root/capture-mod/trunk/CaptureSoapServer.cpp

/*
**Created by Xeno Kovah of the MITRE HoneyClient Project 5/20/2008
*/

#include "CaptureSoapServer.h"
#include "soapH.h"
#include "capture.nsmap" 
#include "Visitor.h"
#include "b64.h" //nice small 3rd party lib for base64 encode/decode

//Only global so that the destructors can be used in ~CaptureSoapServer
//Didn't go in the class definition because adding soapH.h to CaptureSoapServer.h caused compile issues
//that I didn't want to deal with
struct soap soap;

std::list<struct ns__regkey> regList;
std::list<struct ns__regkey> regDeallocList;
std::list<struct ns__processFile> fileList;
std::list<struct ns__processFile> fileDeallocList;
std::list<struct ns__osProcess> procList;
std::list<struct ns__osProcess> procDeallocList;
void dealloc_events(); //For cleaning up when we're done with them

CaptureSoapServer::CaptureSoapServer(Visitor* v, RegistryMonitor * r, FileMonitor * f, ProcessMonitor * p){
    registryMonitor = r;
    fileMonitor = f;
    processMonitor = p;
    CaptureSoapServerThread = new Thread(this);
    CaptureSoapServerThread->start("CaptureSoapServer");
}

CaptureSoapServer::~CaptureSoapServer(){
    soap_destroy(&soap);
    soap_end(&soap);
    soap_done(&soap);
}

void
CaptureSoapServer::run(){

    char debug = 0;
   SOCKET m, s; // master and slave sockets

    onProcessEventConnection = processMonitor->connect_onProcessEvent(boost::bind(&CaptureSoapServer::onProcessEvent, this, _1, _2, _3, _4, _5, _6));
    onRegistryEventConnection = registryMonitor->connect_onRegistryEvent(boost::bind(&CaptureSoapServer::onRegistryEvent, this, _1, _2, _3, _4, _5));
    onFileEventConnection = fileMonitor->connect_onFileEvent(boost::bind(&CaptureSoapServer::onFileEvent, this, _1, _2, _3, _4, _5));

   //The below code is taken mostly from the gsoap standalone server example page
   soap_init(&soap);
   //TODO: change this to the desired port
   m = soap_bind(&soap, "0.0.0.0", 1234, 100);
   if (m < 0)
      soap_print_fault(&soap, stderr);
   else
   {
      if(debug) fprintf(stderr, "Socket connection successful: master socket = %d\n", m);
      for (int i = 1; ; i++)
      {
         s = soap_accept(&soap);
         if (s < 0)
         {
            soap_print_fault(&soap, stderr);
            break;
         }
         if(debug) fprintf(stderr, "%d: accepted connection from IP=%d.%d.%d.%d socket=%d\n", i,
            (soap.ip >> 24)&0xFF, (soap.ip >> 16)&0xFF, (soap.ip >> 8)&0xFF, soap.ip&0xFF, s);
         if (soap_serve(&soap) != SOAP_OK) // process RPC request
            soap_print_fault(&soap, stderr); // print error
         if(debug) fprintf(stderr, "you got served!\n");
         soap_destroy(&soap); // clean up class instances
         soap_end(&soap); // clean up everything and close socket
         dealloc_events(); //Need to clean up any memory we malloced for events
      }
   }
   soap_done(&soap); // close master socket and detach environment
}

//From RegistryMonitor.cpp
//registry event extra.at(0) == PID
//registry event extra.at(1) == name of registry value
//registry event extra.at(2) == registry value type
//registry event extra.at(3) == registry value data (if any)
void CaptureSoapServer::onRegistryEvent (wstring registryEventType, wstring time, 
                                        wstring processPath, wstring registryEventPath, 
                                        vector<wstring> extra)
{
    char debug = 0;
    if(debug) printf("CaptureSoapServer::onRegistryEvent got an event for time = %ls, length = %d\n", time.c_str(), time.length());

    //now begins the arduous process of converting the values into char *s
    ns__regkey_t r;
    r.created_at = (char *)malloc(time.length()+1);
    sprintf(r.created_at, "%ls", time.c_str());

    r.event_type = (char *)malloc(registryEventType.length()+1);
    sprintf(r.event_type, "%ls", registryEventType.c_str());

    char * tmp = (char *)malloc(extra.at(0).length()+1);
    sprintf(tmp, "%ls", extra.at(0).c_str());
    r.pid = atoi(tmp);
    free(tmp);

    r.proc_name = (char *)malloc(processPath.length()+1);
    sprintf(r.proc_name, "%ls", processPath.c_str());

    r.name = (char *)malloc(registryEventPath.length()+1);
    sprintf(r.name, "%ls", registryEventPath.c_str());

    r.value_name = (char *)malloc(extra.at(1).length()+1);
    sprintf(r.value_name, "%ls", extra.at(1).c_str());

    r.value_type = (char *)malloc(extra.at(2).length()+1);
    sprintf(r.value_type, "%ls", extra.at(2).c_str());

    r.value = (char *)malloc(extra.at(3).length()+1);
    sprintf(r.value, "%ls", extra.at(3).c_str());
    
    if(debug){
        int * b = (int *)&r;
        for(int i = 0; i < 8; i++){
            printf("r[%d] = %#x\n", i, b[i]);
        }
    }

    regList.push_back(r);
    if(debug) printf("added one event to regList. Now there are %d elements in the list\n", regList.size());
}

//From FileMonitor.cpp
//file event extra.at(0) == PID
void CaptureSoapServer::onFileEvent(wstring fileEventType, wstring time, 
                                    wstring processPath, wstring fileEventPath, 
                                    vector<wstring> extra)
{
    char debug = 0;
    if(debug) printf("CaptureSoapServer::onFileEvent got an event for time = %ls\n", time.c_str());
    ns__processFile_t f;
    f.created_at = (char *)malloc(time.length()+1);
    sprintf(f.created_at, "%ls", time.c_str());

    f.event_type = (char *)malloc(fileEventType.length()+1);
    sprintf(f.event_type, "%ls", fileEventType.c_str());

    char * tmp = (char *)malloc(extra.at(0).length()+1);
    sprintf(tmp, "%ls", extra.at(0).c_str());
    f.pid = atoi(tmp);
    free(tmp);

    f.proc_name = (char *)malloc(processPath.length()+1);
    sprintf(f.proc_name, "%ls", processPath.c_str());

    f.name = (char *)malloc(fileEventPath.length()+1);
    sprintf(f.name, "%ls", fileEventPath.c_str());

    if(debug){
        int * b = (int *)&f;
        for(int i = 0; i < 5; i++){
            printf("f[%d] = %#x\n", i, b[i]);
        }
    }
    fileList.push_back(f);
    if(debug) printf("added one event to fileList. Now there are %d elements in the list\n", fileList.size());

}

void CaptureSoapServer::onProcessEvent(BOOLEAN created, wstring time, 
                                        DWORD parentProcessId, wstring parentProcess, 
                                        DWORD processId, wstring process)
{
    char debug = 0;
    if(debug) printf("CaptureSoapServer::onProcessEvent got an event for time = %ls\n", time.c_str());
    ns__osProcess_t p;
    p.created_at = (char *)malloc(time.length()+1);
    sprintf(p.created_at, "%ls", time.c_str());

    p.event_type = (char *)malloc(11); //11 == max length == "terminated"
    if(created){
        sprintf(p.event_type, "created");
    }
    else{
        sprintf(p.event_type, "terminated");
    }

    p.parent_pid = parentProcessId;

    p.parent_name = (char *)malloc(parentProcess.length()+1);
    sprintf(p.parent_name, "%ls", parentProcess.c_str());

    p.pid = processId;

    p.name = (char *)malloc(process.length()+1);
    sprintf(p.name, "%ls", process.c_str());

    procList.push_back(p);
    if(debug) printf("added one event to procList. Now there are %d elements in the list\n", procList.size());

}


int ns__ping(struct soap *soap, char * a, char ** result) 
{ 
   printf("%s\n", a);
   *result = "pong";

   return SOAP_OK; 
}

//Give it a url to browse to
int ns__visitURL(struct soap *soap, char * url, int &result){
    char debug = 1;
    wchar_t xURL[1024];
    wsprintf(xURL, L"%hs", url);
    //Build my own new-fangled Element to pass to Visitor:onServerEvent
    typedef boost::signal<void (Element*)> signal_serverEvent;
    Attribute att;
    att.name = L"url";
    att.value = xURL;
    Element e;
    e.name = L"visit";
    e.attributes.push_back(att);
    e.data = NULL;
    e.dataLength = 0;
    if(debug) printf("visitURL to %s\n", url);
    EventController::getInstance()->notifyListeners(&e);

    //TODO: We currently run the browser visit event as a black box.
    //In the future we will want to be able to report back about events before
    //it times out or it's cleanly done with the browse.
    //NOTE: For now, telling the browser to run is not a blocking operation.
    //The alternate way I had done it in the past (calling Visitor::onServerEvent directly IIRC)
    //was a blocking way, and might need to be brought back, both for the blocking, and for
    //being able to get richer information back

    result = 1; //No meaning. Define some meaningful return values if desired

    return SOAP_OK;
}

int ns__sendFileBase64(struct soap *soap, char * fileName, char * data, unsigned int encodedLength, unsigned int decodedLength, int &result){
    char debug = 0;
    if(debug) printf("in ns__sendFileBase64\n");

    if(debug) printf("encodedLength = %d, decodedLength = %d, data[0][1][2][3] = %c%c%c%c\n", encodedLength, decodedLength,
        data[0], data[1], data[2], data[3]);

    //Sanity check
    if(decodedLength != b64::b64_decode(data, encodedLength, NULL, NULL)){
        printf("The decode will not be correct. Exiting\n");
        return SOAP_ERR;
    }
    //Decode the data
    char * decodedData = new char[decodedLength];
    b64::b64_decode(data, encodedLength, decodedData, decodedLength);

    printf("decodedData[0][1] = %c%c\n", decodedData[0], decodedData[1]);
    //Open a file to write the decoded data to
    HANDLE myHandle = CreateFileA(fileName, (GENERIC_READ | GENERIC_WRITE), 
                                    NULL, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if(myHandle == INVALID_HANDLE_VALUE){
        printf("CreateFile failed with %d\n", GetLastError());
        return SOAP_ERR;
    }

    //Write the data
    DWORD numWrote;
    BOOL b = WriteFile(myHandle, decodedData, decodedLength, &numWrote, NULL);
    if(b){
        if(debug) printf("Wrote %d bytes of data to %s\n", numWrote, fileName);
    }
    CloseHandle(myHandle);
    delete[] decodedData;

    result = 1;

    return SOAP_OK;

}

//Allows you to ask for a file and get it back in base64.
//NOTE: While I know it will be mitigated by the network architecture, features like this
//are why we should look into SOAP over SSL
int ns__receiveFileBase64(struct soap *soap, char * fileName, ns__receiveFileStruct &result){
    int debug = 0;
    
    if(debug) printf("in ns__receiveFileBase64, about to open %s\n", fileName);

    //Open the file
    HANDLE myHandle = CreateFileA(fileName, GENERIC_READ, NULL, NULL, 
                                    OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if(myHandle == INVALID_HANDLE_VALUE){
        printf("couldn't open the file %s. Exiting\n", fileName);
        return SOAP_ERR;
    }

    //Get the size and then read it into a buffer
    unsigned int fileSize = (unsigned int)GetFileSize(myHandle, NULL);
    if(fileSize <= 0){
        printf("Error, or zero-length file\n");
        return SOAP_ERR;
    }
    char * buffer = new char[fileSize];
    memset(buffer, 0, fileSize);

    DWORD numRead = 0;
    BOOL b = ReadFile(myHandle, buffer, fileSize, &numRead,NULL);
    if(!b || numRead != fileSize){
        printf("ReadFile error\n");
        return SOAP_ERR;
    }
    else{
        if(debug) printf("Read the file successfully\n");
    }

    //base64 the file
    unsigned int encodedLength = (unsigned int)b64::b64_encode(buffer, fileSize, NULL, NULL);
    if(debug) printf("encodedLength = %d\n", encodedLength);
    //TODO: make this a soap_malloc()
    char * encodedData = new char[encodedLength];
    memset(encodedData, 0, encodedLength);
    size_t ret = b64::b64_encode(buffer, fileSize, encodedData, encodedLength);
    if(ret == 0){
        printf("size of the buffer was insufficient, or the length of the * converted buffer was longer than destLen\n");
        return SOAP_ERR;
    }

    //return the file
    result.data = encodedData;
    result.encodedLength = encodedLength;
    result.decodedLength = fileSize;

    if(debug) printf("cleaning up\n");
    CloseHandle(myHandle);
    delete[] buffer;
    //Don't delete[] encodedData because the SOAP stuff will need to grab the data from there for sending
    //I'm just hoping that it deletes the memory and doesn't leak it
    if(debug) printf("cleaned up successfully\n");

    return SOAP_OK;
}

//After we have sent a document into the VM, we need a way to open it.
//We want to do this in a generic way, so rather than calling specific applications with the
//document as the parameter, we instead exploit the fact that as long as default handlers are 
//set for a given file type, it can be run from the command line by simply typing its name.
//Thus we run cmd.exe with the /K option and the document name as a parameter.
//From cmd.exe help: "/K      Carries out the command specified by string but remains"

//fileName = absolute or relative file name you want to open
//waitTimeMillisec = milliseconds to Sleep() for. Should be unsigned int but SOAP::Lite doesn't
// have an 'unsigned int' type by default, and I didn't want to make one. Make sure you cast it to DWORD.
int ns__openDocument(struct soap *soap, char * fileName, int waitTimeMillisec, int &result){
    int debug = 0;
    if(debug) printf("in ns__openDocument, waitTimeMillisec = %d\n", waitTimeMillisec);

    //Create the string for the parameters
    wchar_t * docName = new wchar_t[1024];
    wsprintf(docName, L"/K %hs", fileName);

    //Create a job object to bind the processes I launch to
    //This lets us get around the problem of Windows not having good ways of determining
    //parent/child relationships, so that we don't have to care, and can for all intents
    //and purposes, terminate the entire process tree starting with the cmd.exe we're launching
    HANDLE myJobObj = CreateJobObject(NULL, NULL);
    if(myJobObj == NULL){
        printf("CreateJobObject failed with error %d\n", GetLastError());
    }

    //open with cmd.exe
    STARTUPINFO myStart;
    memset(&myStart, 0, sizeof(STARTUPINFO));
    PROCESS_INFORMATION procInfo;
    BOOL b = CreateProcess(L"C:\\WINDOWS\\system32\\cmd.exe", docName, NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS, 
                            NULL, NULL, &myStart, &procInfo);
    if(!b){
        printf("CreateProcess failed with error %d\n", GetLastError());
        return SOAP_ERR;
    }
    
    //Add the process to the job object.
    b = AssignProcessToJobObject(myJobObj, procInfo.hProcess);
    if(!b){
        printf("AssignProcessToJobObject failed with error %d\n", GetLastError());
        return SOAP_ERR;
    }

    if(debug) printf("dwProcessId = %d, dwThreadId = %d\n", procInfo.dwProcessId, procInfo.dwThreadId);
    if(debug) printf("Sleeping for %d seconds\n", (DWORD)waitTimeMillisec/1000);
    Sleep((DWORD)waitTimeMillisec);
    if(debug) printf("\n\nDone sleeping\n\n");
    
    //TODO: Before we terminate the jobs, see if it created any events. If so, let it run, and tell the
    //HC Manager about it. The Manager should then request the information about events separately.
    //This is the sort of check we would like for browsing as well

    b = TerminateJobObject(myJobObj, 0);
    if(!b){
        printf("TerminateProcess failed with error %d\n", GetLastError());
        return SOAP_ERR;
    }
    CloseHandle(procInfo.hProcess);
    CloseHandle(procInfo.hThread);

    result = 1;
    return SOAP_OK;
}

//If maxEventsReturned == -1, then then send as many as possible.
int ns__returnRegistryEvents(struct soap *soap, int maxEventsToReturn, struct ns__dynRegArray **result){
    char debug = 1;

    struct ns__dynRegArray * dRegArray;
    //Set up a dynamic array for each of the event types
    dRegArray = soap_new_ns__dynRegArray(soap,1);
    dRegArray->__ptr = NULL;
    dRegArray->__size = regList.size();

    //Figure out how many entries we will send back
    if(maxEventsToReturn < dRegArray->__size && maxEventsToReturn != -1){
        dRegArray->__size = maxEventsToReturn;
    }
    if(debug) printf("Sending back %d registy events\n",dRegArray->__size);

    //Allocate a flat array to hold our ns__regkeys in
    //TODO: see if soap_new_ns__regkey(soap, dRegArray->__size) works
    struct ns__regkey * ns__regkeyArray = (struct ns__regkey *)soap_malloc(soap, dRegArray->__size*sizeof(struct ns__regkey));
    dRegArray->__ptr = ns__regkeyArray;

    for(unsigned int i = 0; i < dRegArray->__size; i++){
        if(debug){
            printf("i = %d\n", i);
//          printf("regList.front().time %s, %#x\n", regList.front().time, regList.front().time);
//          printf("regList.front().eventType %s, %#x\n", regList.front().eventType, regList.front().eventType);
//          printf("regList.front().procPID %d, %#x\n", regList.front().procPID, regList.front().procPID);
//          printf("regList.front().procName %s, %#x\n", regList.front().procName, regList.front().procName);
            int * b = (int *)&regList.front();
            for(int i = 0; i < 8; i++){
                printf("regEvent[%d] = %#x\n", i, b[i]);
            }
        }
        memcpy(&ns__regkeyArray[i],&regList.front(), sizeof(struct ns__regkey));
        regDeallocList.push_back(regList.front()); //Need to keep track of it to dealloc its elements later
        regList.pop_front();
    }
    *result = dRegArray;
    return SOAP_OK;
}
int ns__returnFileEvents(struct soap *soap, int maxEventsToReturn, struct ns__dynFileArray **result){
    char debug = 1;

    struct ns__dynFileArray * dFileArray;
    dFileArray = soap_new_ns__dynFileArray(soap,1);
    dFileArray->__ptr = NULL;
    dFileArray->__size = fileList.size();
    printf("SIZE= %d",dFileArray->__size);
    printf("MAX= %d",maxEventsToReturn);

    //Figure out how many entries we will send back
    if(maxEventsToReturn < dFileArray->__size && maxEventsToReturn != -1){
        dFileArray->__size = maxEventsToReturn;
    }
    if(debug) printf("Sending back %d file events\n",dFileArray->__size);

    struct ns__processFile * ns__processFileArray = (struct ns__processFile *)soap_malloc(soap, dFileArray->__size*sizeof(struct ns__processFile));
    dFileArray->__ptr = ns__processFileArray;

    for(unsigned int i = 0; i < dFileArray->__size; i++){
        memcpy(&ns__processFileArray[i],&fileList.front(), sizeof(struct ns__processFile));
        fileDeallocList.push_back(fileList.front());
        fileList.pop_front();
    }
    
    *result = dFileArray;
    return SOAP_OK;
}
int ns__returnProcessEvents(struct soap *soap, int maxEventsToReturn, struct ns__dynProcArray **result){
    char debug = 1;

    struct ns__dynProcArray * dProcArray;
    dProcArray = soap_new_ns__dynProcArray(soap,1);
    dProcArray->__ptr = NULL;
    dProcArray->__size = procList.size();

    if(maxEventsToReturn < dProcArray->__size && maxEventsToReturn != -1){
        dProcArray->__size = maxEventsToReturn;
    }
    if(debug) printf("Sending back %d process events\n",dProcArray->__size);

    struct ns__osProcess * ns__osProcessArray = (struct ns__osProcess *)soap_malloc(soap, dProcArray->__size*sizeof(struct ns__osProcess));
    dProcArray->__ptr = ns__osProcessArray;

    for(unsigned int i = 0; i < dProcArray->__size; i++){
        memcpy(&ns__osProcessArray[i],&procList.front(), sizeof(struct ns__osProcess));
        procDeallocList.push_back(procList.front());
        procList.pop_front();
    }
    
    *result = dProcArray;
    return SOAP_OK;
}
int ns__returnEvents(struct soap *soap, int maxEventsToReturn, ns__allEvents **result){
    char debug = 1;

    ns__allEvents * all = soap_new_ns__allEvents(soap, 1);
    all->regkeys = NULL;
    all->process_files = NULL;
    all->os_processes = NULL;
    if(regList.empty() || maxEventsToReturn == 0){
        printf("No registry events to send back\n");
    }
    else{
        ns__returnRegistryEvents(soap,maxEventsToReturn,&all->regkeys);
    }
    if(fileList.empty() || maxEventsToReturn == 0){
        printf("No file events to send back\n");
    }
    else{
        ns__returnFileEvents(soap,maxEventsToReturn,&all->process_files);
    }
    if(procList.empty() || maxEventsToReturn == 0){
        printf("No process events to send back\n");
    }
    else{
        ns__returnProcessEvents(soap,maxEventsToReturn,&all->os_processes);
    }

    *result = all;
    if(debug) printf("all->regkeys = %#x, all->process_files = %#x, all->os_processes = %#x\n", all->regkeys, all->process_files, all->os_processes);
    if(debug) printf("regList.size() = %d, fileList.size() = %d, procList.size() = %d\n", regList.size(), fileList.size(), procList.size());

    return SOAP_OK;
}

//Helper function to deallocate any memory in events which have already had their data sent via SOAP
void dealloc_events(){

    if(!regDeallocList.empty()){
        for(int i = 0; i < regDeallocList.size(); i++){
            free(regDeallocList.front().created_at);
            free(regDeallocList.front().event_type);
            free(regDeallocList.front().proc_name);
            free(regDeallocList.front().name);
            free(regDeallocList.front().value_name);
            free(regDeallocList.front().value_type);
            free(regDeallocList.front().value);
            regDeallocList.pop_front();
        }
    }

    if(!fileDeallocList.empty()){
        for(int i = 0; i < fileDeallocList.size(); i++){
            free(fileDeallocList.front().created_at);
            free(fileDeallocList.front().event_type);
            free(fileDeallocList.front().proc_name);
            free(fileDeallocList.front().name);
            fileDeallocList.pop_front();
        }
    }

    if(!procDeallocList.empty()){
        for(int i = 0; i < procDeallocList.size(); i++){
            free(procDeallocList.front().created_at);
            free(procDeallocList.front().event_type);
            free(procDeallocList.front().parent_name);
            free(procDeallocList.front().name);
            procDeallocList.pop_front();
        }
    }

}

//Thus far, SOAP::Lite hasn't been sending the data correctly, so we never get into this function.
//Removing the "This is a multipart message in MIME format..." from MIME::Entity's Entity.pm at least gets 
//rid of the gSOAP "No XML element" error, but then it doesn't seem to ever exit the SOAP::Lite send.
int ns__sendMIME(struct soap *soap, int magicNumber, int &result){
    printf("In ns__sendMIME\n");

    //From the gSOAP documentation example
    struct soap_multipart * attachment;
    for(attachment = soap->mime.list; attachment; attachment = attachment->next){
       printf("MIME attachment:\n"); 
       printf("Memory=%p\n", (*attachment).ptr); 
       printf("Size=%ul\n", (*attachment).size); 
       printf("Encoding=%d\n", (int)(*attachment).encoding); 
       printf("Type=%s\n", (*attachment).type?(*attachment).type:"null"); 
       printf("ID=%s\n", (*attachment).id?(*attachment).id:"null"); 
       printf("Location=%s\n", (*attachment).location?(*attachment).location:"null"); 
       printf("Description=%s\n", (*attachment).description?(*attachment).description:"null");
    }

    printf("magicNumber = %#x\n", magicNumber);
    if(magicNumber == 123){
        result = 42;
    }
    else{
        result = 0;
    }

    return SOAP_OK;
}