hP d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZmZ ddlZddlZddlmZ ddlmZ dd lmZmZmZ dd
l m Z dd l m Z dd l m!Z!m"Z" dd
l#m$Z$ ddl%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- ddl.m/Z/m0Z0m1Z2m3Z3 ddl4m5Z5 ddl6m7Z7 ddl8m9Z9m:Z:m;Z; e
e< Z= G d dej> Z? G d dee Z@ G d de@ ZAdS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)Enum) getLogger)AnyUnion)
inactivity) MessageType) MessageSink
MessageSourceexpect)run_in_executor) HostingPanel)Scope
nice_iterator) ProcessOrder)CLEANUPCLEANUP_ON_SCHEDULE MalwareEventMalwareEventPostponedMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeNOTIFY)
MalwareHitMalwareHitAlternate MalwareScanVulnerabilityHit)MalwareScanMessageInfo)MalwareDatabaseHitInfo)HackerTrapHitsSaver
MalwareActionMalwareActionIm360c ( e Zd Zdedef fd Z xZS )MalwareScanJSONEncoderoreturnc ~ t |t r|j S t | S N)
isinstancer valuesuperdefault)selfr% __class__s R/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/store.pyr, z MalwareScanJSONEncoder.defaultN s2 a 7Nwwq!!! )__name__
__module__ __qualname__r r,
__classcell__r. s @r/ r$ r$ M sK " " " " " " " " " " " "r0 r$ c \ e Zd Zej Zej Ze Z
d\ Z Z d Z
d Z eej d d Z eej d Zed Ze dd
eeef d efd Zd
ej dd fdZede dd fd Z ed Z d
ej fdZ d S )StoreMalwareHits)NNc & K || _ || _ d S r( )_loop_sink)r- loopsinks r/
create_sourcez StoreMalwareHits.create_sourceZ s
r0 c
K d S r( )r- r; s r/ create_sinkz StoreMalwareHits.create_sink^ s r0 F)
async_lockc K |d d sdS t j d 5 | | d{V ddd dS # 1 swxY w Y dS )a1 MalwareScan is saved to DB when:
1. Detached scan started - message has no results
2. Any scan finished - message has summary and results
Message without summary means that detached scan is finished
and summary will arrive along with results in another message.
summarypathN
store_scan)getr tracktask _store_scan)r- messages r/ process_hitsz StoreMalwareHits.process_hitsa s y!%%f-- F
"
"<
0
0 , ,""7++ + + + + + + + , , , , , , , , , , , , , , , , , ,s A((A,/A,c K t j j 5 }t j t
|d |ddt d d d d S # 1 swxY w Y d S )NrC )rC F)indent sort_keyscls)defence360agent internalsloggeropenMalwareScanLogjsondumpdictr$ )r- rJ logfs r/ store_logzStoreMalwareHits.store_logn s
&
-
@
@
B
B d IWY /000 *
s 3A&&A*-A*c t j | ||d |d |d |d ||d d d |d d d ||d d d
S ) Nownerusersizehashhitsr matches timestamp
suspicious) scanid
resource_typer[ r\ r] r^ orig_filetypera status malicious)r create)rc filenamerg rd datas r/
_store_hitzStoreMalwareHits._store_hity sw 'w-f f f f a +6l1ok2 v,q/,77
r0 Npath_obj scan_typec # K t j g}t | t r| gn| }|t j k rt
| E d{V dS |D ]}t j | D ]v}t j
| }t j
| rt j t j |k t j | z t j t( j j k z r|V t1 j | dz }d t j t j | t j | z t j t( j j k z D E d{V xdS )z
Return files that may already not be infected, yet we still
consider them such.
For example, an infected file might have been removed manually.
Nz(/.*|\b)c 3 $ K | ] }|j V d S r( re ).0is r/ z8StoreMalwareHits.get_outdated_entries.. s8 r0 )r FOUNDr) strr REALTIMEiterglobiglobosrD realpathisfiler selectwherere rg in_rd r FILEr* firstreescaperegexp)rm rn possibly_infected_statusespaths target_pathrD scanned_dirs r/ get_outdated_entriesz%StoreMalwareHits.get_outdated_entries s '7&<%=" (3 7 7E
X 0 0 0E{{ " " " " " " " F ! ! K
;//
w''--GNN4(( ")++U#-5%,001KLLN ' 4 6 ; A B UWW JJJJ"$)D//K"?K !+!2!4!4!:!: ' 1 8 8 E E * 1 5 5$>!" !" !+ 8#:#?#E!F " " %
! ! r0 rJ r& c K |d }|d sdS t | }|j rt j t j |d d k sGt j di |t j j
|j d}d|_ |
dS t d|d d dS | | d{V dS ) zLProcess scan message results.
message: MalwareScan message
rC startedNrc )rd initiatorr zScan %s already in databaser? )r
is_summaryMalwareScanModelr~ r rc existsri r r r* r total_malicioussaverS warning_store_scan_from_results)r- rJ rC message_typescans r/ rI z StoreMalwareHits._store_scan s-
)$y! F-g66 " 9 '))'.')2DX2NNOO
(. "9">"D % /
()$ 1793Eh3O //88 8 8 8 8 8 8 8 8 8r0 rC c
| dd }| dd }| d =|=|=| |d |d }t j | d S d S d S d S )N
file_patternsexclude_patternserrorrD rf )rn )poprF r r delete_hits)rP rC r r outdated_entriess r/ _delete_outdated_entriesz)StoreMalwareHits._delete_outdated_entries s OT::
";;'94@@ KK ( % ( " 7 776? 8
"#3 4 4 4 4 4
) (%%((r0 c
K d S r( r? )hit_datadefault_action_resultss r/ _process_default_action_resultsz0StoreMalwareHits._process_default_action_results s
r0 c K |d }|d }t j |i |dt j j i \ }|s
|d _ |d *| d | | d |d D }d t j
t |
D }t t }d }d t fd
} t t | 2 3 d {V }
|
|v rZ | ||
||
d d d r0| |
|d |
f6 fd| D } | j | | d |d | j d {V } i }
| D ]\ }}}}|||f|
|j < | D ]J\ }
}|d d d rt* j }d }|
|
v r|
|
\ }}}t/ |t0 r4|j t4 k r$|d t6 j k rt: nt< }||d< ||d< |dz
}t/ |t> r|j rtC | j" tG j$ | j% j& |
|t j j | d {V }t/ |t0 r<|j' |j( |j) |j* |j ff}|| + | L| _, |d _- t] t_ j/ _0 | d x}r| _1 2 | j r| D ]w\ \ }\ }}} }}|t4 k r1|d t6 j k rtf 4 d I| j 5 |||||| d {V x| 6 |d | D d {V d S ) NrC rc rd )rc defaults completedresultsrD c f i | ].\ }}t j |d d d +||/S )r_ r r` )r match)rr filerk s r/
z=StoreMalwareHits._store_scan_from_results.. sL
d#)$v,q/)*DEE
$
r0 c i | ]
}|j | S r? rq rr hits r/ r z=StoreMalwareHits._store_scan_from_results..
s,
M3
r0 )filesr r c | j t j k p)| j t j t j fv o
| j |k S r( )rg r CLEANUP_STARTED CLEANUP_DONECLEANUP_REMOVED
cleaned_at)r detected_timestamps r/ _hit_status_race_detectedzLStoreMalwareHits._store_scan_from_results.._hit_status_race_detected sG
. >> 8:$1$4 8
N%77
r0 r_ ra c t g | ]4\ }}|d d d t j j || 5S )r_ r rb )r ri rc )rr r rk r s r/
z=StoreMalwareHits._store_scan_from_results..& sQ
d<?<0
&t{D$ ? ?
r0 r rf )r_ r causer< rb default_action try_restore total_filesr zCSkipping auto-cleanup because it's allowed for scheduled scans onlyr_ scan_idr r post_actionc ( i | ]\ }}}}|j |S r? rq )rr r event_s r/ r z=StoreMalwareHits._store_scan_from_results.. s% I I I&6c5!QS]E I I Ir0 )7r
get_or_creater r r* r rF r itemsr get_hitslistr r tuplekeysr malware_actionapply_default_actionr: re r ru r) r actionr r
BACKGROUNDr r r malware_eliminatedr
r9 functoolspartialrl rc rJ r r r appendr total_resourcesinttimera r r rS infoprocess_messager ) r- rJ rC r createdr r_ postponed_hitsr r r malicious_hitsaction_results
apply_dicthit_infor r r rk rg resultr r keyr msg_clsr r r r s @r/ r z)StoreMalwareHits._store_scan_from_results s )$(#(6 !8!=!C
g 2 %[ 1DN 9 )gkk&.A.A.M ) )' 2 2 2
%i 0 6 6 8 8
!*g ???
%T** : (gllnn(=(=>> - - - - - - -$t|| 9 9T
GDM& 1! 4[ A! !| D!!! "&&t,,,
?
%mmoo
$ 2 G G kk+..&/ H
4B J J 0HeV[.3V[-IJx) * *!--// 7 0 7 0JD$F|A|,
%+FFz!!
t$ "
v'<==
)<<<
#6?o.HHH # #
*8%&&1]# 1$ fl33 ! 0 ! '
!OK+06
C &"788
0N ( *
s#**3/// . &} 5 TY[[))KK(( (5 DJ : %%''
BA5)[& 111 ?+EEEKK/
*44 !%$+"'&/(3 22 I I. I I I
s "Fr( ) r1 r2 r3 r
STORE_SCANPROCESSING_ORDERr AVSCOPEr! r r9 r: r= r@ r r r rK rY staticmethodrl r rv r r rI classmethodrW r r r r? r0 r/ r7 r7 T s #. HE"N LE5
VK #666
,
, 76
, VK #$$ %$
\
1 1T "11 1 1 \1f 9)@ 9T 9 9 9 9> 5t 5 5 5 5 [ 5
\
b
k6M b
b
b
b
b
b
r0 r7 c e Zd Zej ZeZ fdZe d Z
e e j
de j
ddfd Ze d Z xZS )StoreMalwareHitsIm360c K t | d {V t j d {V d S r( )r+ r@ r init)r- r; r. s r/ r@ z!StoreMalwareHitsIm360.create_sink sX gg!!$'''''''''!&(((((((((((r0 c K g }g }| D ]\ }}| | }t |t s0|j r| | t
d |d D r| | t j | d{V t j |g d{V dS )z,Do additional processing for malicious filesc 3 > K | ]}t j |d v V dS )r` N)r STANDALONE_MARKr s r/ rt zHStoreMalwareHitsIm360._process_default_action_results.. sB $3s9~E r0 r_ N)
r rF r) r r r anyr add_hitsupdate_sa_hits)r r hacker_trap_hitshacker_trap_sa_hitsrD rk r s r/ r z5StoreMalwareHitsIm360._process_default_action_results s "..** 1 1JD$+//55F fl33
(
. ''--- <
1 $**4000!*+;<<<<<<<<<!01DbIIIIIIIIIIIr0 rJ r& Nc "
K |j r|j d S t j |j |j |j |j |j |j |j |j t j j |j
}nW# t j $ rD t j |j }|j rV|j sO|j r|j rA|j r:|j |j k s*|j |j k s|j t j j k r5t$ d|j |j |j |j Y d S |j |_ |j |_ |j |_ |j |_ |j |_ t j j |_ |j
|_
| t$ d|j d Y nw xY w|j s|j st/ j t. j |j k t. j t j j k z t. j t8 j k z d S t? tA ! d {V fdtE j# D }tI j% |j }| & | | j' ( |j | d | d | j) t j j d {V }i }|D ]\ }}} }
|| f||j < tU tV } |D ]@} d }
| j |v r-|| j \ }
}tY |
tZ r|
j. r;t/ j d i d
|d | | j/ | j/ d | | j0 | j0 d
| j d| j1 dddd dd dd dt8 j dd dt j j d| j2 d| j3 d| j4 d| j5 d| j6 }tY |
tn r6|
j8 |
j9 |
j
|
j: ff}| | ; | B| j) rT| < D ]A\ \ }\ }}}}| j) = |||j ||| d {V @d S d S ) N)
rc r r rf rD r r r rd r )rc zBThe scan %s has already been saved: type=%s, path=%s, completed=%sz
Updated scan z with new data from messagec < i | ]}|j v |j |j S r? )pw_namepw_uid)rr pw panel_userss r/ r z7StoreMalwareHitsIm360.store_db_scan.. s6
z[((
Irz(((r0 r rf )r_ r r r< rd rc r[ r\ re rh Tr^ r] timestamerg r rd app_namedb_hostdb_portdb_namesnippetr r? )>r rf r ri r r rD r r r r DBr* r peeweeIntegrityErrorrF rd rS rc r r r_ r deleter re rg r ru executesetr get_userspwdgetpwallr get_hits_per_db_delete_outdated_db_entriesr r r: r r r) r r r[ r\ signaturer r r r r r rJ r r r r r )r- rJ r uid_to_nameunique_db_hitsr r r r r r r r r r new_hitr r r r r r_ r s @r/
store_db_scanz#StoreMalwareHitsIm360.store_db_scan s ',"6 F- #* !+ \ \ m ' 7 ' 7 5 8 >!+ DD $ #'w???D%
=
N
,0:
~
<49,,<49,,%)@)C)III $K&IN
#?DL $ .DN DJ#*#:D #*#:D !8!;!AD $ .DN IIKKK KKH HHH
= D | =
!##)) )W\9"025;<
"(,<,BB D '))) F 8 8 : :::::::;;
lnn
0? MM (( 888 $ 2 G G kk+..++f%%14: H
%3 3 3 !C$)6?Jsx $T**& & 4 & 4HF}
** x}-"
fl33 ! 0 ! ","3 # # #t#!oohnhnEEE# !__X]HMBBB# #-- #
'' # $
# T# T# $# (--# 4# 6 8 > ># "**# !(( # !(( # !((!#" !((##G& &"788
4N\6#3V5GH s#**7333 :
%%''
:95)[j00G ! ' #"+$/
s AA1 1B9G-BGGc F d | D }t j | d S )Nc g | ] }|j
S r? )rD r s r/ r zEStoreMalwareHitsIm360._delete_outdated_db_entries..N s ///3ch///r0 )r r )r_
orig_filess r/ r z1StoreMalwareHitsIm360._delete_outdated_db_entriesL s, //$///
z*****r0 )r1 r2 r3 r IM360r r" r r@ r r r r MalwareDatabaseScanr r r4 r5 s @r/ r r s KE'N) ) ) ) ) J J \J0 VK +,,S"6S
S S S -,Sj + + \+ + + + +r0 r )B__doc__r ry rU r{ r r r collectionsr enumr loggingr typingr r r defence360agent.internals.loggerrQ defence360agent.apir "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
r r $defence360agent.model.simplificationr
+defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr r imav.contracts.pluginsr imav.malwarelib.configr r r r r r r r imav.malwarelib.modelr r r r r %imav.malwarelib.plugins.detached_scanr imav.malwarelib.scan.mds.reportr imav.malwarelib.subsys.malwarer r! r" r1 rS JSONEncoderr$ r7 r r? r0 r/ r% s *
# # # # # #
' ' ' ' * * * * * * : : : : : :
A @ @ @ @ @ D D D D D D 6 6 6 6 6 6 6 6 / / / / / / C B B B B B
8 " " " " "T - " " "~
~
~
~
~
{M ~
~
~
B
z+ z+ z+ z+ z+ , z+ z+ z+ z+ z+r0