收集windows上软件安装信息
收集windows上软件安装信息,需要编译成exe文件后运行(如果没有环境的话) 需要用到pubapi来写入数据库 由于wazuh有同样的功能可以替代,故本脚本只做技术储备
import winreg, requests, json, platform, socket, time, random
from datetime import date
from requests import urllib3
urllib3.disable_warnings()
#测试的时候可以调整这个数值,保留是因为服务端是flask写的,怕量太大崩掉
delay=random.randint(1,1200)
for i in range(delay, θ,-10):
remaining = min(i, 10)
print(f" This script will run in {i} seconds, please wait... ")
time.sleep(remaining)
def getInstalledSoftware():
softwareSet = set()
#处理64位注册表中的软件信息
uninstallKey64 = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,r"Software\Microsoft\Windows\CurrentVersion\Uninstall")
softwareSet.update(getSoftwareFromRegistry(uninstallKey64))
#处理32位注册表中的软件信息
uninstallKey32 = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,r"Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall")
softwareSet.update(getSoftwareFromRegistry(uninstallKey32))
return list(softwareSet)
def getSoftwareFromRegistry(regKey):
softwareList = []
for i in range(θ, winreg.QueryInfoKey(regKey)[θ]):
subKeyName = winreg.EnumKey(regKey,i)
subKey = winreg.OpenKey(regKey,subKeyName)
try:
displayName = winreg.QueryValueEx(subKey,"DisplayName")[0]
displayVersion = winreg.QueryValueEx(subKey,"DispLayVersion")[θ]
#白名单软件
if displayName != 'aic94xx-firmware' and displayName != ' Azure Data Studio' and '系統更新應用程式' not in displayName and ' Update for' not in displayName and ' for SQL Server' not indisplayName and displayName != ' cim-schema' and ' Cloudbase' not in displayName and ' dstat' notin displayName and displayName != ' galera-4' and displayName != ' hdparm' and ' Hotfix' not indisplayName and displayName != 'iDRAC-with-Lifecycle-Controller' and 'IIS URL' not indisplayName and displayName != ' Integration Services' and displayName != ' Kits Configuration Installer' and ' Analysis Services' not in displayName and displayName != ' Microsoft Edge Update' and ' Language Pack' not in displayName and ' Microsoft Exchange Speech' not in displayName and ' Microsoft Help Viewer' not in displayName and ' Microsoft Server Speech' not in displayName and ' Microsoft Speech' not in displayName and 'T-SQL' not in displayName and ' Setup Support Files' not in displayName and ' Native Client' not in displayName and 'RsFx D river' not in displayName and ' Setup (English)' not in displayName and ' Microsoft Unified Communications Managed API' not in displayName and ' Microsoft Visual Studio Tools' not in displayName and ' Microsoft VSS Writer' not in displayName and ' Notepad++' not in displayName and displayName !='SDK Debuggers' and ' Security Update for' not in displayName and ' Spice Agent' not indisplayName and ' Batch Parser' and ' Tools for' not in displayName and ' Client Tools' not in displayName and ' Common Files' not in displayName and ' Connection Info' not in displayName and ' Database Engine' not in displayName and 'DMF' not in displayName and ' DocumentationComponents' not in displayName and ' Shared Management Objects' not in displayName and 'SQL Diagnostics' not in displayName and ' Reporting Services' not in displayName and ' Trellix ' not in displayName and ' for SSMS' not in displayName and ' Wazuh Agent' not in displayName and 'SDK EULA' not in displayName and ' Software Development Kit' not in displayName:
softwareList.append((displayName, displayVersion)) # 将软件信息转换为元组
except:
pass
return softwareList
def getComputerInfo():
hostname = socket.gethostname()
ip = socket.gethostbyname(hostname)
osName = platform.system()
osVersion = platform.version()
today = date.today().strftime("%Y-%m-%d")
return {"ip": ip, "hostname": hostname, "osname": osName, "osversion": osVersion, "date": today}
softwareInfo = getInstalledSoftware()
computerInfo = getComputerInfo()
finalData = []
for software in softwareInfo:
if "'" in software[0]:
softwareName = software[θ].
split()[0]else:softwareName = software[θ]
softwareData = {"ip": computerInfo["ip"],"hostname": computerInfo["hostname"],"software": softwareName,"version": software[1],"osname":computerInfo["osname"],"osversion": computerInfo["osversion"]}
finalData.append(softwareData)
jsonData = json.dumps(finalData)
url=' <domainname>/insert'
headers = {'Content-Type': 'application/json'}
print (requests.post(url,verify= False, data=jsonData, headers=headers).text)