Skip to content

Commit ca967a1

Browse files
alessandrogarioalessandrogario
authored
Writable windows_sync_objects table (#27)
This is a port of the old windows_sync_objects table to writable extension tables * Add the windows-sync-objects extension * replace usage of osquery::safestrtoull * windows_sync_objects now builds with the rest of the extensions * Added support for custom error messages * Code review changes * Update the documentation * Ephemeral row IDs were not being checked correctly
1 parent 664bc93 commit ca967a1

9 files changed

+1277
-8
lines changed

‎README.md

+11-8
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@ This repository includes [osquery](https://osquery.io/) [extensions](https://osq
44

55
[Extensions](https://osquery.readthedocs.io/en/stable/deployment/extensions/) are a type of osquery add-on that can be loaded at runtime to provide new virtual tables, with capabilities that go beyond the limitations of mainline osquery. Trail of Bits has developed extensions to provide tables that can _manage_ service configurations as well as _view_ them (currently pending the merge of [PR4094](https://github.com/facebook/osquery/pull/4094)), or that can cross-check information on the host with external third-party services. The extensions interface is commonly used to address individual organizations' needs, or to implement proprietary detection methods. Here we use it to demonstrate some pioneering use cases of osquery. To learn more, view our talk ([slides](https://github.com/trailofbits/presentations/tree/master/Osquery%20Extensions), [video](https://www.youtube.com/watch?v=g46rjoP18EE)) from QueryCon 2018.
66

7-
| Extension | Description | Supported Endpoints |
8-
| :-: | :-: | :-: |
9-
| efigy | Integrates osquery with the Duo Labs EFIgy API to determine if the EFI firmware on your Mac fleet is up-to-date. | macOS |
10-
| santa | Integrates osquery with the Santa application whiteslisting solution. Check DENY events and manage the whitelist/blacklist rules. | macOS |
11-
| fwctl | Provides osquery with the ability to view and manage the OS-native firewall rules and `/etc/hosts` file (port and host blocking). | macOS, Linux, Windows |
12-
| ntfs_forensics | Provides osquery with NTFS-specific forensic information for incident responders. | Windows |
13-
| (more to come) | ... | ... |
7+
| Extension | Description | Supported Endpoints |
8+
| :-: | :-: | :-: |
9+
| efigy | Integrates osquery with the Duo Labs EFIgy API to determine if the EFI firmware on your Mac fleet is up-to-date. | macOS |
10+
| santa | Integrates osquery with the Santa application whiteslisting solution. Check DENY events and manage the whitelist/blacklist rules. | macOS |
11+
| fwctl | Provides osquery with the ability to view and manage the OS-native firewall rules and `/etc/hosts` file (port and host blocking). | macOS, Linux, Windows |
12+
| ntfs_forensics | Provides osquery with NTFS-specific forensic information for incident responders. | Windows |
13+
| windows_sync_objects | Provides osquery with the ability of listing and locking Windows synchronization objects (mutants, events, semaphores). | Windows |
14+
| (more to come) | ... | ... |
1415

1516
## Dependencies
1617

@@ -30,7 +31,9 @@ So, for Windows, after cloning the osquery repository and cherry-picking the com
3031
2. Uninstall the boost-msvc14 package that osquery's scripts just installed: `choco uninstall boost-msvc14`
3132
3. Build the Boost package from source (at a Powershell prompt): `.\tools\provision\chocolatey\boost-msvc14.ps1`
3233
4. Enter the folder where the package was created: `cd .\build\chocolatey\boost-msvc14\boost_1_66_0\osquery-choco`
33-
5. Run `choco install -s . .\boost-msvc14.1.66.0-r1.nupkg` to install the Boost package you just built.
34+
5. Run `choco install -s . .\boost-msvc14.1.66.0-r2.nupkg` to install the Boost package you just built.
35+
36+
In case you want a binary package, we have uploaded one in the [releases](https://github.com/trailofbits/osquery-extensions/releases) page.
3437

3538
##### macOS
3639

‎windows_sync_objects/.platforms

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
WINDOWS

‎windows_sync_objects/CMakeLists.txt

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Copyright (c) 2018 Trail of Bits, Inc.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
cmake_minimum_required(VERSION 3.10)
16+
project(windows_sync_objects)
17+
18+
function(main)
19+
set(project_common_source_files
20+
src/winapi.h
21+
22+
src/objectmanager.h
23+
src/objectmanager.cpp
24+
25+
src/windowssyncobjects.h
26+
src/windowssyncobjects.cpp
27+
)
28+
29+
set(project_include_dirs
30+
"${CMAKE_CURRENT_SOURCE_DIR}/src"
31+
)
32+
33+
add_osquery_extension_ex("WindowsSyncObjectsTablePlugin" "table" "windows_sync_objects"
34+
SOURCES ${project_common_source_files}
35+
INCLUDEDIRS ${project_include_dirs}
36+
MAININCLUDES windowssyncobjects.h
37+
LIBRARIES
38+
)
39+
endfunction()
40+
41+
main()

‎windows_sync_objects/README.md

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# windows_sync_objects Extension
2+
3+
This extension provides a list of all mutants, semaphores and events on the system. Additionally, the user is able to create and destroy his own objects using INSERT and DELETE queries.
4+
5+
## Schema
6+
7+
| Column | Type | Description |
8+
|----------------|------|------------------------------------------------|
9+
| type | TEXT | Either Mutant, Event or Semaphore |
10+
| path | TEXT | The folder path |
11+
| name | TEXT | The object name |
12+
| field1_name | TEXT | Name for custom field 1 |
13+
| field1_value | TEXT | Value for custom field 1 |
14+
| field2_name | TEXT | Name for custom field 2 |
15+
| field2_value | TEXT | Value for custom field 2 |
16+
| field3_name | TEXT | Name for custom field 3 |
17+
| field3_value | TEXT | Value for custom field 3 |
18+
19+
### Event objects
20+
1. **field1**: Notification or Synchronization.
21+
2. **field2**: Signaled
22+
23+
### Mutant objects
24+
1. **field1**: CurrentCount
25+
2. **field2**: OwnedByCaller
26+
3. **field3**: AbandonedState
27+
28+
### Semaphore objects
29+
1. **field1**: CurrentCount
30+
2. **field2**: MaximumCount
31+
32+
33+
## Usage
34+
35+
### Creating a new mutant object
36+
``` sql
37+
INSERT INTO windows_sync_objects
38+
(type, path, name)
39+
40+
VALUES
41+
('Mutant', '\BaseNamedObjects', 'trailofbits_mutex');
42+
```
43+
44+
### Removing an object
45+
46+
``` sql
47+
DELETE FROM windows_sync_objects
48+
WHERE name = 'trailofbits_mutex';
49+
```
50+
51+
## License
52+
The code in this repository is licensed under the [Apache 2.0 license](../LICENSE).

0 commit comments

Comments
 (0)