-
Notifications
You must be signed in to change notification settings - Fork 116
Expand file tree
/
Copy pathgenerate_samples.py
More file actions
100 lines (65 loc) · 4.06 KB
/
Copy pathgenerate_samples.py
File metadata and controls
100 lines (65 loc) · 4.06 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
import os
import sys
import subprocess
print(__file__)
samplepath = os.path.join(os.path.dirname(__file__), "..", "samples")
resultdir = os.path.join(os.path.dirname(__file__), "source", "samples_output")
resultdir = os.path.abspath(resultdir)
os.chdir(samplepath)
python_exe = sys.executable
def generate_output_result(target, output):
print("Generating result of <{0}>".format(target))
p = subprocess.Popen([python_exe, target], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True)
result = p.communicate()
with open(os.path.join(resultdir, output), "wb") as f:
f.write("(cmd) python {0}\n".format(target))
f.write(result[0])
if "-n" in sys.argv:
sys.exit(0)
generate_output_result(r"process\current_process.py", "process_current_process.txt")
generate_output_result(r"process\remote_process.py", "process_remote_process.txt")
generate_output_result(r"process\peb.py", "process_peb.txt")
generate_output_result(r"process\iat_hook.py", "process_iat_hook.txt")
generate_output_result(r"process\veh_segv.py", "process_veh_segv.txt")
generate_output_result(r"process\apisetmap.py", "process_apisetmap.txt")
generate_output_result(r"token\token_demo.py", "token_token_demo.txt")
generate_output_result(r"system.py", "system.txt")
# Require admin for 'network.py'
# Also require a local connection to port 80
generate_output_result(r"network\network.py", "network_network.txt")
# Need to anonymise the output
# generate_output_result(r"registry\registry.py", "registry_registry.txt")
generate_output_result(r"crypto\wintrust.py", "crypto_wintrust.txt")
generate_output_result(r"debug\debugger_print_LdrLoaddll.py", "debug_debugger_print_LdrLoaddll.txt")
generate_output_result(r"debug\debugger_membp_singlestep.py", "debug_debugger_membp_singlestep.txt")
generate_output_result(r"debug\debug_functionbp.py", "debug_debug_functionbp.txt")
generate_output_result(r"debug\attach.py", "debug_attach.txt")
generate_output_result(r"debug\local_debugger.py", "debug_local_debugger.txt")
generate_output_result(r"debug\debugger_on_setup.py", "debug_debugger_on_setup.txt")
# dbg.symbols
generate_output_result(r"debug\symbols\virtsymdemo.py", "debug_symbol_virtsymdemo.txt")
generate_output_result(r"debug\symbols\processsymdemo.py", "debug_symbol_processsymdemo.txt")
generate_output_result(r"debug\symbol_debugger.py", "debug_symbol_debugger.txt")
# Not generated: need parameters
# generate_output_result(r"debug\symbols\symsearch.py", "debug_symbol_symsearch.txt")
generate_output_result(r"wmi\wmi_request.py", "wmi_wmi_request.txt")
generate_output_result(r"wmi\create_process.py", "wmi_create_process.txt")
generate_output_result(r"com\com_inetfwpolicy2.py", "com_com_inetfwpolicy2.txt")
generate_output_result(r"com\icallinterceptor.py", "com_icallinterceptor.txt")
generate_output_result(r"crypto\certificate.py", "crypto_certificate.txt")
# Those 2 create another process: cannot get full output with this simple implem
# generate_output_result(r"alpc\simple_alpc.py", "alpc_simple_alpc.txt")
# generate_output_result(r"alpc\advanced_alpc.py", "alpc_advanced_alpc.txt")
generate_output_result(r"rpc\lsass.py", "rpc_lsass.txt")
generate_output_result(r"pipe\child_send_object.py", "pipe_child_send_object.txt")
generate_output_result(r"scheduled_tasks\scheduled_task.py", "scheduled_task_scheduled_task.txt")
generate_output_result(r"event_log\eventlog.py", "event_log_eventlog.txt")
generate_output_result(r"object_manager\findobj.py", "object_manager_findobj.txt")
generate_output_result(r"object_manager\object_manager.py", "object_manager_object_manager.txt")
generate_output_result(r"security\security_descriptor.py", "security_security_descriptor.txt")
generate_output_result(r"service\service_demo.py", "service_service_demo.txt")
generate_output_result(r"device_manager\device_manager.py", "device_manager_device_manager.txt")
generate_output_result(r"etw\etw_enumeration.py", "etw_etw_enumeration.txt")
generate_output_result(r"etw\uac_trace.py", "etw_uac_trace.txt")
# Require ADMIN / NotAdmin run
# generate_output_result(r"security\query_sacl.py", "security_query_sacl.txt")