Package modules :: Package auxiliary :: Module recentfiles
[hide private]
[frames] | no frames]

Source Code for Module modules.auxiliary.recentfiles

 1  # Copyright (C) 2016 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import logging 
 6  import os 
 7  import random 
 8   
 9  from lib.common.abstracts import Auxiliary 
10  from lib.common.defines import SHELL32, SHARD_PATHA 
11  from lib.common.exceptions import CuckooError 
12  from lib.common.rand import random_string 
13  from lib.common.registry import set_regkey_full 
14   
15  log = logging.getLogger(__name__) 
16   
17 -class RecentFiles(Auxiliary):
18 """Populates the Desktop with recent files in order to combat recent 19 anti-sandbox measures.""" 20 21 extensions = [ 22 "txt", "rtf", "doc", "docx", "docm", "ppt", "pptx", 23 ] 24
25 - def start(self):
26 if "USERPROFILE" not in os.environ: 27 raise CuckooError( 28 "Unable to populate recent files as the USERPROFILE " 29 "environment variable is missing." 30 ) 31 32 desktop = os.path.join(os.environ["USERPROFILE"], "Desktop") 33 34 for idx in xrange(random.randint(5, 10)): 35 filename = random_string(10, random.randint(10, 20)) 36 ext = random.choice(self.extensions) 37 filepath = os.path.join(desktop, "%s.%s" % (filename, ext)) 38 open(filepath, "wb").write(os.urandom(random.randint(30, 999999))) 39 40 SHELL32.SHAddToRecentDocs(SHARD_PATHA, filepath) 41 42 set_regkey_full( 43 "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\12.0\\" 44 "Word\\File MRU\\Item %d" % (idx + 1), 45 "REG_SZ", "[F00000000][T01D1C40000000000]*%s" % filepath, 46 )
47