Skip to content

Commit bf6717b

Browse files
grayddqgrayddq
committed
action_start
1 parent 196f87c commit bf6717b

4 files changed

Lines changed: 59 additions & 39 deletions

File tree

‎lib/core/common.py‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -119,18 +119,19 @@ def get_file_attribute(file):
119119
# 获取进程的开始时间
120120
# 返回：进程开始时间
121121
def get_process_start_time(pid):
122+
user, stime = '', ''
122123
try:
123124
pro_info = os.popen("ps -eo pid,user,lstart 2>/dev/null| grep -v 'grep'|grep " + pid).read().splitlines()
124125
for infos in pro_info:
125126
info = infos.strip()
126127
if pid == info.split(' ')[0].strip():
127128
user = info.split(' ', 2)[1].strip()
128-
stime = info.split(' ', 2)[2].strip()
129-
sstime = os.popen("date -d " + stime + " '+%Y-%m-%d %H:%M:%S' 2>/dev/null").read().splitlines()
130-
return user, sstime[0]
131-
return "", ""
129+
sstime = info.split(' ', 2)[2].strip()
130+
stime = os.popen("date -d " + sstime + " '+%Y-%m-%d %H:%M:%S' 2>/dev/null").read().splitlines()
131+
return user, stime[0]
132+
return user, stime
132133
except:
133-
return "", ""
134+
return user, stime
134135

135136

136137
# 检测风险结果，进行全局变量结果录入

‎lib/core/data_aggregation.py‎

Lines changed: 49 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -9,101 +9,119 @@
99

1010
class Data_Aggregation:
1111
def __init__(self):
12+
# 可能存在的黑客入口点信息
13+
self.begins = []
1214
self.result_infos = []
1315

14-
def cmp_datetime(self, a, b):
16+
# 黑客攻击可能存在的入口点
17+
def attack_begins(self):
1518
try:
16-
a_datetime = datetime.datetime.strptime(a, '%Y-%m-%d %H:%M:%S')
17-
b_datetime = datetime.datetime.strptime(b, '%Y-%m-%d %H:%M:%S')
18-
19-
if a_datetime > b_datetime:
20-
return 1
21-
elif a_datetime < b_datetime:
22-
return -1
23-
else:
24-
return 0
19+
attack_begins = os.popen(
20+
"netstat -ntpl | grep -v '127.0.0.1' |awk '{if (NR>1){print $4\" \"$7}}'").read().splitlines()
21+
for infors in attack_begins:
22+
if not '/' in infors: continue
23+
if not ':' in infors: continue
24+
ip_port = infors.split(' ')[0] # 开放端口
25+
pid_name = infors.split(' ')[1] # 钓鱼进程
26+
self.begins.append({'ip_port': ip_port, 'pid_name': pid_name})
2527
except:
26-
return 1
28+
return
2729

2830
def agregation(self):
2931
suggestion = get_value('suggestion')
3032
programme = get_value('programme')
3133

3234
say_info, i = u'-' * 30 + u'\n', 1
3335
say_info += u'根据系统分析的情况，溯源后的攻击行动轨迹为：\n'
36+
# 入口点信息
37+
for begin_info in self.begins:
38+
say_info += u'[起点信息] 进程服务%s 端口%s 对外部公开，可能会被作为入侵起点，属于排查参考方向\n' % (begin_info['pid_name'], begin_info['ip_port'])
3439

35-
programme_info = u'\n初步处理方案如下(请在信息核实后操作)：\n'
36-
37-
self.result_infos.sort(cmp=self.cmp_datetime, key=operator.itemgetter(u'异常时间'))
40+
programme_info = u'\n初步处理方案如下(请核实后操作)：\n'
41+
# 根据时间排序
42+
self.result_infos.sort(key=operator.itemgetter(u'异常时间'))
3843
for result_info in self.result_infos:
3944
if result_info[u'检测项'] == u'常规后门检测':
4045
say_info += u"[%d][%s] 黑客在%s时间，进行了%s植入,%s\n" % (
41-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'风险名称'],
42-
result_info[u'异常信息'])
46+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
47+
result_info[u'风险名称'],
48+
result_info[u'异常信息'])
4349
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
4450
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
4551
if result_info[u'检测项'] == u'配置类安全检测':
4652
say_info += u"[%d][%s] 黑客在%s时间，进行了%s变更，%s\n" % (
47-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'风险名称'],
48-
result_info[u'异常信息'])
53+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
54+
result_info[u'风险名称'],
55+
result_info[u'异常信息'])
4956
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
5057
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
5158
if result_info[u'检测项'] == u'文件类安全检测':
5259
say_info += u"[%d][%s] 黑客在%s时间，植入了恶意文件%s，%s\n" % (
53-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常文件'],
54-
result_info[u'异常信息'])
60+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
61+
result_info[u'异常文件'],
62+
result_info[u'异常信息'])
5563
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
5664
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
5765
if result_info[u'检测项'] == u'主机历史操作类安全检测':
5866
say_info += u"[%d][%s] 黑客在%s时间，进行了恶意操作，%s\n" % (
59-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常信息'])
67+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
68+
result_info[u'异常信息'])
6069
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
6170
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
6271
if result_info[u'检测项'] == u'日志类安全检测':
6372
say_info += u"[%d][%s] 黑客在%s时间，通过用户%s进行了主机登陆，%s\n" % (
64-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'所属用户'],
65-
result_info[u'异常信息'])
73+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
74+
result_info[u'所属用户'],
75+
result_info[u'异常信息'])
6676
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
6777
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
6878
if result_info[u'检测项'] == u'网络链接类安全检测':
6979
say_info += u"[%d][%s] 黑客在%s时间，%s\n" % (
70-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常信息'])
80+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
81+
result_info[u'异常信息'])
7182
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
7283
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
7384
if result_info[u'检测项'] == u'进程类安全检测':
7485
say_info += u"[%d][%s] 黑客在%s时间，启动进程%s，%s\n" % (
75-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'进程PID'],
76-
result_info[u'异常信息'])
86+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
87+
result_info[u'进程PID'],
88+
result_info[u'异常信息'])
7789
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
7890
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
7991
if result_info[u'检测项'] == u'Rootkit类安全检测':
8092
say_info += u"[%d][%s] 黑客在%s时间，植入Rootkit后门，%s\n" % (
81-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常信息'])
93+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
94+
result_info[u'异常信息'])
8295
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
8396
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
8497
if result_info[u'检测项'] == u'系统初始化检测':
8598
say_info += u"[%d][%s] 黑客在%s时间，设置了系统命令别名，%s\n" % (
86-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常信息'])
99+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
100+
result_info[u'异常信息'])
87101
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
88102
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
89103
if result_info[u'检测项'] == u'账户类安全检测':
90104
say_info += u"[%d][%s] 黑客在%s时间，进行了账户修改设置，%s\n" % (
91-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常信息'])
105+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
106+
result_info[u'异常信息'])
92107
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
93108
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
94109
if result_info[u'检测项'] == u'Webshell安全检测':
95110
say_info += u"[%d][%s] 黑客在%s时间，植入了webshell文件%s\n" % (
96-
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知', result_info[u'异常文件'])
111+
i, result_info[u'风险级别'], result_info[u'异常时间'] if result_info[u'异常时间'] else u'未知',
112+
result_info[u'异常文件'])
97113
if suggestion: say_info = say_info + u" 排查参考：%s\n" % result_info[u'手工排查确认']
98114
if programme and result_info[u'处理方案']: programme_info += u"[%d] %s\n" % (i, result_info[u'处理方案'])
99115
i += 1
100116
if programme:
101117
say_info += programme_info
102118

103119
file_write(say_info)
104-
print(say_info.replace(u'[风险]', u'\033[1;31m[风险]\033[0m').replace(u'[可疑]', u'\033[1;33m[可疑]\033[0m'))
120+
print(say_info.replace(u'[风险]', u'[\033[1;31m风险\033[0m]').replace(u'[可疑]', u'[\033[1;33m可疑\033[0m]').replace(
121+
u'[起点信息]', u'[\033[1;32m起点信息\033[0m]'))
105122

106123
def run(self):
107124
self.result_infos = get_value('RESULT_INFO')
108125
self.result_infos = reRepeat(self.result_infos)
126+
self.attack_begins()
109127
self.agregation()

‎lib/plugins/Proc_Analysis.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,10 @@ def check_hide_pro(self):
111111
if file.isdigit():
112112
pid_pro_file.append(file)
113113
hids_pid = list(set(pid_pro_file).difference(set(pid_process)))
114+
if len(hids_pid) > 10: return suspicious, malice
114115
for pid in hids_pid:
115-
malice_result(self.name, u'隐藏进程扫描', '', pid, u'进程ID %s 了隐藏进程信息，未出现在进程列表中' % pid,
116-
u"[1] cat /proc/$$/mountinfo|grep %s \n[2] umount /proc/%s" % (pid, pid), u'风险',
116+
malice_result(self.name, u'隐藏进程扫描', '', pid, u'进程ID %s 隐藏了进程信息，未出现在进程列表中' % pid,
117+
u"[1] cat /proc/$$/mountinfo [2] umount /proc/%s [3]ps -ef |grep %s" % (pid, pid), u'风险',
117118
programme=u'umount /proc/%s & kill %s #关闭隐藏进程并结束进程' % (pid, pid))
118119
malice = True
119120
return suspicious, malice

‎lib/plugins/Webshell_Analysis.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ def scan_web(self):
6161
if len(matches):
6262
self.webshell_list.append(file)
6363
malice_result(self.name, u'webshell安全检测', file, '', u'文件匹配上webshell特征，规则：%s' % matches[0],
64-
u'[1]cat %s' % file, u'可疑',programme=u'rm %s #删除webshell文件' % file)
64+
u'[1]cat %s' % file, u'风险',programme=u'rm %s #删除webshell文件' % file)
6565
except:
6666
continue
6767

0 commit comments

Comments
 (0)