modules.auxiliary.recentfiles

Package modules :: Package auxiliary :: Module recentfiles |
[hide private]
[frames] | no frames]

# Source Code for Module modules.auxiliary.recentfiles

     1  # Copyright (C) 2016 Cuckoo Foundation.
     2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     3  # See the file 'docs/LICENSE' for copying permission.
     4
     5  import logging
     6  import os
     7  import random
     8
     9  from lib.common.abstracts import Auxiliary
    10  from lib.common.defines import SHELL32, SHARD_PATHA
    11  from lib.common.exceptions import CuckooError
    12  from lib.common.rand import random_string
    13  from lib.common.registry import set_regkey_full
    14
    15  log = logging.getLogger(__name__)
    16
    17 -class RecentFiles(Auxiliary):
    18      """Populates the Desktop with recent files in order to combat recent
    19      anti-sandbox measures."""
    20
    21      extensions = [
    22          "txt", "rtf", "doc", "docx", "docm", "ppt", "pptx",
    23      ]
    24
    25 -    def start(self):
    26          if "USERPROFILE" not in os.environ:
    27              raise CuckooError(
    28                  "Unable to populate recent files as the USERPROFILE "
    29                  "environment variable is missing."
    30              )
    31
    32          desktop = os.path.join(os.environ["USERPROFILE"], "Desktop")
    33
    34          for idx in xrange(random.randint(5, 10)):
    35              filename = random_string(10, random.randint(10, 20))
    36              ext = random.choice(self.extensions)
    37              filepath = os.path.join(desktop, "%s.%s" % (filename, ext))
    38              open(filepath, "wb").write(os.urandom(random.randint(30, 999999)))
    39
    40              SHELL32.SHAddToRecentDocs(SHARD_PATHA, filepath)
    41
    42              set_regkey_full(
    43                  "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\12.0\\"
    44                  "Word\\File MRU\\Item %d" % (idx + 1),
    45                  "REG_SZ", "[F00000000][T01D1C40000000000]*%s" % filepath,
    46              )
    47