338 lines
8.4 KiB
Go
338 lines
8.4 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/gookit/color"
|
|
"github.com/urfave/cli/v2"
|
|
"github.com/xuri/excelize/v2"
|
|
|
|
"d-eyes/basicinfo/info"
|
|
"d-eyes/filedetection"
|
|
"d-eyes/logo"
|
|
"d-eyes/output"
|
|
"d-eyes/yaraobj"
|
|
)
|
|
|
|
var path string
|
|
var rule string
|
|
var thread int
|
|
var pid int
|
|
var vulnerability int
|
|
|
|
func main() {
|
|
srcPath := SrcPath()
|
|
logo.ShowLogo()
|
|
app := &cli.App{
|
|
Name: "D-Eyes",
|
|
Usage: "The Eyes of Darkness from Nsfocus spy on everything.",
|
|
Flags: []cli.Flag{
|
|
&cli.StringFlag{
|
|
Name: "path",
|
|
Aliases: []string{"P"},
|
|
Value: "C://",
|
|
Usage: "-P C:// (Only For Filescan)",
|
|
Destination: &path,
|
|
},
|
|
&cli.IntFlag{
|
|
Name: "pid",
|
|
Aliases: []string{"p"},
|
|
Value: -1,
|
|
Usage: "-p 666 (Only For processcan.'-1' means all processes.)",
|
|
Destination: &pid,
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "rule",
|
|
Aliases: []string{"r"},
|
|
Usage: "-r Ransom.Wannacrypt",
|
|
Destination: &rule,
|
|
},
|
|
&cli.IntFlag{
|
|
Name: "thread",
|
|
Aliases: []string{"t"},
|
|
Value: 5,
|
|
Usage: "-t 1 (Only For Filescan)",
|
|
Destination: &thread,
|
|
},
|
|
&cli.IntFlag{
|
|
Name: "vul",
|
|
Aliases: []string{"v"},
|
|
Usage: "-v 1 (1 is to check Exchange Server OWASSRF exploitation)",
|
|
Destination: &vulnerability,
|
|
},
|
|
},
|
|
Commands: []*cli.Command{
|
|
{
|
|
Name: "filescan",
|
|
Aliases: []string{"fs"},
|
|
Usage: "Command for scanning filesystem",
|
|
Flags: []cli.Flag{
|
|
&cli.StringFlag{
|
|
Name: "path",
|
|
Aliases: []string{"P"},
|
|
Value: "C://",
|
|
Usage: "--path C:// or -P C:// (Only For Filescan)",
|
|
Destination: &path,
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "rule",
|
|
Aliases: []string{"r"},
|
|
Usage: "--rule Ransom.Wannacrypt or -r Ransom.Wannacrypt",
|
|
Destination: &rule,
|
|
},
|
|
&cli.IntFlag{
|
|
Name: "thread",
|
|
Aliases: []string{"t"},
|
|
Value: 5,
|
|
Usage: "--thread 1 or -t 1",
|
|
Destination: &thread,
|
|
},
|
|
},
|
|
Action: func(c *cli.Context) error {
|
|
var paths []string
|
|
var r []output.Result
|
|
paths = strings.Split(path, ",")
|
|
var start = time.Now()
|
|
var sum = 0
|
|
|
|
if rule == "" {
|
|
yaraRule := srcPath + "yaraRules"
|
|
rules, err := yaraobj.LoadAllYaraRules(yaraRule)
|
|
if err != nil {
|
|
color.Redln("LoadCompiledRules goes error !!!")
|
|
color.Redln("GetRules err: ", err)
|
|
os.Exit(1)
|
|
}
|
|
for _, path := range paths {
|
|
files := filedetection.StartFileScan(path, rules, thread, &r)
|
|
sum += files
|
|
}
|
|
} else {
|
|
yaraRule := srcPath + "yaraRules\\" + rule + ".yar"
|
|
_, err := os.Lstat(yaraRule)
|
|
if err != nil {
|
|
color.Redln("There is no such rule yet !!!")
|
|
os.Exit(1)
|
|
}
|
|
rules, err := yaraobj.LoadSingleYaraRule(yaraRule)
|
|
if err != nil {
|
|
color.Redln("GetRules err: ", err)
|
|
os.Exit(1)
|
|
}
|
|
for _, path := range paths {
|
|
files := filedetection.StartFileScan(path, rules, thread, &r)
|
|
sum += files
|
|
}
|
|
}
|
|
|
|
if len(r) > 0 {
|
|
length := len(r)
|
|
categories := map[string]string{
|
|
"A1": "Risk Description", "B1": "Risk File Path",
|
|
}
|
|
var values = make(map[string]string)
|
|
vulsumTmp := 0
|
|
for i := 0; i < length; i++ {
|
|
vulsumTmp++
|
|
color.Error.Println("[ Risk ", vulsumTmp, " ]")
|
|
fmt.Print("Risk Description: ")
|
|
color.Warn.Println(r[i].Risk)
|
|
fmt.Println("Risk File Path: ")
|
|
color.Warn.Println(r[i].RiskPath)
|
|
//set excel values
|
|
excelValuetmpA := "A" + strconv.Itoa(vulsumTmp+1)
|
|
excelValuetmpB := "B" + strconv.Itoa(vulsumTmp+1)
|
|
values[excelValuetmpA] = r[i].Risk
|
|
values[excelValuetmpB] = r[i].RiskPath
|
|
}
|
|
//output to a excel
|
|
f := excelize.NewFile()
|
|
f.SetColWidth("Sheet1", "A", "B", 50)
|
|
for k, v := range categories {
|
|
f.SetCellValue("Sheet1", k, v)
|
|
}
|
|
for k, v := range values {
|
|
f.SetCellValue("Sheet1", k, v)
|
|
}
|
|
style, err := f.NewStyle(
|
|
&excelize.Style{
|
|
Font: &excelize.Font{
|
|
Bold: true,
|
|
Size: 11,
|
|
Color: "e83723",
|
|
},
|
|
},
|
|
)
|
|
if err != nil {
|
|
fmt.Println(err)
|
|
}
|
|
f.SetCellStyle("Sheet1", "A1", "A1", style)
|
|
f.SetCellStyle("Sheet1", "B1", "B1", style)
|
|
|
|
// save the result to Deyes.xlsx
|
|
if err := f.SaveAs(srcPath + "D-Eyes_FileResult.xlsx"); err != nil {
|
|
fmt.Println(err)
|
|
}
|
|
} else {
|
|
fmt.Println("\nNo suspicious files found. Your computer is safe with the rules you choose.")
|
|
}
|
|
|
|
var end = time.Now().Sub(start)
|
|
fmt.Println("Consuming Time: ", end, " Number of scanned files: ", sum)
|
|
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "processcan",
|
|
Aliases: []string{"ps"},
|
|
Usage: "Command for scanning processes",
|
|
Flags: []cli.Flag{
|
|
&cli.IntFlag{
|
|
Name: "pid",
|
|
Aliases: []string{"p"},
|
|
Value: -1,
|
|
Usage: "--pid 666 or -p 666 ('-1' means all processes.)",
|
|
Destination: &pid,
|
|
},
|
|
&cli.StringFlag{
|
|
Name: "rule",
|
|
Aliases: []string{"r"},
|
|
Usage: "--rule Ransom.Wannacrypt or -r Ransom.Wannacrypt",
|
|
Destination: &rule,
|
|
},
|
|
},
|
|
Action: func(c *cli.Context) error {
|
|
|
|
var start = time.Now()
|
|
// todo
|
|
//controller.ScanProcess(pid, rule, src_path)
|
|
var end = time.Now().Sub(start)
|
|
fmt.Println("Consuming Time: ", end)
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "host",
|
|
Usage: "Command for displaying basic host information",
|
|
Action: func(c *cli.Context) error {
|
|
color.Infoln("Host Info:")
|
|
info.DisplayBaseInfo()
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "users",
|
|
Usage: "Command for displaying all the users on the host",
|
|
Action: func(c *cli.Context) error {
|
|
color.Infoln("AllUsers:")
|
|
info.DisplayAllUsers()
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "top",
|
|
Usage: "Command for displaying the top 15 processes in CPU usage",
|
|
Action: func(c *cli.Context) error {
|
|
info.Top()
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "netstat",
|
|
Usage: "Command for displaying host network information",
|
|
Action: func(c *cli.Context) error {
|
|
color.Infoln("Network Info:")
|
|
info.DisplayNetStat(srcPath)
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "task",
|
|
Usage: "Command for displaying all the tasks on the host",
|
|
Action: func(c *cli.Context) error {
|
|
color.Infoln("Task:")
|
|
info.DisplayPlanTask()
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "autoruns",
|
|
Usage: "Command for displaying all the autoruns on the host",
|
|
Action: func(c *cli.Context) error {
|
|
color.Infoln("Autoruns:")
|
|
info.CallDisplayAutoruns()
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
Name: "export",
|
|
Usage: "Command for exporting basic host information",
|
|
Action: func(c *cli.Context) error {
|
|
info.SaveSummaryBaseInfo()
|
|
return nil
|
|
},
|
|
},
|
|
|
|
{
|
|
Name: "check",
|
|
Usage: "Command for checking vulnerability exploitation",
|
|
Flags: []cli.Flag{
|
|
&cli.IntFlag{
|
|
Name: "vulnerability",
|
|
Aliases: []string{"v"},
|
|
Usage: "-v 1 (1 is to check Exchange Server OWASSRF exploitation)",
|
|
Destination: &vulnerability,
|
|
},
|
|
},
|
|
Action: func(c *cli.Context) error {
|
|
switch vulnerability {
|
|
case 1:
|
|
var path string
|
|
if len(os.Args) > 4 {
|
|
path = os.Args[4]
|
|
}
|
|
info.CheckExchangeServerOWASSRF(path)
|
|
default:
|
|
fmt.Println("Please enter the number of vulnerability exploitation you want to check.")
|
|
fmt.Println()
|
|
color.Warn.Println("Currently supported vulnerability exploitation list:")
|
|
fmt.Println(" 1: Exchange Server OWASSRF")
|
|
fmt.Println()
|
|
fmt.Print("Like this, if you want to check 'Exchange Server OWASSRF' exploitation, just input ")
|
|
color.Warn.Println("'D-Eyes check -v 1'")
|
|
}
|
|
return nil
|
|
},
|
|
},
|
|
},
|
|
}
|
|
err := app.Run(os.Args)
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func SrcPath() string {
|
|
|
|
args := os.Args
|
|
lastIndex := strings.LastIndex(args[0], "\\")
|
|
cmdPath := args[0][0 : lastIndex+1]
|
|
currentDir, _ := os.Getwd()
|
|
|
|
dir, _ := os.ReadDir(currentDir)
|
|
for _, f := range dir {
|
|
if f.IsDir() {
|
|
if f.Name() == "yaraRules" {
|
|
return currentDir + "\\"
|
|
}
|
|
}
|
|
}
|
|
return cmdPath
|
|
}
|