From 701d771aa509683ad512a7021db61f27055d9965 Mon Sep 17 00:00:00 2001
From: MaximeStor <maximestor@gmail.com>
Date: Sat, 12 Mar 2016 11:21:29 +0100
Subject: [PATCH] Add first version of Source Code

---
 bin/SourceCode.py        | 56 ++++++++++++++++++++++++++++++++++++++++
 bin/packages/modules.cfg |  5 +++-
 files/SourceCode         |  6 +++++
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 bin/SourceCode.py
 create mode 100644 files/SourceCode

diff --git a/bin/SourceCode.py b/bin/SourceCode.py
new file mode 100644
index 00000000..651cd089
--- /dev/null
+++ b/bin/SourceCode.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python2
+# -*-coding:UTF-8 -*
+import time
+from packages import Paste
+from pubsublogger import publisher
+from Helper import Process
+import re
+
+if __name__ == "__main__":
+    publisher.port = 6380
+    publisher.channel = "Script"
+    config_section = "SourceCode"
+    p = Process(config_section)
+    publisher.info("Finding Source Code")
+
+    critical = 0 # AS TO BE IMPORTANT
+
+    shell = "[a-zA-Z0-9]+@[a-zA-Z0-9\-]+\:\~\$"
+    c = "\#include\ \<[a-z\/]+.h\>"
+    php = "\<\?php"
+    python = "import\ [\w]+"
+    bash = "#!\/[\w]*\/bash"
+    javascript = "function\(\)"
+    ruby = "require \ [\w]+"
+    adr = "0x[a-f0-9]{2}"
+    #asm = "\"((?s).{1}x[0-9a-f]{2}){3,}" ISSUES WITH FINDALL, pattern like \x54\xaf\x23\..
+ 
+    languages = [shell, c, php, bash, python, javascript, bash, ruby, adr]
+    regex = '|'.join(languages)
+    print regex
+
+    while True:
+        message = p.get_from_set()
+        if message is None:
+            publisher.debug("Script Credential is Idling 10s")
+            print('Sleeping')
+            time.sleep(10)
+            continue
+
+        filepath, count = message.split()
+
+        paste = Paste.Paste(filepath)
+        content = paste.get_p_content()
+        match_set = set(re.findall(regex, content))
+        if len(match_set) == 0:
+            continue
+
+        to_print = 'SourceCode;{};{};{};{}'.format(paste.p_source, paste.p_date, paste.p_name, message)
+
+	print filepath
+	print(match_set)
+
+        if len(match_set) > critical:
+            publisher.warning(to_print)
+        else:
+            publisher.info(to_print)
diff --git a/bin/packages/modules.cfg b/bin/packages/modules.cfg
index 04887d09..94a2fee4 100644
--- a/bin/packages/modules.cfg
+++ b/bin/packages/modules.cfg
@@ -27,7 +27,7 @@ subscribe = Redis_Words
 
 [Categ]
 subscribe = Redis_Global
-publish = Redis_CreditCards,Redis_Mail,Redis_Onion,Redis_Web,Redis_Credential
+publish = Redis_CreditCards,Redis_Mail,Redis_Onion,Redis_Web,Redis_Credential,Redis_SourceCode
 
 [CreditCards]
 subscribe = Redis_CreditCards
@@ -56,5 +56,8 @@ subscribe = Redis_Credential
 [Phone]
 subscribe = Redis_Global
 
+[SourceCode]
+subscribe = Redis_SourceCode
+
 [Keys]
 subscribe = Redis_Global
diff --git a/files/SourceCode b/files/SourceCode
new file mode 100644
index 00000000..24cebcb2
--- /dev/null
+++ b/files/SourceCode
@@ -0,0 +1,6 @@
+CVE
+exploit
+vulnerability
+payload
+uname
+gcc