Package modules :: Package packages :: Module ps1
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.ps1

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.common.abstracts import Package 
 8  from lib.api.process import Process 
 9  from lib.common.exceptions import CuckooPackageError 
10   
11  # Originally proposed by David Maciejak. 
12   
13 -class PS1(Package):
14 """PowerShell analysis package.""" 15
16 - def get_path(self):
17 paths = [ 18 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v1.0", "powershell.exe"), 19 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v2.0", "powershell.exe"), 20 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v3.0", "powershell.exe") 21 ] 22 23 for path in paths: 24 if os.path.exists(path): 25 return path 26 27 return None
28
29 - def start(self, path):
30 powershell = self.get_path() 31 if not powershell: 32 raise CuckooPackageError("Unable to find any PowerShell executable available") 33 34 dll = self.options.get("dll", None) 35 free = self.options.get("free", False) 36 suspended = True 37 if free: 38 suspended = False 39 40 args = "-NoProfile -ExecutionPolicy unrestricted -File \"{0}\"".format(path) 41 42 p = Process() 43 if not p.execute(path=powershell, args=args, suspended=suspended): 44 raise CuckooPackageError("Unable to execute initial PowerShell process, analysis aborted") 45 46 if not free and suspended: 47 p.inject(dll) 48 p.resume() 49 return p.pid 50 else: 51 return None
52
53 - def check(self):
54 return True
55
56 - def finish(self):
57 if self.options.get("procmemdump", False): 58 for pid in self.pids: 59 p = Process(pid=pid) 60 p.dump_memory() 61 62 return True
63