One Hat Cyber Team

Edit File: CXS.php

<?php

/**
 * CXS
 *
 * @copyright Copyright (c) 2007 DotRoll Kft. (http://www.dotroll.com)
 * @author Zoltán Istvanovszki <zoltan.istvanovszki@dotroll.com>
 * @since 2023-08-17
 * @package CXS_2.0
 */

namespace CXS;

class CXS extends CommonComponent {

/**
	 * Init
	 */
	public function onConstruct() {

}

/**
	 * Get a CXS result
	 * 
	 * @param string $hash
	 * @param string $env
	 */
	public function scan(string $hash, string $env) {
		if ($this->checkHash($hash) === false) {
			return;
		}
		$this->log("Get CXS result $hash via $env");
		$LOGFILE = "/var/log/cxs$env.$hash.log";
		if (\is_file($LOGFILE)) {
			\unlink($LOGFILE);
		}
//		\exec("/usr/bin/ionice -c 2 -n 2 /usr/sbin/cxs --quiet --report $LOGFILE --summary --virusscan --voptions mhexT --exploitscan --nosversionscan --ignore /etc/cxs/cxs.ignore --options MSGchnZDv --MD5 --xtra /etc/cxs/cxs.xtra --script /etc/cxs/htaccessdisable.pl --user $hash");
		\exec("/usr/local/bin/imunify-cxs-wrapper --quiet --report $LOGFILE --summary --virusscan --voptions mhexT --exploitscan --nosversionscan --ignore /etc/cxs/cxs.ignore --options MSGchnZDv --MD5 --xtra /etc/cxs/cxs.xtra --script /etc/cxs/htaccessdisable.pl --user $hash");
		$LOG = \file($LOGFILE);
		if (\is_file($LOGFILE)) {
			\unlink($LOGFILE);
		}
		$newLog = [];
		foreach ($LOG as &$row) {
			$row = \trim($row);
			if (\strpos($row, '# ') !== false) {
				$newLog[\count($newLog) - 1] .= ' ' . $row;
			} else {
				$newLog[] = $row;
			}
		}
		foreach ($newLog as $rowIdx => $row) {
			if (\strpos($row, ' # ') !== false && (\strpos($row, 'Skipped') !== false || \strpos($row, 'Clamd Error for') !== false || \strpos($row, 'Scan Timeout') !== false || \strpos($row, "/home/$hash/mail/") !== false)) {
				unset($newLog[$rowIdx]);
			} elseif (\strpos($row, ' # ') !== false && \strpos($row, 'Suspected exploit file') !== false && \strpos($row, 'social.png') !== false) {
				unset($newLog[$rowIdx]);
			}
		}
		$result = \implode(\PHP_EOL, $newLog);
		$infected = \strpos($result, '# ') !== false ? true : false;

// Save a CXS result
		$report = new \Reports();
		$report->enviroment = $env;
		$report->hostname = \gethostname();
		$report->hash = $hash;
		$report->infected = $infected;
		$report->message = $result;
		$report->save();

// Save a CXS result
		$results = new \Results();
		$results->enviroment = $env;
		$results->hostname = \gethostname();
		$results->hash = $hash;
		$results->infected = $infected;
		$results->message = $result;
		$results->save();

if ($infected === true) {
			// Infected hash
			$this->append($result);
			return;
		}
		$this->append('');
	}

/**
	 * Check a webshost
	 *
	 * @param string $hash Username
	 * @param string $env Enviroment
	 */
	public function check(?string $hash, string $env) {
		if (empty($hash)) {
			return;
		}
		// Get an actual report
		$this->scan($hash, $env);

/* @var $report \Reports */
		$report = \Reports::findFirst([
			'hash = :hash:',
			'bind' => ['hash' => $hash],
			'order' => 'id ASC'
		]);
		/* @var $last \Reports */
		$last = \Reports::findFirst([
			'hash = :hash:',
			'bind' => ['hash' => $hash],
			'order' => 'id DESC'
		]);

if (empty($report->id)) {
			return;
		}
		$excludeUsers = $this->di->get('excludeUsers');
		$excludeUsers->store();
		$this->dispatcher->setParam('jobResponse', $last->message . \PHP_EOL);
		$until = new \DateTime($report->datetime);
		$until->add(new \DateInterval('P3D'));
		if ($last->getInfected() === true) {

$today = \date('Ymd');
			if ($today > 20251218 && $today < 20260106) {
				return;
			}

$this->log("Check CXS hash $hash is infected");
			// get interval days
			$days = (int) (new \DateTime('NOW'))->diff((new \DateTime($report->datetime)))->format('%a');
			// User friendly suspend
			if ($days < 3) {
				// Send e-mail to user
				if ($this->di->get('config')->application->enviroment == 'dotroll') {
					/* @var $ticket \CXS\Ticket */
					$ticket = $this->di->get('ticket');
					$ticket->open('notice', $hash, $last->message, $until->format('Y-m-d H:i:s'));
				} else {
					/* @var $email \CXS\Email */
					$email = $this->di->get('email');
					$email->send('notice', $hash, $last->message, $until->format('Y-m-d H:i:s'));
				}

// Modify account
				/* @var $limit \CXS\Limit */
				$limit = $this->di->get('limit');
				$limit->execute($hash);
			} else {
				/* @var $suspend \CXS\Suspend */
				$suspend = $this->di->get('suspend');
				$suspend->execute($hash, $last->message);

// Karacsonykor csak user limit
				/* @var $limit \CXS\Limit */
				// $limit = $this->di->get('limit');
				// $limit->execute($hash);
			}
		} else {
			if (\is_file("/usr/local/apache/conf/userdata/cxs/$hash.conf") || \is_file("/usr/local/directadmin/data/users/$hash/cxs.conf")) {
				/* @var $unsuspend \CXS\Unsuspend */
				$unsuspend = $this->di->get('unsuspend');
				$unsuspend->execute($hash);
				// Send e-mail to user
				if ($this->di->get('config')->application->enviroment == 'dotroll') {
					/* @var $ticket \CXS\Ticket */
					$ticket = $this->di->get('ticket');
					$ticket->open('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
				} else {
					/* @var $email \CXS\Email */
					$email = $this->di->get('email');
					$email->send('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
				}
			} else {
				/* @var $limit \CXS\Limit */
				$limit = $this->di->get('limit');
				if ($this->getType() == 'DirectAdmin') {
					$paths = \array_map('trim', \file('/etc/exim.blockcracking/script.denied_paths.txt'));
					if (\in_array('^/home/' . $hash . '/.*', $paths)) {
						$limit->restore($hash);
						// Send e-mail to user
						if ($this->di->get('config')->application->enviroment == 'dotroll') {
							/* @var $ticket \CXS\Ticket */
							$ticket = $this->di->get('ticket');
							$ticket->open('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
						} else {
							/* @var $email \CXS\Email */
							$email = $this->di->get('email');
							$email->send('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
						}
					}
				} else {
					/* @var $emaillimit \Emaillimit */
					$emaillimit = \Emaillimit::findFirstByHash($hash);
					if (!empty($emaillimit->elimit)) {
						$limit->restore($hash);
						$limit = null;
						unset($limit);
						// Send e-mail to user
						if ($this->di->get('config')->application->enviroment == 'dotroll') {
							/* @var $ticket \CXS\Ticket */
							$ticket = $this->di->get('ticket');
							$ticket->open('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
						} else {
							/* @var $email \CXS\Email */
							$email = $this->di->get('email');
							$email->send('restore', $hash, $last->message, $until->format('Y-m-d H:i:s'));
						}
					}
				}
			}
			\Reports::findByHash($hash)->delete();
		}
	}
}