Script to alert and create service desk ticket if any user account with blank password detected

Download JSON Download Python

Ratings

(0)

Release Time

07/02/2024

Downloads

133 times

Update Time

11/17/2024

Views

246 times

Share-it:

Tags

User accounts Security tickets

Description
Screen Shots

RUN AS LOCALSYSTEM USER

EDITABLE PARAMETERS:

apikey - Provide the API KEY here. if you don't know how to create API KEY, checkout this documentation. make sure to create API KEY with Public IP of the endpoint machine - https://help.itarian.com/topic-452-1-949-13141-API-Keys.html?af=7639
domain - Provide the domain url here. For Example: if your domain name is ExampleItarian1msp, Provide the domain url like this: https://Exampleitarian1msp.servicedesk.comodo.com
email - Provide the email address here. This email address will be used to create the service desk ticket. For example, the email address used as the Reporter for the ticket.

this script has been scanned with virustotal.com and xcitium verdict cloud.

PYTHON SCRIPT FILE SHA1 VALUE - d7cfac75a635dfe486c9cc12dadecd8b1a78d318

JSON FILE SHA1 VALUE - bf2e6eb356ea023e55c45690fc563ad68e21e5e2

Procedure's Instructions

apikey=itsm.getParameter('Api_Key')
domain=itsm.getParameter('Domain_Name')
email=itsm.getParameter('From_Email')

import urllib2
import json
import os
import ctypes
import sys

class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

def sd(message, email, apikey, domain):
    devicename = os.environ['COMPUTERNAME']
    Data = {
            "email": email,
            "summary": "Blank password Detected!!!",
            "description": "Blank Password Detected on the Device: %s.\n%s"%(devicename, message),
            "assetType": "2",
            "helpTopic": "1",
            "ticketCategory": "1",
            "category": "1"
            }
    
    json_data = json.dumps(Data)

url = "%s/clientapi/index.php?serviceName=createticket"%(domain)

headers = {
    "Content-Type" : "application/json",
    "Authorization" : "%s"%(apikey)
    }

request = urllib2.Request(url, json_data, headers)
    response = urllib2.urlopen(request)
    response_data = json.loads(response.read())

if response_data["status"] == "SUCCESS":
        print("Successfully created Ticket")
        print("Ticket ID: %s"%(response_data["data"]["ticketId"]))
        alert(1)
    else:
        print("Failed to create ticket")
        print(response_data)
        alert(0)

vbs=r'''
On Error Resume Next

Set objNetwork = CreateObject("Wscript.Network")
strComputer = objNetwork.ComputerName
strPassword = ""
Set colAccounts = GetObject("WinNT://" & strComputer)
colAccounts.Filter = Array("user")
For Each objUser In colAccounts
    If objUser.Name <> "Administrator" And objUser.Name <> "DefaultAccount" Then
        objUser.ChangePassword strPassword, strPassword
        If Err = 0 or Err = -2147023569 Then
            Wscript.Echo objUser.Name & " is using a blank password."
        End If
        Err.Clear
    End If
Next
'''

def runvbs(vbs):
    workdir=os.environ['PROGRAMDATA']+r'\temp'
    if not os.path.isdir(workdir): 
        os.mkdir(workdir)
    with open(workdir+r'\temprun.vbs',"w") as f :
        f.write(vbs)        
    with disable_file_system_redirection():
        output = os.popen('cscript.exe "'+workdir+r'\temprun.vbs"').read()
        print('Script execution completed successfully\n')
        if "blank password" in output:
            print(output)
            output = "\n".join(output.strip().splitlines()[2:])
            sd(output, email, apikey, domain)
        else:
            print("no user accounts on this machine has blank password")
            alert(0)
    if os.path.isfile(workdir+r'\temprun.vbs'):
        os.remove(workdir+r'\temprun.vbs')

runvbs(vbs)

Comments

No Comments.

Script to alert and create service desk ticket if any user account with blank password detected

Comments

Leave a Comment