davidpany / wmi_forensics Goto Github PK

View Code? Open in Web Editor NEW

284.0 20.0 56.0 15 KB

Python 100.00%

wmi_forensics's Introduction

WMI_Forensics

This repository contains scripts used to find evidence in WMI repositories, specifically OBJECTS.DATA files located at:

C:\WINDOWS\system32\wbem\Repository\OBJECTS.DATA
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA

CCM_RUA_Finder.py

CCM_RUA_finder.py extracts SCCM software metering RecentlyUsedApplication logs from OBJECTS.DATA files.

Usage

CCM_RUA_Finder.py -i path\to\OBJECTS.DATA -o path\to\output.xls

The output file will be TSV formatted. Excel will automatically parse TSV files with .xls extensions.

PyWMIPersistenceFinder.py

PyWMIPersistenceFinder.py is designed to find WMI persistence via FitlerToConsumerBindings solely by keyword searching the OBJECTS.DATA file without parsing the full WMI repository.

In testing, this script has found the exact same data as python-cim's show_FilterToConsumerBindings.py without requiring the setup. Only further testing will indicate if this script misses any data that python-cim can find.

In theory, this script will detect FilterToConsumerBindings that are deleted and remain in unallocated WMI space, but I haven't had a chance to test yet.

Usage

PyWMIPersistenceFinder.py <OBJECTS.DATA file>

The output is text based in the following format for each binding:

<consumer name>-<filter name>
            <optional notes>
        Consumer: <consumer name><consumer execution details>
        Filter: <filter name><filter listener details>

Contact

David Pany - Mandiant (FireEye) - 2017

Twitter: @DavidPany

Please send comments, bug reports, and questions to @DavidPany or push changes directly to GitHub

wmi_forensics's People

Contributors

Stargazers

Watchers

wmi_forensics's Issues

struct.error: unpack requires a string argument of length 8

Using the tool I got the following error:
$ python CCM_RUA_Finder.py -i OBJECTS.DATA "Format" "FolderPath" "ExplorerFileName" "FileSize" "LastUserName" "LastUsedTime" "TimeZoneOffset" "LaunchCount" "Timestamp1" "Timestamp2" "OriginalFileName" "FileDescription" "CompanyName" "ProductName" "ProductVersion" "FileVersion" "AdditionalProductCodes""msiVersion" "msiDisplayName" "SoftwarePropertiesHash" "ProductCode" "ProductLanguage" "msiPublisher" "FilePropertiesHash" Carved_NullDelim "C:\Windows\system32\" "DllHost.exe" " " "GROUPE\lol" "2017-01-23 12:48:05" ="+000" " " " " " " "dllhost.exe" "COM Surrogate" "Microsoft Corporation" "Microsoft� Windows� Operating System" "6.1.7600.16385" "6.1.7600.16385 (win7_rtm.090713-1255)" "" "" "" "" " " "" "" "" Traceback (most recent call last): File "CCM_RUA_Finder.py", line 506, in <module> main() File "CCM_RUA_Finder.py", line 290, in main parse_null_delimited_record(ccm_nulldel_full_match, True, output_file) File "CCM_RUA_Finder.py", line 359, in parse_null_delimited_record file_size = struct.unpack("L", header_data_match.groups()[4])[0] struct.error: unpack requires a string argument of length 8

If you need it I can provide a sample of the file I used it on.

TypeError: a bytes-like object is required, not 'str'

I run the following command and receive the following error:

python3 CCM_RUA_Finder.py -i OBJECTS.DATA -o OBJECTS.DATA.xls
                0.0% complete...Traceback (most recent call last):
  File "/Users/Ben/Desktop/elrond_dev/WMI_Forensics/CCM_RUA_Finder.py", line 554, in <module>
    main()
  File "/Users/Ben/Desktop/elrond_dev/WMI_Forensics/CCM_RUA_Finder.py", line 241, in main
    all_ccm_data_set = find_ccm_rua_data(args.input)
  File "/Users/Ben/Desktop/elrond_dev/WMI_Forensics/CCM_RUA_Finder.py", line 191, in find_ccm_rua_data
    if "CCM_RecentlyUsedApps" in current_buffer:
TypeError: a bytes-like object is required, not 'str'

Parser may not be working correctly

Hey David, This is an awesome tool. However, I just did a POC test with a WMI persistence on a VM and your script did not pick up the persistence. I could view it live using WMI explorer. Any idea what could have caused that.

struct.error for parse_null_delimited_record function

First, I wanted to thank you for sharing your code!

When you have a moment, I was hoping you could look into why the parser is throwing the following exception during the unpack:
File "CCM_RUA_Finder.py", line 361, in parse_null_delimited_record
file_size = struct.unpack("L", header_data_match.groups()[4])[0]
struct.error: unpack requires a string argument of length 8

I have tried two different OBJECTS.DATA files and both give the same results.

When I put in a exception (catch -> ignore) for the parse_null_delimited_record function, I only get minimal records parsed (40+) with several hundred ignored.

davidpany / wmi_forensics Goto Github PK

wmi_forensics's Introduction

WMI_Forensics

CCM_RUA_Finder.py

Usage

PyWMIPersistenceFinder.py

Usage

Contact

wmi_forensics's People

Contributors

Stargazers

Watchers

Forkers

wmi_forensics's Issues

Recommend Projects

Recommend Topics

Recommend Org