cobaltbrew

#!/usr/bin/python
# Author: xakepnz
# Description: Obtains hashes of any local file, optional hash-search against Virustotal.
############################################################################################
# Imports:
############################################################################################

import argparse
import hashlib
import requests

############################################################################################
# Config:
############################################################################################

# VT API Key:
api_key = ''

# Buffer chunk size for hash obtaining:
buffer_size = 65536

############################################################################################
# Banner:
############################################################################################

def banner():
    """ Simple banner for script """
    print('\n   /######   /######  /#######   /######  /##    /########')
    print('  /##__  ## /##__  ##| ##__  ## /##__  ##| ##   |__  ##__/')
    print(' | ##  \__/| ##  \ ##| ##  \ ##| ##  \ ##| ##      | ##')
    print(' | ##      | ##  | ##| ####### | ########| ##      | ##')
    print(' | ##      | ##  | ##| ##__  ##| ##__  ##| ##      | ##')
    print(' | ##    ##| ##  | ##| ##  \ ##| ##  | ##| ##      | ##')
    print(' |  ######/|  ######/| #######/| ##  | ##| ########| ##')
    print('  \______/  \______/ |_______/ |__/  |__/|________/|__/\n')
    print('       /#######  /#######  /######## /##      /##')
    print('      | ##__  ##| ##__  ##| ##_____/| ##  /# | ##')
    print('      | ##  \ ##| ##  \ ##| ##      | ## /###| ##')
    print('      | ####### | #######/| #####   | ##/## ## ##')
    print('      | ##__  ##| ##__  ##| ##__/   | ####_  ####')
    print('      | ##  \ ##| ##  \ ##| ##      | ###/ \  ###')
    print('      | #######/| ##  | ##| ########| ##/   \  ##')
    print('      |_______/ |__/  |__/|________/|__/     \__/\n')
    print('                     Author: xakepnz              ')
    print('    Repo: https://www.github.com/xakepnz/COBALTBREW\n')
    print(' ------------------------------------------------------\n')

############################################################################################
# Search Virustotal:
############################################################################################

def search(api_key, sha256_hash):
    """
    Info:
        Searches a hash against Virustotal database, returns reseponse.
    
    Inputs:
        api_key     - str, your VT API key.
        sha256_hash - str, the SHA256 hash value of the file to search against VT.
    
    Returns:
        response    - json, object containing response data.
    """

    r = requests.get(
        'https://www.virustotal.com/api/v3/files/{}'.format(sha256_hash),
        headers={
            'Content-Type': 'application-json',
            'x-apikey': '{}'.format(api_key)
        }
    )

    if r.ok:
        if r.status_code == 200:
            return True
    else:
        if r.status_code == 404:
            return None
        else:
            print('Error, failed to connect response code was: {}'.format(r.status_code))
            exit(1)

############################################################################################
# Obtain local file hash:
############################################################################################

def local(path, buffer_size):
    """
    Info:
        Opens a file, reads the bytes to obtain the hash values.
    
    Inputs:
        path        - str, file path to obtain hashes of.
        buffer_size - int, chunk value to read x amount of bytes.
    
    Returns:
        hashes      - dict, containing the hash values.
    """

    # Define the hash objects:
    md5 = hashlib.md5()
    sha1 = hashlib.sha1()
    sha256 = hashlib.sha256()
    sha512 = hashlib.sha512()

    # Open the file and iterate over the chunks until the full file is hashed:
    try:
        with open(path, 'rb') as f:
            while True:
                d_ = f.read(buffer_size)
                if not d_:
                    break
                md5.update(d_)
                sha1.update(d_)
                sha256.update(d_)
                sha512.update(d_)

    except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
        print('Error, failed to read file: "{}" check path.'.format(path))
        exit(1)
    
    return {
        'File': '{}'.format(path),
        'MD5': '{}'.format(md5.hexdigest()),
        'SHA1': '{}'.format(sha1.hexdigest()),
        'SHA256': '{}'.format(sha256.hexdigest()),
        'SHA512': '{}'.format(sha512.hexdigest())
    }

############################################################################################
# Read multiple filepaths:
############################################################################################

def read_multi(multi_loc):
    """
    Info:
        Takes a file path to a new line separated TXT file containing multiple file paths.
    
    Inputs:
        multi_loc  - str, file path to TXT file containing multiple files to check.
    
    Returns:
        file_paths - list, multiple files to get hash values for.
    """

    try:
        file_paths = []

        with open(multi_loc, 'r') as f:
            raw_files = f.readlines()
            for r_ in raw_files:
                r_ = r_.replace('\n','')
                file_paths.append(r_)

        return file_paths

    except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
        print('Error, failed to read file: "{}" check path.'.format(path))
        exit(1)

############################################################################################
# Main:
############################################################################################

# Print the banner:
banner()

# Take variable input from the user:
parser = argparse.ArgumentParser()
parser.add_argument(
    '-f', '--file', 
    help='File path of file to obtain hashes for.',
    required=False
)
parser.add_argument(
    '-m', '--multi', 
    help='Multiple file paths new line separated TXT file.',
    required=False
)
parser.add_argument(
    '-s', '--search', 
    help='Search the hash against Virustotal',
    required=False,
    action='store_true'
)
args = parser.parse_args()
local_file_path = args.file
multi = args.multi
search_bool = args.search

# Ignore requests without input:
if not local_file_path and not multi and not search_bool:
    print('         No input provided, try cobaltbrew --help\n')
    exit(1)

# Ignore requests to search without a key:
if search_bool and not api_key:
    print('Error, virustotal searching enabled without any API Key present.')
    exit(1)

# Get hashes of local file:
if local_file_path:
    hashes = local(local_file_path, buffer_size)

    # Print the hashes:
    print('File: {}\n'.format(hashes.get('File')))
    print('- MD5: {}'.format(hashes.get('MD5')))
    print('- SHA1: {}'.format(hashes.get('SHA1')))
    print('- SHA256: {}'.format(hashes.get('SHA256')))
    print('- SHA512: {}\n'.format(hashes.get('SHA512')))

    # If searching enabled, search against Virustotal and print results:
    if search_bool:
        found = search(api_key, hashes.get('SHA256'))
        print('Virustotal results:\n')
        if found:
            print('- Found: https://www.virustotal.com/gui/file/{}\n'.format(hashes.get('SHA256')))
        else:
            print('- No results for: {}\n'.format(hashes.get('SHA256')))

# Handle multiple file inputs via new line TXT file:
if multi:
    file_paths = read_multi(multi)
    results = []

    # Collect the hashes:
    for f_ in file_paths:
        results.append(
            local(f_, buffer_size)
        )

    # Search against Virustotal
    if search_bool:
        for hashes in results:
            # Print the hashes:
            print('File: {}\n'.format(hashes.get('File')))
            print('- MD5: {}'.format(hashes.get('MD5')))
            print('- SHA1: {}'.format(hashes.get('SHA1')))
            print('- SHA256: {}'.format(hashes.get('SHA256')))
            print('- SHA512: {}\n'.format(hashes.get('SHA512')))

            # If searching enabled, search against Virustotal and print results:
            found = search(api_key, hashes.get('SHA256'))
            print('Virustotal results:\n')
            if found:
                print('Found: https://www.virustotal.com/gui/file/{}\n'.format(hashes.get('SHA256')))
            else:
                print('No results for: {}\n'.format(hashes.get('SHA256')))

    # Otherwise just print the hashes:
    else:
        for hashes in results:
            # Print the hashes:
            print('File: {}\n'.format(hashes.get('File')))
            print('- MD5: {}'.format(hashes.get('MD5')))
            print('- SHA1: {}'.format(hashes.get('SHA1')))
            print('- SHA256: {}'.format(hashes.get('SHA256')))
            print('- SHA512: {}\n'.format(hashes.get('SHA512')))