X frddlZddlZddlmZmZmZmZddlmZm Z m Z m Z m Z ddl mZddlmZddlmZddlmZddlmZdd lmZmZmZmZejeZGd d e jj ej!Z"dS) N)IterableOptional GeneratorTuple) constants exceptions interfaces rendererssymbols) requirements) format_hints)pdbutil)network) timeliner)netscanmodulesinfoverinfoceZdZdZdZdZedZedZede j j de de d e d e f d Zede j j de d e d e d ef dZe d'de j j de de de de d ee jjf dZede j j de de d ee jjfdZede j j de de de de de d ee jjddffdZede j j de de de de d ee jjf dZede j j de de de de d e f d Zede j j de de de de d ee e ff d!Zede j j de de de de de d ee jjfd"Zd(d#eefd$Zd%Z d&Z!dS))NetStatzSTraverses network tracking structures present in a particular windows memory image.)rrrrc tjddddgtjdtjdtjd t jdtjd tjdtjd tj dtjd tj dtj d dddgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r componentversionrrrrinclude-corruptzRadically eases result validation. This will show partially overwritten data. WARNING: the results are likely to include garbage and/or corrupt data. Be cautious!FT)rrdefaultoptional)r ModuleRequirementVersionRequirementrNetScanrModulesr PDBUtilityrInforVerInfoBooleanRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/netstat.pyget_requirementszNetStat.get_requirementss  *,()4     +'/9     +'/9     +'**5::=3;NPQRRSTUL7LQxx 3 318,11JJs\1222 3 r1tcpnet_symbol_tableportport_pool_addrc#K|dkr@|tjzdz}|j|d}nH|dkr@|tjzdz}|j|d}ndSt d||dz } |d z} ||tjzd z|| } | j| } | j j | } | sdS| | j }|rf|||||z }|V|j rB|||| |j |z }|V|j >dSdSdS) aLists all UDP Endpoints and TCP Listeners by parsing UdpPortPool and TcpPortPool. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate net_symbol_table: The name of the table containing the tcpip types port: Current port as integer to lookup the associated object. port_pool_addr: Address of port pool object proto: Either "tcp" or "udp" to decide which types to use. Returns: The list of network objects from this image's TCP and UDP `PortPools` rN _TCP_LISTENERNextudp _UDP_ENDPOINTNzCurrent Port: rE_INET_PORT_POOLr7r8)rBANG symbol_spaceget_typerelative_child_offsetvollogdebugobjectPortAssignmentsInPaBigPoolBase Assignmentsr5EntryrT)r.r6r7rOrPrQprotoobj_name ptr_offset list_indextruncated_port port_poolinpa assignment netw_insidecurr_objs r/enumerate_structures_by_portz$NetStat.enumerate_structures_by_portzs. E>>').8?JH -66x@@VVJJe^^').8?JH -66x@@VVJJ 4 ,d,,---QY NN y~ -0A A!!#  (4)5nE  4))**:;;  ~~Z j8P&HNNN- ">>)..x}== J*  -       r1 nt_symbolsctj|||D]F}|jdkr't d|jd|cSGdS)a|Uses `windows.modules` to find tcpip.sys in memory. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbols: The name of the table containing the kernel symbols Returns: The constructed tcpip.sys module object. z tcpip.syszFound tcpip.sys image base @ 0xxN)rr) list_modules BaseDllName get_stringr^r_DllBase)r.r6r7rpmods r/get_tcpip_modulezNetStat.get_tcpip_modulesu"?//ZPP  C))++{:: Ns{NNNOOO ;tr1 ht_offset ht_length alignmentNc#Kt|D]G}|||zz}||tjzdz||} | jj| krC| VHdS)aParses a hashtable quick and dirty. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate ht_offset: Beginning of the hash table ht_length: Length of the hash table Returns: The hash table entries which are _not_ empty pointerrYN)rFr`rrZvolr8) r.r6r7ryrzr{rOindex current_addrcurrent_pointers r/parse_hashtablezNetStat.parse_hashtables,9%% " "E$uy'88L%nn 9>1I=%#-O ")_<<! ! ! ! ! " "r1tcpip_symbol_tabletcpip_module_offsetc #:Ktj||rd}nd}|tjzdz}|j|tjzdzj}|j|tjzdzj} ||tjzdz|||z} ||tjzdz|| } t |j | || zd d } | | j _ td | | |j|d } t'| j D]\}}td ||jjdkrP||||jj|jj||D]!}||||| z }|V"dS)aParses tcpip.sys's PartitionTable containing established TCP connections. The amount of Partition depends on the value of the symbol `PartitionCount` and correlates with the maximum processor count (refer to Art of Memory Forensics, chapter 11). Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate net_symbol_table: The name of the table containing the tcpip types tcpip_symbol_table: The name of the table containing the tcpip driver symbols tcpip_module_offset: The offset of the tcpip module Returns: The list of TCP endpoint objects from the `layer_name` layer's `PartitionTable` rE _TCP_ENDPOINTPartitionTablePartitionCountr}rY_PARTITION_TABLErr<zBFound TCP connection PartitionTable @ 0x{:x} (partition count: {}) ListEntryzParsing partition rN)r symbol_table_is_64bitrrZr[ get_symboladdressr`r=r>r?r@ Partitionscountr^r_formatr\r] enumerate Endpoints NumEntriesr Directory TableSize)r.r6r7rOrrr{rfpart_table_symbolpart_count_symbolpart_table_addr part_table part_count entry_offsetctr partitionendpoint_entryendpoints r/parse_partitionszNetStat.parse_partitionssg.  (2B C C III#in4F#0;;  /2B B   $0;;  /2B B   ".. y~ - 9!&)::)  ^^ y~ -0B B!"$  ^^ N: & + +,?BS,SUV W W   '1 # P W W     +44X>>TT   ( (=>> # #NC LL3c33 4 4 4"-11&)&9&9'1'1$ '' # #N '~~ #-- < .  H #NNNN! # #r1 config_pathtcpip_module_sizectdtj|t j|d|d||S)aDEPRECATED: Use PDBUtility.symbol_table_from_pdb instead Creates symbol table for the current image's tcpip.sys driver. Searches the memory section of the loaded tcpip.sys module for its PDB GUID and loads the associated symbol table into the symbol space. Args: context: The context to retrieve required elements (layers, symbol tables) from config_path: The config path where to find symbol files layer_name: The name of the layer on which to operate tcpip_module_offset: This memory dump's tcpip.sys image offset tcpip_module_size: The size of `tcpip.sys` for this dump Returns: The name of the constructed and loaded symbol table zkDeprecation: This plugin uses netstat.create_tcpip_symbol_table instead of PDBUtility.symbol_table_from_pdbtcpip tcpip.pdb)r^r_rr*symbol_table_from_pdbr configuration path_join)r.r6rr7rrs r/create_tcpip_symbol_tablez!NetStat.create_tcpip_symbol_tableSs_4  y   !77   $ . .{G D D        r1cd|j|jvr|j|tjzdzj}||tjzdz|||z}|j|tjzdzj}||tjzdz|||z} nVd|j|jvr'|j|tjzdzj} |j|tjzdzj} ||tjzdz||| z} ||tjzdz||| z} ||tjzdz|| }|jjj }||tjzdz|| }|jjj } ntj d|d|d t d |d d | d d || fS)aFinds the given image's port pools. Older Windows versions (presumably < Win10 build 14251) use driver symbols called `UdpPortPool` and `TcpPortPool` which point towards the pools. Newer Windows versions use `UdpCompartmentSet` and `TcpCompartmentSet`, which we first have to translate into the port pool address. See also: http://redplait.blogspot.com/2016/06/tcpip-port-pools-in-fresh-windows-10.html Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate net_symbol_table: The name of the table containing the tcpip types tcpip_module_offset: This memory dump's tcpip.sys image offset tcpip_symbol_table: The name of the table containing the tcpip driver symbols Returns: The tuple containing the address of the UDP and TCP port pool respectively. UdpPortPoolr}rY TcpPortPoolUdpCompartmentSetTcpCompartmentSet_INET_COMPARTMENT_SETz3Neither UdpPortPool nor UdpCompartmentSet found in z tablezFound PortPools @ 0xrrz (UDP) && 0xz (TCP))r[r rrrZrr`InetCompartmentProtocolCompartmentPortPoolr SymbolErrorr^r_)r.r6r7rOrr upp_symbolupp_addr tpp_symboltpp_addrucstcs ucs_offset tcs_offsetucs_objtcs_objs r/find_port_poolszNetStat.find_port_poolsys2 G01CDL L L -88"Y^3mC ~~ 9>1I=%*Z7&H !-88"Y^3mC ~~ 9>1I=%*Z7&HH !G$89K$L$T T T&11"Y^36II &11"Y^36II ! 9>1I=%*S0(J ! 9>1I=%*S0(J nn 9>14KK%!%G .BKHnn 9>14KK%!%G .BKHH("`FX```   VHVVVHVVVVWWW!!r1c #K||||||D]}|V||||||\}} ||tjzdz||} |||| jj| jjdz} ||tjzdz|| } |||| jj| jjdz} t d| t d| | D]&}|s| ||||| dD]}|V'| D]&}|s| |||||dD]}|V'dS) a&Lists all UDP Endpoints, TCP Listeners and TCP Endpoints in the primary layer that are in tcpip.sys's UdpPortPool, TcpPortPool and TCP Endpoint partition table, respectively. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbols: The name of the table containing the kernel symbols net_symbol_table: The name of the table containing the tcpip types tcpip_module_offset: Offset of `tcpip.sys`'s PE image in memory tcpip_symbol_table: The name of the table containing the tcpip driver symbols Returns: The list of network objects from the `layer_name` layer's `PartitionTable` and `PortPools` rXrYrEzFound TCP Ports: zFound UDP Ports: rNrUN) rrr`rrZrM PortBitMapBuffer SizeOfBitMapr^r_ro)r.r6r7rprOrrrrrupp_obj udpa_portstpp_obj tcpl_portsrPobjs r/ list_socketszNetStat.list_socketss,4,,          HNNNN!00        (.. y~ -0A A!!   %%     %   +q 0   .. y~ -0A A!!   %%     %   +q 0     555666 555666  D 77%5tXu       D 77%5tXu       r1show_corrupt_resultsc#8 K|jj|jd}tj|j|j|j|j}| |j|j|j}|st d tj |jtj|jd|jd|j|j}n/#t(j$rt dYnwxYw||j|j|j||j|D]F}|s|st1|t2jrtd|jjd|D]\}}} dt?j |jjd|z||j!d dd |"ptGj$|%ptGj$|&ptGj$f fVt1|t2j'rtd |jjd|(t2j)krd } nq|(t2j*krd } nLtd+|jj|(d} |j,j-} n##t\$rtGj$} YnwxYwdt?j |jj| |/ptGj$|j0|1ptGj$|j2| |"ptGj$|%ptGj$|&ptGj$f fVt1|t2j3rtd|jjd|D]\}}} dt?j |jjd|z||j!| dd|"ptGj$|%ptGj$|&ptGj$f fVtd|dti|HdS)z3Generates the network objects for use in rendering.rz >  7 ?)ATU U U U UC! V! Vr1c >|jdd}tjdtjfdt fdt fdtfdt fdtfdt fd tfd t fd tjfg | | S) Nr#rrrrrrrrrr)r) rgetr TreeGridr rstrr=rr)rrs r/runz NetStat.runs#{/@$GG!<+,#c"c"$$# #H-.  OO1EO F F   r1)rN)N)"__name__ __module__ __qualname____doc___required_framework_version_version classmethodr0r5r r6ContextInterfacer r=rAlistrMrobjectsObjectInterfacerorrxrrrrrrrboolrrr r3r1r/rrs{]]"+H  [ <  [ Y#4YY Y  Y YYY[Y*#4  !   [6LL#4LL L  L  L *$4 5LLL[L\#4  *$4 5 [,"#4"" "  "  "" :%5tTA B"""["BN##4N#N# N#  N# ! N# *$4 5N#N#N#[N#`# #4# #  # ! #  #  # # # [# JW"#4W"W" W"  W" ! W" sCxW"W"W"[W"rX#4XX X  X ! X X *$4 5XXX[Xtzzx~zzzzx"V"V"VH     r1r)#rloggingtypingrrrrvolatility3.frameworkrrr r r #volatility3.framework.configurationr volatility3.framework.renderersr %volatility3.framework.symbols.windowsr0volatility3.framework.symbols.windows.extensionsrvolatility3.pluginsrvolatility3.plugins.windowsrrrr getLoggerr r^pluginsPluginInterfaceTimeLinerInterfacerr3r1r/r&s@ 777777777777WWWWWWWWWWWWWW<<<<<<888888999999DDDDDD))))))GGGGGGGGGGGG  8 $ $K  K  K  K  K  j 0)2NK  K  K  K  K  r1