
    Yj
K              
       "   U d Z ddlZddlZddlZddlZddlZddlmZmZmZ ddl	m
Z
 	 ddlZd Zd Zd	Zd
ZdZdZdZdZi Zeed<    e       Zeed<   i Zeed<   d Zd Z d Z!d Z"d Z#d;dZ$d Z%d Z&d Z'd Z(d Z)d Z* ejV                  d      Z,d Z- ejV                  d       d!f ejV                  d"      d#f ejV                  d$      d%f ejV                  d&      d'f ejV                  d(      d)f ejV                  d*      d+f ejV                  d,      d-f ejV                  d.      d/fgZ.d0Z/ ejV                  d1      Z0 e
e1      Z2d2Z3d3 Z4d4 Z5 e       Z6eed5<   d6 Z7d7 Z8d8 Z9d9 Z:e;d:k(  r e:        yy# e$ r ddlZddlZd Zd ZY Zw xY w)<zIMonitor de seguranca - sem alertas de brute force SSH/web (so voce loga).    N)datetimetimezone	timedelta)defaultdictc                 4    t        j                  | |d       y )N   )jsontimeout)_reqpost)urlpayloads     %/var/www/gangstar/security_monitor.py_postr   	   s    		#GQ/    c                 X    t        j                  | d      }|r|j                         S d S N   r
   )r   getr	   )r   rs     r   	_get_jsonr      s%    HHS!$qvvx&$&r   c                     t        j                  |      j                         }t        j                  j                  | |ddi      }t        j                  j                  |d       y )NzContent-Typezapplication/json)dataheadersr   r   )_json2dumpsencodeurllibrequestRequesturlopen)r   r   r   reqs       r   r   r      sQ    ||G$++-nn$$StnN`=a$bsA.r   c                     	 t         j                  j                  | d      }t        j                  |j                         j                               S # t        $ r Y y w xY wr   )r   r    r"   r   loadsreaddecode	Exception)r   resps     r   r   r      sP    	>>))#q)9D<<		 2 2 455 		s   AA 	A A zyhttps://discord.com/api/webhooks/1526113125022040084/0uw-g4-GVYE6pfHXQNLiBoDRbd0AekHzrZx30BknKe_FjRadiOMVFVdUElrIgWhyzp2hz/var/log/nginx/access.logz/var/log/auth.logz/var/log/gangstar_attacks.logz1/var/www/gangstar/apk_dropper/.monitor_state.jsonzjadbypass.my_last_alert_banned_cache
_geo_cachec                    | t         v r	t         |    S | j                  d      ri S 	 t        d| z   dz         }|rw|j                  d      dk(  rc|j                  dd      |j                  dd	      |j                  d
d      |j                  dd      |j                  dd      d}|t         | <   |S i S # t        $ r Y i S w xY w)Nz10.z127.z192.168.z172.16.z::1zhttp://ip-api.com/json/z.?fields=status,country,countryCode,city,isp,asstatussuccesscountry?countryCodez??cityispas)r1   ccr4   r5   r6   )r,   
startswithr   r   r(   )ipdr   s      r   geo_ipr;   (   s    	Z"~	}}BC	/"47gghxI-EE)C0mD8Qvc*155s3C155QUVY?\AJrNH I  Is   B	B2 2	B?>B?c                     	 t        |       dk(  rMt        dt        | d         z   t        d      z
        t        dt        | d         z   t        d      z
        z   S 	 y# t        $ r Y yw xY w)N   i r   A   u   🌐)lenchrordr(   )r7   s    r   _flagrC   8   su    r7a<ws2a5z)#c(23c'#be*:LSQTX:U6VVV    s   AA 	A+*A+c                     t        |       }|sg S dt        |d         dz   |d   z   dz   |d   z   dz   ddd	|d
   ddd|d   dz   |d   z   d d ddgS )NPaisr7    r1   z ()TnamevalueinlineCidader4   zISP/ASNr5    | r6   P   F)r;   rC   )r9   gs     r   
geo_fieldsrP   @   s    r
A	U1T7^c%9AiL%H4%ORSTXRY%Y\_%_kopQvYlpqah&64&@#2%Fkpq r   c                  d    t        j                  t        j                        j	                         S N)r   nowr   utc	isoformat r   r   now_utcrW   L   s    <<%//11r   c                      t        j                  t        j                        t	        d      z
  j                  d      S )N   )hoursz%d/%m/%Y %H:%M:%S)r   rS   r   rT   r   strftimerV   r   r   now_brr\   O   s+    LL&);;EEFYZZr   c                     	 t        t        d| ||t               ddt        z   dz   t	               z   dz   i|xs g dgi       y # t
        $ r!}t        dt        |      z          Y d }~y d }~ww xY w)Nembedstextu   🛡 rM   z BRT)titledescriptioncolor	timestampfooterfieldsz
[Discord] )r   WEBHOOKrW   HOSTNAMEr\   r(   printstr)r`   descrb   re   es        r   sendrl   R   sy    %gU4RW }x7%?&(JVSTl$$ #% & 	'  %lSV#$$%s   A A 	A-A((A-c                 x    t        j                          }|t        j                  | d      z
  |k  ry|t        | <   y)Nr   FT)timer*   r   )keycooldownrS   s      r   	can_alertrq   [   s5    
))+C
[__S!$$x/Kr   c                 p   | r| t         v ry | j                  d      ry t         j                  |        	 t        j                  ddd| dddd|z   gd	d
       t        dd| z   dz   dd|d	ddt               d	dgt        |       z          y # t        $ r!}t        dt        |      z          Y d }~y d }~ww xY w)Nr.   ufwdenyfromtoanycommentzAuto-block Tr   )capture_outputr
   u   🔨 IP BANIDO AUTOMATICAMENTEz**`z%`** bloqueado permanentemente no UFW.:| MotivorH   Quandorb   re   z[ban] )r+   r8   add
subprocessrunrl   r\   rP   r(   rh   ri   )r9   motivork   s      r   ban_ipr   b   s    }$	}}BCb	!vvr4	=[aKab&*A	73RZAA&4H&&(dKMOYZ\~^	_
  !hQ  !s   AB 	B5B00B5c                      	 t        t              5 } t        j                  |       cd d d        S # 1 sw Y   y xY w# t        $ r i cY S w xY wrR   )open
STATE_FILEr	   loadr(   )fs    r   
load_stater   u   sD    * 	 99Q<	  	  	  	s#   < 0	< 9< < A
	A
c                     	 t        t        d      5 }t        j                  | |       d d d        y # 1 sw Y   y xY w# t        $ r Y y w xY w)Nw)r   r   r	   dumpr(   )sr   s     r   
save_stater   |   sF    *c" 	aIIaO	 	 	 s#   > 2> ;> > 	A
	A
c                     || vr%	 t         j                  j                  |      | |<   | S | S # t        $ r	 d| |<   Y | S w xY w)Nr   )ospathgetsizer(   )statero   r   s      r   	_init_posr      sO    
%	.E#J L5L  	E#JL	s   ", >>c                    t         j                  j                  |       sg S 	 t         j                  j                  |       }|j	                  ||      }||k  rd}||k(  rg S t        | dd      5 }|j                  |       |j                         }|j                         ||<   d d d        |S # 1 sw Y   S xY w# t        $ r#}t        dt        |      z          g cY d }~S d }~ww xY w)Nr   r   replace)errorsz[read] )r   r   existsr   r   r   seek	readlinestellr(   rh   ri   )r   pos_keyr   sizeposr   linesrk   s           r   _read_new_linesr      s    77>>$	wwt$yy$'#:C3;I$I. 	&!FF3KKKMEVVXE'N	& 		&  i#a& !	sA   >B< "B< 05B/%	B< /B94B< 9B< <	C(C#C(#C(zOAccepted (?:password|publickey) for (\S+) from (\S+) port \S+ ssh2: (\S+) (\S+)c                    t        t        d|       }|s8	 t        j                  g dddd      j                  }|j                  d      }t        | j                  dg             }|D ]  }t        j                  |      }|s|j                         \  }}}}	||vs5t        d|z   d	      sEt        d
d|z   dz   ddd|z   dz   ddd|ddd|ddd|	d d dddt               ddgt        |      z           y # t        $ r Y y w xY w)Nauth_pos)
journalctlz-usshz--sincez1 minute agoz
--no-pagerz-oz	short-isoT
   ry   r_   r
   )keepends	known_ipsssh_ok_  u"   🚪 LOGIN SSH — IP DESCONHECIDOz'Novo acesso SSH detectado!
Usuario: **`z`**is IP`rH   Usuarioz
Tipo chaveFingerprint<   FzHorario BRTr}   )r   AUTH_LOGr   r   stdout
splitlinesr(   setr   	ACCEPT_REsearchgroupsrq   rl   r\   rP   )
r   r   outknownlinemuserr9   ktypekfps
             r   check_ssh_loginsr      s4   Hj%8E	..g#$<<BF  NNDN1E 		+r*+E )T"#$88: D"eS9Y^T#B??$FN#"&#(S.TXY"+$TXY".%TXY"/#cr(TYZ"/&(TXY $B(	))	  		s   7C< <	DDz)(?i)(union.{1,20}select|drop.{1,10}table)zSQL injectionz(?i)(\.\./|%2e%2e|%252e%252e)zpath traversalz((?i)(etc/passwd|etc/shadow|\.env|\.git/)zsensitive filez*(?i)(eval\(|base64_decode|system\(|exec\()zRCE attemptz*(?i)(wp-admin|wp-login|phpmyadmin|adminer)z	CMS probez?(?i)(masscan|nikto|sqlmap|nmap|dirsearch|gobuster|nuclei|zgrab)z
scanner UAz4(?i)(xmlrpc\.php|/.git/config|/.aws/|/id_rsa|\.php$)zcritical pathz9(?i)(\.env|\.sh|\.bak|\.sql|\.tar|\.zip|\.gz|\.key|\.pem)z
file probe)z.envz.gitz
etc/passwdzwp-adminzwp-login
phpmyadminadminerz.awsid_rsaz.sshxmlrpcbackupz.keyz.pemz
config.phpshellzcmd=zexec=z.bakz.sqlze(\S+)(?:\s+\[[^\]]*\])? - (?:-\s+)?\[[^\]]+\] "(\S+) ([^"]+) HTTP[^"]*" (\d+) \d+ "([^"]*)" "([^"]*)")z172.64.z172.65.z172.66.z172.67.z172.68.z104.16.z104.17.z104.18.z104.19.z104.20.z104.21.z104.22.z104.23.z104.24.z104.25.z162.158.z198.41.z190.93.z188.114.c                 4     t         fdt        D              S )Nc              3   @   K   | ]  }j                  |        y wrR   )r8   ).0pr9   s     r   	<genexpr>zis_cf.<locals>.<genexpr>   s     5Ar}}Q5s   )rw   CF_PREFIXES)r9   s   `r   is_cfr      s    5555r   c                    t        t        d|       }| j                  di       }|D ]  }t        j	                  |      }|s|j                         \  }}}}}	t        |      }|j                  dd      dz   |d<   t        j                  d|      }
|
r%|
j                  d      dk7  r|
j                  d      n|}d }t        D ]+  \  }}|j                        s|j                  |	      s)|} n |st        fdt        D              rd	}|rt        ||k7  r|n||       |j                  d
d      dz   |d
<   ||k7  r|n|}t        d|z   d      rxd|z   dz   t!        |      r||k7  rd|z   dz   ndz   }t#        dddd|ddd|ddd|dddt%        |      ddddd d z   dz   ddd|	d d ddgt'        ||k7  r|n|      z          |dk(  st        d |z   d!      s|j                  d"d      dz   |d"<   t#        d#d$d%d&d|z   dz   ddd|ddddd d' z   dz   ddd(|	d d ddgt'        ||k7  r|n|      z           y ))N	nginx_posstatstotal_requestsr   r?   z\[([0-9a-fA-F.:]+)\]-c              3   B   K   | ]  }|j                         v   y wrR   )lower)r   r   r   s     r   r   zparse_nginx.<locals>.<genexpr>   s      Lqdjjl!2 Ls   zsensitive pathscannersscan_i  r   z (via CF: `z`) u   🔍 SCANNER / RECON DETECTADOz2Tentativa de reconhecimento bloqueada e IP banido. zIP RealFrH   zTipo de ataqueTMetodoStatusPathx   
User-Agentr}   i  500_,  
errors_500u"   💥 ERRO 500 — POSSIVEL EXPLOITzErro interno no servidor.i r   d   UA)r   	NGINX_LOG
setdefaultLOG_REmatchr   intr   rer   groupSCANNER_PATTERNSrw   SENSITIVE_PATHSr   rq   r   rl   ri   rP   )r   r   r   r   r   r9   methodr/   refereruacf_matchreal_ip	scan_typepatternlabelalert_iplabel_ipr   s                    @r   parse_nginxr      s   I{E:EWb)E 2CLL01
-FD&'2V"')),<a"@1"D 994d;'/HNN14E4L(..#RT 	. 	NGU~~d#w~~b'9!		 S LO LL(Igm7Y? %		*a 81 <E*")R-wRH8+T2=3.uUWy]dhj]j-"2Dt2Kprs;I#"+HW\]"2IX\]"*FX\]"*CKX\]"(C$t*<Ls<R^cd".BtHX]^ $w"}G"EF
G S=Yv{C8"'))L!"<q"@E,;,"w1DPTU&QUV$tDSz1AC1GSWX"DSQVW	
  7b=bABCU2Cr   _REG_ALERTEDc                    t        t        d|       }|D ](  }|j                         }|s	 t        j                  |      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd      }|j                  dd	      d d
 }|j                  dd	      }	|j                  dd	      }
|dk(  r|dk(  rd	}	 |	rt        j                  |	      ni }|j                  d|j                  dd	            d d }|dz   |z   }|t        vst        j                  |       t        |      }|	r|	d d nd}t        dd|z   dz   t        |      z   dz   |dk(  rdnddd|z   dz   ddd t        |      ddd!d"|z   d#z   d$dd%|d$dg|z   &       |d'v s|dk(  s|dk(  st        d(|z   d)      st        |      }	 |	rt        j                  |	      ni }|j                  d*|j                  d+d            }t        d,d-ddd|z   dz   ddd.t        |      ddd/|d$dg|z   &       + y # t
        $ r Y 9w xY w# t
        $ r Y Pw xY w# t
        $ r d}Y aw xY w)0N
attack_posr9   r2   r   r   r/   r   r   r      bodyr)   z/api/registerPOST	charge_idreg_id   _reg_i  z(vazio)u   📝 TENTATIVA DE REGISTROzIP **`z"`** tentou criar conta. Status: ****   ^" r   r   r   TrH   r   zJSON Enviadoz```json
z
```Fr   r}   )z/loginz
/api/login	login_ok_r   usernamer   u   🔑 LOGIN BEM-SUCEDIDO NO SITEz!Alguem logou no site com sucesso.r   r   )r   
ATTACK_LOGstripr	   r%   r(   r   r   r~   rP   rl   ri   rq   )r   r   r   recr9   r   r   r/   r   r   r)   
charge_keyb	dedup_keyrO   body_display
user_fields                    r   parse_attack_logr    s   Je<E 9zz|	**T"C s#3'%1%r"4C($$ ?"v'7J(,DJJt$"UU;h0CDSbI
 Wz1I,  +rN-1tDSzy7]%IICPVKWZ^^'-}8("&38c>UYZ"*CKVZ["0#.#=#GSXZ".2UZ[ 	 --&F2BvQT}r)40rN%,0

4(bA!"z1553E!FJ <8#"&sRx#~QUV"+s:RVW"&rRWX 	e9  		"  2 ! %!$J%s5   I>I;I!	II	II!I/.I/c           
      Z   	 t        j                  g dddd      j                  }t	        j
                  d|      }|rt        |j                  d            nd}t	        j
                  d|      }|rL|j                  d      j                         D cg c]#  }|j                         s|j                         % c}ng }| j                  d	g       }|D cg c]	  }||vs| }	}|| d	<   || j                  d
i       d<   |	rt        dd      r|	d d }
dj                  d |
D              }t        |	      dkD  r|dt        t        |	      dz
        z   z  }t!        dt        t        |	            z   dz   ddd|dddt        |      ddg       y y y # t        $ r Y y w xY wc c}w c c}w )N)zfail2ban-clientr/   sshdTr   r   zCurrently banned:\s+(\d+)r?   r   zBanned IP list:\s+(.*)
banned_ipsr   	f2b_total	f2b_batchr   r   
c              3   ,   K   | ]  }d |z   d z     yw)r   NrV   )r   r9   s     r   r   z!check_fail2ban.<locals>.<genexpr>n  s     =S2X^=s   z
... e mais u   🚫 FAIL2BAN — z IP(s) BANIDO(s)z*Fail2Ban bloqueou IPs por brute force SSH.rz   zIPs banidos agoraFrH   zTotal banidosr}   )r   r   r   r(   r   r   r   r   splitr  r   r   rq   joinr@   ri   rl   )r   r   r   totalm2xcurrentprevr9   new_banssampleips_texts               r   check_fail2banr  \  s   nnB,0tRIIO 	 			.4A C
OaE	,c	2BGI"((1+"3"3"5CQqwwyCrG99\2&D$7r$7H7!E,16EWb!+. Ik3/"199=f==x=1#c(ma.?*@@@H'#c(m*<<?QQ9-eT)UtT	 0x  
 D7s)   %F F#*F#	F(!F(	F F c                    t        j                  t        j                        }|j	                  d      }| j                  d      |k(  s|j                  dk7  ry | j                  di       }t        | j                  di       j                         d       d d }d	j                  d
 |D              xs d}t        dd|j	                  d      z   dz   ddt        |j                  dd            dddt        |j                  dd            dddt        |j                  dd            dddt        |j                  dd            ddd|ddg       |D ci c]  }|d c}| d<   || d<   y c c}w )Nz%Y-%m-%dlast_summary_dayr   r   	ssh_failsc                     | d    S )Nr?   rV   )r  s    r   <lambda>z%check_daily_summary.<locals>.<lambda>  s    AaD5 r   )ro   r   r  c              3   J   K   | ]  \  }}d |z   dz   t        |      z     yw)r   z`: N)ri   )r   r9   cs      r   r   z&check_daily_summary.<locals>.<genexpr>  s&     Dur1rE)CF2Ds   !#Nenhumu   📊 RESUMO DIARIOz Relatorio de seguranca do dia **z%d/%m/%Yr   i; zRequisicoes Webr   TrH   zScanners/Reconr   z	Erros 500r   zIPs banidos F2Br  zTop Atacantes SSHFr}   )r   rS   r   rT   r[   r   hoursorteditemsr  rl   ri   )r   rS   todayr   toptop_textks          r   check_daily_summaryr-  {  s_   
,,x||
$CLL$Eyy#$-QIIgr"E
;+113
I"1
MCyyDDDPH	#	+cll:.F	F	M'SCSUV9W5Xdhi&S:q9Q5Rdhi!S<QR9S5Tdhi'S;PQ9R5Sdhi)Xejk	 %**qad*E'N %E
 +s   
E1c                     t        d       t               } t        | dt               t        | dt               t        | dt
               t        |        	 t        d      }t        |t              r|j                  dd      nd}t        dd	d
dt        ddd|dddt               ddddddg       d}	 	 t        |        t!        |        t#        |        |dz  dk(  rt%        |        |dz  dk(  rt'        |        t        |        |dz  }t+        j,                  d       n# t        $ r d}Y w xY w# t        $ r!}t        dt)        |      z          Y d }~Ld }~ww xY w)Nz[Monitor] Iniciando...r   r   r   z!https://api.ipify.org?format=jsonr9   z167.148.161.78u   ✅ MONITOR REINICIADOz.Sistema ativo. Alertando apenas o que importa.r   HostTrH   r   HorariozAlertas ativoszScanner / Recon web
IP auto-banido (UFW + Fail2Ban)
Login SSH de IP desconhecido
Tentativa de registro (JSON completo)
Login bem-sucedido no site
Erro 500 / exploit
Resumo diario 00:00 UTCFr}   r   r=      r?   z[Erro]    )rh   r   r   r   r   r  r   r   
isinstancedictr   r(   rl   rg   r\   r   r   r  r  r-  ri   rn   sleep)r   pub_iptickrk   s       r   mainr8    sa   	
"#LEe[9-eZ8,e\:.u">?6@6ND!12Td 		!	98E6E68E&+ 	$ D
	&U#U#ax1}u%ax1}#E*uAID 	

2 -  "!"B  	&)c!f$%%	&s+   /D$ 7AD5 $D21D25	E>EE__main__)iDD N)<__doc__r   rn   r   r   r	   r   r   r   collectionsr   requestsr   r   r   ImportErrorurllib.requestr   r   rf   r   r   r  r   rg   r*   r4  __annotations__r   r+   r,   r;   rC   rP   rW   r\   rl   rq   r   r   r   r   r   compiler   r   r   r   r   r   _ip_4xxr   r   r   r   r  r  r-  r8  __name__rV   r   r   <module>rC     s   O % % % 2 2 #0'  I(	 ,
@
T Us 
D  2[%!&* BJJij	)@ RZZ<=XRZZ01HXYRZZ;<HXYRZZ=>VRZZ=>TRZZRSUabRZZGH/ZRZZLM|\	  
l
 c
:
66Ct Ec <@>&..` zF i  )/s   
E7 7FF