Difference between revisions of "Python Sample Exploitation ETL"
Jump to navigation
Jump to search
(Created page with "<syntaxhighlight line lang="python"> import truxton def main(): etl = truxton.etl() etl.name = "My New ETL" etl.description = "This ETL processes files in the Tr...") |
|||
| Line 4: | Line 4: | ||
def main(): | def main(): | ||
| − | + | etl = truxton.etl() | |
| − | + | etl.name = "Acme Exploitation" | |
| − | + | etl.description = "This exploits Acme Corporation data files" | |
| − | + | etl.queue = "wiley" | |
| − | + | etl.stage = 40 | |
| − | + | etl.id = 354376 | |
| + | etl.addtype(10111) | ||
| − | + | message = etl.getmessage() | |
| − | + | while message is not None: | |
| − | + | file_in_truxton = message.file() | |
| − | |||
| − | |||
| − | + | file_in_truxton.seek(5) | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | if file_in_truxton.read(1) == 0x11: | |
| + | # Serial Number. The next 8 bytes are a serial number | ||
| + | file_in_truxton.seek(6) | ||
| + | serial_number = file_in_truxton.read(8) | ||
| + | artifact = file_in_truxton.newartifact() | ||
| + | artifact.type = truxton.ENTITY_TYPE_SERIAL_NUMBER | ||
| + | artifact.value = serial_number.hex() | ||
| + | artifact.datatype = truxton.DATA_TYPE_uint8_t | ||
| + | artifact.offset = 6 | ||
| + | artifact.length = 8 | ||
| + | artifact.save() | ||
| + | |||
| + | message = etl.getmessage() | ||
if __name__ == "__main__": | if __name__ == "__main__": | ||
main() | main() | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 16:37, 12 June 2020
1 import truxton
2
3 def main():
4
5 etl = truxton.etl()
6 etl.name = "Acme Exploitation"
7 etl.description = "This exploits Acme Corporation data files"
8 etl.queue = "wiley"
9 etl.stage = 40
10 etl.id = 354376
11 etl.addtype(10111)
12
13 message = etl.getmessage()
14
15 while message is not None:
16 file_in_truxton = message.file()
17
18 file_in_truxton.seek(5)
19
20 if file_in_truxton.read(1) == 0x11:
21 # Serial Number. The next 8 bytes are a serial number
22 file_in_truxton.seek(6)
23 serial_number = file_in_truxton.read(8)
24
25 artifact = file_in_truxton.newartifact()
26 artifact.type = truxton.ENTITY_TYPE_SERIAL_NUMBER
27 artifact.value = serial_number.hex()
28 artifact.datatype = truxton.DATA_TYPE_uint8_t
29 artifact.offset = 6
30 artifact.length = 8
31 artifact.save()
32
33 message = etl.getmessage()
34
35 if __name__ == "__main__":
36 main()
