<s> """<STR_LIT>""" <EOL> import struct <EOL> import string <EOL> import volatility . plugins . common as common <EOL> import volatility . obj as obj <EOL> import volatility . utils as utils <EOL> import volatility . win32 . tasks as tasks <EOL> __author__ = "<STR_LIT>" <EOL> __copyright__ = "<STR_LIT>" <EOL> __license__ = "<STR_LIT>" <EOL> USERNAME_CHARSET = string . ascii_letters + string . digits + "<STR_LIT>" <EOL> def valid_bool ( x ) : <EOL> return <NUM_LIT:0> <= x <= <NUM_LIT:1> <EOL> def terminate_string ( s ) : <EOL> s , _ , _ = s . partition ( "<STR_LIT>" ) <EOL> return s <EOL> class OpenVPN ( common . AbstractWindowsCommand ) : <EOL> """<STR_LIT>""" <EOL> def calculate ( self ) : <EOL> """<STR_LIT>""" <EOL> kernel_memory = utils . load_as ( self . _config ) <EOL> processes = tasks . pslist ( kernel_memory ) <EOL> processes = filter ( lambda p : str ( p . ImageFileName ) . lower ( ) == "<STR_LIT>" , processes ) <EOL> for process in processes : <EOL> process_memory = process . get_process_address_space ( ) <EOL> pid = int ( process . UniqueProcessId ) <EOL> image_base = process . Peb . ImageBaseAddress <EOL> dos_header = obj . Object ( "<STR_LIT>" , offset = image_base , vm = process_memory ) <EOL> nt_header = dos_header . get_nt_header ( ) <EOL> sections = nt_header . get_sections ( True ) <EOL> sections = filter ( lambda s : str ( s . Name ) in [ "<STR_LIT>" , "<STR_LIT>" ] , sections ) <EOL> if len ( sections ) == <NUM_LIT:0> : <EOL> continue <EOL> for section in sections : <EOL> sec_start = section . VirtualAddress + image_base <EOL> sec_end = sec_start + section . Misc . VirtualSize <EOL> sec_type = str ( section . Name ) <EOL> for creds_start in xrange ( sec_start , sec_end , <NUM_LIT:16> ) : <EOL> creds = process_memory . read ( creds_start , <NUM_LIT:16> ) <EOL> if not creds : <EOL> continue <EOL> struct_layout = None <EOL> struct_length = None <EOL> defined , nocache , username = struct . unpack ( "<STR_LIT>" , creds ) <EOL> if sec_type == "<STR_LIT>" and valid_bool ( defined ) and valid_bool ( nocache ) and username [ <NUM_LIT:0> ] in USERNAME_CHARSET : <EOL> struct_layout = "<STR_LIT>" <EOL> struct_length = <NUM_LIT:4> + <NUM_LIT:4> + <NUM_LIT> + <NUM_LIT> <EOL> defined , nocache , username = struct . unpack ( "<STR_LIT>" , creds ) <EOL> if sec_type == "<STR_LIT>" and valid_bool ( defined ) and valid_bool ( nocache ) and username [ <NUM_LIT:0> ] in USERNAME_CHARSET : <EOL> struct_layout = "<STR_LIT>" <EOL> struct_length = <NUM_LIT:1> + <NUM_LIT:1> + <NUM_LIT> + <NUM_LIT> <EOL> if struct_layout is not None : <EOL> creds = process_memory . zread ( creds_start , struct_length ) <EOL> _ , _ , username , password = struct . unpack ( struct_layout , creds ) <EOL> username = terminate_string ( username ) <EOL> password = terminate_string ( password ) <EOL> yield ( pid , username , password ) <EOL> break <EOL> def render_text ( self , outfd , data ) : <EOL> """<STR_LIT>""" <EOL> self . table_header ( outfd , [ <EOL> ( "<STR_LIT>" , "<STR_LIT>" ) , <EOL> ( "<STR_LIT>" , "<STR_LIT>" ) , <EOL> ( "<STR_LIT>" , "<STR_LIT>" ) ] ) <EOL> for ( pid , username , password ) in data : <EOL> self . table_row ( outfd , pid , username , password ) </s>
