Method crontab

class/btdockerModel/securityModel.py:1238–1311

@name crontab后门检测

()

                            pass

        def crontab():
            """
            @name crontab后门检测
            """
            cron_list = [
                "/etc/crontab", "/etc/cron.hourly", "/etc/cron.daily",
                "/etc/cron.weekly", "/etc/cron.monthly", "/etc/cron.d"
            ]
            environment_regex = '''[a-zA-Z90-9]+\s*=\s*[^\s]+$'''
            cron_regex = '''((\d{1,2}|\*)\s+){5}[a-zA-Z0-9]+\s+(.*)'''
            backdoor_regex_list = [
                # download
                r'''^(wget|curl)\b'''
                # mrig
                r'''^([\w0-9]*mrig[\w0-9]*)\b'''
            ]

            def detect_crontab_content(cron_f):
                """
                @name 检查crontab内容
                """
                result_dict = {}
                for line in cron_f.readlines():
                    # preprocess
                    line = line.strip()
                    line = line.replace("\n", "")
                    # environment
                    if re.match(environment_regex, line): continue
                    m = re.match(cron_regex, line)
                    if m:
                        if len(m.groups()) == 3:
                            cmdline1 = m.group(3)
                            # for backdoor_regex in backdoor_regex_list:
                            #     if re.search(backdoor_regex, cmdline1):
                            #         result_dict[backdoor_regex] = cmdline1
                            for backdoor_regex in backdoor_regex_list1:
                                if re.search(backdoor_regex, cmdline1):
                                    self.send_image_ws(
                                        get,
                                        msg="发现cron后门{}".format(filepath),
                                        detail="发现镜像存在cron后门【{}】，恶意代码内容：<br/>{}".format(filepath,
                                                                                                      self.short_string(
                                                                                                          cmdline1)),
                                        repair="1.进入使用该镜像部署的容器删除文件下的恶意代码<br/>2.排查容器是否已被入侵，更新容器内业务的访问令牌或账号密码<br/>3.建议更换官方镜像或其他可信的镜像部署容器",
                                        status=3
                                    )
                                    result_dict[backdoor_regex] = cmdline1
                        else:
                            continue
                return result_dict

            for cron in cron_list:
                try:
                    # filetype
                    cron_stat = image.stat(cron)
                    if S_ISDIR(cron_stat.st_mode):
                        for root, dirs, files in image.walk(cron):
                            for file in files: