Index: sctry.py =================================================================== --- sctry.py (revision ba17441aef626e29462dd37a6d1d317687b77768) +++ sctry.py (revision 640ed89213ad0086dc8379de00b8d102057ead1f) @@ -1,6 +1,5 @@ #!/usr/bin/env python3 """ -netIntel Client (Fixed + more reliable) -- Sends payload to /receive with X-Env-Token header +POPRAVEN CLIENT со фикс за Sysmon """ @@ -10,43 +9,14 @@ import json import requests -from datetime import datetime +from datetime import datetime, timedelta import psutil import time import subprocess -import getpass - - -# ---------------------------- -# Helpers -# ---------------------------- -def safe_username(): - try: - return os.getlogin() - except Exception: - return getpass.getuser() - - -def get_local_ip_fallback(): - """ - More reliable local IP than socket.gethostbyname(hostname). - """ - try: - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - s.connect(("8.8.8.8", 80)) - ip = s.getsockname()[0] - s.close() - return ip - except Exception: - try: - return socket.gethostbyname(socket.gethostname()) - except Exception: - return "127.0.0.1" - - -# ---------------------------- -# Sysmon-like collector (simulated) -# ---------------------------- +import re +from collections import defaultdict + + class FixedSysmonCollector: - """Simplified collector - works even without Sysmon installed""" + """Симплифициран колектор што работи без инсталиран Sysmon""" def __init__(self): @@ -54,24 +24,24 @@ def collect_sysmon_events(self, limit=50): + """Симулирај Sysmon настани од процеси и мрежа""" events = [] - now = datetime.now() - - try: - # 1) Process events (Event ID 1) + + try: + # 1. Процес настани (Event ID 1 = Process Creation) for proc in psutil.process_iter(['pid', 'name', 'create_time', 'username']): try: pinfo = proc.info - ct = pinfo.get('create_time') - if ct: - create_time = datetime.fromtimestamp(ct) - if (not self.last_collection) or (create_time > self.last_collection): + if pinfo['create_time']: + create_time = datetime.fromtimestamp(pinfo['create_time']) + # Додади само процеси креирани во последните 5 минути + if not self.last_collection or create_time > self.last_collection: events.append({ "event_id": 1, "event_type": "Process Creation", - "message": f"Process created: {pinfo.get('name')} (PID: {pinfo.get('pid')}, User: {pinfo.get('username')})", + "message": f"Process created: {pinfo['name']} (PID: {pinfo['pid']}, User: {pinfo['username']})", "timestamp": create_time.isoformat(), - "process_name": pinfo.get('name'), - "pid": pinfo.get('pid'), - "user": pinfo.get('username'), + "process_name": pinfo['name'], + "pid": pinfo['pid'], + "user": pinfo['username'] }) except (psutil.NoSuchProcess, psutil.AccessDenied): @@ -81,5 +51,5 @@ break - # 2) Network connections (Event ID 3) + # 2. Мрежни конекции (Event ID 3 = Network Connection) for conn in psutil.net_connections(kind='inet'): try: @@ -89,13 +59,11 @@ "event_id": 3, "event_type": "Network Connection", - "message": f"Network {conn.status}: " - f"{conn.laddr.ip if conn.laddr else 'N/A'}:{conn.laddr.port if conn.laddr else 'N/A'} " - f"-> {conn.raddr.ip}:{conn.raddr.port}", - "timestamp": now.isoformat(), + "message": f"Network {conn.status}: {conn.laddr.ip if conn.laddr else 'N/A'}:{conn.laddr.port if conn.laddr else 'N/A'} -> {conn.raddr.ip}:{conn.raddr.port}", + "timestamp": datetime.now().isoformat(), "local_address": f"{conn.laddr.ip}:{conn.laddr.port}" if conn.laddr else None, "remote_address": f"{conn.raddr.ip}:{conn.raddr.port}", "status": conn.status, "pid": conn.pid, - "process_name": proc.name() if proc else "Unknown", + "process_name": proc.name() if proc else "Unknown" }) except (psutil.NoSuchProcess, psutil.AccessDenied): @@ -105,5 +73,5 @@ break - # 3) Performance alerts (optional) + # 3. Системски перформанси настани cpu = psutil.cpu_percent(interval=0.1) if cpu > 80: @@ -112,5 +80,5 @@ "event_type": "High CPU Usage", "message": f"High CPU usage detected: {cpu:.1f}%", - "timestamp": now.isoformat(), + "timestamp": datetime.now().isoformat(), "cpu_percent": cpu }) @@ -122,5 +90,5 @@ "event_type": "High Memory Usage", "message": f"High RAM usage: {ram.percent:.1f}%", - "timestamp": now.isoformat(), + "timestamp": datetime.now().isoformat(), "ram_percent": ram.percent }) @@ -129,15 +97,15 @@ print(f"FixedSysmon error: {e}") - self.last_collection = now + self.last_collection = datetime.now() return events - def collect_network_connections_detailed(self, limit=30): + def collect_network_connections_detailed(self): + """Детални мрежни конекции""" connections = [] - now = datetime.now().isoformat() - try: for conn in psutil.net_connections(kind='inet'): try: proc = psutil.Process(conn.pid) if conn.pid else None + conn_info = { "pid": conn.pid, @@ -145,5 +113,5 @@ "family": str(conn.family), "type": str(conn.type), - "timestamp": now + "timestamp": datetime.now().isoformat() } @@ -159,14 +127,9 @@ if proc: - conn_info["process_name"] = proc.name() - try: - cmd = proc.cmdline() - conn_info["process_cmdline"] = " ".join(cmd) if cmd else None - except Exception: - conn_info["process_cmdline"] = None - try: - conn_info["process_username"] = proc.username() - except Exception: - conn_info["process_username"] = None + conn_info.update({ + "process_name": proc.name(), + "process_cmdline": ' '.join(proc.cmdline()) if proc.cmdline() else None, + "process_username": proc.username() if hasattr(proc, 'username') else None + }) connections.append(conn_info) @@ -175,5 +138,5 @@ continue - if len(connections) >= limit: + if len(connections) >= 30: break @@ -184,31 +147,40 @@ def collect_all_security_data(self): + """Собери сите безбедносни податоци (очекуваниот метод!)""" return { "sysmon_events": self.collect_sysmon_events(limit=50), - "network_connections": self.collect_network_connections_detailed(limit=30), - "file_changes": [], + "network_connections": self.collect_network_connections_detailed(), + "file_changes": [], # Празен лист, можеш да го имплементираш подоцна "collection_time": datetime.now().isoformat() } -# ---------------------------- -# Client -# ---------------------------- class EnhancedFixedClient: - def __init__(self, server_ip="192.168.1.13", port=5555, env_token=None): + def __init__(self, server_ip="192.168.1.13", port=5555): self.server_ip = server_ip self.port = port self.computer_name = socket.gethostname() - self.user = safe_username() - self.sysmon_collector = FixedSysmonCollector() - self.env_token = env_token - - # warmup cpu_percent so it doesn't start at 0 - try: - psutil.cpu_percent(interval=None) - except Exception: - pass + self.user = os.getlogin() + self.sysmon_collector = FixedSysmonCollector() # Користи поправената верзија + + def get_detailed_info(self): + """Собирај подробни податоци""" + info = { + "computer_name": self.computer_name, + "user": self.user, + "ip_address": socket.gethostbyname(self.computer_name), + "os": f"{platform.system()} {platform.release()} {platform.version()}", + "architecture": platform.architecture()[0], + "timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"), + "is_sysmon_available": self._check_sysmon_installed() + } + + info.update(self.get_performance_metrics()) + info.update(self.get_hardware_info()) + + return info def _check_sysmon_installed(self): + """Провери дали Sysmon е инсталиран""" try: if platform.system() == "Windows": @@ -218,16 +190,20 @@ ) return result.returncode == 0 - except Exception: + except: pass return False def get_performance_metrics(self): - try: - cpu_percent = psutil.cpu_percent(interval=0.5) + """Метрики за перформанси - ПОПРАВЕНО БЕЗ DEPRECATION WARNING""" + try: + cpu_percent = psutil.cpu_percent(interval=1) cpu_freq = psutil.cpu_freq() + ram = psutil.virtual_memory() swap = psutil.swap_memory() + disk = psutil.disk_usage("C:/" if platform.system() == "Windows" else "/") + # ДОБАВИ TRY-EXCEPT за disk_io_counters disk_read_mb = 0 disk_write_mb = 0 @@ -237,11 +213,8 @@ disk_read_mb = round(disk_io.read_bytes / (1024 ** 2), 2) disk_write_mb = round(disk_io.write_bytes / (1024 ** 2), 2) - except Exception: + except: pass net_io = psutil.net_io_counters() - - boot_dt = datetime.fromtimestamp(psutil.boot_time()) - uptime_hours = round((datetime.now() - boot_dt).total_seconds() / 3600, 2) return { @@ -262,6 +235,6 @@ "network_packets_sent": net_io.packets_sent, "network_packets_recv": net_io.packets_recv, - "boot_time": boot_dt.strftime("%Y-%m-%d %H:%M:%S"), - "uptime_hours": uptime_hours + "boot_time": datetime.fromtimestamp(psutil.boot_time()).strftime("%Y-%m-%d %H:%M:%S"), + "uptime_hours": round((datetime.now() - datetime.fromtimestamp(psutil.boot_time())).seconds / 3600, 2) } except Exception as e: @@ -270,4 +243,5 @@ def get_hardware_info(self): + """Хардвер информации""" try: partitions = [] @@ -284,7 +258,8 @@ "percent_used": usage.percent }) - except Exception: + except: continue + # Мрежни интерфејси net_if_addrs = psutil.net_if_addrs() interfaces = {} @@ -294,15 +269,8 @@ "family": str(addr.family), "address": addr.address, - "netmask": getattr(addr, "netmask", None) + "netmask": addr.netmask if hasattr(addr, 'netmask') else None } - for addr in addrs if getattr(addr, "address", None) + for addr in addrs if addr.address ] - - batt = None - try: - b = psutil.sensors_battery() - batt = b.percent if b else None - except Exception: - batt = None return { @@ -311,5 +279,6 @@ "disks": partitions, "network_interfaces": interfaces, - "battery_percent": batt, + "battery_percent": psutil.sensors_battery().percent if hasattr(psutil.sensors_battery(), + 'percent') else None, "temperatures": self._get_temperatures() } @@ -319,7 +288,8 @@ def _get_temperatures(self): + """Добиј температури на системот""" try: temps = {} - if hasattr(psutil, "sensors_temperatures"): + if hasattr(psutil, 'sensors_temperatures'): sensors = psutil.sensors_temperatures() for name, entries in sensors.items(): @@ -327,36 +297,38 @@ temps[name] = entries[0].current return temps - except Exception: + except: return {} - def get_detailed_processes(self, limit=100): + def get_detailed_processes(self): + """Детални информации за процесите - ПОПРАВЕНО БЕЗ DEPRECATION WARNING""" processes = [] try: - for proc in psutil.process_iter(['pid', 'name', 'username', 'cpu_percent', 'memory_percent', - 'create_time', 'status']): + for proc in psutil.process_iter(['pid', 'name', 'username', 'cpu_percent', + 'memory_percent', 'create_time', 'status']): try: pinfo = proc.info + + # КОРИСТИ psutil.Process() за да добиеш дополнителни информации with proc.oneshot(): processes.append({ - "pid": pinfo.get("pid"), - "name": pinfo.get("name"), - "user": pinfo.get("username"), - "cpu_percent": pinfo.get("cpu_percent"), + "pid": pinfo['pid'], + "name": pinfo['name'], + "user": pinfo['username'], + "cpu_percent": pinfo['cpu_percent'], "memory_mb": round(proc.memory_info().rss / (1024 ** 2), 2), - "memory_percent": pinfo.get("memory_percent"), - "create_time": datetime.fromtimestamp(pinfo["create_time"]).strftime("%Y-%m-%d %H:%M:%S") - if pinfo.get("create_time") else None, - "status": pinfo.get("status"), - "exe": proc.exe() if hasattr(proc, "exe") else None, - "cmdline": " ".join(proc.cmdline()) if hasattr(proc, "cmdline") else None, - "num_threads": proc.num_threads() if hasattr(proc, "num_threads") else None, - "connections_count": 0 + "memory_percent": pinfo['memory_percent'], + "create_time": datetime.fromtimestamp(pinfo['create_time']).strftime("%Y-%m-%d %H:%M:%S") if + pinfo['create_time'] else None, + "status": pinfo['status'], + "exe": proc.exe() if hasattr(proc, 'exe') else None, + "cmdline": ' '.join(proc.cmdline()) if hasattr(proc, 'cmdline') else None, + "num_threads": proc.num_threads() if hasattr(proc, 'num_threads') else None, + # НЕ КОРИСТИ proc.connections() - тоа е deprecated! + "connections_count": 0 # Стави 0 или избриши го ова поле }) except (psutil.NoSuchProcess, psutil.AccessDenied): continue - except Exception: - continue - - if len(processes) >= limit: + + if len(processes) >= 100: break @@ -366,129 +338,118 @@ return processes - def get_detailed_info(self): - info = { - "computer_name": self.computer_name, - "user": self.user, - "ip_address": get_local_ip_fallback(), - "os": f"{platform.system()} {platform.release()} {platform.version()}", - "architecture": platform.architecture()[0], - "timestamp": datetime.now().isoformat(), - "is_sysmon_available": self._check_sysmon_installed() - } - info.update(self.get_performance_metrics()) - info.update(self.get_hardware_info()) - return info - def collect_and_send(self): - print(f"\n[{datetime.now().strftime('%H:%M:%S')}] 🔍 Collecting...") - + """Собери и испрати сите податоци""" + print(f"\n[{datetime.now().strftime('%H:%M:%S')}] 🔍 Собирање податоци...") + + # Собери сите податоци data = { "info": self.get_detailed_info(), - "processes": self.get_detailed_processes(limit=100), - "security_data": self.sysmon_collector.collect_all_security_data(), + "processes": self.get_detailed_processes(), + "security_data": self.sysmon_collector.collect_all_security_data(), # ОВА СЕГА РАБОТИ! "collection_time": datetime.now().isoformat(), - "client_version": "2.2_fixed" + "client_version": "2.1_fixed" } + # Прикажи основни информации info = data["info"] - sec = data["security_data"] - - print(f" 💻 {info.get('computer_name')} | 👤 {info.get('user')}") - print(f" 📊 CPU {info.get('cpu_usage', 0)}% | RAM {info.get('ram_usage', 0)}% | Disk {info.get('disk_usage', 0)}%") - print(f" 🔄 Processes: {len(data['processes'])}") - print(f" 🛡️ Sysmon events: {len(sec.get('sysmon_events', []))}") - print(f" 🌐 Net conns: {len(sec.get('network_connections', []))}") - - try: - headers = {} - if self.env_token: - headers["X-Env-Token"] = self.env_token - headers["X-Client-Id"] = self.computer_name # optional - - url = f"http://{self.server_ip}:{self.port}/receive" - r = requests.post(url, json=data, headers=headers, timeout=30) - - if r.ok: - resp = r.json() - print(" ✅ Sent OK") - if "sysmon_events_saved" in resp: - print(f" 📝 Saved sysmon: {resp['sysmon_events_saved']}") + sec_data = data["security_data"] + + print(f" 💻 Компјутер: {info['computer_name']}") + print(f" 👤 Корисник: {info['user']}") + print( + f" 📊 CPU: {info.get('cpu_usage', 0)}% | RAM: {info.get('ram_usage', 0)}% | Disk: {info.get('disk_usage', 0)}%") + print(f" 🔄 Процеси: {len(data['processes'])}") + print(f" 🛡️ Sysmon настани: {len(sec_data.get('sysmon_events', []))}") + print(f" 🌐 Мрежни конекции: {len(sec_data.get('network_connections', []))}") + + # Испрати ги податоците + try: + response = requests.post( + f"http://{self.server_ip}:{self.port}/receive", + json=data, + timeout=30 + ) + + if response.status_code == 200: + result = response.json() + print(f" ✅ Податоците се успешно испратени!") + if 'event_count' in result: + print(f" 📝 Зачувани {result['event_count']} Sysmon настани") return True - - # errors - if r.status_code == 401: - try: - msg = r.json() - except Exception: - msg = {"error": r.text[:200]} - print(" 🔒 Token invalid/expired. Generate new token in Admin panel.") - print(f" Server says: {msg}") else: - print(f" ❌ HTTP {r.status_code}: {r.text[:300]}") + print(f" ❌ Грешка: {response.status_code}") + return False + + except Exception as e: + print(f" ❌ Проблем со серверот: {e}") return False - except Exception as e: - print(f" ❌ Connection problem: {e}") - return False - def main(): + """Главна програма""" print("=" * 70) - print("🖥️ netIntel Collector (Fixed)") + print("🖥️ FIXED LAN LOG COLLECTOR v2.1") print("=" * 70) - print(f"Computer: {socket.gethostname()}") - print(f"User: {safe_username()}") - print(f"Local IP: {get_local_ip_fallback()}") + print(f"Компјутер: {socket.gethostname()}") + print(f"Корисник: {os.getlogin()}") + print(f"IP: {socket.gethostbyname(socket.gethostname())}") print("=" * 70) - print("Will send every 30 seconds. Ctrl+C to stop.") + print("Податоците ќе се собираат и испраќаат на секои 30 секунди.") + print("Притисни Ctrl+C за да го прекинеш.") print("=" * 70) - server_ip = input("Server IP (default 192.168.1.13): ").strip() or "192.168.1.13" - env_token = input("ENV TOKEN (from Admin panel): ").strip() - if not env_token: - print("❌ ENV TOKEN is required.") - return - - client = EnhancedFixedClient(server_ip, 5555, env_token=env_token) - - print(f"\n🔌 Testing server {server_ip}...") + # Провери дали серверот е достапен + server_ip = input("Внеси сервер IP (default 192.168.1.13): ").strip() or "192.168.1.13" + + client = EnhancedFixedClient(server_ip) + + # Тест конекција + print(f"\n🔌 Тестирање на врска со серверот {server_ip}...") try: - r = requests.get(f"http://{server_ip}:5555/ping", timeout=5) - if r.ok: - print(" ✅ Server reachable") + response = requests.get(f"http://{server_ip}:5555/ping", timeout=5) + if response.status_code == 200: + print(" ✅ Серверот е достапен!") else: - print(f" ⚠️ Server responded: {r.status_code}") + print(f" ⚠️ Серверот одговори со: {response.status_code}") + confirm = input(" Сакаш ли да продолжиш? (y/n): ").lower() + if confirm != 'y': + return except Exception as e: - print(f" ❌ Can't reach server: {e}") - return + print(f" ❌ Не можам да се поврзам со серверот {server_ip}: {e}") + confirm = input(" Сакаш ли да продолжиш? (y/n): ").lower() + if confirm != 'y': + return try: count = 1 while True: - print(f"\n📤 Transmission #{count}") - client.collect_and_send() + print(f"\n📤 Трансмисија #{count}") + + success = client.collect_and_send() + count += 1 - - print("\n⏳ Waiting 30s...") + print(f"\n⏳ Чекам 30 секунди до следната трансмисија...") + + # Countdown for i in range(30, 0, -1): if i % 10 == 0 or i <= 5: - print(f"\r {i} seconds remaining...", end="") + print(f"\r {i} секунди остануваат...", end="") time.sleep(1) print("\r" + " " * 40 + "\r", end="") except KeyboardInterrupt: - print("\n\n🛑 Stopped.") - print(f"📊 Dashboard/API: http://{server_ip}:5555/") + print("\n\n🛑 Програмата е зајчана.") + print(f"📊 Dashboard: http://{server_ip}:5555/") if __name__ == "__main__": try: - import psutil # noqa - import requests # noqa + import psutil + import requests except ImportError: - print("Install modules:") + print("Инсталирај ги модулите:") print("pip install psutil requests") - input("Press ENTER to exit...") - raise SystemExit(1) + input("Притисни ENTER за излез...") + exit(1) main()