Implement initial detection and data structures for suspicious artifacts
This commit is contained in:
Evan Hosinski
+109
@@ -0,0 +1,109 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"rmm-hunter/internal/pkg"
|
||||
"rmm-hunter/internal/pkg/hunter"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var (
|
||||
excludeRMMs []string
|
||||
inputFile string
|
||||
outputFile string
|
||||
)
|
||||
|
||||
// rootCmd represents the base command when called without any subcommands
|
||||
var rootCmd = &cobra.Command{
|
||||
Use: "rmm-hunter",
|
||||
Short: "RMM-Hunter - Detect and eliminate Remote Monitoring and Management software",
|
||||
Long: `RMM-Hunter is a tool designed to detect and eliminate Remote Monitoring
|
||||
and Management (RMM) software on Windows systems. It can hunt for suspicious
|
||||
processes, services, binaries, and network connections associated with RMM tools.`,
|
||||
Version: "1.0.0",
|
||||
}
|
||||
|
||||
// huntCmd represents the hunt command
|
||||
var huntCmd = &cobra.Command{
|
||||
Use: "hunt",
|
||||
Short: "Hunt for RMM software on the system",
|
||||
Long: `Hunt mode scans the system for signs of RMM software including:
|
||||
- Suspicious processes
|
||||
- Services
|
||||
- Binaries and executables
|
||||
- Network connections
|
||||
- Scheduled tasks
|
||||
- Registry entries`,
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
fmt.Println("Starting RMM Hunt...")
|
||||
runHunt()
|
||||
},
|
||||
}
|
||||
|
||||
// eliminateCmd represents the eliminate command
|
||||
var eliminateCmd = &cobra.Command{
|
||||
Use: "eliminate",
|
||||
Short: "Eliminate Sus software based on hunt results",
|
||||
Long: `Eliminate mode removes detected Sus software from the system.
|
||||
Requires a JSON input file containing hunt results to determine what to remove.`,
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
if inputFile == "" {
|
||||
fmt.Println("Error: --input flag is required for eliminate command")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
fmt.Printf("Starting Sus Elimination using input file: %s\n", inputFile)
|
||||
// TODO: Call eliminate.Eliminate() function
|
||||
runEliminate()
|
||||
},
|
||||
}
|
||||
|
||||
// Execute adds all child commands to the root command and sets flags appropriately.
|
||||
func Execute() {
|
||||
err := rootCmd.Execute()
|
||||
if err != nil {
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func init() {
|
||||
// Add subcommands
|
||||
rootCmd.AddCommand(huntCmd)
|
||||
rootCmd.AddCommand(eliminateCmd)
|
||||
|
||||
// Global flags
|
||||
rootCmd.PersistentFlags().StringSliceVar(&excludeRMMs, "exclude", []string{},
|
||||
"Comma-separated list of Sus names to exclude from detection (optional)")
|
||||
|
||||
// Hunt command flags
|
||||
huntCmd.Flags().StringSliceVar(&excludeRMMs, "exclude", []string{},
|
||||
"Comma-separated list of Sus names to exclude from hunt")
|
||||
huntCmd.Flags().StringVarP(&outputFile, "output", "o", "suspicious-hunter.json",
|
||||
"Output file to write hunt results (optional) Default: suspicious-hunter.json")
|
||||
|
||||
// Eliminate command flags
|
||||
eliminateCmd.Flags().StringVarP(&inputFile, "input", "i", "",
|
||||
"JSON input file containing hunt results (required)")
|
||||
eliminateCmd.MarkFlagRequired("input")
|
||||
}
|
||||
|
||||
func runHunt() {
|
||||
fmt.Println("Starting Sus Hunt...")
|
||||
if len(excludeRMMs) > 0 {
|
||||
fmt.Printf("Excluding RMMs: %v\n", excludeRMMs)
|
||||
}
|
||||
|
||||
hunter.Start(pkg.RunOptions{
|
||||
ExcludeRMMs: excludeRMMs,
|
||||
})
|
||||
|
||||
}
|
||||
|
||||
func runEliminate() {
|
||||
// TODO: Implement eliminate functionality
|
||||
fmt.Println("Eliminate functionality not yet implemented")
|
||||
fmt.Printf("Input file: %s\n", inputFile)
|
||||
fmt.Printf("Excluded RMMs: %v\n", excludeRMMs)
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
module rmm-hunter
|
||||
|
||||
go 1.24.7
|
||||
|
||||
require (
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010192328-967933276439
|
||||
github.com/spf13/cobra v1.10.1
|
||||
golang.org/x/sys v0.29.0
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a // indirect
|
||||
github.com/alwindoss/morse v1.0.1 // indirect
|
||||
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
|
||||
github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5 // indirect
|
||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
|
||||
github.com/ecies/go/v2 v2.0.10 // indirect
|
||||
github.com/elastic/go-sysinfo v1.15.1 // indirect
|
||||
github.com/elastic/go-windows v1.0.2 // indirect
|
||||
github.com/ethereum/go-ethereum v1.14.12 // indirect
|
||||
github.com/go-ole/go-ole v1.3.0 // indirect
|
||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||
github.com/prometheus/procfs v0.15.1 // indirect
|
||||
github.com/ryanuber/columnize v2.1.2+incompatible // indirect
|
||||
github.com/spf13/pflag v1.0.9 // indirect
|
||||
golang.org/x/crypto v0.31.0 // indirect
|
||||
golang.org/x/text v0.21.0 // indirect
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
|
||||
howett.net/plist v1.0.1 // indirect
|
||||
)
|
||||
@@ -0,0 +1,63 @@
|
||||
github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a h1:4c0nc0krv8eh7gD809n+swLaCuFyHpxdrxwx0ZmHvBw=
|
||||
github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010174510-8091571ab864 h1:zYVI4GRNB7wjLtorhpnPLP8v8w5T3axCpCtNDKI2LOs=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010174510-8091571ab864/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010183749-8ab59cb85591 h1:APveZhhJVm6tFcpldhMLxln4JR1V3Aw1xegt0SKGybg=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010183749-8ab59cb85591/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010184333-fb8a7710cf48 h1:nyCMY/8w7IsmduLZspdBuCmWutMUY6lzn5DCKVmQGt0=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010184333-fb8a7710cf48/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010184534-de2a2a349253 h1:ZfFDU6Kp9mFlEb0OZniWQR1E3w3Okr9gK2HlRb9lN6E=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010184534-de2a2a349253/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010185212-88db5cc88bc0 h1:g01ZBGUyvJXSWvxs7SVPTtqv3ruhbFsgsRGxCM2yYoY=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010185212-88db5cc88bc0/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010190109-3a4c7586120a h1:Z4cjdwk5DupnEg/F2dv4DPutwSEmDq7WWe565FjZrtQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010190109-3a4c7586120a/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010190312-0ad88c5f3f2f h1:XJ9IudxrEjAhodOLCTaWCIxWdj0fIa+JOdzfd1nST9k=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010190312-0ad88c5f3f2f/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010192328-967933276439 h1:n/B4+1K6vpKX34iISUKHzEKEND53PmxePHrtsy693Jo=
|
||||
github.com/Kraken-OffSec/Scurvy v0.0.0-20251010192328-967933276439/go.mod h1:hljxQLLV5S60GVVG51+u3r1agCjZ45x8jd2WiJxy0wQ=
|
||||
github.com/alwindoss/morse v1.0.1 h1:PkUh5m1UHMcZ1Upvl7CmSIBMxdEBejWoQ4rQQtgJsCQ=
|
||||
github.com/alwindoss/morse v1.0.1/go.mod h1:qAqJOep3jEpIpiLgqSGgLk5Zh4BZKsyzMQHuAwVPMXc=
|
||||
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
|
||||
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
|
||||
github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5 h1:BjkPE3785EwPhhyuFkbINB+2a1xATwk8SNDWnJiD41g=
|
||||
github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5/go.mod h1:jtAfVaU/2cu1+wdSRPWE2c1N2qeAA3K4RH9pYgqwets=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
|
||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnNEcHYvcCuK6dPZSg=
|
||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
|
||||
github.com/ecies/go/v2 v2.0.10 h1:AaLxGio0MLLbvWur4rKnLzw+K9zI+wMScIDAtqCqOtU=
|
||||
github.com/ecies/go/v2 v2.0.10/go.mod h1:N73OyuR6tuKznit2LhXjrZ0XAQ234uKbzYz8pEPYzlI=
|
||||
github.com/elastic/go-sysinfo v1.15.1 h1:zBmTnFEXxIQ3iwcQuk7MzaUotmKRp3OabbbWM8TdzIQ=
|
||||
github.com/elastic/go-sysinfo v1.15.1/go.mod h1:jPSuTgXG+dhhh0GKIyI2Cso+w5lPJ5PvVqKlL8LV/Hk=
|
||||
github.com/elastic/go-windows v1.0.2 h1:yoLLsAsV5cfg9FLhZ9EXZ2n2sQFKeDYrHenkcivY4vI=
|
||||
github.com/elastic/go-windows v1.0.2/go.mod h1:bGcDpBzXgYSqM0Gx3DM4+UxFj300SZLixie9u9ixLM8=
|
||||
github.com/ethereum/go-ethereum v1.14.12 h1:8hl57x77HSUo+cXExrURjU/w1VhL+ShCTJrTwcCQSe4=
|
||||
github.com/ethereum/go-ethereum v1.14.12/go.mod h1:RAC2gVMWJ6FkxSPESfbshrcKpIokgQKsVKmAuqdekDY=
|
||||
github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
|
||||
github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
|
||||
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
|
||||
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
|
||||
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||
github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
|
||||
github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
|
||||
github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
|
||||
github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
|
||||
github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
|
||||
github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
|
||||
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
|
||||
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
|
||||
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
|
||||
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
|
||||
howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
|
||||
@@ -0,0 +1,170 @@
|
||||
package autorun
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/sys/windows/registry"
|
||||
)
|
||||
|
||||
func Detect() []AutoRun {
|
||||
var suspiciousAutoRuns []AutoRun
|
||||
|
||||
fmt.Printf("[*] Enumerating AutoRun Applications\n")
|
||||
|
||||
// Check common autorun registry locations
|
||||
autorunKeys := []string{
|
||||
`SOFTWARE\Microsoft\Windows\CurrentVersion\Run`,
|
||||
`SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`,
|
||||
`SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run`,
|
||||
`SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce`,
|
||||
`SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices`,
|
||||
`SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce`,
|
||||
`SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run`,
|
||||
`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit`,
|
||||
`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell`,
|
||||
`SOFTWARE\Microsoft\Active Setup\Installed Components`,
|
||||
}
|
||||
|
||||
// Check both HKLM and HKCU
|
||||
roots := []registry.Key{registry.LOCAL_MACHINE, registry.CURRENT_USER}
|
||||
rootNames := []string{"HKLM", "HKCU"}
|
||||
|
||||
totalEntries := 0
|
||||
for i, root := range roots {
|
||||
for _, keyPath := range autorunKeys {
|
||||
entries := checkAutoRunKey(root, keyPath, rootNames[i])
|
||||
totalEntries += len(entries)
|
||||
suspiciousAutoRuns = append(suspiciousAutoRuns, entries...)
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf(" [>] Dispositioning %d AutoRun Entries\n", totalEntries)
|
||||
fmt.Printf("[+] Found %d Suspicious AutoRun Applications\n", len(suspiciousAutoRuns))
|
||||
|
||||
return suspiciousAutoRuns
|
||||
}
|
||||
|
||||
func checkAutoRunKey(root registry.Key, keyPath, rootName string) []AutoRun {
|
||||
var autoRuns []AutoRun
|
||||
|
||||
key, err := registry.OpenKey(root, keyPath, registry.QUERY_VALUE)
|
||||
if err != nil {
|
||||
return autoRuns
|
||||
}
|
||||
defer key.Close()
|
||||
|
||||
valueNames, err := key.ReadValueNames(-1)
|
||||
if err != nil {
|
||||
return autoRuns
|
||||
}
|
||||
|
||||
for _, valueName := range valueNames {
|
||||
value, _, err := key.GetStringValue(valueName)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
|
||||
// Check if this autorun entry matches any known Suspicious patterns
|
||||
if isSuspiciousAutoRun(valueName, value) {
|
||||
// Analyze the executable path for additional suspicious indicators
|
||||
isPathSuspicious, pathReason := analyzeExecutablePath(value)
|
||||
description := extractDescription(value)
|
||||
if isPathSuspicious {
|
||||
description += fmt.Sprintf(" [%s]", pathReason)
|
||||
}
|
||||
|
||||
fmt.Printf(" [?] Found %s\\%s: %s = %s\n", rootName, keyPath, valueName, value)
|
||||
autoRuns = append(autoRuns, AutoRun{
|
||||
Name: valueName,
|
||||
Command: value,
|
||||
Location: fmt.Sprintf("%s\\%s", rootName, keyPath),
|
||||
Enabled: true,
|
||||
Description: description,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
return autoRuns
|
||||
}
|
||||
|
||||
func isSuspiciousAutoRun(name, command string) bool {
|
||||
// Convert to lowercase for case-insensitive comparison
|
||||
nameLower := strings.ToLower(name)
|
||||
commandLower := strings.ToLower(command)
|
||||
|
||||
// Check against known Suspicious names
|
||||
for _, rmm := range common.CommonRMMs {
|
||||
rmmLower := strings.ToLower(rmm)
|
||||
if strings.Contains(nameLower, rmmLower) || strings.Contains(commandLower, rmmLower) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
// Check against common Suspicious executable patterns
|
||||
for _, imageEnd := range common.CommonImageEnds {
|
||||
imageEndLower := strings.ToLower(imageEnd)
|
||||
if strings.Contains(commandLower, imageEndLower) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
// Additional suspicious patterns
|
||||
suspiciousPatterns := []string{
|
||||
"remote", "control", "assist", "support", "vnc", "rdp", "teamview",
|
||||
"anydesk", "logmein", "screenconnect", "splashtop", "ultravnc",
|
||||
}
|
||||
|
||||
for _, pattern := range suspiciousPatterns {
|
||||
if strings.Contains(nameLower, pattern) || strings.Contains(commandLower, pattern) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func extractDescription(command string) string {
|
||||
// Extract just the executable name from the command
|
||||
parts := strings.Fields(command)
|
||||
if len(parts) > 0 {
|
||||
return parts[0]
|
||||
}
|
||||
return command
|
||||
}
|
||||
|
||||
func analyzeExecutablePath(command string) (bool, string) {
|
||||
// Extract executable path from command
|
||||
var execPath string
|
||||
if strings.HasPrefix(command, "\"") {
|
||||
// Handle quoted paths
|
||||
endQuote := strings.Index(command[1:], "\"")
|
||||
if endQuote != -1 {
|
||||
execPath = command[1 : endQuote+1]
|
||||
}
|
||||
} else {
|
||||
// Handle unquoted paths
|
||||
parts := strings.Fields(command)
|
||||
if len(parts) > 0 {
|
||||
execPath = parts[0]
|
||||
}
|
||||
}
|
||||
|
||||
// Check for suspicious installation paths
|
||||
suspiciousPaths := []string{
|
||||
"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
|
||||
"\\users\\public\\", "\\programdata\\",
|
||||
"\\windows\\temp\\", "\\%temp%\\",
|
||||
}
|
||||
|
||||
execPathLower := strings.ToLower(execPath)
|
||||
for _, suspPath := range suspiciousPaths {
|
||||
if strings.Contains(execPathLower, suspPath) {
|
||||
return true, fmt.Sprintf("Suspicious installation path: %s", suspPath)
|
||||
}
|
||||
}
|
||||
|
||||
return false, ""
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
package autorun
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestAutoRun(t *testing.T) {
|
||||
autoruns := Detect()
|
||||
for _, ar := range autoruns {
|
||||
t.Logf("-----")
|
||||
t.Logf("Name: %s", ar.Name)
|
||||
t.Logf("Command: %s", ar.Command)
|
||||
t.Logf("Location: %s", ar.Location)
|
||||
t.Logf("Enabled: %t", ar.Enabled)
|
||||
t.Logf("Description: %s", ar.Description)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
package binaries
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
"strings"
|
||||
"sync"
|
||||
)
|
||||
|
||||
func Detect() []string {
|
||||
var foundBinaries []string
|
||||
var mu sync.Mutex
|
||||
var wg sync.WaitGroup
|
||||
|
||||
fmt.Printf("[*] Enumerating Suspicious Binaries\n")
|
||||
|
||||
// Define search directories
|
||||
searchDirs := []string{
|
||||
os.Getenv("APPDATA"),
|
||||
`C:\ProgramData\`,
|
||||
`C:\Program Files\`,
|
||||
`C:\Program Files (x86)\`,
|
||||
`C:\Downloads\`,
|
||||
}
|
||||
|
||||
fmt.Printf(" [>] Dispositioning %d Directories\n", len(searchDirs))
|
||||
|
||||
// Channel to collect results
|
||||
resultChan := make(chan string, 100)
|
||||
|
||||
// Start goroutines for each directory
|
||||
for _, dir := range searchDirs {
|
||||
if dir == "" {
|
||||
continue // Skip if environment variable is empty
|
||||
}
|
||||
|
||||
wg.Add(1)
|
||||
go func(searchDir string) {
|
||||
defer wg.Done()
|
||||
searchDirectory(searchDir, resultChan)
|
||||
}(dir)
|
||||
}
|
||||
|
||||
// Goroutine to close channel when all searches complete
|
||||
go func() {
|
||||
wg.Wait()
|
||||
close(resultChan)
|
||||
}()
|
||||
|
||||
// Collect results
|
||||
for result := range resultChan {
|
||||
mu.Lock()
|
||||
foundBinaries = append(foundBinaries, result)
|
||||
mu.Unlock()
|
||||
fmt.Printf(" [?] Found %s\n", result)
|
||||
}
|
||||
|
||||
fmt.Printf("[+] Found %d Suspicious Binaries\n", len(foundBinaries))
|
||||
return foundBinaries
|
||||
}
|
||||
|
||||
func searchDirectory(dir string, resultChan chan<- string) {
|
||||
err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
// Skip directories we can't access
|
||||
return nil
|
||||
}
|
||||
|
||||
// Skip directories, only check files
|
||||
if info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Check if the file path ends with any CommonImageEnds
|
||||
for _, imageEnd := range common.CommonImageEnds {
|
||||
// Normalize path separators and make case-insensitive comparison
|
||||
normalizedPath := strings.ToLower(filepath.ToSlash(path))
|
||||
normalizedImageEnd := strings.ToLower(filepath.ToSlash(imageEnd))
|
||||
|
||||
if strings.HasSuffix(normalizedPath, normalizedImageEnd) {
|
||||
resultChan <- path
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
fmt.Printf(" [-] Error searching %s: %v\n", dir, err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
package binaries
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetect(t *testing.T) {
|
||||
binaries := Detect()
|
||||
for _, binary := range binaries {
|
||||
t.Logf("-----")
|
||||
t.Logf("Binary: %s", binary)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,71 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func AnalyzeExecutablePath(command string) (bool, string) {
|
||||
// Extract executable path from command
|
||||
var execPath string
|
||||
if strings.HasPrefix(command, "\"") {
|
||||
// Handle quoted paths
|
||||
endQuote := strings.Index(command[1:], "\"")
|
||||
if endQuote != -1 {
|
||||
execPath = command[1 : endQuote+1]
|
||||
}
|
||||
} else {
|
||||
// Handle unquoted paths
|
||||
parts := strings.Fields(command)
|
||||
if len(parts) > 0 {
|
||||
execPath = parts[0]
|
||||
}
|
||||
}
|
||||
|
||||
// Check for suspicious installation paths
|
||||
suspiciousPaths := []string{
|
||||
"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
|
||||
"\\users\\public\\", "\\programdata\\",
|
||||
"\\windows\\temp\\", "\\%temp%\\",
|
||||
}
|
||||
|
||||
execPathLower := strings.ToLower(execPath)
|
||||
|
||||
// Check for suspicious installation paths
|
||||
suspiciousPaths = []string{
|
||||
"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
|
||||
"\\users\\public\\", "\\programdata\\",
|
||||
"\\windows\\temp\\", "\\%temp%\\",
|
||||
}
|
||||
|
||||
for _, suspPath := range suspiciousPaths {
|
||||
if strings.Contains(execPathLower, suspPath) {
|
||||
// Check for trusted publishers/companies
|
||||
trustedPublishers := []string{
|
||||
"\\microsoft\\",
|
||||
"\\adobe\\",
|
||||
"\\google\\",
|
||||
"\\intel\\",
|
||||
"\\nvidia\\",
|
||||
"\\oracle\\",
|
||||
"\\citrix\\",
|
||||
"\\vmware\\",
|
||||
// Add more trusted publishers as needed
|
||||
}
|
||||
|
||||
isTrusted := false
|
||||
for _, publisher := range trustedPublishers {
|
||||
if strings.Contains(execPathLower, publisher) {
|
||||
isTrusted = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !isTrusted {
|
||||
return true, fmt.Sprintf("Suspicious installation path: %s", suspPath)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false, ""
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
package connections
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"net"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func DetectOutboundConnections() []NetworkConnection {
|
||||
var connections []NetworkConnection
|
||||
|
||||
fmt.Printf("[*] Enumerating Outbound Connections...\n")
|
||||
|
||||
// Get active connections via netstat
|
||||
netstatConnections := getNetstatConnections()
|
||||
connections = append(connections, netstatConnections...)
|
||||
|
||||
// Get DNS cache entries for hostname resolution
|
||||
dnsCache := getDNSCache()
|
||||
|
||||
// Resolve hostnames for IP addresses
|
||||
for i := range connections {
|
||||
if hostname, exists := dnsCache[connections[i].RemoteAddr]; exists {
|
||||
connections[i].RemoteHost = hostname
|
||||
} else {
|
||||
connections[i].RemoteHost = resolveHostname(connections[i].RemoteAddr)
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf(" [>] Dispositioning %d Outbound Connections\n", len(connections))
|
||||
|
||||
return compareConnections(connections)
|
||||
}
|
||||
|
||||
func compareConnections(connections []NetworkConnection) []NetworkConnection {
|
||||
var suspiciousConnections []NetworkConnection
|
||||
|
||||
for _, conn := range connections {
|
||||
remote := conn.RemoteHost
|
||||
|
||||
for _, dns := range common.CommonDNS {
|
||||
if matchesDNSPattern(remote, dns) {
|
||||
fmt.Printf(" [?] Found %s\n", conn.RemoteHost)
|
||||
suspiciousConnections = append(suspiciousConnections, conn)
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf("[+] Found %d Suspicious Outbound Connections\n", len(suspiciousConnections))
|
||||
|
||||
return suspiciousConnections
|
||||
}
|
||||
|
||||
// matchesDNSPattern converts DNS pattern to regex and matches hostname
|
||||
func matchesDNSPattern(hostname, pattern string) bool {
|
||||
// Convert to lowercase for case-insensitive matching
|
||||
pattern = strings.ToLower(pattern)
|
||||
|
||||
// Remove leading dot if present
|
||||
if strings.HasPrefix(pattern, ".") {
|
||||
pattern = pattern[1:]
|
||||
}
|
||||
|
||||
// Escape special regex characters except * and .
|
||||
pattern = regexp.QuoteMeta(pattern)
|
||||
|
||||
// Convert wildcards back to regex
|
||||
pattern = strings.ReplaceAll(pattern, `\*`, `[^.]*`)
|
||||
pattern = strings.ReplaceAll(pattern, `\.`, `\.`)
|
||||
|
||||
// Anchor the pattern to match end of hostname
|
||||
pattern = `(^|\.)` + pattern + `$`
|
||||
|
||||
regex, err := regexp.Compile(pattern)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
return regex.MatchString(hostname)
|
||||
}
|
||||
|
||||
func getNetstatConnections() []NetworkConnection {
|
||||
var connections []NetworkConnection
|
||||
|
||||
cmd := exec.Command("netstat", "-ano")
|
||||
output, err := cmd.Output()
|
||||
if err != nil {
|
||||
return connections
|
||||
}
|
||||
|
||||
scanner := bufio.NewScanner(strings.NewReader(string(output)))
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if strings.Contains(line, "TCP") && strings.Contains(line, "ESTABLISHED") {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) >= 5 {
|
||||
localAddr := fields[1]
|
||||
remoteAddr := fields[2]
|
||||
state := fields[3]
|
||||
pid := fields[4]
|
||||
|
||||
// Filter for outbound connections (exclude localhost)
|
||||
if !strings.HasPrefix(remoteAddr, "127.0.0.1") &&
|
||||
!strings.HasPrefix(remoteAddr, "::1") {
|
||||
connections = append(connections, NetworkConnection{
|
||||
LocalAddr: localAddr,
|
||||
RemoteAddr: extractIP(remoteAddr),
|
||||
State: state,
|
||||
PID: pid,
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return connections
|
||||
}
|
||||
|
||||
func getDNSCache() map[string]string {
|
||||
cache := make(map[string]string)
|
||||
|
||||
cmd := exec.Command("ipconfig", "/displaydns")
|
||||
output, err := cmd.Output()
|
||||
if err != nil {
|
||||
return cache
|
||||
}
|
||||
|
||||
lines := strings.Split(string(output), "\n")
|
||||
var currentHost string
|
||||
|
||||
for _, line := range lines {
|
||||
line = strings.TrimSpace(line)
|
||||
|
||||
if strings.Contains(line, "Record Name") {
|
||||
parts := strings.Split(line, ":")
|
||||
if len(parts) > 1 {
|
||||
currentHost = strings.TrimSpace(parts[1])
|
||||
}
|
||||
}
|
||||
|
||||
if strings.Contains(line, "A (Host) Record") && currentHost != "" {
|
||||
// Look for IP in next few lines
|
||||
continue
|
||||
}
|
||||
|
||||
if currentHost != "" && net.ParseIP(strings.TrimSpace(line)) != nil {
|
||||
cache[strings.TrimSpace(line)] = currentHost
|
||||
currentHost = ""
|
||||
}
|
||||
}
|
||||
|
||||
return cache
|
||||
}
|
||||
|
||||
func extractIP(addr string) string {
|
||||
if idx := strings.LastIndex(addr, ":"); idx != -1 {
|
||||
return addr[:idx]
|
||||
}
|
||||
return addr
|
||||
}
|
||||
|
||||
func resolveHostname(ip string) string {
|
||||
names, err := net.LookupAddr(ip)
|
||||
if err != nil || len(names) == 0 {
|
||||
return ip
|
||||
}
|
||||
return strings.TrimSuffix(names[0], ".")
|
||||
}
|
||||
|
||||
// GetHTTPHostnames extracts unique hostnames from outbound connections
|
||||
func GetHTTPHostnames() []string {
|
||||
connections := DetectOutboundConnections()
|
||||
hostnameMap := make(map[string]bool)
|
||||
var hostnames []string
|
||||
|
||||
for _, conn := range connections {
|
||||
if conn.RemoteHost != "" && conn.RemoteHost != conn.RemoteAddr {
|
||||
if !hostnameMap[conn.RemoteHost] {
|
||||
hostnameMap[conn.RemoteHost] = true
|
||||
hostnames = append(hostnames, conn.RemoteHost)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return hostnames
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
package connections
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetectOutboundConnections(t *testing.T) {
|
||||
conns := DetectOutboundConnections()
|
||||
for _, conn := range conns {
|
||||
t.Logf("-----")
|
||||
t.Logf("PID: %s", conn.PID)
|
||||
t.Logf("LocalAddr: %s", conn.LocalAddr)
|
||||
t.Logf("RemoteAddr: %s", conn.RemoteAddr)
|
||||
t.Logf("RemoteHost: %s", conn.RemoteHost)
|
||||
t.Logf("State: %s", conn.State)
|
||||
t.Logf("Process: %s", conn.Process)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
package directory
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
"strings"
|
||||
)
|
||||
|
||||
var appData = os.Getenv("APPDATA")
|
||||
|
||||
func Detect() []string {
|
||||
var suspiciousDirectories []string
|
||||
|
||||
fmt.Printf("[*] Enumerating Suspicious Directories \n")
|
||||
// Check for common directories
|
||||
for _, dir := range common.CommonDirectories {
|
||||
dir = replaceAppData(dir)
|
||||
if _, err := os.Stat(dir); err == nil {
|
||||
fmt.Printf(" [?] Found %s\n", dir)
|
||||
suspiciousDirectories = append(suspiciousDirectories, dir)
|
||||
}
|
||||
}
|
||||
fmt.Printf("[+] Found %d Suspicious Directories\n", len(suspiciousDirectories))
|
||||
|
||||
return suspiciousDirectories
|
||||
}
|
||||
|
||||
func replaceAppData(path string) string {
|
||||
if strings.Contains(path, "{{APPDATA}}") {
|
||||
p := strings.Replace(path, "{{APPDATA}}", "", -1)
|
||||
return filepath.Join(appData, p)
|
||||
}
|
||||
return path
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
package directory
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetect(t *testing.T) {
|
||||
directories := Detect()
|
||||
for _, dir := range directories {
|
||||
t.Logf("-----")
|
||||
t.Logf("Directory: %s", dir)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
package processes
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
"strings"
|
||||
|
||||
"github.com/Kraken-OffSec/Scurvy/core/process"
|
||||
)
|
||||
|
||||
func Detect() []Process {
|
||||
fmt.Printf("[*] Enumerating Processes \n")
|
||||
|
||||
processes, err := process.Processes()
|
||||
if err != nil {
|
||||
fmt.Printf("[-] Error enumerating processes: %s\n", err.Error())
|
||||
return []Process{}
|
||||
}
|
||||
|
||||
fmt.Printf(" [>] Dispositioning %d Processes\n", len(processes))
|
||||
|
||||
return compareProcesses(processes)
|
||||
}
|
||||
|
||||
func compareProcesses(processes []process.Process) []Process {
|
||||
var suspiciousProcesses []Process
|
||||
|
||||
for _, proc := range processes {
|
||||
procName := proc.Executable()
|
||||
procNameLower := strings.ToLower(procName)
|
||||
|
||||
// Get full executable path if available
|
||||
var fullPath string
|
||||
if proc.Path() != "" {
|
||||
fullPath = proc.Path()
|
||||
}
|
||||
|
||||
// Check against known RMMs
|
||||
isRMMMatch := false
|
||||
for _, rmm := range common.CommonRMMs {
|
||||
rmmLower := strings.ToLower(rmm)
|
||||
if strings.Contains(procNameLower, rmmLower) {
|
||||
isRMMMatch = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
// Check for suspicious path
|
||||
isPathSuspicious := false
|
||||
pathReason := ""
|
||||
if fullPath != "" {
|
||||
isPathSuspicious, pathReason = common.AnalyzeExecutablePath(fullPath)
|
||||
}
|
||||
|
||||
if isRMMMatch || isPathSuspicious {
|
||||
args := ""
|
||||
if isPathSuspicious {
|
||||
args = fmt.Sprintf("[%s]", pathReason)
|
||||
}
|
||||
|
||||
fmt.Printf(" [?] Found %s\n", procName)
|
||||
suspiciousProcesses = append(suspiciousProcesses, Process{
|
||||
Name: procName,
|
||||
PID: proc.Pid(),
|
||||
PPID: proc.PPid(),
|
||||
Path: fullPath,
|
||||
Args: args,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf("[+] Found %d Suspicious Processes\n", len(suspiciousProcesses))
|
||||
return suspiciousProcesses
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package processes
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetect(t *testing.T) {
|
||||
processes := Detect()
|
||||
for _, proc := range processes {
|
||||
t.Logf("-----")
|
||||
t.Logf("Name: %s", proc.Name)
|
||||
t.Logf("PID: %d", proc.PID)
|
||||
t.Logf("PPID: %d", proc.PPID)
|
||||
t.Logf("Path: %s", proc.Path)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
package scheduledTasks
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
schTasks "github.com/Kraken-OffSec/Scurvy/core/scheduledTasks"
|
||||
)
|
||||
|
||||
func Detect() []*ScheduledTask {
|
||||
fmt.Printf("[*] Enumerating Scheduled Tasks \n")
|
||||
tasks, err := schTasks.ListTasks()
|
||||
if err != nil {
|
||||
fmt.Printf("[-] Error enumerating scheduled tasks: %s\n", err.Error())
|
||||
return []*ScheduledTask{}
|
||||
}
|
||||
fmt.Printf(" [>] Dispositioning %d Scheduled Tasks\n", len(tasks))
|
||||
|
||||
return compareTasks(tasks)
|
||||
}
|
||||
|
||||
func compareTasks(tasks []schTasks.TaskInfo) []*ScheduledTask {
|
||||
var suspiciousTasks []*ScheduledTask
|
||||
|
||||
for _, task := range tasks {
|
||||
for _, rmm := range common.CommonRMMs {
|
||||
rmmLower := strings.ToLower(rmm)
|
||||
taskNameLower := strings.ToLower(task.Name)
|
||||
if strings.Contains(taskNameLower, rmmLower) {
|
||||
fmt.Printf(" [?] Found %s\n", task.Name)
|
||||
suspiciousTasks = append(suspiciousTasks, &ScheduledTask{
|
||||
Name: task.Name,
|
||||
Author: task.Author,
|
||||
LastRun: task.LastRun.Format(time.RFC3339),
|
||||
NextRun: task.NextRun.Format(time.RFC3339),
|
||||
LastResult: task.LastResult,
|
||||
CreatedDate: task.CreationDate.Format(time.RFC3339),
|
||||
State: task.State,
|
||||
Path: task.Path,
|
||||
Description: task.Description,
|
||||
ModifiedDate: "",
|
||||
Enabled: task.Enabled,
|
||||
})
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf("[+] Found %d Suspicious Scheduled Tasks\n", len(suspiciousTasks))
|
||||
return suspiciousTasks
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
package scheduledTasks
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetect(t *testing.T) {
|
||||
tasks := Detect()
|
||||
for _, task := range tasks {
|
||||
t.Logf("-----")
|
||||
t.Logf("Name: %s", task.Name)
|
||||
t.Logf("Author: %s", task.Author)
|
||||
t.Logf("LastRun: %s", task.LastRun)
|
||||
t.Logf("NextRun: %s", task.NextRun)
|
||||
t.Logf("LastResult: %s", task.LastResult)
|
||||
t.Logf("CreatedDate: %s", task.CreatedDate)
|
||||
t.Logf("State: %s", task.State)
|
||||
t.Logf("Path: %s", task.Path)
|
||||
t.Logf("Description: %s", task.Description)
|
||||
t.Logf("ModifiedDate: %s", task.ModifiedDate)
|
||||
t.Logf("Enabled: %t", task.Enabled)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/common"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
"strings"
|
||||
|
||||
"github.com/Kraken-OffSec/Scurvy/core/service"
|
||||
"golang.org/x/sys/windows"
|
||||
)
|
||||
|
||||
func Detect() []*Service {
|
||||
fmt.Printf("[*] Enumerating Services \n")
|
||||
|
||||
scm, err := service.Connect()
|
||||
if err != nil {
|
||||
fmt.Printf("[-] Error getting Service Manager: %s\n", err.Error())
|
||||
return []*Service{}
|
||||
}
|
||||
defer windows.Close(scm.Handle)
|
||||
|
||||
services, err := scm.ListServices()
|
||||
if err != nil {
|
||||
fmt.Printf("[-] Error enumerating services: %s\n", err.Error())
|
||||
return []*Service{}
|
||||
}
|
||||
|
||||
fmt.Printf(" [>] Dispositioning %d Services\n", len(services))
|
||||
|
||||
return compareServices(services, scm)
|
||||
}
|
||||
|
||||
func compareServices(serviceStrings []string, scm *service.Mgr) []*Service {
|
||||
var suspiciousServices []*Service
|
||||
|
||||
for _, serviceString := range serviceStrings {
|
||||
svc, err := scm.OpenService(serviceString)
|
||||
if err != nil {
|
||||
fmt.Printf(" [>-] Error opening service %s: %s\n", serviceString, err.Error())
|
||||
continue
|
||||
}
|
||||
config, err := svc.Config()
|
||||
if err != nil {
|
||||
fmt.Printf(" [>-] Error getting service config %s: %s\n", serviceString, err.Error())
|
||||
continue
|
||||
}
|
||||
svcStartName := strings.ToLower(config.ServiceStartName)
|
||||
svcDisplayName := strings.ToLower(config.DisplayName)
|
||||
svcBinaryPath := strings.ToLower(config.BinaryPathName)
|
||||
|
||||
// Check against known RMMs
|
||||
isRMMMatch := false
|
||||
for _, rmm := range common.CommonRMMs {
|
||||
rmmLower := strings.ToLower(rmm)
|
||||
if strings.Contains(svcDisplayName, rmmLower) || strings.Contains(svcStartName, rmmLower) || strings.Contains(svcBinaryPath, rmmLower) {
|
||||
isRMMMatch = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
// Check for suspicious path regardless of RMM match
|
||||
isPathSuspicious, pathReason := common.AnalyzeExecutablePath(config.BinaryPathName)
|
||||
|
||||
if isRMMMatch || isPathSuspicious {
|
||||
description := config.Description
|
||||
if isPathSuspicious {
|
||||
description += fmt.Sprintf(" [%s]", pathReason)
|
||||
}
|
||||
|
||||
fmt.Printf(" [?] Found %s\n", config.DisplayName)
|
||||
suspiciousServices = append(suspiciousServices, &Service{
|
||||
Name: serviceString,
|
||||
DisplayName: config.DisplayName,
|
||||
ServiceTypeRaw: config.ServiceType,
|
||||
ServiceType: getServiceType(config.ServiceType),
|
||||
StartTypeRaw: config.StartType,
|
||||
StartType: getStartType(config.StartType),
|
||||
ErrorControlRaw: config.ErrorControl,
|
||||
ErrorControl: getErrorControl(config.ErrorControl),
|
||||
BinaryPathName: config.BinaryPathName,
|
||||
LoadOrderGroup: config.LoadOrderGroup,
|
||||
TagId: config.TagId,
|
||||
Dependencies: config.Dependencies,
|
||||
ServiceStartName: config.ServiceStartName,
|
||||
Password: config.Password,
|
||||
Description: description,
|
||||
SidType: config.SidType,
|
||||
DelayedAutoStart: config.DelayedAutoStart,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Printf("[+] Found %d Suspicious Services\n", len(suspiciousServices))
|
||||
return suspiciousServices
|
||||
}
|
||||
|
||||
func getServiceType(raw uint32) string {
|
||||
switch raw {
|
||||
case 1:
|
||||
return "KernelDriver"
|
||||
case 2:
|
||||
return "FileSystemDriver"
|
||||
case 4:
|
||||
return "Adapter"
|
||||
case 8:
|
||||
return "RecognizerDriver"
|
||||
case 16:
|
||||
return "Win32OwnProcess"
|
||||
case 32:
|
||||
return "Win32ShareProcess"
|
||||
case 256:
|
||||
return "InteractiveProcess"
|
||||
default:
|
||||
return "Unknown"
|
||||
}
|
||||
}
|
||||
|
||||
func getStartType(raw uint32) string {
|
||||
switch raw {
|
||||
case 0:
|
||||
return "Boot"
|
||||
case 1:
|
||||
return "System"
|
||||
case 2:
|
||||
return "Automatic"
|
||||
case 3:
|
||||
return "Manual"
|
||||
case 4:
|
||||
return "Disabled"
|
||||
default:
|
||||
return "Unknown"
|
||||
}
|
||||
}
|
||||
|
||||
func getErrorControl(raw uint32) string {
|
||||
switch raw {
|
||||
case 0:
|
||||
return "Ignore"
|
||||
case 1:
|
||||
return "Normal"
|
||||
case 2:
|
||||
return "Severe"
|
||||
case 3:
|
||||
return "Critical"
|
||||
default:
|
||||
return fmt.Sprintf("Unknown %d", raw)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
package services
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDetect(t *testing.T) {
|
||||
services := Detect()
|
||||
for _, svc := range services {
|
||||
t.Logf("-----")
|
||||
t.Logf("Name: %s", svc.Name)
|
||||
t.Logf("DisplayName: %s", svc.DisplayName)
|
||||
t.Logf("ServiceTypeRaw: %d", svc.ServiceTypeRaw)
|
||||
t.Logf("ServiceType: %s", svc.ServiceType)
|
||||
t.Logf("StartTypeRaw: %d", svc.StartTypeRaw)
|
||||
t.Logf("StartType: %s", svc.StartType)
|
||||
t.Logf("ErrorControlRaw: %d", svc.ErrorControlRaw)
|
||||
t.Logf("ErrorControl: %s", svc.ErrorControl)
|
||||
t.Logf("BinaryPathName: %s", svc.BinaryPathName)
|
||||
t.Logf("LoadOrderGroup: %s", svc.LoadOrderGroup)
|
||||
t.Logf("TagId: %d", svc.TagId)
|
||||
t.Logf("Dependencies: %v", svc.Dependencies)
|
||||
t.Logf("ServiceStartName: %s", svc.ServiceStartName)
|
||||
t.Logf("Password: %s", svc.Password)
|
||||
t.Logf("Description: %s", svc.Description)
|
||||
t.Logf("SidType: %d", svc.SidType)
|
||||
t.Logf("DelayedAutoStart: %t", svc.DelayedAutoStart)
|
||||
t.Logf("-----")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
package eliminate
|
||||
@@ -0,0 +1,55 @@
|
||||
package hunter
|
||||
|
||||
import (
|
||||
"rmm-hunter/internal/pkg"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/autorun"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/binaries"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/connections"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/directory"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/processes"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/scheduledTasks"
|
||||
"rmm-hunter/internal/pkg/hunt/detect/services"
|
||||
. "rmm-hunter/internal/suspicious"
|
||||
)
|
||||
|
||||
type Hunter struct {
|
||||
Options pkg.RunOptions
|
||||
Sus Suspicious
|
||||
}
|
||||
|
||||
func Start(options pkg.RunOptions) {
|
||||
hunter := Hunter{
|
||||
Options: options,
|
||||
}
|
||||
hunter.run()
|
||||
}
|
||||
|
||||
func (h *Hunter) run() {
|
||||
// Find suspicious processes
|
||||
processes := processes.Detect()
|
||||
h.Sus.Processes = processes
|
||||
|
||||
// Find suspicious services
|
||||
services := services.Detect()
|
||||
h.Sus.Services = services
|
||||
|
||||
// Find suspicious autoruns
|
||||
autoruns := autorun.Detect()
|
||||
h.Sus.AutoRuns = autoruns
|
||||
|
||||
// Find suspicious outbound connections
|
||||
connections := connections.DetectOutboundConnections()
|
||||
h.Sus.OutboundConnections = connections
|
||||
|
||||
// Find suspicious scheduled tasks
|
||||
tasks := scheduledTasks.Detect()
|
||||
h.Sus.ScheduledTasks = tasks
|
||||
|
||||
// Find suspicious binaries
|
||||
binaries := binaries.Detect()
|
||||
h.Sus.Binaries = binaries
|
||||
|
||||
// Find suspicious directories
|
||||
directories := directory.Detect()
|
||||
h.Sus.Directories = directories
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
package pkg
|
||||
|
||||
type RunOptions struct {
|
||||
ExcludeRMMs []string
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
package writer
|
||||
@@ -0,0 +1 @@
|
||||
package writer
|
||||
@@ -0,0 +1,114 @@
|
||||
package suspicious
|
||||
|
||||
/*
|
||||
Suspicious
|
||||
The object used to resemble the Suspicious artifacts and activities.
|
||||
*/
|
||||
type Suspicious struct {
|
||||
Artifacts []Artifact `json:"artifacts"`
|
||||
Persistence Persistence `json:"persistence"`
|
||||
RootFolder string `json:"rootFolder"`
|
||||
Binaries []string `json:"binaries"`
|
||||
Directories []string `json:"directories"`
|
||||
Services []*Service `json:"services"`
|
||||
Processes []Process `json:"processes"`
|
||||
OutboundConnections []NetworkConnection `json:"outboundConnections"`
|
||||
AutoRuns []AutoRun `json:"autoRuns"`
|
||||
ScheduledTasks []*ScheduledTask `json:"scheduledTasks"`
|
||||
}
|
||||
|
||||
type NetworkConnection struct {
|
||||
LocalAddr string
|
||||
RemoteAddr string
|
||||
RemoteHost string
|
||||
State string
|
||||
PID string
|
||||
Process string
|
||||
}
|
||||
|
||||
/*
|
||||
Artifact
|
||||
The object used to resemble the artifacts found by the Suspicious software.
|
||||
*/
|
||||
type Artifact struct {
|
||||
Location string `json:"location"`
|
||||
Content string `json:"content"`
|
||||
SHA256 string `json:"sha256"`
|
||||
}
|
||||
|
||||
/*
|
||||
Persistence
|
||||
The object used to resemble the persistence methods used by the Suspicious software.
|
||||
*/
|
||||
type Persistence struct {
|
||||
AutoRuns []AutoRun `json:"autoRuns"`
|
||||
ScheduledTasks []ScheduledTask `json:"scheduledTasks"`
|
||||
}
|
||||
|
||||
/*
|
||||
AutoRun
|
||||
The object used to resemble the auto run methods used by the Suspicious software.
|
||||
*/
|
||||
type AutoRun struct {
|
||||
Name string `json:"name"`
|
||||
Command string `json:"command"`
|
||||
Location string `json:"location"`
|
||||
Enabled bool `json:"enabled"`
|
||||
Description string `json:"description"`
|
||||
}
|
||||
|
||||
/*
|
||||
ScheduledTask
|
||||
The object used to resemble the scheduled tasks used by the Suspicious software.
|
||||
*/
|
||||
type ScheduledTask struct {
|
||||
Name string `json:"name"`
|
||||
Author string `json:"author"`
|
||||
CreatedDate string `json:"createdDate"`
|
||||
ModifiedDate string `json:"modifiedDate"`
|
||||
Description string `json:"description"`
|
||||
State string `json:"state"`
|
||||
Enabled bool `json:"enabled"`
|
||||
LastResult string `json:"lastResult"`
|
||||
NextRun string `json:"nextRun"`
|
||||
LastRun string `json:"lastRun"`
|
||||
Path string `json:"path"`
|
||||
}
|
||||
|
||||
/*
|
||||
Process
|
||||
The object used to resemble the processes used by the Suspicious software.
|
||||
*/
|
||||
type Process struct {
|
||||
Name string `json:"name"`
|
||||
PID int `json:"pid"`
|
||||
PPID int `json:"ppid"`
|
||||
Parent string `json:"parent"`
|
||||
Args string `json:"args"`
|
||||
Created string `json:"created"`
|
||||
Path string `json:"path"`
|
||||
}
|
||||
|
||||
/*
|
||||
Service
|
||||
The object used to resemble the services used by the Suspicious software.
|
||||
*/
|
||||
type Service struct {
|
||||
Name string `json:"name"`
|
||||
DisplayName string `json:"displayName"`
|
||||
ServiceTypeRaw uint32 `json:"serviceTypeRaw"`
|
||||
ServiceType string `json:"serviceType"`
|
||||
StartTypeRaw uint32 `json:"startTypeRaw"`
|
||||
StartType string `json:"startType"`
|
||||
ErrorControlRaw uint32 `json:"errorControlRaw"`
|
||||
ErrorControl string `json:"errorControl"`
|
||||
BinaryPathName string `json:"binaryPathName"`
|
||||
LoadOrderGroup string `json:"loadOrderGroup"`
|
||||
TagId uint32 `json:"tagId"`
|
||||
Dependencies []string `json:"dependencies"`
|
||||
ServiceStartName string `json:"serviceStartName"`
|
||||
Password string `json:"password"`
|
||||
Description string `json:"description"`
|
||||
SidType uint32 `json:"sidType"`
|
||||
DelayedAutoStart bool `json:"delayedAutoStart"`
|
||||
}
|
||||
Reference in New Issue
Block a user