Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #1179751
Watch For PSP Popups
This guide is an example oh how to use the PSPPersonal Security Product (Anti-Virus) testing tools found in the AEDApplied Engineering Devision leafbag. The purpose of these classes are to give developers and testers a better idea as to what level of alert is made available to the user.
Step-by-step guide
We'll be filling this in later as we figure it out. This is a work in progress User #4194308 User #4194308
- Insert your steps.
- You can also copy and paste or drag and drop images into your instructions.
from abc import ABCMeta, abstractmethod
"""
PspBase
Abstract base class meant for use in PSPPersonal Security Product (Anti-Virus) verification in DART. This class outlines the four required functions
for all PSPPersonal Security Product (Anti-Virus) tests to implement. If a script can't implement a function due to limitations with the PSPPersonal Security Product (Anti-Virus) it must
return a failure case so the user won't get a false negative.
Another note, these tests all return True or False and should never cause an early end to a test.
"""
class PspBase(metaclass=ABCMeta):
@abstractmethod
def __init__(self, host):
""""
Standard constructor, but must implement some basic functionality.
:param host - references the host object of the machine running the PSPPersonal Security Product (Anti-Virus) being tested.
Requirements: The constructor must do the following:
1. Implement self.path_to_psp - full path to the psp exe to be interacted with
2. Populate self.base_line - log dump at the beginning of the test, to limit data being presented to the
user.
"""
pass
@abstractmethod
def run_static_scan(self, files_to_scan=[]):
"""
Kicks of a static scan for the PSP, will pass a list of files to scan to the scanner then parse the logs to see
if any hits occurred.
:param files_to_scan: List of full paths to desired files to scan
:return: True - Scan conducted, no issues to report
False - Something went wrong, should be treated as a failure case
"""
pass
@abstractmethod
def check_dynamic_logs(self, max_allowed_line_entries=5):
"""
Checks the logs generated by a PSPPersonal Security Product (Anti-Virus) and looks for anything of interest. This log will be compared with the log
file collected during initialization (so declaration should be the first part of any test, this the last part)
and checks the diff only. There are two types of failures, if a dirty word like CRITICAL THREAT DETECTED or
similar is found, or the log grew in size greater than max_allowed_line_entries.
:param max_allowed_line_entries: Maximum number of lines a log can grow before being considered a failure case
:return: True - No issues to report
False - Something went wrong, should be treated as a failure case
"""
pass
@abstractmethod
def psp_is_updated(self, max_days_since_update=14):
"""
Checks the PSPs logs to see if the product was updated within the time period set by max_days_since_update
:param max_days_since_update: Maximum number of days since a PSPPersonal Security Product (Anti-Virus) has been updated.
:return: True - No issues to report (PSPPersonal Security Product (Anti-Virus) has been updated recently)
False - Something went wrong, PSPPersonal Security Product (Anti-Virus) should be considered outdated
"""
passYou may also want to use visual panels to communicate related information, tips or things users need to be aware of.
Related articles
Related articles appear here based on the labels you select. Click to edit the macro and add or change labels.
('contentbylabel' missing)