h 2 X d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
ddl m Z
ddl mZmZmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZmZ dd l m Z dd
l m Z m Z ddl!m"Z" ddl#m$Z$ ddl%m&Z&m'Z' ddl(m)Z) ej* e+ Z, G d de Z- G d d Z.dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)suppress)Path)Core)MalwareScanIntensityMalwareSignaturesget_rapid_rescan_frequency)
LicenseCLN)resource_limits)Malware) MalwareTune)AIBOLIT_SCAN_INTENSITY_KEYMalwareScanType)ScanFailedError)AIBOLIT AIBOLIT_PATH)AiBolitDetachedDir)parse_report_json) crontab_path
in_crontab)
get_memoryc e Zd ZdS ) AiBolitErrorN)__name__
__module__ __qualname__ Z/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/ai_bolit/scanner.pyr r ; s Dr r c e Zd Zd dZddddddddddd
defdZed Zed Zdddddddddddd defd
Z dS ) AiBolitNc " d | _ || _ d S N)cmdscan_id)selfr$ s r __init__zAiBolit.__init__@ s r T)
scan_pathr$ db_dir
detect_elfexclude_patternsfollow_symlinks
file_patterns use_filtersjson_report_pathcsv_report_path scan_typec b || _ dt dddt j ddt | d|g | rdgng |d u rd
gn|d u rd gng t
j rd
t j gng t
j rdgng }|r|s|s%|s#t d
|| d }|t
j sgt j
t t! d g}| r| | d | } n t% t' | }| d|g|
rdgng | rd| gng | d| gng ddd |s| dg n| d|g |t* j k r|S | d | d t t
j g t
j rd|4|s2| d |d t t3 g | d t t
j g |t* j t* j t* j fv r}| d! | d"|g t< j r| d#|
g n| d$|g | d% n| g d& t@ ! | |S )'z
:param detect_elf: True - detect as malicious
False - detect as suspicious
None - do nothing
z/opt/ai-bolit/wrapperz--smartz
--deobfuscatez--avdbz --no-htmlz--memoryz
--progressz
--use-filtersTz--use-heuristicsFz--use-heuristics-suspiciousz--hsz--detect-admin-toolszaAi-Bolit cmd generation error, cannot select from finder and filelist.scan_path: {}, filename: {}N*,z--pathz--follow-symlinkz--ignore-filenamesz--only-filepathsz--ignore-quarantinez--use-template-in-pathz--skip-imunify360-storagez--skip-system-ownerz --listingz--with-suspiciousz--sizez--rapid-account-scanz --rapid-scan-rescan-frequencyz--cloudscan-sizez--encode-b64-fnz
--detached
--json_reportz --csv_reportz--quite)r4 .z
--json-stdout)"r$ r r AI_BOLIT_HOSTERr
MalwareConfig HYPERSCANAI_BOLIT_HYPERSCANDETECT_ADMIN_TOOLS TypeErrorformatCRONTABS_SCAN_ENABLEDospathjoinstrr appendr r extendr MODSECMAX_SIGNATURE_SIZE_TO_SCANCLOUD_ASSISTED_SCANr MAX_CLOUDSCAN_SIZE_TO_SCAN
BACKGROUND ON_DEMANDUSERr USE_JSON_REPORTloggerinfo)r% filename
intensity_ram
progress_pathr0 r' r$ r( r) r* r+ r, r- r. r/ r# in_crontabsexclude_crontabs r _cmdz AiBolit._cmdD s . # - } % % "
$/6 B"
%% $$$ && 444%"
4 !**=>>7"
> !3'((A"
H ) H ..4fY.I.I
6
:#%7<<LNN0C0CS#I#I"J# =#**+;<<<#&88O#<#< (i 9 9 JJ />E)**2 , -/?@@ )4 ,];; * - 0!
(
4
12333
JJ X. / / / . . .J
&'''
Hc-"J K KLMMM , !+!
. 7 6 8 899
JJ&
@AA
& %
JJ( ) ) ) JJ g. / / /*
>
O-=>????
NO<===
JJy ! ! ! ! JJ>>> ? ? ? C
r c t j rCt j } t t
j | d< | S d S )N CLOUD_ASSIST)r7 rF r> environcopyrA r
get_server_id) environments r get_updated_environmentz AiBolit.get_updated_environment sD , *//++K*-j.F.H.H*I*IK ' tr c t j t j d t
t j dz S )Nzprogress_file_{}g cA)r> r? r@
CoreConfigTMPDIRr< inttimer r r _generate_progress_filez AiBolit._generate_progress_file sD w|| % %c$)++*<&=&= > >
r )
intensity_cpu intensity_iorO r) r- r$ r( r' r* r+ r, c K || _ |p t j }|p t j }|p t j }|t
j t
j t
j fv }|r|sJ t | j | 5 }|
|rt |j nd|t |j
||| || | |
|
t |j t |j
}||d}|j d 5 }t% j || ddd n # 1 swxY w Y |j d 5 }|j d 5 }t- j |||t0 | d||t | | d{V ddd n # 1 swxY w Y ddd n # 1 swxY w Y ddd n # 1 swxY w Y i S |
||j nd|| ||| || | |
|
| | _ t: d
d | j t- j | j ||t@ j! t@ j! tD j# | t0 | d{V | _$ | j$ % d{V \ | _& | _' nY# tP j) $ rG tU tV 5 | j$ , ddd n # 1 swxY w Y w xY w t% j- | j& . }nL# t$ j/ $ r:}ta d
| j | j$ j1 | j& | j' | j |
|d}~ww xY wt: dtd | tg |d S )a
:param file: path to file with list of paths to scan
:param intensity_cpu: [inverse] niceness level of the scan.
The higher the number the more priority the process
gets (more cpu)
:param intensity_io: [inverse] ioniceness level of the scan.
Higher number means more disk time may be provided
in a given period
:param intensity_ram: memory value
:param detect_elf: enable binary malware (elf) detection
:param use_filters: apply ignore filters to list of scanning files
:param scan_type: type of scan
:param scan_id: id of scan
:param db_dir: path to rapid scan database
:param scan_path: str with scan path (templates allowed)
:param exclude_patterns: patterns of filenames to ignore
:param follow_symlinks: bool, if True -> follow symlinks
:param file_patterns: patterns of filenames to scan
:raise CancelledError: when scan was cancelled
:return iterator: parsed report
)tmp_listing_fileN)
r0 r$ r( r) r* r+ r' r, r. r/ )r# r0 w)modeT)ra rb keystart_new_sessionstdoutstderrcwdenv) r0 r$ r( r) r* r+ r' r, r- z Executing %s )ra rb ri rj rk rl rg JSONDecodeError)messagecommand return_codeouterrr$ r? z%s returned %sF) base64_path)4r$ r CPUIORAMr rI rH rJ r rS rA listing_file
progress_filer. r/ scan_info_fileopenjsondumplog_fileerr_filer
create_subprocessr
rZ namer` r# rL debugr@
subprocessPIPEr\ r] proc communicaterr rs asyncioCancelledErrorr ProcessLookupError terminateloadsdecodern r
returncoder r )r% filer0 ra rb rO r) r- r$ r( r' r* r+ r, _detachedwork_dirr# scan_infofl_fe_freportrs s r scanz AiBolit.scan s N %A)=)A
#>';'> %A)=)A
% & !
( NN7# !% %
ii26@C-...D!.// ' #! )%5$3 '"/%()B%C%C$'(@$A$A %(i @ @ ,11s1;; ,qIi+++, , , , , , , , , , , , , , , %**3//36 %**3//36);&3%1 6y A*. " " MM 8 8 : :
/%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
L I99 )DIIt ( ( * * ! - + '#
^SXXdh%7%7888); H'% ? ?!,,..*95
'+y'<'<'>'>!>!>!>!>!>!> DHdhh% ,--
&
& ##%%%
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
Z 1 122FF# ) I 0HH
%w777 U;;;;s 6BG/D' G/'D+ +G/.D+ / G/ G'AG5 GG GG G G/G G/ G G//G36G3,L #M(M MM MM M +N O5OOr" )
r r r r& rA rS staticmethodrZ r` r r r r r r ? s !R R R
R R R Rh \
\
N< N< N< N< N< N< N< N< N r r_
contextlibr pathlibr defence360agent.contracts.configr r\ r r r !defence360agent.contracts.licenser defence360agent.utilsr
imav.contracts.configr r7 r imav.malwarelib.configr
r imav.malwarelib.scanr imav.malwarelib.scan.ai_bolitr r &imav.malwarelib.scan.ai_bolit.detachedr $imav.malwarelib.scan.ai_bolit.reportr imav.malwarelib.scan.crontabr r imav.malwarelib.utilsr getLoggerr rL r r r r r r s0 *
9 8 8 8 8 8 1 1 1 1 1 1 . - - - - - 1 0 0 0 0 0 ? ? ? ? ? ? ? ? E E E E E E B B B B B B A A A A A A A A , , , , , , 8 $ $ ? v< v< v< v< v< v< v< v< v< v