mirror of https://github.com/CIRCL/AIL-framework
54 lines
1.9 KiB
Python
Executable File
54 lines
1.9 KiB
Python
Executable File
#!/usr/bin/env python3.5
|
|
# -*-coding:UTF-8 -*
|
|
|
|
from pymisp.tools.abstractgenerator import AbstractMISPObjectGenerator
|
|
from packages import Paste
|
|
|
|
class AilleakObject(AbstractMISPObjectGenerator):
|
|
def __init__(self, moduleName, path):
|
|
super(AbstractMISPObjectGenerator, self).__init__('ail-leak')
|
|
self.moduleName = moduleName
|
|
self.path = path
|
|
self.paste = Paste.Paste(path)
|
|
self.generate_attributes()
|
|
|
|
def generate_attributes(self):
|
|
self.add_attribute('type', value=self.moduleName)
|
|
self.add_attribute('origin', value=self.paste.p_source)
|
|
self.add_attribute('last-seen', value=self.paste.p_date)
|
|
#self.add_attribute('raw-data', value=self.paste.get_p_content())
|
|
'''
|
|
# duplicated
|
|
duplicate_list = json.loads(paste._get_p_duplicate())
|
|
is_duplicate = True if len(duplicate_list) > 0 else False
|
|
self.add_attribute('duplicate', value=is_duplicate)
|
|
'''
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
import sys
|
|
sys.path.append('../')
|
|
from mispKEYS import misp_url, misp_key, misp_verifycert
|
|
from pymisp import PyMISP
|
|
|
|
pymisp = PyMISP(misp_url, misp_key, misp_verifycert)
|
|
eventID = "9356"
|
|
mispTYPE = 'ail-leak'
|
|
|
|
moduleName = "Credentials"
|
|
path = "/home/sami/git/AIL-framework/PASTES/archive/pastebin.com_pro/2017/08/23/bPFaJymf.gz"
|
|
|
|
misp_object = AilleakObject(moduleName, path)
|
|
print('validate mispobj', misp_object._validate())
|
|
print(misp_object)
|
|
|
|
# Publish object to MISP
|
|
try:
|
|
templateID = [x['ObjectTemplate']['id'] for x in pymisp.get_object_templates_list() if x['ObjectTemplate']['name'] == mispTYPE][0]
|
|
except IndexError:
|
|
valid_types = ", ".join([x['ObjectTemplate']['name'] for x in pymisp.get_object_templates_list()])
|
|
print ("Template for type %s not found! Valid types are: %s" % (mispTYPE, valid_types))
|
|
print(templateID)
|
|
#r = pymisp.add_object(eventID, templateID, misp_object)
|