One Hat Cyber Team
Your IP :
18.191.156.36
Server IP :
192.145.235.60
Server :
Linux ngx365.inmotionhosting.com 5.14.0-427.33.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 30 09:45:56 EDT 2024 x86_64
Server Software :
Apache
PHP Version :
8.2.27
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
opt
/
sharedrads
/
__pycache__
/
View File Name :
alp.cpython-39.pyc
a �g�@ � @ s, d Z ddlZddlZddlZddlZddlZddlmZ ddlmZ ddl m Z ddl m Z ddlZddlmZmZmZ ddlmZmZ d Zd Zd Zd Ze�� d d ZdZ e� e �Z dd� Z dd� Z!dd� Z"d+dd�Z#dd� Z$d d � Z%d d � Z&d d!� Z'd"d#� Z(d$d%� Z)d&d'� Z*d(d)� Z+e d*k�r(e+� dS ),z5 Apache Log Parser - Parse Apache domain access logs � N)�ArgumentParser)�time)� defaultdict)�node)�resolver� reversename� exception)� setup_logging�colorzDaniel Kzdanielk@inmotionhosting.comz1.0.2z 2016-09-16Zapache_domlogsz/{0!s}/�2 c C s� z8t �� }d|_d|_t�| �}|�|d�}t|d �W S t jyN Y dS t j yn t � d| � Y dS t j y� t � d| � Y dS t jy� t � d | � Y d S 0 d S ) zReturn PTR for IP addressg �?ZPTRr zNo Record Foundz Query Timed out looking for %szQuery Timed OutzNo nameservers found for %szNo nameservers foundzNo answer for %sz No AnswerN)r ZResolverZlifetimeZtimeoutr Z from_address�query�strZNXDOMAINr ZTimeout�LOGGER�debugZ NoNameserversZNoAnswer)�ip_addrZ myresolverZ question_nameZanswers� r �./opt/sharedrads/alp.py� ptr_lookup" s$ r c c s� | dkr t �d� tjE dH nv| }t �d| � tj�|�r�t|dd��>}z|E dH W n tyv t � d|� Y n0 W d � n1 s�0 Y dS )�Process log lines�-zProcessing from STDIN.NzProcess file %szutf-8)�encodingzError reading file %s) r �info�sys�stdin�os�path�exists�open�OSError�error)�source�filenameZ file_handler r r � domlog_lines: s r" c sL i }d}t � � fdd�dd�D ](}|d }� | ||< ||kr | S q |S )z/Trim dictionary to top entries ordered by valuer c s � | S �Nr ��x�� dictionaryr r �<lambda>R � ztrim_dict.<locals>.<lambda>T��key�reverse� )�sorted)r' �entriesZ trimmed_dict�count�itemr r& r � trim_dictK s r2 � Fc C s� t t�t dd� �t t�t t�t t�dd�}t�d�}t| �D �]}|d d |d< |�|�}|du�r8|d |�d � d |d |�d �< d �|�d �|�d ��}|d | d |d |< |d |�d� d |d |�d�< |d |�d� d |d |�d�< |�d�}|�d�} |d | | d |d | | < q<t� d|� q<t |d |�|d < t |d |�|d< t |d |�|d< |�r�t t�} |d D ].} t | �} | d�d| � �} |d | | | < �q�| |d< |S )r c S s t t�S r# )r �intr r r r r( ` r) z parse_domlogs.<locals>.<lambda>r )� status_codes� daily_hourly�requests� user_agents�top_ips� linecountaR ^(?P<ips>(?P<ip>[0-9.]+|[a-fA-F0-9:]+)(,\s*[0-9.]+|[a-fA-F0-9:]+)*)\s+(?P<logname>\S+)\s+(?P<user>\S+)\s+\[(?P<date>[0-9]+/[a-zA-Z]+/[0-9]+):(?P<time>(?P<hour>[0-9]+):[0-9]+:[0-9]+ [0-9-+]+)\]\s+"(?P<request>(?P<type>[A-Z]+)\s+(?P<uri>\S+)) [^"]*"\s+(?P<status>[0-9]+|-)\s+(?P<size>[0-9]+|-)\s+"(?P<referrer>[^"]*)"\s+"(?P<useragent>.*)"$r: r- Nr5 Zstatusz {: <4} {}�requestr7 r9 Zipr8 Z useragent�date�hourr6 zMissed log line: %sz <15� �top_ips_with_ptr) r r4 �re�compiler" �search�group�formatr �warningr2 r )r �numlinesZadd_ptr�resultsZ rx_logline�lineZ match_logliner; r< r= Zip_ptrr Z ptr_recordZ ip_with_ptrr r r � parse_domlogs[ sP � � ���� � rI c C s� | du rt �d� d} n t �d| � g }t�t�| ��D ]H}d|vr8d|vr8d|v rVq8tj�t�| �|�}tj�|�r8|� |� q8|S )zCArray of domlogs for cpuser. If cpuser is None, return all domlogs.Nz Choosing domlog for all users�.zChoosing domlog for %sZ_logz-sslZ ftpxferlog) r r r �listdir�USER_DOMLOG_DIRrD r �join�isfile�append)�cpuser� logfile_listr! �logfiler r r � logs_for_user� s rS c C s� g }t | �}t|�dkr(t�d| � dS t|�dkrNt�d| |d � |d S |D ]$}tj�|�t� d krR|� |� qRt|�dkr�t�d| |d � |d S t|�dkr�t�d| � n|}d}d}|D ]$}tj� |�|kr�tj� |�}|}q�|S ) z� Determine log file to use for a cPanel user. This is done by first using any unique file, then using any unique recently updated file, and then preferring size for the remaining files. If cpuser is None, search for all logs. r z$Could not find valid log file for %sNr- z Only one log file for %s: %si�Q z#Only one recent log file for %s: %szNo recent logs for %s) rS �lenr rE r r r �getmtimer rO �getsize)rP Zrecentlog_listrQ rR Zlargest�domlogr r r �choose_logfile� s4 � rX c C sZ d}d}| d|| � } t | �| }d�dd� t|| �D ��}tt�|�| |��� dS )zPrint pretty headerz~~ {0!s} ~~{1}� N� c s s | ] }d V qdS )�~Nr )�.0�ir r r � <genexpr>� r) z print_title.<locals>.<genexpr>)rT rM �range�printr ZgreenrD )�title�widthZ header_formatZbase_header_sizeZ head_lengthZlong_barr r r � print_title� s ���rc c sd t | |� d}t� � fdd�dd�D ]:}|d }t� | d�d|� �d |� � ||kr$ d S q$d S ) z;Print pretty data in a tall format, with one entry per liner c s � | S r# r r$ ��arrayr r r( r) z print_tall.<locals>.<lambda>Tr* r- z 6z N)rc r. r` )ra re rF rb � line_countr1 r rd r � print_tall� s rg c C s� t | |� d}d}|D ]`}|� d|| � d�}|t|� |kr^|d }t� d}||kr^ dS |t|� }t|dd� qt� dS )z>Print pretty data in a wide format, with many entries per liner �: z r- Nr> )�end)rc rT r` )ra re rF rb rf Z current_widthr1 Z next_itemr r r � print_wide s rj c C s t td�} | jddddd� | jdddd d� | �� }|jd d dd d� |jd dddd� | jddddd� | �d�}|jdddtddd� |jdddtd d d� |jd d dd d� | �d!�}|�� }|jd"d#d$d%d&d'd(� |jd)d*d$d%d+d,d(� |jd-d$tg d.�d/d0� |jd1d2dtd3d4d� | jd5d6td7d8d9� | �� }|j�rlt d:t � �� t d;t � d<�� t � d=� |jd>u �r�tj}ntt|j�� �}|jd3k�r�td?|t jd@� nt|j|dAd@� |j�r�dA}ndB}t|j�d=k�r�t�dC� |j�dD� |j||j |j |j |j |j fS )Ez& Parse command line arguments )� descriptionz-az--all� store_truez]Search all users. Do not limit search to single user. Overrides any usernames or paths given.)�action�helpz-mz --multilogsz7Return results for all log files, rather than just one.z-pz --with-ptrz-Get PTR records for IPs. This is the default.z-Pz--no-ptrz*Do not resolve PTRs for IPs. Overrides -p.z-Vz --versionz#Print version information and exit.zOutput optionsz-nz --numlinesZstorer3 z>Number of lines to display in each section. The default is 10.)rm �type�defaultrn z-wz--width�n z2Width of output in characters. The default is 110.z-jz--jsonz Output data as JSON instead.zError logging optionsz-vz --verbose�loglevel� store_constr zUse verbose logging.)�destrm �constrn z-qz--quiet�criticalzLog only critical errorsz --loglevel)r r r rE rv zBSpecify the verbosity of logging output. The default is 'warning'.)rt ro �choicesrn z-oz--outputrZ z%Output logging to the specified file.�sourcesz (USER|LOG)�*z�Either a cPanel user or an Apache domain log file. '-' will be handled as STDIN. If none are given, then the script will attempt to gather data from the STDIN.)�metavarro �nargsrn zApache Log Parser version zLast modified on rJ r Nz/var/log/messages)r rr Z print_outFTzNo sources. Using STDIN.r )!r �__doc__� add_argumentZ add_mutually_exclusive_groupZadd_argument_groupr4 r � parse_args�versionr` � __version__�__date__r �exitrr �loggingZWARNING�getattr�upper�outputr �stderrZno_ptrrT rx r r rO rF rb �json�all� multilogs)�parserZ ptr_groupZ output_groupZlogging_parser_groupZ logging_group�argsZ logging_level�show_ptrr r r r~ s� � ���� � � � � � � � � � �r~ c C s� | D ]�\}}|d dk r(t |� d�� qt t�d|� d��d � |d D ]"}td|� d�|d | ||� qJtd |d ||� td |d ||� td |d ||� |d dur�td|d ||� ntd|d ||� t d� qdS )z Print out results to terminalr: r- z is empty.z Results for �:r6 z Hourly hits (�)zHTTP response codesr5 z Top Requestsr7 zTop user agentsr8 r? NzTop IPs with PTRszTop IPsr9 � )r` r Zyellowrj rg )rG rF rb r �resultZdayr r r � print_results� s. � � �r� c C s� t � \} }}}}}}tdd� dD ��r,t}nd}g }|r�|rxt�d� td�d|� D ] } t| ||�} |�| | f� qVn.td�} t�d| � t| ||�} |�| | f� �n| D �] } | dkr�t�d| � t| ||�} |�d | f� q�t j � | ��rt�d | � t| ||�} |�| | f� q�t j � d | ����r�|�rtt�d | � t| �d|� D ] } t| ||�} |�| | f� �qPn.t| �} t�d| � t| ||�} |�| | f� q�t� d | � t �d� q�|�r�ttj|dddd�� n t|||� dS )zMain function for scriptc s s | ]}|t � v V qd S r# )�hostname)r\ Z shared_typer r r r^ � r) zmain.<locals>.<genexpr>)ZbizZhub�resNzSource is all log files.zSource is user file: %sr zSource is STDIN: %sZSTDINzSource is file: %sz/var/cpanel/users/z Source is all files for : %sz$Unable to determine log file for: %sZ255T� )�,rh )Z sort_keys�indentZ separators)r~ �any�MAX_LOGS_SHAREDr r rS rI rO rX r r rN rE r r� r` r� �dumpsr� ) rx r� rF rb Z show_jsonZ all_usersr� Z log_limitrG rW Z sections_dictr r r r �main� sj � � ��r� �__main__)r3 F),r| r r r� r@ r� �argparser r � collectionsr �platformr r� ZenvinfoZdnsr r r Zradsr r Z__maintainer__Z __email__r� r� �get_datarL r� Z getLogger�__name__r r r" r2 rI rS rX rc rg rj r~ r� r� r r r r �<module> sD F1 ) J