admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
mftparser
volatilityfoundation-volati…/volatility/plugins/malware/cmdhistory.py
T
iMHLv2 e6ed7078f9 sync with r3581 of trunk
2014-01-17 14:21:55 -06:00

779 lines
33 KiB
Python
Raw Permalink Blame History

# Volatility
# Copyright (C) 2007-2013 Volatility Foundation
#
# Authors:
# Michael Hale Ligh <michael.ligh@mnin.org>
#
# Contributors/References:
# Richard Stevens and Eoghan Casey
# Extracting Windows Cmd Line Details from Physical Memory.
# http://ww.dfrws.org/2010/proceedings/stevens.pdf
#
# This file is part of Volatility.
#
# Volatility is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Volatility is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
#
import volatility.obj as obj
import volatility.plugins.common as common
import volatility.utils as utils
import volatility.win32.tasks as tasks
import volatility.debug as debug
MAX_HISTORY_DEFAULT = 50
#--------------------------------------------------------------------------------
# VTypes
#--------------------------------------------------------------------------------
# Windows 7 Types from conhost.exe
conhost_types_x86 = {
'_COMMAND': [ None, {
'CmdLength': [ 0x00, ['unsigned short']],
'Cmd' : [ 0x02, ['String', dict(encoding = 'utf16', length = lambda x : x.CmdLength)]],
}],
'_COMMAND_HISTORY': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'Flags' : [ 0x08, ['Flags', {'bitmap': {'Allocated': 0, 'Reset': 1}}]],
'Application': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
'CommandCount': [ 0x10, ['short']],
'LastAdded': [ 0x12, ['short']],
'LastDisplayed': [ 0x14, ['short']],
'FirstCommand': [ 0x16, ['short']],
'CommandCountMax': [ 0x18, ['short']],
'ProcessHandle': [ 0x1C, ['unsigned int']],
'PopupList': [ 0x20, ['_LIST_ENTRY']],
'CommandBucket': [ 0x28, ['array', lambda x : x.CommandCount, ['pointer', ['_COMMAND']]]],
}],
'_ALIAS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'SourceLength': [ 0x08, ['unsigned short']],
'TargetLength': [ 0x0A, ['unsigned short']],
'Source': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.SourceLength)]]],
'Target': [ 0x10, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.TargetLength)]]],
}],
'_EXE_ALIAS_LIST' : [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ExeLength': [ 0x08, ['unsigned short']],
'ExeName': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.ExeLength * 2)]]],
'AliasList': [ 0x10, ['_LIST_ENTRY']],
}],
'_POPUP_LIST' : [ None, {
'ListEntry' : [ 0x00, ['_LIST_ENTRY']],
}],
'_CONSOLE_INFORMATION': [ None, {
'CurrentScreenBuffer': [ 0x98, ['pointer', ['_SCREEN_INFORMATION']]],
'ScreenBuffer': [ 0x9C, ['pointer', ['_SCREEN_INFORMATION']]],
'HistoryList': [ 0xD4, ['_LIST_ENTRY']],
'ProcessList': [ 0x18, ['_LIST_ENTRY']], # GetConsoleProcessList()
'ExeAliasList': [ 0xDC, ['_LIST_ENTRY']], # GetConsoleAliasExes()
'HistoryBufferCount': [ 0xE4, ['unsigned short']], # GetConsoleHistoryInfo()
'HistoryBufferMax': [ 0xE6, ['unsigned short']], # GetConsoleHistoryInfo()
'CommandHistorySize': [ 0xE8, ['unsigned short']],
'OriginalTitle': [ 0xEC, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]], # GetConsoleOriginalTitle()
'Title': [ 0xF0, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]], # GetConsoleTitle()
}],
'_CONSOLE_PROCESS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ProcessHandle': [ 0x8, ['unsigned int']],
}],
'_SCREEN_INFORMATION': [ None, {
'ScreenX': [ 0x08, ['short']],
'ScreenY': [ 0x0A, ['short']],
'Rows': [ 0x3C, ['pointer', ['array', lambda x : x.ScreenY, ['_ROW']]]],
'Next': [ 0xDC, ['pointer', ['_SCREEN_INFORMATION']]],
}],
'_ROW': [ 0x1C, {
'Chars': [ 0x08, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
}
# Windows 7 Types from conhost.exe
conhost_types_x64 = {
'_COMMAND': [ None, {
'CmdLength': [ 0x00, ['unsigned short']],
'Cmd' : [ 0x02, ['String', dict(encoding = 'utf16', length = lambda x : x.CmdLength)]],
}],
'_COMMAND_HISTORY': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'Flags' : [ 0x10, ['Flags', {'bitmap': {'Allocated': 0, 'Reset': 1}}]], # AllocateCommandHistory()
'Application': [ 0x18, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]], # AllocateCommandHistory()
'CommandCount': [ 0x20, ['short']],
'LastAdded': [ 0x22, ['short']],
'LastDisplayed': [ 0x24, ['short']],
'FirstCommand': [ 0x26, ['short']],
'CommandCountMax': [ 0x28, ['short']], # AllocateCommandHistory()
'ProcessHandle': [ 0x30, ['address']], # AllocateCommandHistory()
'PopupList': [ 0x38, ['_LIST_ENTRY']], # AllocateCommandHistory()
'CommandBucket': [ 0x48, ['array', lambda x : x.CommandCount, ['pointer', ['_COMMAND']]]],
}],
'_ALIAS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'SourceLength': [ 0x10, ['unsigned short']], # AddAlias()
'TargetLength': [ 0x12, ['unsigned short']], # AddAlias()
'Source': [ 0x18, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.SourceLength)]]], # AddAlias()
'Target': [ 0x20, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.TargetLength)]]], # AddAlias()
}],
'_EXE_ALIAS_LIST' : [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ExeLength': [ 0x10, ['unsigned short']], # AddExeAliasList()
'ExeName': [ 0x18, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.ExeLength * 2)]]], # AddExeAliasList()
'AliasList': [ 0x20, ['_LIST_ENTRY']], # AddExeAliasList()
}],
'_POPUP_LIST' : [ None, {
'ListEntry' : [ 0x00, ['_LIST_ENTRY']],
}],
'_CONSOLE_INFORMATION': [ None, {
'ProcessList': [ 0x28, ['_LIST_ENTRY']], # SrvGetConsoleProcessList()
'CurrentScreenBuffer': [ 0xE0, ['pointer', ['_SCREEN_INFORMATION']]], # AllocateConsole()
'ScreenBuffer': [ 0xE8, ['pointer', ['_SCREEN_INFORMATION']]], # AllocateConsole()
'HistoryList': [ 0x148, ['_LIST_ENTRY']], # AllocateCommandHistory()
'ExeAliasList': [ 0x158, ['_LIST_ENTRY']], # SrvGetConsoleAliasExes()
'HistoryBufferCount': [ 0x168, ['unsigned short']], # AllocateConsole()
'HistoryBufferMax': [ 0x16A, ['unsigned short']], # AllocateConsole()
'CommandHistorySize': [ 0x16C, ['unsigned short']], # AllocateConsole()
'OriginalTitle': [ 0x170, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]], # SrvGetConsoleTitle()
'Title': [ 0x178, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]], # SrvGetConsoleTitle()
}],
'_CONSOLE_PROCESS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ProcessHandle': [ 0x10, ['unsigned int']], # FindProcessInList()
}],
'_SCREEN_INFORMATION': [ None, {
'ScreenX': [ 8, ['short']],
'ScreenY': [ 10, ['short']],
'Rows': [ 0x48, ['pointer', ['array', lambda x : x.ScreenY, ['_ROW']]]],
'Next': [ 0x128, ['pointer', ['_SCREEN_INFORMATION']]],
}],
'_ROW': [ 0x28, {
'Chars': [ 0x08, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
}
# Windows XP, 2003, 2008, Vista from winsrv.dll
winsrv_types_x86 = {
'_COMMAND': [ None, {
'CmdLength': [ 0x00, ['unsigned short']],
'Cmd' : [ 0x02, ['String', dict(encoding = 'utf16', length = lambda x : x.CmdLength)]],
}],
'_COMMAND_HISTORY': [ None, {
'Flags' : [ 0x00, ['Flags', {'bitmap': {'Allocated': 0, 'Reset': 1}}]],
'ListEntry': [ 0x04, ['_LIST_ENTRY']],
'Application': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
'CommandCount': [ 0x10, ['short']],
'LastAdded': [ 0x12, ['short']],
'LastDisplayed': [ 0x14, ['short']],
'FirstCommand': [ 0x16, ['short']],
'CommandCountMax': [ 0x18, ['short']],
'ProcessHandle': [ 0x1C, ['unsigned int']],
'PopupList': [ 0x20, ['_LIST_ENTRY']],
'CommandBucket': [ 0x28, ['array', lambda x : x.CommandCount, ['pointer', ['_COMMAND']]]],
}],
'_ALIAS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'SourceLength': [ 0x08, ['unsigned short']],
'TargetLength': [ 0x0A, ['unsigned short']],
'Source': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.SourceLength)]]],
'Target': [ 0x10, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.TargetLength)]]],
}],
'_EXE_ALIAS_LIST' : [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ExeLength': [ 0x08, ['unsigned short']],
'ExeName': [ 0x0C, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.ExeLength * 2)]]],
'AliasList': [ 0x10, ['_LIST_ENTRY']],
}],
'_POPUP_LIST' : [ None, {
'ListEntry' : [ 0x00, ['_LIST_ENTRY']],
}],
'_CONSOLE_INFORMATION': [ None, {
'CurrentScreenBuffer': [ 0xB0, ['pointer', ['_SCREEN_INFORMATION']]],
'ScreenBuffer': [ 0xB4, ['pointer', ['_SCREEN_INFORMATION']]],
'HistoryList': [ 0x108, ['_LIST_ENTRY']],
'ProcessList': [ 0x100, ['_LIST_ENTRY']],
'ExeAliasList': [ 0x110, ['_LIST_ENTRY']],
'HistoryBufferCount': [ 0x118, ['unsigned short']],
'HistoryBufferMax': [ 0x11A, ['unsigned short']],
'CommandHistorySize': [ 0x11C, ['unsigned short']],
'OriginalTitle': [ 0x124, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
'Title': [ 0x128, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
'_CONSOLE_PROCESS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ProcessHandle': [ 0x08, ['unsigned int']],
'Process': [ 0x0C, ['pointer', ['_CSR_PROCESS']]],
}],
'_SCREEN_INFORMATION': [ None, {
'Console': [ 0x00, ['pointer', ['_CONSOLE_INFORMATION']]],
'ScreenX': [ 0x24, ['short']],
'ScreenY': [ 0x26, ['short']],
'Rows': [ 0x58, ['pointer', ['array', lambda x : x.ScreenY, ['_ROW']]]],
'Next': [ 0xF8, ['pointer', ['_SCREEN_INFORMATION']]],
}],
'_ROW': [ 0x1C, {
'Chars': [ 0x08, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
'_CSR_PROCESS' : [ 0x60, { # this is a public PDB
'ClientId' : [ 0x0, ['_CLIENT_ID']],
'ListLink' : [ 0x8, ['_LIST_ENTRY']],
'ThreadList' : [ 0x10, ['_LIST_ENTRY']],
'NtSession' : [ 0x18, ['pointer', ['_CSR_NT_SESSION']]],
'ClientPort' : [ 0x1c, ['pointer', ['void']]],
'ClientViewBase' : [ 0x20, ['pointer', ['unsigned char']]],
'ClientViewBounds' : [ 0x24, ['pointer', ['unsigned char']]],
'ProcessHandle' : [ 0x28, ['pointer', ['void']]],
'SequenceNumber' : [ 0x2c, ['unsigned long']],
'Flags' : [ 0x30, ['unsigned long']],
'DebugFlags' : [ 0x34, ['unsigned long']],
'ReferenceCount' : [ 0x38, ['unsigned long']],
'ProcessGroupId' : [ 0x3c, ['unsigned long']],
'ProcessGroupSequence' : [ 0x40, ['unsigned long']],
'LastMessageSequence' : [ 0x44, ['unsigned long']],
'NumOutstandingMessages' : [ 0x48, ['unsigned long']],
'ShutdownLevel' : [ 0x4c, ['unsigned long']],
'ShutdownFlags' : [ 0x50, ['unsigned long']],
'Luid' : [ 0x54, ['_LUID']],
'ServerDllPerProcessData' : [ 0x5c, ['array', 1, ['pointer', ['void']]]],
}],
}
winsrv_types_x64 = {
'_COMMAND': [ None, {
'CmdLength': [ 0x00, ['unsigned short']],
'Cmd' : [ 0x02, ['String', dict(encoding = 'utf16', length = lambda x : x.CmdLength)]],
}],
'_COMMAND_HISTORY': [ None, {
'Flags' : [ 0x00, ['Flags', {'bitmap': {'Allocated': 0, 'Reset': 1}}]],
'ListEntry': [ 0x08, ['_LIST_ENTRY']],
'Application': [ 0x18, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
'CommandCount': [ 0x20, ['short']],
'LastAdded': [ 0x22, ['short']],
'LastDisplayed': [ 0x24, ['short']],
'FirstCommand': [ 0x26, ['short']],
'CommandCountMax': [ 0x28, ['short']],
'ProcessHandle': [ 0x30, ['unsigned int']],
'PopupList': [ 0x38, ['_LIST_ENTRY']],
'CommandBucket': [ 0x48, ['array', lambda x : x.CommandCount, ['pointer', ['_COMMAND']]]],
}],
'_ALIAS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'SourceLength': [ 0x10, ['unsigned short']],
'TargetLength': [ 0x12, ['unsigned short']],
'Source': [ 0x14, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.SourceLength)]]],
'Target': [ 0x1C, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.TargetLength)]]],
}],
'_EXE_ALIAS_LIST' : [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ExeLength': [ 0x10, ['unsigned short']],
'ExeName': [ 0x12, ['pointer', ['String', dict(encoding = 'utf16', length = lambda x : x.ExeLength * 2)]]],
'AliasList': [ 0x1A, ['_LIST_ENTRY']],
}],
'_POPUP_LIST' : [ None, {
'ListEntry' : [ 0x00, ['_LIST_ENTRY']],
}],
'_CONSOLE_INFORMATION': [ None, {
'CurrentScreenBuffer': [ 0xE8, ['pointer', ['_SCREEN_INFORMATION']]],
'ScreenBuffer': [ 0xF0, ['pointer', ['_SCREEN_INFORMATION']]],
'HistoryList': [ 0x188, ['_LIST_ENTRY']],
'ProcessList': [ 0x178, ['_LIST_ENTRY']],
'ExeAliasList': [ 0x198, ['_LIST_ENTRY']],
'HistoryBufferCount': [ 0x1A8, ['unsigned short']],
'HistoryBufferMax': [ 0x1AA, ['unsigned short']],
'CommandHistorySize': [ 0x1AC, ['unsigned short']],
'OriginalTitle': [ 0x1B0, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
'Title': [ 0x1B8, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
'_CONSOLE_PROCESS': [ None, {
'ListEntry': [ 0x00, ['_LIST_ENTRY']],
'ProcessHandle': [ 0x10, ['unsigned int']],
'Process': [ 0x18, ['pointer', ['_CSR_PROCESS']]],
}],
'_SCREEN_INFORMATION': [ None, {
'Console': [ 0x00, ['pointer', ['_CONSOLE_INFORMATION']]],
'ScreenX': [ 0x28, ['short']],
'ScreenY': [ 0x2A, ['short']],
'Rows': [ 0x68, ['pointer', ['array', lambda x : x.ScreenY, ['_ROW']]]],
'Next': [ 0x128, ['pointer', ['_SCREEN_INFORMATION']]],
}],
'_ROW': [ 0x28, {
'Chars': [ 0x08, ['pointer', ['String', dict(encoding = 'utf16', length = 256)]]],
}],
'_CSR_PROCESS' : [ 0x60, { # this is a public PDB
'ClientId' : [ 0x0, ['_CLIENT_ID']],
'ListLink' : [ 0x8, ['_LIST_ENTRY']],
'ThreadList' : [ 0x10, ['_LIST_ENTRY']],
'NtSession' : [ 0x18, ['pointer', ['_CSR_NT_SESSION']]],
'ClientPort' : [ 0x1c, ['pointer', ['void']]],
'ClientViewBase' : [ 0x20, ['pointer', ['unsigned char']]],
'ClientViewBounds' : [ 0x24, ['pointer', ['unsigned char']]],
'ProcessHandle' : [ 0x28, ['pointer', ['void']]],
'SequenceNumber' : [ 0x2c, ['unsigned long']],
'Flags' : [ 0x30, ['unsigned long']],
'DebugFlags' : [ 0x34, ['unsigned long']],
'ReferenceCount' : [ 0x38, ['unsigned long']],
'ProcessGroupId' : [ 0x3c, ['unsigned long']],
'ProcessGroupSequence' : [ 0x40, ['unsigned long']],
'LastMessageSequence' : [ 0x44, ['unsigned long']],
'NumOutstandingMessages' : [ 0x48, ['unsigned long']],
'ShutdownLevel' : [ 0x4c, ['unsigned long']],
'ShutdownFlags' : [ 0x50, ['unsigned long']],
'Luid' : [ 0x54, ['_LUID']],
'ServerDllPerProcessData' : [ 0x5c, ['array', 1, ['pointer', ['void']]]],
}],
}
#--------------------------------------------------------------------------------
# Object Classes
#--------------------------------------------------------------------------------
class _CONSOLE_INFORMATION(obj.CType):
""" object class for console information structs """
def get_histories(self):
for hist in self.HistoryList.list_of_type("_COMMAND_HISTORY", "ListEntry"):
yield hist
def get_exe_aliases(self):
"""Generator for exe aliases.
There is one _EXE_ALIAS_LIST for each executable
(i.e. C:\windows\system32\cmd.exe) with registered
aliases. The _EXE_ALIAS_LIST.AliasList contains
one _ALIAS structure for each specific mapping.
See GetConsoleAliasExes, GetConsoleAliases, and
AddConsoleAlias.
"""
for exe_alias in self.ExeAliasList.list_of_type("_EXE_ALIAS_LIST", "ListEntry"):
yield exe_alias
def get_processes(self):
"""Generator for processes attached to the console.
Multiple processes can be attached to the same
console (usually as a result of inheritance from a
parent process or by duplicating another process's
console handle). Internally, they are tracked as
_CONSOLE_PROCESS structures in this linked list.
See GetConsoleProcessList and AttachConsole.
"""
for h in self.ProcessList.list_of_type("_CONSOLE_PROCESS", "ListEntry"):
yield h
def get_screens(self):
"""Generator for screens in the console.
A console can have multiple screen buffers at a time,
but only the current/active one is displayed.
Multiple screens are tracked using the singly-linked
list _SCREEN_INFORMATION.Next.
See CreateConsoleScreenBuffer
"""
screens = [self.CurrentScreenBuffer]
if self.ScreenBuffer not in screens:
screens.append(self.ScreenBuffer)
for screen in screens:
cur = screen
while cur and cur.v() != 0:
yield cur
cur = cur.Next.dereference()
class _CONSOLE_PROCESS(obj.CType):
""" object class for console process """
def reference_object_by_handle(self):
""" Given a process handle, return a reference to
the _EPROCESS object. This function is similar to
the kernel API ObReferenceObjectByHandle. """
console_information = self.obj_parent
parent_process = console_information.obj_parent
for h in parent_process.ObjectTable.handles():
if h.HandleValue == self.ProcessHandle:
return h.dereference_as("_EPROCESS")
return obj.NoneObject("Could not find process in handle table")
class _SCREEN_INFORMATION(obj.CType):
""" object class for screen information """
def get_buffer(self, truncate = True):
"""Get the screen buffer.
The screen buffer is comprised of the screen's Y
coordinate which tells us the number of rows and
the X coordinate which tells us the width of each
row in characters. These together provide all of
the input and output that users see when the
console is displayed.
@param truncate: True if the empty rows at the
end (i.e. bottom) of the screen buffer should be
supressed.
"""
rows = []
for _, row in enumerate(self.Rows.dereference()):
if row.Chars.is_valid():
rows.append(str(row.Chars.dereference())[0:self.ScreenX])
# To truncate empty rows at the end, walk the list
# backwards and get the last non-empty row. Use that
# row index to splice. An "empty" row isn't just ""
# as one might assume. It is actually ScreenX number
# of space characters
if truncate:
non_empty_index = 0
for index, row in enumerate(reversed(rows)):
## It seems that when the buffer width is greater than 128
## characters, its truncated to 128 in memory.
if row.count(" ") != min(self.ScreenX, 128):
non_empty_index = index
break
if non_empty_index == 0:
rows = []
else:
rows = rows[0:len(rows) - non_empty_index]
return rows
class _EXE_ALIAS_LIST(obj.CType):
""" object class for alias lists """
def get_aliases(self):
"""Generator for the individual aliases for a
particular executable."""
for alias in self.AliasList.list_of_type("_ALIAS", "ListEntry"):
yield alias
class _COMMAND_HISTORY(obj.CType):
""" object class for command histories """
def is_valid(self, max_history = MAX_HISTORY_DEFAULT): #pylint: disable-msg=W0221
"""Override BaseObject.is_valid with some additional
checks specific to _COMMAND_HISTORY objects."""
if not obj.CType.is_valid(self):
return False
# The count must be between zero and max
if self.CommandCount < 0 or self.CommandCount > max_history:
return False
# Last added must be between -1 and max
if self.LastAdded < -1 or self.LastAdded > max_history:
return False
# Last displayed must be between -1 and max
if self.LastDisplayed < -1 or self.LastDisplayed > max_history:
return False
# First command must be between zero and max
if self.FirstCommand < 0 or self.FirstCommand > max_history:
return False
# Validate first command with last added
if self.FirstCommand != 0 and self.FirstCommand != self.LastAdded + 1:
return False
# Process handle must be a valid pid
if self.ProcessHandle <= 0 or self.ProcessHandle > 0xFFFF:
return False
Popup = obj.Object("_POPUP_LIST", offset = self.PopupList.Flink,
vm = self.obj_vm)
# Check that the popup list entry is in tact
if Popup.ListEntry.Blink != self.PopupList.obj_offset:
return False
return True
def get_commands(self):
"""Generator for commands in the history buffer.
The CommandBucket is an array of pointers to _COMMAND
structures. The array size is CommandCount. Once CommandCount
is reached, the oldest commands are cycled out and the
rest are coalesced.
"""
for i, cmd in enumerate(self.CommandBucket):
if cmd:
yield i, cmd.dereference()
#--------------------------------------------------------------------------------
# Profile Modifications
#--------------------------------------------------------------------------------
class CmdHistoryVTypesx86(obj.ProfileModification):
"""This modification applies the vtypes for 32bit
Windows up to Windows 7."""
before = ['WindowsObjectClasses']
def check(self, profile):
m = profile.metadata
return (m.get('os', None) == 'windows' and
m.get('memory_model', '32bit') == '32bit' and
(m.get('major') < 6 or (m.get('major') == 6 and m.get('minor') < 1)))
def modification(self, profile):
profile.vtypes.update(winsrv_types_x86)
class CmdHistoryVTypesx64(obj.ProfileModification):
"""This modification applies the vtypes for 64bit
Windows up to Windows 7."""
before = ['WindowsObjectClasses']
def check(self, profile):
m = profile.metadata
return (m.get('os', None) == 'windows' and
m.get('memory_model', '32bit') == '64bit' and
(m.get('major') < 6 or (m.get('major') == 6 and m.get('minor') < 1)))
def modification(self, profile):
profile.vtypes.update(winsrv_types_x64)
class CmdHistoryVTypesWin7x86(obj.ProfileModification):
"""This modification applies the vtypes for 32bit
Windows starting with Windows 7."""
before = ['WindowsObjectClasses']
conditions = {'os': lambda x: x == 'windows',
'major': lambda x: x == 6,
'minor': lambda x: x >= 1,
'memory_model': lambda x : x == '32bit'}
def modification(self, profile):
profile.vtypes.update(conhost_types_x86)
class CmdHistoryVTypesWin7x64(obj.ProfileModification):
"""This modification applies the vtypes for 64bit
Windows starting with Windows 7."""
before = ['WindowsObjectClasses']
conditions = {'os': lambda x: x == 'windows',
'major': lambda x: x == 6,
'minor': lambda x: x >= 1,
'memory_model': lambda x : x == '64bit'}
def modification(self, profile):
profile.vtypes.update(conhost_types_x64)
class CmdHistoryObjectClasses(obj.ProfileModification):
"""This modification applies the object classes for all
versions of 32bit Windows."""
before = ['WindowsObjectClasses']
conditions = {'os': lambda x: x == 'windows'}
# 'memory_model': lambda x : x == '32bit'}
def modification(self, profile):
profile.object_classes.update({
'_CONSOLE_INFORMATION': _CONSOLE_INFORMATION,
'_SCREEN_INFORMATION': _SCREEN_INFORMATION,
'_EXE_ALIAS_LIST': _EXE_ALIAS_LIST,
'_COMMAND_HISTORY': _COMMAND_HISTORY,
'_CONSOLE_PROCESS': _CONSOLE_PROCESS,
})
#--------------------------------------------------------------------------------
# CmdScan Plugin
#--------------------------------------------------------------------------------
class CmdScan(common.AbstractWindowsCommand):
"""Extract command history by scanning for _COMMAND_HISTORY"""
def __init__(self, config, *args, **kwargs):
common.AbstractWindowsCommand.__init__(self, config, *args, **kwargs)
# The default comes from HKCU\Console\HistoryBufferSize
config.add_option('MAX_HISTORY', short_option = 'M', default = MAX_HISTORY_DEFAULT,
action = 'store', type = 'int',
help = 'CommandCountMax (default = 50)')
def cmdhistory_process_filter(self, addr_space):
"""Generator for processes that might contain command
history information.
Takes into account if we're on Windows 7 or an earlier
operator system.
@param addr_space: a kernel address space.
"""
# Detect if we're on windows seven
use_conhost = (6, 1) <= (addr_space.profile.metadata.get('major', 0),
addr_space.profile.metadata.get('minor', 0))
for task in tasks.pslist(addr_space):
process_name = str(task.ImageFileName).lower()
# The process we select is conhost on Win7 or csrss for others
if ((use_conhost and process_name == "conhost.exe") or
(not use_conhost and process_name == "csrss.exe")):
yield task
def calculate(self):
"""The default pattern we search for, as described by Stevens and Casey,
is "\x32\x00". That's because CommandCountMax is a little-endian
unsigned short whose default value is 50. However, that value can be
changed by right clicking cmd.exe and going to Properties->Options->Cmd History
or by calling the API function kernel32!SetConsoleHistoryInfo. Thus
you can tweak the search criteria by using the --MAX_HISTORY.
"""
addr_space = utils.load_as(self._config)
MAX_HISTORY = self._config.MAX_HISTORY
srch_pattern = chr(MAX_HISTORY) + "\x00"
for task in self.cmdhistory_process_filter(addr_space):
process_space = task.get_process_address_space()
for found in task.search_process_memory([srch_pattern]):
hist = obj.Object("_COMMAND_HISTORY",
vm = process_space,
offset = found - addr_space.profile.\
get_obj_offset("_COMMAND_HISTORY", "CommandCountMax"))
if hist.is_valid(max_history = MAX_HISTORY):
yield task, hist
def render_text(self, outfd, data):
for task, hist in data:
outfd.write("*" * 50 + "\n")
outfd.write("CommandProcess: {0} Pid: {1}\n".format(
task.ImageFileName, task.UniqueProcessId))
outfd.write("CommandHistory: {0:#x} Application: {1} Flags: {2}\n".format(
hist.obj_offset, hist.Application.dereference(),
hist.Flags))
outfd.write("CommandCount: {0} LastAdded: {1} LastDisplayed: {2}\n".format(
hist.CommandCount, hist.LastAdded, hist.LastDisplayed))
outfd.write("FirstCommand: {0} CommandCountMax: {1}\n".format(
hist.FirstCommand, hist.CommandCountMax))
outfd.write("ProcessHandle: {0:#x}\n".format(hist.ProcessHandle))
# If the _COMMAND_HISTORY is in use, we would only take
# hist.CommandCount but since we're brute forcing, try the
# maximum and hope that some slots were not overwritten
# or zero-ed out.
pointers = obj.Object("Array", targetType = "address",
count = hist.CommandCountMax,
offset = hist.obj_offset +
hist.obj_vm.profile.get_obj_offset("_COMMAND_HISTORY", "CommandBucket"),
vm = hist.obj_vm)
for i, p in enumerate(pointers):
cmd = p.dereference_as("_COMMAND")
if cmd and str(cmd.Cmd):
outfd.write("Cmd #{0} @ {1:#x}: {2}\n".format(
i, cmd.obj_offset, str(cmd.Cmd)))
#--------------------------------------------------------------------------------
# Consoles Plugin
#--------------------------------------------------------------------------------
class Consoles(CmdScan):
"""Extract command history by scanning for _CONSOLE_INFORMATION"""
def __init__(self, config, *args, **kwargs):
CmdScan.__init__(self, config, *args, **kwargs)
# The default comes from HKCU\Console\NumberOfHistoryBuffers
config.add_option('HISTORY_BUFFERS', short_option = 'B', default = 4,
action = 'store', type = 'int',
help = 'HistoryBufferMax (default = 4)')
def calculate(self):
addr_space = utils.load_as(self._config)
srch_pattern = chr(self._config.MAX_HISTORY) + "\x00"
for task in self.cmdhistory_process_filter(addr_space):
for found in task.search_process_memory([srch_pattern]):
console = obj.Object("_CONSOLE_INFORMATION",
offset = found -
addr_space.profile.get_obj_offset("_CONSOLE_INFORMATION", "CommandHistorySize"),
vm = task.get_process_address_space(),
parent = task)
if (console.HistoryBufferMax != self._config.HISTORY_BUFFERS or
console.HistoryBufferCount > self._config.HISTORY_BUFFERS):
continue
# Check the first command history as the final constraint
history = obj.Object("_COMMAND_HISTORY",
offset = console.HistoryList.Flink.dereference().obj_offset -
addr_space.profile.get_obj_offset("_COMMAND_HISTORY", "ListEntry"),
vm = task.get_process_address_space())
if history.CommandCountMax != self._config.MAX_HISTORY:
continue
yield task, console
def render_text(self, outfd, data):
for task, console in data:
outfd.write("*" * 50 + "\n")
outfd.write("ConsoleProcess: {0} Pid: {1}\n".format(
task.ImageFileName, task.UniqueProcessId))
outfd.write("Console: {0:#x} CommandHistorySize: {1}\n".format(
console.obj_offset, console.CommandHistorySize))
outfd.write("HistoryBufferCount: {0} HistoryBufferMax: {1}\n".format(
console.HistoryBufferCount, console.HistoryBufferMax))
outfd.write("OriginalTitle: {0}\n".format(console.OriginalTitle.dereference()))
outfd.write("Title: {0}\n".format(console.Title.dereference()))
for console_proc in console.get_processes():
process = console_proc.reference_object_by_handle()
if process:
outfd.write("AttachedProcess: {0} Pid: {1} Handle: {2:#x}\n".format(
process.ImageFileName, process.UniqueProcessId,
console_proc.ProcessHandle))
for hist in console.get_histories():
outfd.write("----\n")
outfd.write("CommandHistory: {0:#x} Application: {1} Flags: {2}\n".format(
hist.obj_offset, hist.Application.dereference(),
hist.Flags))
outfd.write("CommandCount: {0} LastAdded: {1} LastDisplayed: {2}\n".format(
hist.CommandCount, hist.LastAdded, hist.LastDisplayed))
outfd.write("FirstCommand: {0} CommandCountMax: {1}\n".format(
hist.FirstCommand, hist.CommandCountMax))
outfd.write("ProcessHandle: {0:#x}\n".format(hist.ProcessHandle))
for i, cmd in hist.get_commands():
if cmd.Cmd:
outfd.write("Cmd #{0} at {1:#x}: {2}\n".format(
i, cmd.obj_offset, str(cmd.Cmd)))
for exe_alias in console.get_exe_aliases():
for alias in exe_alias.get_aliases():
outfd.write("----\n")
outfd.write("Alias: {0} Source: {1} Target: {2}\n".format(
exe_alias.ExeName.dereference(), alias.Source.dereference(),
alias.Target.dereference()))
for screen in console.get_screens():
outfd.write("----\n")
outfd.write("Screen {0:#x} X:{1} Y:{2}\n".format(
screen.dereference(), screen.ScreenX, screen.ScreenY))
outfd.write("Dump:\n{0}\n".format('\n'.join(screen.get_buffer())))
Reference in New Issue View Git Blame Copy Permalink