feat(d-eyes): init
This commit is contained in:
zitn
337
deyes_windows.go
Normal file
337
deyes_windows.go
Normal file
@@ -0,0 +1,337 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gookit/color"
|
||||
"github.com/urfave/cli/v2"
|
||||
"github.com/xuri/excelize/v2"
|
||||
|
||||
"d-eyes/basicinfo/info"
|
||||
"d-eyes/filedetection"
|
||||
"d-eyes/logo"
|
||||
"d-eyes/output"
|
||||
"d-eyes/yaraobj"
|
||||
)
|
||||
|
||||
var path string
|
||||
var rule string
|
||||
var thread int
|
||||
var pid int
|
||||
var vulnerability int
|
||||
|
||||
func main() {
|
||||
srcPath := SrcPath()
|
||||
logo.ShowLogo()
|
||||
app := &cli.App{
|
||||
Name: "D-Eyes",
|
||||
Usage: "The Eyes of Darkness from Nsfocus spy on everything.",
|
||||
Flags: []cli.Flag{
|
||||
&cli.StringFlag{
|
||||
Name: "path",
|
||||
Aliases: []string{"P"},
|
||||
Value: "C://",
|
||||
Usage: "-P C:// (Only For Filescan)",
|
||||
Destination: &path,
|
||||
},
|
||||
&cli.IntFlag{
|
||||
Name: "pid",
|
||||
Aliases: []string{"p"},
|
||||
Value: -1,
|
||||
Usage: "-p 666 (Only For processcan.'-1' means all processes.)",
|
||||
Destination: &pid,
|
||||
},
|
||||
&cli.StringFlag{
|
||||
Name: "rule",
|
||||
Aliases: []string{"r"},
|
||||
Usage: "-r Ransom.Wannacrypt",
|
||||
Destination: &rule,
|
||||
},
|
||||
&cli.IntFlag{
|
||||
Name: "thread",
|
||||
Aliases: []string{"t"},
|
||||
Value: 5,
|
||||
Usage: "-t 1 (Only For Filescan)",
|
||||
Destination: &thread,
|
||||
},
|
||||
&cli.IntFlag{
|
||||
Name: "vul",
|
||||
Aliases: []string{"v"},
|
||||
Usage: "-v 1 (1 is to check Exchange Server OWASSRF exploitation)",
|
||||
Destination: &vulnerability,
|
||||
},
|
||||
},
|
||||
Commands: []*cli.Command{
|
||||
{
|
||||
Name: "filescan",
|
||||
Aliases: []string{"fs"},
|
||||
Usage: "Command for scanning filesystem",
|
||||
Flags: []cli.Flag{
|
||||
&cli.StringFlag{
|
||||
Name: "path",
|
||||
Aliases: []string{"P"},
|
||||
Value: "C://",
|
||||
Usage: "--path C:// or -P C:// (Only For Filescan)",
|
||||
Destination: &path,
|
||||
},
|
||||
&cli.StringFlag{
|
||||
Name: "rule",
|
||||
Aliases: []string{"r"},
|
||||
Usage: "--rule Ransom.Wannacrypt or -r Ransom.Wannacrypt",
|
||||
Destination: &rule,
|
||||
},
|
||||
&cli.IntFlag{
|
||||
Name: "thread",
|
||||
Aliases: []string{"t"},
|
||||
Value: 5,
|
||||
Usage: "--thread 1 or -t 1",
|
||||
Destination: &thread,
|
||||
},
|
||||
},
|
||||
Action: func(c *cli.Context) error {
|
||||
var paths []string
|
||||
var r []output.Result
|
||||
paths = strings.Split(path, ",")
|
||||
var start = time.Now()
|
||||
var sum = 0
|
||||
|
||||
if rule == "" {
|
||||
yaraRule := srcPath + "yaraRules"
|
||||
rules, err := yaraobj.LoadAllYaraRules(yaraRule)
|
||||
if err != nil {
|
||||
color.Redln("LoadCompiledRules goes error !!!")
|
||||
color.Redln("GetRules err: ", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
for _, path := range paths {
|
||||
files := filedetection.StartFileScan(path, rules, thread, &r)
|
||||
sum += files
|
||||
}
|
||||
} else {
|
||||
yaraRule := srcPath + "yaraRules\\" + rule + ".yar"
|
||||
_, err := os.Lstat(yaraRule)
|
||||
if err != nil {
|
||||
color.Redln("There is no such rule yet !!!")
|
||||
os.Exit(1)
|
||||
}
|
||||
rules, err := yaraobj.LoadSingleYaraRule(yaraRule)
|
||||
if err != nil {
|
||||
color.Redln("GetRules err: ", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
for _, path := range paths {
|
||||
files := filedetection.StartFileScan(path, rules, thread, &r)
|
||||
sum += files
|
||||
}
|
||||
}
|
||||
|
||||
if len(r) > 0 {
|
||||
length := len(r)
|
||||
categories := map[string]string{
|
||||
"A1": "Risk Description", "B1": "Risk File Path",
|
||||
}
|
||||
var values = make(map[string]string)
|
||||
vulsumTmp := 0
|
||||
for i := 0; i < length; i++ {
|
||||
vulsumTmp++
|
||||
color.Error.Println("[ Risk ", vulsumTmp, " ]")
|
||||
fmt.Print("Risk Description: ")
|
||||
color.Warn.Println(r[i].Risk)
|
||||
fmt.Println("Risk File Path: ")
|
||||
color.Warn.Println(r[i].RiskPath)
|
||||
//set excel values
|
||||
excelValuetmpA := "A" + strconv.Itoa(vulsumTmp+1)
|
||||
excelValuetmpB := "B" + strconv.Itoa(vulsumTmp+1)
|
||||
values[excelValuetmpA] = r[i].Risk
|
||||
values[excelValuetmpB] = r[i].RiskPath
|
||||
}
|
||||
//output to a excel
|
||||
f := excelize.NewFile()
|
||||
f.SetColWidth("Sheet1", "A", "B", 50)
|
||||
for k, v := range categories {
|
||||
f.SetCellValue("Sheet1", k, v)
|
||||
}
|
||||
for k, v := range values {
|
||||
f.SetCellValue("Sheet1", k, v)
|
||||
}
|
||||
style, err := f.NewStyle(
|
||||
&excelize.Style{
|
||||
Font: &excelize.Font{
|
||||
Bold: true,
|
||||
Size: 11,
|
||||
Color: "e83723",
|
||||
},
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
f.SetCellStyle("Sheet1", "A1", "A1", style)
|
||||
f.SetCellStyle("Sheet1", "B1", "B1", style)
|
||||
|
||||
// save the result to Deyes.xlsx
|
||||
if err := f.SaveAs(srcPath + "D-Eyes_FileResult.xlsx"); err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
} else {
|
||||
fmt.Println("\nNo suspicious files found. Your computer is safe with the rules you choose.")
|
||||
}
|
||||
|
||||
var end = time.Now().Sub(start)
|
||||
fmt.Println("Consuming Time: ", end, " Number of scanned files: ", sum)
|
||||
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "processcan",
|
||||
Aliases: []string{"ps"},
|
||||
Usage: "Command for scanning processes",
|
||||
Flags: []cli.Flag{
|
||||
&cli.IntFlag{
|
||||
Name: "pid",
|
||||
Aliases: []string{"p"},
|
||||
Value: -1,
|
||||
Usage: "--pid 666 or -p 666 ('-1' means all processes.)",
|
||||
Destination: &pid,
|
||||
},
|
||||
&cli.StringFlag{
|
||||
Name: "rule",
|
||||
Aliases: []string{"r"},
|
||||
Usage: "--rule Ransom.Wannacrypt or -r Ransom.Wannacrypt",
|
||||
Destination: &rule,
|
||||
},
|
||||
},
|
||||
Action: func(c *cli.Context) error {
|
||||
|
||||
var start = time.Now()
|
||||
// todo
|
||||
//controller.ScanProcess(pid, rule, src_path)
|
||||
var end = time.Now().Sub(start)
|
||||
fmt.Println("Consuming Time: ", end)
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "host",
|
||||
Usage: "Command for displaying basic host information",
|
||||
Action: func(c *cli.Context) error {
|
||||
color.Infoln("Host Info:")
|
||||
info.DisplayBaseInfo()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "users",
|
||||
Usage: "Command for displaying all the users on the host",
|
||||
Action: func(c *cli.Context) error {
|
||||
color.Infoln("AllUsers:")
|
||||
info.DisplayAllUsers()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "top",
|
||||
Usage: "Command for displaying the top 15 processes in CPU usage",
|
||||
Action: func(c *cli.Context) error {
|
||||
info.Top()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "netstat",
|
||||
Usage: "Command for displaying host network information",
|
||||
Action: func(c *cli.Context) error {
|
||||
color.Infoln("Network Info:")
|
||||
info.DisplayNetStat(srcPath)
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "task",
|
||||
Usage: "Command for displaying all the tasks on the host",
|
||||
Action: func(c *cli.Context) error {
|
||||
color.Infoln("Task:")
|
||||
info.DisplayPlanTask()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "autoruns",
|
||||
Usage: "Command for displaying all the autoruns on the host",
|
||||
Action: func(c *cli.Context) error {
|
||||
color.Infoln("Autoruns:")
|
||||
info.CallDisplayAutoruns()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "export",
|
||||
Usage: "Command for exporting basic host information",
|
||||
Action: func(c *cli.Context) error {
|
||||
info.SaveSummaryBaseInfo()
|
||||
return nil
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
Name: "check",
|
||||
Usage: "Command for checking vulnerability exploitation",
|
||||
Flags: []cli.Flag{
|
||||
&cli.IntFlag{
|
||||
Name: "vulnerability",
|
||||
Aliases: []string{"v"},
|
||||
Usage: "-v 1 (1 is to check Exchange Server OWASSRF exploitation)",
|
||||
Destination: &vulnerability,
|
||||
},
|
||||
},
|
||||
Action: func(c *cli.Context) error {
|
||||
switch vulnerability {
|
||||
case 1:
|
||||
var path string
|
||||
if len(os.Args) > 4 {
|
||||
path = os.Args[4]
|
||||
}
|
||||
info.CheckExchangeServerOWASSRF(path)
|
||||
default:
|
||||
fmt.Println("Please enter the number of vulnerability exploitation you want to check.")
|
||||
fmt.Println()
|
||||
color.Warn.Println("Currently supported vulnerability exploitation list:")
|
||||
fmt.Println(" 1: Exchange Server OWASSRF")
|
||||
fmt.Println()
|
||||
fmt.Print("Like this, if you want to check 'Exchange Server OWASSRF' exploitation, just input ")
|
||||
color.Warn.Println("'D-Eyes check -v 1'")
|
||||
}
|
||||
return nil
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
err := app.Run(os.Args)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func SrcPath() string {
|
||||
|
||||
args := os.Args
|
||||
lastIndex := strings.LastIndex(args[0], "\\")
|
||||
cmdPath := args[0][0 : lastIndex+1]
|
||||
currentDir, _ := os.Getwd()
|
||||
|
||||
dir, _ := os.ReadDir(currentDir)
|
||||
for _, f := range dir {
|
||||
if f.IsDir() {
|
||||
if f.Name() == "yaraRules" {
|
||||
return currentDir + "\\"
|
||||
}
|
||||
}
|
||||
}
|
||||
return cmdPath
|
||||
}
|
||||
Reference in New Issue
Block a user