Changeset 1623

Timestamp:

06/12/08 18:36:35 (3 months ago)

Author:

kindlund

Message:

Updated STRACE support; still have to fully test.

Files:

• honeyclient/branches/exp/kindlund-strace/auto_drive.pl (modified) (2 diffs)
• honeyclient/branches/exp/kindlund-strace/bin/bootstrap_agent.sh (modified) (2 diffs)
• honeyclient/branches/exp/kindlund-strace/etc/honeyclient.xml (modified) (3 diffs)
• honeyclient/branches/exp/kindlund-strace/lib/HoneyClient/Agent.pm (modified) (10 diffs)
• honeyclient/branches/exp/kindlund-strace/thirdparty/capture-mod/FileMonitor.exl (modified) (1 diff)
• honeyclient/branches/exp/kindlund-strace/thirdparty/capture-mod/ProcessMonitor.exl (modified) (2 diffs)

honeyclient/branches/exp/kindlund-strace/auto_drive.pl

@@ -8 +8 @@
-  use MIME::Base64 qw(encode_base64 decode_base64);
-  use Storable qw(thaw);
-
-
+
+
+
+
-
-  # Create a new SOAP client, to talk to the HoneyClient::Agent
@@ -23 +25 @@
-  # Drive HoneyClient::Agent::Driver::Browser::IE to a website.
-  $som = $stub->drive(driver_name => "HoneyClient::Agent::Driver::Browser::IE",
-cnn
+microsoft
-
-  # Check the result to see if any compromise was found.

honeyclient/branches/exp/kindlund-strace/bin/bootstrap_agent.sh

@@ -25 +25 @@
-
-# Ping a remote site, to test for connectivity (optional).
-
+#
-
-# Change to the honeyclient directory.
@@ -31 +31 @@
-
-# Perform an SVN update (optional).
-
+#
-
-# Start up the realtime integrity checker.

honeyclient/branches/exp/kindlund-strace/etc/honeyclient.xml

@@ -81 +81 @@
-            <!-- TODO: Update this. XXX: Command-line option, eventually? -->
-            <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60">
-2
+6
-            </timeout>
+            <bin_injdll description="The absolute path to the INJDLL.EXE process, that is apart of the STRACE application." default="C:\Program Files\STRACE\INJDLL.EXE">
+                C:\Program Files\STRACE\INJDLL.EXE
+            </bin_injdll>
+            <dll_strace description="The absolute path to the STRACE.DLL file to use, when STRACE support is enabled." default="C:\Program Files\STRACE\STRACE.DLL_IE6">
+                C:\Program Files\STRACE\STRACE.DLL_IE6
+            </dll_strace>
+            <work_complete_timeout description="When STRACE support is enabled, this option indicates how many seconds the Driver waits for the STRACE.LOG file to grow in size, before the Driver assumes that all network activity has successfully completed." default="4">
+                4
+            </work_complete_timeout>
-            <Browser>
-                <IE>
@@ -92 +101 @@
-                        iexplore.exe
-                    </process_name>
+                    <dll_strace description="The absolute path to the STRACE.DLL file to use, when STRACE support is enabled." default="C:\Program Files\STRACE\STRACE.DLL_IE7">
+                        C:\Program Files\STRACE\STRACE.DLL_IE7
+                    </dll_strace>
-                </IE>
-                <FF>
@@ -101 +113 @@
-                        firefox.exe
-                    </process_name>
+                    <dll_strace description="The absolute path to the STRACE.DLL file to use, when STRACE support is enabled." default="C:\Program Files\STRACE\STRACE.DLL_IE6">
+                        C:\Program Files\STRACE\STRACE.DLL_IE6
+                    </dll_strace>
-                </FF>
-            </Browser>

honeyclient/branches/exp/kindlund-strace/lib/HoneyClient/Agent.pm

@@ -273 +273 @@
-use DateTime::HiRes;
-
+# Make sure Filesys::CygwinPaths loads.
+BEGIN { use_ok('Filesys::CygwinPaths') or diag("Can't load Filesys::CygwinPaths package.  Check to make sure the package library is correctly listed within the path."); }
+require_ok('Filesys::CygwinPaths');
+use Filesys::CygwinPaths qw(:all);
+
+# Make sure File::Basename loads.
+BEGIN { use_ok('File::Basename', qw(basename dirname)) or diag("Can't load File::Basename package.  Check to make sure the package library is correctly listed within the path."); }
+require_ok('File::Basename');
+can_ok('File::Basename', 'basename');
+can_ok('File::Basename', 'dirname');
+use File::Basename qw(basename dirname);
+
-# Make sure Data::Dumper loads.
-BEGIN { use_ok('Data::Dumper') or diag("Can't load Data::Dumper package.  Check to make sure the package library is correctly listed within the path."); }
@@ -337 +349 @@
-# Use ISO 8601 DateTime Libraries
-use DateTime::HiRes;
+
+# Use Cygwin Path Resolution Libraries 
+use Filesys::CygwinPaths qw(:all);
+
+# Use Basename Libraries 
+use File::Basename qw(basename dirname);
-
-# Include Logging Library
@@ -625 +643 @@
-     },
-     # Time inside VM when job was executed.
-
+
+
+
+
- };
-
@@ -668 +689 @@
-        ok($changes, "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
-        ok(exists($changes->{'status'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
+        ok(exists($changes->{'work_status'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
-        ok(exists($changes->{'time_at'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
-        ok(exists($changes->{'fingerprint'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
@@ -1286 +1308 @@
-            }
-          ],
-
+
+
-        };
-
@@ -1300 +1323 @@
-        ok(exists($changes->{'time_at'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
-        ok(exists($changes->{'fingerprint'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
+        ok(exists($changes->{'work_status'}), "drive(driver_name => 'HoneyClient::Agent::Driver::Browser::IE')") or diag("The drive() call failed.");
-
-        # Check that os_processes is not empty.
@@ -1377 +1401 @@
-    my $ret = {
-        # Time when application was driven.
-
+    
-
-        # Fingerprint information found (if any).
-
+  
-
-        # Status information about the Win32::Job call.
-
+
+
+
+
-    };
-
@@ -1401 +1428 @@
-    my $processName = getVar(name => "process_name",
-                             namespace => $args{'driver_name'});
-    # TODO: Updated for initial STRACE support - Clean this up further.
-    my $status = $job->spawn($processExec, $processName . " " . $args{'parameters'});
-    #my $status = $job->spawn('C:\WINDOWS\system32\cmd.exe', 'cmd.exe /C C:\cygwin\home\Administrator\src\honeyclient-trunk\bin\strace_wrapper.cmd "' . $processExec . "\" \"" . $args{'parameters'} . "\" && sleep " . ($args{'timeout'} + 10));
-
-    # Sanity check.
@@ -1412 +1437 @@
-    }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    # Check to see if run fails.
@@ -1506 +1551 @@
-        } else {
-            $LOG->info($args{'driver_name'} . " - Integrity Check: PASSED");
+            # If the integrity check passes, then delete the strace log if enabled.
+            unlink($straceFile);
-        }
-    }

honeyclient/branches/exp/kindlund-strace/thirdparty/capture-mod/FileMonitor.exl

@@ -336 +336 @@
-
-#### Honeyclient - STRACE Functionality
-
+
+

honeyclient/branches/exp/kindlund-strace/thirdparty/capture-mod/ProcessMonitor.exl

@@ -15 +15 @@
-### Microsoft Internet Explorer 6.0     ###
-###################################################
-
+\
-#agent server is an activeX control that starts upon displaying multimedia content
-
+\
-#messenger activeX
-
+\
-###################################################
-### Honeyclient added/specific?         ###
@@ -36 +36 @@
-
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT
-
-
+\
+\
-
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
-
+\
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT
-#This is related to the language bar...I just installed updates, and it was newly activated
-#thus I consider it something valid to add
-
+\
-
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT - IE7 accessing live.com
-
+\
-
-#### HONEYCLIENT - Incorporating STRACE
-+  cmd.exe .*  C:\\WINDOWS\\system32\\cmd
-runelevate.exe .*  C:\\Program Files\\STRACE\\runelevate
-withdll.exe    .*  C:\\Program Files\\STRACE\\withdll
+#+ perl.exe    .*  C:\\cygwin\\bin\\perl\
+sh.exe .*  C:\\cygwin\\bin\\sh\
+injdll.exe .*  C:\\Program Files\\STRACE\\INJDLL\