Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. #!/usr/bin/python
  2.  
  3. from optparse import OptionParser
  4. import sys
  5. import os, os.path
  6. import subprocess
  7. import base64
  8. import email
  9. import mimetypes
  10. import hashlib
  11.  
  12. outputdirectory="./report"
  13.  
  14.  
  15. def decode_base64(data):
  16.     """Decode base64, padding being optional.
  17.  
  18.    :param data: Base64 data as an ASCII byte string
  19.    :returns: The decoded byte string.
  20.  
  21.    """
  22.     missing_padding = 4 - len(data) % 4
  23.     if missing_padding:
  24.         data += b'='* missing_padding
  25.     return base64.decodestring(data)
  26.  
  27. def primaoperazione(pcap):
  28.     if os.path.exists(outputdirectory):
  29.         print "Errore: directory esistente, rimuoverla prima di procedere"
  30.         exit()
  31.     if not os.path.exists(outputdirectory):
  32.         os.makedirs(outputdirectory)
  33.     subprocess.call("(cd %s && tcpflow -r %s)"%(outputdirectory, pcap), shell=True)
  34.  
  35. def smtpinfo():
  36.     report = open(os.path.join(outputdirectory, "report.txt"), 'wb')
  37.     for file in os.listdir(outputdirectory):
  38.         report.write("-"*50+"\n")
  39.         report.write(("Filename %s\n\n")%file)
  40.         message = []
  41.         a = open(os.path.join(outputdirectory,file)).readlines()
  42.         for i in range(len(a)):
  43.             if "AUTH LOGIN" in a[i]:
  44.                 report.write("Dati LOGIN\n")
  45.                 report.write(decode_base64(str(a[i+1]))+"\n")
  46.                 report.write(decode_base64(str(a[i+2]))+"\n")
  47.             if "MAIL FROM" in a[i]:
  48.                 report.write(a[i]+"\n")
  49.             if "RCPT TO" in a[i]:
  50.                 report.write(a[i]+"\n")
  51.             if "DATA" in a[i]:
  52.                 b="".join(a[(i+1):(len(a)-1)])
  53.                 msg = email.message_from_string(b)
  54.                 for part in msg.walk():
  55.                     if part.get_content_type() == 'text/plain':
  56.                         report.write("Testo del messaggio\n")
  57.                         report.write(part.get_payload()+"\n")
  58.                     filename = part.get_filename()
  59.                     if filename == None:
  60.                         continue
  61.                     else:
  62.                         fp = open(os.path.join(outputdirectory, filename), 'wb')
  63.                         fp.write(part.get_payload(decode=1))
  64.                         fp.close()
  65.                         report.write("Il nome dell'allegato:"+filename+"\n")
  66.                         fp = open(os.path.join(outputdirectory, filename), 'rb')
  67.                         data = fp.read()
  68.                         fp.close()
  69.                         msgmd5 = hashlib.md5(data).hexdigest()
  70.                         report.write("L'hash MD5 del file:"+msgmd5+ "\n")
  71.     report.close()
  72.    
  73. if __name__ == '__main__':
  74.     usage = "Usage: %prog [options]"
  75.     parser = OptionParser(usage)
  76.     parser.add_option("-p",dest="pcapfile",help="Complete path to pcap file")
  77.     (options, args) = parser.parse_args(sys.argv)
  78.     if not options.pcapfile:
  79.         parser.error("-p is required, see --help for details")
  80.     primaoperazione(options.pcapfile)
  81.     smtpinfo()