utils

Documentation

Index

• Constants
• func CountFiles(directory string) (cnt int)
• func DisableAuditPolicy(subCatOrGuid string) error
• func EnableAuditPolicy(subCatOrGuid string) error
• func EnableDNSLogs() error
• func ExpandEnvs(s ...string) (o []string)
• func FlushDNSCache() error
• func GzipFileBestSpeed(path string) (err error)
• func HidsCreateFile(filename string) (*os.File, error)
• func HidsWriteFile(filename string, data []byte) error
• func IsPipePath(path string) bool
• func JSON(i interface{}) string
• func NextIP(ip net.IP) net.IP
• func PrettyJSON(i interface{}) string
• func PrevIP(ip net.IP) net.IP
• func ReadFileString(path string) (string, error)
• func RegQuery(key, value string) (string, error)
• func RemoveEDRAuditACL(directories ...string) (err error)
• func Round(f float64, precision int) float64
• func SetAuditPolicy(subCatOrGuid string, success, failure bool) error
• func SetEDRAuditACL(directories ...string) (err error)
• func Sha256StringArray(array []string) string
• func StdDir(dir string) string
• func StdDirs(directories ...string) (o []string)
• func SvcFromPid(pid int32) string
• func Unzip(zipfile, dest string) (err error)
• func Utf16ToUtf8(b []byte) ([]byte, error)
• type ByteSlice
  • func (b ByteSlice) Len() int
  • func (b ByteSlice) Less(i, j int) bool
  • func (b ByteSlice) Swap(i, j int)
• type WindowsLogger
  • func NewWindowsLogger(channel, source string) (wl *WindowsLogger, err error)
  • func (w *WindowsLogger) Close() error
  • func (w *WindowsLogger) Log(eventid int, entrytype, message string)

Constants

const (
	Kilo
	Mega
	Giga
)

const (
	// DefaultPerms default permissions for output files
	DefaultPerms = 0740
)

Functions

func CountFiles

func CountFiles(directory string) (cnt int)

CountFiles counts files in a directory

func DisableAuditPolicy

func DisableAuditPolicy(subCatOrGuid string) error

func EnableAuditPolicy

func EnableAuditPolicy(subCatOrGuid string) error

func EnableDNSLogs

func EnableDNSLogs() error

EnableDNSLogs through wevutil command line

func ExpandEnvs

func ExpandEnvs(s ...string) (o []string)

ExpandEnvs expands several strings with environment variable it is just a loop calling os.ExpandEnv for every element

func FlushDNSCache

func FlushDNSCache() error

FlushDNSCache executes windows command to flush the DNS cache

func GzipFileBestSpeed

func GzipFileBestSpeed(path string) (err error)

GzipFileBestSpeed compresses a file to gzip and deletes the original file

func HidsCreateFile

func HidsCreateFile(filename string) (*os.File, error)

HidsCreateFile creates a file with the good permissions

func HidsWriteFile

func HidsWriteFile(filename string, data []byte) error

HidsWriteFile is a wrapper around ioutil.WriteFile to write a file with the good permissions

func IsPipePath

func IsPipePath(path string) bool

IsPipePath checks whether the argument path is a pipe

func JSON

func JSON(i interface{}) string

JSON returns a JSON string out of i

func NextIP

func NextIP(ip net.IP) net.IP

derived from: https://gist.github.com/kotakanbe/d3059af990252ba89a82

func PrettyJSON

func PrettyJSON(i interface{}) string

PrettyJSON returns a JSON pretty string out of i

func PrevIP

func PrevIP(ip net.IP) net.IP

derived from: https://gist.github.com/kotakanbe/d3059af990252ba89a82

func ReadFileString

func ReadFileString(path string) (string, error)

ReadFileString reads bytes from a file

func RegQuery

func RegQuery(key, value string) (string, error)

RegQuery issues a reg query command to dump registry

func RemoveEDRAuditACL

func RemoveEDRAuditACL(directories ...string) (err error)

func Round

func Round(f float64, precision int) float64

Round float f to precision

func SetAuditPolicy

func SetAuditPolicy(subCatOrGuid string, success, failure bool) error

func SetEDRAuditACL

func SetEDRAuditACL(directories ...string) (err error)

func Sha256StringArray

func Sha256StringArray(array []string) string

Sha256StringArray utility

func StdDir

func StdDir(dir string) string

StdDir makes a directory ending with os separator

func StdDirs

func StdDirs(directories ...string) (o []string)

StdDirs makes a directories are ending with os separator

func SvcFromPid

func SvcFromPid(pid int32) string

SvcFromPid returns the list of services hosted by a given PID interesting to know what service is hosted by svchost

func Unzip

func Unzip(zipfile, dest string) (err error)

Unzip helper function to unzip a file to a destination folder source code from : https://stackoverflow.com/questions/20357223/easy-way-to-unzip-file-with-golang

func Utf16ToUtf8

func Utf16ToUtf8(b []byte) ([]byte, error)

Utf16ToUtf8 converts a utf16 encoded byte slice to utf8 byte slice it returns error if there is any decoding / encoding issue Inspired by: https://gist.github.com/bradleypeabody/185b1d7ed6c0c2ab6cec#file-gistfile1-go

Types

type ByteSlice

type ByteSlice []byte

func (ByteSlice) Len

func (b ByteSlice) Len() int

func (ByteSlice) Less

func (b ByteSlice) Less(i, j int) bool

func (ByteSlice) Swap

func (b ByteSlice) Swap(i, j int)

type WindowsLogger

type WindowsLogger struct {
	Channel string
	Source  string
	// contains filtered or unexported fields
}

WindowsLogger structure definition

func NewWindowsLogger

func NewWindowsLogger(channel, source string) (wl *WindowsLogger, err error)

NewWindowsLogger creates a new WindowsLogger structure

func (*WindowsLogger) Close

func (w *WindowsLogger) Close() error

Close closes the logger in a clean fashion

func (*WindowsLogger) Log

func (w *WindowsLogger) Log(eventid int, entrytype, message string)

Log logs a message through powershell Write-EventLog