public string GetUsage()
{
var title = ((System.Reflection.AssemblyTitleAttribute)Attribute.GetCustomAttribute(
System.Reflection.Assembly.GetExecutingAssembly(),
typeof(System.Reflection.AssemblyTitleAttribute))).Title;
//ヘッダーの設定
var head = new HeadingInfo(
title,
System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString());
var asmcpy =
(System.Reflection.AssemblyCopyrightAttribute)
Attribute.GetCustomAttribute(
System.Reflection.Assembly.GetExecutingAssembly(),
typeof(System.Reflection.AssemblyCopyrightAttribute));
var regex = new Regex(@".+\s+(\d+)\s+(.+)");
var m = regex.Match(asmcpy.Copyright);
var help = new HelpText(head);
if (m.Success)
{
help.Copyright = new CopyrightInfo(m.Groups[2].Value, int.Parse(m.Groups[1].Value));
}
help.AddPreOptionsLine("オプション一覧");
//全オプションを表示(1行間隔)
help.AdditionalNewLineAfterOption = true;
help.AddOptions(this);
return(help.ToString());
}
public string GetUsage()
{
var programName = System.Reflection.Assembly.GetExecutingAssembly().GetName().Name;
HeadingInfo _headingInfo = new HeadingInfo(programName, System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString());
var help = new HelpText(_headingInfo);
help.AdditionalNewLineAfterOption = true;
help.Copyright = new CopyrightInfo("Modulo Security Solutions", 2011, 2011);
help.AddPreOptionsLine("This is free software. You may redistribute copies of it under the terms of");
help.AddPreOptionsLine("the License <https://github.com/modulogrc/modSIC/blob/master/README>.");
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format("Usage: {0} -c -m <server> -u <username> -p <password> -t <target> -y <target-username> -z <target-password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} --collect --modsic <server> --username <username> --password <password> --target <target> --target-username <target-username> --target-password <target-password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} -s -m <server> -u <username> -p <password> -t <target> -y <target-username> -z <target-password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} --collect-sync --modsic <server> --username <username> --password <password> --target <target> --target-username <target-username> --target-password <target-password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} -g <id> -m <server> -u <username> -p <password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} --get-results <id> --modsic <server> --username <username> --password <password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} -x <id> -m <server> -u <username> -p <password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} --cancel <id> --modsic <server> --username <username> --password <password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} -l -m <server> -u <username> -p <password>", programName));
help.AddPreOptionsLine("");
help.AddPreOptionsLine(String.Format(" {0} --list --modsic <server> --username <username> --password <password>", programName));
help.AddOptions(this);
return(help);
}
/// <summary>
/// Редактирование рубрики
/// </summary>
/// <param name="heading">Модель рубрики</param>
public void Edit(HeadingInfo heading)
{
if (heading == null)
{
throw new ArgumentException("Вы не указали объект");
}
Edit(heading.ID, heading.Name);
}
/// <summary>
/// Добавление новой рубрики
/// </summary>
/// <param name="heading">Модель рубрики</param>
public int Insert(HeadingInfo heading)
{
if (heading == null)
{
throw new ArgumentException("Вы не указали объект");
}
return(Insert(heading.Name));
}
/// <summary>
/// Тест удаления данных
/// </summary>
/// <param name="id">Идентификатор</param>
private void DeleteTest(int id)
{
using (var dataProvider = new DataProvider())
{
dataProvider.Heading.Delete(id);
HeadingInfo headingInfo = dataProvider.Heading.GetByID(id);
Assert.IsNull(headingInfo);
}
}
/// <summary>
/// Тест для возрата рубрики по Идентификатору и проверка наименования
/// </summary>
/// <param name="id">Идентификатор</param>
/// <param name="checkName">Наименвание</param>
private void GetIDAnCheckNameTest(int id, string checkName)
{
using (var dataProvider = new DataProvider())
{
HeadingInfo headingInfo = dataProvider.Heading.GetByID(id);
Assert.IsNotNull(headingInfo);
Assert.AreEqual(checkName, headingInfo.Name);
}
}
//[ExpectedException(typeof(ArgumentException))]
public void EditTestThrowsExceptionIfEmpty()
{
using (var dataProvider = new DataProvider())
{
HeadingInfo headingInfo = dataProvider.Heading.GetByID(1);
Assert.IsNotNull(headingInfo);
Assert.ThrowsException <ArgumentException>(() => dataProvider.Heading.Edit(1, ""));
}
}
/// <summary>
/// Тест для возрата рубрики по Идентификатору и проверка наименования
/// </summary>
/// <param name="id">Идентификатор</param>
/// <param name="path">Путь строка в линке</param>
/// <param name="checkName">Наименвание</param>
private void GetPathLinkAnCheckNameTest(int id, string path, string checkName)
{
using (var dataProvider = new DataProvider())
{
HeadingInfo headingInfo = dataProvider.Heading.GetByPathLink(path);
Assert.IsNotNull(headingInfo);
Assert.AreEqual(id, headingInfo.ID);
Assert.AreEqual(checkName, headingInfo.Name);
}
}
public void OnlyProgramName()
{
HeadingInfo hi = new HeadingInfo("myprog");
string s = hi;
Assert.AreEqual("myprog", s);
StringWriter sw = new StringWriter();
hi.WriteMessage("a message", sw);
Assert.AreEqual("myprog: a message" + Environment.NewLine, sw.ToString());
}
public void ProgramNameAndVersion()
{
HeadingInfo hi = new HeadingInfo("myecho", "2.5");
string s = hi;
Assert.AreEqual("myecho 2.5", s);
StringWriter sw = new StringWriter();
hi.WriteMessage("hello unit-test", sw);
Assert.AreEqual("myecho: hello unit-test" + Environment.NewLine, sw.ToString());
}
public void Program_name_and_version()
{
var hi = new HeadingInfo("myecho", "2.5");
string s = hi;
s.Should().Be("myecho 2.5");
var sw = new StringWriter();
hi.WriteMessage("hello unit-test", sw);
sw.ToString().Should().Be("myecho: hello unit-test" + Environment.NewLine);
}
public void OnlyProgramName()
{
var hi = new HeadingInfo("myprog");
string s = hi;
s.Should().Equal("myprog");
var sw = new StringWriter();
hi.WriteMessage("a message", sw);
sw.ToString().Should().Equal("myprog: a message" + Environment.NewLine);
}
public void ProgramNameAndVersion()
{
var hi = new HeadingInfo("myecho", "2.5");
string s = hi;
Assert.AreEqual("myecho 2.5", s);
var sw = new StringWriter();
hi.WriteMessage("hello unit-test", sw);
Assert.AreEqual("myecho: hello unit-test" + Environment.NewLine, sw.ToString());
}
public void OnlyProgramName()
{
var hi = new HeadingInfo("myprog");
string s = hi;
Assert.AreEqual("myprog", s);
var sw = new StringWriter();
hi.WriteMessage("a message", sw);
Assert.AreEqual("myprog: a message" + Environment.NewLine, sw.ToString());
}
public void Only_program_name()
{
var hi = new HeadingInfo("myprog");
string s = hi;
s.Should().Be("myprog");
var sw = new StringWriter();
hi.WriteMessage("a message", sw);
sw.ToString().Should().Be("myprog: a message" + Environment.NewLine);
}
/// <summary>
/// Редактирование рубрики
/// </summary>
/// <param name="id">ID рубрики</param>
/// <returns></returns>
public ActionResult Edit(int id)
{
HeadingInfo headingInfo = dataProvider.Heading.GetByID(id);
HeadingModel headingModel = new HeadingModel
{
ID = headingInfo.ID,
Name = headingInfo.Name,
PathLink = headingInfo.PathLink,
Title = "Редактирование рубрики"
};
return(PartialView(headingModel));
}
public void Program_name_and_version()
{
var hi = new HeadingInfo("myecho", "2.5");
string s = hi;
s.Should().Be("myecho 2.5");
var sw = new StringWriter();
hi.WriteMessage("hello unit-test", sw);
sw.ToString().Should().Be("myecho: hello unit-test" + Environment.NewLine);
}
public string GetUsage()
{
// ヘッダーの設定
HeadingInfo head = new HeadingInfo("MoveWindow", "Version 1.0");
HelpText help = new HelpText(head);
help.Copyright = new CopyrightInfo("Toru Fukuad", 2017);
help.AddPreOptionsLine("ウィンドウを移動します");
help.AddPreOptionsLine("構文の例: MoveWindow.exe -x0 -y0 -t Twitter");
// 全オプションを表示(1行間隔)
help.AdditionalNewLineAfterOption = true;
help.AddOptions(this);
return(help.ToString());
}
static void Main(string[] args)
{
//Parse command line arguments
//CommandLineOptions opts = new CommandLineOptions();
var result = Parser.Default.ParseArguments <CommandLineOptions>(args).WithParsed(parsed => opts = parsed);
var title = new HeadingInfo("CobaltStrikeScan");
// Option Processes -p
if (opts.Processes)
{
if (!IsUserAdministrator())
{
OutputMessageToConsole(LogLevel.Error, "Not running as Administrator. Admin privileges required for '-p' option\n");
DisplayHelpText(result);
}
OutputMessageToConsole(LogLevel.Info, "Scanning processes for Cobalt Strike Beacons...");
GetBeaconsFromAllProcesses();
}
// Check if file AND directory options were supplied - display error message and exit
else if (!string.IsNullOrEmpty(opts.File) && !string.IsNullOrEmpty(opts.Directory))
{
OutputMessageToConsole(LogLevel.Error, "Error - Can't supply -f and -d options together.\n");
DisplayHelpText(result);
}
// User supplied File option -f or Directory option -d
else if (!string.IsNullOrEmpty(opts.File) || !string.IsNullOrEmpty(opts.Directory))
{
// "Scan single file" option
if (!string.IsNullOrEmpty(opts.File))
{
GetBeaconsFromFile(opts.File);
}
// "Scan a directory" option
else if (!string.IsNullOrEmpty(opts.Directory))
{
GetBeaconsFromDirectory(opts.Directory);
}
}
else if (opts.InjectedThreads)
{
GetBeaconsFromInjectedThreads(opts);
}
else if (opts.Help)
{
DisplayHelpText(result);
}
}
/// <summary>
/// Покатать даннык
/// </summary>
/// <param name="pathLink">Путь из модели рубрик</param>
/// <returns></returns>
// GET: Home
public ActionResult Show(string pathLink)
{
HeadingModel headingModel = new HeadingModel();
headingModel.Title = "Новости 24";
headingModel.Headings = dataProvider.Heading.GetAll().Select(x => new Models.HeadingModel()
{
ID = x.ID,
Name = x.Name,
PathLink = x.PathLink
}).ToList();
HeadingInfo headingInfo = dataProvider.Heading.GetByPathLink(pathLink);
if (headingInfo != null) // если не нашел рубрику то показать все статьи
{
headingModel.ID = headingInfo.ID;
headingModel.Name = headingInfo.Name;
headingModel.PathLink = headingInfo.PathLink;
List <ArticleModel> articlesResults = dataProvider.Heading.ArticleByHeading(headingModel.ID)
.Select(x => new Models.ArticleModel()
{
ID = x.ID,
Name = x.Name,
Text = x.Text,
Author = x.Author,
DateCreate = x.DateCreate,
FileName = x.FileName
}).ToList();
headingModel.Articles = articlesResults;
}
else // если нашел рубрику то показать все статьи данной рубрикм
{
List <ArticleModel> articlesResults = dataProvider.Article.GetAll()
.Select(x => new Models.ArticleModel()
{
ID = x.ID,
Name = x.Name,
Text = x.Text,
Author = x.Author,
DateCreate = x.DateCreate,
FileName = x.FileName
}).ToList();
headingModel.Articles = articlesResults;
}
return(View(headingModel));
}
public string GetUsage()
{
var versionInfo = FileVersionInfo.GetVersionInfo(Assembly.GetExecutingAssembly().Location);
// AssemblyCopyrightAttribute asmcpy = (AssemblyCopyrightAttribute)Attribute.GetCustomAttribute(Assembly.GetExecutingAssembly(), typeof(AssemblyCopyrightAttribute));
//ヘッダーの設定
HeadingInfo head = new HeadingInfo(versionInfo.ProductName, "Version " + versionInfo.ProductVersion);
HelpText help = new HelpText(head);
help.Copyright = new CopyrightInfo("T. Minemoto", 2010);
help.AddPreOptionsLine("University of Hyogo, Research Group of Fundamental Computer Engineering");
help.AddPreOptionsLine("Usage: MorphExtractroCL.exe -i D:\\input -o out -b 123");
//全オプションを表示(1行間隔)
help.AdditionalNewLineAfterOption = false;
help.AddOptions(this);
return(help.ToString());
}
static void Main(string[] args)
{
var ass = Assembly.GetExecutingAssembly();
var fvi = FileVersionInfo.GetVersionInfo(ass.Location);
var Heading = new HeadingInfo(fvi.FileDescription, ass.GetName().Version.ToString());
var Copyright = new CopyrightInfo(fvi.CompanyName, DateTime.Today.Year);
Parser.Default.ParseArguments <Options>(args).WithParsed(o =>
{
Console.WriteLine(Heading.ToString());
Console.WriteLine(Copyright.ToString());
Console.WriteLine();
if (!string.IsNullOrEmpty(o.Excludelist) && File.Exists(o.Excludelist))
{
partitions = new List <string>(File.ReadAllLines(o.Excludelist)).ToArray();
}
ulong eMMCDumpSize;
ulong SectorSize = 0x200;
if (o.ImgFile.ToLower().Contains(@"\\.\physicaldrive"))
{
Logging.Log("Tool is running in Device Dump mode.");
Logging.Log("Gathering disk geometry...");
eMMCDumpSize = (ulong)GetDiskSize.GetDiskLength(@"\\.\PhysicalDrive" + o.ImgFile.ToLower().Replace(@"\\.\physicaldrive", ""));
SectorSize = (ulong)GetDiskSize.GetDiskSectorSize(@"\\.\PhysicalDrive" + o.ImgFile.ToLower().Replace(@"\\.\physicaldrive", ""));
}
else
{
Logging.Log("Tool is running in Image Dump mode.");
Logging.Log("Gathering disk image geometry...");
eMMCDumpSize = (ulong)new FileInfo(o.ImgFile).Length;
}
Logging.Log("Reported source device eMMC size is: " + eMMCDumpSize + " bytes - " + eMMCDumpSize / 1024 / 1024 + "MB - " + eMMCDumpSize / 1024 / 1024 / 1024 + "GB.");
Logging.Log("Selected " + SectorSize + "B for the sector size");
ConvertDD2VHD(o.ImgFile, o.VhdFile, partitions, o.Recovery, (int)SectorSize);
});
}
public Options(HeadingInfo headingInfo)
{
_headingInfo = headingInfo;
}
private static HelpText GetHelpText(ParserResult <object> parserResult)
{
var headingInfo = new HeadingInfo("OctopusPuppet.cmd", FileVersion);
var copyRightInfo = new CopyrightInfo(true, CompanyName, GetCopyrightStartYear, GetCopyrightEndYear);
var helpText = new HelpText(headingInfo, copyRightInfo)
{
AddEnumValuesToHelpText = true
}
.AddOptions(parserResult)
.AddVerbs(typeof(BranchDeploymentOptions), typeof(MirrorEnvironmentOptions), typeof(RedploymentOptions), typeof(DeployOptions))
.AddPostOptionsLine("EXAMPLE USAGE: ")
.AddPostOptionsLine(" OctopusPuppet.Cmd BranchDeployment")
.AddPostOptionsLine(" --OctopusUrl \"http://octopus.test.com/\"")
.AddPostOptionsLine(" --OctopusApiKey \"API-HAAAS4MM6YBBSAIQVVHCQQUEA0\"")
.AddPostOptionsLine(" --TargetEnvironment \"Development\"")
.AddPostOptionsLine(" --Branch \"Master\"")
.AddPostOptionsLine(" [--ComponentFilterPath \"componentFilter.json\"]")
.AddPostOptionsLine(" [--ComponentFilter \"Component filter json base64 encoded\"]")
.AddPostOptionsLine(" [--Deploy]")
.AddPostOptionsLine(" [--DoNotUseDifferentialDeployment]")
.AddPostOptionsLine(" [--UpdateVariables]")
.AddPostOptionsLine(" [--EnvironmentDeploymentPath \"environmentDeployment.json\"]")
.AddPostOptionsLine(" [--MaximumParallelDeployments 4]")
.AddPostOptionsLine(" [--HideDeploymentProgress]")
.AddPostOptionsLine("")
.AddPostOptionsLine(" OctopusPuppet.Cmd MirrorEnvironment")
.AddPostOptionsLine(" --OctopusUrl \"http://octopus.test.com/\"")
.AddPostOptionsLine(" --OctopusApiKey \"API-HAAAS4MM6YBBSAIQVVHCQQUEA0\"")
.AddPostOptionsLine(" --SourceEnvironment \"Development\"")
.AddPostOptionsLine(" --TargetEnvironment \"Test\"")
.AddPostOptionsLine(" [--ComponentFilterPath \"componentFilter.json\"]")
.AddPostOptionsLine(" [--ComponentFilter \"Component filter json base64 encoded\"]")
.AddPostOptionsLine(" [--Deploy]")
.AddPostOptionsLine(" [--DoNotUseDifferentialDeployment]")
.AddPostOptionsLine(" [--UpdateVariables]")
.AddPostOptionsLine(" [--EnvironmentDeploymentPath \"environmentDeployment.json\"]")
.AddPostOptionsLine(" [--MaximumParallelDeployments 4]")
.AddPostOptionsLine(" [--HideDeploymentProgress]")
.AddPostOptionsLine("")
.AddPostOptionsLine(" OctopusPuppet.Cmd Redeployment")
.AddPostOptionsLine(" --OctopusUrl \"http://octopus.test.com/\"")
.AddPostOptionsLine(" --OctopusApiKey \"API-HAAAS4MM6YBBSAIQVVHCQQUEA0\"")
.AddPostOptionsLine(" --TargetEnvironment \"Development\"")
.AddPostOptionsLine(" [--ComponentFilterPath \"componentFilter.json\"]")
.AddPostOptionsLine(" [--ComponentFilter \"Component filter json base64 encoded\"]")
.AddPostOptionsLine(" [--Deploy]")
.AddPostOptionsLine(" [--UpdateVariables]")
.AddPostOptionsLine(" [--EnvironmentDeploymentPath \"environmentDeployment.json\"]")
.AddPostOptionsLine(" [--MaximumParallelDeployments 4]")
.AddPostOptionsLine(" [--HideDeploymentProgress]")
.AddPostOptionsLine("")
.AddPostOptionsLine(" OctopusPuppet.Cmd Deploy")
.AddPostOptionsLine(" --OctopusUrl \"http://octopus.test.com/\"")
.AddPostOptionsLine(" --OctopusApiKey \"API-HAAAS4MM6YBBSAIQVVHCQQUEA0\"")
.AddPostOptionsLine(" --EnvironmentDeploymentPath \"environmentDeployment.json\"")
.AddPostOptionsLine(" --TargetEnvironment \"Development\"")
.AddPostOptionsLine(" [--MaximumParallelDeployments 4]")
.AddPostOptionsLine(" [--HideDeploymentProgress]")
.AddPostOptionsLine("");
HelpText.DefaultParsingErrorsHandler(parserResult, helpText);
return(helpText);
}
static void Main(string[] args)
{
//Parse command line arguments
CommandLineOptions opts = new CommandLineOptions();
var result = Parser.Default.ParseArguments <CommandLineOptions>(args).WithParsed(parsed => opts = parsed);
var title = new HeadingInfo("CobaltStrikeScan");
// Option Processes -p
if (opts.Processes)
{
Console.ForegroundColor = ConsoleColor.Yellow;
Console.WriteLine("Scanning processes for injected threads");
Console.ResetColor();
List <InjectedThread> injectedThreads = GetInjectedThreads.GetInjectedThreads.InjectedThreads();
foreach (InjectedThread injectedThread in injectedThreads)
{
// Output Thread details to console
OutputInjectedThreadToConsole(injectedThread, opts.Verbose);
// Check if option set for dumping process memory
if (opts.Dump)
{
injectedThread.WriteBytesToFile();
}
// Scan process memory for injected thread
Console.ForegroundColor = ConsoleColor.Yellow;
Console.WriteLine("Scanning injected thread for CobaltStrike beacon");
Console.ResetColor();
Dictionary <string, ulong> beaconMatchOffsets = CobaltStrikeScan.YaraScanBytes(injectedThread.ProcessBytes);
if (beaconMatchOffsets.Count > 0)
{
Beacon beacon = GetBeaconFromYaraScan(beaconMatchOffsets, injectedThread.ProcessBytes);
if (beacon != null)
{
beacon.OutputToConsole();
}
}
else
{
Console.WriteLine("Couldn't find CobaltStrike beacon in injected thread");
}
}
}
// User supplied File option -f
else if (!string.IsNullOrEmpty(opts.File))
{
if (File.Exists(opts.File))
{
Dictionary <string, ulong> beaconMatchOffsets = CobaltStrikeScan.YaraScanFile(opts.File);
if (beaconMatchOffsets.Count > 0)
{
byte[] fileBytes = File.ReadAllBytes(opts.File);
Beacon beacon = GetBeaconFromYaraScan(beaconMatchOffsets, fileBytes);
if (beacon != null)
{
beacon.OutputToConsole();
}
}
else
{
Console.WriteLine("Couldn't find CobaltStrike beacon in file");
}
}
else
{
Console.ForegroundColor = ConsoleColor.Red;
Console.WriteLine($"File doesn't exist: {opts.File}\nExiting...");
Console.ResetColor();
System.Environment.Exit(1);
}
}
else if (opts.InjectedThreads)
{
Console.ForegroundColor = ConsoleColor.Yellow;
Console.WriteLine("Scanning processes for injected threads\n");
Console.ResetColor();
List <InjectedThread> injectedThreads = GetInjectedThreads.GetInjectedThreads.InjectedThreads();
foreach (InjectedThread injectedThread in injectedThreads)
{
// Output Thread details to console
OutputInjectedThreadToConsole(injectedThread, opts.Verbose);
// Check if option set for dumping process memory
if (opts.Dump)
{
injectedThread.WriteBytesToFile();
}
}
}
else if (opts.Help)
{
Console.WriteLine(HelpText.AutoBuild(result, h => h, e => e));
}
else
{
Console.WriteLine(HelpText.AutoBuild(result, h => h, e => e));
}
}
