mirror of
https://github.com/snovvcrash/usbrip.git
synced 2024-05-21 14:36:03 +02:00
v2.2.1: Random ID generation for empty auth.json
This commit is contained in:
Sam Fre3side
parent
8f3a161755
commit
b7872cda24
26
README.md
26
README.md
|
|
@ -5,8 +5,8 @@
|
|||
----------
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/snovvcrash/usbrip/blob/master/usbrip/__init__.py#L24"><img src="https://img.shields.io/badge/GitHub%20ver-2.2.0%E2%80%901-success.svg?logo=github&logoColor=white" alt="github-version.svg" /></a>
|
||||
<a href="https://pypi.org/project/usbrip/#history"><img src="https://img.shields.io/badge/PyPI%20ver-2.2.0%E2%80%901-3775a9.svg?logo=pypi&logoColor=white" alt="pypi-version.svg" /></a>
|
||||
<a href="https://github.com/snovvcrash/usbrip/blob/master/usbrip/__init__.py#L24"><img src="https://img.shields.io/badge/GitHub%20ver-2.2.1%E2%80%901-success.svg?logo=github&logoColor=white" alt="github-version.svg" /></a>
|
||||
<a href="https://pypi.org/project/usbrip/#history"><img src="https://img.shields.io/badge/PyPI%20ver-2.2.1%E2%80%901-3775a9.svg?logo=pypi&logoColor=white" alt="pypi-version.svg" /></a>
|
||||
<a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/Python-3.6-3776ab.svg?logo=python&logoColor=white" alt="python-version.svg" /></a>
|
||||
<a href="https://raw.githubusercontent.com/snovvcrash/usbrip/master/LICENSE"><img src="https://img.shields.io/badge/License-GPLv3-blue.svg" alt="license.svg" /></a>
|
||||
<a href="https://blackarch.org/forensic.html"><img src="https://img.shields.io/badge/BlackArch-Linux-b40000.svg?logo=arch-linux" alt="arch-linux.svg" /></a>
|
||||
|
|
@ -47,7 +47,7 @@ Description
|
|||
Besides, it also can:
|
||||
|
||||
* export collected information as a JSON dump (and open such dumps, of course);
|
||||
* generate a list of authorized (*trusted*) USB devices as a JSON (call it `auth.json`);
|
||||
* generate a list of authorized *(trusted)* USB devices as a JSON (call it `auth.json`);
|
||||
* search for "violation events" based on the `auth.json`: show (or generate another JSON with) USB devices that do appear in history and do NOT appear in the `auth.json`;
|
||||
* *\*when installed with `-s` flag\** create crypted storages (7zip archives) to automatically backup and accumulate USB events with the help of `crontab` scheduler;
|
||||
* search additional details about a specific USB device based on its VID and/or PID.
|
||||
|
|
@ -210,8 +210,6 @@ To install usbrip use:
|
|||
* When `-l` switch is enabled, Python dependencies are resolved from local .tar packages (`./3rdPartyTools/`) instead of PyPI.
|
||||
* When `-s` switch is enabled, not only the usbrip project is installed, but also the list of trusted USB devices, history and violations storages are created.
|
||||
|
||||
:alien: **Note:** when using `-s` option during installation, make sure that system logs do contain **at least one external** USB device entry. It is a necessary condition for usbrip to successfully create the list of trusted devices (and as a result, successfully create the violations storage).
|
||||
|
||||
After the installation completes, feel free to remove the `~/usbrip` folder.
|
||||
|
||||
### Paths
|
||||
|
|
@ -268,7 +266,7 @@ Get USB event history.
|
|||
$ sudo usbrip events open <DUMP.JSON> [-t | -l] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [-c <COLUMN> [<COLUMN> ...]] [-f <FILE> [<FILE> ...]] [-q] [--debug]
|
||||
Open USB event dump.
|
||||
|
||||
$ sudo usbrip events gen_auth <OUT_AUTH.JSON> [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [-f <FILE> [<FILE> ...]] [-q] [--debug]
|
||||
$ sudo usbrip events genauth <OUT_AUTH.JSON> [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [-f <FILE> [<FILE> ...]] [-q] [--debug]
|
||||
Generate a list of trusted (authorized) USB devices.
|
||||
|
||||
$ sudo usbrip events violations <IN_AUTH.JSON> [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-t | -l] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [-c <COLUMN> [<COLUMN> ...]] [-f <FILE> [<FILE> ...]] [-q] [--debug]
|
||||
|
|
@ -282,10 +280,10 @@ List contents of the selected storage. STORAGE_TYPE is "history" or "violations"
|
|||
$ sudo usbrip storage open <STORAGE_TYPE> [-t | -l] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [-c <COLUMN> [<COLUMN> ...]] [-q] [--debug]
|
||||
Open selected storage. Behaves similary to the EVENTS OPEN submodule.
|
||||
|
||||
$ sudo usbrip storage update <STORAGE_TYPE> [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [--lvl <COMPRESSION_LEVEL>] [-q] [--debug]
|
||||
$ sudo usbrip storage update <STORAGE_TYPE> [IN_AUTH.JSON] [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [--lvl <COMPRESSION_LEVEL>] [-q] [--debug]
|
||||
Update storage -- add USB events to the existing storage. COMPRESSION_LEVEL is a number in [0..9].
|
||||
|
||||
$ sudo usbrip storage create <STORAGE_TYPE> [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [--lvl <COMPRESSION_LEVEL>] [-q] [--debug]
|
||||
$ sudo usbrip storage create <STORAGE_TYPE> [IN_AUTH.JSON] [-a <ATTRIBUTE> [<ATTRIBUTE> ...]] [-e] [-n <NUMBER_OF_EVENTS>] [-d <DATE> [<DATE> ...]] [--host <HOST> [<HOST> ...]] [--vid <VID> [<VID> ...]] [--pid <PID> [<PID> ...]] [--prod <PROD> [<PROD> ...]] [--manufact <MANUFACT> [<MANUFACT> ...]] [--serial <SERIAL> [<SERIAL> ...]] [--port <PORT> [<PORT> ...]] [--lvl <COMPRESSION_LEVEL>] [-q] [--debug]
|
||||
Create storage -- create 7zip archive and add USB events to it according to the selected options.
|
||||
|
||||
$ sudo usbrip storage passwd <STORAGE_TYPE> [--lvl <COMPRESSION_LEVEL>] [-q] [--debug]
|
||||
|
|
@ -326,13 +324,13 @@ Examples
|
|||
* Show the event history of all USB devices, supressing banner output, info messages and user interaction (`-q`, `--quiet`), represented as a list (`-l`, `--list`) with latest 100 entries (`-n NUMBER`, `--number NUMBER`):
|
||||
|
||||
```
|
||||
~$ usbrip events history -ql -n 100
|
||||
~$ sudo usbrip events history -ql -n 100
|
||||
```
|
||||
|
||||
* Show the event history of the external USB devices (`-e`, `--external`, which were *actually* disconnected) represented as a table (`-t`, `--table`) containing "Connected", "VID", "PID", "Disconnected" and "Serial Number" columns (`-c COLUMN [COLUMN ...]`, `--column COLUMN [COLUMN ...]`) filtered by date (`-d DATE [DATE ...]`, `--date DATE [DATE ...]`) and PID (`--pid <PID> [<PID> ...]`) with logs taken from the outer files (`-f FILE [FILE ...]`, `--file FILE [FILE ...]`):
|
||||
|
||||
```
|
||||
~$ usbrip events history -et -c conn vid pid disconn serial -d '1995-09-15' '2018-07-01' --pid 1337 -f /var/log/syslog.1 /var/log/syslog.2.gz
|
||||
~$ sudo usbrip events history -et -c conn vid pid disconn serial -d '1995-09-15' '2018-07-01' --pid 1337 -f /var/log/syslog.1 /var/log/syslog.2.gz
|
||||
```
|
||||
|
||||
:alien: **Note:** there is a thing to remember when working with filters. There are 4 types of filtering available: only *external* USB events (devices that can be pulled out easily, `-e`); *by date* (`-d`); *by fields* (`--host`, `--vid`, `--pid`, `--product`, `--manufact`, `--serial`, `--port`) and *by number of entries* you get as the output (`-n`). When applying different filters simultaneously, you will get the following behaviour: firstly, *external* and *by date* filters are applied, then usbrip will search for specified *field* values in the intersection of the last two filters, and in the end it will cut the output to the *number* you defined with the `-n` option. So think of it as an **intersection** for *external* and *by date* filtering and **union** for *by fields* filtering. Hope it makes sense.
|
||||
|
|
@ -340,7 +338,7 @@ Examples
|
|||
* Build the event history of all USB devices and redirect the output to a file for further analysis. When the output stream is NOT terminal stdout (`|` or `>` for example) there would be no ANSI escape characters (color) in the output so feel free to use it that way. Also notice that usbrip uses some UNICODE symbols so it would be nice to convert the resulting file to UTF-8 encoding (with `encov` for example) as well as change newline characters to Windows style for portability (with `awk` for example):
|
||||
|
||||
```
|
||||
~$ usbrip history events -t | awk '{ sub("$", "\r"); print }' > usbrip.out && enconv -x UTF8 usbrip.out
|
||||
~$ sudo usbrip history events -t | awk '{ sub("$", "\r"); print }' > usbrip.out && enconv -x UTF8 usbrip.out
|
||||
```
|
||||
|
||||
*Remark*: you can always get rid of the escape characters by yourself even if you have already got the output to stdout. To do that just copy the output data to `usbrip.out` and add one more `awk` instruction:
|
||||
|
|
@ -352,15 +350,15 @@ Examples
|
|||
* Generate a list of trusted USB devices as a JSON-file (`trusted/auth.json`) with "VID" and "PID" attributes containing the first *three* devices connected on November 30, 1984:
|
||||
|
||||
```
|
||||
~$ usbrip events gen_auth trusted/auth.json -a vid pid -n 3 -d '1984-11-30'
|
||||
~$ sudo usbrip events genauth trusted/auth.json -a vid pid -n 3 -d '1984-11-30'
|
||||
```
|
||||
|
||||
:warning: **Warning:** there are cases when different USB flash drives might have identical serial numbers. This could happen as a result of a [manufacturing error](https://forums.anandtech.com/threads/changing-creating-a-custom-serial-id-on-a-flash-drive-low-level-blocks.2099116/) or just some black hats were able to rewrite the drive's memory chip which turned out to be non-one-time programmable and so on... Anyways, *«No system is safe»*. usbrip **does not** handle such cases in a smart way so far, namely it will treat a pair of devices with identical SNs (if there exists one) as the same device regarding to the trusted device list and `gen_auth` module.
|
||||
:warning: **Warning:** there are cases when different USB flash drives might have identical serial numbers. This could happen as a result of a [manufacturing error](https://forums.anandtech.com/threads/changing-creating-a-custom-serial-id-on-a-flash-drive-low-level-blocks.2099116/) or just some black hats were able to rewrite the drive's memory chip which turned out to be non-one-time programmable and so on... Anyways, *"No system is safe"*. usbrip **does not** handle such cases in a smart way so far, namely it will treat a pair of devices with identical SNs (if there exists one) as the same device regarding to the trusted device list and `genauth` module.
|
||||
|
||||
* Search the event history of the external USB devices for violations based on the list of trusted USB devices (`trusted/auth.json`) by "PID" attribute, restrict resulting events to those which have "Bob-PC" as a hostname, "EvilUSBManufacturer" as a manufacturer, "0123456789" as a serial number and represent the output as a table with "Connected", "VID" and "PID" columns:
|
||||
|
||||
```
|
||||
~$ usbrip events violations trusted/auth.json -a pid -et --host Bob-PC --manufact EvilUSBManufacturer --serial 0123456789 -c conn vid pid
|
||||
~$ sudo usbrip events violations trusted/auth.json -a pid -et --host Bob-PC --manufact EvilUSBManufacturer --serial 0123456789 -c conn vid pid
|
||||
```
|
||||
|
||||
* Search for details about a specific USB device by its VID (`--vid VID`) and PID (`--pid PID`):
|
||||
|
|
|
|||
|
|
@ -31,8 +31,19 @@ along with usbrip. If not, see <http://www.gnu.org/licenses/>.
|
|||
|
||||
shopt -s expand_aliases
|
||||
|
||||
# --------------- Check for root privileges ----------------
|
||||
|
||||
if [[ "${EUID}" -ne 0 ]]; then
|
||||
/usr/bin/printf "${R}>>>>${NC} Please run as root:\nsudo -H %s [-l/--local] [-s/--storages]\n" "${0}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ----------------------- Constants ------------------------
|
||||
|
||||
if [[ -z "${SUDO_USER}" ]]; then
|
||||
SUDO_USER="root"
|
||||
fi
|
||||
|
||||
USER_HOME=`getent passwd ${SUDO_USER} | cut -d: -f6`
|
||||
CONFIG="${USER_HOME}/.config/usbrip"
|
||||
|
||||
|
|
@ -69,16 +80,9 @@ create_directory() {
|
|||
|
||||
alias createHistoryStorage="${OPT}/venv/bin/usbrip storage create history -e"
|
||||
|
||||
alias generateAuthorizedDeviceList="${OPT}/venv/bin/usbrip events gen_auth -e -a vid pid"
|
||||
alias generateAuthorizedDeviceList="${OPT}/venv/bin/usbrip events genauth /var/opt/usbrip/trusted/auth.json -e -a vid pid"
|
||||
|
||||
alias createViolationsStorage="${OPT}/venv/bin/usbrip storage create violations -e -a vid pid"
|
||||
|
||||
# --------------- Check for root privileges ----------------
|
||||
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
/usr/bin/printf "${R}>>>>${NC} Please run as root:\nsudo %s\n" "${0}"
|
||||
exit 1
|
||||
fi
|
||||
alias createViolationsStorage="${OPT}/venv/bin/usbrip storage create violations /var/opt/usbrip/trusted/auth.json -e -a vid pid"
|
||||
|
||||
# -------------------- Handle switches ---------------------
|
||||
|
||||
|
|
@ -107,7 +111,7 @@ if ! /usr/bin/dpkg-query -W -f='${Status}' python3-venv 2>&1 | /bin/grep "ok ins
|
|||
select YN in "Yes" "No"; do
|
||||
case ${YN} in
|
||||
"Yes" )
|
||||
$(which apt) install "python3-venv" -y
|
||||
apt install "python3-venv" -y
|
||||
break
|
||||
;;
|
||||
"No" )
|
||||
|
|
@ -125,7 +129,7 @@ if ! /usr/bin/dpkg-query -W -f='${Status}' p7zip-full 2>&1 | /bin/grep "ok insta
|
|||
select YN in "Yes" "No"; do
|
||||
case ${YN} in
|
||||
"Yes" )
|
||||
$(which apt) install "p7zip-full" -y
|
||||
apt install "p7zip-full" -y
|
||||
break
|
||||
;;
|
||||
"No" )
|
||||
|
|
@ -193,17 +197,17 @@ echo
|
|||
|
||||
# ----------------------- Copy files -----------------------
|
||||
|
||||
if /usr/bin/cp "${PWD}/usbrip/usb_ids/usb.ids" "${USER_HOME}/.config/usbrip/usb.ids"; then
|
||||
if cp "${PWD}/usbrip/usb_ids/usb.ids" "${USER_HOME}/.config/usbrip/usb.ids"; then
|
||||
/usr/bin/printf "${G}>>>>${NC} Successfully copied usb.ids database\n\n"
|
||||
else
|
||||
/usr/bin/printf "${R}>>>>${NC} Failed copy usb.ids database\n"
|
||||
/usr/bin/printf "${R}>>>>${NC} Failed to copy usb.ids database\n"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if /usr/bin/cp "${PWD}/usbrip/cron/usbrip.cron" "${USER_HOME}/.config/usbrip/usbrip.cron"; then
|
||||
if cp "${PWD}/usbrip/cron/usbrip.cron" "${USER_HOME}/.config/usbrip/usbrip.cron"; then
|
||||
/usr/bin/printf "${G}>>>>${NC} Successfully copied usbrip cron job example\n\n"
|
||||
else
|
||||
/usr/bin/printf "${R}>>>>${NC} Failed copy usbrip cron job example\n"
|
||||
/usr/bin/printf "${R}>>>>${NC} Failed to copy usbrip cron job example\n"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
|
@ -233,7 +237,7 @@ if ${STORAGES}; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
# Gen Auth
|
||||
# GenAuth
|
||||
|
||||
/usr/bin/printf "${W}>>>>${NC} Generating authorized device list\n"
|
||||
|
||||
|
|
|
|||
|
|
@ -29,8 +29,19 @@ along with usbrip. If not, see <http://www.gnu.org/licenses/>.
|
|||
|
||||
# Usage: sudo bash installers/uninstall.sh [-a/--all]
|
||||
|
||||
# --------------- Check for root privileges ----------------
|
||||
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
/usr/bin/printf "${R}>>>>${NC} Please run as root:\nsudo %s [-a/--all]\n" "${0}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ----------------------- Constants ------------------------
|
||||
|
||||
if [[ -z "${SUDO_USER}" ]]; then
|
||||
SUDO_USER="root"
|
||||
fi
|
||||
|
||||
USER_HOME=`getent passwd ${SUDO_USER} | cut -d: -f6`
|
||||
CONFIG="${USER_HOME}/.config/usbrip"
|
||||
|
||||
|
|
@ -50,13 +61,6 @@ remove_directory() {
|
|||
fi
|
||||
}
|
||||
|
||||
# --------------- Check for root privileges ----------------
|
||||
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
/usr/bin/printf "${R}>>>>${NC} Please run as root:\nsudo %s\n" "${0}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# -------------------- Handle switches ---------------------
|
||||
|
||||
if [[ "$1" == "-a" ]] || [[ "$1" == "--all" ]]; then
|
||||
|
|
|
|||
|
|
@ -21,4 +21,4 @@ You should have received a copy of the GNU General Public License
|
|||
along with usbrip. If not, see <http://www.gnu.org/licenses/>.
|
||||
"""
|
||||
|
||||
__version__ = '2.2.0-1'
|
||||
__version__ = '2.2.1-1'
|
||||
|
|
|
|||
|
|
@ -106,9 +106,9 @@ def main():
|
|||
repres=repres
|
||||
)
|
||||
|
||||
# ------------------ USB Events Gen Auth -------------------
|
||||
# ------------------ USB Events GenAuth -------------------
|
||||
|
||||
elif args.ue_subparser == 'gen_auth':
|
||||
elif args.ue_subparser == 'genauth':
|
||||
timing.begin()
|
||||
ue = USBEvents(args.file)
|
||||
if ue:
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
0 */4 * * * usbrip storage update history -e 2>&1 | tee /var/opt/usbrip/log/$(date "+\%FT\%H\%M\%S").log > /dev/null 2>&1
|
||||
|
||||
# Update USB violation events every 4 hours
|
||||
0 */4 * * * usbrip storage update violations -i /var/opt/usbrip/trusted/auth.json -a vid pid -e 2>&1 | tee /var/opt/usbrip/log/$(date "+\%FT\%H\%M\%S").log > /dev/null 2>&1
|
||||
0 */4 * * * usbrip storage update violations /var/opt/usbrip/trusted/auth.json -a vid pid -e 2>&1 | tee /var/opt/usbrip/log/$(date "+\%FT\%H\%M\%S").log > /dev/null 2>&1
|
||||
|
|
|
|||
|
|
@ -48,6 +48,7 @@ from collections import OrderedDict, defaultdict
|
|||
from string import printable
|
||||
from subprocess import check_output
|
||||
from io import StringIO
|
||||
from random import randint
|
||||
|
||||
from terminaltables import AsciiTable, SingleTable
|
||||
from termcolor import colored, cprint
|
||||
|
|
@ -94,24 +95,30 @@ class USBEvents:
|
|||
# child_env['LANG'] = 'en_US.utf-8'
|
||||
# journalctl_out = check_output(['journalctl'], env=child_env).decode('utf-8')
|
||||
|
||||
journalctl_out = check_output([
|
||||
'journalctl',
|
||||
'-o',
|
||||
'short-iso-precise'
|
||||
]).decode('utf-8')
|
||||
try:
|
||||
journalctl_out = check_output([
|
||||
'journalctl',
|
||||
'-o',
|
||||
'short-iso-precise'
|
||||
]).decode('utf-8')
|
||||
|
||||
if '-- Logs begin at' in journalctl_out:
|
||||
print_info('Successfully runned journalctl')
|
||||
|
||||
filtered_history = _read_log_file(
|
||||
None,
|
||||
log=StringIO(journalctl_out),
|
||||
total=journalctl_out.count('\n')+1
|
||||
)
|
||||
except Exception as e:
|
||||
print_warning(f'Failed to run journalctl: {str(e)}')
|
||||
filtered_history = _get_filtered_history()
|
||||
|
||||
else:
|
||||
print_warning('Failed to run journalctl')
|
||||
filtered_history = _get_filtered_history()
|
||||
if '-- Logs begin at' in journalctl_out:
|
||||
print_info('Successfully runned journalctl')
|
||||
|
||||
filtered_history = _read_log_file(
|
||||
None,
|
||||
log=StringIO(journalctl_out),
|
||||
total=journalctl_out.count('\n')
|
||||
)
|
||||
|
||||
else:
|
||||
print_warning(f'An error occured when running journalctl: {journalctl_out}')
|
||||
filtered_history = _get_filtered_history()
|
||||
|
||||
except USBRipError as e:
|
||||
print_critical(str(e), initial_error=e.errors['initial_error'])
|
||||
|
|
@ -186,14 +193,26 @@ class USBEvents:
|
|||
|
||||
_represent_events(events_to_show, columns, table_data, 'USB-Event-Dump', repres)
|
||||
|
||||
# ------------------ USB Events Gen Auth -------------------
|
||||
# ------------------ USB Events GenAuth -------------------
|
||||
|
||||
@time_it_if_debug(cfg.DEBUG, time_it)
|
||||
def generate_auth_json(self, output_auth, attributes, *, indent=4, sieve=None):
|
||||
self._events_to_show = _filter_events(self._all_events, sieve)
|
||||
if not self._events_to_show:
|
||||
print_info('No USB devices found!')
|
||||
return 1
|
||||
|
||||
rand_id = f'usbrip-{randint(1000, 9999)}'
|
||||
self._events_to_show += [{
|
||||
'conn': rand_id,
|
||||
'host': rand_id,
|
||||
'vid': rand_id,
|
||||
'pid': rand_id,
|
||||
'prod': rand_id,
|
||||
'manufact': rand_id,
|
||||
'serial': rand_id,
|
||||
'port': rand_id,
|
||||
'disconn': rand_id
|
||||
}]
|
||||
|
||||
abs_output_auth = os.path.abspath(output_auth)
|
||||
|
||||
|
|
@ -371,10 +390,10 @@ def _read_log_file(filename, log=None, total=None):
|
|||
|
||||
date = line[:32].strip()
|
||||
if date.count(':') == 3:
|
||||
date = ''.join(line[:32].rsplit(':', 1)) # rreplace(':', '', 1) to remove the last ':' from "2019-08-09T06:15:49.655261-04:00" timestamp if there is one
|
||||
date = ''.join(line[:32].rsplit(':', 1)) # rreplace(':', '', 1) to remove the last ':' from "1970-01-01T00:00:00.000000-00:00" timestamp if there is one
|
||||
|
||||
try:
|
||||
date = datetime.strptime(date, '%Y-%m-%dT%H:%M:%S.%f%z') # ex. "2019-08-09T06:15:49.655261-0400"
|
||||
date = datetime.strptime(date, '%Y-%m-%dT%H:%M:%S.%f%z') # ex. "1970-01-01T00:00:00.000000-0000"
|
||||
|
||||
except ValueError:
|
||||
# Case 2 -- Non-Modified Timestamp ("%b %d %H:%M:%S")
|
||||
|
|
|
|||
|
|
@ -135,12 +135,12 @@ def build_ueo_parser(subparsers):
|
|||
_parse_file_args(ueo_parser)
|
||||
|
||||
|
||||
# ------------------ USB Events Gen Auth -------------------
|
||||
# ------------------ USB Events GenAuth -------------------
|
||||
|
||||
|
||||
def build_ueg_parser(subparsers):
|
||||
ueg_parser = subparsers.add_parser(
|
||||
'gen_auth',
|
||||
'genauth',
|
||||
help='generate authorized device list (JSON)'
|
||||
)
|
||||
|
||||
|
|
@ -283,9 +283,9 @@ def build_usu_parser(subparsers):
|
|||
)
|
||||
|
||||
usu_parser.add_argument(
|
||||
'-i',
|
||||
'--input',
|
||||
'input',
|
||||
type=str,
|
||||
nargs='?',
|
||||
default='/var/opt/usbrip/trusted/auth.json',
|
||||
help='input path for the list of authorized devices'
|
||||
)
|
||||
|
|
@ -318,9 +318,9 @@ def build_usc_parser(subparsers):
|
|||
)
|
||||
|
||||
usc_parser.add_argument(
|
||||
'-i',
|
||||
'--input',
|
||||
'input',
|
||||
type=str,
|
||||
nargs='?',
|
||||
default='/var/opt/usbrip/trusted/auth.json',
|
||||
help='input path for the list of authorized devices'
|
||||
)
|
||||
|
|
|
|||
Loading…
Reference in New Issue