C Sample Exploitation ETL - Revision history

Sam at 11:26, 24 January 2024

2024-01-24T11:26:27Z

Sam: /* Source Code */

2022-10-17T13:03:03Z

Source Code

Sam at 15:09, 3 June 2021

2021-06-03T15:09:59Z

Sam at 15:03, 3 June 2021

2021-06-03T15:03:18Z

Sam at 13:37, 14 May 2021

2021-05-14T13:37:52Z

Sam: Created page with "This sample shows the steps needed to implement a file exploitation ETL in Truxton. =Sample File Format= This sample will exploit a fake file format we call Acme. [https://en..."

2021-04-05T20:36:23Z

Created page with "This sample shows the steps needed to implement a file exploitation ETL in Truxton. =Sample File Format= This sample will exploit a fake file format we call Acme. [https://en..."

New page

This sample shows the steps needed to implement a file exploitation ETL in Truxton.

=Sample File Format=
This sample will exploit a fake file format we call Acme.
[https://en.wikipedia.org/wiki/Acme_Corporation Acme Corporation] is a known supplier of nefarious devices and explosives.
Their file format begins with a five byte [https://en.wikipedia.org/wiki/Magic_number_(programming) magic value] followed by eleven bytes in a data structure.
If the sixth byte in the file is 0x11 then it is a serial number file that uniquely identifies the user.

<pre>
0000h: 88 77 66 55 00 11 22 33 44 55 66 77 88 99 AA BB
0010h: CC
</pre>

=Source Code=
<source lang="C">
#include <stdio.h>
#include <memory.h>
#include <inttypes.h>
#include <TruxtonCAPI.h>
#include <TruxtonFileTypes.h>
#include <TruxtonDefines.h>
#pragma comment (lib, "TruxtonCAPI.lib")

int main(void)
{
uint8_t buffer[20];

uint64_t message = 0;

uint64_t etl_application = truxton_etl_create();

truxton_etl_set_application_name(etl_application, "My File Exploiter");
truxton_etl_set_description(etl_application, "Exploitation ETL for new file type");
truxton_etl_set_queue_name(etl_application, "mef");
truxton_etl_set_stage_number(etl_application, 2);

truxton_etl_add_desired_file_type(etl_application, 11111);

//truxton_etl_send_me_file_id(etl_application, "6068992f-af6b-06b8-28ce-094b0000000d");

message = truxton_etl_get_message(etl_application);

while (message != 0)
{
// Do something with the message
uint64_t file_in_truxton = truxton_message_get_file(message);

if (file_in_truxton != 0)
{
truxton_file_seek(file_in_truxton, 5, SEEK_SET);

if (truxton_file_read(file_in_truxton, buffer, 1) == 1)
{
if (buffer[0] == 0x11)
{
// Serial Number. The next 8 bytes are a serial number
truxton_file_seek(file_in_truxton, 6, SEEK_SET);

if (truxton_file_read(file_in_truxton, buffer, 8) == 8)
{
char serial_number_string[32];

uint64_t artifact = truxton_file_create_artifact(file_in_truxton);
truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);

sprintf_s(serial_number_string, sizeof(serial_number_string), "%02X%02X%02X%02X%02X%02X%02X%02X",
(int)buffer[0], (int)buffer[1], (int)buffer[2], (int)buffer[3],
(int)buffer[4], (int)buffer[5], (int)buffer[6], (int)buffer[7]);
truxton_artifact_set_value(artifact, serial_number_string);
truxton_artifact_set_data_type(artifact, DATA_TYPE_uint8_t);
truxton_artifact_set_offset(artifact, 6);
truxton_artifact_set_length(artifact, 8);

if (truxton_artifact_save(artifact) == 0)
{
printf("Cannot save artifact to the database.\n");
}

truxton_artifact_destroy(artifact);
}
}
}

truxton_file_free(file_in_truxton);
}

truxton_message_destroy(message);

// Pause here until we get another message from the "mef" message queue
message = truxton_etl_get_message(etl_application);
}

truxton_etl_destroy(etl_application);
return(0);
}
</source>

@@ Line 36: / Line 36: @@
    truxton_etl_set_stage_number(etl_application, 40);
    truxton_etl_add_desired_file_type(etl_application, 11111);
    message = truxton_etl_get_message(etl_application);
@@ Line 97: / Line 95: @@
 =Code Walkthrough=
-Lines 7-12 setup the ETL. The message queue name will be "acme", we are an early stage and want to receive Acme files (11000 was chosen as the identifier of Acme files).
+Lines 17-21 setup the ETL. The message queue name will be "acme", we are an early stage and want to receive Acme files (11111 was chosen as the identifier of Acme files).
-Line 14 starts the ETL logic and waits until a message arrives on the "wiley" queue.
+Line 23 starts the ETL logic and waits until a message arrives on the "wiley" queue.
-Line 17 opens the file so we can read from it.
+Line 28 opens the file so we can read from it.
-Lines 21-22 read the fifth byte in the file and checks it for validity.
+Lines 32-36 read the sixth byte in the file and checks it for validity.
-Lines 27-33 creates an artifact (which will be stored in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database) and saves it to Truxton.
+Lines 45-56 creates an artifact (which will be stored in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database) and saves it to Truxton.
-Line 28 sets the [[Entity Types|type of artifact]] to a serial number.
+Line 46 sets the [[Entity Types|type of artifact]] to a serial number.
 This allows analysts to quickly find items of interest by their type.
-Line 30 stores the [[DATA_TYPE|format]] of how the serial number was stored in the file.
+Line 52 stores the [[DATA_TYPE|format]] of how the serial number was stored in the file.
-Line 33 saves the data to Truxton.
+Line 56 saves the data to Truxton.
 It will create a record in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database.
 Saving the artifact will cause Truxton to route it to any ETL that has subscribed to <code>[[Type_Artifact]]</code> messages.
-Line 36 pauses your ETL until a new message arrives on it queue
+Line 72 pauses your ETL until a new message arrives on it queue

← Older revision		Revision as of 13:37, 14 May 2021
Line 1:		Line 1:
	This sample shows the steps needed to implement a file exploitation ETL in Truxton.		This sample shows the steps needed to implement a file exploitation ETL in Truxton.
		+	You can see this same sample implemented in [[Python Sample Exploitation ETL\|Python]].

	=Sample File Format=		=Sample File Format=

@@ Line 1: / Line 1: @@
 This sample shows the steps needed to implement a file exploitation ETL in Truxton.
 You can see this same sample implemented in [[Python Sample Exploitation ETL|Python]].
 =Sample File Format=

@@ Line 85: / Line 85: @@
      truxton_message_destroy(message);
-     // Pause here until we get another message from the "mef" message queue
+     // Pause here until we get another message from the "wiley" message queue
      message = truxton_etl_get_message(etl_application);
+   }

@@ Line 14: / Line 14: @@
 =Source Code=
-<source lang="C">
+<source line lang="C">
 #include <stdio.h>
 #include <memory.h>
@@ Line 31: / Line 31: @@
    uint64_t etl_application = truxton_etl_create();
-   truxton_etl_set_application_name(etl_application, "My File Exploiter");
+   truxton_etl_set_application_name(etl_application, "Acme Exploitation");
-   truxton_etl_set_description(etl_application, "Exploitation ETL for new file type");
+   truxton_etl_set_description(etl_application, "This exploits Acme Corporation data files");
-   truxton_etl_set_queue_name(etl_application, "mef");
+   truxton_etl_set_queue_name(etl_application, "wiley");
-   truxton_etl_set_stage_number(etl_application, 2);
+   truxton_etl_set_stage_number(etl_application, 40);
    truxton_etl_add_desired_file_type(etl_application, 11111);
@@ Line 96: / Line 95: @@
+}
 </source>