Merge pull request Pennyw0rth#307 from Pennyw0rth/marshall-wcc-fix

Fix: WCC Module - do not create log file on every file load

Author: Marshall-Hallenbeck

nxc/modules/wcc.py

@@ -28,17 +28,6 @@
 REG_VALUE_TYPE_UNICODE_STRING_SEQUENCE = 7
 REG_VALUE_TYPE_64BIT_LE = 11
 
-# Setup file logger
-if "wcc_logger" not in globals():
-    wcc_logger = logging.getLogger("WCC")
-    wcc_logger.propagate = False
-    log_filename = nxc_logger.init_log_file()
-    log_filename = log_filename.replace("log_", "wcc_")
-    wcc_logger.setLevel(logging.INFO)
-    wcc_file_handler = logging.FileHandler(log_filename)
-    wcc_file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s"))
-    wcc_logger.addHandler(wcc_file_handler)
-
 
 class ConfigCheck:
     """Class for performing the checks and holding the results"""
@@ -75,7 +64,7 @@ def run(self):
     def log(self, context):
         result = "passed" if self.ok else "did not pass"
         reasons = ", ".join(self.reasons)
-        wcc_logger.info(f'{self.connection.host}: Check "{self.name}" {result} because: {reasons}')
+        self.module.wcc_logger.info(f'{self.connection.host}: Check "{self.name}" {result} because: {reasons}')
         if self.module.quiet:
             return
 
@@ -99,6 +88,19 @@ class NXCModule:
     supported_protocols = ["smb"]
     opsec_safe = True
     multiple_hosts = True
+    
+    def __init__(self):
+        self.context = None
+        self.module_options = None
+        
+        self.wcc_logger = logging.getLogger("WCC")
+        self.wcc_logger.propagate = False
+        log_filename = nxc_logger.init_log_file()
+        log_filename = log_filename.replace("log_", "wcc_")
+        self.wcc_logger.setLevel(logging.INFO)
+        wcc_file_handler = logging.FileHandler(log_filename)
+        wcc_file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s"))
+        self.wcc_logger.addHandler(wcc_file_handler)
 
     def options(self, context, module_options):
         """
@@ -156,15 +158,9 @@ def __init__(self, context, connection):
         self.dce = remoteOps._RemoteOperations__rrp
 
     def run(self):
-        # Prepare checks
         self.init_checks()
-
-        # Perform checks
         self.check_config()
-
-    # Check methods #
-    #################
-
+        
     def init_checks(self):
         # Declare the checks to do and how to do them
         self.checks = [
@@ -483,9 +479,6 @@ def check_applocker(self):
 
         return success, reasons
 
-    # Methods for getting values from the remote registry #
-    #######################################################
-
     def _open_root_key(self, dce, connection, root_key):
         ans = None
         retries = 1
@@ -595,9 +588,6 @@ def get_value(subkey_handle, dwIndex=0):
                     return data
             return DCERPCSessionError(error_code=ERROR_OBJECT_NOT_FOUND)
 
-    # Methods for getting values from SAMR and SCM #
-    ################################################
-
     def get_service(self, service_name, connection):
         """Get the service status and configuration for specified service"""
         remoteOps = RemoteOperations(smbConnection=connection.conn, doKerberos=False)
@@ -645,23 +635,15 @@ def ls(self, smb, path="\\", share="C$"):
             self.context.log.error(f"ls(): C:\\{path} {e}\n")
         return file_listing
 
-
-# Comparison operators #
-########################
-
-
 def le(reg_sz_string, number):
     return int(reg_sz_string[:-1]) <= number
 
-
 def in_(obj, seq):
     return obj in seq
 
-
 def startswith(string, start):
     return string.startswith(start)
 
-
 def not_(boolean_operator):
     def wrapper(*args, **kwargs):
         return not boolean_operator(*args, **kwargs)

nxc/protocols/smb.py

@@ -1126,7 +1126,8 @@ def wmi(self, wmi_query=None, namespace=None):
                     record = wmi_results.getProperties()
                     records.append(record)
                     for k, v in record.items():
-                        self.logger.highlight(f"{k} => {v['value']}")
+                        if k != "TimeGenerated":  # from the wcc module, but this is a small hack to get it to stop spamming - TODO: add in method to disable output for this function
+                            self.logger.highlight(f"{k} => {v['value']}")
                 except Exception as e:
                     if str(e).find("S_FALSE") < 0:
                         raise e