1#@!#!123s

��JFIF�� 1#@!#!123s
: / opt / sharedrads / __pycache__ /
Filename : check_darkmailer.cpython-39.pyc
back
a

�����g�����������������������@���sb���d�dl�Z�d�dlZd�dlmZ�d�dlmZ�g�d�Zg�d�Zdd��Zdd	��Z	d
d��Z
edkr^e
���dS�)
�����N)�
send_email)�node)zhttpd.plZbashZexim�procz
./cache.shz./xmrZxargsuZperxgZmdxfsz	./backupmz./dirtyz	./apache2z
/usr/bin/hostz/usr/sbin/acpidz
./cron.phpz./mileminedz	./annizodz./fpm-worker-mainz	[stealth])zusr/local/cpanel/bin/ftpputz)/usr/local/cpanel/3rdparty/bin/awstats.plzmail.cgic���������������	���C���sJ���g�}�t����D�]8}z|jg�d�d�}W�n�t�jy8���Y�q0�|��|��q|�S�)zi
    Use psutil to generate a list of all system processes
    :return: list of all system processes
    )�username�pid�ppid�create_time�cmdline)�attrs)�psutilZprocess_iterZas_dictZ
NoSuchProcess�append)�all_system_processes�system_processZprocess_info��r����$./opt/sharedrads/check_darkmailer.py�get_system_processes%���s�����
r���c�����������������C���sp���t�����}g�}|�D�]Z}||d��}|d�dkr|d�dkr|dkr|d�d�tv�r|d�d�tvr|�|��q|S�)	a���
    Use some criteria to filter out the malicious processes and create a list
    of them
     - ppid is 1
     - username is not root (non-root)
     - process is older than 5 minutes
     - process 'cmdline' string matches known malicious cmdline string
     - process 'cmdline' string doesn't match known nonmalicious cmdline string
    :param list of all system processes
    :return: list of only malicious system processes
    r���r�������r����rooti,��r	���r���)�time�KNOWN_MALICIOUS_CMDLINE_STRINGS�!KNOWN_NONMALICOUS_CMDLINE_STRINGSr���)r
���Znow�darkmailer_processesr���Zsecondsr���r���r����filter_processes9���s$����
�
���
��r���c���������������
���C���sf���t���}�t|��}|rbg�}|D�]}|�|d�|d�f��qd�t��t|�|�}tdd|dddddd	��dS�)
z�
    Function that manages flow of nagios check
     - Find all system processes
     - Filter the malicious processes
     - Generate nagios exit status
    r���r���z%{} CRITICAL: {} malicious scripts: {}zstr@imhadmin.netzDarkmailer ProcessesNF)Z	localhostr���)ZhtmlZsenderZsslZserverZlogin)r���r���r����formatr����lenr���)r
���r���Zdarkmailer_processes_crit_dataZdarkmailer_process�bodyr���r���r����mainV���s.�������r����__main__)r���r���Zradsr����platformr���r���r���r���r���r����__name__r���r���r���r����<module>���s���$