shadowbrokers-exploits/windows/Resources/Ep/Scripts/eventSummary.eps
2017-04-14 11:45:07 +02:00

629 lines
No EOL
18 KiB
PostScript

#--------------------------------------------------------
# File: eventRecord.eps
# Note: Will miss leap years
#
# Queryeventlogs displays time based on local time
# Queryeventrecord displays time based on GMT calculation without DST
#--------------------------------------------------------
int $DEFAULT_TIME_PERIOD = -10;
int $INCREMENT_SIZE = 50;
int $INCREMENT_NUMBER = 2;
int $MAX_LOG_ENTRIES = 100;
@echo off;
@case-sensitive off;
string $temp;
string $commandLineOption;
string $exploitDateTime;
string $newExploitDate;
bool $useNewExploitDate = false;
int $counter = 0;
#--------------------------------------------------------
# Parse the command line options
#--------------------------------------------------------
while (defined($argv[$counter])) {
$temp = split("-", $argv[$counter]);
$counter += 1;
if (defined($temp[1])) {
$commandLineOption = $temp[1];
if (($commandLineOption == "h") || ($commandLineOption == "help") || ($commandLineOption == "?")) {
echo "\nUsage: script eventsummary.eps _Options_";
echo " Display all the system/application/security events that have happened";
echo " since you connected to the box.";
echo "\nOptions:";
echo " [-start <MM/DD/YYYY HH24:MI:SS>]";
echo " Use this date as the new connect date/time";
echo " [-offset <minutes>]";
echo " This this offset when calculating connect time. Default = -10";
echo " [-cutoff <#>]";
echo " Don't display if more then # records. Default = 100";
return true;
} else {
if (defined($argv[$counter])) {
if ($commandLineOption == "start") {
$exploitDateTime = $argv[$counter];
$useNewExploitDate = true;
} else if ($commandLineOption == "offset") {
$DEFAULT_TIME_PERIOD = <int>$argv[$counter];
} else if ($commandLineOption == "cutoff") {
$MAX_LOG_ENTRIES = <int>$argv[$counter];
}
$counter++;
} else {
echo "OPTION $temp[1] requires data (-h for help)";
return true;
}
}
}
}
if ($useNewExploitDate == false) {
#--------------------------------------------------------
# Get the local date/time that the target was exploited
#--------------------------------------------------------
@record on;
if (`lpgetenv -option exploitdate`) {
$exploitDateTime = GetCmdData("value");
} else {
$exploitDateTime = GetInput("Enter target exploit date (MM/DD/YYYY HH24:MI:SS)");
}
@record off;
}
#--------------------------------------------------------
# Get the GMT date/time that the target was exploited
#--------------------------------------------------------
@record on;
`remotelocaltime`;
@record off;
int $GMTBias = GetCmdData("remoteBias");
string $exploitGMTDateTime = $exploitDateTime;
DateAdd($exploitGMTDateTime, "mi", $GMTBias);
#--------------------------------------------------------
# Query the event logs since DEFAULT_TIME_PERIOD minutes before the connect
# date/time (in GMT) just incase some of our probing was logged
#--------------------------------------------------------
string $queryDate = $exploitGMTDateTime;
DateAdd($queryDate, "mi", $DEFAULT_TIME_PERIOD);
echo "";
echo "Connected to target at $exploitDateTime (using $DEFAULT_TIME_PERIOD minute buffer)";
echo "";
echo "Log time: $exploitGMTDateTime GMT (no DST)";
#--------------------------------------------------------
# Print out a summary of the queryeventlogs command
#--------------------------------------------------------
int $maxSize = strLen("Application");
string $spacing;
int $i;
@record on;
`log queryeventlogs`;
@record off;
string $logName = GetCmdData("qeLogName");
string $lastModDateTime = GetCmdData("qeLastMod");
string $tempModDateTime;
string $tempDateTime;
int $oldestRecord = GetCmdData("qeOldest");
int $newestRecord = GetCmdData("qeNewest");
int $recordCount = GetCmdData("qeRecordCount");
int $dateCompareResult;
bool $eventLogFlag;
echo "\n Log Name Last Update Date/Time StartID - EndID";
echo "----------- --------------------- ---------------";
$counter = 0;
while ($counter < sizeof($logName)) {
$i = strLen($logName[$counter]);
$spacing = "";
while ($i < $maxSize) {
$spacing = "$spacing ";
$i++;
}
$tempDateTime = $lastModDateTime[$counter];
DateAdd($tempDateTime, "mi", $GMTBias);
DateCompare($tempDateTime, $queryDate, $dateCompareResult);
if ($dateCompareResult >= 1) {
echo "$logName[$counter] $spacing$tempDateTime (GMT) $oldestRecord[$counter] - $newestRecord[$counter] ** NEW **";
$eventLogFlag[$counter] = true;
} else {
echo "$logName[$counter] $spacing$tempDateTime (GMT) $oldestRecord[$counter] - $newestRecord[$counter]";
$eventLogFlag[$counter] = false;
}
$counter++;
}
#--------------------------------------------------------
# Loop through the event logs and display records that
# are newer than connect date
#--------------------------------------------------------
int $record_number;
string $event_type;
string $time_stamp;
int $event_id;
string $computer;
string $user;
string $source;
int $string_rec_num;
string $strings;
int $data_rec_num;
string $data;
int $newStartID;
int $sampleSize;
string $eventIDText;
string $finalString;
string $tempDate;
int $j;
int $multiplierCheck;
int $counter2;
$counter = 0;
while ($counter < sizeof($logName)) {
if ($eventLogFlag[$counter]) {
# Determine how far back in the event log you have to look
$newStartID = $newestRecord[$counter];
$dateCompareResult = 99;
$j = 0;
$counter2 = 1;
while (($newestRecord[$counter] > $INCREMENT_SIZE) && ($dateCompareResult > 0)) {
$newStartID -= $INCREMENT_SIZE;
$j += $INCREMENT_SIZE;
#Scale the $INCREMENT_SIZE incase there are tons of records
$multiplierCheck = $counter2;
$multiplierCheck %= $INCREMENT_NUMBER;
if ($multiplierCheck == 0) {
$INCREMENT_SIZE *= 2;
}
if ($newStartID >= $oldestRecord[$counter]) {
@record on;
`queryeventrecord -log $logName[$counter] -recnum $newStartID`;
@record off;
$time_stamp = GetCmdData("time_stamp");
DateCompare($time_stamp, $queryDate, $dateCompareResult);
$counter2++;
} else {
$dateCompareResult = 0;
$newStartID = $oldestRecord[$counter];
}
}
if ($j == 0) {
$newStartID = 1;
}
# Ensure the script isn't going to kill/slow EP
if ($j > $MAX_LOG_ENTRIES) {
$sampleSize = $newestRecord[$counter];
$sampleSize -= $newStartID;
if (prompt "\n$sampleSize new records in the $logName[$counter] event log...query them all?") {
`log queryeventrecord -log $logName[$counter] -start $newStartID -end $newestRecord[$counter]`;
echo "\nSee log file for details...";
}
} else {
@echo off;
@record on;
if ($newStartID == $newestRecord[$counter]) {
`log queryeventrecord -log $logName[$counter] -recnum $newestRecord[$counter]`;
} else {
`log queryeventrecord -log $logName[$counter] -start $newStartID -end $newestRecord[$counter]`;
}
@record off;
$record_number = GetCmdData("record_number");
$event_type = GetCmdData("event_type");
$time_stamp = GetCmdData("time_stamp");
$event_id = GetCmdData("event_id");
$computer = GetCmdData("computer");
$user = GetCmdData("user");
$source = GetCmdData("source");
$string_rec_num = GetCmdData("string_rec_num");
$strings = GetCmdData("strings");
$data_rec_num = GetCmdData("data_rec_num");
$data = GetCmdData("data");
$i=0;
while ($i < sizeof($record_number)) {
if ($i == 0) {
if ($logName[$counter] == "System") {
echo "\n SYSTEM LOG";
$maxSize = strLen("Information");
} else if ($logName[$counter] == "Application") {
echo "\n APPLICATION LOG";
} else if ($logName[$counter] == "Security") {
echo "\n SECURITY LOG";
}
echo "ID Date/Time Event Type EventID Source";
echo "--- ------------- ---------- ------- ------";
}
DateCompare($time_stamp[$i], $queryDate, $dateCompareResult);
if ($dateCompareResult >= 1) {
$j = strLen($event_type[$i]);
$spacing = "";
while ($j < $maxSize) {
$spacing = "$spacing ";
$j++;
}
echo "$record_number[$i] $time_stamp[$i] $event_type[$i] $spacing$event_id[$i] $source[$i]";
if ($logName[$counter] == "System") {
if ($event_id[$i] == 6005) {
echo " EVENT ID 6005: Logged at Boot Time noting event service was started";
} else if ($event_id[$i] == 6006) {
echo " EVENT ID 6006: Clean Shutdown";
} else if ($event_id[$i] == 6008) {
echo " ** EVENT ID 6008: !! Dirty Shutdown !!";
} else if ($event_id[$i] == 6009) {
echo " EVENT ID 6009: Logged during every boot and indicates the OS Version";
}
}
# Print out the strings associated with the event entry if they exist
$finalString = "";
int $j=0;
while ($j < sizeof($string_rec_num)) {
if ($string_rec_num[$j] == $record_number[$i]) {
if (strlen($finalString) == 0) {
$finalString = $strings[$j];
} else if (($strings[$j] != "(NULL)") && ($strings[$j] != "-")) {
$finalString = "$finalString / $strings[$j]";
}
}
$j++;
}
if (strLen($finalString) > 0) {
echo " STRINGS: $finalString";
}
# Print out the data associated with the event entry if they exist
$finalString = "";
$j=0;
while ($j < sizeof($data_rec_num)) {
if ($data_rec_num[$j] == $record_number[$i]) {
if (strlen($finalString) == 0) {
$finalString = $strings[$j];
} else {
$finalString = "$finalString / $data[$j]";
}
}
$j++;
}
if (strLen($finalString) > 0) {
echo " DATA: $finalString\n";
}
echo "";
}
$i++;
}
}
if ($counter < 2) {
pause;
}
} else {
echo "\n **** There are no new entries in the $logName[$counter] log *****";
}
$counter++;
}
# Free up all the arrays
undef($logName);
undef($lastModDateTime);
undef($oldestRecord);
undef($newestRecord);
undef($recordCount);
undef($record_number);
undef($event_type);
undef($time_stamp);
undef($event_id);
undef($computer);
undef($user);
undef($source);
return true;
#--------------------------------------------------------
# Converts a string date to and integer date
# 0 1 2 3 4 5
# MM, DD, YYYY, HH24, MI, SS
#--------------------------------------------------------
Sub DateStringToInteger(IN string $stringDate, REF int $intDate) {
string $splitDateTime;
string $tempDate;
string $tempTime;
$splitDateTime = split(" ", $stringDate);
$tempDate = split("/", $splitDateTime[0]);
$tempTime = split(":", $splitDateTime[1]);
$intDate[0] = <int>$tempDate[0];
$intDate[1] = <int>$tempDate[1];
$intDate[2] = <int>$tempDate[2];
$intDate[3] = <int>$tempTime[0];
$intDate[4] = <int>$tempTime[1];
$intDate[5] = <int>$tempTime[2];
}
#--------------------------------------------------------
# Ensure that the various pieces of the date field all have the necessary 0's (integer date-type to string date-type)
# 0 1 2 3 4 5
# MM, DD, YYYY, HH24, MI, SS
#--------------------------------------------------------
Sub DateIntegerToString(REF string $stringDate, IN int $intDate) {
string $finalDateTime;
if ($intDate[0] < 10) {
$finalDateTime[0] = "0$intDate[0]";
} else {
$finalDateTime[0] = <string>$intDate[0];
}
if ($intDate[1] < 10) {
$finalDateTime[1] = "0$intDate[1]";
} else {
$finalDateTime[1] = <string>$intDate[1];
}
$finalDateTime[2] = <string>$intDate[2];
if ($intDate[3] < 10) {
$finalDateTime[3] = "0$intDate[3]";
} else {
$finalDateTime[3] = <string>$intDate[3];
}
if ($intDate[4] < 10) {
$finalDateTime[4] = "0$intDate[4]";
} else {
$finalDateTime[4] = <string>$intDate[4];
}
if ($intDate[5] < 10) {
$finalDateTime[5] = "0$intDate[5]";
} else {
$finalDateTime[5] = <string>$intDate[5];
}
$stringDate = "$finalDateTime[0]/$finalDateTime[1]/$finalDateTime[2] $finalDateTime[3]:$finalDateTime[4]:$finalDateTime[5]";
}
#--------------------------------------------------------
# Compare 2 dates:
# 0 = date1 < date2
# 1 = date1 > date2
# 2 = date1 = date2
#--------------------------------------------------------
Sub DateCompare(IN string $date1, IN string $date2, REF int $result) {
string $splitDateTime1;
String $splitDateTime2;
string $tempDate1;
string $tempDate2;
string $tempTime1;
string $tempTime2;
string $finalDateTime1;
string $finalDateTime2;
$splitDateTime1 = split(" ", $date1);
$splitDateTime2 = split(" ", $date2);
$tempDate1 = split("/", $splitDateTime1[0]);
$tempDate2 = split("/", $splitDateTime2[0]);
$tempTime1 = split(":", $splitDateTime1[1]);
$tempTime2 = split(":", $splitDateTime2[1]);
$finalDateTime1 = "$tempDate1[2]$tempDate1[0]$tempDate1[1]$tempTime1[0]$tempTime1[1]$tempTime1[2]";
$finalDateTime2 = "$tempDate2[2]$tempDate2[0]$tempDate2[1]$tempTime2[0]$tempTime2[1]$tempTime2[2]";
if ($finalDateTime1 < $finalDateTime2) {
$result = 0;
} else if ($finalDateTime1 > $finalDateTime2) {
$result = 1;
} else {
$result = 2;
}
}
#--------------------------------------------------------
# Add offset to date1
# offsetType: hh24, mi
#--------------------------------------------------------
Sub DateAddDST(REF string $date, IN int $startDay, IN int $startMonth, IN int $endDay, IN int $endMonth, IN int $bias, REF bool $result) {
string $DSTStartDateTime;
string $DSTEndDateTime;
int $tempGMTDateTime;
int $tempDate;
int $result1;
int $result2;
DateStringToInteger($date, $tempGMTDateTime);
$tempDate[0] = $startMonth;
$tempDate[1] = $startDay;
$tempDate[2] = $tempGMTDateTime[2];
$tempDate[3] = 0;
$tempDate[4] = 0;
$tempDate[5] = 0;
DateIntegerToString($DSTStartDateTime, $tempDate);
$tempDate[0] = $endMonth;
$tempDate[1] = $endDay;
$tempDate[3] = 23;
$tempDate[4] = 59;
$tempDate[5] = 59;
DateIntegerToString($DSTEndDateTime, $tempDate);
DateCompare($date, $DSTStartDateTime, $result1);
DateCompare($date, $DSTEndDateTime, $result2);
if (($result1 > 0) && ($result2 == 0)) {
$result = true;
DateAdd($date, "mi", $bias);
} else {
$result = false;
}
}
#--------------------------------------------------------
# Add offset to date1
# offsetType: hh24, mi
#--------------------------------------------------------
Sub DateAdd(REF string $date, IN string $offsetType, IN int $offset) {
string $splitDateTime;
string $tempDate;
string $tempTime;
int $convertDateTime;
int $minuteHolder;
int $hourHolder;
int $dayHolder;
int $monthHolder;
int $daysInMonth;
int $yearHolder;
bool $negativeFlag = false;
string $finalDateTime;
if ($offset < 0) {
$negativeFlag = true;
}
$splitDateTime = split(" ", $date);
$tempDate = split("/", $splitDateTime[0]);
$tempTime = split(":", $splitDateTime[1]);
$convertDateTime[0] = <int>$tempDate[0];
$convertDateTime[1] = <int>$tempDate[1];
$convertDateTime[2] = <int>$tempDate[2];
$convertDateTime[3] = <int>$tempTime[0];
$convertDateTime[4] = <int>$tempTime[1];
$convertDateTime[5] = <int>$tempTime[2];
if ($offsetType == "mi") {
$convertDateTime[4] += $offset;
} else if ($offsetType == "hh") {
$convertDateTime[3] += $offset;
} else if ($offsetType == "dd") {
$convertDateTime[1] += $offset;
} else if ($offsetType == "mm") {
$convertDateTime[0] += $offset;
} else if ($offsetType == "yy") {
$convertDateTime[2] += $offset;
}
# Minutes
$minuteHolder = $convertDateTime[4];
while (($minuteHolder < 0) || ($minuteHolder >= 60)) {
if ($negativeFlag) {
$minuteHolder += 60;
$convertDateTime[3]--;
} else {
$minuteHolder -= 60;
$convertDateTime[3]++;
}
}
$convertDateTime[4] = $minuteHolder;
# Hours
$hourHolder = $convertDateTime[3];
while (($hourHolder < 0) || ($hourHolder >= 24)) {
if ($negativeFlag) {
$hourHolder += 24;
$convertDateTime[1]--;
} else {
$hourHolder -= 24;
$convertDateTime[1]++;
}
}
$convertDateTime[3] = $hourHolder;
# Days
if (($convertDateTime[0] == 1) || ($convertDateTime[0] == 3) || ($convertDateTime[0] == 5) ||
($convertDateTime[0] == 7) || ($convertDateTime[0] == 8) || ($convertDateTime[0] == 10) ||
($convertDateTime[0] == 12)) {
$daysInMonth = 31;
} else if ($convertDateTime[0] == 2) {
$daysInMonth = 28;
} else {
$daysInMonth = 30;
}
$dayHolder = $convertDateTime[1];
if ($negativeFlag) {
while ($dayHolder <= 0) {
$convertDateTime[0]--;
if ($convertDateTime[0] == 0) {
$convertDateTime[0] = 12;
}
if (($convertDateTime[0] == 1) || ($convertDateTime[0] == 3) || ($convertDateTime[0] == 5) ||
($convertDateTime[0] == 7) || ($convertDateTime[0] == 8) || ($convertDateTime[0] == 10) ||
($convertDateTime[0] == 12)) {
$daysInMonth = 31;
} else if ($convertDateTime[0] == 2) {
$daysInMonth = 28;
} else {
$daysInMonth = 30;
}
$dayHolder += $daysInMonth;
}
$convertDateTime[1] = $dayHolder;
} else {
while ($dayHolder > $daysInMonth) {
echo "Day: $dayHolder";
$dayHolder -= $daysInMonth;
$convertDateTime[0]++;
if ($convertDateTime[0] == 13) {
$convertDateTime[0] = 1;
}
if (($convertDateTime[0] == 1) || ($convertDateTime[0] == 3) || ($convertDateTime[0] == 5) ||
($convertDateTime[0] == 7) || ($convertDateTime[0] == 8) || ($convertDateTime[0] == 10) ||
($convertDateTime[0] == 12)) {
$daysInMonth = 31;
} else if ($convertDateTime[0] == 2) {
$daysInMonth = 28;
} else {
$daysInMonth = 30;
}
}
$convertDateTime[1] = $dayHolder;
if ($convertDateTime[1] == 0) {
$convertDateTime[1] = 1;
}
}
# Months
$monthHolder = $convertDateTime[0];
while (($monthHolder < 0) || ($monthHolder >= 13)) {
if ($negativeFlag) {
$monthHolder += 13;
$convertDateTime[2]--;
} else {
$monthHolder -= 13;
$convertDateTime[2]++;
}
}
$convertDateTime[0] = $monthHolder;
if ($convertDateTime[0] == 0) {
$convertDateTime[0] = 1;
}
DateIntegerToString($date, $convertDateTime);
}