Linux Python / Event Triggered Execution: Linux Inotify

Author Issac Briones (1d8)
Platform Linux
Language Python
Technique Event Triggered Execution: Linux Inotify

Description:

The attached code snippet will trigger after a file creation event occurs within the /tmp directory. It will read the contents of the newly created file.

Code

import inotify.adapters
import psutil

def main():
    i = inotify.adapters.Inotify()

    i.add_watch("/tmp")

    for event in i.event_gen(yield_nones=False):
        (_, type_names, path, filename) = event
        if "IN_CREATE" in type_names:
            fullPath = path + "/" + filename 
            # Testing to see if its a swp file that was created
            if fullPath.split("/")[-1].startswith(".") and fullPath.split("/")[-1].endswith(".swp"):
                newPath = path + "/" + fullPath.split("/")[-1][1:].replace(".swp", "")

            elif fullPath.split("/")[-1].startswith(".") and fullPath.split("/")[-1].endswith(".swx"):
                newPath = path + "/" + fullPath.split("/")[-1][1:].replace(".swx", "")

            while isOpen(fullPath) == True:
                pass

            f = open(newPath, 'r')
            data = f.readlines()
            print(f"[+] Contents of {newPath}: {data}")


def isOpen(path):
    for proc in psutil.process_iter():
        try:
            for item in proc.open_files():
                if path == item.path:
                    return True
        except Exception:
            pass
    return False

if __name__ == '__main__':
    main()

Created

November 18, 2024

Last Revised

November 18, 2024