
    ajI              
       (   % S r SSKrSSKrSSKrSSKrSSKrSSKJrJrJr  SSK	J
r
   SSKrS rS rS	rS
rSrSrSrSr0 r\\S'   \" 5       r\\S'   0 r\\S'   S rS r S r!S r"S r#S;S jr$S r%S r&S r'S r(S r)S r*\RV                  " S5      r,S r-\RV                  " S 5      S!4\RV                  " S"5      S#4\RV                  " S$5      S%4\RV                  " S&5      S'4\RV                  " S(5      S)4\RV                  " S*5      S+4\RV                  " S,5      S-4\RV                  " S.5      S/4/r.S0r/\RV                  " S15      r0\
" \15      r2S2r3S3 r4S4 r5\" 5       r6\\S5'   S6 r7S7 r8S8 r9S9 r:\;S::X  a  \:" 5         gg! \ a    SSKrSSKrS rS r GN]f = f)<zIMonitor de seguranca - sem alertas de brute force SSH/web (so voce loga).    N)datetimetimezone	timedelta)defaultdictc                 .    [         R                  " XSS9  g )N   )jsontimeout)_reqpost)urlpayloads     security_monitor.py_postr   	   s    		#Q/    c                 ^    [         R                  " U SS9nU(       a  UR                  5       $ S $ N   r
   )r   getr	   )r   rs     r   	_get_jsonr      s%    HHS!$qvvx&$&r   c                     [         R                  " U5      R                  5       n[        R                  R                  XSS0S9n[        R                  R                  USS9  g )NzContent-Typezapplication/json)dataheadersr   r   )_json2dumpsencodeurllibrequestRequesturlopen)r   r   r   reqs       r   r   r      sO    ||G$++-nn$$SnN`=a$bsA.r   c                      [         R                  R                  U SS9n[        R                  " UR                  5       R                  5       5      $ ! [         a     g f = fr   )r   r    r"   r   loadsreaddecode	Exception)r   resps     r   r   r      sP    	>>))#q)9D<<		 2 2 455 		s   AA 
AA z/var/log/nginx/access.logz/var/log/auth.logz/var/log/gangstar_attacks.logz1/var/www/gangstar/apk_dropper/.monitor_state.jsonzjadbypass.my_last_alert_banned_cache
_geo_cachec                    U [         ;   a	  [         U    $ U R                  S5      (       a  0 $  [        SU -   S-   5      nU(       ax  UR                  S5      S:X  ac  UR                  SS5      UR                  SS	5      UR                  S
S5      UR                  SS5      UR                  SS5      S.nU[         U '   U$ 0 $ ! [         a     0 $ f = f)Nz10.z127.z192.168.z172.16.z::1zhttp://ip-api.com/json/z.?fields=status,country,countryCode,city,isp,asstatussuccesscountry?countryCodez??cityispas)r2   ccr5   r6   r7   )r-   
startswithr   r   r(   )ipdr   s      r   geo_ipr<   (   s    	Z"~	}}BCC	/"47gghxI-EE)C0mD8Qvc*155s3C155QUVY?\AJrNH I  Is   BB? ?
CCc                      [        U 5      S:X  aM  [        S[        U S   5      -   [        S5      -
  5      [        S[        U S   5      -   [        S5      -
  5      -   $  g! [         a     gf = f)N   i r   A   u   🌐)lenchrordr(   )r8   s    r   _flagrD   8   su    r7a<ws2a5z)#c(23c'#be*:LSQTX:U6VVV    s   AA   
A-,A-c                     [        U 5      nU(       d  / $ S[        US   5      S-   US   -   S-   US   -   S-   SS.S	US
   SS.SUS   S-   US   -   S S SS./$ )NPaisr8    r2   z ()TnamevalueinlineCidader5   zISP/ASNr6   z | r7   P   F)r<   rD   )r:   gs     r   
geo_fieldsrP   @   s    r
A	U1T7^c%9AiL%H4%ORSTXRY%Y\_%_kopQvYlpqah&64&@#2%Fkpq r   c                  f    [         R                  " [        R                  5      R	                  5       $ N)r   nowr   utc	isoformat r   r   now_utcrW   L   s    <<%//11r   c                  |    [         R                  " [        R                  5      [	        SS9-
  R                  S5      $ )N   )hoursz%d/%m/%Y %H:%M:%S)r   rS   r   rT   r   strftimerV   r   r   now_brr\   O   s+    LL&);;EEFYZZr   c                     g rR   rV   )titledesccolorfieldss       r   sendrb   R   s    
r   c                 |    [         R                   " 5       nU[        R                  U S5      -
  U:  a  gU[        U '   g)Nr   FT)timer+   r   )keycooldownrS   s      r   	can_alertrg   V   s5    
))+C
[__S!$$x/Kr   c                    U (       a
  U [         ;   a  g U R                  S5      (       a  g [         R                  U 5         [        R                  " SSSU SSSSU-   /S	S
S9  [        SSU -   S-   SSUS	S.S[        5       S	S./[        U 5      -   S9  g ! [         a!  n[        S[        U5      -   5         S nAg S nAff = f)Nr/   ufwdenyfromtoanycommentzAuto-block Tr   )capture_outputr
   u   🔨 IP BANIDO AUTOMATICAMENTEz**`z%`** bloqueado permanentemente no UFW.:| MotivorI   Quandor`   ra   z[ban] )r,   r9   add
subprocessrunrb   r\   rP   r(   printstr)r:   motivoes      r   ban_ipr{   ]   s    }$	}}BCCb	!vvr4	=[aKab&*A	73RZAA&4H&&(dKMOYZ\~^	_
  !hQ  !s    AB 
B=B88B=c                       [        [        5       n [        R                  " U 5      sS S S 5        $ ! , (       d  f       g = f! [         a    0 s $ f = frR   )open
STATE_FILEr	   loadr(   )fs    r   
load_stater   p   s;    *99Q<  	s(   A 1	A 
?A A AAc                      [        [        S5       n[        R                  " X5        S S S 5        g ! , (       d  f       g = f! [         a     g f = f)Nw)r}   r~   r	   dumpr(   )sr   s     r   
save_stater   w   s;    *c"aIIaO #"" s*   A 2A 
A A  A 
AAc                     X;  a$   [         R                  R                  U5      X'   U $ U $ ! [         a    SX'    U $ f = f)Nr   )ospathgetsizer(   )statere   r   s      r   	_init_posr   ~   sI    
	.EJ L5L  	EJL	s   !, >>c                    [         R                  R                  U 5      (       d  / $  [         R                  R                  U 5      nUR	                  X5      nX4:  a  SnX4:X  a  / $ [        U SSS9 nUR                  U5        UR                  5       nUR                  5       X!'   S S S 5        U$ ! , (       d  f       W$ = f! [         a#  n[        S[        U5      -   5        / s S nA$ S nAff = f)Nr   r   replace)errorsz[read] )r   r   existsr   r   r}   seek	readlinestellr(   rw   rx   )r   pos_keyr   sizeposr   linesrz   s           r   _read_new_linesr      s    77>>$	wwt$yy':C;I$I.!FF3KKKMEVVXEN / 	 /.  i#a& !	sA   =C &C 14B/%	C /
B>9C >C 
C.C)#C.)C.zOAccepted (?:password|publickey) for (\S+) from (\S+) port \S+ ssh2: (\S+) (\S+)c                 .   [        [        SU 5      nU(       d3   [        R                  " / SQSSSS9R                  nUR                  SS9n[        U R                  S/ 5      5      nU H  n[        R                  U5      nU(       d  M!  UR                  5       u  pgpXs;  d  M;  [        SU-   S	5      (       d  MQ  [        S
SU-   S-   SSSU-   S-   SS.SUSS.SUSS.SU	S S SS.S[        5       SS./[        U5      -   S9  M     g ! [         a     g f = f)Nauth_pos)
journalctlz-usshz--sincez1 minute agoz
--no-pagerz-oz	short-isoT
   ro   textr
   )keepends	known_ipsssh_ok_  u"   🚪 LOGIN SSH — IP DESCONHECIDOz'Novo acesso SSH detectado!
Usuario: **`z`**is IP`rI   Usuarioz
Tipo chaveFingerprint<   FzHorario BRTrs   )r   AUTH_LOGru   rv   stdout
splitlinesr(   setr   	ACCEPT_REsearchgroupsrg   rb   r\   rP   )
r   r   outknownlinemuserr:   ktypekfps
             r   check_ssh_loginsr      s.   Hj%8E	..g#$<<BF  NNDN1E 		+r*+ET"1#$88: De9Y^T#B#B??$FN#"&#(S.TXY"+$TXY".%TXY"/#cr(TYZ"/&(TXY $B(	) 	  		s   2D 
DDz)(?i)(union.{1,20}select|drop.{1,10}table)zSQL injectionz(?i)(\.\./|%2e%2e|%252e%252e)zpath traversalz((?i)(etc/passwd|etc/shadow|\.env|\.git/)zsensitive filez*(?i)(eval\(|base64_decode|system\(|exec\()zRCE attemptz*(?i)(wp-admin|wp-login|phpmyadmin|adminer)z	CMS probez?(?i)(masscan|nikto|sqlmap|nmap|dirsearch|gobuster|nuclei|zgrab)z
scanner UAz4(?i)(xmlrpc\.php|/.git/config|/.aws/|/id_rsa|\.php$)zcritical pathz9(?i)(\.env|\.sh|\.bak|\.sql|\.tar|\.zip|\.gz|\.key|\.pem)z
file probe)z.envz.gitz
etc/passwdzwp-adminzwp-login
phpmyadminadminerz.awsid_rsaz.sshxmlrpcbackupz.keyz.pemz
config.phpshellzcmd=zexec=z.bakz.sqlze(\S+)(?:\s+\[[^\]]*\])? - (?:-\s+)?\[[^\]]+\] "(\S+) ([^"]+) HTTP[^"]*" (\d+) \d+ "([^"]*)" "([^"]*)")z172.64.z172.65.z172.66.z172.67.z172.68.z104.16.z104.17.z104.18.z104.19.z104.20.z104.21.z104.22.z104.23.z104.24.z104.25.z162.158.z198.41.z190.93.z188.114.c                 6   ^  [        U 4S j[         5       5      $ )Nc              3   F   >#    U  H  nTR                  U5      v   M     g 7frR   )r9   ).0pr:   s     r   	<genexpr>is_cf.<locals>.<genexpr>   s     5Ar}}Qs   !)rm   CF_PREFIXES)r:   s   `r   is_cfr      s    5555r   c                   ^ [        [        SU 5      nU R                  S0 5      nU GHN  n[        R	                  U5      nU(       d  M"  UR                  5       u  pVmpxn	[        U5      nUR                  SS5      S-   US'   [        R                  " SU5      n
U
(       a&  U
R                  S5      S:w  a  U
R                  S5      OUnS n[         H5  u  pUR                  T5      (       d  UR                  U	5      (       d  M3  Un  O   U(       d   [        U4S j[         5       5      (       a  S	nU(       a  [        X:w  a  UOUU5        UR                  S
S5      S-   US
'   X:w  a  UOUn[        SU-   S5      (       az  SU-   S-   [!        U5      (       a  X:w  a  SU-   S-   OS-   n[#        SSSSUSS.SUSS.SUSS.S[%        U5      SS.SSTS S -   S-   SS.SU	S S SS./['        X:w  a  UOU5      -   S9  US:X  d  GM  [        S U-   S!5      (       d  GM  UR                  S"S5      S-   US"'   [#        S#S$S%S&SU-   S-   SS.SUSS.SSTS S' -   S-   SS.S(U	S S SS./['        X:w  a  UOU5      -   S9  GMQ     g ))N	nginx_posstatstotal_requestsr   r@   z\[([0-9a-fA-F.:]+)\]-c              3   H   >#    U  H  oTR                  5       ;   v   M     g 7frR   )lower)r   r   r   s     r   r   parse_nginx.<locals>.<genexpr>   s      LOqdjjl!2Os   "zsensitive pathscannersscan_i  r   z (via CF: `z`)r*   u   🔍 SCANNER / RECON DETECTADOz2Tentativa de reconhecimento bloqueada e IP banido. zIP RealFrI   zTipo de ataqueTMetodoStatusPathx   
User-Agentrs   i  500_,  
errors_500u"   💥 ERRO 500 — POSSIVEL EXPLOITzErro interno no servidor.i r   d   UA)r   	NGINX_LOG
setdefaultLOG_REmatchr   intr   rer   groupSCANNER_PATTERNSrm   SENSITIVE_PATHSr{   rg   r   rb   rx   rP   )r   r   r   r   r   r:   methodr0   refereruacf_matchreal_ip	scan_typepatternlabelalert_iplabel_ipr   s                    @r   parse_nginxr      s   I{E:EWb)ELL01
-D&2V"')),<a"@1"D 994d;'/HNN14E4L(..#RT 	.NG~~d##w~~b'9'9!	 / S LO LLL(Igm7Y? %		*a 81 <E*")-wRH8+T22=3.uUWyy]d]j-"2Dt2Kprs;I#"+HW\]"2IX\]"*FX\]"*CKX\]"(C$t*<Ls<R^cd".BtHX]^ $w}G"EF
G S=Yv{C88"'))L!"<q"@E,;,"w1DPTU&QUV$tDSz1AC1GSWX"DSQVW	
  7=bABCU r   _REG_ALERTEDc                 <   [        [        SU 5      nU GHO  nUR                  5       nU(       d  M   [        R                  " U5      nUR                  SS5      nUR                  SS5      nUR                  SS5      nUR                  SS5      nUR                  SS	5      S S
 nUR                  SS	5      n	UR                  SS	5      n
US:X  a  US:X  a  S	n U	(       a  [        R                  " U	5      O0 nUR                  SUR                  SS	5      5      S S nUS-   U-   nU[        ;  a  [        R                  U5        [        U5      nU	(       a  U	S S OSn[        SSU-   S-   [        U5      -   S-   US:X  a  SOSSSU-   S-   SS.S [        U5      SS.S!S"U-   S#-   S$S.S%US$S./U-   S&9  GM  GM  US';   d  GM  US:X  d  GM  US:X  d  GM  [        S(U-   S)5      (       d  GM  [        U5      n U	(       a  [        R                  " U	5      O0 nUR                  S*UR                  S+S5      5      n[        S,S-SSSU-   S-   SS.S.[        U5      SS.S/US$S./U-   S&9  GMR     g ! [
         a     GMc  f = f! [
         a     GNlf = f! [
         a    Sn Ndf = f)0N
attack_posr:   r3   r   r   r0   r   r   r*      bodyr)   z/api/registerPOST	charge_idreg_id   _reg_i  z(vazio)u   📝 TENTATIVA DE REGISTROzIP **`z"`** tentou criar conta. Status: ****   ^" r   r   r   TrI   r   zJSON Enviadoz```json
z
```Fr   rs   )z/loginz
/api/login	login_ok_r   usernamer   u   🔑 LOGIN BEM-SUCEDIDO NO SITEz!Alguem logou no site com sucesso.r   r   )r   
ATTACK_LOGstripr	   r%   r(   r   r   rt   rP   rb   rx   rg   )r   r   r   recr:   r   r   r0   r   r   r)   
charge_keyb	dedup_keyrO   body_display
user_fields                    r   parse_attack_logr    s   Je<Ezz|	**T"C s#3'%1%r"4C($$ ?"v'7J(,DJJt$"UU;h0CDSbI
 Wz1I,  +rN-1tDSzy7]%IICPVKWZ^^'-}8("&38c>UYZ"*CKVZ["0#.#=#GSXZ".2UZ[ 		 -  --&F2BvQT}r)400rN%,0

4(bA!"z1553E!FJ <8#"&sRx#~QUV"+s:RVW"&rRWX 	e   		"  2 ! %!$J%s7   I)AI;5AJ)
I87I8;
J	J	JJc           
          [         R                  " / SQSSSS9R                  n[        R
                  " SU5      nU(       a  [        UR                  S5      5      OSn[        R
                  " SU5      nU(       aT  UR                  S5      R                  5        Vs/ s H)  oUR                  5       (       d  M  UR                  5       PM+     snO/ nU R                  S	/ 5      nU Vs/ s H  oU;  d  M
  UPM     n	nX`S	'   X0R                  S
0 5      S'   U	(       a  [        SS5      (       a  U	S S n
SR                  S U
 5       5      n[        U	5      S:  a  US[        [        U	5      S-
  5      -   -  n[!        S[        [        U	5      5      -   S-   SSSUSS.S[        U5      SS./S9  g g g ! [         a     g f = fs  snf s  snf )N)zfail2ban-clientr0   sshdTr   r   zCurrently banned:\s+(\d+)r@   r   zBanned IP list:\s+(.*)
banned_ipsr   	f2b_total	f2b_batchr   r   
c              3   2   #    U  H  nS U-   S -   v   M     g7f)r   NrV   )r   r:   s     r   r   !check_fail2ban.<locals>.<genexpr>i  s     =fS2X^fs   z
... e mais u   🚫 FAIL2BAN — z IP(s) BANIDO(s)z*Fail2Ban bloqueou IPs por brute force SSH.rp   zIPs banidos agoraFrI   zTotal banidosrs   )ru   rv   r   r(   r   r   r   r   splitr   r   r   rg   joinrA   rx   rb   )r   r   r   totalm2xcurrentprevr:   new_banssampleips_texts               r   check_fail2banr  W  s   nnB,0tRIIO 	 			.4A C
OaE	,c	2BGI"((1+"3"3"5C"5Qyqwwy"5CrG99\2&D$7Wr$WH7!,16Wb!+. Ik3//"199=f==x=1#c(ma.?*@@@H'#c(m*<<?QQ9-eT)UtT	 0x  
 D7s)   #F1 G:G)	G6G1
F>=F>c                    [         R                  " [        R                  5      nUR	                  S5      nU R                  S5      U:X  d  UR                  S:w  a  g U R                  S0 5      n[        U R                  S0 5      R                  5       S S9S S nS	R                  S
 U 5       5      =(       d    Sn[        SSUR	                  S5      -   S-   SS[        UR                  SS5      5      SS.S[        UR                  SS5      5      SS.S[        UR                  SS5      5      SS.S[        UR                  SS5      5      SS.SUSS./S9  U Vs0 s H  ofS_M     snU S'   X S'   g s  snf )Nz%Y-%m-%dlast_summary_dayr   r   	ssh_failsc                     U S   * $ )Nr@   rV   )r  s    r   <lambda>%check_daily_summary.<locals>.<lambda>|  s
    AaD5r   )re   r   r  c              3   N   #    U  H  u  pS U-   S-   [        U5      -   v   M     g7f)r   z`: N)rx   )r   r:   cs      r   r   &check_daily_summary.<locals>.<genexpr>}  s$     DurrE)CF2s   #%Nenhumu   📊 RESUMO DIARIOz Relatorio de seguranca do dia **z%d/%m/%Yr   i; zRequisicoes Webr   TrI   zScanners/Reconr   z	Erros 500r   zIPs banidos F2Br
  zTop Atacantes SSHFrs   )r   rS   r   rT   r[   r   hoursorteditemsr  rb   rx   )r   rS   todayr   toptop_textks          r   check_daily_summaryr+  v  s_   
,,x||
$CLL$Eyy#$-QIIgr"E
;+113
I"1
MCyyDDDPH	#	+cll:.F	F	M'SCSUV9W5Xdhi&S:q9Q5Rdhi!S<QR9S5Tdhi'S;PQ9R5Sdhi)Xejk	 %**EqdE*E'N %
 +s   E4c                     [        S5        [        5       n [        U S[        5        [        U S[        5        [        U S[
        5        [        U 5         [        S5      n[        U[        5      (       a  UR                  SS5      OSn[        SS	S
S[        SS.SUSS.S[        5       SS.SSSS./S9  Sn  [        U 5        [!        U 5        [#        U 5        US-  S:X  a  [%        U 5        US-  S:X  a  ['        U 5        [        U 5        US-  n[*        R,                  " S5        Mr  ! [         a    Sn Nf = f! [         a!  n[        S[)        U5      -   5         S nANPS nAff = f)Nz[Monitor] Iniciando...r   r   r   z!https://api.ipify.org?format=jsonr:   z167.148.161.78u   ✅ MONITOR REINICIADOz.Sistema ativo. Alertando apenas o que importa.r   HostTrI   r   HorariozAlertas ativoszScanner / Recon web
IP auto-banido (UFW + Fail2Ban)
Login SSH de IP desconhecido
Tentativa de registro (JSON completo)
Login bem-sucedido no site
Erro 500 / exploit
Resumo diario 00:00 UTCFrs   r   r>      r@   z[Erro]    )rw   r   r   r   r   r   r   r   
isinstancedictr   r(   rb   HOSTNAMEr\   r   r   r  r  r+  rx   rd   sleep)r   pub_iptickrz   s       r   mainr7    sd   	
"#LEe[9-eZ8,e\:.u">?6@6N6ND!12Td 		!	98E6E68E&+ 	$ D
	&U#U#ax1}u%ax1}#E*uAID 	

2 -  "!"B  	&)c!f$%%	&s+   4D* 9AD< *D98D9<
E'E""E'__main__)iDD N)<__doc__ru   rd   r   r   r	   r   r   r   collectionsr   requestsr   r   r   ImportErrorurllib.requestr   r   WEBHOOKr   r   r   r~   r3  r+   r2  __annotations__r   r,   r-   r<   rD   rP   rW   r\   rb   rg   r{   r   r   r   r   compiler   r   r   r   r   r   _ip_4xxr   r   r   r   r  r  r+  r7  __name__rV   r   r   <module>rC     s   O % % % 2 2 #0'  (	 ,
@
T Us 
D  2[!&* JJij	)@ ZZ<=XZZ01HXYZZ;<HXYZZ=>VZZ=>TZZRSUabZZGH/ZZZLM|\	  
l
 c
:
66Ct Ec <@>&..` zF _  )/s   
E9 9FF