infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Moved antivirusproduct to situational_awareness/host/antivirusproduct , 

added ComputerName option, output pipeline fix.
1.6
Harmj0y 2015-10-30 13:39:25 -04:00
parent 59aa123d88
commit 581c9aa948
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/modules/collection/antivirusproduct.py → lib/modules/situational_awareness/host/antivirusproduct.py
View File

@ -9,9 +9,9 @@ class Module:
'Author': ['@mh4x0f', 'Jan Egil Ring'], 'Author': ['@mh4x0f', 'Jan Egil Ring'],
'Description': ('get antivirus product information.'), 'Description': ('Get antivirus product information.'),
'Background' : False, 'Background' : True,
'OutputExtension' : None, 'OutputExtension' : None,
@ -34,6 +34,11 @@ class Module:
'Description' : 'Agent to run module on.', 'Description' : 'Agent to run module on.',
'Required' : True, 'Required' : True,
'Value' : '' 'Value' : ''
},
'ComputerName' : {
'Description' : 'Computername to run the module on, defaults to localhost.',
'Required' : True,
'Value' : ''
} }
} }
@ -56,9 +61,9 @@ function Get-AntiVirusProduct {
param ( param (
[parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
[Alias('name')] [Alias('name')]
$computername=$env:computername ) $ComputerName=$env:computername )
$Query = 'select * from AntiVirusProduct' $Query = 'select * from AntiVirusProduct'
$AntivirusProduct = Get-WmiObject -Namespace 'root\SecurityCenter2' -Query $Query @psboundparameters # -ErrorVariable myError -ErrorAction 'SilentlyContinue' $AntivirusProduct = Get-WmiObject -Namespace 'root\SecurityCenter2' -Query $Query @psboundparameters -ErrorVariable myError -ErrorAction 'SilentlyContinue'
switch ($AntiVirusProduct.productState) { switch ($AntiVirusProduct.productState) {
'262144' {$defstatus = 'Up to date' ;$rtstatus = 'Disabled'} '262144' {$defstatus = 'Up to date' ;$rtstatus = 'Disabled'}
'262160' {$defstatus = 'Out of date' ;$rtstatus = 'Disabled'} '262160' {$defstatus = 'Out of date' ;$rtstatus = 'Disabled'}
@ -73,13 +78,14 @@ function Get-AntiVirusProduct {
default {$defstatus = 'Unknown' ;$rtstatus = 'Unknown'} default {$defstatus = 'Unknown' ;$rtstatus = 'Unknown'}
} }
$ht = @{} $ht = @{}
$ht.Computername = $computername $ht.Computername = $ComputerName
$ht.Name = $AntiVirusProduct.displayName $ht.Name = $AntiVirusProduct.displayName
$ht.ProductExecutable = $AntiVirusProduct.pathToSignedProductExe $ht.ProductExecutable = $AntiVirusProduct.pathToSignedProductExe
$ht.'Definition Status' = $defstatus $ht.'Definition Status' = $defstatus
$ht.'Real-time Protection Status' = $rtstatus $ht.'Real-time Protection Status' = $rtstatus
New-Object -TypeName PSObject -Property $ht New-Object -TypeName PSObject -Property $ht
} }
Get-AntiVirusProduct """ Get-AntiVirusProduct """
for option,values in self.options.iteritems(): for option,values in self.options.iteritems():
@ -91,4 +97,6 @@ Get-AntiVirusProduct """
else: else:
script += " -" + str(option) + " " + str(values['Value']) script += " -" + str(option) + " " + str(values['Value'])
script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(self.info["Name"])+' completed!";'
return script return script