Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
82 lines (63 sloc) 2.82 KB
class Module:
def __init__(self, mainMenu, params=[]):
# metadata info about the module, not modified during runtime
self.info = {
# name for the module that will appear in module menus
'Name': 'SearchEmail',
# list of one or more authors for the module
'Author': ['@harmj0y'],
# more verbose multi-line description of the module
'Description': ("Searches for Mail .emlx messages, optionally only returning "
"messages with the specified SeachTerm."),
# True if the module needs to run in the background
'Background' : False,
# File extension to save the file as
'OutputExtension' : "",
# if the module needs administrative privileges
'NeedsAdmin' : False,
# True if the method doesn't touch disk/is reasonably opsec safe
'OpsecSafe' : True,
# list of any references/other comments
'Comments': [
"https://davidkoepi.wordpress.com/2013/07/06/macforensics5/"
]
}
# any options needed by the module, settable during runtime
self.options = {
# format:
# value_name : {description, required, default_value}
'Agent' : {
# The 'Agent' option is the only one that MUST be in a module
'Description' : 'Agent to execute module on.',
'Required' : True,
'Value' : ''
},
'SearchTerm' : {
# The 'Agent' option is the only one that MUST be in a module
'Description' : "Term to grep for in email messages.",
'Required' : False,
'Value' : ''
}
}
# save off a copy of the mainMenu object to access external functionality
# like listeners/agent handlers/etc.
self.mainMenu = mainMenu
# During instantiation, any settable option parameters
# are passed as an object set to the module and the
# options dictionary is automatically set. This is mostly
# in case options are passed on the command line
if params:
for param in params:
# parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self):
searchTerm = self.options['SearchTerm']['Value']
script = "cmd = \"find /Users/ -name *.emlx 2>/dev/null"
if searchTerm != "":
script += "|xargs grep -i '"+searchTerm+"'\""
else:
script += "\""
script += "\nrun_command(cmd)"
return script
You can’t perform that action at this time.