Updated product_keys.py

This commit is contained in:
2Shirt 2018-12-27 20:07:18 -07:00
parent 72eac47524
commit 82a2d6b74d
Signed by: 2Shirt
GPG key ID: 152FAC923B0E132C

View file

@ -4,108 +4,110 @@ from functions.common import *
# Regex # Regex
REGEX_REGISTRY_DIRS = re.compile( REGEX_REGISTRY_DIRS = re.compile(
r'^(config$|RegBack$|System32$|Transfer|Win)', r'^(config$|RegBack$|System32$|Transfer|Win)',
re.IGNORECASE) re.IGNORECASE)
REGEX_SOFTWARE_HIVE = re.compile(r'^Software$', re.IGNORECASE) REGEX_SOFTWARE_HIVE = re.compile(r'^Software$', re.IGNORECASE)
def extract_keys(): def extract_keys():
"""Extract keys from provided hives and return a dict.""" """Extract keys from provided hives and return a dict."""
keys = {} keys = {}
# Extract keys # Extract keys
extract_item('ProduKey', silent=True) extract_item('ProduKey', silent=True)
for hive in find_software_hives(): for hive in find_software_hives():
cmd = [ cmd = [
global_vars['Tools']['ProduKey'], global_vars['Tools']['ProduKey'],
'/IEKeys', '0', '/IEKeys', '0',
'/WindowsKeys', '1', '/WindowsKeys', '1',
'/OfficeKeys', '1', '/OfficeKeys', '1',
'/ExtractEdition', '1', '/ExtractEdition', '1',
'/nosavereg', '/nosavereg',
'/regfile', hive, '/regfile', hive,
'/scomma', ''] '/scomma', '']
try: try:
out = run_program(cmd) out = run_program(cmd)
except subprocess.CalledProcessError: except subprocess.CalledProcessError:
# Ignore and return empty dict # Ignore and return empty dict
pass pass
else: else:
for line in out.stdout.decode().splitlines(): for line in out.stdout.decode().splitlines():
# Add key to keys under product only if unique # Add key to keys under product only if unique
tmp = line.split(',') tmp = line.split(',')
product = tmp[0] product = tmp[0]
key = tmp[2] key = tmp[2]
if product not in keys: if product not in keys:
keys[product] = [] keys[product] = []
if key not in keys[product]: if key not in keys[product]:
keys[product].append(key) keys[product].append(key)
# Done # Done
return keys return keys
def list_clientdir_keys(): def list_clientdir_keys():
"""List product keys found in hives inside the ClientDir.""" """List product keys found in hives inside the ClientDir."""
keys = extract_keys() keys = extract_keys()
key_list = [] key_list = []
if keys: if keys:
for product in sorted(keys): for product in sorted(keys):
key_list.append(product) key_list.append(product)
for key in sorted(keys[product]): for key in sorted(keys[product]):
key_list.append(' {key}'.format(key=key)) key_list.append(' {key}'.format(key=key))
else: else:
key_list.append('No keys found.') key_list.append('No keys found.')
return key_list return key_list
def find_software_hives(): def find_software_hives():
"""Search for transferred SW hives and return a list.""" """Search for transferred SW hives and return a list."""
hives = [] hives = []
search_paths = [global_vars['ClientDir']] search_paths = [global_vars['ClientDir']]
while len(search_paths) > 0: while len(search_paths) > 0:
for item in os.scandir(search_paths.pop(0)): for item in os.scandir(search_paths.pop(0)):
if item.is_dir() and REGEX_REGISTRY_DIRS.search(item.name): if item.is_dir() and REGEX_REGISTRY_DIRS.search(item.name):
search_paths.append(item.path) search_paths.append(item.path)
if item.is_file() and REGEX_SOFTWARE_HIVE.search(item.name): if item.is_file() and REGEX_SOFTWARE_HIVE.search(item.name):
hives.append(item.path) hives.append(item.path)
return hives return hives
def get_product_keys(): def get_product_keys():
"""List product keys from saved report.""" """List product keys from saved report."""
keys = [] keys = []
log_file = r'{LogDir}\Product Keys (ProduKey).txt'.format(**global_vars) log_file = r'{LogDir}\Product Keys (ProduKey).txt'.format(**global_vars)
with open (log_file, 'r') as f: with open (log_file, 'r') as f:
for line in f.readlines(): for line in f.readlines():
if re.search(r'^Product Name', line): if re.search(r'^Product Name', line):
line = re.sub(r'^Product Name\s+:\s+(.*)', r'\1', line.strip()) line = re.sub(r'^Product Name\s+:\s+(.*)', r'\1', line.strip())
keys.append(line) keys.append(line)
if keys: if keys:
return keys return keys
else: else:
return ['No product keys found'] return ['No product keys found']
def run_produkey(): def run_produkey():
"""Run ProduKey and save report in the ClientDir.""" """Run ProduKey and save report in the ClientDir."""
extract_item('ProduKey', silent=True) extract_item('ProduKey', silent=True)
log_file = r'{LogDir}\Product Keys (ProduKey).txt'.format(**global_vars) log_file = r'{LogDir}\Product Keys (ProduKey).txt'.format(**global_vars)
if not os.path.exists(log_file): if not os.path.exists(log_file):
# Clear current configuration # Clear current configuration
for config in ['ProduKey.cfg', 'ProduKey64.cfg']: for config in ['ProduKey.cfg', 'ProduKey64.cfg']:
config = r'{BinDir}\ProduKey\{config}'.format( config = r'{BinDir}\ProduKey\{config}'.format(
config=config, **global_vars) config=config, **global_vars)
try: try:
if os.path.exists(config): if os.path.exists(config):
os.remove(config) os.remove(config)
except Exception: except Exception:
pass pass
cmd = [ cmd = [
global_vars['Tools']['ProduKey'], global_vars['Tools']['ProduKey'],
'/nosavereg', '/nosavereg',
'/stext', '/stext',
log_file] log_file]
run_program(cmd, check=False) run_program(cmd, check=False)
if __name__ == '__main__': if __name__ == '__main__':
print("This file is not meant to be called directly.") print("This file is not meant to be called directly.")
# vim: sts=2 sw=2 ts=2