blob: 4d9413e3c8fd112ab3a789a9890d6744e4b6ed6a [file] [log] [blame]
#!/usr/bin/perl
# **********************************************************
# Copyright (c) 2006 VMware, Inc. All rights reserved.
# **********************************************************
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# * Neither the name of VMware, Inc. nor the names of its contributors may be
# used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
# DAMAGE.
## bugtitle.pl
## by Vladimir Kiriansky
## August 2006
##
## find odd processes and show description of all found
###########################################################################
## Requires wget
## example use:
# just collect all links to select a few suspicious ones
# $ ./procdb.pl -s bug_8704/iexplore.exe.1608.00000000.xml
# ...
# wget -O - http://www.processlibrary.com/directory/files/wscntfy/ | grep -A 5 'Description:'
# normal use:
# $ ./procdb.pl bug_8704/iexplore.exe.1608.00000000.xml > processes.out
# $ cat process.out
# ..
# <td width="390">regscan.exe is added by
# Trojan.W32.Rbot. It is a worm which attemps to spread via
# network shares. It also contains backdoor Trojan
# capabilities allowing unauthorised remote access to the
# infected computer. If found on your system make sure that
# you have downloaded the latest update for your antivirus
# application. This process is a security risk and should be
# removed from your system.<br>
# copy&paste from bugtitle.pl
# FIXME: should merge with the logic from wld/wld.pl
# about having a whitelist database on DLLs
# adding only exe's that should be seen only once!
# so that we can detect a c:\temp\services.exe as rogue
# FIXME: not yet used
%seen_known = ();
# should add more entries from config/applications.html or even have a
# generator from config/application_data.h
%known_exe_description = {
'lsass' => 'lsass',
'services' => 'services'};
$tools = $ENV{'DYNAMORIO_TOOLS'};
if ($tools eq "") {
# use same dir this script sits in
$tools = $0;
if ($tools =~ /[\\\/]/) {
$tools =~ s/^(.+)[\\\/][\w\.]+$/$1/;
$tools =~ s/\\/\\\\/g;
} else {
$tools = "./";
}
# address_query needs DYNAMORIO_TOOLS set to find DRload.exe
$ENV{'DYNAMORIO_TOOLS'} = $tools;
}
# parameters
$usage = "Usage: $0 [-v] [-q] [-glob] [-noglob] <forensic_file>\n";
$just_show = 0;
$verbose = 0;
$quiet = 0;
$globall = 0;
$noglob = 0;
while ($#ARGV >= 0) {
if ($ARGV[0] eq '-v') {
$verbose = 1;
} elsif ($ARGV[0] eq '-q') {
$quiet = 1;
} elsif ($ARGV[0] eq '-s') {
$just_show = 1;
} elsif ($ARGV[0] eq '-glob') {
$globall = 1;
} elsif ($ARGV[0] eq '-noglob') {
$noglob = 1;
} elsif ($ARGV[0] =~ /^-/) {
die $usage;
} else {
# rest should be forensic file names
last;
}
shift;
}
die $usage if ($#ARGV < 0);
$multiple = ($#ARGV > 0);
while ($#ARGV >= 0) {
my $filearg = $ARGV[0];
# make it easy for users w/ non-globbing shell and non-globbing perl to
# pass *, w/o double-globbing and messing up escaped chars for other users
if (!$noglob && ($globall || $filearg =~ /\*/)) {
# FIXME: must convert from \ to / BEFORE the glob -- yet don't
# want to ruin escaped chars! It's a tradeoff: is \* a directory delimiter
# followed by metachar *, or is it an escaped * trying to be literal?
# In everyday usage we assume no escaped *'s!
# If we didn't care for \* directory delim we might do:
# $filearg =~ s|\\\\|//|g; # next rule won't get both slashes so need this rule
# $filearg =~ s|\\([\w\d])|/\1|g; # \ to / only if before a normal char
$filearg =~ s|\\|/|g; # assume \ is dir delim, no support for \ as escape char
@files = glob($filearg);
print "globbing: \"$filearg\" => \"@files\"\n" if ($verbose);
if ($#files < 0) {
# if glob comes up empty, don't use its results (to get error msg)
@files = ($filearg);
}
} else {
@files = ($filearg);
}
$multiple = $multiple || $#files > 0;
foreach $file (@files) {
print "processing \"$file\"\n" if ($verbose);
$file =~ s|\\|/|g; # normalize
unless (-f "$file") {
die "Error: No forensic file $file\n";
}
if ($multiple) {
print "\n$file:\n";
}
process_file($file);
}
shift;
}
sub is_known_exe
{
my ($exe) = @_;
return 0;
return 0 unless exists $known_exe_description { $exe };
# known should be only once
if (defined $seen_known{ $exe } &&
$seen_known{ $exe } == 1) {
# test with svchost.exe which may also be the Welchia worm
print "WARNING: second appearance of $exe\n";
}
$seen_known{ $exe } = 1;
return 1;
}
sub get_external_data
{
# wget -q http://www.processlibrary.com/directory/files/defwatch -O - | grep -A 5 "Description:"
my ($exe) = @_;
my $base = "http://www.processlibrary.com/directory/files/";
my $url = "$base$exe/";
my $wget = "wget -q -O - ";
my $postprocess = "grep -A 5 'Description:'";
my $desc = "";
my $command = "$wget $url | $postprocess";
$desc = `$command` if (!$just_show);
print "$command \n" if ($just_show);
# FIXME: note processlibrary tries to find a substring if they can't find an exact match
# so we have to verify that the process name they are returning is the one we really asked for
# for the time being leaving users to worry about it by being more verbose
return $desc;
}
# http://www.processlibrary.com/directory/files/rtvscan/index.html
sub process_file($) {
my ($file) = @_;
$processing = 0;
open(IN, "< $file") || die "Error: couldn't open $file\n";
while (<IN>) {
# Handle CR
s/\r//;
# Start of process list
if (/^<process-list> <!\[CDATA\[/) {
$processing = 1;
}
elsif (/]]> <\/process-list>/) {
$processing = 0;
} elsif ($processing) {
$skip = 0;
if (/^([^\s\<]+).exe$/i) {
$process=$1;
} else {
$process=$_;
chomp $process;
if ($process ne "System") {
print "not an EXE '$process!'\n";
} else {
$skip = 1;
}
}
if (!$skip) {
print "Querying '$process'\n" if ($verbose);
$skip = is_known_exe($exe);
}
if (!$skip) {
print "Querying Externally '$process'\n";
print &get_external_data($process), "\n";
}
}
}
close(IN);
}
sub unixpath2win32($) {
my ($p) = @_;
# use cygpath if available, it will convert /home to c:\cygwin\home, etc.
$cp = `cygpath -wi \"$p\"`;
chomp $cp;
if ($cp eq "") {
# do it by hand
# add support for /x => x:
$p =~ s|^/([a-z])/|$1:/|;
# forward slash becomes backslash since going through another shell
$p =~ s|/|\\|g;
} else {
$p = $cp;
}
# make single backslashes doubles
$p =~ s|\\{1}|\\\\|g;
return $p;
}