dorothy2 1.1.0 → 1.2.0

data/lib/dorothy2/NAM.rb

@@ -19,12 +19,12 @@ module Dorothy
     end
 
     def start_sniffer(vmaddress, interface, name, pcaphome)
-      Net::SSH.start(@server, @user, :password => @pass, :port =>@port) do |@ssh|
+      Net::SSH.start(@server, @user, :password => @pass, :port =>@port) do |ssh|
         MANUAL ? not_rdp = "and not port 3389" : not_rdp = ""
-        @ssh.exec "nohup sudo tcpdump -i #{interface} -s 1514 -w #{pcaphome}/#{name}.pcap host #{vmaddress} #{not_rdp} 2> log.tmp  & "
+        ssh.exec "nohup sudo tcpdump -i #{interface} -s 1514 -w #{pcaphome}/#{name}.pcap host #{vmaddress} #{not_rdp} 2> log.tmp  & "
 
         begin
-          t = @ssh.exec!"ps aux |grep #{name}|grep -v grep|grep -v bash"
+          t = ssh.exec!"ps aux |grep #{name}|grep -v grep|grep -v bash"
           pid = t.split(" ")[1]
         rescue
           r = 0

data/lib/dorothy2/do-init.rb

@@ -1,3 +1,6 @@
+#!/bin/env ruby
+# encoding: utf-8
+
 # Copyright (C) 2010-2013 marco riccardi.
 # This file is part of Dorothy - http://www.honeynet.it/
 # See the file 'LICENSE' for copying permission.
@@ -66,6 +69,7 @@ module Dorothy
         conf["env"]["analysis_dir"] = "#{home}/opt/analyzed"
         conf["env"]["geoip"] = "#{home}/etc/geo/GeoLiteCity.dat"
         conf["env"]["geoasn"] = "#{home}/etc/geo/GeoIPASNum.dat"
+        conf["env"]["geoisp"] = "#{home}/etc/geo/GeoIPISP.dat"
 
         conf["env"]["dtimeout"] = 3600
 
@@ -130,6 +134,9 @@ module Dorothy
         puts "After how many seconds do you want to take the first screenshot? [1]"
         conf["sandbox"]["screen1time"] = (t = gets.chop).empty? ? 1 : t
 
+        puts "Which is the sandox's network? [10.10.10.0/0]"
+        conf["sandbox"]["network"] = (t = gets.chop).empty? ? "10.10.10.0/0" : t
+
         ######################################################
         ###NAM
         ######################################################

data/lib/dorothy2/do-utils.rb

@@ -1,3 +1,6 @@
+#!/bin/env ruby
+# encoding: utf-8
+
 # Copyright (C) 2010-2013 marco riccardi.
 # This file is part of Dorothy - http://www.honeynet.it/
 # See the file 'LICENSE' for copying permission.
@@ -16,14 +19,14 @@ module Dorothy
     end
 
     def init_db(ddl=DoroSettings.dorothive[:ddl], force=false)
-      LOGGER.warn "DB", "The database is going to be initialized with the file #{ddl}. If the Dorothive is already present, " + "all the its data will be lost".red + ". Continue?(write yes)"
+      LOGGER.warn "DB", "The database is going to be initialized with the file #{ddl}. If the Dorothive is already present, " + "all its data will be lost".red + ". Continue?(write yes)"
       answ = "yes"
       answ = gets.chop unless force
 
       if answ == "yes"
         begin
           #ugly, I know, but couldn't find a better and easier way..
-          raise 'An error occurred' unless system "psql -h #{DoroSettings.dorothive[:dbhost]} -U #{DoroSettings.dorothive[:dbuser]} -f #{ddl} 1> /dev/null"
+          raise 'An error occurred' unless system "sh -c 'psql -h #{DoroSettings.dorothive[:dbhost]} -U #{DoroSettings.dorothive[:dbuser]} -f #{ddl} 1> /dev/null'"
           LOGGER.info "DB", "Database correctly initialized. Now you can restart Dorothy!"
         rescue => e
           LOGGER.error "DB", $!
@@ -150,12 +153,12 @@ module Dorothy
       @db.exec("SELECT CASE WHEN EXISTS (SELECT * FROM dorothy.#{table} LIMIT 1) THEN FALSE ELSE TRUE END").first["case"] == "t" ? true : false
     end
 
-    def update_proto(role, ip)
-      @db.exec("UPDATE dorothy.host_roles set app_protocol = '#{proto}' where id = currval('connections_id_seq')")
+    def update_sample_path(sample, path)
+      @db.exec("UPDATE dorothy.samples set path = '#{path}' where sha256 = #{sample}")
     end
 
     def set_analyzed(hash)
-      @db.exec("UPDATE dorothy.traffic_dumps set parsed = true where hash = '#{hash}'")
+      @db.exec("UPDATE dorothy.traffic_dumps set parsed = true where sha256 = '#{hash}'")
     end
 
     def find_seq(seq)
@@ -168,7 +171,7 @@ module Dorothy
 
     def malware_list
       malwares = []
-      @db.exec("SELECT samples.hash FROM dorothy.samples").each do |q|
+      @db.exec("SELECT samples.sha256 FROM dorothy.samples").each do |q|
         malwares.push q
       end
       return malwares
@@ -177,7 +180,7 @@ module Dorothy
     def find_pcap
       @pcaps = []
       begin
-        @db.exec("SELECT traffic_dumps.hash, traffic_dumps.pcapr_id, traffic_dumps.size, traffic_dumps.binary, traffic_dumps.parsed, samples.md5 as \"sample\", analyses.date as \"date\", analyses.id as \"anal_id\" FROM dorothy.traffic_dumps, dorothy.samples, dorothy.analyses WHERE analyses.traffic_dump = traffic_dumps.hash AND analyses.sample = samples.hash AND traffic_dumps.parsed = false").each do |q|
+        @db.exec("SELECT traffic_dumps.sha256, traffic_dumps.pcapr_id, traffic_dumps.size, traffic_dumps.binary, traffic_dumps.parsed, samples.md5 as \"sample\", analyses.date as \"date\", analyses.id as \"anal_id\" FROM dorothy.traffic_dumps, dorothy.samples, dorothy.analyses WHERE analyses.traffic_dump = traffic_dumps.sha256 AND analyses.sample = samples.sha256 AND traffic_dumps.parsed = false").each do |q|
           @pcaps.push q
         end
       rescue

data/lib/dorothy2/version.rb

@@ -1,3 +1,3 @@
 module Dorothy
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 end

data/lib/mu/xtractr.rb

@@ -17,7 +17,7 @@ require 'mu/xtractr/content'
 require 'mu/xtractr/field'
 require 'mu/xtractr/flow'
 require 'mu/xtractr/flows'
-require 'mu/xtractr/host'
+require File.dirname(__FILE__) + '/xtractr/host'   #overrides the gem one with the local (fixed for 1.9.3)
 require 'mu/xtractr/packet'
 require 'mu/xtractr/packets'
 require 'mu/xtractr/service'

data/lib/mu/xtractr/host.rb

@@ -74,9 +74,12 @@ class Host
     private
     def role2q role, forp, q=nil # :nodoc:
         _q = case role
-                when :any:    "#{forp}.src|#{forp}.dst:\"#{address}\""
-                when :client: "#{forp}.src:\"#{address}\""
-                when :server: "#{forp}.dst:\"#{address}\""
+               when :any
+                 "#{forp}.src|#{forp}.dst:\"#{address}\""
+               when :client
+                 "#{forp}.src:\"#{address}\""
+               when :server
+                 "#{forp}.dst:\"#{address}\""
                 else raise ArgumentError, "Unknown role #{role}"
             end
         _q << " #{q}" if q

metadata

@@ -1,262 +1,225 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: dorothy2
-version: !ruby/object:Gem::Version 
-  hash: 19
-  prerelease: 
-  segments: 
-  - 1
-  - 1
-  - 0
-  version: 1.1.0
+version: !ruby/object:Gem::Version
+  version: 1.2.0
 platform: ruby
-authors: 
+authors:
 - marco riccardi
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2013-09-24 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2013-12-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: net-scp
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 31
-        segments: 
-        - 1
-        - 0
-        - 4
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.0.4
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: net-ssh
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 5
-        segments: 
-        - 2
-        - 2
-        - 1
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.0.4
+- !ruby/object:Gem::Dependency
+  name: net-ssh
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 2.2.1
   type: :runtime
-  version_requirements: *id002
-- !ruby/object:Gem::Dependency 
-  name: trollop
   prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 83
-        segments: 
-        - 1
-        - 16
-        - 2
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.2.1
+- !ruby/object:Gem::Dependency
+  name: trollop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.16.2
   type: :runtime
-  version_requirements: *id003
-- !ruby/object:Gem::Dependency 
-  name: rest-client
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 13
-        segments: 
-        - 1
-        - 6
-        - 1
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.16.2
+- !ruby/object:Gem::Dependency
+  name: rest-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.6.1
   type: :runtime
-  version_requirements: *id004
-- !ruby/object:Gem::Dependency 
-  name: mime-types
   prerelease: false
-  requirement: &id005 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 47
-        segments: 
-        - 1
-        - 16
-        version: "1.16"
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.6.1
+- !ruby/object:Gem::Dependency
+  name: mime-types
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.16'
   type: :runtime
-  version_requirements: *id005
-- !ruby/object:Gem::Dependency 
-  name: colored
   prerelease: false
-  requirement: &id006 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 11
-        segments: 
-        - 1
-        - 2
-        version: "1.2"
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.16'
+- !ruby/object:Gem::Dependency
+  name: colored
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.2'
   type: :runtime
-  version_requirements: *id006
-- !ruby/object:Gem::Dependency 
-  name: ruby-pg
   prerelease: false
-  requirement: &id007 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 16179
-        segments: 
-        - 0
-        - 7
-        - 9
-        - 2008
-        - 1
-        - 28
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: ruby-pg
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 0.7.9.2008.01.28
   type: :runtime
-  version_requirements: *id007
-- !ruby/object:Gem::Dependency 
-  name: virustotal
   prerelease: false
-  requirement: &id008 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 15
-        segments: 
-        - 2
-        - 0
-        - 0
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.7.9.2008.01.28
+- !ruby/object:Gem::Dependency
+  name: virustotal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 2.0.0
   type: :runtime
-  version_requirements: *id008
-- !ruby/object:Gem::Dependency 
-  name: nokogiri
   prerelease: false
-  requirement: &id009 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.0.0
+- !ruby/object:Gem::Dependency
+  name: nokogiri
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        hash: 23
-        segments: 
-        - 1
-        - 5
-        - 10
+      - !ruby/object:Gem::Version
         version: 1.5.10
   type: :runtime
-  version_requirements: *id009
-- !ruby/object:Gem::Dependency 
-  name: rbvmomi
   prerelease: false
-  requirement: &id010 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 27
-        segments: 
-        - 1
-        - 3
-        - 0
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.5.10
+- !ruby/object:Gem::Dependency
+  name: rbvmomi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.3.0
   type: :runtime
-  version_requirements: *id010
-- !ruby/object:Gem::Dependency 
-  name: ruby-filemagic
   prerelease: false
-  requirement: &id011 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 11
-        segments: 
-        - 0
-        - 4
-        - 2
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.3.0
+- !ruby/object:Gem::Dependency
+  name: ruby-filemagic
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 0.4.2
   type: :runtime
-  version_requirements: *id011
-- !ruby/object:Gem::Dependency 
-  name: net-dns
   prerelease: false
-  requirement: &id012 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 63
-        segments: 
-        - 0
-        - 8
-        - 0
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.4.2
+- !ruby/object:Gem::Dependency
+  name: net-dns
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 0.8.0
   type: :runtime
-  version_requirements: *id012
-- !ruby/object:Gem::Dependency 
-  name: geoip
   prerelease: false
-  requirement: &id013 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 29
-        segments: 
-        - 1
-        - 2
-        - 1
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.8.0
+- !ruby/object:Gem::Dependency
+  name: geoip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.2.1
   type: :runtime
-  version_requirements: *id013
-- !ruby/object:Gem::Dependency 
-  name: tmail
   prerelease: false
-  requirement: &id014 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 81
-        segments: 
-        - 1
-        - 2
-        - 7
-        - 1
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.2.1
+- !ruby/object:Gem::Dependency
+  name: tmail
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.2.7.1
   type: :runtime
-  version_requirements: *id014
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.2.7.1
 description: A malware/botnet analysis framework written in Ruby.
-email: 
+email:
 - marco.riccardi@honeynet.it
-executables: 
+executables:
 - dorothy_start
 - dorothy_stop
 - dparser_start
 - dparser_stop
 extensions: []
-
-extra_rdoc_files: 
+extra_rdoc_files:
 - README.md
-files: 
+files:
 - .gitignore
+- CHANGELOG
 - Gemfile
 - LICENSE
 - README.md
@@ -284,7 +247,6 @@ files:
 - lib/dorothy2/do-init.rb
 - lib/dorothy2/do-logger.rb
 - lib/dorothy2/do-utils.rb
-- lib/dorothy2/environment.rb
 - lib/dorothy2/version.rb
 - lib/dorothy2/vtotal.rb
 - lib/mu/xtractr.rb
@@ -322,36 +284,28 @@ files:
 - var/log/parser.log
 homepage: https://github.com/m4rco-/dorothy2
 licenses: []
-
-post_install_message: If you are upgrating from a previous version, read the UPDATE file!
+metadata: {}
+post_install_message: ! '\n WARING: If you are upgrating from a previous version,
+  read the UPDATE file!\n'
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: 1.9.3
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 2.1.10
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: More info at http://www.honeynet.it
-test_files: 
+test_files:
 - test/tc_dorothy_full.rb
+has_rdoc: