hackedteam/test-av2

#!/usr/bin/python

""" check_infected.py - Checks for synchronization request during update. """

import os
import smtplib

from email.MIMEMultipart import MIMEMultipart
from email.MIMEText import MIMEText

log_file = "/var/log/rcs.log"
detected_file = '/var/log/detected'

def send_mail(line):
    content = "INFECTED MACHINE DETECTED!\n%s" % line
    try:
        msg = MIMEMultipart()
        msg["Subject"] = "AV Monitor Results"
        msg["From"] = "avmonitor@hackingteam.com"
        msg["To"] = "olli@hackingteam.com"
        body = MIMEText(content, 'txt')
        msg.attach(body)
        smtp = smtplib.SMTP("mail.hackingteam.com", 25)
        smtp.sendmail(msg["From"], msg["To"].split(","), msg.as_string())
        smtp.quit()
    except Exception as e:
        print "Impossible to send mail. Exception: %s" % e

def delete_logfile():
    pass

def stop():
    with open(detected_file, 'w') as f:
        f.write("")

def trigger(cont):
    send_mail(cont)
    delete_logfile()
    stop()

def main():
    if os.path.exists(detected_file):
        exit()
    print "not exited"
    if os.path.exists(log_file):
        with open(log_file, "r") as f:
            cont = f.read()
            if "RCS-SYNC" in cont:
                print "--- INFECTED MACHINE DETECTED ---"
                ''' TODO: do something '''
                trigger(cont)

if __name__ == "__main__":
    main()