h# d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZ ddlmZ ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZmZm Z m Z m Z m Z ej e! Z"dd Z# G d d
e Z$ G d de Z% G d de Z&dee'e(f de(fdZ) G d de* Z+ G d de
e'e+f Z, G d d Z-dS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)suppress)DictListOptionalTupleUnion)MalwareSignatures) MessageTypebase64_encode_filename) MalwareTune)VulnerabilityHit) DeletionType ErrorTypeRescanResultTypeRevisiumCSVFileRevisiumJsonFileRevisiumTempFilec Z t j rt | | S t | | S N)r
USE_JSON_REPORTr r tempdirmodes \/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/vulnerabilities/patcher.pypatcher_result_instancer 0 s- " / ... 7D ) )) c e Zd ZdS )VulnerabilityPatcherLogN__name__
__module__ __qualname__ r r r r 6 Dr r c e Zd ZdS ) VulnerabilityPatcherProgressNr r$ r r r' r' : r% r r' c e Zd Zd ZdS )VulnerabilityPatchFileListc | j d 5 }| d |D d d d d S # 1 swxY w Y d S )Nwbc 3 : K | ]}t | d z V dS )
Nr ).0fs r z3VulnerabilityPatchFileList.write..A s0 MMq/22U:MMMMMMr )_pathopen
writelines)selffilelistws r writez VulnerabilityPatchFileList.write? s
Z__T
"
" Na
LLMMHMMM M M M N N N N N N N N N N N N N N N N N Ns AA A N)r! r" r# r7 r$ r r r) r) > s( N N N N Nr r) valuereturnc D t | S # t $ r Y dS w xY w)zbConvert str|int to int, in case errors return -2
-1 used as default value when storing CH
)int
ValueError)r8 s r
_parse_intr> D s5 5zz rrs
c \ e Zd Zdeeeeef f f fd Zd Zd Z d Z
d Z xZ S )PatchResultEntrydatac t t | dd t | dd |d |d t | dd t | dd t | dd | d d
| d d
d S )
Ndesr/ rmbmahb ha) rC rE rF r/ rG mtime_before mtime_after hash_before
hash_after)super__init__r> get)r4 rA __class__s r rR zPatchResultEntry.__init__O s #r**++#r**++3i3i#r**++#DHHT2$6$677"488D"#5#566 r**xxb))
r c | s| rdS | d t j k r#t d| d dS | d t j k o| d t j k S )NFrE z2File has changed, assuming that it was patched: %sr/ TrC ) is_failed requires_myimunify_protectionr
NOT_CLEANEDUPloggerwarningNO_ERRORr
PATCH_APPLIEDr4 s r
is_patchedzPatchResultEntry.is_patchede s NN $ B B D D 5 9 / / / NNDd3i
4
I+ +
8S \ 77
r c . | d t j k S NrG )r DETECTEDr] s r rV zPatchResultEntry.is_failedv s I)2 2
r c . | d t j k S r` )r REQUIRED_ADVANCED_SIGNATURESr] s r rW z.PatchResultEntry.requires_myimunify_protection{ s Cy , IIIr c X | o| d t j k S )NrE )rV r FILE_NOT_EXISTSr] s r not_existzPatchResultEntry.not_exist~ s& >>###NS Y5N(NNr )
r! r" r# r strr r< rR r^ rV rW rf
__classcell__rT s @r r@ r@ N s
T#uS#X"6 7
,
"
J J JO O O O O O Or r@ c e Zd ZdZd fd Zedeeef defd Z deeef f fd Z
deeef f fd Z xZ S )
PatchResultz5
Cleanup result container for result entries
Nc f |r-t d |D d S d S )Nc : i | ]}|d t | S )r/ )r@ )r. rE s r
z(PatchResult.__init__.. s' J J Jaaf&6q&9&9 J J Jr )rQ rR )r4 reportrT s r rR zPatchResult.__init__ sE L GG J J6 J J J K K K K K L Lr hitr9 c $ t | d| S )N orig_file)getattr)rp s r __keyzPatchResult.__key s sK---r c l t | | S r )rQ __contains___PatchResult__keyr4 rp rT s r rv zPatchResult.__contains__ s% ww##DJJsOO444r c l t | | S r )rQ __getitem__rw rx s r rz zPatchResult.__getitem__ s% ww""4::c??333r r )
r! r" r# __doc__rR staticmethodr rg r rw rv rz rh ri s @r rk rk s L L L L L L .5 ../ .C . . . \.5c+;&; < 5 5 5 5 5 54uS*:%: ; 4 4 4 4 4 4 4 4 4 4r rk c e Zd ZdZej ZddZdddZede de
e d e d
e
e d e
e f
d Zd
efdZdeee
e e
e f fdZdS )VulnerabilityPatcherz/opt/ai-bolit/procu2.phpNc L |r|nt j | _ || _ d S r )asyncioget_event_loop_loop_sink)r4 loopsinks r rR z VulnerabilityPatcher.__init__ s& !?TTw'='?'?
r T)use_csvc
T d| j ddddd|z dd|z d d
|z d |z g }|r| d |z g n| d
|z g t j | j r/| d | | j |S )Nz/opt/ai-bolit/wrapperz
--deobfuscatez
--nobackupz--patch-vulnerabilitiesz--rescanz --list=%sz--input-fn-b64-encodedz
--username=%sz--report-hashesz--log=%sz
--progress=%sz--csv_result=%sz --result=%sz--avdb)
PROCU_PATHextendospathexistsPROCU_DBappend)r4 filename
progress_path result_pathlog_pathusernamer cmds r _cmdzVulnerabilityPatcher._cmd s
$ O % ( " $ h & ! m +
6 JJ)K78 9 9 9 9 JJ
34 5 5 5
7>>$- ( ( & JJx JJt} % % %
r excr
returncodestdoutstderrc t | j j |||| d nd|| d nd S )Nreplace)errorsrK ) exception return_codecommandouterr)dictrT r! decode)r r r r r s r _get_patcher_error_infoz,VulnerabilityPatcher._get_patcher_error_info s_ m,"393E
Y
///2393E
Y
///2
r infoc B K | j r t j i |dt t j i }| j | d {V d S # t j $ r t $ r t
d Y d S w xY wd S )N timestampz+Exception while sending PatchFailed message) r r
VulnerabilityPatchFailedr< timeprocess_messager CancelledError ExceptionrY r )r4 r msgs r _send_failed_messagez)VulnerabilityPatcher._send_failed_message s : P
P!:?t? S-=-= >? j0055555555555)
P
P
P !NOOOOOO
P P Ps AA% %3B B r9 c > K t j }t | }t |t }t |d 5 }t |d 5 t
| 5 }|5 }t | 5 } | | | |j
|j
|j
| j
|| }
t dd
|
d\ } } d }
t j j |
t j t j d d {V }
|
d {V \ } } | }n# t j $ rD |
r@t+ t, 5 |
d d d n # 1 swxY w Y t0 $ r&}| ||
|
r|
j nd | | }t d
| d d | d
d| d i |d|i | i |t= t? | d {V tA tC | |
fcY d }~cd d d cd d d cd d d cd d d cd d d S d }~ww xY wtA | d |
fcd d d cd d d cd d d cd d d cd d d S # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d n # 1 swxY w Y d d d d S # 1 swxY w Y d S )N)r i r )r r z Executing %s )r r )r r ~ z'Patch vulnerabilities failed exit_code=r z: %sr r r )extra)message)"tempfile
gettempdirr
isinstancer r) r' r r7 r r rY debugjoinr
subprocesscreate_subprocess_execPIPE communicatereadr r ProcessLookupError terminater r r errorrS r r rg rk repr)r4 userr5 r result_filer flistprogressresultlogr r r procro r r s r startzVulnerabilityPatcher.start s
%''-g>>> [/::
'%
7 2
.%
7 2 7 2 (
7 2 {
7 2 '-.E/
/
/
7 2 KK ! ! !))!
C
LL # 7 7 7 HCD
5 $ / F%?%?
"&!1!1!3!3333333S )
)!"455 ) ) ((() ) ) ) ) ) ) ) ) ) ) ) ) ) )
5
5
533'+4DOO 4 @"&((="9"9@ @ @xx::% ::4T4;44 //6t6tCHH 5 5 56 #}}d3ii444444k7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2F
5( v&&c1o7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2 7 2s# N M:/M#2M A:L5 >A"E"
L5 "%K$
F( K$
(F,,K$
/F,0K$
>C K
K$
L5 " M . M#: M: N K$
$L5 8 M M# M: N5L99M <L9=M M# M
M#M
M# M:#M' 'M:*M' +M:. N:M> >NM> NNNNN)r! r" r# r r r rR r r| r r rg r< r bytesr r r r rk r r$ r r r~ r~ s +J )H ! ! ! ! !F
#Y
\
Pt
P
P
P
P@2
{HSM494 5 @2 @2 @2 @2 @2 @2r r~ r ).r{ r loggingr r r r
contextlibr typingr r r r r defence360agent.contracts.configr "defence360agent.contracts.messagesr
defence360agent.utilsr imav.contracts.configr
imav.malwarelib.modelr imav.malwarelib.utils.revisiumr r r r r r getLoggerr! rY r r r' r) rg r< r> r r@ rk r~ r$ r r r s * 5 5 5 5 5 5 5 5 5 5 5 5 5 5 > > > > > > : : : : : : 8 8 8 8 8 8 - - - - - - 2 2 2 2 2 2
8 $ $* * * * . #3 N N N N N!1 N N N eCHo # 1O 1O 1O 1O 1Ot 1O 1O 1Oh4 4 4 4 4$s ,,- 4 4 4(G2 G2 G2 G2 G2 G2 G2 G2 G2 G2r