python——信息取證

1 讀取PDF元信息

from PyPDF2 import PdfFileReader,PdfFileWriter
from io import FileIO as file 
import sys

def printMeta(fileName):
    pdfFile = PdfFileReader(file(fileName,'rb'))
    docInfo = pdfFile.getDocumentInfo()
    print('[*] PDF MetaData For:'+ str(fileName))
    for metaItem in docInfo:
        print(('[+]'+ metaItem + ':' + docInfo[metaItem]))

if __name__ == "__main__":
    printMeta(sys.argv[1])

結果：

2 調查PC曾經連接過的WIFI

# -*- coding=utf-8 -*-
from winreg import * # 都windows註冊表分析工具
import os

def val2addr(val):
    addrlst = []
    for ch in val:
        addrlst.append(str(hex(ch))[-2:])
        MAC_ADDR= ':'.join(addrlst)
    return MAC_ADDR
    
def printNets(): 
    net = r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged"
    key = OpenKey(HKEY_LOCAL_MACHINE,net)# 提取註冊表鍵值
    hostname = os.getenv( 'computername' )#提取windows主機名
    print('計算機:'+ hostname +'遊覽過如下無線網絡')
    for i in range(100):
        try:
            guid = EnumKey(key,i)#逐個提取key,最多100個
            netKey = OpenKey(key,str(guid))
            (n,addr,t) = EnumValue(netKey,5)
            (n,name,t) = EnumValue(netKey,4)
            macAddr = val2addr( addr)#提取網關MAC
            SSID = str(name).strip()# SSID名字
            if SSID == '網絡' :
                CloseKey(netKey)
                next
            else:
                print('無線網絡SSID名稱:',end = '')
                print('%-20s'%SSID,end ='')
                print('%25s'%'網關MAC地址:',end = '')
                print (macAddr)
                CloseKey(netKey )
        except Exception as e :
            next
if __name__ == '__main__':
    printNets()

結果：