[Autogenerated] So now that we have reviewed the
different modules that we will be using,
let's move into the fun part and see how this all works
in a live demonstration environment.
Remember that in the context of this course,
you're a new hire for Globomantics and part of your appeal is having the
ability to work with these new tolls and put them in place where they
can be the most useful with that in mind.
Imagine how each of these different modules could be used
in a real environment and how you can make them work in
your favor for this section.
We will be reviewing several examples of how these modules can be implemented,
including how the platform module is used to collect
information about the local server,
how the PS Util module can be used to display the processes on a
system and how the PS Util module can also be used to show the
utilization information for the system, how the W.
M.
I module can be used to collect additional information
from different data points on a system.
And finally how the Win apps module can be used to
collect installed application information.
So now let's move into our demonstration environment where we are
specifically going to show examples of a couple different modules
including the platform P Sutil W.
M.
I and Win apps modules for Python Now remember that our demonstration here
is going to be focused on those security engineers who would potentially
use these modules for their day to day work.
So some of the narration is going to be focused in that direction
that said any of these modules or any of the different topics that
I'm reviewing are not specific to security.
So you can also use these in a number of other different ways.
So first we're going to start off with the platform module in this case,
this first group we're taking a look at on your screen is just
throwing out a bunch of output of the different variables that can
be obtained using this specific module.
So we're going to start by taking a look at the initial import of
the module that we're talking about in this case,
which is platform.
So all this does is it imports all of the different methods and
parameters that come with the platform module.
Now,
the first thing we're going to show is actually
this whole little code block here.
The platform dot you name,
function or method is used to return six of the most common variables
that are queried from using the platform module.
These include the node name, the system,
the system, the release, the version, the machine and the processor.
In this case we use that method and push all of those
different variables into the my system variable.
And then we pull out each of those six whenever we do the print thus the my
system dot node in dot system and dot release and so on.
So that would be the first part of it.
The second part of it is is some of the separate methods that
can be pulled out using the platform module,
including the platform variable the architecture,
the specific python version and the python implementation.
And since we are using Windows in this case,
there are also a few different variables that are
specific to a Windows based machine, including the version,
the addition and whether it is the IOT version,
which was formally referred to as Windows embedded.
Now, if we just run this up here, we'll see the output here.
Okay, now, if we look at this, what did we say in the script?
It shows the system node name, it's running a window system released 10.
The specific patch level at this point is 10 dot oh 10.0.19044.
It's running on a 64 bit intel AMG based processor that tells
you the specific processor that's on here,
which is an enter family six,
the generation of the physical processor in this machine shows you the platform,
which gives you down to the specific patch level and
then the architecture variable, which will say at 64-bit the python version,
which is 3.10 dot eight,
which is as of the time of this recording the most
recent mainline python version.
It's c python, which is the most commonly used version of python at the moment.
And then we come into the three different Windows specific
variables where we look at the version.
So it gives you those 10, 10 dot oh 10.0.19044 S p zero.
It's the professional version of Windows 10 and it is not the embedded
version in this case we're just showing what's potentially possible and
then you can use this in a number of different ways to display
information on the specific targeted machine.
Now we can move over to the first example of the PS util module
and in this case for our example for ps utility,
it's going to be rather shallow for this specific module but we're going to
be looking at it in much more detail in a future module.
And what we're doing here is we're going to be using the process
underscore iter method of the PS util module and we're only going to
be specifically querying for the process I.
D.
The apparent process,
IDE the name and the username that ran the specific process and
then we're just displaying that information.
So if we run this and what it's gonna do is it's going to
show a long list of all the different processes that are
running on this specific machine.
Look at this one, here we go.
So this is the Visual Studio Code executable that we're using right now.
It was run with the user name of Sean Wilkins because
that's the user I have built into this VM.
Its parent process was 61 16 or 6116.
It's process ideas.
588 and its executable name is code dot e x e.
So what information can we gather from just this information?
Well, you have the executable name,
you have who ran it and you also have the parent process.
So if you wanted to take that parent process information, you can take 6116.
And if we move down in this list 6116 and look for 6116, we will see 6116.
So in this case it was run and spawned off of the
Explorer dot executable process.
It was also run by me, it's parent process is 6052 but its processes 6116.
So from that information we can determine if we want to jump
around and reference it what its processor,
IDE is,
who ran him and then we also know that the code executable was something
that this specific process spawned now for a specific list or a more
formatted list of how this spawn list looks.
We're going to cover that in a later module specifically where we're
trying to focus on these different processes and who they spawn and who
spawned them in a more easily readable fashion.
Next,
we're going to move over and take a look at some of the utilization
examples that are provided by the ps util module.
So for this I just sort of commented out a couple of different options that you
have and these can be put together and then a number of different ways
depending on what you're specifically trying to look at,
including just putting them all together.
So this first one we're going to be paying attention to what these overall
CPU utilization was for the whole system and this is retrieved using the
CPU underscore percent method and the interval is how often it's checked
if we make this big in this case,
this virtual machine is using four different process cores.
So since we indicated on that line that we'll look at in a
second that we did want to look at it per CPU in this case
will be per virtual CPU core.
We get four different numbers in here.
So each one is a representation of the utilization
that's overall for this system.
As of the time that you know, we initially started this script.
So obviously when we first used the script we see a whole bunch of higher
numbers because it's thinking and now that it's just running our processor has
run considerably further down and then just sitting here,
there's nothing else running on this specific VM other than code.
So we know that the utilization is rather low.
So on average here we're talking about 2 to 3% and every
once in a while it'll jump up to at five.
So using this type of method right here and keep in mind this
is wrapped inside this loop right here.
It'll iterator over what the CPU percent was compared to the last time,
that specific method was run.
So if we move on from overall utilization and we want to take a
look at what the per process CPU utilization was.
So how much processing is being used by each individual process on the machine,
We would use it a little bit differently.
And in this case what we're going to be doing is we're using the
here where you're using the ps util process,
we are giving it a specific processor ID in this case.
This was from whenever we built it.
So this process I.
D may or may not be valid.
So we need to Let's get a number of a process that we
know is running on the system right now.
And for that,
let's look at what was that process idea of code that we were using?
So 6116 and so 588 is the process I.
D.
That we're using four or one of the process I.
D.
S.
That code is using we can go back here and we can put 588
here and what we're doing here again,
we're sitting inside a loop and we're going to be saying the process as
a ruling utilization of X percent and we are using that p variable that
we opened up with the process method.
So this is only going to be giving you the utilization of a specific process
that is mentioned in this inside this parenthesis here.
So if we run that.
So again, we're doing this on an interval.
So it's based on how much is being used between now this this iteration
of running this specific method and the last one.
So right now,
whenever we went into it it was 3.6 if I just sit here and don't move
the mouse at all and we don't interact with it at all,
the utilization is going to be very low.
If I sit here and move and code a little bit here,
it's going to go up a little bit,
show it shows you what the CPU utilization is
reporting for this specific process.
So that is covered in this code Next let's look at memory usage.
And again,
we're going to split these into system wide memory usage and process
specific memory usage And 588 is the process we used before.
So we'll put this down here before we forget about it.
So in this case,
what we're doing is we're gonna utilize the virtual memory
method and by itself it's going to be returned into the
virtual underscore memory variable.
And I left as a comment in here is all of the different potential ways
that this method gives you the memory because there's,
you know, there's virtual memory, there's physical memory,
there's available memory,
there's a percentage of memory overall and it splits it into a number of
different categories if you want to look at it that way.
In our case we're going to be printing out four of
those which is the total memory, the used memory,
the memory as a term of percentage overall and then the amount free.
So if we run this again in this case we're not in a loop,
it's just going to show us at the point of running it
And this is for the whole system.
So we have given this specific VM eight gig of memory
currently we're using 2.8 around 2.8 gig of it.
We are roughly using 32.4% of it and the available memory
right now is around 5.8 gigabits left.
Now you can put that into a loop if you wanted to see that iterate
but this is just a simple display of what the overall system memory
is as of the time that we ran that method.
Now,
the last one we're going to show for this script is memory usage per processor
but in this case we're going to use that 5 88 process I.
D.
Which was for code and we're going to be using a specific one of the specific
memory methods in this case we're going to obtain memory info for this specific
process and we're going to be looking at the R.
S.
S attribute which is the non swapped physical memory that a process is using.
So if we run this currently the code executable process is
using 95 meg of physical rss memory.
So now if we exit out of that,
put this all back together and next we're gonna move on to the W M I module and
the W M I module is for the Windows management instrumentation module that is
built into most of the modern versions of Windows,
although it may or may not be turned on on your
specific targeted machines in this case,
I know it's turned on for this one now in this case we're
only going to be focusing on retrieving it from the local
system so I have local access to it,
we're going to cover the remote access version of this two sections from now,
whenever we're going to be focusing on remote information collection.
So now this script is focused on a couple of the
different options that are available.
Now there are several that are included within W M I and we are
basically picking and choosing information about a specific system and
we're focusing on some of the more simpler variables that are available
as you can see as part of the script,
I noted the specific location that gives the reference of the different
attributes that are available for each one of the modules.
This first one, for example,
is talking about the Windows 32 underscore operating
system method and if you go to this link,
you will see that there are a number of different attributes that are
available as part of this specific method that we're using.
And all of these options over here on the left that were sort of scrolling
through are ones that you can use at this case where you're looking at the
specific attributes including the caption or name,
the free physical memory, total visible memory,
build number,
build types all very similar to the platform and should
match very close to the output from the platform module
From the win 32 computer system.
You see the system name logical, processor,
physical processor, the statuses, system type.
Then we move down in and we're just looking at one of the options for
networking where we can get the name of the network adapter.
The Mac address assigned the IP address assigned to each one of them and
that's pushed into a little for loop So it actually displays somewhat
pretty instead of individually but with that let's take a look at what
this would look like if we run this.
So in this case we haven't used any super special formatting for
anything except for the network stuff at the bottom here.
But we got all this edition,
it's Windows 10 pro the free and total memory build number
of Windows which matches the platform.
Multi process are free.
We saw that earlier.
We're used to the partition thing if we've installed Windows before
This is the information from the second module.
So it's 64-bit there's the name of the number of virtual cores,
the number of physical cores and then we move over
to the network specific stuff.
So in this case we have two different physical
adapters that are available on this.
one.
One is the one that's actually used for normal network traffic,
which is the gigabit network intel card,
which has a Mac address shown there.
And we are signing at the 10.10 dot 10.1 oh three
address with a 255.255 dot 255.0 mask.
So this is just a very small amount of the potential information you can
collect using the W M I module for local collection.
Now, finally,
as part of this specific demo where we're focusing on the local stuff,
we're going to take a look at the Wynn apps module.
Now, this module is a smaller module compared to the other ones,
but it does provide some useful input as to the currently
installed packages on the targeted machine.
And in this case we use its list out install method,
which kicks out a list of the applications that are installed on this
machine and pushes them into a dictionary variable.
And then we just print it out.
If we take a look at this,
you'll see why this could be very useful depending on
your specific needs in this case.
This part up top This is actually the raw dictionary
variable if it was printed in a not pretty way,
but down here,
we have listed all of the individual items that exist within that
dictionary from that list installed method.
So we have each of these different applications that is installed.
And on top of telling you that these applications are installed,
it also tells you the versions of those specific applications.
So with this output,
what we could do if you are a security individual looking to find
out if a machine is running any applications that it's not allowed
to is in a slightly more refined script,
you could have a list of those applications that are allowed
and compare that against the applications from this module
that are actually installed.
And then it could kick you out an output that says X machine
as this installed and it's not supposed to or I could say this
machine has that app installed, but the version isn't where it's supposed to be.
So it's not at a patch level that you would expect it to be at.
Now, if you're looking at it from a security perspective,
and you're trying to get into a machine,
obviously you could use the same information to say,
okay, it's a patch level that's known to be exploitable.
And then you could exploit it.
So with that this will finish up this demonstration of the different
modules that we can use for local collection of information.
Now we're going to move over into a short section where we
discuss the remote collection of information,
and then we're going to move back into the demonstration
environment and show an example of it.