From e7cc357c64bb06313320e4ec13e631fac758714e Mon Sep 17 00:00:00 2001 From: Gabe Stocco <98900+gfs@users.noreply.github.com> Date: Tue, 25 May 2021 18:22:30 -0700 Subject: [PATCH] Gfs/#579 (#582) * Set version to '2.4-alpha' * Update Readme.md (#581) * Update README.md * Some cleanup * Update OpenPortCollector.cs * Update CommandOptions.cs * Fix Getting Process Names * Update EventLogCollector.cs * Update FileSystemMonitor.cs * Update CollectorTests.cs * Update CollectorTests.cs * Update CollectorTests.cs * Update CollectorTests.cs * Update version.json * Update version.json --- .../CollectorOptions/FileCollectorOptions.razor | 12 ++++++------ .../CollectorOptions/RegistryCollectorOptions.razor | 10 +++++----- .../MonitorOptions/FileMonitorOptions.razor | 10 +++++----- Lib/Collectors/EventLogCollector.cs | 4 ++++ Lib/Collectors/FileSystemMonitor.cs | 2 +- Lib/Collectors/OpenPortCollector.cs | 6 ++---- Lib/Objects/CommandOptions.cs | 10 +++++----- Lib/Utils/Win32OpenPortListenerHelper.cs | 2 +- Tests/CollectorTests.cs | 2 +- version.json | 2 +- 10 files changed, 31 insertions(+), 29 deletions(-) diff --git a/Cli/Components/CollectorOptions/FileCollectorOptions.razor b/Cli/Components/CollectorOptions/FileCollectorOptions.razor index 914fe494e..a53035f85 100644 --- a/Cli/Components/CollectorOptions/FileCollectorOptions.razor +++ b/Cli/Components/CollectorOptions/FileCollectorOptions.razor @@ -24,9 +24,9 @@
@@ -71,17 +71,17 @@ void RemoveInputFromList() { - if (appData.CollectOptions.SelectedDirectories.Count > SelectedDirectoryTop) + if (appData.CollectOptions.SelectedDirectories.Count() > SelectedDirectoryTop) { - appData.CollectOptions.SelectedDirectories.RemoveAt(SelectedDirectoryTop); + appData.CollectOptions.SelectedDirectories = appData.CollectOptions.SelectedDirectories.Except(appData.CollectOptions.SelectedDirectories.Skip(SelectedDirectoryTop-1).Take(1)); Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, false); } } void PushInputToList() { - appData.CollectOptions.SelectedDirectories.Add(SelectedDirectoryInput); - SelectedDirectoryTop = appData.CollectOptions.SelectedDirectories.Count - 1; + appData.CollectOptions.SelectedDirectories = appData.CollectOptions.SelectedDirectories.Union(new string[] { SelectedDirectoryInput }); + SelectedDirectoryTop = appData.CollectOptions.SelectedDirectories.Count() - 1; Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, true); SelectedDirectoryInput = string.Empty; } diff --git a/Cli/Components/CollectorOptions/RegistryCollectorOptions.razor b/Cli/Components/CollectorOptions/RegistryCollectorOptions.razor index bb0757f51..1cdefe70f 100644 --- a/Cli/Components/CollectorOptions/RegistryCollectorOptions.razor +++ b/Cli/Components/CollectorOptions/RegistryCollectorOptions.razor @@ -23,9 +23,9 @@
@@ -44,14 +44,14 @@ void RemoveInputFromList() { - appData.CollectOptions.SelectedHives.RemoveAt(SelectedHiveTop); + appData.CollectOptions.SelectedHives = appData.CollectOptions.SelectedDirectories.Except(appData.CollectOptions.SelectedDirectories.Skip(SelectedHiveTop-1).Take(1)); Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, false); } void PushInputToList() { - appData.CollectOptions.SelectedHives.Add(SelectedHiveInput); - SelectedHiveTop = appData.CollectOptions.SelectedHives.Count - 1; + appData.CollectOptions.SelectedHives = appData.CollectOptions.SelectedHives.Union(new string[] { SelectedHiveInput }); + SelectedHiveTop = appData.CollectOptions.SelectedHives.Count() - 1; Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, true); SelectedHiveInput = string.Empty; } diff --git a/Cli/Components/MonitorOptions/FileMonitorOptions.razor b/Cli/Components/MonitorOptions/FileMonitorOptions.razor index 6343c31a5..19c149388 100644 --- a/Cli/Components/MonitorOptions/FileMonitorOptions.razor +++ b/Cli/Components/MonitorOptions/FileMonitorOptions.razor @@ -30,9 +30,9 @@
@@ -51,14 +51,14 @@ void RemoveInputFromList() { - appData.MonitorOptions.MonitoredDirectories.RemoveAt(SelectedDirectoryTop); + appData.MonitorOptions.MonitoredDirectories = appData.MonitorOptions.MonitoredDirectories.Except(appData.MonitorOptions.MonitoredDirectories.Skip(SelectedDirectoryTop-1).Take(1)); Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, false); } void PushInputToList() { - appData.MonitorOptions.MonitoredDirectories.Add(SelectedDirectoryInput); - SelectedDirectoryTop = appData.MonitorOptions.MonitoredDirectories.Count - 1; + appData.MonitorOptions.MonitoredDirectories = appData.MonitorOptions.MonitoredDirectories.Union(new string[] { SelectedDirectoryInput }); + SelectedDirectoryTop = appData.MonitorOptions.MonitoredDirectories.Count() - 1; Helper.ToggleGlow(() => InvokeAsync(StateHasChanged), directorySelectElementGlowClass, true); SelectedDirectoryInput = string.Empty; } diff --git a/Lib/Collectors/EventLogCollector.cs b/Lib/Collectors/EventLogCollector.cs index 7523af50c..55d2be88b 100644 --- a/Lib/Collectors/EventLogCollector.cs +++ b/Lib/Collectors/EventLogCollector.cs @@ -189,6 +189,10 @@ public void ExecuteMacOs(CancellationToken cancellationToken) [System.Diagnostics.CodeAnalysis.SuppressMessage("Design", "CA1031:Do not catch general exception types", Justification = "Official documentation for this functionality does not specify what exceptions it throws. https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlogentrycollection?view=netcore-3.0")] public void ExecuteWindows(CancellationToken cancellationToken) { + if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) + { + return; + } void ParseWindowsLog(EventLogEntry entry) { if (opts.GatherVerboseLogs || entry.EntryType.ToString() == "Warning" || entry.EntryType.ToString() == "Error") diff --git a/Lib/Collectors/FileSystemMonitor.cs b/Lib/Collectors/FileSystemMonitor.cs index 5f0fda6ad..f0a49701f 100644 --- a/Lib/Collectors/FileSystemMonitor.cs +++ b/Lib/Collectors/FileSystemMonitor.cs @@ -83,7 +83,7 @@ public FileSystemMonitor(MonitorCommandOptions opts, Action c GatherHashes = options.GatherHashes, }); - foreach (var dir in options.MonitoredDirectories.Count > 0 ? options.MonitoredDirectories : fsc.Roots.ToList()) + foreach (var dir in (options?.MonitoredDirectories.Any() is true) ? options.MonitoredDirectories : fsc.Roots.ToList()) { foreach (var filter in defaultFiltersList) { diff --git a/Lib/Collectors/OpenPortCollector.cs b/Lib/Collectors/OpenPortCollector.cs index 1e4edfa3a..d199228df 100644 --- a/Lib/Collectors/OpenPortCollector.cs +++ b/Lib/Collectors/OpenPortCollector.cs @@ -191,10 +191,8 @@ internal void ExecuteWindows(CancellationToken cancellationToken) { Address = endpoint.Address.ToString(), }; - foreach (ProcessPort p in Win32ProcessPorts.ProcessPortMap.FindAll(x => x.PortNumber == endpoint.Port)) - { - obj.ProcessName = p.ProcessName; - } + + obj.ProcessName = Win32ProcessPorts.ProcessPortMap.Find(x => x.PortNumber == endpoint.Port)?.ProcessName; HandleChange(obj); } diff --git a/Lib/Objects/CommandOptions.cs b/Lib/Objects/CommandOptions.cs index 9a72a10a8..0974eee63 100644 --- a/Lib/Objects/CommandOptions.cs +++ b/Lib/Objects/CommandOptions.cs @@ -119,13 +119,13 @@ public class CollectorOptions : CommandOptions public string? RunId { get; set; } [Option("directories", Required = false, HelpText = "comma separated list of paths to scan with FileSystemCollector", Separator = ',')] - public List SelectedDirectories { get; set; } = new List(); + public IEnumerable SelectedDirectories { get; set; } = new List(); [Option("skip-directories", Required = false, HelpText = "comma separated list of paths to skip with FileSystemCollector", Separator = ',')] - public List SkipDirectories { get; set; } = new List(); + public IEnumerable SkipDirectories { get; set; } = new List(); [Option("hives", Required = false, HelpText = "comma separated list of hives and subkeys to search.", Separator = ',')] - public List SelectedHives { get; set; } = new List(); + public IEnumerable SelectedHives { get; set; } = new List(); [Option(HelpText = "Force singlethreaded collectors.")] public bool SingleThread { get; set; } @@ -276,7 +276,7 @@ public class GuidedModeCommandOptions : CollectorOptions public bool FileNamesOnly { get; set; } [Option(HelpText = "Comma-separated list of directories to monitor.", Separator = ',')] - public List MonitoredDirectories { get; set; } = new List(); + public IEnumerable MonitoredDirectories { get; set; } = new List(); [Option(HelpText = "Directory to output to.")] public string? OutputPath { get; set; } @@ -304,7 +304,7 @@ public class MonitorCommandOptions : CommandOptions public bool GatherHashes { get; set; } [Option('d', "directories", Required = false, HelpText = "Comma-separated list of directories to monitor.", Separator = ',')] - public List MonitoredDirectories { get; set; } = new List(); + public IEnumerable MonitoredDirectories { get; set; } = new List(); //[Option('r', "registry", Required = false, HelpText = "Monitor the registry for changes. (Windows Only)")] //public bool EnableRegistryMonitor { get; set; } diff --git a/Lib/Utils/Win32OpenPortListenerHelper.cs b/Lib/Utils/Win32OpenPortListenerHelper.cs index b1d878b6a..5179ed2b8 100644 --- a/Lib/Utils/Win32OpenPortListenerHelper.cs +++ b/Lib/Utils/Win32OpenPortListenerHelper.cs @@ -29,7 +29,7 @@ public static List ProcessPortMap } } - private static List CachedProcessPortMap = new List(); + private static List? CachedProcessPortMap = null; /// /// This method distills the output from netstat -a -n -o into a list of ProcessPorts that provide diff --git a/Tests/CollectorTests.cs b/Tests/CollectorTests.cs index bc9148a29..8943a0b5a 100644 --- a/Tests/CollectorTests.cs +++ b/Tests/CollectorTests.cs @@ -507,7 +507,7 @@ public void TestUserCollectorWindows() { Assert.IsTrue(AsaHelpers.IsAdmin()); var user = System.Guid.NewGuid().ToString().Substring(0, 10); - var password = "$" + CryptoHelpers.GetRandomString(13); + var password = $"$A4%b^6a_"; var cmd = string.Format("user /add {0} {1}", user, password); ExternalCommandRunner.RunExternalCommand("net", cmd); diff --git a/version.json b/version.json index 764508454..2c0f7bd2b 100644 --- a/version.json +++ b/version.json @@ -16,4 +16,4 @@ "release": { "branchName": "release/v{version}" } -} \ No newline at end of file +}