hashdir v2 all native

#!/usr/bin/python -tt

# HashDir hashes files in a directory and stores the values in a database,
# it then compares those hashes to the baseline hashes (if present) and reports any changes

import sys
import os
import hashlib
import sqlite3
import time

dateTimeGroup = time.asctime().replace(':','').replace(' ','')

def help():

    print """  Syntax: ./hashDirectories.py directory [-h,-v,-r,-p,-a]

    If you use relative or full path be consitent every run!

    -h, --help             this screen
    -v, --verbose           print all transactions while they happen
    -r, --reset           reset all baseline hashes
    -p, --purge           purge old and deleted records (prevents deleted records from alerting)
    -a, --reset-alerts     reset all baseline hashes for files that have alerted in the past and reset and any new alerts immediately
    Example:
    $ ./hashDirectories.py c:\\Users -v --reset-alerts
    """

    sys.exit(2)

def dbExists():

    try:

        open(os.getcwd() + '\\hashDB.db')

        return True

    except IOError, e:

        return False

def tableExisits():

    if cursor.execute("SELECT * FROM hashgrid") != 0:

        return True

    else:

        return False


def createDB():

    with open(os.getcwd() + '\\hashDB.db','w+') as makedb:

            makedb.close()


def openDB():

    try:

        conn = sqlite3.connect(os.getcwd() + '\\hashDB.db')

    except sqlite3.Error, e:

        print "\n[!] sqlite.Error Connecting to DB:" + str(e)

        sys.exit(1)

    if conn:

        print "\n[-] Sucessfully connected to Sqlite DB on " + time.asctime()

    return conn

def createTable(cursor):

    createtb = """
    CREATE TABLE    hashgrid(
    id               INTEGER      PRIMARY KEY,
    filepath         VARCHAR(255) NOT NULL,
    baseline_hash    CHAR(40)     NOT NULL,
    compare_hash     CHAR(40)     DEFAULT NULL,
    hash_date        VARCHAR(17)  DEFAULT NULL
    )"""

    try:

        cursor.execute(createtb)

    except sqlite3.Error, e:

        update += 1

        print "\n[!] sqlite3.Error creating table: " + str(e) + "[!] Quitting!"

        sys.exit(1)

def purgeTable(cursor):

    purgeold = """DELETE FROM hashgrid
    WHERE hash_date != '%s' or
    compare_hash IS NULL""" % dateTimeGroup

    cursor.execute(purgeold)

def tableInsert(fileHash, pathToFile, cursor, conn):

    insertdb = """
    INSERT INTO hashgrid
    (baseline_hash,filepath)
    VALUES('%s','%s')""" % (fileHash, pathToFile)

    try:
        cursor.execute(insertdb)

        if '-v' in sys.argv or '--verbose' in sys.argv:

            print '[+] '  + insertdb.replace("\n"," ")

            conn.commit()

    except sqlite3.Error, e:

        print  "\n[!] Error INSERTDB: " + str(e)

        errors.append( "\n[!] Error INSERTDB: " + str(e))

def tableUpdate(fileHash, pathToFile, cursor, conn):

    updatetb = """
    UPDATE hashgrid
    SET compare_hash = '%s', hash_date = '%s'
    WHERE filepath = '%s'
    """ % (fileHash, dateTimeGroup, pathToFile)

    try:
        cursor.execute(updatetb)

        if '-v' in sys.argv or '--verbose' in sys.argv:

            print '\n[+] ' + updatetb.replace("\n"," ")

            conn.commit()

    except sqlite3.Error, e:

        print "\n[!] sqlite3.Error updating table: " + str(e)

def tableDrop(cursor):

    if cursor.execute("SELECT * FROM hashgrid") != 0:

        droptb = "DROP TABLE hashgrid"

        cursor.execute(droptb)

def checkForTableDifferences(cursor):

    rows = cursor.execute("SELECT * FROM hashgrid WHERE baseline_hash != compare_hash").fetchall()

    if len(rows) > 0:

        print '\n[!] The following record(s) hash has changed since baseline...\n'

        for row in rows:

            print "\t[!] Changed Record: " + row[1].replace("\n","")

def checkForDeletedFiles(cursor):

    rows = cursor.execute("SELECT * FROM hashgrid WHERE hash_date != ('%s')" % (dateTimeGroup)).fetchall()

    if len(rows) > 0:

        print '\n[!] The following record(s) were deleted since baseline...\n'

        for row in rows:

            print "\t[!] Deleted Record: " + row[1].replace("\n","")

def checkForNewFiles(cursor, newRecords):

    rows = cursor.execute("SELECT * FROM hashgrid WHERE compare_hash is null and hash_date is ('%s')" % (dateTimeGroup)).fetchall()

    if len(rows) == newRecords:

        print "\n[-] The table is verified True!"

    else:

        print "\n[!] The table may have a discrepency"

    if len(rows) > 0:

        print '\n[!] The following record(s) were added since baseline...\n'

        for row in rows:

            print "\t[!] Added Record: " + row[1].replace("\n","")

def resetHashBaselines(cursor):

    resetalerts = """
    UPDATE hashgrid
    SET baseline_hash = compare_hash
    WHERE compare_hash != baseline_hash
    """

    cursor.execute(resetalerts)

def hashDirectories(dir):

    newRecords = 0

    firstRun = True

    hasResets = False

    if dbExists():

        conn = openDB()

        cursor = conn.cursor()

        firstRun = False

    else:

        createDB()

        conn = openDB()

        cursor = conn.cursor()

        createTable(cursor)

    # resets the entire table effectivly making removing all records in the DB
    if '-r' in sys.argv or '--reset' in sys.argv:

        tableDrop(cursor)

        createTable(cursor)

    # purges all the alerts for new, deleted, and hash anomolies
    if '-p' in sys.argv or '--purge' in sys.argv:

        purgeTable(cursor);

        hasResets = True

    # resets all new hashes to the baseline restting each record in the table
    if '-a' in sys.argv or '--reset-alerts' in sys.argv:

        resetHashBaselines(cursor)

        hasResets = True

    # Start recursing through the directories
    for root, dir, files in os.walk(str(dir)):

        for file in files:

            pathToFile = root + '\\' + file

            # Helping Python force garbage collection by deleting the last open file
            try:

                del fileOpen

            except UnboundLocalError, e:

                pass

            try:

                fileOpen = open(pathToFile)

            except IOError:

                print '\n[!] IOError opening: ' + pathToFile + str(e)

            try:

                try:

                    fileHash = hashlib.md5(fileOpen.read()).hexdigest()

                except MemoryError,e:

                    print '\n[!] Memory Error while opening: ' + pathToFile

            except UnboundLocalError, e:

                print '\n[!] UnboundLocalError while opening: ' + pathToFile

            # checks to see if the file is already in the database and if so it will simply update the hash record for that file in the new column

            if cursor.execute("SELECT filepath FROM hashgrid WHERE filepath = '%s'" % pathToFile).fetchall() == []:

                tableInsert(fileHash, pathToFile, cursor, conn)

                newRecords += 1


            # if the file has never been added to the DB previously these commands create an all new record for that file in the DB
            else:

                tableUpdate(fileHash, pathToFile, cursor, conn)

            try:

                fileOpen.close()

            except UnboundLocalError, e:

                print "\n[!] UnboundLocal Error: " + str(e)

    if newRecords > 0:

        if not hasResets:

            print '\n[-] Sucessfully added ' + str(newRecords) + ' file(s)'

    else:

        print '\n[-] No new files were added on this run'

    if firstRun or hasResets:

        print '\n[-] This was the first time running hashDirectories or your baselines were reset (No changes!)'

    # Checking if any files were deleted since last run
    if not firstRun and '-p' not in sys.argv and '--purge' not in sys.argv and '-a' not in sys.argv and '--reset-alerts' not in sys.argv:

        checkForNewFiles(cursor, newRecords)

        checkForDeletedFiles(cursor)

        checkForTableDifferences(cursor)

    conn.commit()

    cursor.close()

    conn.close()

def main():

    if '-h' in sys.argv or '--help' in sys.argv:

        help()

    if len(sys.argv) > 0:

        try:
            dir = sys.argv[1]

            hashDirectories(dir)

        except IndexError, e:

            print '\n[!] Index error: ' + str(e)

            help()

if __name__ == '__main__':

    main()