TruxtonETL

This class provides capability to participate in Truxton's ETL pipeline. You can implement your own form of file exploitation. You can subscribe to events...

Attributes and Methods

addarg(argument)

This is used to build the command line arguments for the process. Truxton will automatically parse the command line for you but this allows you to programmatically force command line options.

addtype(file_type)

This is how you programmatically tell Truxton what types of files you want to process. It will cause Truxton to write records to the ETLRoute table. A new record will be added (if one does not already exist) with the ETLQueueName column set to this ETL's queue name and the FileTypeID column set to the file type specified in this function call.

The file_type parameter should be the type of file you'd like to process.

depot

This property is used in generating the depot filename.

description

This is a longer form description of what your ETL does.

dtype

The type of depot you will be writing to. It should be one of the values stored in the ID column of the DepotType table in the database.

getmessage()

This function halts the execution of your process until a message arrives on your message queue.

name

This gives your ETL a human friendly name.

poly

This property tells Truxton that your ETL handles data that resides in multiple files all of which must be processed as a single unit. A Poly expander resides in the Semi-Chaotic stage of an exploitation effort. By default, Truxton assumes that ETL processes are single-file. A poly-file expander is a process that requires multiple files in order to successfully expand. An example of this situation is a spanned zip file where all of the pieces of the zip archive must be gathered before unzipping it.

queue

This tells Truxton which message queue to wait for messages for this ETL. This name will be normalized to all lower case letters with spaces removed. "My Queue" will be normalized to "myqueue"

sendmefileid(file_id)

This method

sendmefiles(file_type, count)

This method

sendmehash(hash)

This is used during the development of your exploitation program. It will go to Truxton, find the file with the given hash and place it into your message queue. The hash value is a string representation of an MD5 hash.

sendmelocalfile(file_name, file_type, calculate_hash)

This method

stage

This property - set only

version

This property - set only

Sample

import truxton

def main():
  etl = truxton.etl()
  etl.name = "My New ETL"
  etl.description = "This ETL processes files in the Truxton system"
  etl.queue = "anewetl"
  etl.stage = 40
  etl.id = 9999
  etl.depot = "thumbnail"
  etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
  etl.poly = 0

  etl.addarg("--verbose")
  etl.addarg("Yes")

  message = etl.getmessage()

  while message is not None:
    file_in_truxton = message.file()

    # YOUR FORENSIC CODE GOES HERE

    line_of_text = file_in_truxton.readline()

    if "[SetupAPI" in line_of_text:
      child = file_in_truxton.newchild()
      child.name = "Child file from New ETL"
      child.write("This is the file you were looking for.")
      child.save()

if __name__ == "__main__":
  main()