n(m. t U d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZ ddlmZmZmZmZmZmZmZmZmZmZmZ ddl m Z dd l m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z% dd
l&m'Z'm(Z(m)Z) dd l*m+Z+ dd l,m-Z- dd
l.m/Z/ ddl0m1Z1 ddl2m3Z3m4Z4 ddl5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@ ddlAmBZBmCZC ddlDmEZF ddlGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZambZb ddlcmdZdmeZemfZfmgZgmhZh ddlimjZj ddlkmlZl ddlmmnZnmoZo ddlpmqZq erddlrmsZs e
et Zud Zveewexejy f Zy ed Zz ed efej Z{d e|fd Z}d Z~d Zd! Zd"ewd eewewdz f fd#Z G d$ d% Zd& Zd'Zeewd(f ed)< G d* d+ Z G d, d-e ZdS ).u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict) ConfigParser) getLogger)Path)
TYPE_CHECKINGCallable
CollectionDictIterableListOptionalTupleTypeVarUnioncast)IntegrityError)Core
HackerTrapMyImunifyConfigUserType"choose_use_backups_start_from_datechoose_value_from_config should_try_autorestore_malicious) MS_CONFIG_DEFAULT_ACTION_EDIThas_permission myimunify_protection_enabled)g)run_in_executor)
web_server)
hosting_panel)ModsecVendorsErrorPanelException) COPY_TO_MODSEC_MAXTRIES
CheckRunErrorLazyLockatomic_rewritebase64_decode_filenamebase64_encode_filename check_run is_cloudways log_failed_to_copy_to_modsecretry_on
safe_sequence)MalwareCleanupRevertMalwareCleanupTask)Malware)ADDED_TO_IGNORECLEANUP CLEANUP_DONECLEANUP_ON_SCHEDULECLEANUP_REMOVEDDELETED_FROM_IGNOREFAILED_TO_CLEANUP FAILED_TO_DELETE_FROM_IGNOREFAILED_TO_IGNORE FAILED_TO_RESTORE_FROM_BACKUPFAILED_TO_RESTORE_ORIGINALFAILED_TO_STORE_ORIGINALFAILED_TO_SUBMITFOUND NOT_EXISTNOTIFYPENDING REQUIRES_MYIMUNIFY_PROTECTIONRESTORED_FROM_BACKUPRESTORED_ORIGINALSUBMITTED_FOR_ANALYSISUNABLE_TO_CLEANUP MalwareEventMalwareEventPostponedMalwareHitStatusMalwareScanResourceTypeMalwareScanType)MalwareHistory
MalwareHitMalwareHitAlternateMalwareIgnorePath MalwareScan)MalwareDatabaseHitInfo)
restore_files) hash_pathsubmit)
detected_hook)
RestoreReportc K t d rddg} ng d} t | d {V d S # t $ r t d Y d S w xY w)Nz/usr/bin/imunify360-wsctlzimunify360-wsctlreload) systemctlrX zimunify360-wafdz"Failed to reload 'imunify360-wafd')r is_filer) r$ loggerwarning)argss S/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/subsys/malware.py reload_wafdr_ s '((0022 :"H-999=oo = = =;<<<<<<=s A $A-,A-T HitInfoTypereturnc t } | d | ddd dk }|o
t S # t $ r Y nw xY wdS )Nz*/etc/sysconfig/imunify360/integration.confr server_type )fallbacknginxF)r readgetr* Exception)cfgis_nginxs r^ _is_force_use_corazarm ss
nn =>>>77< 7DDO*LNN*
5s AA
A A c t j d fd }t j d fd }t j r|n|S )z8Decorator responsible for logging malware events into DBNc
K | fp t j
d | d {V t t j
fd d {V S )N) path
file_owner file_user signature_id initiatorapp_name
resource_typedb_hostdb_portdb_namescan_idc t j di d
j dd d ddddd d
d d d
dd d S )Neventrp ru rv rq rr rt causerw rx ry
table_name table_field
table_row_infrz rs )rL
save_eventtitle)ru r} rw ry rx rq rr rt rp rv resultrz rs r r~ r s r^ z?update_malware_history..async_wrapper.. s N- llT " ,m
&: $)
$) e &: (K ,m *\! )r ROOTr asyncioget_event_loopclsrp rq rr rs rt r} rv ru rw rx ry r~ r r rz kwargsr coros ``````````````` @r^
async_wrapperz-update_malware_history..async_wrapper s+ ( t
! % 08= '
" $ $
*
r c | f||||p t j ||| |
| ||d |}t j di d|j d|d|d|d|d|d|d |d
| d |
d | d
| d|
d|d|d| |S )N) rp rq rr rt ru rv rw rx ry rz rs r| rp ru rv rq rr rt r} rw rx ry r~ r r rz rs r )r r rL r r r s r^ wrapperz'update_malware_history..wrapper s6 (
! 08= '%
!
,,
X
(-
"z
i
i
%
G
G
G
"z
$
(-
G
& !
$
r ) NNNNNNNNNNN) functoolswrapsr iscoroutinefunction)r r r s ` r^ update_malware_historyr s _T !8 8 8 8 8 8t _T !5 5 5 5 5 5n $ 7 = = J==7Jr c < ddt t f fd
}|S )
Decorator responsible for logging multiple malware events into DB at once.
Decorated function accepts an iterable of `MalwareHit`s.
Nhitsc K t j fd|D d {V }|s|S t j fdt || D |S )Nc 3 T K | ]"} |j |j |j V #dS ))rp rq rr N) orig_fileowneruser).0hitr r s r^ zCmultiple_update_malware_history..wrapper..- s\
"y !h r c g | ]^\ }}|j |j |j |j |j |j p t j p t j |j
|j |j |j
d _S )) r| rp rv ru rq rr r} rt rw rx ry rz )r r rv ru r r rK MANUALr r rw rx ry scanidr r r r} rt s r^
zDmultiple_update_malware_history..wrapper..: s~
C $\ M%(%6 # "%)!$ " .wrapper) s
N"
$'tW#5#5
& r NNr rM r r s ` r^ multiple_update_malware_historyr # sB @D# #J'# # # # # #J Nr c < ddt t f fd
}|S )r Nr c K | |fi | d {V }|s|S t j fd| D |S )Nc g | ]:\ }}|j |j |j |j p t j p t j d ;S ))r| rp rq rr r} rt )r r r r rK r r r r s r^ r z@bulk_update_malware_history..wrapper..^ s_
C $\ M"%)!$ " .wrapperW s !Dd 5 5f 5 5555555 "
$/#4#4#6#6
r r r r s ` r^ bulk_update_malware_historyr Q sA @D J' * Nr usernamec K t j rt | s t | fS t t
| d {V rt
dd| S t
dd S )NMALWARE_SCANNINGdefault_action)r ENABLEDr r@ r r r r s r^ choose_action_for_maliciousr o s $+H55 $8# #
98
D
DDDDDDD
' 0(
$$68H I IIr c e Zd ZdZ ee Zed Zed Z ee
d de fd Z ee
de fd Z
ee
de fd Zee
d Zee
d
Zee
d Zee
dd d
eded fd Zeed Zeed Zeed Zeed Zeed Zeed Ze d de e de e e e ee f fd Z ed Z!ed Z"ed Z#ee$de%e&e f fd Z'e d de e e&e f fd Z(dS )
MalwareActionz
Responsible for manipulations with malware files.
As long as each handler function is wrapped in `update_malware_history`,
arguments should be passed in kwargs form.
c K | j | D ]w} ||t | d{V ## t j $ r t $ r9}t
d ||| Y d}~pd}~ww xY wdS )z$Execute callback for specific actionNzEError '{!r}' happened when run callback {} forMalwareAction {} method) _CALLBACKrG r CancelledErrorrj r[ exceptionformat)r method_namerp r callbackes r^ run_callbacks_forz MalwareAction.run_callbacks_for s
k2 H
ht\%%8%89999999999)
..4fQ+.N.N
s 3B /B Bc F | j | | d S N)r add)r r r s r^ add_callbackzMalwareAction.add_callback s#
k"&&t,,,,,r Nrb c K t j ||| d {V }t j t t j t
t j t i}| |t }t | S r )
rT submit_malwareSUBMIT_SUCCESSrE SUBMIT_PENDINGrA
SUBMIT_FAILEDr= ri rG )r rp typereason_r
status_map event_titles r^ submit_for_analysisz!MalwareAction.submit_for_analysis ss
,T4@@@@@@@@ !#9 !7 "2
!nnV-=>> K(((r c K t t j fd d {V t }n# t $ r
t
}Y nw xY wt
| S )Nc 0 t j S )Nrp rv )rO creater s r^ r z&MalwareAction.ignore.. s )0 ] r )r r r r1 r r9 rG )r rp rv r r s `` r^ ignorezMalwareAction.ignore s
$!&((
$EE % % %$EEE % E"""s +9 A
A
c t j t j |k }t |rt nt S r )rO deletewhererp executerG r6 r8 )r rp r deleteds r^ delete_from_ignore_syncz%MalwareAction.delete_from_ignore_sync sW
$ & &
U$)T1
2
2
WYY
#* L 0L
r c . K t t S r )rG r> r r __s r^ notifyzMalwareAction.notify s E"""r c . K t t S r )rG r; r s r^ cleanup_failed_restorez$MalwareAction.cleanup_failed_restore s 6777r c . K t t S r )rG r< r s r^ cleanup_failed_storez"MalwareAction.cleanup_failed_store s 4555r )reportrt r rV c K |rWt j d x}rA||_ | t | d {V t
t S )Nsink)r ri rt process_messager. to_dictrG rD )r rt r r r r s r^ cleanup_restored_originalz'MalwareAction.cleanup_restored_original sv
OquV}},t O (F &&';FNN.h D
, <== >
r r$ r[ r\ r- rp r
setdefaultr r r update_restore_from_backup r r r r! r" f user_hitsr resr _hitss r^ restore_from_backupz!MalwareAction.restore_from_backupO ^
#&"<".r ++++++r filesuntilr r c & g | ]
}|j v |S r r: r r restoreds r^ r z6MalwareAction._restore_from_backup..~ % DDDqAK8,C,C,C,C,Cr c & g | ]
}|j v |S r r: r r faileds r^ r z6MalwareAction._restore_from_backup.. % @@@Q!+*?*?q*?*?*?r File %s was restored from backupc 2 g | ]}|t fS r rG r rhr s r^ r z6MalwareAction._restore_from_backup.. & FFF"R e,,-FFFr #File %s wasn't restored from backupc 2 g | ]}|t fS r rJ r fhr s r^ r z6MalwareAction._restore_from_backup.. & DDD"R e,,-DDDr r rR r r- rp r[ inforC extendr\ r: r r rq r r pathsr r4
restored_hits failed_hitsp safe_pathrF rB r s @@@r^ r0 z"MalwareAction._restore_from_backupn ,+d+++"":..!.4Z@@ "
"
"
& DDDDDDDD
@@@@$@@@ G GA%*1--I KK:I F F F F$
FFFF
FFFGGG M MA%*1--I NN@) L L L L-
DDDD DDDEEE
r r )NNN))__name__
__module__ __qualname____doc__r setr classmethodr r r rG r r r r r r r r
r r r r r r r r r rN r boolr r r r$ r r
rM r6 r0 r r r^ r r | s C I [ - - [- $
)
)
)
)
) [
) #| # # # [ #
<
[
# # [# 8 8 [8 6 6 [6 EI/ / / /)1/)B/ / / [/ $/ / %$ [/ $* * %$ [* $- - %$ [- $/ / %$ [/ $; ; %$ [; $' ' %$ ['
&'
e' sD@A B [8 2 2 [2 [ ' ' [ '>
j,& ' ! [: $(
eJ ,- . [ r r c < t | | d S r )r r )r r s r^ subscribe_to_malware_actionre s vt,,,,,r )z admin.tool..ADMIN_TOOL_TYPE_PATTERNSc e Zd Zej Zej Zej ZdZ dZ
dZ e Z
ededefd Zededefd Zed$defd
Zedefd Zed$d ee fd
Zed ee dee dee fd Zed ee dee fd Z ed Z ed ee fd Z ed%dee fd Z edee fd Z!edee fd Z"edefd Z#ed Z$e e%e&e'e(d d Z)ed Z*ed Z+ed Z,ed Z-edee d ee defd! Z.edee d ee fd" Z/ed# Z0d S )&HackerTrapHitsSaveri iQ z-SA- signaturerb c | j |v S )zwTrue iff *signature* carries the standalone (-SA-) mark
that lands a path into ``malware_standalone_b64.list``.)STANDALONE_MARK)r ri s r^ is_standalone_matchz'HackerTrapHitsSaver.is_standalone_match s "i//r hit_typec t | sdS | t fdt D S )aQ True iff *hit_type* is an AI-Bolit admin-tool signature.
Used at the projection-time filter in :meth:`reset_sa_hits`
(against ``MalwareHit.type``) and at the write-time filter
in ``StoreMalwareHitsIm360._process_default_action_results``
(against in-flight ``hit["matches"]`` from a scan result).
Fc 3 K | ]}|v V d S r r )r rZ lowereds r^ r z9HackerTrapHitsSaver.is_admin_tool_type.. s' BBA1<BBBBBBr )loweranyrf )rm rp s @r^ is_admin_tool_typez&HackerTrapHitsSaver.is_admin_tool_type sE 5..""BBBB)ABBBBBBr Nc > |p| j }t | j | S r )NAMEr BASE_DIR)r filenamenames r^ _filepathz HackerTrapHitsSaver._filepath s #38CL$'''r c < t | j | j dz S )Nz.clean)r rv ru r s r^ _clean_filepathz#HackerTrapHitsSaver._clean_filepath s CL#(X"5666r file_listc t | | d d |D ddd d S # t $ r&}t d| Y d }~d S d }~ww xY w)N
c 3 4 K | ]}t | V d S r )r( )r rx s r^ r z-HackerTrapHitsSaver._write.. s+ NND1$77NNNNNNr FT )backupallow_empty_content permissionsz#Unable to write HackerTrap file: %r)r& ry joinOSErrorr[ error)r r} rw oes r^ _writezHackerTrapHitsSaver._write s D
h''
NNINNNNN $( !
D D D LL> C C C C C C C C C Ds AA
A8A33A8 files_to_addc t | }| }|D ]0}||v r| | | | 1|| j d S )a>
adds files_to_add to file_list
the method has side_effect (file_list will be modified)
yet, given that it is private class method -- we can do it
:param file_list: existing files
:param files_to_add: files to add
:return: joined list, limited to MAX_HITS_COUNT
N)ra copyremover MAX_HITS_COUNT)r r} r file_set
_file_listfiles r^ _extendzHackerTrapHitsSaver._extend s| y>> ^^%%
$ $D x !!$''' d # # # #3--//00r c d | D S )a
This method checks if any of the files on the list is present
and removes that entry from the list
:param file_list: list of files
:return: new list of files, in the same order, with files that exist
skipped
c P g | ]#}t j | !|$S r )r rp exists)r r s r^ r z3HackerTrapHitsSaver._clean_list.. s+ GGG"'..2F2FGGGGr r )r} s r^ _clean_listz HackerTrapHitsSaver._clean_list s HGGGGGr c ||z
| j k S r )SECONDS_BEFORE_CLEAN)r
file_mtime current_times r^
_should_cleanz!HackerTrapHitsSaver._should_clean s j(3+CCCr c R | }| ri| | j t j r*| d | | }n| d |S )z
We will use extra file to track last time we cleaned
For that we will use mtime of that file
:param file_list: list to clean
:return: cleaned list
r )r| r r statst_mtimetime write_bytesr )r r} rZ s r^ _clean_filez HackerTrapHitsSaver._clean_file s
! ! 88:: !2DIKK@@
7
c""" OOI 6 6
MM# r Tc | | }g }|D ]]} | t | &# t
j $ r&}t d|| Y d }~Vd }~ww xY w|r| | n|S # t $ r g cY S w xY w)Nz*Can't decode filepath [%r] with error [%r]) ry
read_bytessplitr r' binasciiErrorr[ r r r )r rw skip_existsr} decoded_file_listr r s r^ _readzHackerTrapHitsSaver._read s
h''2244::<<
-/ !
%,,-CD-I-IJJJJ ~ LLDdA ' 1222&
! III s; ?B6 "A%$B6 %B4 BB6 BB6 6 CCc r K | j |g|R i | d{V | g | d{V dS )z"Same behavior as for separate hit.N)r files_to_remove) _add_hitsupdate_sa_hits)r r r] r s r^ add_hitsz HackerTrapHitsSaver.add_hits sm cmL:4:::6::::::::: b, OOOOOOOOOOOr c 0 K | }| || }| | | | j d {V d S # t
$ r&}t d| Y d }~d S d }~ww xY w)Nz!Unable to read HackerTrap file %r)r r r _copy_to_modsec_rulesru r r[ r )r r r] r r} r r s r^ r z HackerTrapHitsSaver._add_hits$ s B$'IIKKI!$Y !E!EF JJv ++CH55 5 5 5 5 5 5 5 5 5 B B B LL K | |g d{V S )zWhen storing separate hit it needs to be added to
malware_found_b64.list
and excluded from malware_sa_found_b64.list as well from
proactive/dangerous/[hash]Nr )r r r] r s r^ add_hitzHackerTrapHitsSaver.add_hit. s. \\;-000000000r c @ K | g d {V d S r r r{ s r^ initzHackerTrapHitsSaver.init6 s0 ll2 r ) max_trieson_errorsilentc . K t j } | d {V }nF# t t f$ r2}t
t | Y d }~dS d }~ww xY w | || d {V }n3# t $ r&}t
d| Y d }~dS d }~ww xY wt t j | }|
|j dz }| rz| j | j k rF| | k r t
d dS t) j t | t | | | dS # t. $ r}|d }~wt0 $ r&}t
d| Y d }~dS d }~ww xY w)NFz%Can't get malware found list file: %sz.tmpzNothing to updateTz%Failed to copy malware found list: %s)r r get_i360_vendor_namer! r" r[ r\ r build_vendor_file_pathr r r DIR with_suffixsuffixr r st_sizer rT shutilr renamer r r )r malware_list_namer vendorr target
found_list
target_tmps r^ r z)HackerTrapHitsSaver._copy_to_modsec_rules: s1
'
)
) 2244444444FF"N3 NN3q66 " " "55555 44V=NOOOOOOOOFF! Da H H H55555 *.*;<<
''
(>??
MMOO
% ):):)BBB!!##z'<'<'>'>>> KK+ , , ,5 KJZ 9 9 9 f % % %4 G LL@! D D D55555 sR 2 A5'A00A59 B
C CCAG
H G!!
H.HHc t j | j 5 }d |D cd d d S # 1 swxY w Y d S )Nc D g | ] }| |j S r )rZ rx )r entrys r^ r z>HackerTrapHitsSaver._get_exists_hash_files..g s' BBB5%--//BEJBBBr )r scandir BASE_PD_DIR)r its r^ _get_exists_hash_filesz*HackerTrapHitsSaver._get_exists_hash_filesd s
Z
(
( CBBBBBBB C C C C C C C C C C C C C C C C C Cs 377c ~ |D ]9}t | j t | z d :d S )Nr )r r touchr r> fnames r^ _create_hash_filesz&HackerTrapHitsSaver._create_hash_filesi sG ? ?E
#/
"
"T%[[
0 7 7 > > > > ? ?r c | |D ]8}t | j t | z 9d S r )r r unlinkr s r^ _remove_hash_filesz&HackerTrapHitsSaver._remove_hash_filesn sE ; ;E
#/
"
"T%[[
0 8 8 : : : : ; ;r c | t j d }d |D }| }t | t | z
}t | t | z
}| | | | dS # t $ r9}t d||j
r d|j
dnd Y d}~dS d}~ww xY w) z
SA hits stored for PD as sha256 hash of full path in
HackerTrap.DIR_PD. Not more than MAX_HITS_COUNT files in dir.
Remove older (by mtime) files first.
Frw r c 0 g | ]}|t | S r )rS )r rp s r^ r z=HackerTrapHitsSaver._update_sa_hash_files..~ s3 $( $ r zHackerTrap error: %r%sz ()re N) r r SA_NAMEr ra r r r r[ r\ rw )r saved_files_listhash_file_listexists_hash_file_listfiles_to_createfiles_to_deleter s r^ _update_sa_hash_filesz)HackerTrapHitsSaver._update_sa_hash_filess s4 "yy#+ ) ,< N %($>$>$@$@ ! !. 1 1C8M4N4N NO !"7 8 83~;N;N NO " "? 3 3 3 " "? 3 3 3 3 3 NN(()
:$QZ$$$$
s B)B- -
C07.C++C0r c L | t j d }| || }fd|D }||k r#| |t j dS n2# t
$ r%}t d| Y d}~nd}~ww xY wdS )z
Update file of malware standalone list.
Return True if malware standalone list was changed otherwise False.
Fr c g | ]}|v| S r r )r rp r s r^ r z;HackerTrapHitsSaver._update_sa_hit_list.. s* $o2M2M2M2M2Mr rw TzHackerTrap error: %sN)r r r r r r r[ r )r r r
saved_list
extended_list updated_listr s ` r^ _update_sa_hit_listz'HackerTrapHitsSaver._update_sa_hit_list s 4%(YY#+ &/ & &J ), J (M(MM !. L z))
<*2D
EEEt * 4 4 4 LL/ 3 3 3 3 3 3 3 3 4us A,A2 2
B!<B B!c 4 K |s|sd S d |D }d |D }| j 4 d {V | || r| t j d {V rvt j d {V t s!t j j
j dk r.t
d t d {V | d d d d {V d S # 1 d {V swxY w Y d S )Nc P g | ]#}t t j | $S r r r fsdecoder r2 s r^ r z6HackerTrapHitsSaver.update_sa_hits.. s( CCCR[^^,,CCCr c P g | ]#}t t j | $S r r r s r^ r z6HackerTrapHitsSaver.update_sa_hits.. s( IIIA4 A//IIIr cPanelCoraza:Reloading 'imunify360-wafd' as coraza ruleset is in action)LOCKr r r r r graceful_restartrm r r __class__r] r[ rT r_ r )r r r s r^ r z"HackerTrapHitsSaver.update_sa_hits s F DClCCC II III8 , , , , , , , ,&&|_EE
, 22:3EFFFFFFFF
,$5777777777 -.. ,(577AJ) * * , *mm+++++++))+++! , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,s CD
DDc K t j j }t j t j t j t j g t j
t j | j
t j |k g}t j du r$| d t$ D | j 4 d{V t j t j j | t j | j t; t= j fd d{V }| d |D tB j" | # tB j" d{V rvtI j% d{V tM s!tO j( j) j* dk r.tV , d t[ d{V | . ddd d{V dS # 1 d{V swxY w Y dS ) zI
Re-populate HackerTrap records using data from database
Fc 3 V K | ]$}t j | V %d S r )rM r contains)r patterns r^ r z4HackerTrapHitsSaver.reset_sa_hits.. sI ! ! ))'222! ! ! ! ! !r Nc " t S r )list)rowss r^ r z3HackerTrapHitsSaver.reset_sa_hits.. s
$t** r c : g | ]\ }t j | S r )r fsencoder s r^ r z5HackerTrapHitsSaver.reset_sa_hits.. s" 111CQQ 111r r r r )/rJ FILEvaluerM statusin_rI r> CLEANUP_STARTEDRESTORE_FROM_BACKUP_STARTED maliciousr r rk rv
MalwareConfigDETECT_ADMIN_TOOLSrU rf r r r r order_by timestampdesclimitr tuplesr r r r r r r r r rm r r r r] r[ rT r_ r )r rv
where_clausesr> r s @r^
reset_sa_hitsz!HackerTrapHitsSaver.reset_sa_hits s 4 04:
! !$*$4$@
O $ $S%8 9 9 $
5
+u 4 4 ! ! 7! ! !
8 ( ( ( ( ( ( ( (
!*"677
'*.335566s)**
*&((*<*<*<*< E
JJ115111J.wrapper2 s #* # )
)#,E =C
r r )r r r r s ``` r^ r zMalwareActionIm360.postpone0 s/ r c K t j | }t |||j |j |j |j d {V d S )N)r )rP ri rU r startedrp total_resources)r rz r r scans r^ r zMalwareActionIm360.detectA sm g... I L I
r c K | | \ }}|D ]4}t dt j |j 5i }|D ]0}| |j g | 1i }| D ].\ } }
|
| j |
fd| i| d {V /|
d |D |S )Nr( rq c 3 B K | ]}|t t fV d S r r* r+ s r^ r z9MalwareActionIm360.restore_from_backup..f r, r r- r1 s r^ r6 z&MalwareActionIm360.restore_from_backupM r7 r c 6 g }g }|D ]}|j }d } t t j | }n=# t
$ r0 t dt j | Y nw xY w|jt j
t j |k t j t k t j |k | | | | ||fS r r r s r^ r$ z)MalwareActionIm360._split_hits_on_restorel r% r& Nc P
K d |D }| | }t |t | || d {V \
g }
fd|D } fd|D }
D ]1}
t j |
} t
d| 2t | fd|D D ]1}
t j |
} t
d| 2t | fd| D |S ) Nc g | ] }|j
S r r: r; s r^ r z;MalwareActionIm360._restore_from_backup.. r< r r= c & g | ]
}|j v |S r r: rA s r^ r z;MalwareActionIm360._restore_from_backup.. rC r c & g | ]
}|j v |S r r: rE s r^ r z;MalwareActionIm360._restore_from_backup.. rG r rH c 2 g | ]}|t fS r rJ rK s r^ r z;MalwareActionIm360._restore_from_backup.. rM r rN c 2 g | ]}|t fS r rJ rP s r^ r z;MalwareActionIm360._restore_from_backup.. rR r rS rV s @@@r^ r0 z'MalwareActionIm360._restore_from_backup r\ r c 6 t j } t j | }n## t t
f$ r t j cY S w xY w t | |j
}n## t t f$ r t j cY S w xY w|S r r r s r^ r z MalwareActionIm360._get_tmp_dir r r r c K d |D } | j |f|||d| d{V }t t j d{V fdt j D } g }
|D ]} t | t r|| | j
t | j
} | | j t | j }
t t | j }| j }n/| j
} | j }
t t | j }| j }t' |
d{V \ }}| |v r.|| j r!|
| || |df
| }t | t rF| j |d< | j |d< | j |d< | j |d < | j |d
< | j |d < | j |d < | | } |d|| |
||p||| j ||d
| d{V }|
| ||df |
S )r c d g | ]-}t |j t |t +|.S r )r r
isinstancerQ r+ s r^ r z;MalwareActionIm360.apply_default_action.. sM
/99
s$:;;
r )rt r r} Nc < i | ]}|j v |j |j S r )pw_namepw_uid)r pw panel_userss r^
z;MalwareActionIm360.apply_default_action.. s6
z[((
Irz(((r Try rw rx r~ r r rz ) rp rq rr r} rt r ru rv rs Fr ) r6 ra r r get_usersr getpwallr, rQ ri r r r r rp ri rN r r r
successfulr r ry rw rx r~ r r rz r ru )r r rt r} r rv r r! restore_events uid_to_namer4 r r r rp rs r r handler_kw_argshandlerr| r1 s @r^ r z'MalwareActionIm360.apply_default_action s
7s 6
"+$e
GM
: < < F F H HHHHHHHII
lnn
, 4 , 4C# 566
(# 3sy>>BB"sxSX ?? 2C88= "} x /55? "x )DT)J)J#J#J#J#J#J#J FLn$$ )<)G$
C !4fdCDDD $kkmmO# 566
9-0[ *-0[ *-0[ *03 -14
.363D0-0[ *&&v..G!' #3| + ) " E
JJUFE2 3 3 3 3
r r )NNNN)r] r^ r_ rb r r r r r r
rM rG r6 r$ r r r0 r r ra r rc r r r r^ r r s X [. [
[
j,& ' ! [: ' ' [ '> $(
eJ ,- . [ D [
L L%L
eK sD89 :L L L [L L Lr r )r` r r r r r r r collectionsr configparserr loggingr pathlibr typingr r r r
r r r
r r r r peeweer defence360agent.contracts.configr r r r r r r %defence360agent.contracts.permissionsr r r &defence360agent.internals.global_scoper $defence360agent.model.simplificationr defence360agent.subsysr defence360agent.subsys.panelsr "defence360agent.subsys.panels.baser! r" defence360agent.utilsr# r$ r% r& r' r( r) r* r+ r, r- imav.contracts.messagesr. r/ imav.contracts.configr0 r imav.malwarelib.configr1 r2 r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA rB rC rD rE rF rG rH rI rJ rK imav.malwarelib.modelrL rM rN rO rP imav.malwarelib.scan.mds.reportrQ *imav.malwarelib.subsys.restore_from_backuprR imav.malwarelib.utilsrS rT imav.plugins.event_hook_executorrU imav.malwarelib.cleanup.storagerV r] r[ r_ r bytesr r` ra rc rm r r r r r re rf __annotations__rh r r r r^ rS sn *
# # # # # # % % % % % % " ! ! ! ! !
5 4 4 4 4 4 @ @ @ @ @ @ - - - - - - 7 7 7 7 7 7 ; : : : : : : C B B B B B D D D D D D 3 3 3 3 3 3 3 3 : : : : : : >====== 8 = = = eR[( ) GCLLg&(> d vK vK vKr+ + +\ <
J
Jc3:o8N
J
J
J
JS S S S S S S Sl- - - -= %S/ < < <v( v( v( v( v( v( v( v(r s s s s s s s s s sr