1249 lines · 37.1 KB · Text
RawDownload
# DSZ script processes each txt file found in the TaskedCmds directory by determining the type
# of tasking (dir, ipconfig, regquery, ...) and then calling the appropriate DSZ script. Each
# command script is run in the background. When finished, the results are written to a file
# in the TaskResults directory, located on the OpsDisk in the Logs directory. The main script
# is terminated when all of the background jobs associated with tasking are completed which
# is determined by using the pollStatus routine.

@include "_Arrays.dsi";
@include "_CommandLine.dsi";
@include "_Xml.dsi";

@include "Include/_dirTasking.dsi";
@include "Include/_ipTasking.dsi";
@include "Include/_netmapTasking.dsi";
@include "Include/_regQueryTasking.dsi";
@include "Include/_netstatTasking.dsi";
@include "Include/_routeTasking.dsi";
@include "Include/_arpTasking.dsi";
@include "Include/_processlistTasking.dsi";
@include "Include/_auditTasking.dsi";
@include "Include/_localeTasking.dsi";
@include "Include/_tracerouteTasking.dsi";
@include "Include/_regWalkTasking.dsi";
@include "Include/_getTasking.dsi";
@include "Include/_systemInfoTasking.dsi";
@include "Include/_writeTaskedResults.dsi";
@include "_File.dsi";
@include "_LpHelperFunctions.dsi";
@include "_Menu.dsi";

bool $filesFound = true;
#string $command = "";
#string $taskID = "";
#string $targetID = "";
#string $priority = "";
#bool $ok = false;
#string $location = "";

string %params;
if (!_ParseCommandLine($argc, $argv, %params)) {
	return false;
}

if (defined(%params{"verbose"}) && <bool>%params{"verbose"}) {
	%_sgEnv{'verbose'} = "true";
} else {
	%_sgEnv{'verbose'} = "false";
}

# Get location of Commands directory to translate command parameters into dsz command
string $startDir;
if (defined(%params{"tasking"})) {
	$startDir = %params{"tasking"};
} else {
	$startDir = "%_sgEnv{'script_path'}/../TaskedCmds/";
}

echo ("--------------------------------", GOOD);
echo (GetProjectVersion(), GOOD);
echo ("--------------------------------", GOOD);
echo ("");

# Put results in the TaskResults directory, created as sibling of Logs directory
string $temp;
if (!_GetLpLogsDirectory($temp) || !defined($temp)) {
	return false;
}

string $resultsDir = "$temp/TaskResults";
if (!_FileExistsLocal($resultsDir)){
	`local mkdir "$resultsDir"`;
}


int $jobs;
int $cnt = 0;

#Find tasking and prompt user
string $metaFiles;
string $metaFilter = "*_metadata.txt";
bool $taskingFound = false;
if (!FileGetFiles($startDir, $metaFilter, $metaFiles, true)){
	echo ("Unable to find tasking\n", ERROR);
	return false;
}

string $filesGood;
string $messageGood;
string $filesMaybe;
string $messageMaybe;
string $filesBad;
string $messageBad;

for (int $i=0; $i<sizeof($metaFiles); $i++) {
	string $metaFile = $metaFiles[$i];
	int $type;
	string $msg;
	
	findTasking($metaFile, false, $type, $msg);
	if ($type == GOOD) {
		_AppendString($filesGood,    $metaFile);
		_AppendString($messageGood, "$msg:  $metaFile");
	} else if ($type == WARNING) {
		_AppendString($filesMaybe,   $metaFile);
		_AppendString($messageMaybe, "$msg:  $metaFile");
	} else if ($type == ERROR) {
		_AppendString($filesBad, $metaFile);
		_AppendString($messageBad, "$msg:  $metaFile");
	}
	
}

while (true) {
	string $dub;
	int $selected;
	for (int $i = 0; $i < 5; $i++) {
		echo();
	}
	
	string $files;
	string $message;
	
	AddList($files, $message, $filesGood,  $messageGood);
	AddList($files, $message, $filesMaybe, $messageMaybe);
	AddList($files, $message, $filesBad,   $messageBad);
	
	if (!_ExecuteSimpleMenu("Available Tasking", $message, $dub, $selected)) {
		break;
	}
	if (!defined($selected)) {
		break;
	}
	int $type;
	string $msg;
	if (findTasking($files[$selected], true, $type, $msg)) {
		runTasking($files[$selected], $resultsDir, $jobs, $cnt);
		remove($files[$selected], $filesGood, $filesMaybe, $filesBad);
	}
}


# Since scripts are backgrounded, 10 at a time, must check status periodically to determine when done
if ($cnt > 0) {
	pollStatus ($jobs, $cnt);
}

return true;

#--------------------------------------------------------------------------
sub remove(IN string $file, REF string $good, REF string $maybe, REF string $bad) {
	remove($file, $good);
	remove($file, $maybe);
	remove($file, $bad);
}

#--------------------------------------------------------------------------
sub remove(IN string $file, REF string $array) {
	for (int $i = 0; $i < sizeof($array); $i++) {
		if (!defined($array[$i])) {
			continue;
		}
		if($array[$i] == $file) {
			undef($array[$i]);
		}
	}
}
#--------------------------------------------------------------------------
sub AddList(REF string $outFiles, REF string $outMessage, IN string $files, IN string $message) {
	for (int $i = 0; $i < sizeof($files); $i++) {
		if (defined($files[$i])) {
			_AppendString($outFiles,   $files[$i]);
			_AppendString($outMessage, $message[$i]);
		}
	}
}

#--------------------------------------------------------------------------
# Runs tasking for a given metadata file
#--------------------------------------------------------------------------
sub runTasking(IN string $metaFile, IN string $resultsDir, REF int $jobs, REF int $cnt) {
	string $command = "";
	string $taskID = "";
	string $targetID = "";
	string $priority = "";
	bool $ok = false;
	string $location = "";
	if (<bool>%_sgEnv{"verbose"}) {
		echo "About to start parsing tasking";
	}
	string $parts;
	SplitPath($metaFile, $parts);
	string $taskingDir = $parts[0];
	string $resultsFile;
	string $mask = "*.txt";

	# Assuming priority level goes from 1 to 9
	for (int $j=1; $j < 10; $j++) {
		string $filter = "$j$mask";
		string $files = "";
		#string $scriptFile = "";

		if (<bool>%_sgEnv{"verbose"}) {
			echo "Look for files:";
			echo "\ttaskingDir = $taskingDir";
			echo "\tfilter = $filter";
		}
		# Run  tasking associated with metadata file
		if (!FileGetFiles($taskingDir, $filter, $files, true)) {
			if (<bool>%_sgEnv{"verbose"}) {
				echo "Failed to get tasking files";
			}
		} else {
			for (int $i=0; $i < sizeof($files); $i++) {
				if (<bool>%_sgEnv{"verbose"}) {
					echo "Examining $files[$i] for tasking purposes";
				}
				string $timestamp;
				# necessary to ensure that there are no identical timestamps
				Sleep(1000);
				if (!GetTimestamp($timestamp)) {
					$timestamp = "_Unknown";
				} else {
					$timestamp = "_$timestamp";
				}

				# dir processing
				if (RegexMatch("_dirTasking", $files[$i])) {
					_dirTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/dir_$taskID$timestamp.xml";
					if (checkDevice($command)) {
						runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
					}
				} 

				# regquery processing
				if (RegexMatch("_regQueryTasking", $files[$i])) {
					_regQueryTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/regquery_$taskID$timestamp.xml";
					echo ("\nRegistry Query: $command", WARNING);
					if (prompt("\nRun anyway?", true)) {
						runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
					}
				}

				# ipconfig processing
				if (RegexMatch("_ipconfigTasking", $files[$i])) {
					_ipTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/ipconfig_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				} 
				# netmap processing
				if (RegexMatch("_netmapTasking", $files[$i])) {
					_netmapTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/netmapTasking_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}
				# netstat processing
				if (RegexMatch("_netstatTasking", $files[$i])) {			
					_netstatTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/netstatTasking_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				} 
				# routetable processing
				if (RegexMatch("_routeTasking", $files[$i])) {
					_routeTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/route_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# arp processing
				if (RegexMatch("_arpTasking", $files[$i])) {
					_arpTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/arp_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# processlist processing
				if (RegexMatch("_processlistTasking", $files[$i])) {
					_processlistTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/processlist_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# audit processing
				if (RegexMatch("_auditTasking", $files[$i])) {	
					_auditTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/audit_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# locale processing
				if (RegexMatch("_localeTasking", $files[$i])) {	
					_localeTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/locale_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# traceroute processing (Assume dmgz is already installed)
				if (RegexMatch("_tracerouteTasking", $files[$i])) {	
					_tracerouteTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/traceroute_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				}

				# regwalk processing
				if (RegexMatch("_regwalkTasking", $files[$i])) {	
					_regWalkTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/regwalk_$taskID$timestamp.xml";
					echo ("\nRegistry Walk: $command", WARNING);
					if (prompt("\nRun anyway?", true)) {
						runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
					}
				}

				# get processing
				if (RegexMatch("_getTasking", $files[$i])) {
					_getTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/get_$taskID$timestamp.xml";
					
					# Check size before retrieving
					if (checkSize($command)) {
						if (checkDevice($command)) {
							runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
						}
					}
				} 

				# systeminfo processing
				if (RegexMatch("_systeminfoTasking", $files[$i])) {	
					_systeminfoTasking($files[$i], $command, $taskID, $targetID);
					$resultsFile = "$resultsDir/systeminfo_$taskID$timestamp.xml";
					runCmd ($command, $resultsFile, $taskID, $targetID, $jobs, $cnt);
				} 
			}
		}
	}
}

#--------------------------------------------------------------------------
# RunCmd
#		Runs a command, but only if there are no more than the max (10).
#		If the number of DSZ commands is > 10, call pollJobs to determine 
#		when another job can be added
#--------------------------------------------------------------------------
Sub runCmd(IN STRING $command, IN STRING $resultsFile, IN STRING $taskID, IN STRING $targetID, REF INT $jobs, REF INT $cnt) {
	if ($command != "") {
	
		if (<bool>%_sgEnv{"verbose"}) {
			echo "Run Command:  '$command'";
		}
	
		bool $suc;
		int $idValue;
		int $id;
		int $cmdid;
		string $location;
		string $fileLoc;

		for (int $j=0; $j < sizeof($command); $j++)
		{
			if ($cnt > 9)
			{
				echo ("\nThere are currently $cnt tasks running...waiting for one or more to finish\n", WARNING);
				while ($cnt > 9)
				{
					pollJobs($jobs, $cnt);
				}
			}
			@record on;
			bool $ok = `background $command[$j]`;
			@record off;

			if (!GetCmdData("commandmetadata::id", $cmdid)) {
   				return false;
			}
			if (!GetCmdData("commandmetadata::xmllog", $location)) {
   				$fileLoc[$j] = "Does not exist";
			}
			else {
   				$fileLoc[$j] = $location;
			}
			$jobs[$cnt] = $cmdid;
			$cnt++;
		} 
		# Write results to TaskResults directory
		writeResults($resultsFile, $taskID, $targetID, $command, $fileLoc);
	}	
}

#--------------------------------------------------------------------------
# findTasking
#		Attempt to match up target with tasking by first checking PC ID and
#		then checking MACs
#--------------------------------------------------------------------------
Sub findTasking(IN STRING $metaFile, IN bool $bQuery, OUT int $suggestionType, OUT string $suggestion)
{

	echo "Metadata:  $metaFile";

	# first, get target information
	int		$host_pcIds;
	string	$host_macAddresses;
	string	$host_ipaddresses;
	string	$host_hostname = "(None)";
	string	$host_domain = "(None)";
	
	if (!FindTargetInformation($host_pcIds, $host_macAddresses, $host_ipAddresses, $host_hostname, $host_domain)) {
		echo "Unable to find local information for comparison.";
		return false;
	}

	# second, get metadata information
	int		$meta_pcIds;
	string	$meta_macAddresses;
	string	$meta_ipaddresses;
	string	$meta_hostname = "(None)";
	string	$meta_domain = "(None)";

	if (!FindMetadataInformation($metaFile, $meta_pcIds, $meta_macAddresses, $meta_ipaddresses, $meta_hostname, $meta_domain)) {
		echo ("Unable to find metadata for comparison.", ERROR);
		return false;
	}

	# PC ID comparison
	if (sizeof($host_pcIds) > 0 && sizeof($meta_pcIds) > 0) {
		# do comparison
		int $matches;
		bool $matchFound = false;
		for (int $i = 0; $i < sizeof($host_pcIds); $i++) {
			for (int $j = 0; $j < sizeof($meta_pcIds); $j++) {
				if ($host_pcIds[$i] == $meta_pcIds[$j]) {
					$matchFound = true;
				}
			}
		}
		int $fieldSize = 18;
		string $banner = "";
		StrCat($banner, CenterString("Target", $fieldSize));
		StrCat($banner, "   ");
		StrCat($banner, CenterString("Metadata", $fieldSize));
				
		string $line = "";
		StrCat($line, CenterString("PC IDs", strlen($banner)));
		echo $line;
		echo $banner;
		echo Repeat("-", strlen($banner));
		int $count = max(sizeof($host_pcIds), sizeof($meta_pcIds));
		for (int $i = 0; $i < $count; $i++) {
			string $host = PadRightString("", $fieldSize);
			if ($i < sizeof($host_pcIds)) {
				$host = NumberToHexString($host_pcIds[$i], 16);
			}
			string $meta = PadRightString("", $fieldSize);
			if ($i < sizeof($meta_pcIds)) {
				$meta = NumberToHexString($meta_pcIds[$i], 16);
			}
			
			echo "$host   $meta";
			
		}

		int $type;
		string $message;
		if (!$matchFound) {
			if (sizeof($host_pcIds) > 0 && sizeof($meta_pcIds) > 0) {
				$type = ERROR;
				$message = "No match!";
				
				SetSuggestion($suggestion, $suggestionType, "SKIP", ERROR);
			} else {
				$type = WARNING;
				$message = "No values to match";
			}
		} else {
			if (sizeof($host_pcIds) > 1 || sizeof($meta_pcIds) > 1) {
				$type = WARNING;
				$message = "Weak Match - Multiple Ids";
				
				SetSuggestion($suggestion, $suggestionType, "CONSIDER", WARNING);
			} else {
				$type = GOOD;
				$message = "Solid Match";
				
				SetSuggestion($suggestion, $suggestionType, "DO TASKING", GOOD);
			}
		}
		echo("PC ID Comparison:  $message", $type);
		
	} else if (sizeof($host_pcIds) > 0) {
		echo ("Metadata did not contain a PC ID", WARNING);
	} else if (sizeof($meta_pcIds) > 0) {
		echo ("Unable to determine ID of current PC connection", WARNING);
	} else {
		echo ("Unable to find any PC ID", WARNING);
	}
	echo();

	# MAC comparison
	if (sizeof($host_macAddresses) > 0 && sizeof($meta_macAddresses) > 0) {
		# do comparison

Lines 1–500 of 1249.