#!/usr/bin/env python

import io
import magic
import hashlib
import zipfile
import logging
import requests
from io import BytesIO
from mwdblib import MWDB
from datetime import datetime, timedelta

requests.packages.urllib3.disable_warnings()

log = logging.getLogger(__name__)

__author__  = 'c3rb3ru5'
__version__ = '1.0.0'


class MWDBFeedsModule():

    """
    A MalwareBazaar Collector Module for mwdb-feeds
    """

    def __init__(self, config, mwdb):
        self.name = 'malwarebazaar'
        self.tag = f'feed:{self.name}'
        self.url = 'https://mb-api.abuse.ch/downloads/'
        self.enabled = self.startup(config)
        self.mwdb = mwdb

    def startup(self, config):
        options = ['days', 'enabled', 'password']
        for option in options:
            if config.has_option(self.name, option) is False:
                log.warning(f'{self.name} section is missing the {option} option')
                return False
        self.config = config
        return self.config.getboolean(self.name, 'enabled')

    def send_zip_contents(self, content) -> bool:
        if magic.from_buffer(content, mime=True) != 'application/zip':
            return False
        z = zipfile.ZipFile(io.BytesIO(content))
        z.setpassword(self.config.get(self.name, 'password').encode())
        for z_file in z.namelist():
            if not z_file.endswith('/'):
                data = z.read(z_file)
                name = hashlib.sha256(data).hexdigest()
                if self.mwdb.query_file(name, raise_not_found=False) is None:
                    log.debug(f'uploading {name}')
                    result = self.mwdb.upload_file(name=name, content=data)
                    result.add_tag(self.tag)
                else:
                    log.debug(f'{name} already exits on the server')
        z.close()
        return True

    def get_urls(self):
        urls = []
        for day in range(1, self.config.getint(self.name, 'days')):
            date = datetime.now() - timedelta(days=day)
            date = date.strftime("%Y-%m-%d")
            urls.append(self.url + date + '.zip')
        return urls

    def main(self) -> dict:
        result = {
            'module': self.name,
            'success': True
        }
        try:
            urls = self.get_urls()
            for url in  urls:
                log.debug(url)
                r = requests.get(url, verify=False)
                if r.status_code == 200:
                    self.send_zip_contents(r.content)
                else:
                    log.error(f'failed with status code {r.status_code}')
        except Exception as error:
            log.error(error)
            result['success'] = False
        return result

#!/usr/bin/env python

import io
import magic
import hashlib
import zipfile
import logging
import requests
from io import BytesIO
from mwdblib import MWDB
from datetime import datetime, timedelta

requests.packages.urllib3.disable_warnings()

log = logging.getLogger(__name__)

__author__  = 'c3rb3ru5'
__version__ = '1.0.0'


class MWDBFeedsModule():

    """
    A MalwareBazaar Collector Module for mwdb-feeds
    """

    def __init__(self, config, mwdb):
        self.name = 'malwarebazaar'
        self.tag = f'feed:{self.name}'
        self.url = 'https://mb-api.abuse.ch/downloads/'
        self.enabled = self.startup(config)
        self.mwdb = mwdb

    def startup(self, config):
        options = ['days', 'enabled', 'password']
        for option in options:
            if config.has_option(self.name, option) is False:
                log.warning(f'{self.name} section is missing the {option} option')
                return False
        self.config = config
        return self.config.getboolean(self.name, 'enabled')

    def send_zip_contents(self, content) -> bool:
        if magic.from_buffer(content, mime=True) != 'application/zip':
            return False
        z = zipfile.ZipFile(io.BytesIO(content))
        z.setpassword(self.config.get(self.name, 'password').encode())
        for z_file in z.namelist():
            if not z_file.endswith('/'):
                data = z.read(z_file)
                name = hashlib.sha256(data).hexdigest()
                if self.mwdb.query_file(name, raise_not_found=False) is None:
                    log.debug(f'uploading {name}')
                    result = self.mwdb.upload_file(name=name, content=data)
                    result.add_tag(self.tag)
                else:
                    log.debug(f'{name} already exits on the server')
        z.close()
        return True

    def get_urls(self):
        urls = []
        for day in range(1, self.config.getint(self.name, 'days')):
            date = datetime.now() - timedelta(days=day)
            date = date.strftime("%Y-%m-%d")
            urls.append(self.url + date + '.zip')
        return urls

    def main(self) -> dict:
        result = {
            'module': self.name,
            'success': True
        }
        try:
            urls = self.get_urls()
            for url in  urls:
                log.debug(url)
                r = requests.get(url, verify=False)
                if r.status_code == 200:
                    self.send_zip_contents(r.content)
                else:
                    log.error(f'failed with status code {r.status_code}')
        except Exception as error:
            log.error(error)
            result['success'] = False
        return result

#!/usr/bin/env python A MalwareBazaar Collector Module for mwdb-feeds