diff --git a/detect_doublepulsar_rdp.py b/detect_doublepulsar_rdp.py index 55f3867..2034150 100644 --- a/detect_doublepulsar_rdp.py +++ b/detect_doublepulsar_rdp.py @@ -5,7 +5,8 @@ import argparse import threading import ssl - +import logging +import logging.handlers # Packets ssl_negotiation_request = binascii.unhexlify("030000130ee000000000000100080001000000") @@ -34,12 +35,24 @@ semaphore = threading.BoundedSemaphore(value=num_threads) print_lock = threading.Lock() +logging.captureWarnings(True) +logger = logging.getLogger('DOUBLEPULSAR RDP') +logger.setLevel(logging.DEBUG) +fileHandler = logging.handlers.RotatingFileHandler('doublepulsar_rdp.log', maxBytes=2000000, backupCount=5) +formatter = logging.Formatter('[%(asctime)s][%(name)s][%(levelname)s] %(message)s') +fileHandler.setFormatter(formatter) +logger.addHandler(fileHandler) + +# log console handler +consoleHandler = logging.StreamHandler() +consoleHandler.setFormatter(formatter) +logger.addHandler(consoleHandler) def print_status(ip, message): global print_lock with print_lock: - print "[*] [%s] %s" % (ip, message) + logger.info("[%s] %s" % (ip, message)) def check_ip(ip): @@ -91,7 +104,7 @@ def check_ip(ip): # Server requires NLA which implant does not support elif len(negotiation_response) >= 19 and negotiation_response[11] == "\x03" and negotiation_response[15] == "\x05": with print_lock: - print "[-] [%s] Server requires NLA, which DOUBLEPULSAR does not support" % ip + logger.info("[%s] Server requires NLA, which DOUBLEPULSAR does not support" % ip) s.close() return @@ -115,13 +128,13 @@ def check_ip(ip): with print_lock: if len(ping_response) == 288: - print "[+] [%s] DOUBLEPULSAR RDP IMPLANT DETECTED!!!" % ip + logger.info("[%s] DOUBLEPULSAR RDP IMPLANT DETECTED!!!" % ip) else: - print "[-] [%s] Status Unknown - Response received but length was %d not 288" % (ip, len(ping_response)) + logger.info("[%s] Status Unknown - Response received but length was %d not 288" % (ip, len(ping_response))) s.close() except socket.error as e: with print_lock: - print "[-] [%s] No presence of DOUBLEPULSAR RDP implant" % ip + logger.info("[%s] No presence of DOUBLEPULSAR RDP implant" % ip) def threaded_check(ip_address): @@ -131,7 +144,7 @@ def threaded_check(ip_address): check_ip(ip_address) except Exception as e: with print_lock: - print "[ERROR] [%s] - %s" % (ip_address, e) + logger.error("[%s] - %s" % (ip_address, e)) finally: semaphore.release() diff --git a/detect_doublepulsar_smb.py b/detect_doublepulsar_smb.py index d0dded5..83711c4 100755 --- a/detect_doublepulsar_smb.py +++ b/detect_doublepulsar_smb.py @@ -5,7 +5,8 @@ import argparse import struct import threading - +import logging +import logging.handlers # Packets negotiate_protocol_request = binascii.unhexlify("00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200") @@ -35,6 +36,18 @@ semaphore = threading.BoundedSemaphore(value=num_threads) print_lock = threading.Lock() +logging.captureWarnings(True) +logger = logging.getLogger('DOUBLEPULSAR SMB') +logger.setLevel(logging.DEBUG) +fileHandler = logging.handlers.RotatingFileHandler('doublepulsar_smb.log', maxBytes=2000000, backupCount=5) +formatter = logging.Formatter('[%(asctime)s][%(name)s][%(levelname)s] %(message)s') +fileHandler.setFormatter(formatter) +logger.addHandler(fileHandler) + +# log console handler +consoleHandler = logging.StreamHandler() +consoleHandler.setFormatter(formatter) +logger.addHandler(consoleHandler) def calculate_doublepulsar_xor_key(s): x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8))) @@ -46,7 +59,7 @@ def print_status(ip, message): global print_lock with print_lock: - print "[*] [%s] %s" % (ip, message) + logger.info("[%s] %s" % (ip, message)) def check_ip(ip): @@ -113,7 +126,8 @@ def check_ip(ip): signature_long = struct.unpack('