Advertisement
Guest User

Untitled

a guest
Apr 19th, 2019
158
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 5.70 KB | None | 0 0
  1. import requests
  2. import logging
  3. import sys
  4. import hashlib
  5. import os
  6. import ntpath
  7. import json
  8. import time
  9.  
  10. TOKEN = '3368d1e65134733d3a8bd70ef54aeaa1c49a0f14'
  11. BUFFER_SIZE = 65538
  12. A1000_HOST = "https://a1000.reversinglabs.com"
  13. TI_CLOUD_EMEA_APAC_HOST = "ticloud01.reversinglabs.com"
  14. TI_CLOUD_US_HOST = "ticloud-cdn-api.reversinglabs.com"
  15.  
  16. ####################################################################
  17. #                UTILS                 #
  18. ####################################################################
  19.  
  20.  
  21. def path_leaf(path):
  22.     head, tail = ntpath.split(path)
  23.     return tail or ntpath.basename(head)
  24.  
  25.  
  26. ####################################################################
  27. #                A1000 services                #
  28. ####################################################################
  29.  
  30.  
  31. def rl_a1000_upload(a1000_host, file,  token):
  32.    
  33.     file_name = path_leaf(file)
  34.  
  35.     data = {"analysis": "cloud", "filename": file_name}
  36.     f = {"file": open(file, 'rb')}
  37.     headers = {"Authorization" : "Token %s" % token}
  38.  
  39.     r = requests.post(
  40.         "%s%s" % (a1000_host,  "/api/uploads/"),
  41.         files=f,
  42.         headers=headers,
  43.         data=data,
  44.     )
  45.  
  46.     if r.status_code < 200 or r.status_code >= 300:
  47.         logging.warning(
  48.             "Request did not succeeded and returned code %s" % r.status_code
  49.         )
  50.     return r.text
  51.  
  52. def rl_a1000_processing_status_sample(a1000_host, hash, token):
  53.     headers = {'Authorization' : 'Token %s' % token}
  54.     data = {'hash_values' : [hash]}
  55.     params = {'status' : 'processed'}
  56.    
  57.     url = "%s/api/samples/status/" % (a1000_host)
  58.         print(url) 
  59.     r = requests.post(url, data=data, params=params, headers=headers)  
  60.  
  61.     if r.status_code < 200 or r.status_code >= 300:
  62.             logging.warning("Request did not succeeded and returned code %s" % r.status_code)
  63.        
  64.     return r.text
  65.  
  66.  
  67. def rl_a1000_reanalyze(a1000_host, hash, token):
  68.    data = {"analysis": "cloud"}
  69.    headers = {"Authorization" : "Token %s" % token}
  70.  
  71.    url = "%s/api/samples/%s/analyze/" % (a1000_host, hash)
  72.  
  73.    r = requests.post(url, headers=headers, data=data)
  74.  
  75.    if r.status_code < 200 or r.status_code >= 300:
  76.        logging.warning(
  77.            "Request did not succeeded and returned code %s" % r.status_code
  78.        )
  79.    return r.text
  80.  
  81. def rl_a1000_list(a1000_host, hashes, token, verify_cert=True):
  82.    
  83.     data = {"hash_values": [hashes], "fields": FIELDS}
  84.     headers = {"Authorization" : "Token %s" % token}
  85.     r = requests.post(
  86.         "%s%s" % (a1000_host,  "/api/samples/list/"),
  87.         headers=headers,
  88.         data=data,
  89.         verify=verify,
  90.     )
  91.     if r.status_code < 200 or r.status_code >= 300:
  92.         logging.warning(
  93.             "Request did not succeeded and returned code %s" % r.status_code
  94.         )
  95.         return r
  96.     return r.text
  97.  
  98. def rl_a1000_list_of_extracted_files_from_sample(a1000_host, hash, token):
  99.     headers = {"Authorization" : "Token %s" % token}
  100.     r = requests.get("%s%s%s%s" % (a1000_host, "/api/samples/", hash, "/extracted-files/"), headers=headers)
  101.  
  102.     if r.status_code < 200 or r.status_code >= 300:
  103.             logging.warning("Request did not succeeded and returned code %s" % r.status_code)
  104.        
  105.     return r.text
  106.  
  107.  
  108. def rl_a1000_is_available(a1000_host, token, hash):
  109.     headers = {'Authorization' : 'Token %s' % token}
  110.         r = requests.get("%s%s%s/" % (a1000_host, "/api/samples/", hash), headers=headers)
  111.         if r.status_code < 200 or r.status_code >= 300:
  112.             return False
  113.  
  114.     return True
  115.  
  116. def rl_titanium_cloud_alert_api(tc_host, hashes, subscribe=True):
  117.     if subscribe:
  118.         url = "https://%s/api/subscription/data_change/v1/bulk_query/subscribe/json".format(tc_host)
  119.     else:
  120.         url = "https://%s/api/subscription/data_change/v1/bulk_query/unsubscribe/json".format(tc_host)
  121.     json_payload = {"rl": {"query":{"hash_type":"sha1", "hashes" : hashes} }}
  122.     r = requests.post(url, json=json_payload)
  123.        
  124.  
  125.  
  126. ############################################################################
  127. #               HASH CALCULATOR                #
  128. ############################################################################
  129.  
  130. def calculate_sha1(file):
  131.     sha1 = hashlib.sha1()
  132.    
  133.     try:
  134.         f = open(file, 'rb')
  135.     except IOError:
  136.         print 'Could not read the file: %s' % file
  137.         exit(1)
  138.    
  139.     with f:
  140.         while True:
  141.             data = f.read(BUFFER_SIZE)
  142.             if not data:
  143.                 break
  144.             sha1.update(data)
  145.  
  146.     return sha1.hexdigest()
  147.    
  148.  
  149.  
  150. if __name__ == '__main__':
  151.        
  152.     if len(sys.argv) != 2:
  153.         print 'You must submit the path to the binary that will be examined!'
  154.         exit(1)
  155.    
  156.     file_path = sys.argv[1]    
  157.  
  158.     if not os.path.exists(file_path):
  159.         print 'The submited path does not exist. Please check the path and try again.'
  160.         exit(1)
  161.    
  162.     logging.basicConfig(level=logging.INFO)
  163.    
  164.     hash = calculate_sha1(file_path)
  165.     logging.info("Checking availability of sample...")
  166.     available_on_a1000 = rl_a1000_is_available(A1000_HOST, TOKEN, hash)
  167.    
  168.     if not available_on_a1000:
  169.         logging.info('Sending the sample on A1000...')
  170.         response = rl_a1000_upload(A1000_HOST, file_path, TOKEN)
  171.         print(response)
  172.     else:
  173.         logging.info('Sending on reanalyze....')
  174.         response = rl_a1000_reanalyze(A1000_HOST, hash, TOKEN)
  175.         print(response)
  176.  
  177.     response = rl_a1000_processing_status_sample(A1000_HOST, hash, TOKEN)
  178.     json_response = json.loads(response)
  179.    
  180.     count = len(json_response['results'])
  181.  
  182.     while count != 1:
  183.         response = rl_a1000_processing_status_sample(A1000_HOST, hash, TOKEN)
  184.             json_response = json.loads(response)
  185.             count = len(json_response['results'])
  186.         time.sleep(5)  
  187.    
  188.     logging.info('Sample is analyzed...')
  189.     logging.info('Retreiving extracted files from the sample...')
  190.  
  191.     response = rl_a1000_list_of_extracted_files_from_sample(A1000_HOST, hash, TOKEN)   
  192.     print(response)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement