private void GoButton_Click(object sender, EventArgs e)
{
treeView1.Nodes.Clear();
string rules = " /ruleid:";
bool[] ruleChecks =
{
CB_SQLInjection.Checked, CB_CommandExecution.Checked, CB_FileCanonicalisation.Checked,
CB_InformationDisclosure.Checked, CB_XSS.Checked, CB_WebRedirection.Checked,
CB_XPathInjection.Checked, CB_LDAPInjection.Checked
};
// build the cmd flags for CAT.NET rules based on the user input
for (int r = 0; r < ruleChecks.Length; r++)
{
if (ruleChecks[r])
{
rules += "+ACESEC0" + (r + 1).ToString() + ",";
}
else
{
rules += "-ACESEC0" + (r + 1).ToString() + ",";
}
}
// delete the last comma ','
rules = rules.Substring(0, rules.Length - 1);
progressBar1.Value = 0;
progressBar1.Step = 0;
progressBar1.PerformStep();
progressBar1.Refresh();
// create the database if first-time run
if (!File.Exists("MattDotNet.sqlite"))
{
DbFuncs.CreateDB();
}
if (File.Exists(CatNETPath.Text))
{
TraverseAndRun(SourcePath.Text, CatNETPath.Text, rules, DestPath.Text);
}
else
{
MessageBox.Show("Can't find CAT.NET. Check path and try again...");
}
}
private void viewdb_Click(object sender, EventArgs e)
{
dataGridView1.DataSource = DbFuncs.DumpDB().Tables[0].DefaultView;
}
public void TraverseAndRun(string root, string binary, string rules, string dest)
{
label1.Text = "Enumerating .NET EXE and DLL Files...";
label1.Refresh();
DotNetBinary dnb = new DotNetBinary();
try
{
// enumerate all .NET dll and exe files in the given directory
var dotNetFiles = from file in Directory.EnumerateFiles(root, "*.*", SearchOption.AllDirectories)
where (isDotNet(file, "_CorDllMain") && file.EndsWith(".dll")) || (isDotNet(file, "_CorExeMain") && file.EndsWith(".exe"))
select new
{
File = file
};
label1.Text = "Enumerating Files... Complete. Found " + dotNetFiles.Count().ToString() + " files.";
label1.Refresh();
// only continue if we found >= 1 file
if (dotNetFiles.Count() != 0)
{
int count = 0;
progressBar1.Step = (int)(progressBar1.Maximum / dotNetFiles.Count());
// calculate the given CAT.NET timeout (how long before CAT gives up on processing a binary)
int timeout;
bool isNumeric = int.TryParse(CATtimeout.Text, out timeout);
if (isNumeric)
{
timeout = timeout * 1000 * 60;
}
else
{
timeout = 300000;
}
List <string> errorFiles = new List <string>();
foreach (var f in dotNetFiles)
{
System.IO.FileInfo fi = new System.IO.FileInfo(f.File);
string filePath = dest + "\\" + fi.Name;
ProcessStartInfo startInfo = new ProcessStartInfo();
startInfo.CreateNoWindow = true;
startInfo.UseShellExecute = false;
startInfo.FileName = "\"" + binary + "\"";
startInfo.WindowStyle = ProcessWindowStyle.Hidden;
startInfo.Arguments = "/file:" + "\"" + f.File + "\"" + rules + " /report:\"" + filePath + "\"" + ".xml" + " /reportxsloutput:\"" + filePath + "\"" + ".html";
label1.Text = "Processing " + fi.Name + " : " + (++count).ToString() + " of " + dotNetFiles.Count().ToString();
label1.Refresh();
dnb.hash = hashFile(fi);
dnb.name = fi.Name;
dnb.application = Path.GetDirectoryName(f.File);
// only run CAT.NET on the binary if we haven't done so before
if (!DbFuncs.seenBefore(dnb))
{
try
{
// Start the process with the info we specified. Call WaitForExit and then the using statement will close.
using (Process exeProcess = Process.Start(startInfo))
{
// give the process 5 minutes runtime before we kill it and move on to the next file
bool cleanExit = exeProcess.WaitForExit(timeout); // default is 300000
label1.Text = "Timeout reached. Moving to next file.";
if (!cleanExit)
{
exeProcess.Kill();
label1.Text = "Timout reached and process kill forced. Moving to next file.";
errorFiles.Add(fi.Name);
}
else
{
label1.Text = " ";
label1.Refresh();
// add the file to our TreeNode
TreeNode[] results = parseXML(filePath + ".xml");
TreeNode treeNode = new TreeNode(f.File.ToString(), results);
treeView1.Nodes.Add(treeNode);
treeView1.Refresh();
foreach (TreeNode tn in results)
{
string[] s = tn.Text.Split(':');
Console.Write(s[0] + " " + s[1]);
if (s[0].Equals("SQLi"))
{
int.TryParse(s[1], out dnb.numSQLi);
}
if (s[0].Equals("Command Execution"))
{
int.TryParse(s[1], out dnb.numCodEx);
}
if (s[0].Equals("File Canonicalisation"))
{
int.TryParse(s[1], out dnb.numFileEx);
}
if (s[0].Equals("Info Leak"))
{
int.TryParse(s[1], out dnb.numInfoLeak);
}
if (s[0].Equals("XSS"))
{
int.TryParse(s[1], out dnb.numXSS);
}
if (s[0].Equals("User Redirection"))
{
int.TryParse(s[1], out dnb.numRedirect);
}
if (s[0].Equals("XPath Injection"))
{
int.TryParse(s[1], out dnb.numXPath);
}
if (s[0].Equals("LDAP Injection"))
{
int.TryParse(s[1], out dnb.numLDAP);
}
}
// add the results to the database
DbFuncs.PopulateDB(dnb);
// refresh the datagrid
dataGridView1.DataSource = DbFuncs.DumpDB().Tables[0].DefaultView;
}
}
}
// error either opening file or running CAT.NET on that file.
catch
{
errorFiles.Add(fi.Name);
}
}
else
{
label1.Text = "Seen this file before; moving to next file...";
}
progressBar1.PerformStep();
progressBar1.Refresh();
}
progressBar1.Step = progressBar1.Maximum;
progressBar1.PerformStep();
progressBar1.Refresh();
label1.Text = "Finished.";
if (errorFiles.Count > 0)
{
string errors = "There were errors processing the following files.\nTry again with a longer CAT timeout:\n" + string.Join("\n", errorFiles.ToArray());
MessageBox.Show(errors);
}
}
}
catch (Exception e)
{
// e.g. some sort of dir/file exception
MessageBox.Show(e.ToString());
}
}
