Hell yeah 3

Author: noahverner1995

README.md

@@ -28,6 +28,11 @@
 2. A JSON file containing Metadata of extracted file as a JSON file including:
  - File name
  - File size
+ - Source IP address
+ - Source Port number
+ - Destination IP address
+ - Destination Port number
+ - timestamp
 3. A JSON file containing logs of all packet layer details.
 
 

extract_smb.py

@@ -165,7 +165,23 @@ def extract_file_data_and_name(logs):
  name = re.sub(r"^b'|'$", '', name)
  name = name.encode('latin1').decode('unicode_escape')
  file_name = name
- return file_data, file_name
+
+ # Extracting src, dst, sport, dport, and timestamp values
+ for item in entry:
+ if isinstance(item, list) and item[0] == "IP":
+ ip_header = item[1]
+ src = ip_header.get("src", "")
+ dst = ip_header.get("dst", "")
+ if isinstance(item, list) and item[0] == "TCP":
+ tcp_header = item[1]
+ sport = tcp_header.get("sport", 0)
+ dport = tcp_header.get("dport", 0)
+ for option in tcp_header.get("options", []):
+ if isinstance(option, list) and option[0] == "Timestamp":
+ timestamp = option[1]
+
+
+ return file_data, file_name, src, dst, sport, dport, timestamp
 
 # Function to recursively extract packet layer details
 def extract_packet_details(packet):
@@ -193,7 +209,7 @@ def extract_packet_details(packet):
  logs = json.load(file)
 
 # Extract the file data and name
-file_data, file_name = extract_file_data_and_name(logs)
+file_data, file_name, src, dst, sport, dport, timestamp = extract_file_data_and_name(logs)
 
 # Cleaning the file name
 clean_file_name = re.sub(r'\x00', '', file_name) # remove null bytes
@@ -211,7 +227,12 @@ def extract_packet_details(packet):
 # Prepare metadata
 metadata = {
  "FileName": clean_file_name,
- "FileSize": convert_size(file_size)
+ "FileSize": convert_size(file_size),
+ "src": src,
+ "dst": dst,
+ "sport": sport,
+ "dport": dport,
+ "timestamp": timestamp
 }
 
 # Save metadata to JSON file

metadata_of_extracted_file.json

@@ -1,4 +1,12 @@
 {
  "FileName": "Test\\2009-12 Payroll.xlsx",
- "FileSize": "25.33 KB"
+ "FileSize": "25.33 KB",
+ "src": "192.168.1.78",
+ "dst": "192.168.1.53",
+ "sport": 55770,
+ "dport": 445,
+ "timestamp": [
+ 1003549546,
+ 8116880
+ ]
 }