mysticmomba/AirlockTools
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Updated functions... need to be able to pull groupid and applicationid out of the list functions, else make new ones to do that

Browse Source
This commit is contained in:
=
2025-08-28 18:42:23 -04:00
parent 0287475090
commit 1d83c61998
2 changed files with 39 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AirlockTools.py
+36 -20
View File
@@ -132,8 +132,9 @@ def menu_prepare_to_enforce():
first_policy = " " first_policy = " "
second_policy = " " second_policy = " "
allowlist_parent = " " allowlist_parent_name = " "
allowlist_child = " " allowlist_child_name = " "
destination_policy = " "
df_aggregated_combo = pd.DataFrame() df_aggregated_combo = pd.DataFrame()
#If the directorys where we're going to store our output dont exist, make them. #If the directorys where we're going to store our output dont exist, make them.
@@ -230,14 +231,18 @@ def menu_prepare_to_enforce():
else: else:
print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red")) print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red"))
print(ct.colorText(f"5. Choose the destination parent and child policy allow list", "cyan")) print(ct.colorText(f"5. Choose the destination_name policy and parent and child allow list", "cyan"))
if allowlist_child == " " and allowlist_parent== " ": if allowlist_child_name == " " and allowlist_parent_name== " ":
print(ct.colorText(f" [✗] No policies have been chosen","red")) print(ct.colorText(f" [✗] No allowlists have been chosen","red"))
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is allowlist_child: elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name:
print(ct.colorText(f" [✓] [✗] Only {allowlist_parent} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow")) print(ct.colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is not allowlist_child: elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name:
print(ct.colorText(f" [✓] {allowlist_parent} has been selected as Parent Policy","green")) print(ct.colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green"))
print(ct.colorText(f" [✓] {allowlist_child} has been selected as Child Policy","green")) print(ct.colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green"))
if destination_policy == " ":
print(ct.colorText(f" [✗] No destination_name policy has been chosen","red"))
else:
print(ct.colorText(f" [✓] destination_name policy is {destination_policy}","green"))
print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan")) print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan"))
print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan")) print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan"))
@@ -369,19 +374,27 @@ def menu_prepare_to_enforce():
elif choice == "5": elif choice == "5":
print(ct.colorText(f"Please choose Parent Allowlist","white")) print(ct.colorText(f"Please choose destination_name Policy for Path Exclusions","white"))
destination_tuple = utils.allowlist.listPolicies(url)
#print(allowlist_parent_tuple)
destination_name = destination_tuple[1][destination_tuple[0]]
destination_id = destination_tuple[0][destination_tuple[0]]
print(ct.colorText(f"Please choose Parent Allowlist for Known Hashes","white"))
allowlist_parent_tuple = utils.allowlist.listAllowlists(url) allowlist_parent_tuple = utils.allowlist.listAllowlists(url)
#print(allowlist_parent_tuple) #print(allowlist_parent_tuple)
allowlist_parent = allowlist_parent_tuple[1][allowlist_parent_tuple[0]] allowlist_parent_name = allowlist_parent_tuple[1][allowlist_parent_tuple[0]]
allowlist_parent_id = allowlist_parent_tuple[1][allowlist_parent_tuple[1]]
print(ct.colorText(f"Please choose Child Allowlist","white")) print(ct.colorText(f"Please choose Child Allowlist for Less-Known Hashes","white"))
allowlist_child_tuple = utils.allowlist.listAllowlists(url) allowlist_child_tuple = utils.allowlist.listAllowlists(url)
#print(allowlist_child_tuple) #print(allowlist_child_tuple)
allowlist_child = allowlist_child_tuple[1][allowlist_child_tuple[0]] allowlist_child_name = allowlist_child_tuple[1][allowlist_child_tuple[0]]
allowlist_child_id = allowlist_child_tuple[0][allowlist_child_tuple[0]]
elif choice == "6": elif choice == "6":
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent != " " and allowlist_child != " ": if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent_name != " " and allowlist_child_name != " ":
pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv")
allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv")
@@ -397,15 +410,18 @@ def menu_prepare_to_enforce():
if confirmation.strip().upper() == "I AGREE": if confirmation.strip().upper() == "I AGREE":
print(ct.colorText("Proceeding with the code...", "yellow")) print(ct.colorText("Proceeding with the code...", "yellow"))
print(ct.colorText(f"Adding path exclusions to {destination_name}", "yellow"))
pathexcludelist = pathexclusions['longestcfp'].unique().tolist() pathexcludelist = pathexclusions['longestcfp'].unique().tolist()
utils.policyfunctions.addPath(allowlist_child,pathexcludelist) utils.policyfunctions.addPath(destination_id,pathexcludelist)
print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist() allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist()
utils.policyfunctions.addHash(allowlist_parent,allowlist_parenthashlist) utils.policyfunctions.addHash(allowlist_parent_id,allowlist_parenthashlist)
print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist() allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist()
utils.policyfunctions.addHash(allowlist_child, allowlist_childhashlist) utils.policyfunctions.addHash(allowlist_child_id, allowlist_childhashlist)
else: else:
print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red")) print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red"))
utils/policyfunctions.py
+3 -2
View File
@@ -15,6 +15,7 @@
import requests import requests
import json import json
import os
import utils.pretty as ct import utils.pretty as ct
def addHash(policy, hash): def addHash(policy, hash):
@@ -32,7 +33,7 @@ def addHashReal(url, allowlistID, hashlist):
endpoint = url + '/v1/hash/application/add' endpoint = url + '/v1/hash/application/add'
print(ct.colorText("[+] Grabbing All Categories", "cyan")) print(ct.colorText("[+] Grabbing All Categories", "cyan"))
payload = { payload = {
"applicationid" : allowlistID "applicationid" : allowlistID,
"hashes" : hashlist "hashes" : hashlist
} }
headers = { headers = {
@@ -50,7 +51,7 @@ def addPathReal(url, grouplistID, pathlist):
endpoint = url + '/v1/group/path/add' endpoint = url + '/v1/group/path/add'
print(ct.colorText("[+] Grabbing All Categories", "cyan")) print(ct.colorText("[+] Grabbing All Categories", "cyan"))
payload = { payload = {
"applicationid" : grouplistID "applicationid" : grouplistID,
"hashes" : pathlist "hashes" : pathlist
} }
headers = { headers = {