$vރLe $ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
Z
ddl m Z ddl
mZ ddlmZ ddlmZmZ ddlZddlmZ dd lmZ dd
lmZmZm Z dd l m Z dd l m Z dd
l!m"Z"m#Z# ddl$m%Z& ddl'm(Z(m)Z)m*Z* ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z: ddl;mZ> ddl;m*Z? ddl@mAZA ddlBmCZC ddlDmEZEmFZFmGZG ddl;mHZH eeI ZJ G d dejK ZL G d d ee ZM G d d eM ZNdS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)Enum) getLogger)Path)AnyUnion)
inactivity) MessageType) MessageSink
MessageSourceexpect)run_in_executor) HostingPanel)Scope
nice_iterator)Malware)MalwareDatabaseCleanupMalwareDatabaseScan MalwareScan) ProcessOrder)open_aibolit_actions_logopen_mds_actions_log) HookEvent)CLEANUPCLEANUP_ON_SCHEDULENOTIFY MalwareEventMalwareEventPostponedMalwareHitStatusMalwareScanResourceTypeMalwareScanType)
MalwareHitMalwareHitAlternateVulnerabilityHit)r )MalwareScanMessageInfo)MalwareDatabaseHitInfo)HackerTrapHitsSaver
MalwareActionMalwareActionIm360)MalwareIgnorePathc ( e Zd Zdedef fd Z xZS )MalwareScanJSONEncoderoreturnc t |t r|j S t |t rt | S t j | rt j | S t | S N)
isinstancer valuesetlist dataclasses is_dataclassasdictsuperdefault)selfr- __class__s R/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/store.pyr9 z MalwareScanJSONEncoder.default] ss a 7N a 77N #A & & ) %a(( (wwq!!! )__name__
__module__ __qualname__r r9
__classcell__r; s @r< r, r, \ sK " " " " " " " " " " " "r= r, c Z e Zd Zej Zej Ze Z
d\ Z Z d Z
d ZdefdZ eej d d Z eej d Zed
Ze dd eeef d
ed z fd Zdedd fdZ e dedd fd Z ed Z defdZ d S )StoreMalwareHits)NNc & K || _ || _ d S r0 )_loop_sink)r: loopsinks r<
create_sourcez StoreMalwareHits.create_sourcem s
r= c
K d S r0 )r: rH s r< create_sinkz StoreMalwareHits.create_sinkq s r= summaryc K | d rdnd}d}d| d i}|D ]}||v r || ||< | d }t |t r |r|d nd}t j | d | d
|| d | d | d d | d ||| d
pi
}| j r"| j | d{V dS dS )zFEmit MalwareScanningFinished using summary dict, including perf stats.errorfailedok) scan_time scan_time_hsscan_time_preg
smart_time_hssmart_time_preg finder_timecas_timedeobfuscate_timemem_peak total_filespathr scanidtypestartedtotal_malicious scan_args)
scan_id scan_typer] ra r\ rb rP statusstats scan_paramsN)getr1 r4 r MalwareScanningFinishedrG process_message)r: rN rf
stats_keysrg key
event_pathfinished_events r< _call_scan_finished_hookz)StoreMalwareHits._call_scan_finished_hookt sq $[[ 1 1;t
M : :; * *Cg~~ $S\c
[[((
j$ ' ' =*4<A "J":KK)) kk&))KK ** M22 #KK(91 = =++g&& K006B
: =*,,^<< < < < < < < < < < = =r= F)
async_lockc K |d d sdS t j d 5 | | d{V ddd dS # 1 swxY w Y dS )a1 MalwareScan is saved to DB when:
1. Detached scan started - message has no results
2. Any scan finished - message has summary and results
Message without summary means that detached scan is finished
and summary will arrive along with results in another message.
rN r] N
store_scan)ri r tracktask _store_scan)r: messages r< process_hitsz StoreMalwareHits.process_hits s y!%%f-- F
"
"<
0
0 , ,""7++ + + + + + + + , , , , , , , , , , , , , , , , , ,s A((A,/A,c r K | d d S | di }| d }|s t d| d S t | 5 }t j t
| |ddt d d d d S # 1 swxY w Y d S )NresultsrN r_ z1MalwareScan message received without a scanid: %s Findent sort_keyscls)ri loggerrP r jsondumpdictr, )r: rw rN rd logfs r< store_logzStoreMalwareHits.store_log s ;;y ! ! ) F++i,,++h'' LLCW
F
%g
.
. $ IW
*
s 3,B,,B03B0c t j | ||d |d |d |d ||d d d |d d d ||d d d
S ) Nownerusersizehashhitsr matches timestamp
suspicious) r_
resource_typer r r r orig_filer` r rf malicious)r" create)r_ filenamerf r datas r<
_store_hitzStoreMalwareHits._store_hit sw 'w-f f f f a +6l1ok2 v,q/,77
r= Npath_objre c # K t j g}t | t r| gn| }|t j k rt
| E d{V dS |D ]}t j | D ]v}t j
| }t j
| rt j t j |k t j | z t j t( j j k z r|V t1 j | dz }d t j t j | t j | z t j t( j j k z D E d{V xdS )z
Return files that may already not be infected, yet we still
consider them such.
For example, an infected file might have been removed manually.
Nz(/.*|\b)c 3 $ K | ] }|j V d S r0 r ).0is r< z8StoreMalwareHits.get_outdated_entries.. s8 r= )r FOUNDr1 strr! REALTIMEiterglobiglobosr] realpathisfiler" selectwherer rf in_r r FILEr2 firstreescaperegexp)r re possibly_infected_statusespaths target_pathr] scanned_dirs r< get_outdated_entriesz%StoreMalwareHits.get_outdated_entries s '7&<%=" (3 7 7E
X 0 0 0E{{ " " " " " " " F ! ! K
;//
w''--GNN4(( ")++U#-5%,001KLLN ' 4 6 ; A B UWW JJJJ"$)D//K"?K !+!2!4!4!:!: ' 1 8 8 E E * 1 5 5$>!" !" !+ 8#:#?#E!F " " %
! ! r= rw r. c K |d }|d sdS t | }|j rt j t j |d d k sGt j di |t j j
|j d}d|_ |
dS t d|d d dS | | d{V dS ) zLProcess scan message results.
message: MalwareScan message
rN ra Nr_ )r initiatorr zScan %s already in databaserL )r%
is_summaryMalwareScanModelr r r_ existsr r r r2 r rb saver warning_store_scan_from_results)r: rw rN message_typescans r< rv z StoreMalwareHits._store_scan s-
)$y! F-g66 " 9 '))'.')2DX2NNOO
(. "9">"D % /
()$ 1793Eh3O //88 8 8 8 8 8 8 8 8 8r= c
| dd }| dd }| d =|=|=| |d |d }t j | d S d S d S d S )N
file_patternsexclude_patternsrP r] r` )re )popri r r" delete_hits)r rN r r outdated_entriess r< _delete_outdated_entriesz)StoreMalwareHits._delete_outdated_entries! s OT::
";;'94@@ KK ( % ( " 7 776? 8
"#3 4 4 4 4 4
) (%%((r= c
K d S r0 rL )hit_datadefault_action_resultss r< _process_default_action_resultsz0StoreMalwareHits._process_default_action_results/ s
r= c * K |d }|d }t j |i |dt j j i \ }|s
|d _ |d *| d | | d |d D }d t j
t |
D }t t }d }d t fd
} t t | 2 3 d {V }
|
|v r\ | ||
||
d d d r2| |
d |d |
d h6 t t | 2 3 d {V }
t# j |
d {V r2| |
d |d |
d U# t& $ r&} t( d|
| Y d } ~ d } ~ ww xY w6 fd| D } | j | | d |d | j d {V }
i }|
D ]\ }}}}|||f||j < | D ]J\ }
}|d d d rt4 j }d }|
|v r||
\ }}}t9 |t: r4|j t> k r$|d t@ j! k rtD ntF }||d< ||d< |dz
}t9 |tH r|j% rtM | j' tQ j) | j* j+ |
|t j j | d {V }t9 |t: r<|j, |j- |j. |j/ |j ff}|| 0 | L| _1 |d _2 tg ti j4 _5 | d x}r| _6 7 j1 |d< | 8 | d {V n*# t& $ r t( d Y nw xY w| j r| D ]w\ \ }\ }} } }}|t> k r1|d t@ j! k rt( 9 d I| j : ||||| | d {V x| ; |d |
D d {V d S )!NrN r_ r )r_ defaults completedrz r] c f i | ].\ }}t j |d d d +||/S )r r r )r$ match)r filer s r<
z=StoreMalwareHits._store_scan_from_results..J sL
d#)$v,q/)*DEE
$
r= c i | ]
}|j | S rL r r hits r< r z=StoreMalwareHits._store_scan_from_results..O s,
M3
r= )filesr r c | j t j k p)| j t j t j fv o
| j |k S r0 )rf r CLEANUP_STARTED CLEANUP_DONECLEANUP_REMOVED
cleaned_at)r detected_timestamps r< _hit_status_race_detectedzLStoreMalwareHits._store_scan_from_results.._hit_status_race_detectedV sG
. >> 8:$1$4 8
N%77
r= r r z0Ignore check failed for file %s: %s; keeping hitc t g | ]4\ }}|d d d t j j || 5S )r r r )r# r r_ )r r r r s r<
z=StoreMalwareHits._store_scan_from_results..y sQ
d<?<0
&t{D$ ? ?
r= r r` )r r causerI r default_action try_restore r\ rP rb rN @Failed to emit MalwareScanningFinished after store (DB, no hits)zCSkipping auto-cleanup because it's allowed for scheduled scans onlyr rd r r post_actionc ( i | ]\ }}}}|j |S rL r )r r event_s r< r z=StoreMalwareHits._store_scan_from_results.. s% I I I&6c5!QS]E I I Ir= )> 3 3 3 3 3 3 3$t|| 9 9T
GDM& 1! 4[ A! !| D$''' "&&tT222
? (gllnn(=(=>> $
*:4@@@@@@@@ 7KKd+++I&**4666
F
?
%mmoo
$ 2 G G kk+..&/ H
4B J J 0HeV[.3V[-IJx) * *!--// 7 0 7 0JD$F|A|,
%+FFz!!
t$ "
v'<==
)<<<
#6?o.HHH # #
*8%&&1]# 1$ fl33 ! 0 ! '
!OK+06
C &"788
0N ( *
s#**3/// . &} 5 TY[[))KK(( (5 DJ )-)=G% &///@@ @ @ @ @ @ @ @ @
: %%''
BA5)[& 111 ?+EEEKK/
*44 !%$+"'&/(3 22 I I. I I I
s7 "F
9IA H
H> H99H> &R0 0$SSr0 )!r> r? r@ r
STORE_SCANPROCESSING_ORDERr AVSCOPEr( r rF rG rJ rM r rp r
r
r rx r staticmethodr r r r4 r rv classmethodr r r rL r= r< rD rD g s #. HE"N LE5
%= %= %= %= %=N VK #666
,
, 76
, VK #$$ %$*
\
!%1 1T "1:1 1 1 \1f 9 9 9 9 9 9> 5t 5 5 5 5 [ 5
\
z
k z
z
z
z
z
z
r= rD c e Zd Zej ZeZ fdZe d Z
e e j
de
ddfd Ze d Z e e j defd Z xZS ) StoreMalwareHitsIm360c K t | d {V t j d {V d S r0 )r8 rM r' init)r: rH r; s r< rM z!StoreMalwareHitsIm360.create_sink sX gg!!$'''''''''!&(((((((((((r= c R K g }g }t j du }t j | D ]\ }}| | }t
|t s0|j r| | t fd|d D sn|r"t fd|d D r| | t j d |D d{V t j
d |D g d{V dS )z,Do additional processing for malicious filesFc 3 : K | ]} |d V dS r NrL r his_sas r< r zHStoreMalwareHitsIm360._process_default_action_results.. s1 AAquuQy\**AAAAAAr= r c 3 n K | ]/} |d t j |d V 0dS r )r' is_admin_tool_typer s r< r zHStoreMalwareHitsIm360._process_default_action_results.. sZ ( (59 &&(#6q|DD( ( ( ( ( (r= c P g | ]#}t t j | $S rL r r fsdecoder ps r< r zIStoreMalwareHitsIm360._process_default_action_results.. s( < < . s( ? ? ?aT"+a..
!
! ? ? ?r= )
MalwareConfigDETECT_ADMIN_TOOLSr' is_standalone_matchr ri r1 r r r anyalladd_hitsupdate_sa_hits) r r hacker_trap_hitshacker_trap_sa_hitsskip_admin_toolsr] r r r s @r< r z5StoreMalwareHitsIm360._process_default_action_results s );uD#7"..** - -JD$+//55F fl33
(
. ''---AAAADLAAAAA
C ( ( ( ( f ( ( ( % %
& &t , , , ,!* < <+; < < <
"0 ? ?+> ? ? ?
r= rw r. Nc V
K |j r|j d S t j |j |j |j |j |j |j |j |j t j j |j
}nW# t j $ rD t j |j }|j rV|j sO|j r|j rA|j r:|j |j k s*|j |j k s|j t j j k r5t$ d|j |j |j |j Y d S |j |_ |j |_ |j |_ |j |_ |j |_ t j j |_ |j
|_
| t$ d|j d Y nw xY w| d }|rRt- | 5 }t/ j t3 | |ddt4 d d d n # 1 swxY w Y |j s<|j s|j d
}t; j t j d |d z f t: j! |k z t: j t j j k z t: j" tF j$ k z % |j |j |j |j |j |j |j pd
|j i d }| & | d {V n*# tN $ r t$ ( d Y nw xY wd S tS tU + d {V fdtY j- D }| . |j | j/ 0 |j | d | d | j1 t j j d {V }i } |D ]\ }
} } }
| | f| |
j < te tf }ti j5 |j }|D ]@}d }|j | v r-| |j \ }}tm |tn r|j8 r;t; j d(i d|d| |j9 |j9 d| |j: |j: d|j d|j; dddd d d d d d tF j$ d d d t j j d!|j< d"|j= d#|j> d$|j? d%|j@ }tm |t r6|jB |jC |j
|jD ff}|| E | B| j1 r |j |j |j |j |j |j |j pd
|j i d }| & | d {V n*# tN $ r t$ ( d& Y nw xY w|F D ]A\ \ }\ }}}}| j1 G |||j |||' d {V @d S d S ))N)
r_ ra r r` r] rP r rb r r )r_ zBThe scan %s has already been saved: type=%s, path=%s, completed=%sz
Updated scan z with new data from messagerd r{ Fr| /z CAST(orig_file AS TEXT) LIKE ?z/%r ) r_ r` r] ra r r\ rb rP rc r r c < i | ]}|j v |j |j S rL )pw_namepw_uid)r pw panel_userss r< r z7StoreMalwareHitsIm360.store_db_scan.. s6
z[((
Irz(((r= r r` )r r r rI r r_ r r r r Tr r timestamerf r r app_namedb_hostdb_portdb_namesnippetz=Failed to emit MalwareScanningFinished after store (DB, hits)r rL )Hra r` r r rd r r] rP r rb r DBr2 r peeweeIntegrityErrorri r r r_ r r r r r r r, r rstripr" deleter SQLr rf r r executerp r r r3 r get_userspwdgetpwall_delete_outdated_db_entriesr r rG r r4 r& get_hits_per_dbr1 r r r r signaturer. r/ r0 r1 r2 r rw r r r r rk )r: rw r rd r scan_pathrN uid_to_namer r r r r r r unique_hits_infor r r new_hitrm r r r r r r, s @r<
store_db_scanz#StoreMalwareHitsIm360.store_db_scan sd ',"6 F- #* !+ \ \ m ' 7 ' 7 5 8 >!+ DD $ #'w???D%
=
N
,0:
~
<49,,<49,,%)@)C)III $K&IN
#?DL $ .DN DJ#*#:D #*#:D !8!;!AD $ .DN IIKKK KKH HHH
= D ++i(( %g..
$ MM #.
| # =
#L / / 4 4 !##))
< & - / &/9< > #025;<
"(,<,BB D
')))
%o #L #L &!(!2#*#:'.'>'C! $]!#
33G3DDDDDDDDDD
F 8 8 : :::::::;;
lnn
(( 666 $ 2 G G kk+..++f%%14: H
%3 3 3 !C$)6?Jsx $T**1A',OO( & 4 & 4HF}
** x}-"
fl33 ! 0 ! ","3 # # #t#!oohnhnEEE# !__X]HMBBB# #-- #
'' # $
# T# T# $# (--# 4# 6 8 > ># "**# !(( # !(( # !((!#" !((##G& &"788
4N\6#3V5GH s#**7333 : !
%o #L #L &!(!2#*#:'.'>'C! $]!#
33G3DDDDDDDDDD
%%''
:95)[j00G ! ' #"+$/ 3! ! *
sR AA1 1B9G-BGG.,H&&H*-H*6AM $M0/M0AX) )$YYc F d | D }t j | d S )Nc g | ] }|j
S rL )r] r s r< r zEStoreMalwareHitsIm360._delete_outdated_db_entries.. s ///3ch///r= )r" r )r
orig_filess r< r= z1StoreMalwareHitsIm360._delete_outdated_db_entries s, //$///
z*****r= c K | d }|s t d| d S t | 5 }t j t
| |ddt d d d d S # 1 swxY w Y d S )Nrd z=MalwareDatabaseCleanup message received without a scan_id: %sr{ Fr| )ri r rP r r r r r, )r: rw rd r s r< store_db_cleanup_logz*StoreMalwareHitsIm360.store_db_cleanup_log s ++i(( LL
F
!'
*
* d IW
*
s ,A??BB)r> r? r@ r IM360r r) r rM r r r
r
r rD r= r rI rA rB s @r< r r s KE'N) ) ) ) ) #
#
\#
J VK +,,G+> G4 G G G -,GR + + \+ VK .//2H 0/ r= r )O__doc__r r r r r; r r collectionsr r5 enumr loggingr pathlibr typingr r r4 defence360agent.apir "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r r
$defence360agent.model.simplificationr +defence360agent.subsys.panels.hosting_panelr defence360agent.utilsr r imav.contracts.configr r imav.contracts.messagesr r r imav.contracts.pluginsr imav.internals.loggerr r %defence360agent.contracts.hook_eventsr imav.malwarelib.configr r r r r r r r! imav.malwarelib.modelr" r# r$ r %imav.malwarelib.plugins.detached_scanr% imav.malwarelib.scan.mds.reportr& imav.malwarelib.subsys.malwarer' r( r) r* r> r JSONEncoderr, rD r rL r= r< rb s *
# # # # # #
* * * * * * : : : : : :
A @ @ @ @ @ D D D D D D 6 6 6 6 6 6 6 6 : : : : : :
0 / / / / / < ; ; ; ; ;
C B B B B B
4 3 3 3 3 3 8 " " " " "T - " " "H
H
H
H
H
{M H
H
H
V O O O O O , O O O O Or=