EricZimmerman / EricZimmerman/KapeFiles

Implement module variable to support root paths

Open
#812 0 comments 0 reactions 1 assignee Claimed by @EricZimmerman View on GitHub
enhancement
Dominant language
No language data
Stars
874
Forks
234
Avg merge
1h 46m
Merged PRs (30d)
10

Description

**KAPE version**
1.3.0.2

**Is your feature request related to a problem? Please describe.**
A number of modules rely on specific folder paths, but because files are copied to separate base directories (`C`, `VSS1`, etc), they have no way to actually specify "go parse the file at this path relative to the drive root". A few examples:
1. [NirSoft_BrowsingHistoryView](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Apps/NirSoft/NirSoft_BrowsingHistoryView.mkape) needs the path to the C:\Users folder to exist (`%sourceDirectory%\Users`)
2. [Winlogbeat_ALL](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Apps/Winlogbeat_ALL.mkape) currently uses a FileMask for every single EVTX, but I think would work better if `\Windows\System32\winevt\logs\.evtx` could be specified
3. [SQLite3_TeraCopy_History](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Apps/SQLite3_TeraCopy_History.mkape) uses a filemask to parse every single `*.db` file, which the comments note will be noisy.

**Describe the solution you'd like**
An additional variable, something like `%baseDirectory%`, that could be provided to processors.
When the module is called, KAPE would run the processor once for each base directory in `msource` (`C`, `VSS1`, `VSS2`, etc), with the full path to that "base directory" substituted in for the value.
This would be similar to KAPE running the processor once for each result of a File Mask.

`%sourceDirectoryBase%` [is already defined for modules](https://ericzimmerman.github.io/KapeDocs/#!Pages%5C2.2-Modules.md).

**Describe alternatives you've considered**
So far I've only come up with 4 solutions, none of which feel "good":
* Use FileMask with a very wide net, accepting that it will catch lots of things like examples 2 & 3 above. This would cause a lot of calls to the processors for false positives - example 2 probably means 50+ executions of the program for a single file, and 3 would be even worse. This also would generate a lot of extra irrelevant output
* Have users specify the baseDirectory instead of `tdest` in `msource`, as in example 1. This becomes unintuitive - if you check "BrowsingHistory" and "BrowsingHistoryView" as a target&module and hit execute, you don't get browsing history in the module output because the user has to set things up differently
* Use filemask to find a static file, like `$MFT`, that can then be used to reference `%sourceDirectoryBase%`. This achieves the goal, but relies on artifacts being collected that would not make sense to collect for the artifact. Using the previous thought experiment, with "BrowsingHistoryView" you wouldn't get the `$MFT` necessary as an anchor file.
* Create a shim script that does this processing for each base directory. This is a workaround I can implement if necessary but it feels goofy/backwards to not just have it handled by KAPE.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.