file.find()

docs/_docs/user-guide/eldritch.md

@@ -378,6 +378,18 @@ The <b>file.timestomp</b> method is very cool, and will be even cooler when Nick
 The <b>file.write</b> method writes to a given file path with the given content.
 If a file or directory already exists at this path, the method will fail.
 
+### file.find
+
+`file.find(path: str, name: Option<str>, file_type: Option<str>, permissions: Option<int>, modified_time: Option<int>, create_time: Option<int>) -> Vec<str>`
+
+The <b>file.find</b> method finds all files matching the used paramters. Returns file path for all matching items.
+
+- name: Checks if file name contains provided input
+- file_type: Checks for 'file' or 'dir' for files or directories, respectively.
+- permissions: On UNIX systems, takes numerical input of standard unix permissions (rwxrwxrwx == 777). On Windows, takes 1 or 0, 1 if file is read only.
+- modified_time: Checks if last modified time matches input specified in time since EPOCH
+- create_time: Checks if last modified time matches input specified in time since EPOCH
+
 ---
 
 ## Pivot

implants/lib/eldritch/src/file.rs

@@ -16,6 +16,7 @@
 mod template_impl;
 mod timestomp_impl;
 mod write_impl;
+mod find_impl;
 
 use allocative::Allocative;
 use derive_more::Display;
@@ -180,4 +181,8 @@
         write_impl::write(path, content)?;
         Ok(NoneType{})
     }
+    fn find(this: FileLibrary, path: String, name: Option<String>, file_type: Option<String>, permissions: Option<u64>, modified_time: Option<u64>, create_time: Option<u64>) -> anyhow::Result<Vec<String>> {
+        if false { println!("Ignore unused this var. _this isn't allowed by starlark. {:?}", this); }
+        find_impl::find(path, name, file_type, permissions, modified_time, create_time)
+    }
 }

implants/lib/eldritch/src/file/find_impl.rs

@@ -0,0 +1,81 @@
+use std::{path::{Path, PathBuf}, time::{SystemTime, UNIX_EPOCH}};
+use anyhow::{anyhow, Result};
+use std::fs::canonicalize;
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+fn check_path(path: &PathBuf,  name: Option<String>, file_type: Option<String>, permissions: Option<u64>, modified_time: Option<u64>, create_time: Option<u64>) -> Result<bool> {
+    if let Some(name) = name {
+        if !path.file_name().ok_or(anyhow!("Failed to get item file name"))?.to_str().ok_or(anyhow!("Failed to convert file name to str"))?.contains(&name) {
+            return Ok(false);
+        }
+    }
+    if let Some(file_type) = file_type {
+        if !path.is_file() && file_type == "file" {
+            return Ok(false);
+        }
+        if !path.is_dir() && file_type == "dir" {
+            return Ok(false);
+        }
+    }
+    if let Some(permissions) = permissions {
+        let metadata = path.metadata()?.permissions();
+        #[cfg(unix)]
+        {
+            if metadata.mode() != (permissions as u32) {
+                return Ok(false);
+            }
+        }
+        #[cfg(windows)]
+        {
+            if permissions == 0 && metadata.readonly() {
+                return Ok(false);
+            }
+            if permissions == 1 && !metadata.readonly() {
+                return Ok(false);
+            }
+        }
+    }
+    if let Some(modified_time) = modified_time {
+        if path.metadata()?.modified()?.duration_since(UNIX_EPOCH)?.as_secs() != modified_time {
+            return Ok(false);
+        }
+    }
+    if let Some(create_time) = create_time {
+        if path.metadata()?.created()?.duration_since(UNIX_EPOCH)?.as_secs() != create_time {
+            return Ok(false);
+        }
+    }
+    Ok(true)
+}
+
+fn search_dir(path: &str, name: Option<String>, file_type: Option<String>, permissions: Option<u64>, modified_time: Option<u64>, create_time: Option<u64>) -> Result<Vec<String>> {
+    let mut out: Vec<String> = Vec::new();
+    let res = Path::new(&path);
+    if !res.is_dir() {
+        return Err(anyhow!("Search path is not a directory"));
+    }
+    if res.is_dir() {
+        for entry in res.read_dir()? {
+            let entry = entry?;
+            let path = entry.path();
+            if path.is_dir() {
+                out.append(&mut search_dir(path.to_str().ok_or(anyhow!("Failed to convert path to str"))?, name.clone(), file_type.clone(), permissions, modified_time, create_time)?);
+            } else {
+                if check_path(&path, name.clone(), file_type.clone(), permissions, modified_time, create_time)? {
+                    out.push(canonicalize(path)?.to_str().ok_or(anyhow!("Failed to convert path to str"))?.to_owned());
+                }
+            }
+        }
+    }
+    Ok(out)
+}
+
+pub fn find(path: String, name: Option<String>, file_type: Option<String>, permissions: Option<u64>, modified_time: Option<u64>, create_time: Option<u64>) -> Result<Vec<String>> {
+    if let Some(perms) = permissions {
+        if !cfg!(unix) && (perms != 0 || perms != 1) {
+            return Err(anyhow::anyhow!("Only readonly permissions are available on non-unix systems. Please use 0 or 1."));
+        }
+    }
+    search_dir(&path, name, file_type, permissions, modified_time, create_time)
+}

implants/lib/eldritch/src/lib.rs

@@ -221,7 +221,7 @@ mod tests {
         a.globals(globals);
         a.all_true(
             r#"
-dir(file) == ["append", "compress", "copy", "download", "exists", "hash", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]
+dir(file) == ["append", "compress", "copy", "download", "exists", "find", "hash", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]
 dir(process) == ["info", "kill", "list", "name", "netstat"]
 dir(sys) == ["dll_inject", "dll_reflect", "exec", "get_env", "get_ip", "get_os", "get_pid", "get_reg", "get_user", "hostname", "is_linux", "is_macos", "is_windows", "shell", "write_reg_hex", "write_reg_int", "write_reg_str"]
 dir(pivot) == ["arp_scan", "bind_proxy", "ncat", "port_forward", "port_scan", "smb_exec", "ssh_copy", "ssh_exec", "ssh_password_spray"]