From 537f9132f518fc702eecc0adb03ce7cbeda9c446 Mon Sep 17 00:00:00 2001 From: milkmix Date: Mon, 24 Dec 2018 16:40:31 +0100 Subject: [PATCH] support for md5 and sha1 hashes --- .../modules/export_mod/nexthinkexport.py | 27 ++++++++++++------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/misp_modules/modules/export_mod/nexthinkexport.py b/misp_modules/modules/export_mod/nexthinkexport.py index 92af800..ee05923 100755 --- a/misp_modules/modules/export_mod/nexthinkexport.py +++ b/misp_modules/modules/export_mod/nexthinkexport.py @@ -10,7 +10,7 @@ import re misperrors = {"error": "Error"} -types_to_use = ['sha1'] +types_to_use = ['sha1', 'md5'] userConfig = { @@ -29,16 +29,26 @@ moduleinfo = {'version': '1.0', 'author': 'Julien Bachmann, Hacknowledge', def handle_sha1(value, period): - return ''' - (select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time))) - (from (binary user device execution) - (where binary (eq hash (sha1 %s)))) - (between now-%s now) - (limit 1000)) + query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time))) +(from (binary user device execution) +(where binary (eq sha1 (sha1 %s))) +(between now-%s now)) +(limit 1000) ''' % (value, period) + return query.replace('\n', ' ') + +def handle_md5(value, period): + query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time))) +(from (binary user device execution) +(where binary (eq hash (md5 %s))) +(between now-%s now)) +(limit 1000) + ''' % (value, period) + return query.replace('\n', ' ') handlers = { - 'sha1': handle_sha1 + 'sha1': handle_sha1, + 'md5': handle_md5 } def handler(q=False): @@ -56,7 +66,6 @@ def handler(q=False): r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')} return r - def introspection(): modulesetup = {} try: