#!/usr/bin/env python3
"""Agent for performing lateral movement detection and simulation with WMIExec — authorized testing only."""

import json
import argparse
import subprocess
import re


def detect_wmiexec_artifacts_evtx(evtx_file):
    """Detect WMIExec lateral movement artifacts in Windows Event Logs."""
    try:
        import Evtx.Evtx as evtx
        import xml.etree.ElementTree as ET
    except ImportError:
        return {"error": "python-evtx not installed — pip install python-evtx"}
    ns = {"e": "http://schemas.microsoft.com/win/2004/08/events/event"}
    indicators = {
        "wmi_process_creation": [],
        "network_logon": [],
        "service_install": [],
    }
    with evtx.Evtx(evtx_file) as log:
        for record in log.records():
            try:
                xml = record.xml()
                root = ET.fromstring(xml)
                eid_elem = root.find(".//e:EventID", ns)
                if eid_elem is None:
                    continue
                eid = eid_elem.text
                data = {d.get("Name"): d.text for d in root.findall(".//e:Data", ns)}
                if eid == "1":
                    parent = data.get("ParentImage", "").lower()
                    cmdline = data.get("CommandLine", "")
                    if "wmiprvse.exe" in parent:
                        indicators["wmi_process_creation"].append({
                            "image": data.get("Image"), "cmdline": cmdline[:200],
                            "user": data.get("User"), "parent": data.get("ParentImage"),
                        })
                elif eid == "4624":
                    logon_type = data.get("LogonType", "")
                    if logon_type == "3":
                        indicators["network_logon"].append({
                            "user": data.get("TargetUserName"),
                            "source_ip": data.get("IpAddress"),
                            "workstation": data.get("WorkstationName"),
                        })
                elif eid == "7045":
                    svc_name = data.get("ServiceName", "")
                    if re.search(r"(BTOBTO|wmiprvse|wmi_|cmd\.exe)", svc_name, re.I):
                        indicators["service_install"].append({
                            "service": svc_name,
                            "path": data.get("ImagePath", "")[:200],
                        })
            except Exception:
                continue
    total = sum(len(v) for v in indicators.values())
    return {
        "evtx_file": evtx_file, "total_indicators": total,
        "wmi_process_creations": len(indicators["wmi_process_creation"]),
        "network_logons": len(indicators["network_logon"]),
        "service_installs": len(indicators["service_install"]),
        "indicators": {k: v[:15] for k, v in indicators.items()},
        "finding": "WMIEXEC_DETECTED" if total > 0 else "NO_INDICATORS",
    }


def run_wmiexec_impacket(target, domain, username, command="whoami"):
    """Execute command via Impacket wmiexec (authorized pentest use)."""
    cmd = ["python3", "-m", "impacket.examples.wmiexec",
           f"{domain}/{username}@{target}", command]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return {
            "target": target, "domain": domain, "user": username,
            "command": command, "output": result.stdout[:500],
            "success": result.returncode == 0,
            "stderr": result.stderr[:200] if result.stderr else "",
        }
    except FileNotFoundError:
        return {"error": "Impacket not installed — pip install impacket"}
    except Exception as e:
        return {"error": str(e)}


def detect_wmi_network_traffic(pcap_file):
    """Analyze PCAP for WMI lateral movement network indicators."""
    cmd = ["tshark", "-r", pcap_file, "-Y",
           "dcerpc.cn_bind_uuid == 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 || tcp.port == 135 || dcom",
           "-T", "fields", "-e", "ip.src", "-e", "ip.dst", "-e", "tcp.dstport",
           "-e", "dcerpc.cn_bind_uuid", "-e", "frame.time"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        connections = []
        for line in result.stdout.strip().splitlines():
            parts = line.split("\t")
            if len(parts) >= 3:
                connections.append({"src": parts[0], "dst": parts[1], "port": parts[2],
                                    "uuid": parts[3] if len(parts) > 3 else "", "time": parts[4] if len(parts) > 4 else ""})
        dcom_uuid = "4d9f4ab8-7d1c-11cf-861e-0020af6e7c57"
        wmi_traffic = [c for c in connections if c.get("uuid") == dcom_uuid or c.get("port") == "135"]
        return {
            "pcap_file": pcap_file, "total_connections": len(connections),
            "wmi_related": len(wmi_traffic), "connections": wmi_traffic[:20],
        }
    except FileNotFoundError:
        return {"error": "tshark not found — install Wireshark"}
    except Exception as e:
        return {"error": str(e)}


def check_wmi_persistence():
    """Check for WMI-based persistence mechanisms on local system."""
    checks = {
        "event_subscriptions": ["wmic", "/namespace:\\\\root\\subscription", "path", "__EventFilter", "get", "/format:list"],
        "consumers": ["wmic", "/namespace:\\\\root\\subscription", "path", "CommandLineEventConsumer", "get", "/format:list"],
        "bindings": ["wmic", "/namespace:\\\\root\\subscription", "path", "__FilterToConsumerBinding", "get", "/format:list"],
    }
    results = {}
    for name, cmd in checks.items():
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
            entries = [line.strip() for line in result.stdout.splitlines() if "=" in line]
            results[name] = {"count": len(entries), "entries": entries[:10]}
        except Exception as e:
            results[name] = {"error": str(e)}
    total = sum(r.get("count", 0) for r in results.values() if isinstance(r.get("count"), int))
    return {"wmi_persistence": results, "total_subscriptions": total,
            "finding": "WMI_PERSISTENCE_FOUND" if total > 0 else "NO_WMI_PERSISTENCE"}


def main():
    parser = argparse.ArgumentParser(description="WMIExec Lateral Movement Agent (Authorized Testing Only)")
    sub = parser.add_subparsers(dest="command")
    d = sub.add_parser("detect", help="Detect WMIExec in EVTX logs")
    d.add_argument("--evtx", required=True)
    e = sub.add_parser("exec", help="Execute via wmiexec (pentest)")
    e.add_argument("--target", required=True)
    e.add_argument("--domain", required=True)
    e.add_argument("--user", required=True)
    e.add_argument("--cmd", default="whoami")
    n = sub.add_parser("network", help="Analyze PCAP for WMI traffic")
    n.add_argument("--pcap", required=True)
    sub.add_parser("persistence", help="Check WMI persistence")
    args = parser.parse_args()
    if args.command == "detect":
        result = detect_wmiexec_artifacts_evtx(args.evtx)
    elif args.command == "exec":
        result = run_wmiexec_impacket(args.target, args.domain, args.user, args.cmd)
    elif args.command == "network":
        result = detect_wmi_network_traffic(args.pcap)
    elif args.command == "persistence":
        result = check_wmi_persistence()
    else:
        parser.print_help()
        return
    print(json.dumps(result, indent=2, default=str))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
WMI Lateral Movement Tracker and Report Generator

Tracks WMI-based lateral movement activities during red team
engagements and generates movement reports.
For authorized red team engagements only.
"""

import json
import sys
import os
from datetime import datetime


def load_movement_log(filepath: str) -> list:
    """Load lateral movement log entries."""
    try:
        with open(filepath, "r") as f:
            return json.load(f)
    except (FileNotFoundError, json.JSONDecodeError) as e:
        print(f"Error loading log: {e}")
        return []


def generate_movement_report(entries: list) -> str:
    """Generate lateral movement tracking report."""
    report = [
        "=" * 60,
        "WMI Lateral Movement Report",
        f"Generated: {datetime.now().isoformat()}",
        "=" * 60,
        "",
        f"Total Movements: {len(entries)}",
        ""
    ]

    hosts_accessed = set()
    credentials_used = set()

    for i, entry in enumerate(entries, 1):
        source = entry.get("source", "N/A")
        target = entry.get("target", "N/A")
        method = entry.get("method", "wmiexec")
        credential = entry.get("credential", "N/A")
        timestamp = entry.get("timestamp", "N/A")
        result = entry.get("result", "N/A")

        hosts_accessed.add(target)
        credentials_used.add(credential)

        report.append(f"  [{i}] {source} → {target}")
        report.append(f"      Method: {method}")
        report.append(f"      Credential: {credential}")
        report.append(f"      Time: {timestamp}")
        report.append(f"      Result: {result}")
        report.append("")

    report.extend([
        f"Unique Hosts Accessed: {len(hosts_accessed)}",
        f"Unique Credentials Used: {len(credentials_used)}",
        "",
        "Hosts:",
    ])
    for host in sorted(hosts_accessed):
        report.append(f"  - {host}")

    report.append("")
    report.append("=" * 60)
    return "\n".join(report)


def create_example_log():
    """Create an example movement log template."""
    example = [
        {
            "source": "10.10.10.100",
            "target": "10.10.10.50",
            "method": "wmiexec.py",
            "credential": "domain\\admin (PtH)",
            "timestamp": "2024-01-15T10:30:00",
            "result": "Shell obtained, credentials harvested"
        }
    ]
    with open("movement_log.json", "w") as f:
        json.dump(example, f, indent=2)
    print("Example log created: movement_log.json")


def main():
    if len(sys.argv) < 2:
        print("Usage: python process.py <movement_log.json>")
        print("       python process.py --create-template")
        return

    if sys.argv[1] == "--create-template":
        create_example_log()
        return

    entries = load_movement_log(sys.argv[1])
    if entries:
        report = generate_movement_report(entries)
        print(report)


if __name__ == "__main__":
    main()