459 lines
No EOL
18 KiB
Python
459 lines
No EOL
18 KiB
Python
|
|
import datastore
|
|
import utils
|
|
import dsz.cmd
|
|
import dsz.lp
|
|
import os
|
|
from utils import limitedget, file_exists, reg_exists
|
|
|
|
def find_01():
|
|
result = utils.reg_exists('L', 'software\\microsoft\\windows\\currentversion\\StrtdCfg', None, True)
|
|
if result:
|
|
return True
|
|
for key in datastore.HKEY_USERS_DATA:
|
|
result = utils.reg_exists('U', ('%s\\software\\microsoft\\windows\\currentversion\\StrtdCfg' % key), None, True)
|
|
if result:
|
|
return True
|
|
return False
|
|
|
|
def find_02():
|
|
result = utils.reg_exists('L', 'System\\CurrentControlSet\\Control\\CrashImage', None, True)
|
|
if result:
|
|
return True
|
|
return False
|
|
|
|
def find_03():
|
|
if ('driver32' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
return False
|
|
|
|
def find_04():
|
|
if ('$NtUninstallQ817473$' in datastore.SYSPATH_FILE_SET):
|
|
return True
|
|
for f in ['Hd1', 'Hd2', 'IdeDrive1', 'IdeDrive2']:
|
|
if utils.file_exists('\\\\.', (f + '\\')):
|
|
return True
|
|
return False
|
|
|
|
def find_05():
|
|
if ('systmgmt' in datastore.SERVICE_NAME_SET):
|
|
return True
|
|
return False
|
|
|
|
def find_06():
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\Run\\ipmontr'):
|
|
return True
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\WinKernel\\Explorer\\Run\\ipmontr'):
|
|
return True
|
|
return False
|
|
|
|
def find_07():
|
|
return utils.reg_exists('L', 'Software\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\Run\\Internet32')
|
|
|
|
def find_08():
|
|
if ('s7otbxsx.dll' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
if ('mrxcls' in datastore.SERVICE_NAME_SET):
|
|
return True
|
|
if utils.file_exists(('%s\\inf' % datastore.SYSPATH_STR), 'mdmcpq3.pnf'):
|
|
return True
|
|
return False
|
|
|
|
def find_09():
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(('dir -mask * -path "%s\\Common Files\\Microsoft Shared"' % datastore.PROGRAM_FILES_STR), dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
names = dsz.cmd.data.Get('DirItem::FileItem::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
names = None
|
|
if (names is not None):
|
|
if (('msaudio' in names) or ('mssecuritymgr' in names) or ('MSAPackages' in names)):
|
|
return True
|
|
return False
|
|
|
|
def find_10():
|
|
if ('icsvnt32.dll' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx('registryquery -hive L -key "SYSTEM\\CurrentControlCet\\Control\\timezoneinformation"', dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
value_names = dsz.cmd.data.Get('key::value::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
value_names = None
|
|
if (value_names is not None):
|
|
if (('standarddatebias' in value_names) or ('standardtimebias' in value_names)):
|
|
return True
|
|
return False
|
|
|
|
def find_11():
|
|
if (('ups32.exe' in datastore.PROCESS_NAME_SET) or ('utilman32.exe' in datastore.PROCESS_NAME_SET)):
|
|
return True
|
|
if ('ups32.exe' in datastore.DRIVERPATH_FILE_SET):
|
|
return True
|
|
search_set = set(('ups32.exe', 'utilman32.exe', 'utliman32.exe', 'msvcp11.dll', 'msxml10.dll'))
|
|
if (not datastore.SYSTEMROOT_FILE_SET.isdisjoint(search_set)):
|
|
return True
|
|
return False
|
|
|
|
def find_12():
|
|
if utils.file_exists(('%s\\All Users\\Application Data' % datastore.PROFILE_PATH), 'Network'):
|
|
return True
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\MSFix'):
|
|
return True
|
|
for key in datastore.HKEY_USERS_DATA:
|
|
if utils.reg_exists('U', ('%s\\Software\\Microsoft\\MSFix' % key)):
|
|
return True
|
|
return False
|
|
|
|
def find_13():
|
|
if ('WOWmanager' in datastore.SERVICE_NAME_SET):
|
|
return True
|
|
if ('winstat.pdr' in datastore.SYSPATH_FILE_SET):
|
|
return True
|
|
search_set = set(('winview.ocs', 'Mfc42l00.pdb', 'ISUninst.bin', 'mswmpdat.tlb', 'wmmini.swp', 'wowmgr.exe'))
|
|
if (not datastore.SYSTEMROOT_FILE_SET.isdisjoint(search_set)):
|
|
return True
|
|
return False
|
|
|
|
def find_14():
|
|
valid = False
|
|
if utils.file_exists('c:\\win\\drivers', 'slidebar.exe'):
|
|
vals = ['newval', 'WindowsFirewallSecurityServ', 'slidebar', 'MSDeviceDriver']
|
|
keys = (['SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'] * len(vals))
|
|
valid = any(map(utils.reg_exists, (['L'] * len(vals)), keys, vals))
|
|
return valid
|
|
|
|
def find_15():
|
|
if ('TlbControl' in datastore.SERVICE_NAME_SET):
|
|
return True
|
|
if (('tlbcon32.exe' in datastore.SYSTEMROOT_FILE_SET) or ('con32.nls' in datastore.SYSTEMROOT_FILE_SET)):
|
|
return True
|
|
return False
|
|
|
|
def find_16():
|
|
if ('indsvc32.ocx' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
if utils.file_exists(('%s\\temp' % datastore.SYSPATH_STR), 'indsvc32.ocx'):
|
|
return True
|
|
return False
|
|
|
|
def find_17():
|
|
search_set = set(('ADWM.DLL', 'ASFIPC.DLL', 'BROWUI.DLL', 'CAPESPN.DLL', 'CFGKRNL3.DLL', 'CRYPTKRN.DLL', 'DESKKRNE.DLL', 'DSKMGR.DLL', 'EXPLORED.DLL', 'FMEM.DLL', 'HDDBACK4.DLL', 'HWMAP.DLL', 'ipnetd.dll', 'IPNETD.DLL', 'KNRLADD.DLL', 'MAILAPIC.DLL', 'MSGRTHLP.DLL', 'MSIAXCPL.DLL', 'MSID32.DLL', 'MSRECV40.DLL', 'NCFG.DLL', 'PARALEUI.DLL', 'secur16.dll', 'SECUR16.DLL', 'SOUNDLOC.DLL', 'WINF.DLL', 'WMCRT.DLL'))
|
|
if (not datastore.SYSTEMROOT_FILE_SET.isdisjoint(search_set)):
|
|
return True
|
|
if utils.reg_exists('R', 'Lnkfile\\shellex\\IconHandler', 'OptionFlags'):
|
|
return True
|
|
return False
|
|
|
|
def find_18():
|
|
if (('msprnt.exe' in datastore.SYSTEMROOT_FILE_SET) or ('fmem.dll' in datastore.SYSTEMROOT_FILE_SET)):
|
|
return True
|
|
search_set = set(('pnppci', 'ethio', 'ntdos505', 'ndisio'))
|
|
if (not datastore.SERVICE_NAME_SET.isdisjoint(search_set)):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(('dir -mask * -path "%s\\All Users\\Application Data"' % datastore.PROFILE_PATH), dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
names = dsz.cmd.data.Get('DirItem::FileItem::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
names = None
|
|
if (names is None):
|
|
return False
|
|
if (('msncp.exe' in names) or ('netsvcs.exe' in names)):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(('dir -mask * -path "%s\\common files\\microsoft shared\\Triedit"' % datastore.PROGRAM_FILES_STR), dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
names = dsz.cmd.data.Get('DirItem::FileItem::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
names = None
|
|
if (names is None):
|
|
return False
|
|
if (('htmlprsr.exe' in names) or ('dhtmled.dll' in names) or ('TRIEDIT.TLB' in names)):
|
|
return True
|
|
return False
|
|
|
|
def find_19():
|
|
return ('nsecm.dll' in datastore.SYSTEMROOT_FILE_SET)
|
|
|
|
def find_20():
|
|
if ('svchost00000000-0000-0000-0000-0000-00000000.dat' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
if utils.file_exists(('%s\\All Users\\MSI' % datastore.PROFILE_PATH), 'update.msi'):
|
|
return True
|
|
if utils.file_exists(('%s\\All Users\\Application Data\\MSI' % datastore.PROFILE_PATH), 'update.msi'):
|
|
return True
|
|
if ('ProgramData' in datastore.ENV_VARS):
|
|
prog_data = datastore.ENV_VARS.get('ProgramData')
|
|
if utils.file_exists(('%s\\MSI' % prog_data), 'update.msi'):
|
|
return True
|
|
if utils.file_exists(('%s\\Common Files' % datastore.PROGRAM_FILES_STR), 'wusvcd.exe'):
|
|
return True
|
|
if utils.file_exists(('%s\\Common Files\\%s' % (datastore.PROGRAM_FILES_STR, 'wusvcd')), 'wusvcd.exe'):
|
|
return True
|
|
if (('WinMI32' in datastore.SERVICE_NAME_SET) or ('wusvcd' in datastore.SERVICE_NAME_SET)):
|
|
return True
|
|
if ('Microsoft' in datastore.SYSTEMROOT_FILE_SET):
|
|
if utils.file_exists(('%s\\Microsoft' % datastore.SYSTEMROOT_STR), 'Windows Management Infrastructure'):
|
|
return True
|
|
return False
|
|
|
|
def find_21():
|
|
if utils.file_exists(('%s\\temp' % datastore.SYSPATH_STR), 'temp56273.pdf'):
|
|
return True
|
|
for ud in datastore.USER_DIRS_LIST:
|
|
if utils.file_exists(('%s\\%s\\Local Settings\\History\\cache' % (datastore.PROFILE_PATH, ud)), 'iecache.dll'):
|
|
return True
|
|
return False
|
|
|
|
def find_22():
|
|
if utils.file_exists(('%s\\etc' % datastore.DRIVERPATH_STR), 'network.ics'):
|
|
return True
|
|
if ('acelpvc.dll' in datastore.SYSTEMROOT_FILE_SET):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx('registryquery -hive L -key "Software\\Sun\\1.1.2"', dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
subkeys = dsz.cmd.data.Get('key::subkey::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
subkeys = None
|
|
if (subkeys is not None):
|
|
if (('AppleTlk' in subkeys) or ('IsoTp' in subkeys)):
|
|
return True
|
|
try:
|
|
values = dsz.cmd.data.Get('key::value::name', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
values = None
|
|
if (values is not None):
|
|
if (('AppleTlk' in values) or ('IsoTp' in values)):
|
|
return True
|
|
return False
|
|
|
|
def find_23():
|
|
for key in datastore.HKEY_USERS_DATA:
|
|
if utils.reg_exists('U', ('%s\\software\\microsoft\\NetWin' % key)):
|
|
return True
|
|
return False
|
|
|
|
def find_24():
|
|
if (('mfc64comm.sys' in datastore.DRIVERPATH_FILE_SET) or ('adap64info.sys' in datastore.DRIVERPATH_FILE_SET)):
|
|
return True
|
|
return False
|
|
|
|
def find_25():
|
|
pass
|
|
|
|
def find_26():
|
|
if utils.reg_exists('L', 'Software\\Adobe\\Fix'):
|
|
return True
|
|
search_set = set(('result.dat', 'data.dat', 'Acrobat.dll', 'first.tmp'))
|
|
for ud in datastore.USER_DIRS_LIST:
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(('dir -mask * -path "%s\\%s\\Local Settings\\Temp"' % (datastore.PROFILE_PATH, ud)), dsz.RUN_FLAG_RECORD)
|
|
if cmdStatus:
|
|
try:
|
|
names = set(dsz.cmd.data.Get('DirItem::FileItem::name', dsz.TYPE_STRING, cmdId))
|
|
except RuntimeError:
|
|
names = None
|
|
if ((names is not None) and (not names.isdisjoint(search_set))):
|
|
return True
|
|
return False
|
|
|
|
def find_27():
|
|
search_set = set(('qtlib.sqt', 'zl4vq.sqt', 'dfrgntfs5.sqt', 'msvcrt58.sqt'))
|
|
if (not datastore.SYSTEMROOT_FILE_SET.isdisjoint(search_set)):
|
|
return True
|
|
return False
|
|
|
|
def find_28():
|
|
for ud in datastore.USER_DIRS_LIST:
|
|
if utils.file_exists(('%s\\%s\\Local Settings\\Application Data' % (datastore.PROFILE_PATH, ud)), 'S-1-5-31-1286970278978-5713669491-166975984-320'):
|
|
return True
|
|
return False
|
|
|
|
def find_30():
|
|
if (('msdxofg.dll' in datastore.SYSTEMROOT_FILE_SET) or ('atllib.dll' in datastore.SYSTEMROOT_FILE_SET) or ('ocmsiecon.hlp' in datastore.SYSTEMROOT_FILE_SET)):
|
|
return True
|
|
return False
|
|
|
|
def find_31():
|
|
if (('wpa.dbl.bak' in datastore.SYSTEMROOT_FILE_SET) or ('sslkey.exe' in datastore.SYSTEMROOT_FILE_SET)):
|
|
return True
|
|
if ('WindowsUpdate.old' in datastore.SYSPATH_FILE_SET):
|
|
return True
|
|
if utils.file_exists(('%s\\temp' % datastore.SYSPATH_STR), '~MS1E.tmp'):
|
|
return True
|
|
if utils.file_exists(('%s\\temp' % datastore.SYSPATH_STR), '~FMIFEN.tmp'):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx('registryquery -hive L -key "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Streams\\Desktop"', dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
return False
|
|
try:
|
|
subkeys = set(dsz.cmd.data.Get('key::subkey::name', dsz.TYPE_STRING, cmdId))
|
|
except:
|
|
subkeys = None
|
|
if (subkeys is not None):
|
|
search_set = set(('Default Statusbar Sign', 'Default MenuBars Sign', 'Default Taskbar Sign', 'Default Zone'))
|
|
if (not subkeys.isdisjoint(search_set)):
|
|
return True
|
|
return False
|
|
|
|
def find_32():
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\Active Setup\\Installed Components\\{FB083534-2709-3378-0000-F0FCD03BA387}'):
|
|
return True
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\Active Setup\\Installed Components\\{FB083534-2709-3378-0001-F0FCD03BA387}'):
|
|
return True
|
|
return False
|
|
|
|
def find_33():
|
|
return ('INI' in datastore.SYSTEMROOT_FILE_SET)
|
|
|
|
def find_34():
|
|
return utils.reg_exists('L', 'System\\CurrentControlSet\\Services\\Windows Installer Management')
|
|
|
|
def find_35():
|
|
for f in datastore.DRIVERPATH_DATA:
|
|
if ((f[1] == 9472) and f[0].endswith('.sys')):
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(('grep -mask %s -path %s -pattern 9N' % (f[0], datastore.DRIVERPATH_STR)), dsz.RUN_FLAG_RECORD)
|
|
if (not cmdStatus):
|
|
continue
|
|
try:
|
|
matches = dsz.cmd.data.Get('file::numlines', dsz.TYPE_INT, cmdId)
|
|
except:
|
|
matches = None
|
|
if (matches is not None):
|
|
print ('SIG35: matched %d lines in %s' % (len(matches), f[0]))
|
|
return True
|
|
return False
|
|
|
|
def find_36():
|
|
xmldir = os.path.normpath(('%s/Data' % dsz.lp.GetLogsDirectory()))
|
|
cmdStr = (u'local grep -mask "*processinfo*" -path "%s" -pattern "kernel32.dll.aslr"' % xmldir)
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx(cmdStr.encode('utf8'), dsz.RUN_FLAG_RECORD)
|
|
if cmdStatus:
|
|
try:
|
|
matches = dsz.cmd.data.Get('file::location', dsz.TYPE_STRING, cmdId)
|
|
except:
|
|
matches = None
|
|
if (matches is not None):
|
|
print ('matched files: %s' % matches)
|
|
return True
|
|
return False
|
|
|
|
def find_37():
|
|
return ('godown.dll' in datastore.SYSTEMROOT_FILE_SET)
|
|
|
|
def find_38():
|
|
if (('winns.exe' in datastore.SYSTEMROOT_FILE_SET) or ('kbdarpe.dll' in datastore.SYSTEMROOT_FILE_SET)):
|
|
return True
|
|
return False
|
|
|
|
def find_39():
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\MS QAG\\U11'):
|
|
return True
|
|
if utils.reg_exists('L', 'Software\\Microsoft\\MS QAG\\U12'):
|
|
return True
|
|
return False
|
|
|
|
def find_40():
|
|
return utils.reg_exists('L', 'Software\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad', 'NetIDS')
|
|
|
|
def find_41():
|
|
if utils.file_exists(('%s\\common files' % datastore.PROGRAM_FILES_STR), 'Log'):
|
|
return True
|
|
elif (datastore.PROGRAM_FILESX86_STR is not None):
|
|
if utils.file_exists(('%s\\common files' % datastore.PROGRAM_FILESX86_STR), 'Log'):
|
|
return True
|
|
(cmdStatus, cmdId) = dsz.cmd.RunEx('registryquery -hive L -key "software\\microsoft\\windows nt\\currentversion\\winlogon" -value Userinit')
|
|
if cmdStatus:
|
|
try:
|
|
value_data = dsz.cmd.data.Get('key::value::value', dsz.TYPE_STRING, cmdId)
|
|
except RuntimeError:
|
|
value_data = None
|
|
if (value_data is not None):
|
|
if (value_data.find('svchost') >= 0):
|
|
return True
|
|
return False
|
|
|
|
def find_43():
|
|
filesinsys32 = ['cryptapi32.dll']
|
|
otherfiles = ['%appdata%\\Help\\system32\\cryptapi32.dll']
|
|
regentries = [('L', 'SYSTEM\\CurrentControlSet\\Control', 'DType0')]
|
|
results = []
|
|
for f in filesinsys32:
|
|
results.append((f in datastore.SYSPATH_FILE_SET))
|
|
for f in otherfiles:
|
|
results.append(file_exists(*os.path.split(f)))
|
|
for reg in regentries:
|
|
results.append(reg_exists(*reg))
|
|
return any(results)
|
|
|
|
def find_44():
|
|
filesinsys32 = ['rasmgr.dll', 'raseap.dll']
|
|
otherfiles = ['%windir%\\AppPatch\\rasmain.sdb']
|
|
results = []
|
|
for f in filesinsys32:
|
|
results.append((f in datastore.SYSPATH_FILE_SET))
|
|
for f in otherfiles:
|
|
results.append(file_exists(*os.path.split(f)))
|
|
return any(results)
|
|
|
|
def find_45():
|
|
regkey = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'
|
|
val = ('Internet',)
|
|
data = re.compile('C:\\WINDOWS\\system32\\Microsoft\\Protect\\Windows\\sv[s|c]host.exe')
|
|
otherfiles = ['%windir%\\AppPatch\\rasmain.sdb']
|
|
results = []
|
|
for f in filesinsys32:
|
|
results.append((f in datastore.SYSPATH_FILE_SET))
|
|
for f in otherfiles:
|
|
results.append(file_exists(*os.path.split(f)))
|
|
return any(results)
|
|
|
|
def get_03():
|
|
pass
|
|
|
|
def get_04():
|
|
pass
|
|
|
|
def get_05():
|
|
pass
|
|
|
|
def get_06():
|
|
pass
|
|
|
|
def get_07():
|
|
pass
|
|
|
|
def get_11():
|
|
pass
|
|
|
|
def get_14():
|
|
to_get = ['c:\\applicationdata\\appdata1\\logFile.txt', '%USERPROFILE%\\MyHood\\btmn\\system\\temp\\cnf.txt', 'c:\\syslog\\temp\\012tg7\\system\\cnf.txt']
|
|
for getfile in to_get:
|
|
(path, name) = os.path.split(getfile)
|
|
limitedget(path, name, maxfilesize=256000)
|
|
|
|
def get_17():
|
|
pass
|
|
|
|
def get_18():
|
|
pass
|
|
|
|
def get_43():
|
|
to_get = ['%system%\\mtmon.sdb']
|
|
for getfile in to_get:
|
|
(path, name) = os.path.split(getfile)
|
|
limitedget(path, name, maxfilesize=256000)
|
|
|
|
def get_44():
|
|
to_get = ['%ProgramFiles%\\Common Files\\System\\ado\\msado39.tlb', '%ProgramFiles%\\Common Files\\System\\ado\\msado29.tlb']
|
|
for getfile in to_get:
|
|
(path, name) = os.path.split(getfile)
|
|
limitedget(path, name, maxfilesize=256000)
|
|
FIND_SIG = [find_01, find_02, find_03, find_04, find_05, find_06, find_07, find_08, find_09, find_10, find_11, find_12, find_13, find_14, find_15, find_16, find_17, find_18, find_19, find_20, find_21, find_22, find_23, find_24, find_25, find_26, find_27, find_28, None, find_30, find_31, find_32, find_33, find_34, find_35, find_36, find_37, find_38, find_39, find_40, find_41, None, find_43, find_44]
|
|
GET_SIG = [None, None, get_03, get_04, get_05, get_06, get_07, None, None, None, get_11, None, None, get_14, None, None, get_17, get_18, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, get_43, get_44] |