plaso-rubanetra/plaso/formatters/rubanetra.py
2020-04-06 18:48:34 +02:00

423 lines
20 KiB
Python
Executable File

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Copyright 2014 The Plaso Project Authors.
# Please see the AUTHORS file for details on individual authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""This file contains formatters for the parsed Rubanetra events. Additionally, a Java Instant formatter was defined
as well."""
from plaso.formatters import interface
__author__ = 'Stefan Swerk (stefan_rubanetra@swerk.priv.at)'
class RubanetraBaseActivityFormatter(interface.ConditionalEventFormatter):
""" Formatter for a Rubanetra BaseActivity """
DATA_TYPE = 'java:rubanetra:base_activity'
SOURCE_SHORT = 'LOG'
SOURCE_LONG = 'at.jku.fim.rubanetra.BaseActivity'
FORMAT_STRING_PIECES = [
u'activityType: \'{activity_type}\'',
u'firstTimestamp: \'{first_timestamp}\'',
u'lastTimestamp: \'{last_timestamp}\'',
u'description: \'{description}\'',
u'sourceAddress: \'{source_address}\'',
u'destinationAddress: \'{destination_address}\'',
u'compoundFrameNumbers: \'{compound_frame_number_list}\'',
u'isReplaced: \'{replaced}\'',
u'optionalFields: \'{optional_field_dict}\'']
class RubanetraPcapActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:pcap_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.PcapActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES \
+ [u'totalSize: \'{pcap_total_size}\'',
u'frameNumber: \'{pcap_frame_number}\'',
u'wireLength: \'{pcap_packet_wirelen}\'',
u'headerCount: \'{pcap_header_count}\'']
class RubanetraHttpRequestActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:http_request_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.HttpRequestActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'serverAddress: \'{server_address}\'',
u'clientAddress: \'{client_address}\'',
u'httpVersion: \'{http_version}\'',
u'httpMethod: \'{http_method}\'',
u'httpQueryString: \'{http_query_string}\'',
u'httpQueryParameters: \'{http_query_parameters}\'',
u'httpRequestHeader: \'{http_request_header_dict}\'',
u'url: \'{url}\'',
u'originalHttpHeader: \'{orig_http_header}\'',
u'contentType: \'{content_type}\'',
u'isResponse: \'{is_response}\'',
u'JNetPcapHttpString: \'{jnetpcap_http_string}\'']
class RubanetraHttpResponseActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:http_response_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.HttpResponseActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'httpVersion: \'{http_version}\'',
u'httpStatusCode: \'{response_status_code}\'',
u'httpStatusLine: \'{response_status_line}\'',
u'httpResponseHeader: \'{response_header_dict}\'',
u'originalHttpHeader: \'{orig_http_header}\'',
u'contentType: \'{content_type}\'',
u'JNetPcapHttpString: \'{jnetpcap_http_string}\'']
class RubanetraDnsActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:dns_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.DnsActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'questionRecords: \'{question_record_list}\'',
u'answerRecords: \'{answer_record_list}\'',
u'authorityRecords: \'{authority_record_list}\'',
u'additionalRecords: \'{additional_record_list}\'',
u'dnsMessageHeader: \'{dns_message_header}\'',
u'isResponse: \'{is_response_bool}\'']
class RubanetraHttpImageActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:http_image_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.HttpImageActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'imageType: \'{image_type}\'',
u'imagePath: \'{image_path}\'']
class RubanetraArpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:arp_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.ArpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'hardwareType: \'{hardware_type}\'',
u'protocolType: \'{protocol_type}\'',
u'hardwareAddressLength: \'{hardware_address_length}\'',
u'protocolAddressLength: \'{protocol_address_length}\'',
u'senderHardwareAddress: \'{sender_mac_address}\'',
u'targetHardwareAddress: \'{target_mac_address}\'',
u'senderProtocolAddress: \'{sender_protocol_address}\'',
u'targetProtocolAddress: \'{target_protocol_address}\'',
u'JNetPcapArpString: \'{jnetpcap_arp}\'']
class RubanetraDhcpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:dhcp_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.DhcpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'dhcpMessage: \'{dhcp_message}\'']
class RubanetraEthernetActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:ethernet_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.EthernetActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'sourceMacAddress: \'{source_mac_address}\'',
u'destinationMacAddress: \'{destination_mac_address}\'',
u'ethernetType: \'{ethernet_type}\'',
u'ethernetTypeEnum: \'{ethernet_type_enum}\'',
u'JNetPcapEthernetString: \'{jnetpcap_ethernet}\'']
class RubanetraFtpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:ftp_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.FtpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'ftpActivityType: \'{ftp_type}\'',
u'command: \'{command}\'',
u'reply: \'{reply}\'',
u'list: \'{list}\'']
class RubanetraIcmpv4ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:icmpv4_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Icmpv4Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'icmpSubType: \'{icmp_subtype}\'',
u'icmpPacket: \'{icmp_packet}\'',
u'icmpMessage: \'{icmp_message}\'',
u'icmpType: \'{icmp_type}\'',
u'icmpCode: \'{icmp_code}\'',
u'sourceAddress: \'{source_address}\'',
u'destinationAddress: \'{destination_address}\'',
u'identifier: \'{identifier}\'',
u'sequence: \'{sequence}\'',
u'JNetPcapIcmpString: \'{jnetpcap_icmp}\'']
class RubanetraIcmpv6ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:icmpv6_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Icmpv6Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'icmpSubType: \'{icmp_subtype}\'',
u'icmpPacket: \'{icmp_packet}\'',
u'icmpMessage: \'{icmp_message}\'',
u'icmpType: \'{icmp_type}\'',
u'JNetPcapIcmpString: \'{jnetpcap_icmp}\'']
class RubanetraIpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:ip_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.IpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'version: \'{version}\'',
u'protocol: \'{protocol}\'',
u'sourceAddress: \'{source_address}\'',
u'destinationAddress: \'{destination_address}\'']
class RubanetraIpv4ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:ipv4_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Ipv4Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'internetHeaderLength: \'{internet_header_length}\'',
u'differentiatedServicesCodePoint: \'{differentiated_services_code_point}\'',
u'totalLength: \'{total_length}\'',
u'identification: \'{identification}\'',
u'flags: \'{flags}\'',
u'fragmentOffset: \'{fragment_offset}\'',
u'timeToLive: \'{time_to_live}\'',
u'headerChecksum: \'{header_checksum}\'',
u'options: \'{options}\'',
u'JNetPcapIpv4String: \'{jnetpcap_ip4}\'']
class RubanetraIpv6ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:ipv6_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Ipv6Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'trafficClass: \'{traffic_class}\'',
u'flowLabel: \'{flow_label}\'',
u'payloadLength: \'{payload_length}\'',
u'nextHeader: \'{next_header}\'',
u'hopLimit: \'{hop_limit}\'',
u'JNetPcapIpv6String: \'{jnetpcap_ip6}\'',
u'KrakenIpv6String: \'{kraken_ip6}\'']
class RubanetraMsnActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:msn_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.MsnActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'account: \'{account}\'',
u'chat: \'{chat}\'']
class RubanetraNetbiosActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:Netbios_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.NetbiosActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'datagramPacket: \'{datagram_packet}\'',
u'namePacket: \'{name_packet}\'']
class RubanetraPop3ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:pop3_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Pop3Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'subType: \'{sub_type}\'',
u'header: \'{header}\'',
u'data: \'{data}\'',
u'command: \'{command}\'',
u'response: \'{response}\'']
class RubanetraSmtpCommandActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:smtp_command_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.SmtpCommandActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'command: \'{command}\'',
u'parameter: \'{parameter}\'']
class RubanetraSmtpReplyActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:smtp_reply_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.SmtpReplyActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'code: \'{code}\'',
u'message: \'{message}\'']
class RubanetraSmtpSendActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:smtp_send_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.SmtpSendActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'header: \'{header}\'',
u'data: \'{data}\'']
class RubanetraSnmpv1ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:snmpv1_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Snmpv1Activity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'pdu: \'{pdu}\'',
u'sourceSocketAddress: \'{source_socket_address}\'',
u'destinationSocketAddress: \'{destination_socket_address}\'']
class RubanetraSnmpv2ActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:snmpv2_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.Snmpv2Activity'
FORMAT_STRING_PIECES = RubanetraSnmpv1ActivityFormatter.FORMAT_STRING_PIECES
class RubanetraTcpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:tcp_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.TcpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'sourcePort: \'{source_port}\'',
u'destinationPort: \'{destination_port}\'',
u'sequenceNumber: \'{sequence_number}\'',
u'acknowledgeNumber: \'{acknowledge_number}\'',
u'relativeSequenceNumber: \'{relative_sequence_number}\'',
u'relativeAcknowledgeNumber: \'{relative_acknowledge_number}\'',
u'dataOffset: \'{data_offset}\'',
u'controlBits: \'{control_bits}\'',
u'windowSize: \'{window_size}\'',
u'checksum: \'{checksum}\'',
u'urgentPointer: \'{urgent_pointer}\'',
u'tcpLength: \'{tcp_length}\'',
u'options: \'{options}\'',
u'padding: \'{padding}\'',
u'syn: \'{syn}\'',
u'ack: \'{ack}\'',
u'psh: \'{psh}\'',
u'fin: \'{fin}\'',
u'rst: \'{rst}\'',
u'urg: \'{urg}\'',
u'direction: \'{direction}\'',
u'clientState: \'{client_state}\'',
u'serverState: \'{server_state}\'',
u'JNetPcapTcpString: \'{jnetpcap_tcp}\'',
u'sourceAddress: \'{source_address}\'',
u'destinationAddress: \'{destination_address}\'',
u'sourceSocketAddress: \'{source_socket_address}\'',
u'destinationSocketAddress: \'{destination_socket_address}\'']
class RubanetraTelnetActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:telnet_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.TelnetActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'subType: \'{sub_type}\'',
u'command: \'{command}\'',
u'option: \'{option}\'',
u'ansiMode: \'{ansi_mode}\'',
u'arguments: \'{arguments}\'',
u'text: \'{text}\'',
u'title: \'{title}\'']
class RubanetraTlsActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:tls_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.TlsActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'clientToServerTraffic: \'{client_to_server_traffic}\'',
u'serverToClientTraffic: \'{server_to_client_traffic}\'']
class RubanetraUdpActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:udp_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.UdpActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'sourcePort: \'{source_port}\'',
u'destinationPort: \'{destination_port}\'',
u'length: \'{length}\'',
u'checksum: \'{checksum}\'',
u'JNetPcapUdpString: \'{jnetpcap_udp}\'',
u'sourceSocketAddress: \'{source_socket_address}\'',
u'destinationSocketAddress: \'{destination_socket_address}\'']
class RubanetraOpenSSHActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:open_ssh_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.OpenSSHActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'clientToServerTraffic: \'{client_to_server_traffic}\'',
u'serverToClientTraffic: \'{server_to_client_traffic}\'']
class RubanetraDropboxTlsActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:dropbox_tls_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.DropboxActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'clientAddress: \'{client_address}\'',
u'serverAddress: \'{server_address}\'']
class RubanetraSpiderOakActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:spideroak_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.SpiderOakActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'clientAddress: \'{client_address}\'',
u'serverAddress: \'{server_address}\'']
class RubanetraSkypePayloadActivityFormatter(RubanetraBaseActivityFormatter):
DATA_TYPE = 'java:rubanetra:skype_payload_activity'
SOURCE_LONG = 'at.jku.fim.rubanetra.SkypePayloadActivity'
FORMAT_STRING_PIECES = RubanetraBaseActivityFormatter.FORMAT_STRING_PIECES + \
[u'sourceObjectId: \'{source_object_id}\'',
u'destinationObjectId: \'{destination_object_id}\'',
u'sourceHost: \'{source_host}\'',
u'destinationHost: \'{destination_host}\'']
class JavaInstantFormatter(interface.EventFormatter):
""" Formatter for a Java Instant """
DATA_TYPE = 'java:time:Instant'
SOURCE_SHORT = 'JAVA'
SOURCE_LONG = 'java.time.Instant'
FORMAT_STRING = (
u'epoch_seconds: \'{instant_epoch_seconds}, nano: \'{instant_nano}\'')
FORMAT_STRING_SHORT = (u'{instant_epoch_seconds}.{instant_nano}\'')