opcache_malware_hunt.py

#!/usr/bin/env python2

# Copyright (c) 2016 GoSecure Inc.

from opcache_disassembler import OPcacheDisassembler
import hashlib
import opcache_parser
import opcache_parser_64
import sys
import os
import subprocess
import shutil
import difflib
import time

hunt_source_files = "hunt_source_files.tmp"
hunt_ini          = "hunt.ini"
hunt_opcache      = "hunt_opcache"
hunt_report       = "hunt_report" + "_" + str(int(time.time()))

def list_opcache_files(path):
    """ List every opcache (.php.bin) file found in a given path """

    opcache_files = []

    # Check if arg[1] is a folder or a file
    if os.path.isdir(path):

        # Iterate through all the files of the folder
        for subdir, dirs, files in os.walk(path):
            for file in files:

                # Only check .php.bin files
                if file.endswith(".php.bin"):
                    file = os.path.join(subdir, file)
                    opcache_files += [file]

    else:
        # Only check .php.bin files
        if path.endswith(".php.bin"):
          opcache_files += [path]

    return opcache_files

def dump_source_file_list(list):
    """ Writes a list of files to the hunt_source_files file"""

    with open(hunt_source_files, 'w') as f:
        for file in list:
            f.write(file + "\n")

def setup_env(phpini_path):
    """ Setup all the files and folders needed for this tool """

    # hunt.ini
    with open(phpini_path, "r") as f:
        with open(hunt_ini, "w") as h:
            for line in f.readlines():

                # opcache.file_cache
                if "opcache.file_cache=" in line:
                    line = "opcache.file_cache=" + os.path.join(os.getcwd(), hunt_opcache)

                # opcache.enable_cli
                if "opcache.enable_cli=" in line:
                    line = "opcache.enable_cli=1"

                # opcache.enable_cli
                if "opcache.enable=" in line:
                    line = "opcache.enable=1"

                if "opcache.file_cache_only=" in line:
                    line = "opcache.file_cache_only=0"

                h.write(line)

    # cache folder location
    os.mkdir(hunt_opcache)
    os.chmod(hunt_opcache, 0o777)

    # report folder
    os.mkdir(hunt_report)

def cleanup():
    """ Cleanup all temporary files and folders """

    # Remove cache folder
    try:
        shutil.rmtree(hunt_opcache)
    except:
        pass

    # Remove hunt.ini
    try:
        os.remove(hunt_ini)
    except:
        pass

    # Remove source files list
    try:
        os.remove(hunt_source_files)
    except:
        pass

def compile_source_files():
    """ Uses the compile.php script to compile each file in the hunt_source_files file"""

    command = "php -c {0} compile.php {1}".format(hunt_ini, hunt_source_files)
    subprocess.call(command.split(), shell=False)

def parse_file(file):
    """ Parse a file and return a construct object """

    return OPcacheParser(file)


def get_literals(parsed_literals):
    """ Extract the literals values from a list of construct objects

        Arguments:
            parsed_literals : A list of construct objects representing literals
    """
    literals = []

    for f in parsed_literals:
        if f.u1.type == 6:
            string = f.string.val
            if string.startswith("\x00"):
                literals += [string[1:-10]] # Trim address from literal

        if f.u1.type == 4:
            literals += [f.value.w1]

    return literals

def get_opcodes(parsed_opcodes):
    """ Extract the opcode values from a list of construct objects

        Arguments:
            parsed_opcodes : A list of construct objects representing opcodes
    """
    return [f.opcode for f in parsed_opcodes]

def get_function(parsed_function):
    """ Extract a function from a construct object

        Arguments:
            parsed_function : A construct object representation a function
    """

    function_name = parsed_function['function_name']['value']['val']
    opcodes = get_opcodes(parsed_function['opcodes'])
    literals = get_literals(parsed_function['literals'])

    return {function_name : { 'opcodes' : opcodes, 'literals' : literals }}

def get_class(parsed_class):
    """ Extract a class from a construct object

        Arguments:
            parsed_class : A construct object representation a class
    """

    if not parsed_class:
        return {}

    classname = parsed_class['name']['value']['val']

    parsed_functions = [f['val']['op_array'] for f in parsed_class['function_table']['buckets']]
    functions = []
    for function in parsed_functions:
        functions += [get_function(function)]

    return { classname : {'functions' : functions}}


def compare_parsed_files(file1, file2):

    """ Compare two parsed files based on opcodes, literals, classes and functions.

        Arguments :
            file1 : A construct object representing an OPcache file
            file2 : A construct object representing an OPcache file
    """

    # Main OP array
    opcodes_1 = get_opcodes(file1['script']['main_op_array']['opcodes'])
    opcodes_2 = get_opcodes(file2['script']['main_op_array']['opcodes'])
    literals_1 = get_literals(file1['script']['main_op_array']['literals'])
    literals_2 = get_literals(file2['script']['main_op_array']['literals'])

    main_op_array_1 = { 'opcodes' : opcodes_1, 'literals' : literals_1 }
    main_op_array_2 = { 'opcodes' : opcodes_2, 'literals' : literals_2 }

    # Function OPcodes
    functions_1 = {}
    functions_2 = {}

    # Functions of file 1
    functions = [f['val']['op_array'] for f in file1['script']['function_table']['buckets']]
    for function in functions:
        functions_1.update(get_function(function))

    # Functions of file 2
    functions = [f['val']['op_array'] for f in file2['script']['function_table']['buckets']]
    for function in functions:
        functions_2.update(get_function(function))

    # Class OPcodes
    classes_1 = {}
    classes_2 = {}

    # Classes of file 1
    classes = [f['val']['class'] for f in file1['script']['class_table']['buckets']]
    for class_ in classes:
        classes_1.update(get_class(class_))

    # Classes of file 2
    classes = [f['val']['class'] for f in file2['script']['class_table']['buckets']]
    for class_ in classes:
        classes_2.update(get_class(class_))

    # OPcodes
    if main_op_array_1 != main_op_array_2:
        return False

    # Functions
    if functions_1 != functions_2:
        return False

    # Classes
    if classes_1 != classes_2:
        return False

    return True

def create_diff_report(file1, file2, file_name, from_desc, to_desc, is_64_bit):

    """ Create a report showing the differences between two files

        Arguments :
            file1 : path to a file to disassemble
            file2 : path to a file to disassemble
            report_name : The name to use for the report
            from_desc : A description of the 'from' element
            to_desc : A description of the 'to' element
    """

    # Disassemble each file and split into lines
    disassembled_1 = OPcacheDisassembler(is_64_bit).disassemble(file1).split("\n")
    disassembled_2 = OPcacheDisassembler(is_64_bit).disassemble(file2).split("\n")

    # Differ
    html_differ = difflib.HtmlDiff()

    # Generate the report and write into a file
    file_name = file_name.replace("/", "%2f") + '.html'
    hash_name = hashlib.sha1(file_name).hexdigest()
    with open(hunt_report + "/" + hash_name + ".html", "w") as f:
	content = html_differ.make_file(disassembled_1, disassembled_2, from_desc, to_desc)
        f.write(content)

    # Return the name of the report
    return (file_name, hash_name + ".html")

def create_index(file_names, report_names):

    """ Create an index file containing the list of all the reports generated by create_diff_report

        Arguments :
            report_names : the list of report names
    """

    # Header
    header = """
    <html>
        <head>
            <title>OPcache Malware Hunt Report</title>
        </head>
        <body>
            <h1>Potentially infected files</h1>
    """

    # The list of links towards each report
    body = "<ul>"
    for index, report_name in enumerate(report_names):
        link = report_name.replace("%2f", "%252f")
        link_name = file_names[index].replace("%2f", "/")[:-5]
        body += "<li><a href='{0}'>{1}</a></li>".format(link, link_name)
    body += "</ul>"

    # Footer
    footer = """
        </body>
    </html>
    """
    with open(hunt_report + "/" + "index.html", "w") as f:
        f.write(header + body + footer)

def show_help():
    """ Show the help menu"""

    print "Usage : {0} [opcache_folder] [-a(86|64)] [system_id] [php.ini] ".format(sys.argv[0])

if __name__ == "__main__":

    if len(sys.argv) < 3:
        show_help()
        exit(0)

    # Remove temporary files and folders
    cleanup()

    # Paths to analyse
    opcache_folder = sys.argv[1]
    architecture = sys.argv[2]
    system_id = sys.argv[3]
    phpini_path = sys.argv[4]

    # Is 64 bit
    is_64_bit = False
    if architecture == "-a64":
        is_64_bit = True
	OPcacheParser = opcache_parser_64.OPcacheParser
    elif architecture == "-a32":
        is_64_bit = False
	OPcacheParser = opcache_parser.OPcacheParser


    # Setup a new phpini for compilation
    setup_env(phpini_path)

    # OPcache file list
    opcache_files = list_opcache_files(opcache_folder)

    # Get location of source folder
    prefix = os.path.commonprefix(opcache_files)
    source_folder = prefix.split(system_id, 1)[1]

    # Source files list
    if len(opcache_files) > 1:
        source_files = [source_folder + file.split(source_folder)[-1][:-4] for file in opcache_files ]
    else:
        source_files = [source_folder[:-4]]

    # Dump source files
    dump_source_file_list(source_files)

    # Compile source files
    compile_source_files()

    # Compare original cache files with new ones
    flagged_files = []
    for idx, file in enumerate(opcache_files):
        new_cache_file = os.path.join(hunt_opcache, system_id)
        new_cache_file += os.path.join(new_cache_file, source_files[idx])
        new_cache_file += ".bin"

        # Parse files
        print "Parsing " + file
        original_file = parse_file(file)

        print "Parsing " + new_cache_file
        new_parsed = parse_file(new_cache_file)

        # Compare files
        if not compare_parsed_files(original_file, new_parsed):
            flagged_files += [(idx, file, new_cache_file)]

    if flagged_files:
        print ""
        print "Potentially infected files : "
        reports = []
	file_names = []
        for idx, file, new_cache_file in flagged_files:
            print " - " + file

            (file_name, report) = create_diff_report(new_cache_file, file, opcache_files[idx], "Source Code", "Cache", is_64_bit)
            reports += [report]
	    file_names += [file_name]

        create_index(file_names, reports)
    else:
        print "No infected files found."

    print ""
    print "Generated report in folder " + hunt_report

    # Remove temporary files and folders
    cleanup()