Changeset 1672

Show
Ignore:
Timestamp:
07/08/08 15:28:36 (5 months ago)
Author:
kindlund
Message:

Updated bootstrapping code and whitelists for selenium support.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/branches/exp/kindlund-selenium/bin/bootstrap_agent.sh

    r1499 r1672  
    3333svn update 
    3434 
     35# Start up the selenium server. 
     36cd ~/honeyclient/thirdparty/selenium 
     37java -jar selenium-server.jar -trustAllSSLCertificates& 
     38cd ~/honeyclient  
     39 
    3540# Start up the realtime integrity checker. 
    3641~/honeyclient/thirdparty/capture-mod/CaptureBAT.exe -c -l "C:\cygwin\tmp\realtime-changes.txt"& 

  • honeyclient/branches/exp/kindlund-selenium/thirdparty/capture-mod/FileMonitor.exl

    r1668 r1672  
    348348# System Log Files - IE7 
    349349+   Write   C:\\WINDOWS\\system32\\services\.exe    C:\\WINDOWS\\Debug\\UserMode\\userenv\.log 
     350 
     351# IE6 - Selenium Support 
     352+   Write   C:\\WINDOWS\\system32\\mshta\.exe   C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\.* 
     353+   Delete  C:\\WINDOWS\\system32\\mshta\.exe   C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\.* 
     354+   Write   C:\\WINDOWS\\system32\\java\.exe    C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\customProfileDir.* 
     355+   Delete  C:\\WINDOWS\\system32\\java\.exe    C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\customProfileDir.* 

  • honeyclient/branches/exp/kindlund-selenium/thirdparty/capture-mod/ProcessMonitor.exl

    r1647 r1672  
    5454# IE - Random Crashing Due To Poor Application Coding 
    5555+   drwtsn32.exe    .*  C:\\WINDOWS\\system32\\drwtsn32\.exe 
     56 
     57# IE6 - Selenium Support 
     58+   cmd.exe .*  C:\\WINDOWS\\system32\\cmd\.exe 
     59+   mshta.exe   .*  C:\\WINDOWS\\system32\\mshta\.exe 

  • honeyclient/branches/exp/kindlund-selenium/thirdparty/capture-mod/RegistryMonitor.exl

    r1668 r1672  
    407407# IE - Random Crashing Due To Poor Application Coding 
    408408+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\.* 
     409 
     410# IE6 - Selenium Support 
     411+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCR\\CLSID\\.* 
     412+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCR\\JavaPlugin.* 
     413+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2.* 
     414+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.* 
     415+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.* 
     416+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders.* 
     417+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders.* 
     418+   SetValueKey C:\\WINDOWS\\system32\\mshta\.exe   HKLM\\SYSTEM\\ControlSet001\\.+ 
     419+   DeleteValueKey  C:\\WINDOWS\\system32\\mshta\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.*