wh1sk3yj4ck

#!/usr/bin/env python

# By William 'wh1sk3yj4ck' Soderberg
# E-mail: william.soderberg@gmail.com

# This script will analyze your auth.log file for brute force attacks and print you a report.

sshdInfo = dict()
ip = 0
time = 0
attempts = 0
index = 12 # index in list where IP is stored

# debugging
totalFailed = 0

def checkRatio():
    # Checks success/failed ratio in order to remove false positives
    tmpLst = []

    for k, v in sshdInfo.iteritems():
        if v[4] > 0:
            # Adjust tolerance here.
            # Default tolerance is 1 success of 10
            if (v[4]/float(v[2])) > float(0.1):
                tmpLst.append(k)

    # Removing keys with a good ratio
    for keys in tmpLst:
        del sshdInfo[keys]

def check(line):
    # Function that will check for failed entries in the logfile
    line = line.split()

    time = line[0] + ' ' + line[1] + ' ' + line[2]

    if 'Failed' in line:
        if 'invalid' in line:
            storeFailed(line, index, time)
        else:
            storeFailed(line, index - 2, time)
    elif 'Accepted' in line:
        storeSuccessful(line, time)
    else
        recordSession(line, time)

def storeFailed(line, index, time):
    attempts = 0
    success = 0
    ip = line[index]

    # IP-addr. resides at index 12
    if ip not in sshdInfo:
        # Adds initial values to IP key
        sshdInfo[ip] = [time, time, attempts, [], success]

    # If IP key already exist, then renew end time and add one to attempts
    sshdInfo[ip][1] = time
    sshdInfo[ip][2] += 1

def storeSuccessful(line, time):
    ip = line[10]
    user = line[8]

    if ip not in sshdInfo:
        # We don't need to add successful attempts that's not considered
        # a brute force attempt.
        return

    sshdInfo[ip][3].append(time) # adds when the acc was compromised
    sshdInfo[ip][3].append(user) # adds user

    sshdInfo[ip][1] = time # adds timestamp
    sshdInfo[ip][4] += 1 # adds success

def recordSession():
    # This function will record the session end time.
    # If a session exists and this function gets called, it will
    # then add the session end time to the stored information

    # NOTE: This could record wrong session time since several IP's can be logged on at the same time
    if ip not in sshdInfo:
        # We don't need to add logouts that's not apart of the attack
        return

def writeReport(totalFailed):
    # Writes a detailed report of the findings to a file

    successful = 0

    with open('sshd_analyzer_report', 'w') as f2:

        for k, v in sshdInfo.iteritems():
            f2.write('\n\nAttacker IP: ' + k)
            f2.write('\nStart time: ' + v[0])
            f2.write('\nEnd time: ' + v[1])
            f2.write('\nLogin attempts: ' + str(v[2]))

            if v[4] > 0:
                successful += 1
                f2.write('\nSuccessful attempts: ' + str(v[4]))
                f2.write('\nRatio: ' + str(v[4]/float(v[2])))

                if len(v[3]) > 0:
                    f2.write('\nCompromised account details:')
                    count = 0

                    while count < len(v[3]):
                        f2.write('\n')
                        f2.write(v[3][count] + ' : ' + v[3][count+1])
                        count += 2

            totalFailed += v[2]

    print 'Total number of attackers: ' + str(len(sshdInfo))
    print 'Total number of successful attackers: ' + str(successful)
    print 'Total number of failed attackers: ' + str(len(sshdInfo) - successful)
    print 'Number of failed login attempts: ' + str(totalFailed)

def main():
    # Checks for failed and successful login attempts, rest is discarded
    with open('sanitized_log/auth.log', 'r') as f:
        for line in f:
            if 'sshd' and 'Failed' in line:
                check(line)
            elif 'sshd' and 'Accepted' in line:
                check(line)
            elif 'session closed for user' in line:
                check(line)

main()
checkRatio()
writeReport(totalFailed)