Changeset 167

Timestamp:

01/19/07 16:27:58 (2 years ago)

Author:

kindlund

Message:

Finished initial integration testing.

Files:

• honeyclient/branches/exp/mbriggs-db/lib/HoneyClient/Manager.pm (modified) (5 diffs)

honeyclient/branches/exp/mbriggs-db/lib/HoneyClient/Manager.pm

@@ -163 +163 @@
-use HoneyClient::Manager::VM qw();
-
+# Include DB Utility Library
+# TODO: Include unit tests.
+use HoneyClient::Manager::DB;
+
-# XXX: Remove this, eventually.
-use Data::Dumper;
@@ -218 +222 @@
-# XXX: May want to change this format/usage, eventually.
-our $STATE_FILE = getVar(name => "manager_state");
+
+# Global Database Parameters
+# XXX: Will eventually go away.
+our $DB_PARAMS = {
+    dsn=>'DBI:mysql:mysql;host=192.168.0.130',
+    username=>'root',
+    password=>''
+};
+
+# Global Database Handle
+our $DB;
+
-
-#######################################################################
@@ -440 +456 @@
-    my $agentState = undef;
-
+    # Connect to remote database.
+    $DB = new HoneyClient::Manager::DB($DB_PARAMS);
+    if ($DB->deploy()) {
+        print "Database connection succeeded.\n"; 
+
+        $DB_PARAMS = {
+            dsn=>'DBI:mysql:HoneyClient;host=192.168.0.130',
+            username=>'root',
+            password=>''
+        };
+        $DB = new HoneyClient::Manager::DB($DB_PARAMS);
+    }
+
-    for (;;) {
-        print "Starting new session...\n";
@@ -452 +481 @@
-        #print Dumper(thaw(decode_base64($agentState)));
-    }
+
+    # XXX: Be sure to DROP the HoneyClient table, after every Manager->run() call.
+    # XXX: This will eventually be removed.
+    $DB->{dbh}->do("DROP DATABASE HoneyClient");
-}
-
@@ -657 +690 @@
-                    HoneyClient::Manager::VM->destroy();
-                    $vmCompromised = 1;
+
+                    # Insert Compromised Fingerprint into DB.
+                    # XXX: For now, we do a blanket insert; eventually, we'll need to
+                    # check if this fingerprint already exists in the DB.
+                    my (@Files, @RegKeys, @Procs);
+    
+                    push @Files, {
+                        path => 'c:\windows\system32',
+                             name => 'calc.exe',
+                             content => {
+                                 md5  => '82da9a561687f841a61e752e401471d2',
+                                 sha1 => '7552ad083713e6d6b79539b64d598d4dcadfba35',
+                                 size => 114688,
+                                 type => 'MS-DOS executable (EXE), OS/2 or MS Windows'
+                             }
+                    };
+                    push @Files, {
+                        path => 'c:\windows\system32',
+                             name => 'msgina.dll',
+                             content => {
+                                 md5  => 'bab513fc028515389eb6b2ad16e35ad2',
+                                 sha1 => 'c5597928b22d2c49a41510d6ab11d8f19bfab0af',
+                                 size => 994304,
+                                 type => 'MS-DOS executable (EXE), OS/2 or MS Windows'
+                             }
+                    };
+                    push @Files, {
+                        path => 'c:\windows\system32',
+                             name => 'drwatson.exe',
+                             content => {
+                                 md5  => '37564f065866fa7215453e72f1264f4b',
+                                 sha1 => '7144ee8b57f3fcae6870f452b140365f75b5265c',
+                                 size => 28112,
+                                 type => 'MS-DOS executable (EXE), OS/2 or MS Windows'
+                             }
+                    };
+                    push @RegKeys, {
+                        key_name => 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
+                                 status => 1,
+                                 entries => [
+                                 {
+                                     name => 'QuickTime Task',
+                                     new_val => '"C:\Program Files\QuickTime\qttask.exe" -atboottime'
+                                 }
+                        ]
+                    };
+                    push @Procs, {
+                        name => 'calc'
+                    };
+                    push @Procs, {
+                        name => 'drwatson'
+                    };
+
+                    my $exploit1 = {
+                        Files => \@Files,
+                        RegKeys => \@RegKeys,
+                        Procs => \@Procs
+                    };
+                    $exploit1->{vmid} = 'VMTest1'; 
+                    my $exploit2 = {
+                        Files => [ $Files[0],$Files[1] ],
+                        RegKeys => \@RegKeys,
+                        Procs => [ $Procs[0] ]
+                    };
+
+                    if ($DB->Insert($exploit1,'Fingerprints')) {
+                        print "Database insert successful.\n";
+                    }
+
-                    return; # Return out of eval block.
-                } else {