The goal was to be able to search for files on the workstations.
More specifically, mobile apps that don't appear in the inventory. And often not updated, therefore potentially vulnerable
The previous code works, but I would have liked to optimize it by also updating the version of the .exe file
Here's what I tested:
Code: Select all
# -*- coding: utf-8 -*-
from setuphelpers import *
import pathlib
import win32api
def install():
pass
def audit():
fileDir = r'C:\\'
fileExt = r"**\*nomdufichier*"
liste_fichiers = list(pathlib.Path(fileDir).glob(fileExt))
for fname in liste_fichiers:
properties= getFileProperties(fname)
print('properties = %s ' %properties)
print('Fichiers trouvés: %s propriétés %s' %(fname , properties))
if liste_fichiers:
print('Fichiers trouvés: %s ' %liste_fichiers)
return 'WARNING'
print('Aucun fichiers trouvés')
return 'OK'
#==============================================================================
def getFileProperties(fname):
#==============================================================================
"""
Read all properties of the given file return them as a dictionary.
"""
propNames = ('Comments', 'InternalName', 'ProductName',
'CompanyName', 'LegalCopyright', 'ProductVersion',
'FileDescription', 'LegalTrademarks', 'PrivateBuild',
'FileVersion', 'OriginalFilename', 'SpecialBuild')
props = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
try:
# backslash as parm returns dictionary of numeric info corresponding to VS_FIXEDFILEINFO struc
fixedInfo = win32api.GetFileVersionInfo(fname, '\\')
props['FixedFileInfo'] = fixedInfo
props['FileVersion'] = "%d.%d.%d.%d" % (fixedInfo['FileVersionMS'] / 65536,
fixedInfo['FileVersionMS'] % 65536, fixedInfo['FileVersionLS'] / 65536,
fixedInfo['FileVersionLS'] % 65536)
# \VarFileInfo\Translation returns list of available (language, codepage)
# pairs that can be used to retreive string info. We are using only the first pair.
lang, codepage = win32api.GetFileVersionInfo(fname, '\\VarFileInfo\\Translation')[0]
# any other must be of the form \StringfileInfo\%04X%04X\parm_name, middle
# two are language/codepage pair returned from above
strInfo = {}
for propName in propNames:
strInfoPath = u'\\StringFileInfo\\%04X%04X\\%s' % (lang, codepage, propName)
## print str_info
strInfo[propName] = win32api.GetFileVersionInfo(fname, strInfoPath)
props['StringFileInfo'] = strInfo
except:
pass
return props
The for loop should have been under the if statement, but it was for debugging purposes
In the end I was unable to use the function def getFileProperties(fname):
find on:
https://stackoverflow.com/questions/580 ... on-windows
Here is the result:
Code: Select all
Auditing XXX-searchfile
properties = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
Fichiers trouvés: C:\Users\user1\AppData\Roaming\AnyDesk propriétés {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
properties = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
Fichiers trouvés: C:\Users\user1\Downloads\AnyDesk.exe propriétés {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
properties = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
Fichiers trouvés: C:\Users\user1\Pictures\AnyDesk propriétés {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
properties = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
Fichiers trouvés: C:\Windows\Prefetch\ANYDESK.EXE-0A8BB3A0.pf propriétés {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
Fichiers trouvés: [WindowsPath('C:/Users/user1/AppData/Roaming/AnyDesk'), WindowsPath('C:/Users/user1/Downloads/AnyDesk.exe'), WindowsPath('C:/Users/user1/Pictures/AnyDesk'), WindowsPath('C:/Windows/Prefetch/ANYDESK.EXE-0A8BB3A0.pf')]
If someone could help me by optimizing the package to get the executable version, that would be great.
Otherwise I will close the topic.
Thank you.
