Changeset 150

Timestamp:

01/10/07 13:37:40 (2 years ago)

Author:

mbriggs

Message:

Changed format of file and registry hashes
Added potential CheckFingerprints Hash
Still needs _SelectRegKeys function implemented

Files:

• honeyclient/branches/exp/mbriggs-db/lib/HoneyClient/Manager/DB.pm (modified) (23 diffs)

honeyclient/branches/exp/mbriggs-db/lib/HoneyClient/Manager/DB.pm

@@ -9 +9 @@
-##############################################################################
-# Package:     HoneyClient::Manager::DB 
-0
+4
-# File:        DB.pm
-# Description: A module server that provides an interface to the Honeyclient DB
-# Author:      mbriggs
-#
-0 2006-11-30 20:43:34
+4 2007-01-10 18:10:58
-#
-# Copyright (C) 2006 The MITRE Corporation.  All rights reserved.
@@ -100 +100 @@
-            vmid         => 1,
-            datedetected => 0,
-            subsecs      => 0,
-            CVENum       => 0,
-            notes        => 0,
@@ -109 +108 @@
-    Files => {
-        fields => {
-
-
+
+
+
+
+
+
+
-            path        => 1,
-            name        => 1,
-            size        => 1,
-            type        => 1,
-            datecreated => 0,
-            subsecs     => 0,
-            notes       => 0,
-        },
-        selectFunc => \&_SelectFiles,
@@ -124 +124 @@
-    RegKeys => {
-        fields => {
-
-
-
+
+
+
+
+
+
+
-            datecreated => 0,
-            subsecs     => 0,
-            notes       => 0,
-            '`key`'     => 0 # TODO: HACK - Find a better way handle this!
-        },
-        selectFunc => undef,
@@ -139 +141 @@
-            name        => 1,
-            datecreated => 0,
-            subsecs     => 0,
-            notes       => 0,
-        },
@@ -147 +148 @@
-);
-
+our %required_fields;
+
-our $threshold=.2;
-
@@ -161 +164 @@
-    my ($contentid,$rc);
-    eval {
-        my %fileContent = map { $_ => $self->{dbh}->quote($h_file->{$_}) } ('md5','sha1','type','size');
-        my $abstract = new Relations::Abstract($self->{dbh});
-        
-        if (!$self->_VerifyHash($h_file,$tables{Files}{fields},1)) {return;}
+        my %fileContent = map { $_ => $self->{dbh}->quote($h_file->{content}->{$_}) } ('md5','sha1','type','size');
+        
+        my $abstract = new Relations::Abstract($self->{dbh});
-        # Check for existence of file content in Database
-        my $query = new Relations::Query(
@@ -227 +231 @@
-sub _InsertRegKey {
-    my ($self,$h_regkey,$serial) = @_;
-rc
+id
-    eval {
-        if (!$self->_VerifyHash($h_regkey,$tables{RegKeys}{fields},1)){return;}
-        my $abstract = new Relations::Abstract($self->{dbh});
-        
-
-
+
-        $regkey{serial} = $serial;
-    
-rc
+id
-            -id    => 'id',
-            -table => 'RegKeys',
-            -set   => \%regkey
-        );
+        foreach my $entry (@{$h_regkey->{entries}}) {
+            my %entry = map { $_ => $self->{dbh}->quote($entry->{$_}) } (keys %$entry);
+            $abstract->insert_id(
+                -id     => 'id',
+                -table  => 'RegKeyEntries',
+                -set    => \%entry
+            ) or Carp::croak __PACKAGE__."->_InsertRegKey Failed: Insert returned a NULL ID";
+        }
-    };
-    if ($@) {
-        Carp::croak "__PACKAGE__->_InsertRegKey Failed:\n\t$@";
-    }
-rc
+id
-    
-}
@@ -284 +295 @@
-    
-    foreach $key (keys %$hash) {
-
+
+
+
+
-            delete $fields{$key};
-        }
@@ -356 +370 @@
-sub deploy {
-    my $self = shift;
+    my $dbname;
+    #Check if DB exists already:
+    my $sth = $self->{dbh}->prepare("SHOW DATABASES");
+    $sth->execute();
+    while ($dbname = $sth->fetchrow_array()) {
+        if ($dbname eq 'HoneyClient') {
+            print "It thinks DB exists!\n";#TODO: Delete Debug statement
+            return 1;
+        }
+    }
+    
-    my $abstract = new Relations::Abstract($self->{dbh});
-    $abstract->run_query("CREATE DATABASE HoneyClient");
@@ -402 +427 @@
-            id INT UNSIGNED AUTO_INCREMENT,
-            serial INT UNSIGNED NOT NULL,
-
-
-
+
+
-            datecreated TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-            notes TEXT,
+            PRIMARY KEY (id)
+        ) ENGINE=InnoDB
+    "); # or die "Failed Creating RegKeys Table"; not necessary because of RaiseError??
+    $abstract->run_query("
+        CREATE TABLE RegKeyEntries
+        (
+            id INT UNSIGNED AUTO_INCREMENT,
+            regkeyid INT UNSIGNED NOT NULL,
+            name VARCHAR(255) NOT NULL,
+            new_val VARCHAR(255) NOT NULL,
+            old_val VARCHAR(255) NOT NULL,
-            PRIMARY KEY (id)
-        ) ENGINE=InnoDB
@@ -421 +456 @@
-        ) ENGINE=InnoDB
-    "); # or die "Failed Creating Procs Table"; not necessary because of RaiseError??
+    $abstract->run_query("
+        CREATE FUNCTION objcount (s INT) RETURNS INT DETERMINISTIC
+        BEGIN
+            DECLARE f,r,p,sum INT;
+            SET sum = 0;
+            SELECT numfiles,numregkeys,numprocs INTO f,r,p FROM Fingerprints WHERE serial=s;
+            SET sum = f + r + p;
+            RETURN sum;
+        END;
+    "); # or die "Failed Creating Procs Table"; not necessary because of RaiseError??
-    return 1;
-}
@@ -442 +487 @@
-
-{
-
-
-
+
-    name => 'notepad.exe',
-
-
+
+
+
+
+
+
-}
-
@@ -457 +504 @@
-
-{
-
-
+
+
+
+
+
+
+
+
+
-}
-
@@ -546 +600 @@
-    
-    push @Files, {
-        md5  => '82da9a561687f841a61e752e401471d2',
-        sha1 => '7552ad083713e6d6b79539b64d598d4dcadfba35',
-        path => 'c:\windows\system32',
-        name => 'calc.exe',
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-        name => 'msgina.dll',
-
-
+
+
+
+
+
+
-    };
-    push @Files, {
-        md5  => '37564f065866fa7215453e72f1264f4b',
-        sha1 => '7144ee8b57f3fcae6870f452b140365f75b5265c',
-        path => 'c:\windows\system32',
-        name => 'drwatson.exe',
-
-
+
+
+
+
+
+
-    };
-    push @RegKeys, {
-
-
-
+
+
+
+
+
+
+
+
-    };
-    push @Procs, {
@@ -670 +735 @@
-    
-    push @Files, {
-        md5  => '82da9a561687f841a61e752e401471d2',
-        sha1 => '7552ad083713e6d6b79539b64d598d4dcadfba35',
-        path => 'c:\windows\system32',
-        name => 'calc.exe',
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-        name => 'msgina.dll',
-
-
+
+
+
+
+
+
-    };
-    push @Files, {
-        md5  => '37564f065866fa7215453e72f1264f4b',
-        sha1 => '7144ee8b57f3fcae6870f452b140365f75b5265c',
-        path => 'c:\windows\system32',
-        name => 'drwatson.exe',
-
-
+
+
+
+
+
+
-    };
-    push @RegKeys, {
-
-
-
+
+
+
+
+
+
+
+
-    };
-    push @Procs, {
@@ -736 +812 @@
-    my ($i,$rows,$r,$serial);
-    for ($i = 0; $i < $numfiles; $i++) {
+        
+    }
-        $rows = $self->Select({
-            table => 'Files',
@@ -744 +822 @@
-            $fileMatches{$serial}{$i} = $r;
-        }
-    }
-    for ($i = 0; $i < $numregkeys; $i++) {
-        $rows = $self->Select({
@@ -779 +856 @@
-        $scores{$key} += keys %{$procMatches{$key}};
-    }
-    $h_scores->{Scores}  = \%scores;
-    $h_scores->{Files}   = \%fileMatches;
-    $h_scores->{RegKeys} = \%regMatches;
-    $h_scores->{Procs}   = \%procMatches;
-
-    foreach $key (keys %scores) {
-        if ($scores{$key}/$objCount < $threshold) {
@@ -791 +863 @@
-            delete $scores{$key};
-        }
-
-
+
+
+
+
+
+
+
+
+
-    return @matches;
-}
@@ -848 +927 @@
-}
-
-
+ files
-# Creates a SQL Select statement from the Query Hash passed to it.
-# Returns - An array reference to an array of file records
@@ -855 +934 @@
-    my ($self,$q) = @_;
-    $q->{'select'} = [ 'Files.id','Files.contentid','Files.serial','Files.name',
-
-,'FileContent.notes'
+s.notes','File
+
-    ];
-    #map {$q->{where}->{$_} = $self->{dbh}->quote($q->{where}->{$_})} (keys %{$q->{where}});
@@ -866 +945 @@
-        $query->add("-$property" => $q->{$property}) if( $q->{$property} );
-    }
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-