }
|
||
|
|
else { echo "\tFirewall Logging Off (not default): Events are NOT logged to fwflog."; }
|
||
|
|
}
|
||
|
|
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value evlog`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "1") { echo "\tApplication Logging On (default): Events are logged to appflog."; }
|
||
|
|
else { echo "\tApplication Logging Off (not default): Events are NOT logged to appflog."; }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# for fw version 11 (2009)
|
||
|
|
if ($strMajorVersion == "11") {
|
||
|
|
# safeguard settings
|
||
|
|
# registry protection
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value sbxrg`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000001") { echo "\tRegistry Protection On (default): \n\tCritical registry entries are protected from modification by unknown programs."; }
|
||
|
|
else { echo "\tRegistry Protection Off (NOT default): \n\tCritical registry entries are NOT protected from modification by unknown programs."; }
|
||
|
|
}
|
||
|
|
|
||
|
|
# program protection
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value sbxspg`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000001") { echo "\tProgram Protection On (NOT default): \n\tPrograms are monitored to prevent them from spawning potentially malicious programs."; }
|
||
|
|
else { echo "\tProgram Protection Off (default): \n\tPrograms are NOT monitored to prevent them from spawning potentially malicious programs."; }
|
||
|
|
}
|
||
|
|
|
||
|
|
# code injection protection
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value sbxsg`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000001") { echo "\tCode Injection Protection On (NOT default): \n\tPrograms are monitored for attempts to inject malicious code."; }
|
||
|
|
else { echo "\tCode Injection Protection Off (default): \n\tPrograms are NOT monitored for attempts to inject malicious code."; }
|
||
|
|
}
|
||
|
|
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value alertoptions`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000001") { echo "\tApplication Alert Option 1 (NOT default): \n\tApplication network access causes user popup."; }
|
||
|
|
else { echo "\tApplication Alert Option 0 (default): \n\tApplication network access does not cause popup."; }
|
||
|
|
}
|
||
|
|
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value checkknownapps`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000000") { echo "\tCheck Known Apps Option 0 (NOT default): \n\tIf application alert option is 1, will always causes popup to user."; }
|
||
|
|
else { echo "\tCheck Known Apps Option 1 (default): \n\tApplication alert level 1 only causes popup to user if not in known apps list."; }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# for fw version 10 and 11 (2009)
|
||
|
|
if ($strMajorVersion == "10" || $strMajorVersion == "11") {
|
||
|
|
# reporting settings
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\hipsengine\\products\\capf" -value alertlevel`) {
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($strTmp == "00000001") { echo "\tFW Alert Level High (NOT default): All firewall alerts pop up to the user. User active? Check fwflog."; }
|
||
|
|
else if($strTmp == "00000008") { echo "\tFW Alert Level Medium (NOT default): Only firewall alerts requiring user attention pop up."; }
|
||
|
|
else { echo "\tFW Alert Level Off (default):NO firewall alerts pop up to the user."; }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# check for and get fwflog
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value fwflog`) {
|
||
|
|
@metaData.$logFile=GetCmdData("value_data");
|
||
|
|
echo "\tfwflog location: \n\t@metaData.$logFile";
|
||
|
|
if(`getfileattribs -file "@metaData.$logFile"`) {
|
||
|
|
$strTmp = GetCmdData("modifiedtime");
|
||
|
|
string $strDate = GetCmdData("modifieddate");
|
||
|
|
int $iSize = GetCmdData("size");
|
||
|
|
echo "\tfwflog modified on $strDate at $strTmp. Size $iSize bytes.";
|
||
|
|
if(prompt "\tIs the log recent? Would you like to get it now?"){
|
||
|
|
`get "@metaData.$logFile"`;
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
echo "\tfwflog empty.";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if(`regquery -hive L -subkey "SOFTWARE\\ca\\capf" -value appflog`) {
|
||
|
|
@metaData.$logFile=GetCmdData("value_data");
|
||
|
|
echo "\tappflog location: \n\t@metaData.$logFile";
|
||
|
|
if(`getfileattribs -file "@metaData.$logFile"`) {
|
||
|
|
$strTmp = GetCmdData("modifiedtime");
|
||
|
|
string $strDate = GetCmdData("modifieddate");
|
||
|
|
int $iSize = GetCmdData("size");
|
||
|
|
echo "\tappflog modified on $strDate at $strTmp. Size $iSize bytes.";
|
||
|
|
if(prompt "\tIs the log recent? Would you like to get it now?"){
|
||
|
|
`get "@metaData.$logFile"`;
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
echo "\tappflog empty.";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (@metaData.$version == "unknown") {
|
||
|
|
echo "!! Unknown Computer Associates application. You are on your own !!";
|
||
|
|
} else {
|
||
|
|
echo "Writing PSP Metadata information to pspInformation.txt";
|
||
|
|
if(writeMetaData(@metaData)){
|
||
|
|
echo "Wrote MetaData to disk";
|
||
|
|
} else {
|
||
|
|
echo "ERROR: could not write meta data to disk, find help.";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
@record off;
|
||
|
|
|
||
|
|
|
||
|
|
# conducts a registry query and returns value or false in $logtext
|
||
|
|
sub go(IN string $regkey, IN string $regvalue, IN string $prod, REF string $logtext){
|
||
|
|
string $strTmp;
|
||
|
|
@record on;
|
||
|
|
if(`regquery -hive L -subkey "$regkey" -value "$regvalue"`){
|
||
|
|
$strTmp=GetCmdData("value_data");
|
||
|
|
if($logtext == "NTR") {$logtext="";}
|
||
|
|
if(StrLen($strTmp)<1){return false;}
|
||
|
|
if(Sizeof($logtext)>1){
|
||
|
|
$logtext="$logtext,$prod\_$strTmp";
|
||
|
|
} else {$logtext="$prod\_$strTmp";}
|
||
|
|
} else {return false;}
|
||
|
|
@record off;
|
||
|
|
}
|
||
|
|
|
||
|
|
# sets noInject (no pwdump) true
|
||
|
|
sub safety() {
|
||
|
|
SetEnv("noInject", "TRUE");
|
||
|
|
}
|