#!/usr/bin/python3 # # Author: Panagiotis Chartas (t3l3machus) # https://github.com/t3l3machus import os, re, argparse from pathlib import Path from stat import S_ISCHR, ST_MODE, S_ISBLK, S_ISFIFO, S_ISSOCK from platform import system as get_system_type from sys import exit as _exit def move_on(): pass # Enable colors if Windows WINDOWS = True if get_system_type() == 'Windows' else False os.system('') if WINDOWS else move_on ''' Colors ''' LINK = '\033[1;38;5;37m' BROKEN = '\033[48;5;234m\033[1;31m' CHARSPEC = '\033[0;38;5;228m' #CHARSPEC = '\033[48;5;234m\033[1;33m' #PIPE = '\033[38;5;214m' PIPE = '\033[48;5;234m\033[1;30m' SOCKET = '\033[1;38;5;98m' EXECUTABLE = '\033[1;38;5;43m' DENIED = '\033[38;5;222m' DEBUG = '\033[0;38;5;214m' GREEN = '\033[38;5;47m' DIR = '\033[1;38;5;12m' MATCH = '\033[1;38;5;201m' FAILED = '\033[1;31m' END = '\033[0m' BOLD = '\033[1m' # -------------- Arguments & Usage -------------- # parser = argparse.ArgumentParser( formatter_class = argparse.RawTextHelpFormatter, epilog = ''' Usage tips: - Regex -x search actually returns a unique list of all matched patterns in a file. Be careful when combining it with -v (--verbose), try to be specific and limit the length of chars to match. - You can use this tool as the classic "tree" command if you do not provide keywords -k and regex -x values. This is useful in case you have gained a limited shell on a machine and want to have "tree" with colored output to look around. Useful keywords/regex patterns: Regex to look for passwords: -x ".{0,3}passw.{0,3}[=]{1}.{0,18}" Keywords to look for sensitive info: -k passw,db_,admin,account,user,token ''' ) parser.add_argument("-r", "--root-path", action="store", help = "The root path to walk.", required = True) parser.add_argument("-k", "--keywords", action="store", help = "Comma separated keywords to search for in files.") parser.add_argument("-x", "--regex", action="store", help = "Regex pattern to search for in files. In combination with --verbose, this option returns all values that matched the given pattern for each file, you should use it with caution while setting character limits before and after your actual pattern.") parser.add_argument("-a", "--match-all", action="store_true", help = "By default, files are highlighted when at least one keyword is matched. Use this option to highlight files that match all given keywords only. This option has no effect when used with regex.") parser.add_argument("-L", "--level", action="store", help = "Descend only level directories deep.", type = int) parser.add_argument("-c", "--case-sensitive", action="store_true", help = "Enables case sensitive keywords/regex search.") parser.add_argument("-b", "--binary", action="store_true", help = "Search for keywords/regex in binary files too.") parser.add_argument("-v", "--verbose", action="store_true", help = "Print information about which keyword(s) matched.") parser.add_argument("-i", "--interesting-only", action="store_true", help = "List only files with matching keywords/regex content (significantly reduces output length).") parser.add_argument("-f", "--full-pathnames", action="store_true", help = "Print absolute file and directory paths.") parser.add_argument("-A", "--ascii", action="store_true", help = "Use ASCII instead of extended characters (use this in case of \"UnicodeEncodeError: 'ascii' codec...\" along with -q).") parser.add_argument("-d", "--directories-only", action="store_true", help = "List directories only.") parser.add_argument("-l", "--follow-links", action="store_true", help = "Follows symbolic links if they point to directories, as if they were directories. Symbolic links that will result in recursion are avoided when detected.") parser.add_argument("-q", "--quiet", action="store_true", help = "Do not print the banner on startup.") args = parser.parse_args() def exit_with_msg(msg): print('[' + DEBUG + 'Debugger' + END + '] ' + msg) _exit(1) # Init keyword(s)/regex list if any provided if args.keywords and args.regex: exit_with_msg("You can't use keywords (-k) and regex (-x) at the same time.") keywords = [] if args.keywords: for word in args.keywords.split(","): if len(word.strip()) > 0: keywords.append(word.strip()) verify = [k for k in keywords if k.strip() != ''] if not len(verify): exit_with_msg("Illegal keyword(s) value(s).") elif args.regex: keywords = [args.regex] total_keywords = len(keywords) # Define depth level if isinstance(args.level, int): depth_level = args.level if (args.level > 0) else exit_with_msg('Level (-L) must be greater than 0.') else: depth_level = 4096 process_files = True if (args.keywords or args.regex) else False print_fnames = True if not args.directories_only else False # Filetypes to avoid searching for keywords/regex: filetype_blacklist = ['gz', 'zip', 'tar', 'rar', '7z', 'bz2', 'xz', 'deb', 'img', 'iso', 'vmdk', 'dll', 'ovf', 'ova'] # -------------- Functions -------------- # def print_banner(): print('\r') padding = ' ' E = [[' ', '┌', '─', '┐'], [' ', '├┤',' '], [' ', '└','─','┘']] V = [[' ', '┬', ' ', ' ', '┬'], [' ', '└','┐','┌', '┘'], [' ', ' ','└','┘', ' ']] I = [[' ', '┬'], [' ', '│',], [' ', '┴']] L = [[' ', '┬',' ',' '], [' ', '│',' ', ' '], [' ', '┴','─','┘']] T = [[' ', '┌','┬','┐'], [' ', ' ','│',' '], [' ', ' ','┴',' ']] R = [[' ', '┬','─','┐'], [' ', '├','┬','┘'], [' ', '┴','└','─']] banner = [E,V,I,L,T,R,E,E] final = [] init_color = 43 txt_color = init_color cl = 0 for charset in range(0, 3): for pos in range(0, len(banner)): for i in range(0, len(banner[pos][charset])): clr = '\033[38;5;' + str(txt_color) + 'm' char = clr + banner[pos][charset][i] final.append(char) cl += 1 txt_color = txt_color + 36 if cl <= 3 else txt_color cl = 0 txt_color = init_color init_color += 31 if charset < 2: final.append('\n ') print(' ' + ''.join(final)) print(END + padding +' by t3l3machus\n') def load_file(file_path, mode): f = open(file_path, mode) content = f.read() f.close() return content def decoder(l): decoded = [] for item in l: if isinstance(item, bytes): decoded.append(item.decode('utf-8', 'ignore')) else: decoded.append(item) return decoded def file_inspector(file_path, mode = 0): try: ''' Load file content accordingly ''' try: content = load_file(file_path, 'r') binary = False except UnicodeDecodeError: content = load_file(file_path, 'rb') binary = True except PermissionError: return 1 except MemoryError: return 2 except KeyboardInterrupt: return 999 #exit_with_msg('Keyboard interrupt.') except: return FAILED ''' Search content ''' matched = [] for w in keywords: ''' Set regex ''' if args.keywords: w = re.escape(w) if binary: regex = re.compile(bytes(w.encode('utf-8'))) if args.case_sensitive else re.compile(bytes(w.encode('utf-8')), re.IGNORECASE) else: regex = w ''' Search file contents ''' if binary and args.binary: found = re.search(regex, content) if args.keywords else re.findall(regex, content) elif not binary: if args.keywords: found = re.search(regex, content) if args.case_sensitive else re.search(regex, content, re.IGNORECASE) elif args.regex: found = re.findall(regex, content) else: found = False ''' Handle matches ''' if found: if args.keywords: matched.append(w) elif args.regex: for match in found: matched.append(match) if args.keywords and not args.match_all and not args.verbose: return MATCH if args.binary: matched = decoder(matched) if not args.match_all and args.keywords and len(matched): return [MATCH, " " + GREEN + "[" + ', '.join(matched) + "]" + END] if args.match_all and args.keywords and len(matched) == total_keywords: return MATCH if not args.verbose else [MATCH, " " + GREEN + "[" + ', '.join(matched) + "]" + END] if args.regex: if not args.verbose and matched: return MATCH elif args.verbose and matched: unique = list(set(matched)) return [MATCH, " " + GREEN + "[" + ', '.join(unique) + "]" + END] return '' except: return FAILED def fake2realpath(path, target): sep_count = target.count(".." + os.sep) regex_chk_1 = "^" + re.escape(".." + os.sep) regex1_chk_2 = "^" + re.escape("." + os.sep) regex1_chk_3 = "^" + re.escape(os.sep) if (re.search(regex_chk_1, target)) and (sep_count <= (path.count(os.sep) - 1)): dirlist = [d for d in path.split(os.sep) if d.strip()] dirlist.insert(0, os.sep) try: realpath = '' for i in range(0, len(dirlist) - sep_count ): realpath = realpath + (dirlist[i] + os.sep) if dirlist[i] != "/" else dirlist[i] realpath += target.split(".." + os.sep)[-1] return str(Path(realpath).resolve()) except: return None elif re.search(regex1_chk_2, target): return str(Path((path + (target.replace("." + os.sep, "")))).resolve()) elif not re.search(regex1_chk_3, target): return str(Path(path + target).resolve()) else: return str(Path(target).resolve()) def adjustUnicodeError(): exit_with_msg('The system seems to have an uncommon default encoding. Restart eviltree with options -q and -A to resolve this issue.') # ~ child = '├── ' if not args.ascii else '|-- ' # ~ child_last = '└── ' if not args.ascii else '|-- ' # ~ parent = '│ ' if not args.ascii else '| ' child = (chr(9500) + (chr(9472) * 2) + ' ') if not args.ascii else '|-- ' child_last = (chr(9492) + (chr(9472) * 2) + ' ') if not args.ascii else '\-- ' parent = (chr(9474) + ' ') if not args.ascii else '| ' total_dirs_processed = 0 total_files_processed = 0 def eviltree(root_dir, intent = 0, depth = '', depth_level = depth_level): try: global total_dirs_processed, total_files_processed root_dirs = next(os.walk(root_dir))[1] root_files = next(os.walk(root_dir))[2] total_dirs = len(root_dirs) total_files = len(root_files) symlinks = [] recursive = [] print('\r' + DIR + root_dir + END) if not intent else move_on() ''' Handle symlinks ''' for d in root_dirs: if os.path.islink(root_dir + d): symlinks.append(d) ''' Process files ''' root_files.sort() for i in range(0, total_files): total_files_processed += 1 file_path = root_dir + root_files[i] is_link = True if os.path.islink(file_path) else False if not WINDOWS: try: is_char_special = True if S_ISCHR((os.lstat(file_path)[ST_MODE])) else False except: is_char_special = False try: is_block_special = True if S_ISBLK(os.stat(file_path)[ST_MODE]) else False except: is_block_special = False try: is_pipe = True if S_ISFIFO(os.stat(file_path).st_mode) else False except: is_pipe = False try: is_socket = True if S_ISSOCK(os.stat(file_path).st_mode) else False except: is_socket = False try: is_executable = True if (os.access(file_path, os.X_OK) and not is_char_special and not is_block_special and not is_pipe and not is_socket) else False except: is_executable = False else: is_executable, is_socket, is_pipe, is_block_special, is_char_special = False, False, False, False, False ''' Verify target path if file is a symlink ''' if is_link: symlink_target = target = os.readlink(file_path) if is_link else None target = fake2realpath(root_dir, target) is_dir = True if os.path.isdir(str(target)) else False is_broken = True if (not os.path.exists(str(target)) or is_dir) else False if not WINDOWS: try: target_is_char_special = True if S_ISCHR((os.lstat(target)[ST_MODE])) else False except: target_is_char_special = False try: target_is_block_special = True if S_ISBLK(os.stat(target).st_mode) else False except: target_is_block_special = False try: target_is_pipe = True if S_ISFIFO(os.stat(target).st_mode) else False except: target_is_pipe = False try: target_is_socket = True if S_ISSOCK(os.stat(target).st_mode) else False except: target_is_socket = False try: target_is_executable = True if (os.access(target, os.X_OK) and not target_is_char_special and not target_is_block_special and not target_is_pipe and not target_is_socket) else False except: target_is_executable = False else: target_is_executable, target_is_socket, target_is_pipe, target_is_block_special, target_is_char_special = False, False, False, False, False else: is_broken = None ''' Submit file for content inspection if it's not a broken symlink / character special / block special / pipe / socket''' if process_files: # Check if file extension in blacklist fname = root_files[i] if not is_link else target file_ext = fname.rsplit(".", 1)[-1].lower() blacklisted = True if file_ext in filetype_blacklist else False if (not is_link and not is_char_special and not is_block_special and not is_pipe and not is_socket and not blacklisted) or (is_link and not is_broken and not target_is_char_special and not target_is_block_special and not target_is_pipe and not target_is_socket and not blacklisted): details = file_inspector(file_path) if not is_link else file_inspector(target) if isinstance(details, list): color, verbose, errormsg = details[0], details[1], '' elif details == 1: color, verbose, errormsg = details, '', ' ' + DENIED + '[permission denied]' + END elif details == 2: color, verbose, errormsg = details, '', ' ' + DENIED + '[memory error]' + END elif details == 999: exit_with_msg('Keyboard interrupt.') else: color, verbose, errormsg = details, '', '' else: color, verbose, errormsg = '', '', '' else: color, verbose, errormsg = '', '', '' ''' Color mark and print file accordingly in relation to its type and content inspection results ''' if print_fnames: color = str(color) if is_link: linkcolor = BROKEN if is_broken else LINK color = CHARSPEC if target_is_block_special or target_is_char_special else color color = PIPE if target_is_pipe else color color = SOCKET if target_is_socket else color color = EXECUTABLE if (target_is_executable and color not in [MATCH, FAILED]) else color filename = (linkcolor + root_files[i] + END + ' -> ' + color + symlink_target + errormsg) if not args.full_pathnames else (linkcolor + root_dir + root_files[i] + END + ' -> ' + color + symlink_target + errormsg) elif is_char_special or is_block_special: filename = (CHARSPEC + root_files[i]) if not args.full_pathnames else (CHARSPEC + root_dir + root_files[i]) elif is_pipe: filename = (PIPE + root_files[i]) if not args.full_pathnames else (PIPE + root_dir + root_files[i]) elif is_socket: filename = (SOCKET + root_files[i]) if not args.full_pathnames else (SOCKET + root_dir + root_files[i]) elif is_executable: if color not in [MATCH, FAILED]: filename = (EXECUTABLE + root_files[i]) if not args.full_pathnames else (EXECUTABLE + root_dir + root_files[i]) else: filename = (color + root_files[i]) if not args.full_pathnames else (color + root_dir + root_files[i]) else: filename = (color + root_files[i]) if not args.full_pathnames else (color + root_dir + root_files[i]) ''' Print file branch ''' if not args.interesting_only: print(depth + child + color + filename + END + verbose + errormsg) if (i < (total_files + total_dirs) - 1) else print(depth + child_last + color + filename + END + verbose + errormsg) elif args.interesting_only and ((color and color == MATCH) and not errormsg): print(depth + child + color + filename + END + verbose + errormsg) if (i < (total_files + total_dirs) - 1) else print(depth + child_last + color + filename + END + verbose + errormsg) ''' Process dirs ''' root_dirs.sort() for i in range(0, total_dirs): total_dirs_processed += 1 joined_path = root_dir + root_dirs[i] is_recursive = False directory = root_dirs[i] if not args.full_pathnames else (joined_path + os.sep) ''' Access permissions check ''' try: sub_dirs = len(next(os.walk(joined_path))[1]) sub_files = len(next(os.walk(joined_path))[2]) errormsg = '' except StopIteration: sub_dirs, sub_files = 0, 0 errormsg = ' [error accessing dir]' ''' Check if symlink and if target leads to recursion ''' if root_dirs[i] in symlinks: symlink_target = target = os.readlink(joined_path) target = fake2realpath(root_dir, target) is_recursive = ' [recursive, not followed]' if target == root_dir[0:-1] else '' if len(is_recursive): recursive.append(joined_path) print(depth + child + LINK + directory + END + ' -> ' + DIR + symlink_target + END + is_recursive + errormsg) if i < total_dirs - 1 else print(depth + child_last + LINK + directory + END + ' -> ' + DIR + symlink_target + END + is_recursive + errormsg) else: print(depth + child + DIR + directory + END + errormsg) if i < total_dirs - 1 else print(depth + child_last + DIR + directory + END + errormsg) ''' Iterate next dir ''' if (not args.follow_links and root_dirs[i] not in symlinks) or (args.follow_links and not is_recursive): if (sub_dirs or sub_files) and (intent + 1) < depth_level: tmp = depth depth = depth + parent if i < (total_dirs - 1) else depth + ' ' eviltree(joined_path + os.sep, intent + 1, depth) depth = tmp except StopIteration: print('\r' + DIR + root_dir + END + ' [Permission Denied]') #print('\r' + DIR + root_dir + END + ' [error accessing dir]') except UnicodeEncodeError: adjustUnicodeError() except KeyboardInterrupt: exit_with_msg('Keyboard interrupt.') except PermissionError: print('\r' + DIR + root_dir + END + ' [Permission Denied]') except Exception as e: exit_with_msg('Something went wrong. Consider creating an issue about this in the original repo (https://github.com/t3l3machus/eviltree)\n' + BOLD + 'Error Details' + END +': ' + str(e)) def main(): try: print_banner() if not args.quiet else move_on() except UnicodeEncodeError: adjustUnicodeError() root_dir = args.root_path if args.root_path[-1] == os.sep else args.root_path + os.sep if os.path.exists(root_dir): eviltree(root_dir) print('\n' + str(total_dirs_processed) + ' directories, ' + str(total_files_processed) + ' files') else: exit_with_msg('Directory does not exist.') if __name__ == '__main__': main()