code_optimizing

grayddq · May 7, 2019 · 40cdc25 · 40cdc25
1 parent d5be14c
commit 40cdc25
Show file tree

Hide file tree

Showing 34 changed files with 204 additions and 187 deletions.
diff --git a/GScan.py b/GScan.py
@@ -1,19 +1,6 @@
 # coding:utf-8
-import os, optparse, time
-from lib.Host_Info import *
-from lib.File_Analysis import *
-from lib.History_Analysis import *
-from lib.Proc_Analysis import *
-from lib.Network_Analysis import *
-from lib.Backdoor_Analysis import *
-from lib.User_Analysis import *
-from lib.common import *
-from lib.Config_Analysis import *
-from lib.Log_Analysis import *
-from lib.Rootkit_Analysis import *
-from lib.Webshell_Analysis import *
-from lib.Init import *
-from lib.globalvar import *
+from lib.core.option import *
+import os
 
 # 作者：咚咚呛
 # 版本：v0.1
@@ -33,61 +20,4 @@
     '''
     print(progam)
 
-    parser = optparse.OptionParser()
-    parser.add_option("--overseas", dest="overseas", default=False, action='store_true', help=u"境外模式，此参数将不进行境外ip的匹配")
-    parser.add_option("--full", dest="full_scan", default=False, action='store_true', help=u"完全扫描，此参数将启用完全扫描")
-    parser.add_option("--debug", dest="debug", default=False, action='store_true', help=u"调试模式，进行程序的调试数据输出")
-    parser.add_option("-l", "--log", dest="logdir", help=u"打包当前系统的所有安全日志（暂不支持），demo: -l /var/log/")
-    options, _ = parser.parse_args()
-
-    if not options.logdir:
-        # 设置调试模式
-        init()
-        set_value('DEBUG', True if options.debug else False)
-        # 设置国内ip模式
-        set_value('Overseas', True if options.overseas else False)
-        # 设置扫描模式为完全扫描
-        set_value('SCAN_TYPE', 2 if options.full_scan else 1)
-        set_value('SYS_PATH', os.path.dirname(os.path.abspath(__file__)))
-        set_value('LOG_PATH', os.path.dirname(os.path.abspath(__file__)) + "/log/gscan.log")
-        # 创建日志文件
-        mkfile()
-        file_write(progam + '\n')
-        file_write(u'\n开始扫描当前系统安全状态...\n')
-        print(u'\033[1;32m开始扫描当前系统安全状态...\033[0m')
-        # 主机信息获取
-        Host_Info().run()
-        # 系统初始化检查
-        SYS_INIT().run()
-        # 文件类安全检测
-        File_Analysis().run()
-        # 主机历史操作类扫描
-        History_Analysis().run()
-        # 主机进程类安全扫描
-        Proc_Analysis().run()
-        # 网络链接类安全扫描
-        Network_Analysis().run()
-        # 后门类扫描
-        Backdoor_Analysis().run()
-        # 账户类扫描
-        User_Analysis().run()
-        # 安全日志类
-        Log_Analysis().run()
-        # 安全配置类
-        Config_Analysis().run()
-        # rootkit检测
-        Rootkit_Analysis().run()
-        # WEBShell类扫描
-        Webshell_Analysis().run()
-        # 漏洞扫描
-
-
-        # 输出报告
-        print(u'-' * 30)
-        print(u'\033[1;32m扫描完毕，扫描结果已记入到 %s 文件中，请及时查看\033[0m' % get_value('LOG_PATH'))
-
-
-    elif options.logdir:
-        print(u'\033[1;32m开始备份整个系统安全日志...\033[0m\n')
-    else:
-        parser.print_help()
+    main(os.path.dirname(os.path.abspath(__file__)))
diff --git a/README.md b/README.md
@@ -119,27 +119,31 @@
 ## 程序脚本说明 ##
 
 	GScan
-	----GScan.py                #主程序
-	----log                     #日志和结果记录
-	----lib                     #模块库文件
-	-------common.py            #调用的公共库
-	-------Host_Info.py         #主机信息获取
-	-------File_Analysis.py     #文件类安全检测
-	-------History_Analysis.py  #用户历史操作类
-	-------Proc_Analysis.py     #进程类安全检测
-	-------Network_Analysis.py  #网络类安全检测
-	-------Backdoor_Analysis.py #后门类检测
-	-------User_Analysis.py     #账户类安全排查
-	-------Log_Analysis.py      #日志类安全分析
-	-------Config_Analysis.py   #安全配置类分析
-	-------Rootkit_Analysis.py  #Rootkit分析
-	-------SSHAnalysis.py       #secure日志分析
-	-------Webserver.py         #获取当前web服务的web根目录
-	-------Webshell_Analysis.py #webshell检测
-	-----ip                     #ip地址定位库
-	-----malware                #各类恶意特征库
-	-----egg                    #yara打包动态库
-	-----webshell_rule        #webshell检测的规则
+	----GScan.py                   #主程序
+	----log                        #日志和结果记录
+	----lib                        #模块库文件
+	-------core                    #调用库文件
+	----------common.py            #公共库模块
+	----------globalvar.py         #全局参数管理模块
+	----------option.py            #参数管理模块
+	----------ip                   ##ip地址定位库
+	-------egg                     #yara打包动态库
+	-------malware                 #恶意特征库
+	-------plugins                 #检测插件模块库
+	----------Host_Info.py         #主机信息获取
+	----------File_Analysis.py     #文件类安全检测
+	----------History_Analysis.py  #用户历史操作类
+	----------Proc_Analysis.py     #进程类安全检测
+	----------Network_Analysis.py  #网络类安全检测
+	----------Backdoor_Analysis.py #后门类检测
+	----------User_Analysis.py     #账户类安全排查
+	----------Log_Analysis.py      #日志类安全分析
+	----------Config_Analysis.py   #安全配置类分析
+	----------Rootkit_Analysis.py  #Rootkit分析
+	----------SSHAnalysis.py       #secure日志分析
+	----------Webserver.py         #获取当前web服务的web根目录
+	----------Webshell_Analysis.py #webshell检测
+	----------webshell_rule        #webshell检测的规则
 
 
 ## 程序特点 ##
@@ -225,6 +229,8 @@
 | 【日志安全检测】wtmp日志安全检测 | √ | √ |  |  |
 | 【日志安全检测】utmp日志安全检测 | √ | √ |  |  |
 | 【日志安全检测】lastlog日志安全检测 | √ | √ |  |  |
+| 【日志安全检测】web日志安全检测 |  |  |  |  |
+| 【日志安全检测】其他服务日志安全检测 |  |  |  |  |
 | 【安全配置检测】DNS设置检测 | √ |  |  | √ |
 | 【安全配置检测】防火墙设置检测 | √ |  |  | √ |
 | 【安全配置检测】hosts安全检测 | √ |  |  | √ |

diff --git a/lib/.DS_Store b/lib/.DS_Store
diff --git a/lib/core/__init__.py b/lib/core/__init__.py
diff --git a/lib/common.py → lib/core/common.py b/lib/common.py → lib/core/common.py
@@ -2,8 +2,8 @@
 from __future__ import print_function
 import os, sys, json, re, time
 from imp import reload
-from lib.ip.ip import *
-from lib.globalvar import *
+from lib.core.ip.ip import *
+from lib.core.globalvar import *
 
 # 作者：咚咚呛
 # 功能：调用的公共库
@@ -19,6 +19,9 @@
 ip_re = r'(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
 lan_ip = r'(127\.0\.0\.1)|(localhost)|(10\.\d{1,3}\.\d{1,3}\.\d{1,3})|(172\.((1[6-9])|(2\d)|(3[01]))\.\d{1,3}\.\d{1,3})|(192\.168\.\d{1,3}\.\d{1,3})'
 
+# 恶意特征列表list
+malware_infos = []
+
 
 # 颜色打印
 def pringf(strings, security=False, suspicious=False, malice=False):
@@ -186,9 +189,9 @@ def check_shell(content):
 
 
 # 获取配置文件的恶意域名等信息
-def get_malware_info():
+def get_malware_info(path):
     try:
-        malware_path = sys.path[0] + '/lib/malware/'
+        malware_path = path + '/lib/malware/'
         if not os.path.exists(malware_path): return
         for file in os.listdir(malware_path):
             with open(malware_path + file) as f:
@@ -273,12 +276,9 @@ def analysis_file(file):
         if not os.path.exists(file): return ""
         if os.path.isdir(file): return ""
         if (" " in file) or ("GScan" in file) or ("\\" in file) or (".jpg" in file) or (")" in file) or (
-                "(" in file): return ""
-        if 'GScan' in file: return ""
-        if '\\' in file: return ""
-        if os.path.splitext(file)[1] == '.log': return ""
+                "(" in file) or (".log" in file): return ""
         if (os.path.getsize(file) == 0) or (round(os.path.getsize(file) / float(1024 * 1024)) > 10): return ""
-        strings = os.popen("strings %s" % file).readlines()
+        strings = os.popen("strings %s 2>/dev/null" % file).read().splitlines()
         if len(strings) > 200: return ""
 
         time.sleep(0.01)
@@ -301,9 +301,3 @@ def analysis_file(file):
         return ""
     except:
         return ""
-
-
-# 恶意特征列表list
-malware_infos = []
-# 获取恶意特征信息
-get_malware_info()
diff --git a/lib/globalvar.py → lib/core/globalvar.py b/lib/globalvar.py → lib/core/globalvar.py
diff --git a/lib/core/ip/.DS_Store b/lib/core/ip/.DS_Store
diff --git a/lib/ip/17monipdb.dat → lib/core/ip/17monipdb.dat b/lib/ip/17monipdb.dat → lib/core/ip/17monipdb.dat
diff --git a/lib/ip/__init__.py → lib/core/ip/__init__.py b/lib/ip/__init__.py → lib/core/ip/__init__.py
diff --git a/lib/ip/ip.py → lib/core/ip/ip.py b/lib/ip/ip.py → lib/core/ip/ip.py
diff --git a/lib/core/option.py b/lib/core/option.py
@@ -0,0 +1,91 @@
+# coding:utf-8
+
+import os, optparse, time
+from lib.core.option import *
+from lib.plugins.Host_Info import *
+from lib.plugins.File_Analysis import *
+from lib.plugins.History_Analysis import *
+from lib.plugins.Proc_Analysis import *
+from lib.plugins.Network_Analysis import *
+from lib.plugins.Backdoor_Analysis import *
+from lib.plugins.User_Analysis import *
+from lib.core.common import *
+from lib.plugins.Config_Analysis import *
+from lib.plugins.Log_Analysis import *
+from lib.plugins.Rootkit_Analysis import *
+from lib.plugins.Webshell_Analysis import *
+from lib.plugins.Sys_Init import *
+from lib.core.globalvar import *
+
+
+def main(path):
+    parser = optparse.OptionParser()
+    parser.add_option("--version", dest="version", default=False, action='store_true', help=u"当前程序版本")
+
+    group = optparse.OptionGroup(parser, "Mode", "GScan running mode options")
+    group.add_option("--overseas", dest="overseas", default=False, action='store_true', help=u"境外模式，此参数将不进行境外ip的匹配")
+    group.add_option("--full", dest="full_scan", default=False, action='store_true', help=u"完全模式，此参数将启用完全扫描")
+    group.add_option("--debug", dest="debug", default=False, action='store_true', help=u"调试模式，进行程序的调试数据输出")
+
+    parser.add_option_group(group)
+
+    group = optparse.OptionGroup(parser, "Optimization", "Optimization options")
+    group.add_option("--job", dest="job", default=False, action='store_true', help=u"添加定时任务，用于定时执行程序")
+    group.add_option("--log", dest="logdir", default=False, action='store_true', help=u"打包当前系统的所有安全日志（暂不支持）")
+    group.add_option("--time", dest="time", help=u"搜索指定时间内主机改动的所有文件")
+    parser.add_option_group(group)
+
+    options, _ = parser.parse_args()
+
+    if options.logdir:
+        print(u'\033[1;32m开始备份整个系统安全日志...\033[0m\n')
+    elif options.job:
+        print(u'\033[1;32m开始添加定时任务...\033[0m\n')
+    elif options.version:
+        parser.print_help()
+    else:
+        # 初始化全局模块
+        init()
+        # 设置调试模式
+        set_value('DEBUG', True if options.debug else False)
+        # 设置国内ip模式
+        set_value('Overseas', True if options.overseas else False)
+        # 设置扫描模式为完全扫描
+        set_value('SCAN_TYPE', 2 if options.full_scan else 1)
+        set_value('SYS_PATH', path)
+        set_value('LOG_PATH', path + "/log/gscan.log")
+        # 获取恶意特征信息
+        get_malware_info(path)
+        # 创建日志文件
+        mkfile()
+        file_write(u'开始扫描当前系统安全状态...\n')
+        print(u'\033[1;32m开始扫描当前系统安全状态...\033[0m')
+        # 主机信息获取
+        Host_Info().run()
+        # 系统初始化检查
+        SYS_INIT().run()
+        # 文件类安全检测
+        File_Analysis().run()
+        # 主机历史操作类扫描
+        History_Analysis().run()
+        # 主机进程类安全扫描
+        Proc_Analysis().run()
+        # 网络链接类安全扫描
+        Network_Analysis().run()
+        # 后门类扫描
+        Backdoor_Analysis().run()
+        # 账户类扫描
+        User_Analysis().run()
+        # 安全日志类
+        Log_Analysis().run()
+        # 安全配置类
+        Config_Analysis().run()
+        # rootkit检测
+        Rootkit_Analysis().run()
+        # WEBShell类扫描
+        Webshell_Analysis().run()
+        # 漏洞扫描
+
+        # 输出报告
+        print(u'-' * 30)
+        print(u'\033[1;32m扫描完毕，扫描结果已记入到 %s 文件中，请及时查看\033[0m' % get_value('LOG_PATH'))
diff --git a/lib/plugins/.DS_Store b/lib/plugins/.DS_Store
diff --git a/lib/Backdoor_Analysis.py → lib/plugins/Backdoor_Analysis.py b/lib/Backdoor_Analysis.py → lib/plugins/Backdoor_Analysis.py
@@ -1,8 +1,8 @@
 # coding:utf-8
 from __future__ import print_function
 import os, time, sys, json, re
-from lib.common import *
-from lib.ip.ip import *
+from lib.core.common import *
+from lib.core.ip.ip import *
 from subprocess import Popen, PIPE
 
 
@@ -137,7 +137,7 @@ def check_cron(self):
     def check_alias(self):
         suspicious, malice = False, False
         try:
-            infos = os.popen("alias").read().splitlines()
+            infos = os.popen("alias 2>/dev/null").read().splitlines()
             for info in infos:
                 suspicious, malice = self.analysis_strings('alias backdoor', "", info, '[1]alias')
             return suspicious, malice
@@ -148,7 +148,7 @@ def check_alias(self):
     def check_SSH(self):
         suspicious, malice = False, False
         try:
-            infos = os.popen("netstat -ntpl |grep -v ':22 '| awk '{if (NR>2){print $7}}'").read().splitlines()
+            infos = os.popen("netstat -ntpl 2>/dev/null |grep -v ':22 '| awk '{if (NR>2){print $7}}'").read().splitlines()
             for info in infos:
                 pid = info.split("/")[0]
                 if os.path.exists('/proc/%s/exe' % pid):
@@ -165,7 +165,7 @@ def check_SSH(self):
     def check_SSHwrapper(self):
         suspicious, malice = False, False
         try:
-            infos = os.popen("file /usr/sbin/sshd").read().splitlines()
+            infos = os.popen("file /usr/sbin/sshd 2>/dev/null").read().splitlines()
             if not len(infos): return suspicious, malice
             if ('ELF' not in infos[0]) and ('executable' not in infos[0]):
                 self.backdoor.append(
@@ -215,14 +215,7 @@ def check_setuid(self):
         suspicious, malice = False, False
         try:
             file_infos = os.popen(
-                "find / ! -path '/proc/*' -type f -perm -4000 | grep -vE 'pam_timestamp_check|unix_chkpwd|ping|mount|su|pt_chown|ssh-keysign|at|passwd|chsh|crontab|chfn|usernetctl|staprun|newgrp|chage|dhcp|helper|pkexec|top|Xorg|nvidia-modprobe|quota|login|security_authtrampoline|authopen|traceroute6|traceroute|ps'").read().splitlines()
-            '''
-            p1 = Popen("find / ! -path '/proc/*' -type f -perm -4000", stdout=PIPE, shell=True)
-            p2 = Popen(
-                "grep -vE 'pam_timestamp_check|unix_chkpwd|ping|mount|su|pt_chown|ssh-keysign|at|passwd|chsh|crontab|chfn|usernetctl|staprun|newgrp|chage|dhcp|helper|pkexec'",
-                stdin=p1.stdout, stdout=PIPE, shell=True)
-            file_infos = p2.stdout.splitlines()
-            '''
+                "find / ! -path '/proc/*' -type f -perm -4000 2>/dev/null | grep -vE 'pam_timestamp_check|unix_chkpwd|ping|mount|su|pt_chown|ssh-keysign|at|passwd|chsh|crontab|chfn|usernetctl|staprun|newgrp|chage|dhcp|helper|pkexec|top|Xorg|nvidia-modprobe|quota|login|security_authtrampoline|authopen|traceroute6|traceroute|ps'").read().splitlines()
             for info in file_infos:
                 self.backdoor.append(
                     {u'异常类型': u'setuid后门', u'异常信息': u'文件被设置setuid属性', u'文件': info,

diff --git a/lib/Config_Analysis.py → lib/plugins/Config_Analysis.py b/lib/Config_Analysis.py → lib/plugins/Config_Analysis.py
@@ -1,8 +1,8 @@
 # coding:utf-8
 from __future__ import print_function
-import os, optparse, time, sys, json, re
-from lib.common import *
-from lib.ip.ip import *
+import os, re
+from lib.core.common import *
+from lib.core.ip.ip import *
 from subprocess import Popen, PIPE
 
 
@@ -23,7 +23,7 @@ def check_dns(self):
         try:
             if os.path.exists('/etc/resolv.conf'):
                 shell_process = os.popen(
-                    'cat /etc/resolv.conf | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}"').read().splitlines()
+                    'cat /etc/resolv.conf 2>/dev/null| grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}"').read().splitlines()
                 for ip in shell_process:
                     if check_ip(ip):
                         self.config_suspicious.append(
@@ -37,9 +37,7 @@ def check_dns(self):
     def check_iptables(self):
         suspicious, malice = False, False
         try:
-            iptable = os.popen("whereis iptables").read().splitlines()
-            if not len(iptable): return suspicious, malice
-            shell_process = os.popen("iptables -L -n| grep -v 'Chain'|grep 'ACCEPT'").read().splitlines()
+            shell_process = os.popen("iptables -L -n 2>/dev/null| grep -v 'Chain'|grep 'ACCEPT'").read().splitlines()
             for iptables in shell_process:
                 self.config_suspicious.append(
                     {u'配置信息': iptables, u'异常类型': u'存在iptables ACCEPT策略', u'手工确认': u'[1]iptables -L'})
@@ -62,9 +60,9 @@ def check_hosts(self):
         suspicious, malice = False, False
         try:
             if not os.path.exists("/etc/hosts"): return suspicious, malice
-            p1 = Popen("cat /etc/hosts", stdout=PIPE, shell=True)
+            p1 = Popen("cat /etc/hosts 2>/dev/null", stdout=PIPE, shell=True)
             p2 = Popen("awk '{print $1}'", stdin=p1.stdout, stdout=PIPE, shell=True)
-            shell_process = p2.stdout.readlines()
+            shell_process = p2.stdout.read().splitlines()
             for ip_info in shell_process:
                 if not re.search(self.ip_re, ip_info): continue
                 ip = ip_info.strip().replace('\n', '')