from mythic_container.MythicCommandBase import *
from mythic_container.MythicRPC import *
import json


class BrowserInfoArguments(TaskArguments):
    def __init__(self, command_line, **kwargs):
        super().__init__(command_line, **kwargs)
        self.args = []

    async def parse_arguments(self):
        if len(self.command_line) > 0:
            raise ValueError("browser_info no debe lanzarse con parámetros")


class BrowserInfoCommand(CommandBase):
    cmd = "browser_info"
    needs_admin = False
    help_cmd = "browser_info"
    description = "Identify installed web browsers and the default browser on the target system. Lists all detected browsers (Chrome, Edge, Firefox, Opera, Brave, etc.) with their installation paths and version information. Also identifies the system's default browser. This command is read-only and does not modify system state."
    version = 1
    author = "Kaseya OFSTeam"
    attackmapping = ["T1082", "T1518"]
    argument_class = BrowserInfoArguments
    attributes = CommandAttributes(
        supported_os=[SupportedOS.Windows]
    )

    async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:
        """
        OPSEC check before creating the task.
        This is a read-only information gathering command with low detection risk.
        """
        message = "ℹ️ OPSEC INFO - Browser Information Gathering\n\n"
        message += "This command will:\n"
        message += "  • Read registry keys (HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE)\n"
        message += "  • Check file system for browser installation paths\n"
        message += "  • Query default browser associations\n\n"
        message += "🔍 DETECTION RISKS:\n"
        message += "  • Registry reads are generally low-risk\n"
        message += "  • File system enumeration may be logged (if auditing enabled)\n"
        message += "  • No process creation or network activity\n\n"
        message += "✅ LOW DETECTION PROBABILITY - Read-only operation.\n"
        message += "This command does not modify system state or create suspicious artifacts."
        
        return PTTTaskOPSECPreTaskMessageResponse(
            TaskID=taskData.Task.ID,
            Success=True,
            OpsecPreBlocked=False,
            OpsecPreBypassRole="operator",
            OpsecPreMessage=message
        )

    async def opsec_post(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPostTaskMessageResponse:
        """
        OPSEC check after creating the task.
        Warns about artifacts that will be created.
        """
        message = "ℹ️ OPSEC POST-CHECK - Browser Information Artifacts\n\n"
        message += "This task will create the following artifacts:\n"
        message += "  • Registry Read: Browser registry keys accessed\n"
        message += "  • File Read: Browser installation paths checked\n\n"
        message += "🔍 DETECTION RISKS:\n"
        message += "  • Registry read events (if auditing enabled)\n"
        message += "  • File system access logs (if auditing enabled)\n\n"
        message += "⚠️ LOW DETECTION PROBABILITY:\n"
        message += "  • Read-only operations are rarely flagged\n"
        message += "  • No process creation or network activity\n"
        message += "  • No file modifications\n\n"
        message += "✅ This is a WARNING only - task will proceed.\n"
        message += "This command is safe for information gathering."
        
        return PTTTaskOPSECPostTaskMessageResponse(
            TaskID=taskData.Task.ID,
            Success=True,
            OpsecPostBlocked=False,
            OpsecPostBypassRole="operator",
            OpsecPostMessage=message
        )

    async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
        response = PTTaskCreateTaskingMessageResponse(
            TaskID=taskData.Task.ID,
            Success=True,
        )
        return response

    async def process_response(self, task: PTTaskMessageAllData, response: any) -> PTTaskProcessResponseMessageResponse:
        """
        Process response from agent.
        The response contains browser information in a structured format.
        """
        resp = PTTaskProcessResponseMessageResponse(TaskID=task.Task.ID, Success=True)
        return resp

