#!/usr/bin/env python3
"""LaZagne credential access detection agent.

Detects evidence of LaZagne credential harvesting tool execution on
endpoints by scanning for process artifacts, file system indicators,
and Windows event log entries associated with credential dumping.
Used for defensive detection and incident response, not offensive use.
"""
import argparse
import json
import os
import subprocess
import sys
from datetime import datetime, timezone


LAZAGNE_INDICATORS = {
    "file_paths": [
        "lazagne.exe", "LaZagne.exe", "laZagne.py",
        "lazagne_output.txt", "credentials.txt",
    ],
    "process_names": [
        "lazagne.exe", "python.exe lazagne",
    ],
    "registry_keys": [
        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    ],
    "event_ids": {
        4688: "Process creation (look for lazagne.exe or suspicious python)",
        4663: "File access audit (credential store access)",
        4656: "Handle request to credential objects",
    },
    "credential_stores": [
        # Windows
        r"%APPDATA%\Mozilla\Firefox\Profiles",
        r"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data",
        r"%APPDATA%\Opera Software\Opera Stable\Login Data",
        # Linux
        os.path.expanduser("~/.mozilla/firefox"),
        os.path.expanduser("~/.config/google-chrome/Default/Login Data"),
        "/etc/shadow",
        os.path.expanduser("~/.ssh"),
    ],
}


def scan_filesystem_indicators(search_paths=None):
    """Scan file system for LaZagne artifacts."""
    findings = []
    if search_paths is None:
        if sys.platform == "win32":
            search_paths = [
                os.environ.get("TEMP", "C:\\Temp"),
                os.environ.get("USERPROFILE", "C:\\Users\\Default"),
                "C:\\Windows\\Temp",
            ]
        else:
            search_paths = ["/tmp", "/var/tmp", os.path.expanduser("~")]

    print("[*] Scanning filesystem for LaZagne indicators...")
    for search_path in search_paths:
        if not os.path.isdir(search_path):
            continue
        for root, dirs, files in os.walk(search_path):
            for fname in files:
                fname_lower = fname.lower()
                for indicator in LAZAGNE_INDICATORS["file_paths"]:
                    if indicator.lower() in fname_lower:
                        full_path = os.path.join(root, fname)
                        stat = os.stat(full_path)
                        findings.append({
                            "type": "file_indicator",
                            "path": full_path,
                            "indicator": indicator,
                            "size": stat.st_size,
                            "modified": datetime.fromtimestamp(stat.st_mtime, tz=timezone.utc).isoformat(),
                            "severity": "CRITICAL",
                            "description": f"LaZagne artifact found: {fname}",
                        })
            # Limit directory depth to avoid slow scans
            if root.count(os.sep) - search_path.count(os.sep) > 3:
                dirs.clear()

    return findings


def check_windows_event_logs():
    """Check Windows Security event logs for LaZagne-related activity."""
    findings = []
    if sys.platform != "win32":
        return findings

    print("[*] Checking Windows Security event logs...")

    # Check for process creation events matching LaZagne
    ps_script = """
    Get-WinEvent -FilterHashtable @{
        LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)
    } -MaxEvents 1000 -ErrorAction SilentlyContinue |
    Where-Object {
        $_.Properties[5].Value -match 'lazagne|LaZagne' -or
        $_.Properties[8].Value -match 'lazagne|LaZagne'
    } |
    Select-Object TimeCreated, @{N='ProcessName';E={$_.Properties[5].Value}},
        @{N='CommandLine';E={$_.Properties[8].Value}},
        @{N='User';E={$_.Properties[1].Value}} |
    ConvertTo-Json
    """
    result = subprocess.run(
        ["powershell", "-Command", ps_script],
        capture_output=True, text=True, timeout=60,
    )
    if result.returncode == 0 and result.stdout.strip():
        try:
            events = json.loads(result.stdout)
            if isinstance(events, dict):
                events = [events]
            for evt in events:
                findings.append({
                    "type": "event_log",
                    "event_id": 4688,
                    "time": str(evt.get("TimeCreated", "")),
                    "process": evt.get("ProcessName", ""),
                    "command_line": evt.get("CommandLine", "")[:200],
                    "user": evt.get("User", ""),
                    "severity": "CRITICAL",
                    "description": "LaZagne process execution detected in event logs",
                })
        except json.JSONDecodeError:
            pass

    # Check for credential file access (Event ID 4663)
    ps_script2 = """
    Get-WinEvent -FilterHashtable @{
        LogName='Security'; Id=4663; StartTime=(Get-Date).AddDays(-7)
    } -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object {
        $_.Properties[6].Value -match 'Login Data|logins.json|Credentials|vault'
    } |
    Select-Object TimeCreated, @{N='ObjectName';E={$_.Properties[6].Value}},
        @{N='ProcessName';E={$_.Properties[11].Value}} |
    ConvertTo-Json
    """
    result = subprocess.run(
        ["powershell", "-Command", ps_script2],
        capture_output=True, text=True, timeout=60,
    )
    if result.returncode == 0 and result.stdout.strip():
        try:
            events = json.loads(result.stdout)
            if isinstance(events, dict):
                events = [events]
            for evt in events:
                findings.append({
                    "type": "credential_access",
                    "event_id": 4663,
                    "time": str(evt.get("TimeCreated", "")),
                    "object": evt.get("ObjectName", ""),
                    "process": evt.get("ProcessName", ""),
                    "severity": "HIGH",
                    "description": "Credential store accessed by process",
                })
        except json.JSONDecodeError:
            pass

    return findings


def check_credential_store_integrity():
    """Check if credential stores have been recently accessed unusually."""
    findings = []
    print("[*] Checking credential store integrity...")

    stores_to_check = []
    if sys.platform == "win32":
        appdata = os.environ.get("APPDATA", "")
        localappdata = os.environ.get("LOCALAPPDATA", "")
        stores_to_check = [
            (os.path.join(localappdata, "Google", "Chrome", "User Data", "Default", "Login Data"), "Chrome"),
            (os.path.join(appdata, "Mozilla", "Firefox"), "Firefox"),
        ]
    else:
        stores_to_check = [
            (os.path.expanduser("~/.config/google-chrome/Default/Login Data"), "Chrome"),
            (os.path.expanduser("~/.mozilla/firefox"), "Firefox"),
            (os.path.expanduser("~/.ssh"), "SSH Keys"),
        ]

    for path, store_name in stores_to_check:
        if os.path.exists(path):
            if os.path.isfile(path):
                stat = os.stat(path)
                access_time = datetime.fromtimestamp(stat.st_atime, tz=timezone.utc)
                mod_time = datetime.fromtimestamp(stat.st_mtime, tz=timezone.utc)
                findings.append({
                    "type": "credential_store",
                    "store": store_name,
                    "path": path,
                    "last_accessed": access_time.isoformat(),
                    "last_modified": mod_time.isoformat(),
                    "severity": "INFO",
                })

    return findings


def format_summary(all_findings):
    """Print detection summary."""
    print(f"\n{'='*60}")
    print(f"  LaZagne Credential Access Detection Report")
    print(f"{'='*60}")

    file_findings = [f for f in all_findings if f["type"] == "file_indicator"]
    event_findings = [f for f in all_findings if f["type"] in ("event_log", "credential_access")]
    store_findings = [f for f in all_findings if f["type"] == "credential_store"]

    print(f"  File Indicators  : {len(file_findings)}")
    print(f"  Event Log Hits   : {len(event_findings)}")
    print(f"  Credential Stores: {len(store_findings)}")

    critical = [f for f in all_findings if f.get("severity") == "CRITICAL"]
    if critical:
        print(f"\n  CRITICAL FINDINGS ({len(critical)}):")
        for f in critical:
            print(f"    [{f['type']}] {f.get('description', f.get('path', ''))}")

    severity_counts = {}
    for f in all_findings:
        sev = f.get("severity", "INFO")
        severity_counts[sev] = severity_counts.get(sev, 0) + 1
    return severity_counts


def main():
    parser = argparse.ArgumentParser(
        description="LaZagne credential access detection agent (defensive use)"
    )
    parser.add_argument("--search-paths", nargs="+", help="Paths to scan for artifacts")
    parser.add_argument("--skip-events", action="store_true", help="Skip Windows event log check")
    parser.add_argument("--skip-stores", action="store_true", help="Skip credential store check")
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    all_findings = []
    all_findings.extend(scan_filesystem_indicators(args.search_paths))
    if not args.skip_events:
        all_findings.extend(check_windows_event_logs())
    if not args.skip_stores:
        all_findings.extend(check_credential_store_integrity())

    severity_counts = format_summary(all_findings)

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "LaZagne Detection",
        "findings": all_findings,
        "severity_counts": severity_counts,
        "risk_level": (
            "CRITICAL" if severity_counts.get("CRITICAL", 0) > 0
            else "HIGH" if severity_counts.get("HIGH", 0) > 0
            else "LOW"
        ),
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
LaZagne Output Parser and Credential Analysis Script

Parses LaZagne JSON output, deduplicates credentials, and generates
prioritized reports. For authorized red team engagements only.
"""

import json
import sys
import os
from datetime import datetime
from collections import defaultdict


def load_lazagne_output(filepath: str) -> list:
    """Load LaZagne JSON output file."""
    try:
        with open(filepath, "r") as f:
            return json.load(f)
    except (FileNotFoundError, json.JSONDecodeError) as e:
        print(f"Error loading LaZagne output: {e}")
        return []


def parse_credentials(data: list) -> list:
    """Parse LaZagne output into normalized credential entries."""
    credentials = []

    for module_result in data:
        if isinstance(module_result, dict):
            category = module_result.get("Category", "Unknown")
            results = module_result.get("results", [])

            if isinstance(results, list):
                for entry in results:
                    if isinstance(entry, dict):
                        cred = {
                            "category": category,
                            "username": entry.get("Login", entry.get("Username", "")),
                            "password": entry.get("Password", ""),
                            "url": entry.get("URL", entry.get("Host", "")),
                            "port": entry.get("Port", ""),
                            "source": entry.get("Software", entry.get("Module", category)),
                            "raw": entry
                        }
                        if cred["username"] or cred["password"]:
                            credentials.append(cred)

    return credentials


def deduplicate_credentials(credentials: list) -> list:
    """Remove duplicate credential entries."""
    seen = set()
    unique = []

    for cred in credentials:
        key = (
            cred["username"].lower(),
            cred["password"],
            cred["url"].lower() if cred["url"] else ""
        )
        if key not in seen:
            seen.add(key)
            unique.append(cred)

    return unique


def categorize_credentials(credentials: list) -> dict:
    """Categorize credentials by type and priority."""
    categories = {
        "domain": [],
        "cloud": [],
        "database": [],
        "remote_access": [],
        "email": [],
        "web": [],
        "other": []
    }

    cloud_indicators = ["aws", "azure", "gcp", "cloud", "console."]
    remote_indicators = ["rdp", "ssh", "vnc", "vpn", "putty", "winscp"]
    db_indicators = ["postgres", "mysql", "mssql", "oracle", "mongodb", "redis"]
    email_indicators = ["outlook", "thunderbird", "smtp", "imap", "pop3", "mail"]

    for cred in credentials:
        source_lower = cred["source"].lower()
        url_lower = cred["url"].lower() if cred["url"] else ""
        combined = source_lower + " " + url_lower

        if "\\" in cred["username"] or "@" in cred["username"]:
            if any(domain_hint in cred["username"].lower()
                   for domain_hint in [".local", ".corp", ".internal", "\\"]):
                categories["domain"].append(cred)
                continue

        if any(ind in combined for ind in cloud_indicators):
            categories["cloud"].append(cred)
        elif any(ind in combined for ind in db_indicators):
            categories["database"].append(cred)
        elif any(ind in combined for ind in remote_indicators):
            categories["remote_access"].append(cred)
        elif any(ind in combined for ind in email_indicators):
            categories["email"].append(cred)
        elif cred["url"]:
            categories["web"].append(cred)
        else:
            categories["other"].append(cred)

    return categories


def generate_report(credentials: list, categories: dict, source_file: str) -> str:
    """Generate a credential analysis report."""
    report = [
        "=" * 70,
        "LaZagne Credential Analysis Report",
        f"Generated: {datetime.now().isoformat()}",
        f"Source File: {source_file}",
        "=" * 70,
        "",
        f"Total Credentials Recovered: {len(credentials)}",
        "",
        "Breakdown by Priority:",
        f"  [CRITICAL] Domain Credentials: {len(categories['domain'])}",
        f"  [HIGH]     Cloud Credentials: {len(categories['cloud'])}",
        f"  [HIGH]     Remote Access: {len(categories['remote_access'])}",
        f"  [MEDIUM]   Database Credentials: {len(categories['database'])}",
        f"  [MEDIUM]   Email Credentials: {len(categories['email'])}",
        f"  [LOW]      Web Credentials: {len(categories['web'])}",
        f"  [INFO]     Other: {len(categories['other'])}",
        ""
    ]

    priority_order = [
        ("CRITICAL", "Domain Credentials", categories["domain"]),
        ("HIGH", "Cloud Credentials", categories["cloud"]),
        ("HIGH", "Remote Access Credentials", categories["remote_access"]),
        ("MEDIUM", "Database Credentials", categories["database"]),
        ("MEDIUM", "Email Credentials", categories["email"]),
    ]

    for priority, label, creds in priority_order:
        if creds:
            report.append(f"[{priority}] {label}:")
            report.append("-" * 50)
            for cred in creds:
                report.append(f"  Source: {cred['source']}")
                report.append(f"  User: {cred['username']}")
                report.append(f"  Target: {cred['url'] or 'N/A'}")
                report.append("")

    # Source distribution
    source_counts = defaultdict(int)
    for cred in credentials:
        source_counts[cred["source"]] += 1

    report.append("Credentials by Source:")
    report.append("-" * 50)
    for source, count in sorted(source_counts.items(), key=lambda x: -x[1]):
        report.append(f"  {source}: {count}")

    report.append("")
    report.append("=" * 70)
    return "\n".join(report)


def main():
    """Main entry point."""
    if len(sys.argv) < 2:
        print("Usage: python process.py <lazagne_output.json>")
        return

    input_file = sys.argv[1]
    data = load_lazagne_output(input_file)

    if not data:
        print("No data loaded from LaZagne output.")
        return

    credentials = parse_credentials(data)
    credentials = deduplicate_credentials(credentials)
    categories = categorize_credentials(credentials)

    report = generate_report(credentials, categories, input_file)
    print(report)

    report_file = f"credential_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
    with open(report_file, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {report_file}")


if __name__ == "__main__":
    main()