TruxtonETL

This class provides capability to participate in Truxton's ETL pipeline. You can implement your own form of file exploitation. You can subscribe to events...

Attributes and Methods

addarg(argument)

This is used to build the command line arguments for the process. Truxton will automatically parse the command line for you but this allows you to programmatically force command line options.

addtype(file_type)

This is how you programmatically tell Truxton what types of files you want to process. It will cause Truxton to write records to the ETLRoute table. A new record will be added (if one does not already exist) with the ETLQueueName column set to this ETL's queue name and the FileTypeID column set to the file type specified in this function call.

The file_type parameter should be the type of file you'd like to process.

depot

This property is used in generating the depot filename.

description

This is a longer form description of what your ETL does.

dtype

The type of depot you will be writing to. It should be one of the values stored in the ID column of the DepotType table in the database.

expanderid

This is an arbitrary value you choose to uniquely identify your ETL process. This should be a fixed value that you never change. It will be written to the Expander column of the ExpandedFile table.

getmessage()

This function halts the execution of your process until a message arrives on your message queue.

name

This gives your ETL a human friendly name.

poly

This property tells Truxton that your ETL handles data that resides in multiple files all of which must be processed as a single unit. A Poly expander resides in the Semi-Chaotic stage of an exploitation effort. By default, Truxton assumes that ETL processes are single-file. A poly-file expander is a process that requires multiple files in order to successfully expand. An example of this situation is a spanned zip file where all of the pieces of the zip archive must be gathered before unzipping it.

queue

This tells Truxton which message queue to wait for messages for this ETL. This name will be normalized to all lower case letters with spaces removed. "My Queue" will be normalized to "myqueue"

sendmefileid(file_id)

This is used during the development of your exploitation program. It will go to Truxton, find the file and place it into your message queue.

sendmefiles(file_type, count)

This is used during the development of your exploitation program. It will go to Truxton, find the files that meet your criteria and place them into your message queue. file_type is the type of file you would like to process. count is the maximum number of files that will be put into your message queue.

sendmehash(hash)

This is used during the development of your exploitation program. It will go to Truxton, find the file with the given hash and place it into your message queue. The hash value is a string representation of an MD5 hash.

sendmelocalfile(file_name, file_type, calculate_hash)

This is used during the development of your exploitation program. It will open the file and put a message into your message queue. file_name is the path the file on your system that you want to process. file_type is the type of file you would like associated with this file's contents. calculate_hash controls how the hash value associated with this file is calculated. By default, Truxton will calculate the MD5 hash of the file's contents before sending it to you. However, this can take some time if you are dealing with large files. If you don't care about the hash value, set calculate_hash to zero and the calculation of the hash will be skipped and a random value sent as the hash.

stage

The stage number tells Truxton how your ETL fits into the overall exploitation process.

version

The optional version number of your ETL process. It will be written to the Version column of the ExpandedFile table. If you do not set the version number, Truxton will use a packed version number based on the information in the version resource of your executable.

Sample

import truxton

def main():
  etl = truxton.etl()
  etl.name = "My New ETL"
  etl.description = "This ETL processes files in the Truxton system"
  etl.queue = "anewetl"
  etl.stage = 40
  etl.expanderid = 0x05fc0bf6a57726a0
  etl.version = 0
  etl.depot = "thumbnail"
  etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
  etl.poly = 0

  etl.addarg("--verbose")
  etl.addarg("Yes")

  etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
  etl.sendmehash("baa51f0cc8361660df911e06e7637485")
  etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
  etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
  etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )

  message = etl.getmessage()

  while message is not None:
    file_in_truxton = message.file()

    # YOUR FORENSIC CODE GOES HERE

    line_of_text = file_in_truxton.readline()

    if "[SetupAPI" in line_of_text:
      child = file_in_truxton.newchild()
      child.name = "Child file from New ETL"
      child.write("This is the file you were looking for.")
      child.save()

if __name__ == "__main__":
  main()