From f40eaaf65092be344f2e21af37e7baa6d4fb9183 Mon Sep 17 00:00:00 2001 From: Davide Arcuri Date: Tue, 13 Feb 2024 09:34:46 +0100 Subject: [PATCH] maxmind info --- .gitignore | 3 ++ CHANGELOG.md | 7 +++ compose/local/django/Dockerfile | 3 ++ compose/local/maxmind/README.txt | 5 ++ orochi/static/css/style.css | 4 ++ orochi/templates/website/index.html | 36 +++++++++++-- .../templates/website/partial_analysis.html | 2 +- orochi/templates/website/partial_indices.html | 2 +- .../{partial_vt.html => partial_json.html} | 8 +-- orochi/utils/volatility_dask_elk.py | 10 ++-- orochi/website/urls.py | 1 + orochi/website/views.py | 52 ++++++++++++++++++- requirements/base.txt | 4 +- 13 files changed, 118 insertions(+), 19 deletions(-) create mode 100644 compose/local/maxmind/README.txt rename orochi/templates/website/{partial_vt.html => partial_json.html} (70%) diff --git a/.gitignore b/.gitignore index 96812249..21d1c867 100644 --- a/.gitignore +++ b/.gitignore @@ -272,3 +272,6 @@ compose/local/clamav/freshclam.conf # History .history orochi/utils/test.py +compose/local/maxmind/GeoLite2-ASN.mmdb +compose/local/maxmind/GeoLite2-City.mmdb +compose/local/maxmind/GeoLite2-Country.mmdb \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index f1556c24..5e9b1308 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ ## Changelog + +
+ OROCHI 2.2.0 + + * ADD more info on foreign addr in netstat [[#494](https://github.com/LDO-CERT/orochi/issues/494)] +
+
OROCHI 2.1.0 [2024/02/12] diff --git a/compose/local/django/Dockerfile b/compose/local/django/Dockerfile index ec13df63..485c6051 100644 --- a/compose/local/django/Dockerfile +++ b/compose/local/django/Dockerfile @@ -69,6 +69,9 @@ RUN pip install -r /requirements/local.txt --ignore-installed ruamel.yaml COPY ./compose/local/__init__.py /src/volatility3/volatility3/framework/constants/__init__.py +RUN mkdir /maxmind +COPY ./compose/local/maxmind /maxmind + WORKDIR /app COPY . . COPY ./compose/local/django/entrypoint /entrypoint diff --git a/compose/local/maxmind/README.txt b/compose/local/maxmind/README.txt new file mode 100644 index 00000000..fad78019 --- /dev/null +++ b/compose/local/maxmind/README.txt @@ -0,0 +1,5 @@ +MAXMIND MMDB FILES +=================================================================== + +In order to update MaxMind database you should download them from a workstation with Internet connection. +This is necessary because you must download databases from https://www.maxmind.com/en/accounts/851360/geoip/downloads after login with a proper account. diff --git a/orochi/static/css/style.css b/orochi/static/css/style.css index eebad8ef..5b908ac8 100644 --- a/orochi/static/css/style.css +++ b/orochi/static/css/style.css @@ -25,6 +25,10 @@ a.navbar-brand { padding-bottom: 0px; } +.list-group-item { + background-color: rgba(var(--bs-tertiary-bg-rgb),var(--bs-bg-opacity))!important; +} + /******************************************************** MOVE DOWN FROM TITLE [OVVERRIDE DASHBOARD] ********************************************************/ diff --git a/orochi/templates/website/index.html b/orochi/templates/website/index.html index eaf10274..fef48c79 100644 --- a/orochi/templates/website/index.html +++ b/orochi/templates/website/index.html @@ -11,7 +11,7 @@ {% endblock %} {% block sidebar %} -
+
dumps
- 
-        
-            {{data | pprint}}
-        
-
+ 
{{data | pprint}}
diff --git a/orochi/utils/volatility_dask_elk.py b/orochi/utils/volatility_dask_elk.py index 7ec5ed0c..eaf0ba83 100644 --- a/orochi/utils/volatility_dask_elk.py +++ b/orochi/utils/volatility_dask_elk.py @@ -62,6 +62,7 @@ RESULT_STATUS_DISABLED, RESULT_STATUS_EMPTY, RESULT_STATUS_ERROR, + RESULT_STATUS_NOT_STARTED, RESULT_STATUS_RUNNING, RESULT_STATUS_SUCCESS, RESULT_STATUS_UNSATISFIED, @@ -324,10 +325,6 @@ def run_regipy(filepath): logging.error(e) -def run_maxmind(filepath): - pass - - def send_to_ws(dump, result=None, plugin_name=None, message=None, color=None): """ Notifies plugin result to websocket @@ -876,7 +873,10 @@ def unzip_then_run(dump_pk, user_pk, password, restart): if restart: tasks_list = tasks_list.filter(plugin__pk__in=restart) for result in tasks_list: - if result.result != RESULT_STATUS_DISABLED: + if result.result not in [ + RESULT_STATUS_DISABLED, + RESULT_STATUS_NOT_STARTED, + ]: task = dask_client.submit( run_plugin, dump, result.plugin, None, user_pk ) diff --git a/orochi/website/urls.py b/orochi/website/urls.py index dbcc287c..820714f7 100644 --- a/orochi/website/urls.py +++ b/orochi/website/urls.py @@ -69,6 +69,7 @@ def to_url(self, value): # CHANGELOG path("changelog", views.changelog, name="changelog"), # EXTERNAL VIEW + path("maxmind", views.maxmind, name="maxmind"), path("json_view/", views.json_view, name="json_view"), path("hex_view/", views.hex_view, name="hex_view"), path("get_hex/", views.get_hex, name="get_hex"), diff --git a/orochi/website/views.py b/orochi/website/views.py index c3fb04c3..2f9cb0ce 100644 --- a/orochi/website/views.py +++ b/orochi/website/views.py @@ -14,6 +14,7 @@ from urllib.request import pathname2url import elasticsearch +import geoip2.database import magic import requests from dask.distributed import Client, fire_and_forget @@ -32,6 +33,7 @@ from django.utils.text import slugify from elasticsearch import Elasticsearch from elasticsearch_dsl import Search +from geoip2.errors import GeoIP2Error from guardian.shortcuts import assign_perm, get_objects_for_user, get_perms, remove_perm from pymisp import MISPEvent, MISPObject, PyMISP from pymisp.tools import FileObject @@ -508,10 +510,21 @@ def analysis(request): continue elif res.result != RESULT_STATUS_DISABLED and columns == []: columns = ["Disabled"] + + maxmind = ( + os.path.exists("/maxmind/GeoLite2-ASN.mmdb") + or os.path.exists("/maxmind/GeoLite2-City.mmdb") + or os.path.exists("/maxmind/GeoLite2-Country.mmdb") + ) return render( request, "website/partial_analysis.html", - {"note": note, "columns": columns, "plugin": plugin.name}, + { + "note": note, + "columns": columns, + "plugin": plugin.name, + "maxmind": maxmind, + }, ) # SEARCH FOR ITEMS AND KEEP INDEX @@ -582,13 +595,48 @@ def change_keys(obj): ############################## # SPECIAL VIEWER ############################## +@login_required +def maxmind(request): + """Use maxmind mmdb to lookup ip information""" + if ( + not Path("/maxmind/GeoLite2-ASN.mmdb").exists() + and not Path("/maxmind/GeoLite2-City.mmdb").exists() + and not Path("/maxmind/GeoLite2-Country.mmdb").exists() + ): + raise Http404("404") + + try: + ip = request.GET.get("ip") + data = {} + if Path("/maxmind/GeoLite2-ASN.mmdb").exists(): + with geoip2.database.Reader("/maxmind/GeoLite2-ASN.mmdb") as reader: + data.update(reader.asn(ip).raw) + if Path("/maxmind/GeoLite2-City.mmdb").exists(): + with geoip2.database.Reader("/maxmind/GeoLite2-City.mmdb") as reader: + data.update(reader.city(ip).raw) + if Path("/maxmind/GeoLite2-Country.mmdb").exists(): + with geoip2.database.Reader("/maxmind/GeoLite2-Country.mmdb") as reader: + data.update(reader.country(ip).raw) + return render( + request, + "website/partial_json.html", + {"data": data, "title": "Maxmind Info"}, + ) + except (GeoIP2Error, Exception): + raise Http404("404") + + @login_required def vt(request): """show vt report in dialog""" path = request.GET.get("path") if Path(path).exists(): data = json.loads(open(path, "r").read()) - return render(request, "website/partial_vt.html", {"data": data}) + return render( + request, + "website/partial_json.html", + {"data": data, "title": "VirusTotal Report"}, + ) raise Http404("404") diff --git a/requirements/base.txt b/requirements/base.txt index ce1fb098..ec2dd049 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -98,7 +98,7 @@ tornado==6.4 # ------------------------------------------------------------------------------ # https://github.com/volatilityfoundation/ # volatility3==2.5.0 --e git+https://github.com/volatilityfoundation/volatility3.git@497d291ef4393e2580052a3dfddbef10e4dc2338#egg=volatility3 volatility3 +-e git+https://github.com/volatilityfoundation/volatility3.git@6d34e43667a4f709902f3c157a4e54ec4ed679ce#egg=volatility3 volatility3 # https://github.com/VirusTotal/yara-python #yara-python==4.1.0 # https://github.com/Viicos/clamdpy @@ -113,6 +113,8 @@ capstone==5.0.1 jsonschema==4.21.1 # https://github.com/Legrandin/pycryptodome pycryptodome==3.20.0 +# https://github.com/maxmind/GeoIP2-python +geoip2==4.8.0 # Yara # ------------------------------------------------------------------------------