Changeset 1737

Timestamp:

08/14/08 13:54:57 (4 months ago)

Author:

kindlund

Message:

Migrated changes from trunk into this branch.

Files:

• honeyclient/branches/exp/bhenderson-browser_automation/bin/UpdateBundleChecksum.pl (modified) (1 diff)
• honeyclient/branches/exp/bhenderson-browser_automation/etc/honeyclient.xml (modified) (2 diffs)
• honeyclient/branches/exp/bhenderson-browser_automation/lib/HoneyClient/Manager/VM.pm (modified) (1 diff)
• honeyclient/branches/exp/bhenderson-browser_automation/lib/HoneyClient/Manager/VM/Clone.pm (modified) (1 diff)
• honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/FileMonitor.exl (modified) (3 diffs)
• honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/ProcessMonitor.exl (modified) (1 diff)
• honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/RegistryMonitor.exl (modified) (6 diffs)

honeyclient/branches/exp/bhenderson-browser_automation/bin/UpdateBundleChecksum.pl

@@ -1 +1 @@
-#!/usr/bin/perl
+
+#Run like:
+#./UpdateBundleChecksum.pl ../cpan/sources/authors/id/M/MI/MITREHC/
-
-use CPAN::Checksums qw(updatedir);

honeyclient/branches/exp/bhenderson-browser_automation/etc/honeyclient.xml

@@ -213 +213 @@
-            <!-- TODO: Update this. -->
-            <url description="The URL of the local Ruby web service, which interfaces with the local HoneyClient database.">
-172.16.164.1
+drone
-            </url>
-            <max_retry_count description="If the Manager is unable to contact the Ruby web service due to connectivity issues, then the Manager will retry up to the specified number of times before giving up." default="1800">
@@ -319 +319 @@
-        <VM>
-            <master_vm_config description="The full absolute path to the VM configuration file on the host system that will be used by all subsequent cloned VMs.">
-2
+4
-            </master_vm_config>
-            <port description="The TCP port number that the SOAP server of the VM daemon will listen on for requests.  Note: This port should be unique and not already be used by other modules, services, or daemons running on the host system." default="7627">

honeyclient/branches/exp/bhenderson-browser_automation/lib/HoneyClient/Manager/VM.pm

@@ -3425 +3425 @@
-        /A file encapsulating the state of a virtual machine was discovered/ &&
-            do { $choice = 0; last; }; # Choice 0: Discard.
+       
+        # Error reading image (vmdk); go ahead and retry.
+        /Operation on file \".*\" failed/ &&
+            do { $choice = 0; last; }; # Choice 0: Retry.
-
-        $LOG->warn("Encountered unknown question for VM ($args{'config'}). " .

honeyclient/branches/exp/bhenderson-browser_automation/lib/HoneyClient/Manager/VM/Clone.pm

@@ -1544 +1544 @@
-
-    if ($args{'perform_archive'}) {
+        $LOG->info("Thread ID (" . threads->tid() . "): Archiving clone VM (" . $vmConfig . ").");
-        if ($argsExist &&
-            exists($args{'snapshot_file'}) &&

honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/FileMonitor.exl

@@ -97 +97 @@
-+   Write   C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG
-+   Delete  C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG
++   Write   C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT
-+   Write   C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe  E:\\\$LogFile
-+   Write   C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe  E:\\\$Directory
@@ -331 +332 @@
-+   Write   C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe  C:\\WINDOWS\\system32\\config\\system\.LOG
-+   Write   C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe  C:\\WINDOWS\\system32\\config\\system
++   Write   C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe  C:\\WINDOWS\\system32\\config
-
-# IE7 - Exclusion
@@ -344 +346 @@
-+   Write   C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+html
-+   Delete  C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+tmp
++   Write   C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+tmp
+
+# System Log Files - IE7
++   Write   C:\\WINDOWS\\system32\\services\.exe    C:\\WINDOWS\\Debug\\UserMode\\userenv\.log
+
+# IE6 Crashing
++   Write   C:\\WINDOWS\\system32\\drwtsn32\.exe    C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Dr Watson\\.*

honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/ProcessMonitor.exl

@@ -54 +54 @@
-# IE - Random Crashing Due To Poor Application Coding
-+   drwtsn32.exe    .*  C:\\WINDOWS\\system32\\drwtsn32\.exe
+
+# IE - MSN Messenger Autostart 
++   msmsgs.exe  .*  C:\\Program Files\\Messenger\\msmsgs\.exe

honeyclient/branches/exp/bhenderson-browser_automation/thirdparty/capture-mod/RegistryMonitor.exl

@@ -114 +114 @@
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.+
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache.+
-\\.+
+.*
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\.+
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Direct3D.+
@@ -160 +160 @@
-+   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.+
-+   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache.+
-\\.+
+.*
-+   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\.+
-+   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Direct3D.+
@@ -186 +186 @@
-+   SetValueKey C:\\Program Files\\Messenger\\msmsgs\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MSMSGS
-+   SetValueKey C:\\Program Files\\Messenger\\msmsgs\.exe   HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\.+
-\\.+
+.*
-+   SetValueKey C:\\Program Files\\Messenger\\msmsgs\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\.+
-+   SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\EventSystem\\.+\\Subscriptions\\.+
@@ -202 +202 @@
-+   DeleteValueKey  C:\\Program Files\\Messenger\\msmsgs\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MSMSGS
-+   DeleteValueKey  C:\\Program Files\\Messenger\\msmsgs\.exe   HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\.+
-\\.+
+.*
-+   DeleteValueKey  C:\\Program Files\\Messenger\\msmsgs\.exe   HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\.+
-+   DeleteValueKey  C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\EventSystem\\.+\\Subscriptions\\.+
@@ -290 +290 @@
-+   SetValueKey C:\\Program Files\\Windows Media Player\\wmplayer\.exe  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Macromedia\\FlashPlayerUpdate
-+   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Macromedia\\FlashPlayer
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Macromedia\\FlashPlayer
@@ -407 +408 @@
-# IE - Random Crashing Due To Poor Application Coding
-+   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\.*
++   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\.*
+
+# IE - Dr Watson IE 6 Crashing
++   SetValueKey C:\\WINDOWS\\system32\\drwtsn32\.exe    HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders.*
++   SetValueKey C:\\WINDOWS\\system32\\drwtsn32\.exe    HKLM\\SOFTWARE\\Microsoft\\DrWatson.*
+
+# Benign Explorer Activity
++   SetValueKey C:\\WINDOWS\\explorer\.exe  HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar.*
++   SetValueKey C:\\WINDOWS\\explorer\.exe  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.*
+
+# Benign DirectX Activity
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Multimedia\\msacm.msgsm610.*