-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathbruteForceDetection.py
116 lines (107 loc) · 5.53 KB
/
bruteForceDetection.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# This is a sample Python script.
# !/bin/python3
# Press Shift+F10 to execute it or replace it with your code.
# Press Double Shift to search everywhere for classes, files, tool windows, actions, and settings.
import re
import sys
import argparse
import utmp
def writeLog():
# parser.add_argument('files', metavar='FILE', help='Files (utmp/wtmp/btmp) to read from', nargs='+')
# args = parser.parse_args()
all_contents = ""
logPath = ['/var/log/btmp']
logName = ['btmp']
# for fn in args.files:
noOfFiles = 0
for fn in logPath:
# print(fn)
with open(fn, 'rb') as fd:
buf = fd.read()
for entry in utmp.read(buf):
all_contents += str(entry.time) + str(entry.type) + str(entry)
all_contents += "\n" # add line to all_contents
# print(all_contents)
fd.close()
result = open(logName[noOfFiles] + ".txt", "w") # create file allLogs.txt
result.write(all_contents)
result.close()
noOfFiles += 1
def bruteForceDetection():
writeLog()
header = "Date Time PID User IP"
logs = open("btmp.txt")
p1 = re.compile(
"([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}).*type=(\d+), pid=(\d+), line='(.*)', id='.*', user='(.*)', host='(.*)',")
count = {}
usernames = []
for line in logs: # iterate over each line
match = p1.match(line) # match line with regex
if match is not None: # if there is a match do following
match_index = None # initialize match index. Can be of group3 or group4 depending on match
if len(usernames) == 0: # if usernames is empty, directly add this user and ip
if match.group(5) is not None:
match_index = 5
elif match.group(6) is not None:
match_index = 6
usernames.append(match.group(match_index))
count[match.group(match_index)] = {}
count[match.group(match_index)]["count"] = 1
count[match.group(match_index)]["Type"] = []
count[match.group(match_index)]["Type"].append(match.group(2))
count[match.group(match_index)]["PID"] = []
count[match.group(match_index)]["PID"].append(match.group(3))
count[match.group(match_index)]["time"] = []
count[match.group(match_index)]["time"].append(match.group(1))
count[match.group(match_index)]["User"] = []
count[match.group(match_index)]["User"].append(match.group(5))
count[match.group(match_index)]["IP"] = []
count[match.group(match_index)]["IP"].append(match.group(6))
else: # if month is not empty check if username already exists
exists = False
if match.group(5) is not None:
match_index = 5
elif match.group(6) is not None:
match_index = 6
for name in usernames: # Loop through the variable month
if name == match.group(match_index): # if month already exists, increase count and add
exists = True
count[match.group(match_index)]["count"] += 1
ip_exists = False
# Append the necessary info into the same month
count[match.group(match_index)]["Type"].append(match.group(2))
count[match.group(match_index)]["PID"].append(match.group(3))
count[match.group(match_index)]["time"].append(match.group(1))
count[match.group(match_index)]["User"].append(match.group(5))
count[match.group(match_index)]["IP"].append(match.group(6))
break
if not exists: # if user does not exists yet, add username and ip
usernames.append(match.group(match_index))
count[match.group(match_index)] = {}
count[match.group(match_index)]["count"] = 1
count[match.group(match_index)]["Type"] = []
count[match.group(match_index)]["Type"].append(match.group(2))
count[match.group(match_index)]["PID"] = []
count[match.group(match_index)]["PID"].append(match.group(3))
count[match.group(match_index)]["time"] = []
count[match.group(match_index)]["time"].append(match.group(1))
count[match.group(match_index)]["User"] = []
count[match.group(match_index)]["User"].append(match.group(5))
count[match.group(match_index)]["IP"] = []
count[match.group(match_index)]["IP"].append(match.group(6))
returnValue = [usernames,count]
return returnValue
#output=''
#output =[]
#for eachUser in usernames:
#print(eachUser + ": " + " Number of Failed Login Attempts: " )
#for key in count:
#print("User " + count[key]["User"][0] + " Number of failed Login Attempts: " + str(count[key]["count"]))
#if count[key]["count"] > 5:
#print("Suspected Brute Force")
#for i in range(len(count[key]["User"])):
#if i == len(count[key]["User"])-1:
#print("Login attempt at " + count[key]["time"][i] + " IP: " + count[key]["IP"][i])
#else:
#print("Login attempt at " + count[key]["time"][i] + " IP: " + count[key]["IP"][i])
#print("\n")