Merge pull request #271 from cclgroupltd/add_fcm

Add fcm
abrignoni · Jul 28, 2022 · ce31cf9 · ce31cf9
2 parents de44749 + 60a64ef
commit ce31cf9
Show file tree

Hide file tree

Showing 13 changed files with 2,397 additions and 1 deletion.
diff --git a/scripts/artifacts/FCMQueuedMessageOutlook.py b/scripts/artifacts/FCMQueuedMessageOutlook.py
@@ -0,0 +1,82 @@
+"""
+Copyright 2022, CCL Forensics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+"""
+
+import json
+import pathlib
+from scripts.ccl_android_fcm_queued_messages import FcmIterator
+from scripts.artifact_report import ArtifactHtmlReport
+import scripts.ilapfuncs
+
+__version__ = "0.2"
+__description__ = """
+Reads records from the fcm_queued_messages.ldb leveldb in com.google.android.gms related to 
+com.microsoft.office.outlook"""
+__contact__ = "Alex Caithness (research [at] cclsolutionsgroup.com)"
+
+
+def get_fcm_outlook(files_found, report_folder, seeker, wrap_text):
+    # we only need the input data dirs not every matching file
+    in_dirs = set(pathlib.Path(x).parent for x in files_found)
+    rows = []
+    for in_db_path in in_dirs:
+        with FcmIterator(in_db_path) as record_iterator:
+            for rec in record_iterator:
+                if rec.package == "com.microsoft.office.outlook":
+                    if rec.key_values["type"] == "OutlookPushNotification":
+                        hx_message = json.loads(rec.key_values["HxMessage"])
+                        for notification in hx_message["NewMailNotifications"]:
+                            rows.append([
+                                rec.timestamp,
+                                notification["ReceivedOrRenewTime"],
+                                rec.key,
+                                [hx_message["TenantGuid"], hx_message["MailboxGuid"]],
+                                notification["Sender"],
+                                notification["Topic"],
+                                notification["Preview"]
+                            ])
+                    else:
+                        print(rec.key_values)
+                        raise ValueError(f"Unknown type {rec.key_values['type']}")
+
+    if rows:
+        report = ArtifactHtmlReport("Outlook Notifications (Firebase Cloud Messaging Queued Messages)")
+        report_name = "FCM-Outlook Notifications"
+        report.start_artifact_report(report_folder, report_name)
+        report.add_script()
+        data_headers = ["FCM Timestamp", "Received / Renew Time", "FCM Key", "Tenant / Mailbox GUID", "Sender", "Topic", "Preview"]
+        source_files = " ".join(str(x) for x in in_dirs)
+
+        report.write_artifact_data_table(data_headers, rows, source_files)
+        report.end_artifact_report()
+
+        scripts.ilapfuncs.tsv(report_folder, data_headers, rows, report_name, source_files)
+        scripts.ilapfuncs.timeline(report_folder, report_name, rows, data_headers)
+    else:
+        scripts.ilapfuncs.logfunc("No FCM Outlook notifications found")
+
+
+__artifacts__ = {
+        "FCM_Outlook": (
+                "Firebase Cloud Messaging",
+                ('*/fcm_queued_messages.ldb/*'),
+                get_fcm_outlook)
+}
diff --git a/scripts/artifacts/FCMQueuedMessagesDump.py b/scripts/artifacts/FCMQueuedMessagesDump.py
@@ -0,0 +1,85 @@
+"""
+Copyright 2022, CCL Forensics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+"""
+
+import pathlib
+import typing
+
+from scripts.ccl_android_fcm_queued_messages import FcmIterator
+from scripts.artifact_report import ArtifactHtmlReport
+import scripts.ilapfuncs
+
+
+__version__ = "1.1"
+__description__ = """Creates a summary report of all records from the fcm_queued_messages.ldb leveldb in 
+com.google.android.gms"""
+__contact__ = "Alex Caithness (research [at] cclsolutionsgroup.com)"
+
+
+class SupportsContains(typing.Protocol):
+    def __contains__(self, item) -> bool:
+        ...
+
+
+def get_fcm_dump(files_found, report_folder, seeker, wrap_text):
+    # we only need the input data dirs not every matching file
+    in_dirs = set(pathlib.Path(x).parent for x in files_found)
+    package_tables = {}
+    for in_db_dir in in_dirs:
+        with FcmIterator(in_db_dir) as iterator:
+            for record in iterator:
+                if record.package not in package_tables:
+                    package_tables[record.package] = []
+
+                for k, v in record.key_values.items():
+                    package_tables[record.package].append([
+                        record.timestamp,
+                        pathlib.Path(record.originating_file).name,
+                        record.key,
+                        k,
+                        v
+                    ])
+
+        if not package_tables:
+            scripts.ilapfuncs.logfunc("No FCM Notifications Found")
+
+        for package, rows in package_tables.items():
+            report = ArtifactHtmlReport(f"Firebase Cloud Messaging Queued Messages Dump: {package}")
+            report_name = f"FCM-Dump-{package}"
+            report.start_artifact_report(report_folder, report_name)
+            report.add_script()
+            data_headers = ["Timestamp", "Originating File", "Record ID", "Key", "Value"]
+            source_files = " ".join(str(x) for x in in_dirs)
+
+            report.write_artifact_data_table(data_headers, rows, source_files)
+            report.end_artifact_report()
+
+            scripts.ilapfuncs.tsv(report_folder, data_headers, rows, report_name, source_files)
+            scripts.ilapfuncs.timeline(report_folder, report_name, rows, data_headers)
+
+
+
+__artifacts__ = {
+        "FCM_Dump": (
+                "Firebase Cloud Messaging",
+                ('*/fcm_queued_messages.ldb/*'),
+                get_fcm_dump)
+}
diff --git a/scripts/artifacts/FCMQueuedMessagesInstagram.py b/scripts/artifacts/FCMQueuedMessagesInstagram.py
@@ -0,0 +1,78 @@
+"""
+Copyright 2022, CCL Forensics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+"""
+import pathlib
+import json
+from scripts.ccl_android_fcm_queued_messages import FcmIterator
+from scripts.artifact_report import ArtifactHtmlReport
+import scripts.ilapfuncs
+
+
+__version__ = "0.2"
+__description__ = """
+Reads records from the fcm_queued_messages.ldb leveldb in com.google.android.gms related to com.instagram.android"""
+__contact__ = "Alex Caithness (research [at] cclsolutionsgroup.com)"
+
+
+def get_fcm_instagram(files_found, report_folder, seeker, wrap_text):
+    # we only need the input data dirs not every matching file
+    in_dirs = set(pathlib.Path(x).parent for x in files_found)
+    rows = []
+
+    for in_db_path in in_dirs:
+        with FcmIterator(in_db_path) as record_iterator:
+            for rec in record_iterator:
+                if rec.package == "com.instagram.android":
+                    if "data" in rec.key_values:
+                        obj = json.loads(rec.key_values["data"])
+                        if "c" in obj:
+                            rows.append([rec.timestamp, obj["c"], obj["m"], rec.key, obj["PushNotifID"], obj["ig"]])
+                        elif "collapse_key" in obj:
+                            rows.append(
+                                [rec.timestamp, obj["collapse_key"], obj["m"], rec.key, obj["PushNotifID"], obj["ig"]])
+                        else:
+                            raise ValueError("unknown notification format")
+
+        if rows:
+            report = ArtifactHtmlReport("Instagram Notifications (Firebase Cloud Messaging Queued Messages)")
+            report_name = "FCM-Instagram Notifications"
+            report.start_artifact_report(report_folder, report_name)
+            report.add_script()
+            data_headers = [
+                "Timestamp", "Notification Type", "Notification", "FCM Key", "Push Notification ID", "IG Endpoint"
+            ]
+            source_files = " ".join(str(x) for x in in_dirs)
+
+            report.write_artifact_data_table(data_headers, rows, source_files)
+            report.end_artifact_report()
+
+            scripts.ilapfuncs.tsv(report_folder, data_headers, rows, report_name, source_files)
+            scripts.ilapfuncs.timeline(report_folder, report_name, rows, data_headers)
+        else:
+            scripts.ilapfuncs.logfunc("No FCM Instagram notifications found")
+
+
+__artifacts__ = {
+    "FCM_Instagram": (
+        "Firebase Cloud Messaging",
+        ('*/fcm_queued_messages.ldb/*'),
+        get_fcm_instagram)
+}