Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Standardize outputs of DeviceRedirectionMITM and FileCrawlerMITM #270

Closed
xshill opened this issue Nov 27, 2020 · 3 comments
Closed

Standardize outputs of DeviceRedirectionMITM and FileCrawlerMITM #270

xshill opened this issue Nov 27, 2020 · 3 comments
Assignees
Labels
enhancement New feature or request refactor

Comments

@xshill
Copy link
Collaborator

xshill commented Nov 27, 2020

Instead of being in pyrdp_output/files, they should be in pyrdp_output/crawler to make it easier to differentiate which files were intercepted and which files were crawled.

@xshill xshill self-assigned this Nov 27, 2020
@xshill xshill changed the title Move crawled filesystems to their own folder Standardize outputs of DeviceRedirectionMITM and FileCrawlerMITM Nov 27, 2020
@xshill
Copy link
Collaborator Author

xshill commented Nov 27, 2020

On second thought, it would be much nicer to have a unified system for both components. Essentially:

  • Both DeviceRedirectionMITM and FileCrawler should recreate the victim's filesystem in pyrdp_output/filesystems/
  • Actual files should be written in pyrdp_output/files/ and renamed to the sha1 hash of their contents
  • Files in filesystems/ should only link to the corresponding file in files/. On Windows, this could be a .lnk file or just a text file containing the path or the hash of the file (e.g: virus.exe would actually be called virus.exe.txt, it's content would be [pyrdp_output_path]/files/sha1(virus.exe)).
  • All files should be logged in pyrdp_output/mapping.json (this implies changing the path attributes to arrays)

@xshill
Copy link
Collaborator Author

xshill commented Nov 27, 2020

One more note about mapping.json, we don't really need the remote_path attribute anymore since the filesystem is recreated. We can just have an array of local_paths were each file was saved.

@xshill
Copy link
Collaborator Author

xshill commented Dec 22, 2020

Actually I removed the mapping.json file since all the information from it can be gathered elsewhere and it makes the code much simpler.

@xshill xshill mentioned this issue Dec 23, 2020
@xshill xshill closed this as completed Jan 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request refactor
Projects
None yet
Development

No branches or pull requests

1 participant