4i( ddlZddlmZddlmZidgddddgd gd d d gd gdddgdddgdddgdgdddgdddgdgdd d!d gd"gd#d$d%gd&d'gd(d)gd*gd+gd,d-ggd.d/aidd0dd1d d1d d1d d2dd1dd3dd3dd3dd2dd1dd4d d1d"d3d$d4d&d4d(d3d4d4d5ad2d6d6d6d6d6d6d3d6d7 agd8d9gd:gd;aga ga d<Z d=Z d>Z d?Zd@ZdAZdBZdCZdDZdEZejdFfdGZdS)HN)config)bcolors Kaspersky)avpavpuiklifKAVFSkavfsslpprunsrv Malwarebytes mbcloudea mbamserviceSymantec)SmcGui SISIPSServiceSemSvcsnac64 sesmcontinst Bitdefendervsserv TrendMicro)tmntsrvPwmTowerSMEX_SystemWatcher SMEX_MasterzWindows DefenderMsMpEngAvastaswBccbccCylance CylanceSvc CylanceUiESET)epfwepfwlwfepfwwfpzFireEye Endpoint AgentxagtzF-Securefsdevcon FSORSPClientMacAfee)enterceptagentMcAfeeEngineServiceMcAfeeFrameworkmcdatrepMcScript_InUseamupdate SentinelOne SentinelAgentSophos) sophosssp sophosspsALMonALsvc swc_serviceswi_fc swi_filter swi_service ZoneALarmzlclientzPanda AntiVirusAVENGINEAVGavgemcavscanAVKProxy CybereasonCybereasonRansomFree)Cyvera CyveraConsole tlaworker)AviraG datarCz Palo Alto XDR)rHrI) wireshark vboxservicevboxtrayautorunprocexpprocmontcpviewpowershell_isesysmon)z splunk-admonsplunkdzsplunk-winevtlogz splunk-netmonrX winlogbeat)SplunkSysmonzElastic Search / Gray Logcg}|D]}tD]\}}|D]}|dd|krM||vrI||t dt dt|}|dkr;ttj dztj z|tddSttj dztj ztddS)N.r rLz#SIEM detected using process list : ####################################zNo SIEM Detected ) splitSIEMitemslowerappendscoresandboxlenprintrFAILENDCOKGREEN)pssiemitspcls /home/kali/Ninja/core/DA.py detect_SIEMruMs) D XXZZ&&JJLL & &DAq & &773<<?bhhjj00!t))KKNNNLLOOONN1%%%  & & D A1uu glBBW\QSWXXX 344444 go 33glBCCC 344444cg}g}|dD]P}|d}|ddkr||dQt|}|dkr*t t jdzt jz||D]}t D]y\}}|D]q} |dd| kr>||vr:||tt|rzt|}|dkr;t t jdzt jz|t d dSt t j d zt jzt d dS) N :r displayNamez#AV detected using powershell API : r^z!AV detected using process list : r`zNo AV Detected )rastriprerhrirrjrkAV_listrcrdrfAV_scorerl) rmavAVAVProfieldsrsrprqrrs rt detect_AVr`s B C XXd^^!! !9??   - - IIfQi  BA1uu glBBW\QSUVVV XXZZ..MMOO . .DAq . .773<<?bhhjj00!s((JJqMMMLL!--- . . CA1uu gl@@7<OQTUUU 344444 go 11GL@AAA 344444rvc td|dD]_}|d}|ddkr*t|ddd `td |dd dD]&}t|dd 'td |d D]w}|dD]_}|d}|ddkr*t|ddd `xtddS)Nz Domain Users : rx: rNamer{,)endz ############ Domain Groups : rMz" ############ Domain Computers : z namez% ###################################)rirar|)adusersadgroupsADPCrords rtAD_enumr{sx !!! ]]4 22 !9??   & & &)//##Sb 1 1 1 1 /000 ^^D ! !!"" %&& aggii"%%%%% 2333ZZ  66 6 6AWWT]]Fay  F**fQioo''"5555 6 344444rvc|D]l}tD]P\}}|dd|krt|QmdS)Nr^r)ra Sandbox_IOCrcrdrgre)rmrorprqs rtdetect_sandboxrs{ XXZZ""%%'' " "DAqwws||A!''))++q!!! """rvci} |dD]M}|d}t|dkr#|d||d<Ntd|dd|dd |d d |d d |dd|dd d|dzdz|dzdz|dddksC|dddkrt d|dddkrtd|dddkrtd|dddkrtd |dd!dkrtd |dd"dkrtddSdS)#Nrxrr{rzPC Report : Host Name: CSNamez OS : Captionz Build Number : BuildNumberz Local Time : LocalDateTimez Time Zone : CurrentTimeZonez Last Boot Time : LastBootUpTimez zBios Manufacturer : Manufacturerz , SMBIOSBIOSVersionz% ###################################innotek virtualboxr_z windows 10rJz windows 7rMz windows 8rKzwindows server 2012zwindows server 2016) rarhr|rirdfindrgrerf)pcinfopclistrors rtPCinfors  F\\$  22 v;;??(.q F6!9??$$ % Ex&+++VM-B-B-BF?D[D[D[]cdu]v]v]v    "#9F>>MNNN Qq /00000rvc|dddddkrttjdz|dddztjztdtdtd d Sttj d ztjztd td td dS)Nrxrrrrzthis device part of the domain r{rJr`Tz!this device is not part of domainrNrKF) r|replacerarirrlrkrfrergrj)isjoineds rt getjoinedrs~~b))//44Q7==??6II go AAHNNSWDXDXD^D^_bDcDcdeDffipiuuvvv Qq 3444t gl@@7<OPPP Qq 3444urvcd}tD]}||z}|ttz }|dkr?ttjdzt |zdzdztjz|dkrE|dkr?ttjdzt |zdzdztjz|dkr?ttjdzt |zdzd ztjzd}tD]}||z}|ttz }|dkr?ttjd zt |zdzd ztjz|dkrE|dkr?ttjd zt |zdzd ztjz|dkr?ttjd zt |zdzd ztjztddS)NrrMzHardness score (z/10z() : Easy , you can pwn the system easilyrKrOzV) : Medium , you can pwn the system with good enumeration and available local exploit zD) : Hard , be careful from the AV and the security updates installedzSandbox Score (z() : you are probably in real live systemzB) : check and confirm as you probably in a security analyst devicez) : you are in a sandboxr`) rfrhrirrlstrrkWARNINGrjrg)sumroavgs rtgetscorers C Ag U C axx go 22S 66EFHO U V V V axxC1HH go 22S 66stv}wCC D D D Qww gl//# 33abdkdpq r r r C Ag W C axx go 11C 55EFHO U V V V axxC1HH go 11C 55_`bibno p p p Qww gl..S9EAD^^ahammnnn /00000rvz/DA/DA_out.txtc t|}|}|d}|d}|d}|d}|d}|d}|d}|d} |d } |d } |d } |d } t|t ||t |t |t|t|}t|tt| |rt| | | td | dS#t$r*}tdt|zYd}~dSd}~wwxYw)Nz###############r{rrNrMrKrLrOrJr_ z Shares : z[-] ERROR(webserver->main): %s)openreadrarurrrrrrrrrri Exceptionr)fnamefiledatarrmrrrrrrrrsharesjoinedes rtmainrs9E{{yy{{zz+,, !W !W1gq'7a7q'7BxbB"brs 8$$v (  - GXt , , , nf%%%%% 999 .Q78888888889sD:D>> E2E--E2)rcorer core.colorrr}r~rrbrfrgrurrrrrrrrr campaign_namerrvrtrs  III [-0 OOO H:   NNN      h   k*  * * * vh ^, rrr O]3  ppp *   |! " H:# $Zl!78<<<+   2  A  1   !      Q q  A a  q 1  a   q! " 1# $'   0   ONNj".   555&5556555.""""""J333 1 1 1 1 1 1    111@&666 9 9 9 9 9 9rv