403WebShell

403Webshell
Server IP : 198.38.94.13 / Your IP : 216.73.217.33
Web Server : Apache
System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64
User : revivere ( 1140)
PHP Version : 8.2.33
Disable Function : NONE
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF
Directory : /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/
Upload File :
[ Back ]
Current File : /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_event.cpython-310.pyc
o

;j8\�@s dZddlZddlZddlZddlZddlmZzddlZddl	Z	ddl
Z
ddlZddlZdZ
Wney;dZ
Ynwe�e�ZdZdd�Zd)d
d�Zdd
�Zdd�Zdd�Zdd�Zdd�Zdd�Zd*dd�Zdd�Zd+dd�Zd*dd �Zd!d"�Z					d,d#d$�Z d-d%d&�Z!d'd(�Z"dS).zR
A module for working with the Windows Event log system.
.. versionadded:: 3006.0
�N)�CommandExecutionErrorTFZ	win_eventcCstjj��sdStsdStS)z2
    Load only on minions running on Windows.
    )Fzwin_event: Must be on Windows)Fzwin_event: Missing PyWin32)�salt�utils�platformZ
is_windows�
IMPORT_STATUS�__virtualname__�rr�J/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_event.py�__virtual__!s
r
�utf-8cCs�t|t�r"i}|D]}t|||�}|rt||�}|||<q	|}|St|t�r:g}|D]
}|�t||��q+|}|St|t�rTg}|D]
}|�t||��qCt|�}|St|t�r^|�|�}|S)a
    Convert string objects to byte objects.

    .. warning::
        This function will destroy the data object and objects that data links
        to.

    Args:

        data (object): The string object to encode

        encoding (:obj:`str`, optional):
            The encoding type.
            Default is "utf-8".

        encode_keys (:obj:`bool`, optional):
            If ``False``, key strings will not be encoded.
            Defaults is ``False``.

    Returns:
        (object): An object with the new encoding
    )�
isinstance�dict�	_to_bytes�list�append�tuple�str�encode)�data�encodingZencode_keysZnew_dict�key�itemZnew_listrrr	r-s0



�
�
�
rcCs*t�dd�}||j|j|j|j|j|j�S)z�
    Will make a pywintypes.datetime into a TimeTuple.

    Args:

        time (obj): A datetime object

    Returns:
        TimeTuple: A TimeTuple
    �	TimeTuplez&year, month, day, hour, minute, second)�collections�
namedtuple�year�month�day�hour�minute�second)�timerrrr	�	_raw_timebs��r"cCs�d}i}|D]}t||d��|dd�d�||<qt�|d�|d<|ddur2|d��|d<t|d�|d<t|d�|d<t|�S)	z�
    Will make a PyEventLogRecord into a dictionary

    Args:

        event (PyEventLogRecord): An event to convert to a dictionary

    Returns:
        dict: A dictionary containing the event information
    )ZclosingRecordNumberZcomputerNamer�
eventCategory�eventID�	eventTypeZrecordNumberZreservedZ
reservedFlags�sidZ
sourceNameZ
stringInserts�
timeGenerated�timeWrittenr�Nr$r&r'r()�getattr�upper�winerrorZHRESULT_CODEZGetSidIdentifierAuthorityr"r)�eventZevent_partsZ
event_dictZ
event_partrrr	�_make_event_dictvs
�r.c
Cs@zt�d|�WStjy}ztd|�d|j����d}~ww)z�
    Will try to open a PyHANDLE to the Event System

    Args:

        log_name (str): The name of the log to open

    Returns:
        PyHANDLE: A handle to the event log
    NzFailed to open log: z
Error: )�win32evtlogZOpenEventLog�
pywintypes�error�FileNotFoundError�strerror)�log_name�excrrr	�_get_handle�s���r6cCst�|�dS)z|
    Will close the handle to the event log

    Args:

        handle (PyHANDLE): The handle to the event log to close
    N)r/Z
CloseEventLog)�handlerrr	�
_close_handle�s
r8ccsN�t|�}tjtjB}	t�||d�}|sn|D]}t|�Vqqt|�dS)z�
    Get all log events one by one. Events are not ordered

    Args:

        log_name(str): The name of the log to retrieve

    Yields:
        dict: A dictionary object for each event
    TrN)r6r/ZEVENTLOG_BACKWARDS_READZEVENTLOG_SEQUENTIAL_READZReadEventLogr.r8)r4r7�flags�eventsr-rrr	�_event_generator�s�
�	r;ccs^�d}t|�D]%}i}|D]}||||<q
t|�D]\}}|d|||<q||fVqdS)z�
    Sorts the results of the event generator

    Args:

        log_name (str): The name of the log to retrieve

    Yields:
        dict: A dictionary object for each event
    )rrrrrr r'N)r;�	enumerate)r4Z
time_partsr-Z
event_info�partZspotrrrr	�_event_generator_with_time�s�	�r>c
ksp�t|�D�]/\}}|r�|D]�}|�d�rq|dvrqt||t�r�z\t�dt||�t||�d���||||�d�kr}z)t�dt||�t||�d��d���||||�d��d�krhWWn7Wnt	y|t�d||�YWn#wWqt	y�t�d	||�Ynw||||kr�nq|Vq|D]�}|�d�r�q�|dvr�q�t||t��r(z"t�dt||�t||�d���||||�d�kr�|VWnt	y�t�d	||�Ynwz)t�dt||�t||�d��d���||||�d��d�k�r|VWq�t	�y't�d||�Ynw||||k�r4|Vq�qd
S)a�
    Will find events that meet the requirements in the filter. Can be any item
    in the return for the event.


    Args:

        log_name (str): The name of the log to retrieve

        all_requirements (bool): Should the results match all requirements.
            ``True`` matches all requirements. ``False`` matches any
            requirement.

    Kwargs:

        eventID (int): The event ID number

        eventType (int): The event type number. Valid options and their
            corresponding meaning are:

            - 0 : Success
            - 1 : Error
            - 2 : Warning
            - 4 : Information
            - 8 : Audit Success
            - 10 : Audit Failure

        year (int): The year

        month (int): The month

        day (int): The day of the month

        hour (int): The hour

        minute (int): The minute

        second (int): The second

        eventCategory (int): The event category number

        sid (sid): The SID of the user that created the event

        sourceName (str): The name of the event source

    Yields:
        dict: A dictionary object for each event

    CLI Example:

    .. code-block:: python

        # Return all events from the Security log with an ID of 1100
        _event_generator_filter("Security", eventID=1100)

        # Return all events from the System log with an Error (1) event type
        _event_generator_filter("System", eventType=1)

        # Return all events from System log with an Error (1) type, source is Service Control Manager, and data is netprofm
        _event_generator_filter("System", eventType=1, sourceName="Service Control Manager", data="netprofm")
    �__)r4Z
all_argumentszutf-8: Does %s == %srzutf-16: Does %s == %szutf-16�zFailed to decode (utf-16): %szFailed to decode (utf-8): %sN)
r>�
startswithr�bytes�logZtrace�repr�decode�strip�UnicodeDecodeError)r4�all_requirements�kwargsr-�inforrrr	�_event_generator_filters��?

�
��������

���
�����rKcCstt|��S)a
    Get events from the specified log. Get a list of available logs using the
    :py:func:`win_event.get_log_names <salt.modules.win_event.get_log_names>`
    function.

    .. warning::
        Running this command on a log with thousands of events, such as the
        ``Applications`` log, can take a long time.

    Args:

        log_name (str): The name of the log to retrieve.

    Returns
        tuple: A tuple of events as dictionaries

    CLI Example:

    .. code-block:: bash

        salt '*' win_event.get Application
    )rr;)r4rrr	�get�srL�c
Cszt|t�s	td��tj}|stj}t�|||d�}g}t�||�D]}|r,t�|d�}	n	t	�
t�|d��}	|�|	�q!|S)a2

    Query a log for a specific event_id. Return the top number of records
    specified. Use the
    :py:func:`win_event.get_log_names <salt.modules.win_event.get_log_names>`
    to see a list of available logs on the system.

    .. Note::
        You can use the Windows Event Viewer to create the XPath query for the
        ``query_text`` parameter. Click on ``Filter Current Log``, configure the
        filter, then click on the XML tab. Copy the text between the two
        ``<Select>`` tags. This will be the contents of the ``query_text``
        parameter. You will have to convert some codes. For example, ``&gt;``
        becomes ``>``, ``&lt;`` becomes ``<``. Additionally, you'll need to
        put spaces between comparison operators. For example: ``this >= that``.

    Args:

        log_name (str): The name of the log to query

        query_text (:obj:`str`, optional):
            The filter to apply to the log.
            Default is ``None``.

        records (:obj:`int`, optional):
            The number of records to return.
            Default is 20

        latest (:obj:`bool`, optional):
            ``True`` will return the newest events. ``False`` will return the
            oldest events.
            Default is ``True``.

        raw (:obj:`bool`, optional):
            ``True`` will return the raw xml results. ``False`` will return the
            xml converted to a dictionary.
            Default is ``False``.

    Returns:
        list: A list of dict objects that contain information about the event

    CLI Example:

    .. code-block:: bash

        # Return the 20 most recent events from the Application log with an event ID of 22
        salt '*' win_event.query Application '*[System[(EventID=22)]]'

        # Return the 20 most recent events from the Application log with an event ID of 22
        # Return raw xml
        salt '*' win_event.query Application '*[System[(EventID=22)]]' raw=True

        # Return the 20 oldest events from the Application log with an event ID of 22
        salt '*' win_event.query Application '*[System[(EventID=22)]]' latest=False

        # Return the 20 most recent Critical (1) events from the Application log in the last 12 hours
        salt '*' win_event.query Application '*[System[(Level=1) and TimeCreated[timediff(@SystemTime) <= 43200000]]]'

        # Return the 5 most recent Error (2) events from the application log
        salt '*' win_event.query Application '*[System[(Level=2)]]' records=5

        # Return the 20 most recent Warning (3) events from the Windows PowerShell log where the Event Source is PowerShell
        salt '*' win_event.query 'Windows PowerShell' '*[System[Provider[@Name="PowerShell"] and (Level=3)]]'

        # Return the 20 most recent Information (0 or 4) events from the Microsoft-Windows-PowerShell/Operational on 2022-08-24 with an Event ID of 4103
        salt '*' win_event.query 'Microsoft-Windows-PowerShell/Operational' '*[System[(Level=4 or Level=0) and (EventID=4103) and TimeCreated[@SystemTime >= "2022-08-24T06:00:00.000Z"]]]'

        # Return the 20 most recent Information (0 or 4) events from the Microsoft-Windows-PowerShell/Operational within the last hour
        salt '*' win_event.query 'Microsoft-Windows-PowerShell/Operational' '*[System[(Level=4 or Level=0) and TimeCreated[timediff(@SystemTime) <= 3600000]]]'
    zlatest must be a booleanNr))r�boolrr/ZEvtQueryReverseDirectionZEvtQueryForwardDirectionZEvtQueryZEvtNextZ	EvtRender�	xmltodict�parser)
r4Z
query_text�recordsZlatest�raw�	direction�resultsZ
event_listZevt�resrrr	�query�s
FrVcKstt||fi|���S)a#
    Will find events that match the fields and values specified in the kwargs.
    Kwargs can be any item in the return for the event.

    .. warning::
        Running this command on a log with thousands of events, such as the
        ``Applications`` log, can take a long time.

    Args:

        log_name (str): The name of the log to retrieve

        all_requirements (:obj:`bool`, optional):
            ``True`` matches all requirements. ``False`` matches any
            requirement.
            Default is ``True``.

    Kwargs:

        eventID (int): The event ID number

        eventType (int): The event type number. Valid options and their
            corresponding meaning are:

            - 0 : Success
            - 1 : Error
            - 2 : Warning
            - 4 : Information
            - 8 : Audit Success
            - 10 : Audit Failure

        year (int): The year

        month (int): The month

        day (int): The day of the month

        hour (int): The hour

        minute (int): The minute

        second (int): The second

        eventCategory (int): The event category number

        sid (sid): The SID of the user that created the event

        sourceName (str): The name of the event source

    Returns:
        tuple: A tuple of dicts of each filtered event

    CLI Example:

    .. code-block:: bash

        # Return all events from the Security log with an ID of 1100
        salt '*' win_event.get_filtered Security eventID=1100

        # Return all events from the System log with an Error (1) event type
        salt '*' win_event.get_filtered System eventType=1

        # Return all events from System log with an Error (1) type, source is Service Control Manager, and data is netprofm
        salt '*' win_event.get_filtered System eventType=1 sourceName='Service Control Manager' data='netprofm'

        # Return events from the System log that match any of the kwargs below
        salt '*' win_event.get_filtered System eventType=1 sourceName='Service Control Manager' data='netprofm' all_requirements=False
    )rrK)r4rHrIrrr	�get_filteredsFrWcCs>t�d�}g}t�|�dur|�t�|��t�|�dus|S)z�
    Get a list of event logs available on the system

    Returns:
        list: A list of event logs available on the system

    CLI Example:

    .. code-block:: bash

        salt '*' win_event.get_log_names
    N)r/ZEvtOpenChannelEnumZEvtNextChannelPathr)�hZ	log_namesrrr	�
get_log_namesOs

�rYc	
Cszt|�}Wntytd��wzt|�}Wnty#td��wddddddd	d
ddd
dd�}|dur<|d
}n||vrId|��}t|��||}|durct|t�rZ|g}n	t|t�sctd��|durntjj�	|�}t
j|t|�t|�||||d�dS)a�
    Adds an event to the application event log.

    Args:

        log_name (str): The name of the application or source

        event_id (int): The event ID

        event_category (:obj:`int`, optional):
            The event category.
            Default is 0

        event_type (:obj:`str`, optional):
            The event category. Must be one of:

            - Success
            - Error
            - Warning
            - Information
            - AuditSuccess
            - AuditFailure

            Default is ``None``.

        event_strings (:obj:`list`, optional):
            A list of strings.
            Default is ``None``.

        event_data (:obj:`bytes`, optional):
            Event data. Strings will be converted to bytes.
            Default is ``None``.

        event_sid (:obj:`sid`, optional):
            The SID for the event.
            Default is ``None``.

    Raises:
        CommandExecutionError: event_id is not an integer
        CommandExecutionError: event_category is not an integer
        CommandExecutionError: event_type is not one of the valid event types
        CommandExecutionError: event_strings is not a list or string

    CLI Example:

    .. code-block:: bash

        # A simple Application event log warning entry
        salt '*' win_event.add Application 1234 12 Warning

        # A more complex System event log information entry
        salt '*' win_event.add System 1234 12 Information '["Event string data 1", "Event string data 2"]' 'Some event data'

        # Log to the System Event log with the source "Service Control Manager"
        salt '*' win_event.add 'Service Control Manager' 1234 12 Warning '["Event string data 1", "Event string data 2"]' 'Some event data'

    .. code-block:: powershell

        # Log to the PowerShell event log with the source "PowerShell (PowerShell)"
        salt-call --local win_event.add "PowerShell" 6969 12 Warning
    zevent_id must be an integerz!event_category must be an integerrr)�����Success�Error�Warning�Information�AuditSuccess�AuditFailure)r^r_r`rarbrcrr)rZr[r\r]NzIncorrect event type: zevent_strings must be a list)ZappNamer$r#r%�stringsrr&)�int�	TypeErrorrrrrrrZstringutils�to_bytes�win32evtlogutilZReportEvent)	r4Zevent_idZevent_categoryZ
event_typeZ
event_stringsZ
event_dataZ	event_sidZevent_types�msgrrr	�addcsZG���




�rjcCs t|�}t�||�t|�dS)a�
    Clears the specified event log.

    .. note::
        A clear log event will be added to the log after it is cleared.

    Args:

        log_name (str): The name of the log to clear

        backup (:obj:`str`, optional):
            Path to backup file.
            Default is ``None``.

    CLI Example:

    .. code-block:: bash

        salt "*" win_event.clear Application
    N)r6r/Z
ClearEventLogr8)r4Zbackupr7rrr	�clear�srkcCst|�}t�|�}t|�|S)a
    Gets the number of events in the specified.

    Args:

        log_name (str): The name of the log

    Returns:
        int: The number of events the log contains

    CLI Example:

    .. code-block:: bash

        salt "*" win_event.count Application
    )r6r/ZGetNumberOfEventLogRecordsr8)r4r7Znumber_of_eventsrrr	�count�s
rl)rF)T)NrMTF)rNNNN)N)#�__doc__r�loggingZsalt.utils.platformrZsalt.utils.stringutilsZsalt.exceptionsrr0r/rhr,rOr�ImportError�	getLogger�__name__rCrr
rr"r.r6r8r;r>rKrLrVrWrYrjrkrlrrrr	�<module>sP�

5.

 

ZI
�
}
Youez - 2016 - github.com/yon3zu
LinuXploit