Changeset 328

Show
Ignore:
Timestamp:
05/06/07 20:43:06 (1 year ago)
Author:
kindlund
Message:

merged filesystem exp branch back into trunk

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/trunk/etc/honeyclient.xml

    r292 r328  
    6969            <!-- TODO: Update this. --> 
    7070            <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60"> 
    71                 10  
     71                20  
    7272            </timeout> 
    7373            <Browser> 
    …… 
    125125        <!-- HoneyClient::Agent::Integrity Options --> 
    126126        <Integrity> 
    127             <!-- Files which are read in only. --> 
    128             <!-- TODO: Update this. --> 
    129             <file_checklist description="The file containing the list of files and directories to check during filesystem checking." default="none"> 
    130                 etc/file_checklist.txt 
    131             </file_checklist> 
    132             <!-- TODO: Update this. --> 
    133             <file_exclude description="The file containing the list of files or directories to exclude if found in subdirectories during filesystem checking." default="none"> 
    134                 ../../../etc/file_exclude.txt 
    135             </file_exclude> 
    136             <!-- Files which are written out only. --> 
    137             <!-- TODO: Update this. --> 
    138             <clean_file description="File to store hashes for files selected during baseline process."> 
    139                 /tmp/cleanfile.txt 
    140             </clean_file> 
    141             <!-- TODO: Update this. --> 
    142             <change_file description="File to write any found changes to."> 
     127            <changes_found_file description="When an integrity check fails, all changes will be written to this file within the compromized honeyclient VM's filesystem." default="/tmp/changes.txt"> 
    143128                /tmp/changes.txt 
    144             </change_file> 
    145             <!-- Files to read and write. --> 
    146             <!-- TODO: Update this. --> 
    147             <test_dir description="If you're testing integrity checks, this is the directory that you can specify to minimize testing time. Only the files in this directory will be part of the integrity check."> 
    148                 ../t/testintegrity 
    149             </test_dir> 
     129            </changes_found_file> 
     130            <!-- HoneyClient::Agent::Integrity::Filesystem Options --> 
     131            <Filesystem> 
     132                <directories_to_check description="List of base directories on the filesystem to recursively analyze.  Use a regular slash (/) instead of a backslash (\) as a directory separator character."> 
     133                    <name>C:/</name> 
     134                </directories_to_check> 
     135                <exclude_list description="List of regular expressions that match files/directories to exclude from analysis.  These entries match files/directories that change normally during the course of driving the target application.  As such, they are excluded from analysis in order to reduce false positives.  Use a regular slash (/) instead of a backslash (\) as a directory separator character.  Never prefix any entry with a carat (^) before the drive letter, such as '^C:/', and never add the regex suffix ($) to the end of an expression, such as 'C:/Temp$'.  All comparisons are case-insensitive."> 
     136                    <regex>C:/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader.*</regex> 
     137                    <regex>C:/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles.*</regex> 
     138                    <regex>C:/Documents and Settings/Administrator/Cookies.*</regex> 
     139                    <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex> 
     140                    <regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex> 
     141                    <regex>C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5.*</regex> 
     142                    <regex>C:/Documents and Settings/Administrator/Local Settings/Temp</regex> 
     143                    <regex>C:/Documents and Settings/Administrator/Recent.*</regex> 
     144                    <regex>C:/Documents and Settings/Administrator/ntuser.dat.LOG</regex> 
     145                    <regex>C:/Program Files/Mozilla Firefox/active-update.xml</regex> 
     146                    <regex>C:/Program Files/Mozilla Firefox/updates</regex> 
     147                    <regex>C:/WINDOWS/PCHEALTH/HELPCTR/DataColl.*</regex> 
     148                    <regex>C:/WINDOWS/Prefetch.*</regex> 
     149                    <regex>C:/WINDOWS/Debug/UserMode/userenv.log</regex> 
     150                    <regex>C:/WINDOWS/SchedLgU.txt</regex> 
     151                    <regex>C:/WINDOWS/SoftwareDistribution/DataStore.*</regex> 
     152                    <regex>C:/WINDOWS/SoftwareDistribution/ReportingEvents.log</regex> 
     153                    <regex>C:/WINDOWS/SoftwareDistribution/WuRedir.*</regex> 
     154                    <regex>C:/WINDOWS/SYSTEM32/config/SecEvent.evt</regex> 
     155                    <regex>C:/WINDOWS/SYSTEM32/config/SysEvent.evt</regex> 
     156                    <regex>C:/WINDOWS/SYSTEM32/config/software.log</regex> 
     157                    <regex>C:/WINDOWS/SYSTEM32/wbem.*</regex> 
     158                    <regex>C:/WINDOWS/WindowsUpdate.log</regex> 
     159                    <!-- To exclude entries inside cygwin, use the following format. --> 
     160                    <regex>/cygdrive/c/cygwin/tmp.*</regex> 
     161                    <regex>/cygdrive/c/cygwin/home/Administrator/honeyclient.*</regex> 
     162                </exclude_list> 
     163                <!-- HoneyClient::Agent::Integrity::Filesystem::Test Options --> 
     164                <Test> 
     165                    <!-- 
     166                        Note: you should *never* need to change *any* values 
     167                        within this section of the configuration.  All contents 
     168                        are *only* used for unit testing. 
     169                    --> 
     170                    <monitor_dir description="The relative path to the test directory, that's used during unit testing." default="t/test_filesystem"> 
     171                        t/test_filesystem 
     172                    </monitor_dir> 
     173                </Test> 
     174            </Filesystem> 
     175            <!-- HoneyClient::Agent::Integrity::Registry Options --> 
    150176            <Registry> 
     177                <hives_to_check description="List of registry hives to analyze."> 
     178                    <name>HKEY_LOCAL_MACHINE</name> 
     179                    <name>HKEY_CLASSES_ROOT</name> 
     180                    <name>HKEY_CURRENT_USER</name> 
     181                    <name>HKEY_USERS</name> 
     182                    <name>HKEY_CURRENT_CONFIG</name>  
     183                </hives_to_check> 
     184                <exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis.  These entries match registry key directories that change normally during the course of driving the target application.  As such, they are excluded from analysis in order to reduce false positives.  As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character."> 
     185                    <regex>^HKEY_CURRENT_USER\\SessionInformation.*$</regex> 
     186                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 
     187                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International$</regex> 
     188                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex> 
     189                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main$</regex> 
     190                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
     191                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
     192                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
     193                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
     194                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume.*$</regex> 
     195                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex> 
     196                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex> 
     197                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex> 
     198                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex> 
     199                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex> 
     200                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex> 
     201                    <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex> 
     202                    <regex>^HKEY_CURRENT_USER\\Volatile Environment$</regex> 
     203                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia$</regex> 
     204                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia\\FlashPlayer$</regex> 
     205                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\RNG$</regex> 
     206                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\BITS$</regex> 
     207                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine\\Extension-List\\.*$</regex> 
     208                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\S.+\\Extension-List\\.*$</regex> 
     209                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\.*$</regex> 
     210                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update.*$</regex> 
     211                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\.*$</regex> 
     212                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Prefetcher$</regex> 
     213                    <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\WgaLogon\\Settings$</regex> 
     214                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\.+\\Parameters\\Tcpip.*$</regex> 
     215                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Dhcp\\Parameters.*$</regex> 
     216                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Eventlog\\Application\\ESENT.*$</regex> 
     217                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\SharedAccess\\Epoch.*$</regex> 
     218                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex> 
     219                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Parameters.*$</regex> 
     220                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Application\\ESENT.*$</regex> 
     221                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Epoch$</regex> 
     222                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex> 
     223                    <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.+\\Parameters\\Tcpip.*$</regex> 
     224                    <regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex> 
     225                    <regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex> 
     226                    <regex>^HKEY_USERS\\.+\\UNICODE Program Groups.*$</regex> 
     227                    <regex>^HKEY_USERS\\S.+\\SessionInformation$</regex> 
     228                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 
     229                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International$</regex> 
     230                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex> 
     231                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Main$</regex> 
     232                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
     233                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
     234                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
     235                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
     236                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume.*$</regex> 
     237                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex> 
     238                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex> 
     239                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex> 
     240                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex> 
     241                    <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex> 
     242                </exclude_list> 
    151243                <!-- HoneyClient::Agent::Integrity::Registry::Test Options --> 
    152244                <Test> 
    …… 
    304396        <!-- HoneyClient::Manager::VM Options --> 
    305397        <VM> 
    306             <!-- TODO: Update this. --> 
    307398            <!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. --> 
    308399            <port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089"> 
    309400                8089 
    310401            </port> 
    311             <!-- TODO: Update this. --> 
    312402            <datastore_path description="The absolute path to the parent directory, where all HoneyClient VM data is stored on the host server.  It is assumed that individual VM data is stored in separate subdirectories within this parent directory." default="/vm"> 
    313403                /vm 
    314404            </datastore_path> 
    315             <!-- TODO: Update this. --> 
    316405            <snapshot_path description="The absolute path to the directory that contains all snapshot data, associated with every HoneyClient VM." default="/vm/snapshots"> 
    317406                /vm/snapshots 
    318407            </snapshot_path> 
    319             <!-- TODO: Update this. --> 
    320408            <vmware_port description="The TCP port that VMware Server / GSX uses for console communication.  By default, this TCP port is 902.  Unless you've explicitly changes this port during the vmware-config.pl setup process, leave this setting as the default." default="902"> 
    321409                902 
    322410            </vmware_port> 
    323             <!-- TODO: Update this. --> 
    324411            <bin_tar description="The absolute path to the 'tar' executable, accessible on the host filesystem." default="/bin/tar"> 
    325412                /bin/tar 
    326413            </bin_tar> 
    327             <!-- TODO: Update this. --> 
    328414            <vm_id_length description="The length of each corresponding VM identifier (VMID).  This value can be any integer between 1 and 32, inclusive.  The VMID is a hexadecimal string that represents the VM's name.  It is designed to be generated once per clone and remain for the life of the VM (regardless of where it runs).  The VMID is used externally by HoneyClient::Manager and HoneyClient::Manager::FW.  The HoneyClient::Manager::FW package uses IPTables and binds each rule to a specific VMID.  However, IPTable's firewall rule labels can only be a maximum of 30 characters in length.  Thus, 26 is specified here, to account for 'VMID-OUT' as a possible chain name." default="26"> 
    329415                26 
    330416            </vm_id_length> 
    331             <!-- TODO: Update this. --> 
    332417            <dhcp_log description="The absolute path to the file that contains the DHCP logs, when a new VM gets a DHCP lease from the VMware Server / GSX server." default="/var/log/messages"> 
    333418                /var/log/messages 
    …… 
    340425                    are *only* used for unit testing. 
    341426                --> 
    342                 <test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/testVM/winXPPro.vmx"> 
    343                     t/testVM/winXPPro.vmx 
     427                <test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/test_vm/winXPPro.vmx"> 
     428                    t/test_vm/winXPPro.vmx 
    344429                </test_vm_config> 
    345430            </Test> 

  • honeyclient/trunk/lib/HoneyClient/Agent.pm

    r289 r328  
    99# @author knwang, ttruong, kindlund 
    1010# 
    11 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     11# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1212# 
    1313# This program is free software; you can redistribute it and/or 
    …… 
    163163 
    164164# Make sure Storable loads. 
    165 BEGIN { use_ok('Storable', qw(nfreeze thaw)) or diag("Can't load Storable package.  Check to make sure the package library is correctly listed within the path."); } 
     165BEGIN { use_ok('Storable', qw(freeze nfreeze thaw)) or diag("Can't load Storable package.  Check to make sure the package library is correctly listed within the path."); } 
    166166require_ok('Storable'); 
     167can_ok('Storable', 'freeze'); 
    167168can_ok('Storable', 'nfreeze'); 
    168169can_ok('Storable', 'thaw'); 
    169 use Storable qw(nfreeze thaw); 
     170use Storable qw(freeze nfreeze thaw); 
    170171 
    171172# Make sure MIME::Base64 loads. 
    …… 
    209210# Include Hash Serialization Utility Libraries 
    210211# TODO: Update unit tests to include 'dclone' 
    211 use Storable qw(nfreeze thaw dclone); 
     212use Storable qw(freeze nfreeze thaw dclone); 
    212213$Storable::Deparse = 1; 
    213214$Storable::Eval = 1; 
    …… 
    242243# initialized integrity state of the VM -- ready to be checked 
    243244# against, at any time. 
     245our $integrity = undef; 
    244246our $integrityState : shared = undef; 
    245247 
    …… 
    369371    # Perform initial integrity baseline check. 
    370372    #my $integrity = undef; 
    371     #if ($PERFORM_INTEGRITY_CHECKS) { 
    372     #    print "Initializing Integrity Check...\n"; 
    373     #    # TODO: Initialize Integrity Checks 
    374     #    $integrity = HoneyClient::Agent::Integrity->new(); 
    375     #    $integrity->initAll(); 
    376     #} 
    377     #$integrityState = $integrity->serialize(); 
     373    if ($PERFORM_INTEGRITY_CHECKS) { 
     374        $integrity = HoneyClient::Agent::Integrity->new(); 
     375        $integrity->closeFiles(); 
     376        $integrityState = freeze($integrity); 
     377    } 
     378    # XXX: Check to make sure this doesn't destroy the integrity 
     379    # object prematurely. 
     380    #$integrity = undef; 
    378381 
    379382    # Release data lock. 
    …… 
    730733                    # As such, do NOT try to call integrity checks on multiple, simultaneous 
    731734                    # asynchronous threaded drivers. 
    732                     #$integrity = thaw($integrityState); 
     735                    $integrity = thaw($integrityState); 
    733736                    # Perform initial integrity baseline check. 
    734                     print "Initializing Integrity Check...\n"; 
     737                    #print "Initializing Integrity Check...\n"; 
    735738                    # TODO: Initialize Integrity Checks 
    736                     $integrity = HoneyClient::Agent::Integrity->new(); 
    737                     $integrity->initAll(); 
    738  
    739                     # TODO: Delete this. 
    740                     #$Data::Dumper::Indent = 1; 
    741                     #$Data::Dumper::Terse = 1; 
    742                     #print "Integrity: " . Dumper($integrity) . "\n"; 
     739                    #$integrity = HoneyClient::Agent::Integrity->new(); 
    743740                } 
    744741 
    …… 
    815812                    # Check to see if our driver's targets have changed. 
    816813                    $driverTargetsChanged = not(Compare($data->{$driverName}->{'next'}->{'targets'}, $driver->next()->{'targets'})); 
     814                    # XXX: Delete this, eventually. 
     815                    if ($driverTargetsChanged) { 
     816                        print "Driver targets have changed.\n"; 
     817                        #$Data::Dumper::Terse = 0; 
     818                        #$Data::Dumper::Indent = 1; 
     819                        #print "Current: " . Dumper($data->{$driverName}->{'next'}->{'targets'}) . "\n"; 
     820                        #print "Next: " . Dumper($driver->next()->{'targets'}) . "\n"; 
     821                    } 
    817822 
    818823                    # Copy object data to shared memory. 
    …… 
    843848                    # the $data->{$driverName}->{'status'} sub-hashtable. 
    844849                    print "Performing Integrity Checks...\n"; 
    845                     if ($integrity->checkAll()) { 
     850                    my $changes = $integrity->check(); 
     851                    if (scalar(@{$changes->{registry}}) ||  
     852                        scalar(@{$changes->{filesystem}})) { 
    846853                        print "Integrity Check: FAILED\n"; 
    847854                        $data->{$driverName}->{'status'}->{'is_compromised'} = 1; 
    …… 
    11561163=head1 COPYRIGHT & LICENSE 
    11571164 
    1158 Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     1165Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    11591166 
    11601167This program is free software; you can redistribute it and/or 

  • honeyclient/trunk/lib/HoneyClient/Agent/Driver.pm

    r234 r328  
    1010# @author knwang, ttruong, kindlund 
    1111# 
    12 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     12# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1313# 
    1414# This program is free software; you can redistribute it and/or 
    …… 
    713713=head1 COPYRIGHT & LICENSE 
    714714 
    715 Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     715Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    716716 
    717717This program is free software; you can redistribute it and/or 

  • honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser.pm

    r234 r328  
    1111# @author knwang, kindlund, stephenson 
    1212# 
    13 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     13# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1414# 
    1515# This program is free software; you can redistribute it and/or 
    …… 
    476476 
    477477    # Comma-separated string containing the good words and bad words for link scoring purposes 
     478    # TODO: Need to fix this to support proper XML list elements. 
    478479    goodwords => getVar(name => "goodwords", namespace => "HoneyClient::Agent::Driver::Browser"), 
    479480    badwords => getVar(name => "badwords", namespace => "HoneyClient::Agent::Driver::Browser"), 
    …… 
    10231024    # Check our internal relative links counter. 
    10241025    if ($self->_remaining_number_of_relative_links_to_visit == 1) { 
     1026 
     1027        # XXX: Delete this, eventually. 
     1028        print "Resetting relative links to visit counter.\n"; 
     1029 
    10251030        # The counter has reached one, so drop all other relative links 
    10261031        # found, to force the driver to go to a new website. 
    …… 
    15781583=head1 COPYRIGHT & LICENSE 
    15791584 
    1580 Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     1585Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    15811586 
    15821587This program is free software; you can redistribute it and/or 

  • honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser/FF.pm

    r234 r328  
    77#              HoneyClient VM. 
    88# 
     9# CVS: $Id$ 
     10# 
    911# @author knwang, xkovah, kindlund, ttruong 
    1012# 
    11 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     13# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1214# 
    1315# This program is free software; you can redistribute it and/or 

  • honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser/IE.pm

    r234 r328  
    1111# @author knwang, ttruong, kindlund, stephenson 
    1212# 
    13 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     13# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1414# 
    1515# This program is free software; you can redistribute it and/or 

  • honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm

    r261 r328  
    11################################################################################ 
    22# Created on:  June 01, 2006 
    3 # Package:     HoneyClient::Agent 
     3# Package:     HoneyClient::Agent::Integrity 
    44# File:        Integrity.pm 
    55# Description: Module for checking the system integrity for possible 
    66#              modifications. 
    77# 
    8 # @author knwang, xkovah, ttruong 
     8# CVS: $Id$ 
    99# 
    10 # Copyright (C) 2006 The MITRE Corporation.  All rights reserved. 
     10# @author knwang, xkovah, ttruong, kindlund, stephenson 
     11# 
     12# Copyright (C) 2007 The MITRE Corporation.  All rights reserved. 
    1113# 
    1214# This program is free software; you can redistribute it and/or 
    …… 
    3133=head1 NAME 
    3234 
    33 HoneyClient::Agent::Integrity - Responsible for performing static integrity  
    34 checks on the filesystem and registry. (Additionally it calls an external module  
    35 which is responsible for performing real-time checking for new processes which 
    36 are created. 
     35HoneyClient::Agent::Integrity - Perl extension to perform configurable  
     36integrity checks of the Agent VM OS. 
    3737 
    3838=head1 VERSION 
    3939 
    40 0.95 
     40This documentation refers to HoneyClient::Agent::Integrity version 0.95. 
    4141 
    4242=head1 SYNOPSIS 
    4343 
     44  use HoneyClient::Agent::Integrity; 
     45  use Data::Dumper; 
     46 
     47  # Create the Integrity object.  Upon creation, the object will 
     48  # be initialized, by performing a baseline of the Agent VM OS. 
     49  my $integrity = HoneyClient::Agent::Integrity->new(); 
     50 
     51  # ... Some time elapses ... 
     52 
     53  # Check the Agent VM, for any violations. 
     54  my $changes = $integrity->check(); 
     55 
     56  if (!defined($changes)) { 
     57      print "No integrity violations have occurred.\n"; 
     58  } else { 
     59      print "System integrity has been compromised:\n"; 
     60      print Dumper($changes); 
     61  } 
     62 
     63  # $changes refers to an array of hashtable references, where 
     64  # each hashtable has the following format: 
     65  # 
     66  # $changes = { 
     67  #     registry => [ { 
     68  #         # The registry directory name. 
     69  #         'key' => 'HKEY_LOCAL_MACHINE\Software...', 
     70  # 
     71  #         # Indicates if the registry directory was deleted, 
     72  #         # added, or changed. 
     73  #         'status' => 'deleted' | 'added' | 'changed', 
     74  #  
     75  #         # An array containing the list of entries within the 
     76  #         # registry directory that have been deleted, added, or 
     77  #         # changed.  If this array is empty, then the corresponding 
     78  #         # registry directory in the original and new hives contained 
     79  #         # no entries. 
     80  #         'entries'  => [ { 
     81  #             'name' => "\"string\"",  # A (potentially) quoted string;  
     82  #                                      # "@" for default 
     83  #             'new_value' => "string", # New string; maybe undef, if deleted 
     84  #             'old_value' => "string", # Old string; maybe undef, if added 
     85  #         }, ], 
     86  #    }, ], 
     87  # 
     88  #    filesystem => [ { 
     89  #         # Indicates if the filesystem entry was deleted, 
     90  #         # added, or changed. 
     91  #         'status' => 'deleted' | 'added' | 'changed', 
     92  # 
     93  #         # If the entry has been added/changed, then this  
     94  #         # hashtable contains the file/directory's new information. 
     95  #         'new' => { 
     96  #             'name'  => 'C:\WINDOWS\SYSTEM32...', 
     97  #             'size'  => 1263, # in bytes 
     98  #             'mtime' => 1178135092, # modification time, seconds since epoch 
     99  #         }, 
     100  # 
     101  #         # If the entry has been deleted/changed, then this 
     102  #         # hashtable contains the file/directory's old information. 
     103  #         'old' => { 
     104  #             'name'  => 'C:\WINDOWS\SYSTEM32...', 
     105  #             'size'  => 802, # in bytes 
     106  #             'mtime' => 1178135028, # modification time, seconds since epoch 
     107  #         }, 
     108  #   }, ], 
     109  # } 
     110 
     111=head1 DESCRIPTION 
     112 
     113# TODO: This text needs to change. 
     114 
    44115=head2 INITIALIZATION 
     116 
     117# TODO: This text needs to change. 
    45118 
    46119In order to properly check the system, a snapshot must be taken of a known-good 
    …… 
    61134 
    62135=head2 CHECKING 
     136 
     137# TODO: This text needs to change. 
    63138 
    64139Checking the filesystem entails running mostly the same code as the initialization 
    …… 
    92167use Carp (); 
    93168 
    94 =pod 
    95  
    96 =begin testing 
    97  
    98 # Make sure HoneyClient::Agent::Integrity loads. 
    99 BEGIN { use_ok('HoneyClient::Agent::Integrity', qw(initAll checkAll initRegistry checkRegistry initFileSystem checkFileSystem)) or diag("Can't load HoneyClient::Util::Config package.  Check to make sure the package library is correctly listed within the path."); } 
    100 require_ok('HoneyClient::Agent::Integrity'); 
    101 #can_ok('HoneyClient::Agent::Integrity', 'new'); 
    102 can_ok('HoneyClient::Agent::Integrity', 'initAll'); 
    103 can_ok('HoneyClient::Agent::Integrity', 'checkAll'); 
    104 can_ok('HoneyClient::Agent::Integrity', 'initFileSystem'); 
    105 can_ok('HoneyClient::Agent::Integrity', 'checkFileSystem'); 
    106 use HoneyClient::Agent::Integrity qw(initAll checkAll initFileSystem checkFileSystem); 
    107  
    108 # Make sure HoneyClient::Util::Config loads. 
    109 BEGIN { use_ok('HoneyClient::Util::Config', qw(getVar)) or diag("Can't load HoneyClient::Util::Config package.  Check to make sure the package library is correctly listed within the path."); } 
    110 require_ok('HoneyClient::Util::Config'); 
    111 can_ok('HoneyClient::Util::Config', 'getVar'); 
    112 use HoneyClient::Util::Config qw(getVar); 
    113  
    114 # Make sure File::Find loads. 
    115 BEGIN { use_ok('File::Find', qw(find)) or diag("Can't load File::Find package.  Check to make sure the package library is correctly listed within the path."); } 
    116 require_ok('File::Find'); 
    117 can_ok('File::Find', 'find'); 
    118 use File::Find; 
    119  
    120 # Make sure Digest::MD5 loads. 
    121 #BEGIN { use_ok('Digest::MD5', qw(new)) or diag("Can't load Digest::MD5 package.  Check to make sure the package library is correctly listed within the path."); } 
    122 #require_ok('Digest::MD5'); 
    123 #use Digest::MD5; 
    124  
    125 # Make sure MIME::Base64 loads. 
    126 BEGIN { use_ok('MIME::Base64', qw(encode_base64 decode_base64)) or diag("Can't load MIME::Base64 package.  Check to make sure the package library is correctly listed within the path."); } 
    127 require_ok('MIME::Base64'); 
    128 can_ok('MIME::Base64', 'encode_base64'); 
    129 can_ok('MIME::Base64', 'decode_base64'); 
    130 use MIME::Base64 qw(encode_base64 decode_base64); 
    131  
    132 # Make sure Storable loads. 
    133 BEGIN { use_ok('Storable', qw(dclone nfreeze thaw)) or diag("Can't load Storable package.  Check to make sure the package library is correctly listed within the path."); } 
    134 require_ok('Storable'); 
    135 can_ok('Storable', 'dclone'); 
    136 can_ok('Storable', 'nfreeze'); 
    137 can_ok('Storable', 'thaw'); 
    138 use Storable qw(dclone nfreeze thaw); 
    139  
    140 ###Testing Globals### 
    141 # Directory where the known-good test files are stored 
    142 $test_dir = getVar(name => "test_dir"); 
    143  
    144 # List of files and directories to check during filesystem checking 
    145 $file_checklist = getVar(name => "file_checklist"); 
    146  
    147 # List of files or directories to exclude if found in subdirs during 
    148 # filesystem check. 
    149 $file_exclude = getVar(name => "file_exclude"); 
    150  
    151 # File where found changes are written to 
    152 $change_file = getVar(name => "change_file"); 
    153  
    154 =end testing 
    155  
    156 =cut 
    157169 
    158170# Include Global Configuration Processing Library 
    159171use HoneyClient::Util::Config qw(getVar); 
     172 
     173# Include the Registry Checking Library 
    160174use HoneyClient::Agent::Integrity::Registry; 
    161 use File::Find qw(find); 
    162 #use Win32::TieRegistry; 
    163 use Digest::MD5; 
    164 use MIME::Base64; 
     175 
     176# Include the Filesystem Checking Library 
     177use HoneyClient::Agent::Integrity::Filesystem; 
     178 
     179# Use Storable Library 
    165180use Storable qw(nfreeze thaw dclone); 
    166181$Storable::Deparse = 1; 
    167182$Storable::Eval = 1; 
     183 
     184# Use Dumper Library 
    168185use Data::Dumper; 
    169 use File::Basename qw(dirname); 
     186 
     187# Include Logging Library 
     188use Log::Log4perl qw(:easy); 
     189 
     190####################################################################### 
     191# Module Initialization                                               # 
     192####################################################################### 
    170193 
    171194BEGIN { 
    …… 
    180203 
    181204    # Symbols to export on request 
    182     @EXPORT = qw(new initAll checkAll); 
     205    @EXPORT = qw( ); 
    183206 
    184207    # Items to export into callers namespace by default. Note: do not export 
    …… 
    186209    # Do not simply export all your public functions/methods/constants. 
    187210 
     211    # This allows declaration use HoneyClient::Agent::Integrity ':all'; 
     212    # If you do not need this, moving things directly into @EXPORT or @EXPORT_OK 
     213    # will save memory. 
     214 
     215    %EXPORT_TAGS = ( 
     216        'all' => [ qw( ) ], 
     217    ); 
     218 
    188219    # Symbols to autoexport (:DEFAULT tag) 
    189     @EXPORT_OK = qw(initAll checkAll); 
    190  
     220    @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } ); 
     221 
     222    $SIG{PIPE} = 'IGNORE'; # Do not exit on broken pipes. 
    191223} 
    192224our (@EXPORT_OK, $VERSION); 
    193225 
    194  
    195  
    196 ##################### 
    197 # GLOBALS 
    198 ##################### 
    199  
    200 # Package Global Variable 
    201 our $AUTOLOAD; 
    202  
    203 # These two hack variables are necessary currently in order to get values back  
    204 # out of the functions used with the find() function from File::Find. I can 
    205 # not pass in/out the current object, so these get around that by making a  
    206 # global copy. 
    207 my $g_hack; 
    208 my $g_ex_hash; 
    209  
    210 #Used *for now* to signal whether any changes occured (if they == 1) 
    211 my $g_fs_changes = 0; 
    212  
    213 # XXX: All dirs must NEVER end in a trailing slash. 
    214 my @default_file_exclude_array = ( 
    215     '/cygdrive/c/cygwin/tmp', 
    216     '/cygdrive/c/cygwin/tmp/changes.txt', 
    217     '/cygdrive/c/cygwin/tmp/cleanfile.txt', 
    218     '/cygdrive/c/cygwin/home/Administrator', 
    219     '/cygdrive/c/Documents and Settings/Administrator/Desktop/honeyclient', 
    220     '/cygdrive/c/WINDOWS/Prefetch', 
    221     '/cygdrive/c/WINDOWS/WindowsUpdate.log', 
    222     '/cygdrive/c/WINDOWS/Debug/UserMode/userenv.log', 
    223     '/cygdrive/c/WINDOWS/SoftwareDistribution/DataStore', 
    224     '/cygdrive/c/WINDOWS/SchedLgU.Txt', 
    225     '/cygdrive/c/WINDOWS/SoftwareDistribution/ReportingEvents.log', 
    226     '/cygdrive/c/WINDOWS/system32/config/SysEvent.Evt', 
    227     '/cygdrive/c/WINDOWS/system32/wbem', 
    228     '/cygdrive/c/WINDOWS/PCHEALTH/HELPCTR/DataColl', 
    229     '/cygdrive/c/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader', 
    230     '/cygdrive/c/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles', 
    231     '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles', 
    232     '/cygdrive/c/Documents and Settings/Administrator/Application Data/Talkback/MozillaOrg/Firefox15/Win32/2006050817/permdata.box', 
    233     '/cygdrive/c/Documents and Settings/Administrator/Cookies/index.dat', 
    234     '/cygdrive/c/Documents and Settings/Administrator/Local Settings/History/History.IE5', 
    235     '/cygdrive/c/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5', 
    236     '/cygdrive/c/Documents and Settings/Administrator/Recent', 
    237     '/cygdrive/c/Program Files/Mozilla Firefox/updates', 
    238     '/cygdrive/c/Program Files/Mozilla Firefox/active-update.xml', 
    239     '/cygdrive/c/Program Files/Mozilla Firefox/updates.xml', 
    240     '/cygdrive/c/System Volume Information', 
    241     '/cygdrive/c/WINDOWS/SoftwareDistribution/WuRedir', 
    242     '/cygdrive/c/WINDOWS/SYSTEM32/config/SecEvent.Evt', 
    243     '/cygdrive/c/WINDOWS/SYSTEM32/config/SysEvent.Evt', 
    244     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/INDEX.BTR', 
    245     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/INDEX.MAP', 
    246     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING.VER', 
    247     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING1.MAP', 
    248     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/MAPPING2.MAP', 
    249     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/OBJECTS.DATA', 
    250     '/cygdrive/c/WINDOWS/SYSTEM32/wbem/Repository/FS/OBJECTS.MAP', 
     226=pod 
     227 
     228=begin testing 
     229 
     230# Make sure Log::Log4perl loads 
     231BEGIN { use_ok('Log::Log4perl', qw(:nowarn)) 
     232        or diag("Can't load Log::Log4perl package. Check to make sure the package library is correctly listed within the path."); 
     233        
     234        # Suppress all logging messages, since we need clean output for unit testing. 
     235        Log::Log4perl->init({ 
     236            "log4perl.rootLogger"                               => "DEBUG, Buffer", 
     237            "log4perl.appender.Buffer"                          => "Log::Log4perl::Appender::TestBuffer", 
     238            "log4perl.appender.Buffer.min_level"                => "fatal", 
     239            "log4perl.appender.Buffer.layout"                   => "Log::Log4perl::Layout::PatternLayout", 
     240            "log4perl.appender.Buffer.layout.ConversionPattern" => "%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n", 
     241        }); 
     242} 
     243require_ok('Log::Log4perl'); 
     244use Log::Log4perl qw(:easy); 
     245 
     246# Make sure the module loads properly, with the exportable 
     247# functions shared. 
     248BEGIN { use_ok('HoneyClient::Util::Config', qw(getVar setVar))  
     249        or diag("Can't load HoneyClient::Util::Config package.  Check to make sure the package library is correctly listed within the path."); } 
     250require_ok('HoneyClient::Util::Config'); 
     251can_ok('HoneyClient::Util::Config', 'getVar'); 
     252can_ok('HoneyClient::Util::Config', 'setVar'); 
     253use HoneyClient::Util::Config qw(getVar setVar); 
     254 
     255# Suppress all logging messages, since we need clean output for unit testing. 
     256Log::Log4perl->init({ 
     257    "log4perl.rootLogger"                               => "DEBUG, Buffer", 
     258    "log4perl.appender.Buffer"                          => "Log::Log4perl::Appender::TestBuffer", 
     259    "log4perl.appender.Buffer.min_level"                => "fatal", 
     260    "log4perl.appender.Buffer.layout"                   => "Log::Log4perl::Layout::PatternLayout", 
     261    "log4perl.appender.Buffer.layout.ConversionPattern" => "%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n", 
     262}); 
     263 
     264# Make sure Data::Dumper loads 
     265BEGIN { use_ok('Data::Dumper') 
     266        or diag("Can't load Data::Dumper package. Check to make sure the package library is correctly listed within the path."); } 
     267require_ok('Data::Dumper'); 
     268use Data::Dumper; 
     269 
     270# Make sure Storable loads 
     271BEGIN { use_ok('Storable', qw(nfreeze thaw dclone)) 
     272        or diag("Can't load Storable package. Check to make sure the package library is correctly listed within the path."); } 
     273require_ok('Storable'); 
     274can_ok('Storable', 'nfreeze'); 
     275can_ok('Storable', 'thaw'); 
     276can_ok('Storable', 'dclone'); 
     277use Storable qw(nfreeze thaw dclone); 
     278 
     279# Make sure HoneyClient::Agent::Integrity::Registry loads 
     280BEGIN { use_ok('HoneyClient::Agent::Integrity::Registry') 
     281        or diag("Can't load HoneyClient::Agent::Integrity::Registry package. Check to make sure the package library is correctly listed within the path."); } 
     282require_ok('HoneyClient::Agent::Integrity::Registry'); 
     283use HoneyClient::Agent::Integrity::Registry; 
     284 
     285# Make sure HoneyClient::Agent::Integrity::Filesystem loads 
     286BEGIN { use_ok('HoneyClient::Agent::Integrity::Filesystem') 
     287        or diag("Can't load HoneyClient::Agent::Integrity::Filesystem package. Check to make sure the package library is correctly listed within the path."); } 
     288require_ok('HoneyClient::Agent::Integrity::Filesystem'); 
     289use HoneyClient::Agent::Integrity::Filesystem; 
     290 
     291# Make sure HoneyClient::Agent::Integrity loads. 
     292BEGIN { use_ok('HoneyClient::Agent::Integrity') or diag("Can't load HoneyClient::Agent::Integrity package.  Check to make sure the package library is correctly listed within the path."); } 
     293require_ok('HoneyClient::Agent::Integrity'); 
     294use HoneyClient::Agent::Integrity; 
     295 
     296=end testing 
     297 
     298=cut 
     299 
     300####################################################################### 
     301# Global Configuration Variables                                      # 
     302####################################################################### 
     303 
     304# The global logging object. 
     305our $LOG = get_logger(); 
     306 
     307=pod 
     308 
     309=head1 DEFAULT PARAMETER LIST 
     310 
     311When an Integrity B<$object> is instantiated using the B<new()> function, 
     312the following parameters are supplied default values.  Each value 
     313can be overridden by specifying the new (key => value) pair into the 
     314B<new()> function, as arguments. 
     315 
     316=head2 bypass_baseline  
     317 
     318=over 4 
     319 
     320When set to 1, the object will forgo any type of initial baselining 
     321process, upon initialization.  Otherwise, baselining will occur 
     322as normal, upon initialization. 
     323 
     324=back 
     325 
     326=cut 
     327 
     328my %PARAMS = ( 
     329    # When set to 1, the object will forgo any type of initial baselining 
     330    # process, upon initialization.  Otherwise, baselining will occur 
     331    # as normal, upon initialization. 
     332    bypass_baseline => 0, 
     333 
     334    # Contains the Registry object, once initialized. 
     335    # (For internal use only.) 
     336    _registry => undef, 
     337 
     338    # Contains the Filesystem object, once initialized. 
     339    # (For internal use only.) 
     340    _filesystem => undef, 
     341 
     342    # XXX: comment this 
     343    _changes_found_file => getVar(name => 'changes_found_file'), 
    251344); 
    252345 
    253  
    254 my %PARAMS = ( 
    255  
    256     # Contains the Registry object, once initialized. 
    257     _registry => undef, 
    258  
    259     # XXX: Clean the rest of these variables up. 
    260     ### Files which are read in only ### 
    261     # List of files and directories to check during filesystem checking 
    262     file_checklist => getVar(name => "file_checklist", namespace => "HoneyClient::Agent::Integrity"), 
    263