251 lines
8.7 KiB
Python
251 lines
8.7 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""
|
|
BootVerify.py - Boot Sector Insurance Verification Script
|
|
Verifies MBR, EFI, and WMI persistence for trojan infection
|
|
Uses Python libs, system tools, and BOOTICE.exe
|
|
"""
|
|
import os
|
|
import sys
|
|
import time
|
|
import subprocess
|
|
import datetime
|
|
import ctypes
|
|
import json
|
|
|
|
# ============ Configuration ============
|
|
WORK_DIR = r"C:\Windows-Mining-Trojan-Remover"
|
|
BOOTICE = os.path.join(WORK_DIR, "BOOTICE.exe")
|
|
REPORT_FILE = os.path.join(WORK_DIR, "BootVerify_Report.txt")
|
|
MBR_BACKUP = os.path.join(WORK_DIR, "MBR_backup.bin")
|
|
|
|
# Suspicious keywords for detection
|
|
SUSPICIOUS_KEYWORDS = [
|
|
'UT7ejTkn', 'WE93mndC', 'WpSJj0lv', 'YRbL1xSX', 'RuntimeHost', 'RuntimeTask',
|
|
'ScreenConnect', 'kryptex', 'gleeze', 'rasedy', 'lolMiner', 'SRBMiner',
|
|
'gminer', 'miniZ', 'Diagnostics.Client', 'SimpleRunPE', 'ccv', 'mzcv',
|
|
'Windows VC', 'proxies-peer', '15AB6CF5', 'B95EB893', '0AzjkAEd', '6E7B6FD3',
|
|
'TfuSTvhb', '5ghAHv', 'jHkYtN', 'zQM241sm', 'nAumBAO1', 'lw5ypO',
|
|
'P41H56Vb', 'KxDQmm', '8B86CBC', '2FA7F989', 'ABE94A11', 'SecurityHealthHost',
|
|
'Efficiently Achieve Analysis', 'productivity Deadlines Priority',
|
|
'Windows System Health', 'Workflow Contingency', 'Elevate Plans Interface',
|
|
]
|
|
|
|
|
|
def is_admin():
|
|
"""Check admin privileges"""
|
|
try:
|
|
if 'SYSTEM' in os.environ.get('USERNAME', '').upper():
|
|
return True, 'SYSTEM'
|
|
return ctypes.windll.shell32.IsUserAnAdmin() != 0, 'ADMIN'
|
|
except Exception:
|
|
return False, 'UNKNOWN'
|
|
|
|
|
|
def now():
|
|
return datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
|
|
|
|
|
|
def run_cmd(cmd, timeout=60):
|
|
try:
|
|
result = subprocess.run(cmd, shell=True, capture_output=True,
|
|
text=True, timeout=timeout, errors='ignore')
|
|
return result.stdout + result.stderr
|
|
except Exception as e:
|
|
return f"ERROR: {e}"
|
|
|
|
|
|
def log_write(f, section, content):
|
|
f.write(f"\n{'='*60}\n[{section}] - {now()}\n{'='*60}\n")
|
|
f.write(content + "\n")
|
|
f.flush()
|
|
|
|
|
|
# ============ 1. MBR Verification ============
|
|
|
|
def verify_mbr():
|
|
"""Verify MBR using BOOTICE"""
|
|
results = []
|
|
if not os.path.exists(BOOTICE):
|
|
return "BOOTICE not found, cannot verify MBR"
|
|
|
|
# Backup MBR
|
|
result = run_cmd(f'"{BOOTICE}" /DEVICE=0:0 /mbr /backup /file="{MBR_BACKUP}" /sectors=1 /quiet')
|
|
if os.path.exists(MBR_BACKUP):
|
|
results.append(f"MBR backup created: {MBR_BACKUP}")
|
|
# Read MBR content
|
|
try:
|
|
with open(MBR_BACKUP, 'rb') as f:
|
|
mbr = f.read()
|
|
results.append(f"MBR size: {len(mbr)} bytes")
|
|
# Check signature (last 2 bytes should be 55 AA)
|
|
if len(mbr) >= 2:
|
|
sig = mbr[-2:]
|
|
if sig == b'\x55\xAA':
|
|
results.append("MBR signature: 55 AA (VALID)")
|
|
else:
|
|
results.append(f"MBR signature: {sig.hex().upper()} (INVALID!)")
|
|
# Check partition table type (EE = GPT)
|
|
if len(mbr) >= 447:
|
|
pt_type = mbr[450] # First partition type at offset 450
|
|
if pt_type == 0xEE:
|
|
results.append("Partition table: GPT (EE type)")
|
|
elif pt_type == 0x00:
|
|
results.append("Partition table: Empty")
|
|
else:
|
|
results.append(f"Partition table type: 0x{pt_type:02X}")
|
|
# Check for suspicious boot code (first 446 bytes)
|
|
boot_code = mbr[:446]
|
|
if boot_code.count(b'\x00') > 400:
|
|
results.append("Boot code: Mostly empty (normal for GPT)")
|
|
else:
|
|
results.append("Boot code: Present (check for anomalies)")
|
|
except Exception as e:
|
|
results.append(f"MBR read error: {e}")
|
|
else:
|
|
results.append("MBR backup FAILED")
|
|
|
|
# Get disk info
|
|
result2 = run_cmd(f'"{BOOTICE}" /diskinfo /list /file="{WORK_DIR}\\diskinfo.txt" /quiet')
|
|
if os.path.exists(os.path.join(WORK_DIR, 'diskinfo.txt')):
|
|
with open(os.path.join(WORK_DIR, 'diskinfo.txt'), 'r', encoding='utf-8', errors='ignore') as f:
|
|
results.append("Disk info:\n" + f.read())
|
|
|
|
return '\n'.join(results)
|
|
|
|
|
|
# ============ 2. EFI Verification ============
|
|
|
|
def verify_efi():
|
|
"""Verify EFI boot entries and ESP content"""
|
|
results = []
|
|
|
|
# Check BCD boot entries
|
|
bcd = run_cmd('bcdedit /enum firmware')
|
|
results.append("=== BCD Firmware Boot Entries ===")
|
|
results.append(bcd)
|
|
|
|
# Check for suspicious boot entries
|
|
suspicious_entries = []
|
|
for line in bcd.split('\n'):
|
|
if 'description' in line.lower():
|
|
desc = line.split('description')[1].strip() if 'description' in line else ''
|
|
# Check for suspicious descriptions
|
|
for kw in SUSPICIOUS_KEYWORDS:
|
|
if kw.lower() in desc.lower():
|
|
suspicious_entries.append(f"Suspicious boot entry: {desc}")
|
|
if suspicious_entries:
|
|
results.append("\n=== SUSPICIOUS BOOT ENTRIES ===")
|
|
results.extend(suspicious_entries)
|
|
else:
|
|
results.append("\nNo suspicious boot entries found")
|
|
|
|
# Check ESP content
|
|
results.append("\n=== EFI System Partition Check ===")
|
|
# Try to find ESP and list EFI directory
|
|
ps_cmd = r'''
|
|
$esp = Get-Partition | Where-Object { $_.Type -eq 'EFI System Partition' }
|
|
if ($esp) {
|
|
$esp | Format-List DiskNumber,PartitionNumber,DriveLetter,Size
|
|
} else {
|
|
Write-Output "No ESP found"
|
|
}
|
|
'''
|
|
import base64
|
|
encoded = base64.b64encode(ps_cmd.encode('utf-16-le')).decode('ascii')
|
|
esp_info = run_cmd(f'powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand {encoded}')
|
|
results.append(esp_info)
|
|
|
|
return '\n'.join(results)
|
|
|
|
|
|
# ============ 3. WMI Verification ============
|
|
|
|
def verify_wmi():
|
|
"""Verify WMI persistence"""
|
|
results = []
|
|
|
|
# Check WMI event filters
|
|
filters = run_cmd('wmic /namespace:\\\\root\\subscription path __EventFilter get Name,Query')
|
|
results.append("=== WMI Event Filters ===")
|
|
results.append(filters)
|
|
|
|
# Check WMI event consumers (command line)
|
|
consumers = run_cmd('wmic /namespace:\\\\root\\subscription path CommandLineEventConsumer get Name,CommandLineTemplate')
|
|
results.append("\n=== WMI Command Line Consumers ===")
|
|
results.append(consumers if consumers.strip() else "No command line consumers")
|
|
|
|
# Check WMI event consumers (script)
|
|
script_consumers = run_cmd('wmic /namespace:\\\\root\\subscription path ActiveScriptEventConsumer get Name,ScriptText')
|
|
results.append("\n=== WMI Script Consumers ===")
|
|
results.append(script_consumers if script_consumers.strip() else "No script consumers")
|
|
|
|
# Check WMI bindings
|
|
bindings = run_cmd('wmic /namespace:\\\\root\\subscription path __FilterToConsumerBinding get Filter,Consumer')
|
|
results.append("\n=== WMI Filter to Consumer Bindings ===")
|
|
results.append(bindings)
|
|
|
|
# Analyze for suspicious
|
|
all_wmi = filters + consumers + script_consumers + bindings
|
|
suspicious = []
|
|
for kw in SUSPICIOUS_KEYWORDS:
|
|
if kw.lower() in all_wmi.lower():
|
|
suspicious.append(f"Suspicious WMI: {kw}")
|
|
if suspicious:
|
|
results.append("\n=== SUSPICIOUS WMI ===")
|
|
results.extend(suspicious)
|
|
else:
|
|
results.append("\nNo suspicious WMI persistence found")
|
|
|
|
return '\n'.join(results)
|
|
|
|
|
|
# ============ Main ============
|
|
|
|
def main():
|
|
print("=" * 60)
|
|
print("BootVerify - Boot Sector Insurance Verification")
|
|
print("Verifies MBR, EFI, and WMI persistence")
|
|
print("=" * 60)
|
|
|
|
# Check admin privileges
|
|
admin, priv_type = is_admin()
|
|
if not admin:
|
|
print("\n[ERROR] Insufficient privileges!")
|
|
print("Please run as Administrator or SYSTEM.")
|
|
input("Press Enter to exit...")
|
|
return
|
|
print(f"\n[OK] Running with {priv_type} privileges")
|
|
|
|
# Open report file
|
|
with open(REPORT_FILE, 'w', encoding='utf-8') as f:
|
|
f.write(f"BootVerify Report\nTime: {now()}\n")
|
|
f.write(f"System: {os.environ.get('COMPUTERNAME', 'Unknown')}\n")
|
|
|
|
# 1. MBR
|
|
print("\n[1/3] Verifying MBR...")
|
|
mbr_result = verify_mbr()
|
|
print(mbr_result)
|
|
log_write(f, "1. MBR Verification", mbr_result)
|
|
|
|
# 2. EFI
|
|
print("\n[2/3] Verifying EFI...")
|
|
efi_result = verify_efi()
|
|
print(efi_result[:2000])
|
|
log_write(f, "2. EFI Verification", efi_result)
|
|
|
|
# 3. WMI
|
|
print("\n[3/3] Verifying WMI...")
|
|
wmi_result = verify_wmi()
|
|
print(wmi_result[:2000])
|
|
log_write(f, "3. WMI Verification", wmi_result)
|
|
|
|
f.write(f"\n{'='*60}\nVerification Complete: {now()}\n")
|
|
|
|
print(f"\nReport saved: {REPORT_FILE}")
|
|
print("\nVerification complete!")
|
|
input("Press Enter to exit...")
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|