[ #gW(ddlZddlZddlZddlmZmZmZmZmZddl m Z m Z m Z m Z mZddlmZddlmZddlmZddlmZddlmZdd lmZdd lmZmZmZej>e Z!Gd d e jDjFejHZ%y) N)IterableListOptionalTupleType) constants exceptions interfaces rendererssymbols) requirements) format_hints)intermed)versions)network) timeliner)info poolscannerverinfoc eZdZdZdZdZedZede jjde de ejfdZede jjd e d e dee effd Zede jjd e d e d e de f d Zede jjd e d e de dee j,j.f dZddeefdZdZdZy)NetScanzGScans for network objects present in a particular windows memory image.)rrrrc Ftjddddgtjdtjdtjd t j dtjd tjdtjd d d dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r componentversionrrinclude-corruptzRadically eases result validation. This will show partially overwritten data. WARNING: the results are likely to include garbage and/or corrupt data. Be cautious!FT)rr defaultoptional) r ModuleRequirementVersionRequirementr PoolScannerrInforVerInfoBooleanRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/netscan.pyget_requirementszNetScan.get_requirementss  * *,()4   + +"k.E.Ey   + +tyy)   + +'//9   + +&A    context symbol_tablereturnc |jj|tjzdzj}|jj|tjzdzj}|jj|tjzdzj}t j d|tjzdz|dft jjt jjzt j d|tjzdz|dft jjt jjzt j d|tjzdz|dft jjt jjzgS) aVCreates a list of Pool Tag Constraints for network objects. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the symbols / types Returns: The list containing the built constraints. _TCP_LISTENER _TCP_ENDPOINT _UDP_ENDPOINTsTcpLN) type_namesize page_typesTcpEsUdpA) symbol_spaceget_typerBANGr9rPoolConstraintPoolTypeNONPAGEDFREE)r1r2 tcpl_size tcpe_size udpa_sizes r.create_netscan_constraintsz"NetScan.create_netscan_constraints5s((11 9>> )O ; $ ((11 9>> )O ; $ ((11 9>> )O ; $   & &&7/I&%..77+:N:N:S:SS    & &&7/I&%..77+:N:N:S:SS    & &&7/I&%..77+:N:N:S:SS  !  r0 layer_nament_symbol_tablec ptj||}tj||}|rd}nd}tj j |||}tj j|||} t|j} t|j} t|j} t j#dj%|j|j|j&|j| dk(r|dk(rt(j*} nt(j,} |dk(r:idd d d d d d d d dddddddddddddddddddddd dd!dd"di} nnt j#d?| j3| | | |f}|s| Dcgc]\}}}}|| k(r|| k(r ||kr||||f}}}}}|j;|r/|d@}| j3|}t j#dA|n'tdBj%| | |j&| t j#dC||| fS#t$r tdtjdxYwcc}}}}wcc}}}}w)DaTries to determine which symbol filename to use for the image's tcpip driver. The logic is partially taken from the info plugin. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols Returns: The filename of the symbol table to use. )r1r2x64x86z4Kernel Debug Structure version format not supported!z\Kernel Debug Structure missing VERSION/KUSER structure, unable to determine Windows version!z"Determined OS Version: {}.{} {}.{} )riprznetscan-vista-x86)rLriqr)rLrirr)rLrisr)rLrirznetscan-win7-x86)rLrir)rLri r)rLri#rznetscan-win8-x86)rL%rznetscan-win81-x86)rKri(rznetscan-win10-10240-x86)rKriZ)rznetscan-win10-10586-x86)rKri98rznetscan-win10-14393-x86)rKri:rznetscan-win10-15063-x86)rKri?r)rKriBrznetscan-win10-17134-x86)rKricErrKrGrrKrGrznetscan-vista-x64znetscan-vista-sp12-x64znetscan-win7-x64znetscan-win8-x64znetscan-win81-x64)rLrMrNiMznetscan-win81-19935-x64znetscan-win10-x64znetscan-win10-15063-x64znetscan-win10-16299-x64znetscan-win10-17134-x64znetscan-win10-17763-x64znetscan-win10-18362-x64znetscan-win10-18363-x64znetscan-win10-19041-x64znetscan-win10-20348-x64)rOrQ)rKriaJr)rKri|OrrrPz@Detected 18363 data structures: working with 18363 symbol table.rRzaRequiring further version inspection due to OS version by checking tcpip.sys's FileVersion header memory_layerNz tcpip.sysrMz&Determined tcpip.sys's FileVersion: {}z,Could not determine tcpip.sys's FileVersion.zEUnable to retrieve physical memory layer, skipping FileVersion check.z>Unable to find exact matching symbol file, going with latest: z6This version of Windows is not supported: {}.{} {}.{}!zDetermined symbol filename: )r symbol_table_is_64bitris_win10_18363_or_laterrr*get_version_structureget_kuser_structureint MinorVersionNtMajorVersionNtMinorVersion ValueErrorNotImplementedErrorr VolatilityExceptionvollogdebugformat MajorVersionrwin10_x64_class_types class_typeslayersconfiggetrr+find_version_infosort)r-r1rFrGis_64bitis_18363_or_laterarchverskuservers_minor_versionnt_major_versionnt_minor_versionre version_dicttcpip_mod_versionabcdphysical_layer_nameverfilenament_majnt_minvers_min tcpip_vercurrent_versionslatest_versions r.determine_tcpip_versionzNetScan.determine_tcpip_versiongs_000/J$<</  DDyy..w OT --gz?S !$T%6%6!7 "5#7#78 "5#7#78   0 7 7$$$$!!!!    r !dem!77K"--K 5=!4!4 !4 !4   !3   !3  !3 !3 !4"#<"#<"#<"#<"#<"#< "#"#6"#6"#6"#<"#< "#?$$U %F  00n p X s8?M;"N( !N0 ;*N% config_pathcd|i}|j|||\}}tjj||tj j dd|||S)aCreates a symbol table for TCP Listeners and TCP/UDP Endpoints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols config_path: The config path where to find symbol files Returns: The name of the constructed symbol table nt_symbolswindowsnetscan)re table_mapping)rrIntermediateSymbolTablecreateospathjoin)r-r1rFrGrrsymbol_filenameres r.create_netscan_symbol_tablez#NetScan.create_netscan_symbol_table>sm&&7 '*'B'B   ( $ //66   GGLLI . #' 7  r0netscan_symbol_tablec#K|j||}tjj||||D] }|\}}} |yw)a>Scans for network objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols netscan_symbol_table: The name of the table containing the network object symbols (_TCP_LISTENER etc.) Returns: A list of network objects found by scanning the `layer_name` layer for network pool signatures N)rErr)generate_pool_scan) r-r1rFrGr constraintsresult _constraint mem_object_headers r.scanz NetScan.scanbsS(44W>RS !--@@ Z+ F06 ,KW   sAANshow_corrupt_resultsc# K|jj|jd}|j|j|j|j |j }|j|j|j|j |D]A}tjd|jjddt||s|jsPt|tj rtjd|jjd|j#D]\}}}dt%j&|jjd|z||j(ddd |j+xst-j.|j1xst-j.|j3xst-j.f fbt|tj4rtjd |jjd|j7tj8k(rd }n&|j7tj:k(rd }nd } |j<j>} dt%j&|jj||jCxst-j.|jD|jGxst-j.|jH| |j+xst-j.|j1xst-j.|j3xst-j.f f t|tjJrtjd|jjd|j#D]\}}} dt%j&|jjd|z||j(| dd|j+xst-j.|j1xst-j.|j3xst-j.f ftjd|dt|Dy#t@$rt-j.} Y[wxYww)z3Generates the network objects for use in rendering.rzFound netw obj @ 0x2xz of assumed type zFound UDP_ENDPOINT @ 0xrUDP*zFound _TCP_ENDPOINT @ 0xTCPv4TCPv6zTCPv?zFound _TCP_LISTENER @ 0xTCP LISTENINGz)Found network object unsure of its type: z of type N)&r1modulesrgrrFsymbol_table_namerrr`ravoloffsettypeis_valid isinstancerr7dual_stack_socketsrHexPort get_owner_pidr UnreadableValueget_owner_procnameget_create_timer6get_address_familyAF_INETAF_INET6Stater r]get_local_address LocalPortget_remote_address RemotePortr5) selfrrrnetw_objrzladdr_protostateraddrs r. _generatorzNetScan._generator~s %%dkk(&;<#?? LL&++V-E-EtGWGW  LL     $ $  H LL%hll&9&9"%==NtT\~N^_ (0A0A0C(G$9$9: 6x||7J7J26NOP&.%@%@%BMC(,,X\\-@-@A!CK!$MM$224S 8Q8Q8S$779;(88:$446U):S:S:U &C$Hg&;&;< 7 8K8KB7OPQ..0GOOC#E002g6F6FF#E#E8$NN66E $(()<)<= 224S 8Q8Q8S ** 335T9R9R9T ++ ..0OI4M4M4O 335T9R9R9T 002Qi6O6O6Q "Hg&;&;< 7 8K8KB7OPQ*2)D)D)F%C(,,X\\-@-@A!CK!$MM!'$224S 8Q8Q8S$779;(88:$446U):S:S:U *G& ?zSWX`SaRbcs \"8%557E8s+J T S"H;TS>:T=S>>Tc #K|jD]}|\}}t|dtjs&|Dcgc]:}t|tjst|tj rdn|<}}dj |d|d|d|d|d|d |d |d }|tjj|dfycc}ww) N zN/Az`Network connection: Process {} {} Local Address {}:{} Remote Address {}:{} State {} Protocol {} rrMrLr) rrdatetimer rUnparsableValuerbr TimeLinerTypeCREATED)rrow_depthrow_datair s r.generate_timelinezNetScan.generate_timelines??$C" FHhqk8+<+<=" "!Y%>%>?!!Y%>%>?H==CVQKQKQKQKQKQKQKQK >  7 7 ? ?!M M7% s;C?CrErrrrrobjectsObjectInterfacerrboolrrrr0r.rrsQ"+H  0/ ##44/ DG/ k(( )/ / bT%##44T%T% T% sDy  T%T%l! ##44! !  !  ! ! ! F##44  "  *$$44 5 6dx~dLN< r0r)&rloggingrtypingrrrrrvolatility3.frameworkrr r r r #volatility3.framework.configurationr volatility3.framework.renderersrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr0volatility3.framework.symbols.windows.extensionsrvolatility3.pluginsrvolatility3.plugins.windowsrrr getLoggerrr`pluginsPluginInterfaceTimeLinerInterfacerrr0r.rsh  88WW<82:D)BB   8 $} j  00)2N2N} r0