From 18ebde9bffc72c2317d2c601c6b3bbddb276ca07 Mon Sep 17 00:00:00 2001 From: Brian Maloney Date: Mon, 22 Oct 2018 09:22:57 -0500 Subject: [PATCH 1/3] Update jobparser.py Added User Data / Reserved data , Triggers, and Job Signature. --- misc_python/jobparser.py | 258 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 242 insertions(+), 16 deletions(-) diff --git a/misc_python/jobparser.py b/misc_python/jobparser.py index 6588aa9..33cf264 100755 --- a/misc_python/jobparser.py +++ b/misc_python/jobparser.py @@ -88,6 +88,13 @@ 0x1000000:"TASK_FLAG_INTERACTIVE", } +# https://msdn.microsoft.com/en-us/library/cc248290.aspx +triggerflags = { + 01:"TASK_TRIGGER_FLAG_HAS_END_DATE", + 0b10:"TASK_TRIGGER_FLAG_KILL_AT_DURATION_END", + 0b100:"TASK_TRIGGER_FLAG_DISABLED", +} + # http://msdn.microsoft.com/en-us/library/cc248286%28v=prot.10%29.aspx priorities = { 0x20000000:"NORMAL_PRIORITY_CLASS", @@ -96,6 +103,69 @@ 0x100000:"REALTIME_PRIORITY_CLASS", } +# https://msdn.microsoft.com/en-us/library/cc248291.aspx +triggertype = { + 0x00000000:"ONCE", + 0x00000001:"DAILY", + 0x00000002:"WEEKLY", + 0x00000003:"MONTHLYDATE", + 0x00000004:"MONTHLYDOW", + 0x00000005:"EVENT_ON_IDLE", + 0x00000006:"EVENT_AT_SYSTEMSTART", + 0x00000007:"EVENT_AT_LOGON", +} + +exitcode = { + 0x0: "S_OK", + 0x1: "S_FALSE", + 0x80000002: "E_OUTOFMEMORY", + 0x80000009: "E_ACCESSDENIED", + 0x80000003: "E_INVALIDARG", + 0x80000008: "E_FAIL", + 0x8000FFFF: "E_UNEXPECTED", + 0x00041300: "SCHED_S_TASK_READY", + 0x00041301: "SCHED_S_TASK_RUNNING", + 0x00041302: "SCHED_S_TASK_DISABLED", + 0x00041303: "SCHED_S_TASK_HAS_NOT_RUN", + 0x00041304: "SCHED_S_TASK_NO_MORE_RUNS", + 0x00041305: "SCHED_S_TASK_NOT_SCHEDULED", + 0x00041306: "SCHED_S_TASK_TERMINATED", + 0x00041307: "SCHED_S_TASK_NO_VALID_TRIGGERS", + 0x00041308: "SCHED_S_EVENT_TRIGGER", + 0x80041309: "SCHED_E_TRIGGER_NOT_FOUND", + 0x8004130A: "SCHED_E_TASK_NOT_READY", + 0x8004130B: "SCHED_E_TASK_NOT_RUNNING", + 0x8004130C: "SCHED_E_SERVICE_NOT_INSTALLED", + 0x8004130D: "SCHED_E_CANNOT_OPEN_TASK", + 0x8004130E: "SCHED_E_INVALID_TASK", + 0x8004130F: "SCHED_E_ACCOUNT_INFORMATION_NOT_SET", + 0x80041310: "SCHED_E_ACCOUNT_NAME_NOT_FOUND", + 0x80041311: "SCHED_E_ACCOUNT_DBASE_CORRUPT", + 0x80041312: "SCHED_E_NO_SECURITY_SERVICES", + 0x80041313: "SCHED_E_UNKNOWN_OBJECT_VERSION", + 0x80041314: "SCHED_E_UNSUPPORTED_ACCOUNT_OPTION", + 0x80041315: "SCHED_E_SERVICE_NOT_RUNNING", + 0x80041316: "SCHED_E_UNEXPECTEDNODE", + 0x80041317: "SCHED_E_NAMESPACE", + 0x80041318: "SCHED_E_INVALIDVALUE", + 0x80041319: "SCHED_E_MISSINGNODE", + 0x8004131A: "SCHED_E_MALFORMEDXML", + 0x0004131B: "SCHED_S_SOME_TRIGGERS_FAILED", + 0x0004131C: "SCHED_S_BATCH_LOGON_PROBLEM", + 0x8004131D: "SCHED_E_TOO_MANY_NODES", + 0x8004131E: "SCHED_E_PAST_END_BOUNDARY", + 0x8004131F: "SCHED_E_ALREADY_RUNNING", + 0x80041320: "SCHED_E_USER_NOT_LOGGED_ON", + 0x80041321: "SCHED_E_INVALID_TASK_HASH", + 0x80041322: "SCHED_E_SERVICE_NOT_AVAILABLE", + 0x80041323: "SCHED_E_SERVICE_TOO_BUSY", + 0x80041324: "SCHED_E_TASK_ATTEMPTED", + 0x00041325: "SCHED_S_TASK_QUEUED", + 0x80041326: "SCHED_E_TASK_DISABLED", + 0x80041327: "SCHED_E_TASK_NOT_V1_COMPAT", + 0x80041328: "SCHED_E_START_ON_DEMAND", +} + class JobDate: def __init__(self, data, scheduled = False): # scheduled is the time the job was scheduled to run @@ -112,10 +182,10 @@ def __init__(self, data, scheduled = False): else: self.Weekday = None self.Day = struct.unpack("I", data[32:36])[0] self.MaxRunTime = struct.unpack("I", data[48:52])[0] self.RunDate = JobDate(data[52:68]) @@ -198,17 +297,64 @@ def __init__(self, data): if self.CommentSize > 0: self.Comment = data[self.cursor:self.cursor + self.CommentSize * 2].replace("\x00", "") self.cursor += self.CommentSize * 2 - # this is probably User Data + Reserved Data: - self.UserData = data[self.cursor:self.cursor + 18] - self.cursor += 18 - # This isn't really documented, but this is the time the job was scheduled to run: - self.ScheduledDate = JobDate(data[self.cursor:self.cursor + 20], scheduled = True) + self.UserDataSize = struct.unpack(" 0: + self.UserData = data[self.cursor:self.cursor + self.UserDataSize * 2].replace("\x00", "") + self.cursor += self.UserDataSize * 2 + self.ReservedDataSize = struct.unpack(" Date: Mon, 22 Oct 2018 09:33:38 -0500 Subject: [PATCH 2/3] Update jobparser.py Added check for multiple triggers so it doesn't error on signature check. --- misc_python/jobparser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misc_python/jobparser.py b/misc_python/jobparser.py index 33cf264..1ef727a 100755 --- a/misc_python/jobparser.py +++ b/misc_python/jobparser.py @@ -339,7 +339,7 @@ def __init__(self, data): self.Reserved3 = struct.unpack(" Date: Tue, 23 Oct 2018 12:36:13 -0500 Subject: [PATCH 3/3] Update jobparser.py Removed commented out code. --- misc_python/jobparser.py | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/misc_python/jobparser.py b/misc_python/jobparser.py index 1ef727a..b5ad5d6 100755 --- a/misc_python/jobparser.py +++ b/misc_python/jobparser.py @@ -384,13 +384,10 @@ def _get_job_info(self): lines.append("Working Directory: {0}".format(self.WorkingDirectory)) lines.append("User: {0}".format(self.User)) lines.append("Comment: {0}".format(self.Comment)) -# lines.append("User Data Size: {0}".format(self.UserDataSize)) -# lines.append("Reserved Data Size: {0}".format(self.ReservedDataSize)) for e in exitcode: if self.StartError == e: serror = exitcode[e] lines.append("Start Error: {0}".format(serror)) -# lines.append("Task Flags: {0}".format(self.TaskFlags)) lines.appensd("Trigger Count: {0}".format(self.TriggerCount)) lines.append("Scheduled Start Date: {0}".format(self.ScheduledStart)) lines.append("Scheduled End Date: {0}".format(self.ScheduledEnd)) @@ -410,12 +407,7 @@ def _get_job_info(self): lines.append("Trigger Type: {0}\n".format(ttype.rstrip(", "))) if self.TriggerSpecific != "": lines.append("{0}".format(self.TriggerSpecific)) -# lines.append("Padding: {0}".format(self.Padding)) -# lines.append("Reserved2: {0}".format(self.Reserved2)) -# lines.append("Reserved3: {0}".format(self.Reserved3)) if self.Test != '': -# lines.append("Signature Version: {0}".format(self.SignatureVersion)) -# lines.append"Min Client Version: {0}".format(self.MinClientVersion)) str = "" for ch in self.JobSignature: str += hex(ord(ch)).lstrip("0x") @@ -459,13 +451,10 @@ def __repr__(self): lines += "Working Directory: {0}\n".format(self.WorkingDirectory) lines += "User: {0}\n".format(self.User) lines += "Comment: {0}\n".format(self.Comment) -# lines += "User Data Size: {0}\n".format(self.UserDataSize) -# lines += "Reserved Data Size: {0}\n".format(self.ReservedDataSize) for e in exitcode: if self.StartError == e: serror = exitcode[e] lines += "Start Error: {0}\n".format(serror) -# lines += "Task Flags: {0}\n".format(self.TaskFlags) lines += "Trigger Count: {0}\n".format(self.TriggerCount) lines += "Scheduled Start Date: {0}\n".format(self.ScheduledStart) lines += "Scheduled End Date: {0}\n".format(self.ScheduledEnd) @@ -485,12 +474,7 @@ def __repr__(self): lines += "Trigger Type: {0}\n".format(ttype) if self.TriggerSpecific != "": lines += "{0}".format(self.TriggerSpecific) -# lines += "Padding: {0}\n".format(self.Padding) -# lines += "Reserved2: {0}\n".format(self.Reserved2) -# lines += "Reserved3: {0}\n".format(self.Reserved3) if self.Test != '': -# lines += "Signature Version: {0}\n".format(self.SignatureVersion) -# lines += "Min Client Version: {0}\n".format(self.MinClientVersion) str = "" for ch in self.JobSignature: str += hex(ord(ch)).lstrip("0x")