Alert and Trigger Veeam agent to Backup if file is Encrypted

path=r"C:\Users\C1-En_230\Downloads"  # Give the Path want to monitor

path_to_bckup=r"C:\Users\C1-En_230\Desktop\Backup" #Give the path where want to store backedup files.

​

​

import os

import ctypes

import re

import time

import shutil

import datetime

import socket

import platform

import sys

​

​

class disable_file_system_redirection:

    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection

    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection

    def __enter__(self):

        self.old_value = ctypes.c_long()

        self.success = self._disable(ctypes.byref(self.old_value))

    def __exit__(self, type, value, traceback):

        if self.success:

            self._revert(self.old_value)

​

​

def alert(arg): 

   sys.stderr.write("%d%d%d" % (arg, arg, arg)) 

​

​

def file_owner(filename):

    import ctypes as ctypes

    from ctypes import wintypes as wintypes

​

    advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)

​

    # required constants

    ERROR_INSUFFICIENT_BUFFER = 0x007A

    OWNER_SECURITY_INFORMATION = 0x00000001

​

    # related constants

    ERROR_INVALID_FUNCTION = 0x0001

    ERROR_FILE_NOT_FOUND   = 0x0002

    ERROR_PATH_NOT_FOUND   = 0x0003

    ERROR_ACCESS_DENIED    = 0x0005

    GROUP_SECURITY_INFORMATION     = 0x00000002

    DACL_SECURITY_INFORMATION      = 0x00000004

    SACL_SECURITY_INFORMATION      = 0x00000008

    LABEL_SECURITY_INFORMATION     = 0x00000010

    ATTRIBUTE_SECURITY_INFORMATION = 0x00000020

    SCOPE_SECURITY_INFORMATION     = 0x00000040

    BACKUP_SECURITY_INFORMATION    = 0x00010000

    UNPROTECTED_SACL_SECURITY_INFORMATION = 0x10000000

    UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000

    PROTECTED_SACL_SECURITY_INFORMATION   = 0x40000000

    PROTECTED_DACL_SECURITY_INFORMATION   = 0x80000000

​

    # type definitions

    LPBOOL  = ctypes.POINTER(wintypes.BOOL)

    LPDWORD = ctypes.POINTER(wintypes.DWORD)

    PSID = ctypes.POINTER(wintypes.BYTE)

    PSECURITY_DESCRIPTOR = ctypes.POINTER(wintypes.BYTE)

    SECURITY_INFORMATION = wintypes.DWORD

​

    class SID_NAME_USE(wintypes.DWORD):

        _sid_types = dict(enumerate('''

            User Group Domain Alias WellKnownGroup DeletedAccount

            Invalid Unknown Computer Label'''.split(), 1))

​

        def __init__(self, value=None):

            if value is not None:

                if value not in self.sid_types:

                    raise ValueError('invalid SID type')

                wintypes.DWORD.__init__(value)

​

        def __str__(self):

            if self.value not in self._sid_types:

                raise ValueError('invalid SID type')

            return self._sid_types[self.value]

​

    PSID_NAME_USE = ctypes.POINTER(SID_NAME_USE)

​

    # function pointer prototypes

​

    def _check_bool(result, func, args,

                    WinError=ctypes.WinError,

                    get_last_error=ctypes.get_last_error):

        if not result:

            raise WinError(get_last_error())

        return args

​

    # msdn.microsoft.com/en-us/library/aa446639

    advapi32.GetFileSecurityW.errcheck = _check_bool

    advapi32.GetFileSecurityW.argtypes = (

        wintypes.LPCWSTR,     # _In_      lpFileName

        SECURITY_INFORMATION, # _In_      RequestedInformationRequested

        PSECURITY_DESCRIPTOR, # _Out_opt_ pSecurityDescriptor

        wintypes.DWORD,       # _In_      nLength

        LPDWORD)              # _Out_     lpnLengthNeeded

​

    # msdn.microsoft.com/en-us/library/aa446651

    advapi32.GetSecurityDescriptorOwner.errcheck = _check_bool

    advapi32.GetSecurityDescriptorOwner.argtypes = (

        PSECURITY_DESCRIPTOR,  # _In_  pSecurityDescriptor

        ctypes.POINTER(PSID),  # _Out_ pOwner

        LPBOOL)                # _Out_ lpbOwnerDefaulted

​

    # msdn.microsoft.com/en-us/library/aa379166

    advapi32.LookupAccountSidW.errcheck = _check_bool

    advapi32.LookupAccountSidW.argtypes = (

        wintypes.LPCWSTR, # _In_opt_  lpSystemName

        PSID,             # _In_      lpSid

        wintypes.LPCWSTR, # _Out_opt_ lpName

        LPDWORD,          # _Inout_   cchName

        wintypes.LPCWSTR, # _Out_opt_ lpReferencedDomainName

        LPDWORD,          # _Inout_   cchReferencedDomainName

        PSID_NAME_USE)    # _Out_     peUse

​

    def get_file_security(filename, request):

        length = wintypes.DWORD()

        # N.B. This query may fail with ERROR_INVALID_FUNCTION

        # for some filesystems.

        try:

            advapi32.GetFileSecurityW(filename, request, None, 0,

                ctypes.byref(length))

        except WindowsError as e:

            if e.winerror != ERROR_INSUFFICIENT_BUFFER:

                raise

        if not length.value:

            return None

        sd = (wintypes.BYTE * length.value)()

        advapi32.GetFileSecurityW(filename, request, sd, length,

            ctypes.byref(length))

        return sd

​

    def look_up_account_sid(sid):

        SIZE = 256

        name = ctypes.create_unicode_buffer(SIZE)

        domain = ctypes.create_unicode_buffer(SIZE)

        cch_name = wintypes.DWORD(SIZE)

        cch_domain = wintypes.DWORD(SIZE)

        sid_type = SID_NAME_USE()

        advapi32.LookupAccountSidW(None, sid, name, ctypes.byref(cch_name),

            domain, ctypes.byref(cch_domain), ctypes.byref(sid_type))

        return name.value, domain.value, sid_type

​

    def get_file_owner(filename):

        sd = get_file_security(filename, OWNER_SECURITY_INFORMATION)

        sid = PSID()

        sid_defaulted = wintypes.BOOL()

        advapi32.GetSecurityDescriptorOwner(sd, ctypes.byref(sid),

            ctypes.byref(sid_defaulted))

        name, domain, sid_type = look_up_account_sid(sid)

        return name, domain, sid_type

​

​

​

    import sys

​

​

    if isinstance(filename, bytes):

        filename = filename.decode('mbcs')

​

    name, domain, sid_type = get_file_owner(filename)

​

    if domain:

        name =  '{0}\\{1}'.format(domain, name)

    print("\nFile : {0}".format(filename))

    print("Owner: {0} ({1})".format(name, sid_type))

​

​

def check():

    with disable_file_system_redirection():

        os.chdir(path)

        inst=os.popen("cipher").read()

    return inst

​

​

def again():

    with disable_file_system_redirection():

        os.chdir(path)

        ins=os.popen("wmic product get name,identifyingnumber").read()

        if 'Veeam Agent' in ins:

            print "\n Veeam Agent is installed on Endpoint"

            print "\n Veeam agent is Backing up your files, takes time to finish up based on FILE SIZES"

            veeam()

        else:

            print "\nCouldn't find Veeam Agent on Endpoint"

            print "\n Please Install Veeam Agent to start Backup"

​

def veeam ():

    os.chdir(path)

    os.popen('"C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Manager.exe" /standalone '+path_to_bckup)

    time.sleep(60)

    os.chdir(path_to_bckup)

    so=os.popen('dir').read()

    if "Backup Job" in so:

        print "\n Backup is completed and stored in specified path"

​

​

​

inst=check()

​

if len(inst)>0:

    find=re.findall('E\s(.*)',inst)

​

    if len(find)>0:

        alert(1)

        print "\nFound Encrypted files on Specified path:\n"

        print "User IP :"+socket.gethostbyname(socket.gethostname())

        print "Os Details :"+platform.platform()

        for f in find:

            fn=path+'\\'+f

            file_owner(fn)

            print "File Created Date : "+time.strftime("%Y/%m/%d",time.localtime(os.path.getctime(path+'\\'+f)))

            print "File Created Time : "+time.strftime("%I:%M:%S %p",time.localtime(os.path.getctime(path+'\\'+f)))

            print "File Modified Date: "+time.strftime("%Y/%m/%d",time.localtime(os.path.getmtime(path+'\\'+f)))

            print "File Modified Time: "+time.strftime("%I:%M:%S %p",time.localtime(os.path.getmtime(path+'\\'+f)))

        print "\n Checking for Veeam agent status in Endpoint"

        again()

​

​

    else:

        print "No file is Encrypted in Specified path"

        alert(0)

​

​

​

​