mysticmomba/AirlockTools
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

MemOpt #18

Merged
mysticmomba merged 30 commits from MemOpt into master 2025-09-02 17:53:43 -04:00
Conversation 0 Commits 30 Files Changed 9
+39 -22
2 changed files with 39 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1d83c61998 - Show all commits
AirlockTools.py
+35 -19
View File
@@ -132,8 +132,9 @@ def menu_prepare_to_enforce():
first_policy = " " first_policy = " "
second_policy = " " second_policy = " "
allowlist_parent = " " allowlist_parent_name = " "
allowlist_child = " " allowlist_child_name = " "
destination_policy = " "
df_aggregated_combo = pd.DataFrame() df_aggregated_combo = pd.DataFrame()
#If the directorys where we're going to store our output dont exist, make them. #If the directorys where we're going to store our output dont exist, make them.
@@ -230,14 +231,18 @@ def menu_prepare_to_enforce():
else: else:
print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red")) print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red"))
print(ct.colorText(f"5. Choose the destination parent and child policy allow list", "cyan")) print(ct.colorText(f"5. Choose the destination_name policy and parent and child allow list", "cyan"))
if allowlist_child == " " and allowlist_parent== " ": if allowlist_child_name == " " and allowlist_parent_name== " ":
print(ct.colorText(f" [✗] No policies have been chosen","red")) print(ct.colorText(f" [✗] No allowlists have been chosen","red"))
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is allowlist_child: elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name:
print(ct.colorText(f" [✓] [✗] Only {allowlist_parent} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow")) print(ct.colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is not allowlist_child: elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name:
print(ct.colorText(f" [✓] {allowlist_parent} has been selected as Parent Policy","green")) print(ct.colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green"))
print(ct.colorText(f" [✓] {allowlist_child} has been selected as Child Policy","green")) print(ct.colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green"))
if destination_policy == " ":
print(ct.colorText(f" [✗] No destination_name policy has been chosen","red"))
else:
print(ct.colorText(f" [✓] destination_name policy is {destination_policy}","green"))
print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan")) print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan"))
print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan")) print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan"))
@@ -369,19 +374,27 @@ def menu_prepare_to_enforce():
elif choice == "5": elif choice == "5":
print(ct.colorText(f"Please choose Parent Allowlist","white")) print(ct.colorText(f"Please choose destination_name Policy for Path Exclusions","white"))
destination_tuple = utils.allowlist.listPolicies(url)
#print(allowlist_parent_tuple)
destination_name = destination_tuple[1][destination_tuple[0]]
destination_id = destination_tuple[0][destination_tuple[0]]
print(ct.colorText(f"Please choose Parent Allowlist for Known Hashes","white"))
allowlist_parent_tuple = utils.allowlist.listAllowlists(url) allowlist_parent_tuple = utils.allowlist.listAllowlists(url)
#print(allowlist_parent_tuple) #print(allowlist_parent_tuple)
allowlist_parent = allowlist_parent_tuple[1][allowlist_parent_tuple[0]] allowlist_parent_name = allowlist_parent_tuple[1][allowlist_parent_tuple[0]]
allowlist_parent_id = allowlist_parent_tuple[1][allowlist_parent_tuple[1]]
print(ct.colorText(f"Please choose Child Allowlist","white")) print(ct.colorText(f"Please choose Child Allowlist for Less-Known Hashes","white"))
allowlist_child_tuple = utils.allowlist.listAllowlists(url) allowlist_child_tuple = utils.allowlist.listAllowlists(url)
#print(allowlist_child_tuple) #print(allowlist_child_tuple)
allowlist_child = allowlist_child_tuple[1][allowlist_child_tuple[0]] allowlist_child_name = allowlist_child_tuple[1][allowlist_child_tuple[0]]
allowlist_child_id = allowlist_child_tuple[0][allowlist_child_tuple[0]]
elif choice == "6": elif choice == "6":
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent != " " and allowlist_child != " ": if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent_name != " " and allowlist_child_name != " ":
pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv")
allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv")
@@ -397,15 +410,18 @@ def menu_prepare_to_enforce():
if confirmation.strip().upper() == "I AGREE": if confirmation.strip().upper() == "I AGREE":
print(ct.colorText("Proceeding with the code...", "yellow")) print(ct.colorText("Proceeding with the code...", "yellow"))
print(ct.colorText(f"Adding path exclusions to {destination_name}", "yellow"))
pathexcludelist = pathexclusions['longestcfp'].unique().tolist() pathexcludelist = pathexclusions['longestcfp'].unique().tolist()
utils.policyfunctions.addPath(allowlist_child,pathexcludelist) utils.policyfunctions.addPath(destination_id,pathexcludelist)
print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist() allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist()
utils.policyfunctions.addHash(allowlist_parent,allowlist_parenthashlist) utils.policyfunctions.addHash(allowlist_parent_id,allowlist_parenthashlist)
print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist() allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist()
utils.policyfunctions.addHash(allowlist_child, allowlist_childhashlist) utils.policyfunctions.addHash(allowlist_child_id, allowlist_childhashlist)
else: else:
print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red")) print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red"))
utils/policyfunctions.py
+3 -2
View File
@@ -15,6 +15,7 @@
import requests import requests
import json import json
import os
import utils.pretty as ct import utils.pretty as ct
def addHash(policy, hash): def addHash(policy, hash):
@@ -32,7 +33,7 @@ def addHashReal(url, allowlistID, hashlist):
endpoint = url + '/v1/hash/application/add' endpoint = url + '/v1/hash/application/add'
print(ct.colorText("[+] Grabbing All Categories", "cyan")) print(ct.colorText("[+] Grabbing All Categories", "cyan"))
payload = { payload = {
"applicationid" : allowlistID "applicationid" : allowlistID,
"hashes" : hashlist "hashes" : hashlist
} }
headers = { headers = {
@@ -50,7 +51,7 @@ def addPathReal(url, grouplistID, pathlist):
endpoint = url + '/v1/group/path/add' endpoint = url + '/v1/group/path/add'
print(ct.colorText("[+] Grabbing All Categories", "cyan")) print(ct.colorText("[+] Grabbing All Categories", "cyan"))
payload = { payload = {
"applicationid" : grouplistID "applicationid" : grouplistID,
"hashes" : pathlist "hashes" : pathlist
} }
headers = { headers = {