h 3 " d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZmZmZmZmZmZmZ ddlmZmZmZ ddlmZ dd l m Z dd
l m Z m Z m!Z!m"Z" dd l#m$Z$ dd l%m&Z& dd
l'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- ej. e/ Z0d!dZ1 G d de- Z2 G d de, Z3 G d de- Z4dee5e6f de6fdZ7 G d de8 Z9 G d dee5e9f Z: G d d Z; G d d e Z.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)suppress)islice)CallableDictListOptionalSetTupleUnion)MalwareMalwareSignaturesMyImunifyConfig) MessageType)&ms_clean_requires_myimunify_protection)RecurringCheckStop Singletonbase64_encode_filenamerecurring_check) MalwareTune)
MalwareHit) DeletionType ErrorTypeRescanResultTypeRevisiumCSVFileRevisiumJsonFileRevisiumTempFilec Z t j rt | | S t | | S N)r USE_JSON_REPORTr r tempdirmodes T/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/cleanup/cleaner.pycleaner_result_instancer% ? s- " / ... 7D ) )) c e Zd ZdS )MalwareCleanerLogN)__name__
__module__ __qualname__ r& r$ r( r( E s Dr& r( c > e Zd ZdZdZ ed d ZdS )MalwareCleanerProgressz+
Get progress from external source
r c K | }n-# t $ r t t j $ r Y d S w xY w|d }|| j z
|c}| _ || d S )Ncurrent)readFileNotFoundErrorr jsonJSONDecodeError _progress)selfcallbackdataprogress increments r$ watchz MalwareCleanerProgress.watchP s 99;;DD ' ' '$&& &# FF ?$,t~$=x! 4>s &AAN)r) r* r+ __doc__r6 r r< r, r& r$ r. r. I sI I_Q r& r. c e Zd Zd ZdS )MalwareCleanupFileListc | j d 5 }| d |D d d d d S # 1 swxY w Y d S )Nwbc 3 : K | ]}t | d z V dS )
N)r ).0fs r$ z/MalwareCleanupFileList.write..c s0 MMq/22U:MMMMMMr& )_pathopen
writelines)r7 filelistws r$ writez MalwareCleanupFileList.writea s
Z__T
"
" Na
LLMMHMMM M M M N N N N N N N N N N N N N N N N N Ns AA A N)r) r* r+ rL r, r& r$ r? r? ` s( N N N N Nr& r? valuereturnc D t | S # t $ r Y dS w xY w)zbConvert str|int to int, in case errors return -2
-1 used as default value when storing CH
)int
ValueError)rM s r$
_parse_intrS f s5 5zz rrs
c b e Zd Zdeeeeef f f fd Zd Zd Z d Z
d Z d Z xZ
S )CleanupResultEntryr9 c t t | dd t | dd |d |d t | dd t | dd t | dd | d d
| d d
d S )
NdesrE rmbmahb ha) rW rY rZ rE r[ mtime_before mtime_after hash_before
hash_after)super__init__rS get)r7 r9 __class__s r$ rf zCleanupResultEntry.__init__q s #r**++#r**++3i3i#r**++#DHHT2$6$677"488D"#5#566 r**xxb))
r& c | s| rdS | d t j k r#t d| d dS | d t j k o| d t j k S )NFrY z2File has changed, assuming that it was cleaned: %srE TrW ) is_failed requires_myimunify_protectionr
NOT_CLEANEDUPloggerwarningNO_ERRORr INJECTION_REMOVEDr7 s r$
is_cleanedz CleanupResultEntry.is_cleaned s >> t A A C C 5 9 / / / NNDd3i
4
I+ +
<S \ ;;
r& c | o+| d t j k o| d t j k S )NrY rW )rj r ro r rp rq s r$
is_removedz CleanupResultEntry.is_removed s?
;S Y //
;S L ::
r& c . | d t j k S Nr[ )r DETECTEDrq s r$ rj z CleanupResultEntry.is_failed s Cy , 555r& c . | d t j k S rv )r REQUIRED_ADVANCED_SIGNATURESrq s r$ rk z0CleanupResultEntry.requires_myimunify_protection s Cy , IIIr& c X | o| d t j k S )NrY )rj r FILE_NOT_EXISTSrq s r$ not_existz CleanupResultEntry.not_exist s& >>###NS Y5N(NNr& )r) r* r+ r strr rQ rf rr rt rj rk r|
__classcell__rh s @r$ rU rU p s
T#uS#X"6 7
,
6 6 6J J JO O O O O O Or& rU c e Zd ZdZd fd Zedeeef defd Z deeef f fd Z
deeef f fd Z xZ S )
CleanupResultz5
Cleanup result container for result entries
Nc f |r-t d |D d S d S )Nc : i | ]}|d t | S )rE )rU )rD rY s r$
z*CleanupResult.__init__.. s' L L Laf&8&;&; L L Lr& )re rf )r7 reportrh s r$ rf zCleanupResult.__init__ sE N GG L LV L L L M M M M M N Nr& hitrN c $ t | d| S )N orig_file)getattr)r s r$ __keyzCleanupResult.__key s sK---r& c l t | | S r )re __contains___CleanupResult__keyr7 r rh s r$ r zCleanupResult.__contains__ s% ww##DJJsOO444r& c l t | | S r )re __getitem__r r s r$ r zCleanupResult.__getitem__ s% ww""4::c??333r& r )
r) r* r+ r= rf staticmethodr r} r r r r r~ r s @r$ r r s N N N N N N .5j ) .c . . . \.5c:o 6 5 5 5 5 5 54uS*_ 5 4 4 4 4 4 4 4 4 4 4r& r c e Zd ZdZej ZddZdddddZede de
e d e d
e
e d e
e f
d Zd
efdZ ddeee
e e
e f fdZede dedefd ZdS )MalwareCleanerz/opt/ai-bolit/procu2.phpNTc |r|nt j | _ t | _ || _ || _ d S r )asyncioget_event_loop_loopMalwareCleanupProxy_proxy_sink_watch_progress)r7 loopsinkwatch_progresss r$ rf zMalwareCleaner.__init__ s= !?TTw'='?'?
)++
- r& ) blacklistuse_csv
standard_onlyc
R d| j ddddd|z dd|z d g
}
|r|
d
|z |
d |z d |z g t j r|
d
|r|
d|z g n|
d|z g | r|
dg t
j | j r/|
d |
| j |r|
d |
S )Nz/opt/ai-bolit/wrapperz
--deobfuscatez
--nobackupz--forcibly_cleanupz--rescanz --list=%sz--input-fn-b64-encodedz
--username=%sz--report-hashesz--black-list=%sz--log=%sz
--progress=%sz--disable-cloudavz--csv_result=%sz --result=%sz--standard-onlyz--avdbz--soft)
PROCU_PATHappendextendr
CLEANUP_DISABLE_CLOUDAVospathexistsPROCU_DB) r7 filename
progress_path result_pathlog_pathsoftusernamer r r cmds r$ _cmdzMalwareCleaner._cmd s]
$ O ( " $ h &
6 JJ(94 5 5 5
X% -/
* , JJ* + + + 6 JJ)K78 9 9 9 9 JJ
34 5 5 5 , JJ)* + + +
7>>$- ( ( & JJx JJt} % % % ! JJx
r& excr
returncodestdoutstderrc t | j j |||| d nd|| d nd S )Nreplace)errorsr_ ) exception return_codecommandouterr)dictrh r) decode)r r r r r s r$ _get_cleaner_error_infoz&MalwareCleaner._get_cleaner_error_info s_ m,"393E
Y
///2393E
Y
///2
r& infoc B K | j r t j i |dt t j i }| j | d {V d S # t j $ r t $ r t
d Y d S w xY wd S )N timestampz-Exception while sending CleanupFailed message) r r
CleanupFailedrQ timeprocess_messager CancelledError Exceptionrm r )r7 r msgs r$ _send_cleanup_failed_messagez+MalwareCleaner._send_cleanup_failed_message s :
!/?t? S-=-= >? j0055555555555)
C
s AA% %3B B rN c K t j }t | }t |t }| || }t
|d 5 } t
|d 5 }
t | 5 } |5 } t | 5 }
| | |r|
| | j
r7| j |
| j j |r8| | j | j | j |
j |||
j || }n1| | j | j | j |
j |||| }t$ dd | d\ }}d } t+ j j |t, j t, j d d {V }| d {V \ }}| }n# t* j $ rD |r@t9 t: 5 | d d d n # 1 swxY w Y t> $ r&}| |||r|j! nd
|| }t$ " d |# d d
|# d d|# d i |d|i | $ i |tK tM | d {V tO tQ | |fcY d }~cd d d cd d d cd d d cd d d cd d d S d }~ww xY wtO | d |fcd d d cd d d cd d d cd d d cd d d S # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )N)r" i r! )r r r r )r r r z Executing %s )r& r& )r r ~ zCleanup failed exit_code=r z: %sr r r )extra)message))tempfile
gettempdirr%
isinstancer is_standard_onlyr? r. r( rL r r create_taskr< r progress_cbr r rm debugjoinr
subprocesscreate_subprocess_execPIPE communicater2 r r ProcessLookupError terminater r r errorrg r r r} r repr)r7 userrJ r r r r" result_filer flistblkr: resultlogr r r procr r r s r$ startzMalwareCleaner.start s %''-g>>> [/:: --dMBB
#%
J 4
*%
J 4 (
J 4 {
J 4 '-.?/
/
/
J 4 KK ! ! !
% )$$$#
P
&&x~~dk6M'N'NOOO
iiN %OL ! !l #"/
iiN %OL ! #"/
LL # 7 7 7 HCD
7 $ / F%?%?
"&!1!1!3!3333333S )
)!"455 ) ) ((() ) ) ) ) ) ) ) ) ) ) ) ) ) )
7
7
733'+4DOO 4 M 0G0GMMMxx::% ::4T4;44
776t6tCHH 5 5 56 %S 3666666QJ 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4n
7& !(($3UJ 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4 J 4s# "P94P!P
O3 D O %A"H
O %N
.I N
IN
IN
%C N
N
O O3 P
! P!- P9N
O O3 + P
7 P! P9 O O3 #O $O3 ' P
3O7
7P
:O7
;P
> P!
P P!P P! P9!P% %P9(P% )P99P= P=r r c dS )z@Check if only standard signatures should be applied for the userF)r ENABLEDr )r r s r$ r z MalwareCleaner.is_standard_onlyp s
ur& )NNT)TNN)r) r* r+ r r r rf r r r r r} rQ r bytesr r r r r r boolr r, r& r$ r r sM +J )H. . . . 2 2 2 2 2h
#Y
\
t $
W4 W4
}hsmT#Y6 7W4 W4 W4 W4r
s
4
D
\
r& r c V e Zd ZdZ d Zd Zdeeeeee f fdZ
d dZ d Z d Z
d
S ) r i' c T dx| _ | _ t t | _ d S Nr )r1 totalr sethitsrq s r$ rf z MalwareCleanupProxy.__init__ s# $%% tz $$ r& c P | j |||||f | d S r )r update)r7 cause initiator post_actionscan_idr r s r$ addzMalwareCleanupProxy.add s+
I{G] C
&,,,,,r& rN c # K | j r| j \ }}t | }t t || j }t
|d }|@| j | | | j | | | xj t | z
c_ g ||R V | j d S d S r ) r popitemiterr r _CHUNK_SIZEnextr r r len)r7 scan_infor all_hits
remaining_hits r$ flushzMalwareCleanupProxy.flush s i # "i / / 1 1OItDzzHvh(899::D 4 0 0M ( )$(( 777 )$++H555 JJ#d)) #JJ"9"d"" " " " i # # # # #r& c & | xj |z
c_ d S r )r1 )r7 r; s r$ r z MalwareCleanupProxy.progress_cb s ! r& c " dx| _ | _ d S r )r1 r rq s r$ resetzMalwareCleanupProxy.reset s $%% tzzzr& c t | j | j t | j z z dz S # t
$ r Y d S w xY w)Nd )rQ r1 r r r ZeroDivisionErrorrq s r$ get_progressz MalwareCleanupProxy.get_progress sR t|tzC NN'BCcIJJ J 44 s 36
AAN)r )r) r* r+ r rf r r r} r r
r r r r r, r& r$ r r s K% % %
#uS#xc 9:
#
#
#
# " " " "& & & r& r ) metaclass)NN)=r= r r4 loggingr r r r collectionsr
contextlibr itertoolsr typingr r r r r
r r defence360agent.contracts.configr
r r "defence360agent.contracts.messagesr %defence360agent.contracts.permissionsr defence360agent.utilsr r r r imav.contracts.configr imav.malwarelib.modelr imav.malwarelib.utils.revisiumr r r r r r getLoggerr) rm r% r( r. r? r} rQ rS r rU r r r r, r& r$ r s * # # # # # # D D D D D D D D D D D D D D D D D D
; : : : : : . - - - - - , , , , , ,
8 $ $* * * * ( - .N N N N N - N N N eCHo # 4O 4O 4O 4O 4O 4O 4O 4On4 4 4 4 4D 001 4 4 4(C C C C C C C C L( ( ( ( (I ( ( ( ( ( (r&