#!/usr/bin/perl
print "Content-type: text/html \n\n";

use IO::File;
use Fcntl;
use Socket;
use File::stat;
use Time::localtime;
use Time::Local;
use strict;

my ($time,$date,$ip,$key,$abs_start,$K,$tm);
my ($line,$i,$date_time,$j,$p,$p1,$p2,$p3,$p4,$p5,$p6,$p7,$p8,$ppp,$pip);
my ($N1,$N2,$ip1,$ip2,$ip3,$N3,$ip4,$N4,$ip5,$N5,$ip6,$N6,$ip7,$N7,$ip8,$N8);
my @mons=("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec");
my (@LL,@NNN,@recs,@MM,@nums,@L,@ill);
my ($cur_TIME,$length,$sum,$ipi,$Ni);
my ($year,$month,$day,$hours,$mins,$secs,$c_date);
my ($dev,$ino,$mode,$lins);
my ($nm,$marker,$ip_adr,$where);

my $ilm=0;			# Illegal method arracks number
my $slash=0;			# Multiple slash attacks number
my $i=0;
my $k=0;
$lins=0;			# The number of "Deny from IP" in <server_status.txt>

#########################################################
# Yu. Semenov 04-Sep-2011				#
# Development of the log-files:				#
# <ip_log.txt> IP number (from secur.pl)		#
# <ip_secure.txt> (all IPs with the same format);	# 
# <ip_secure.txt> - secure-log-lines			#
# <slash.txt> (time-mark number)			#
# <ip_atck_acc.txt> - IP Number				#
# <il_ip_meth.txt> IP Number				#
# <il_meth_text.txt> - log-file lines			#
# <ip_attack_er.txt> -	IP Number			#
# <ip_atck_er.txt> - H:M:S - 0 or IP N			#
# attack analyses					#
# and forming the file 					#
# <server_status.txt> The first line contains		#
# number of lines. Zero means no status lines		#
# Status-lines contains 3 component:			#
# Date_time status_code IP-address			#
#							#
# Status_code = 1 - pass-guessing;			#
# Status_code = 2 - slash-attack;			#
# Status_code = 3 - Illegal method;			#
# Status_code = 4 - search of vulnerable file;		#
#########################################################
#print "ANALYS_ATK\n";
for($i=0;$i<100;$i++)	{ $recs[$i]=""; }			# Clear records-array

# OUTPUT-files

$p1="/home/httpd/htdocs/saturn/attacks/ids/server_status.txt";	# <server_status.txt>
sysopen(p_stat,$p1,O_RDWR|O_TRUNC) or die "Can't start tst1: $!\n";# open output <server_status.txt>

$p2="/home/httpd/htdocs/saturn/attacks/ids/attackers.txt";	# out file <attackers.txt>
sysopen(patk, $p2, O_RDWR|O_APPEND|O_CREAT) or die "Can't start tst2: $!\n";	# open output <attackers.txt>

# INPUT-files

$p3="/home/httpd/htdocs/saturn/attacks/ids/ip_atck_acc.txt";	# Slash-attacks (IP - Num)
sysopen(Ssl, $p3, O_RDWR) or die "Can't start tst3: $!\n";	# open input <ip_atck_acc.txt> file

$p7="/home/httpd/htdocs/saturn/attacks/ids/il_ip_meth.txt";	# input file <il_ip_meth.txt> (ILL-Meth)
sysopen(Film, $p7, O_RDWR) or die "Can't start tst7: $!\n";	# open status-file <il_ip_meth.txt>

$p8="/home/httpd/htdocs/saturn/attacks/ids/ip_attack_er.txt";	# input file <ip_attack_er.txt>
sysopen(Fipe, $p8, O_RDWR) or die "Can't start tst8: $!\n";	# Open file <ip_attack_er.txt>

$pip="/home/httpd/htdocs/saturn/attacks/ids/ip_log.txt";	# Filtered Log-file (SECURE)
sysopen(Fip, $pip, O_RDWR) or die "Can't start tst10: $!\n";	# Open file <ip_log.txt>

#################################################
# SECURE-analyses (secur.pl) & secur_cur.pl	#
# ip_log.txt & ip_atk_sec.txt			#
# PASS-word guessing				#
#################################################
# Current Date_time calculation	($c_date)	#
#################################################
$tm=localtime;
$secs=$tm->sec;
$mins=$tm->min;
$hours=$tm->hour;
$year=$tm->year+1900;
$month=$tm->mon+1;
$day=$tm->mday;
$c_date=$year."-".$month."-".$day." ".$hours.":".$mins.":".$secs;
#print "DATE=",$c_date,"\n";
$line=readline(Fip);			# read line of <ip_log.txt> SECURE
chop $line;				#
@LL=split/\s+/,$line;
$ip1=$LL[0];				# The most popular IP in SECURE
$N1=$LL[1];				# Attack number
#print "SECURE=",$line,"\n";
if($N1>5)	{			# If # attacks > 5 (PASS guessing)	#########
print patk $c_date," SEC1 ",$ip1," ",$N1,"\n";						#
$line=readline(Fip);			# read line of <ip_log.txt> SECURE		#
chop $line;				#						#
@LL=split/\s+/,$line;									#
$ip2=$LL[0];				# The most popular IP in SECURE			#
$N2=$LL[1];				# Attack number					#
$recs[$lins]=$c_date." 1 ".$ip1;	# <1> means PASS-problem			#
$lins++;				# If # attacks >1, line counter 1 upgrade	#
if($N2>5){               		# If # attacks > 5 (pass guessing) ######	#
$recs[$lins]=$c_date." 1 ".$ip2;	# <1> means secure-attack		#	#
$lins++;				#					#	#
print patk $c_date," SEC2 ",$ip2," ",$N2,"\n"; # putting down to attackers.txt	#	#
	 }				# 				#########	#
	 }				#			#########################

close(Fip);

#########################################
# ACCESS_LOG analyses (access_cur.pl)	#
# <ip_atck_acc.txt> & <il_ip_meth.txt>	#
#########################################

$line=readline(Ssl);			# Slash-attack-event analyses (<ip_atck_acc.txt>)
chop $line;				#
@LL=split/\s+/,$line;
$ip3=$LL[0];				# IP
$N3=$LL[1];				# Attack number
#print "Slash=",$line,"\n";
if($N3>5)	{			# Test slash-attack threthold (=10)	#################
print patk $c_date," Slash1 ",$ip3," ",$N3,"\n";    # to <attackers.txt>			#
$line=readline(Ssl);			# <ip_atck_acc.txt>					#
chop $line;											#
@LL=split/\s+/,$line;										#
$ip4=$LL[0];											#
$N4=$LL[1];											#
$recs[$lins]=$c_date." 2 ".$ip3;	# <2> means slash-attack				#
$lins++;											#
												#
if($N4>5)	{               	# If # attacks > 10		#################	#
$recs[$lins]=$c_date." 2 ".$ip4;	# <2> means slash-attack			#	#
		 $lins++;		#						#	#
print patk $c_date," Slash2 ",$ip4," ",$N4,"\n"; # putting down into <attackers.txt>	#	#
		}							#################	#
		}								#################
close(Ssl);

$line=readline(Film);			# Illegal METHOD-event analyses
chop $line;				# <il_ip_meth.txt>
@LL=split/\s+/,$line;			#
$ip5=$LL[0];				# The most popular IP for ill-methods
$N5=$LL[1];				# Attack number
#print "FILM=",$line,"\n";		#
if($N5>6){               		# If # attacks > 6		#################
$recs[$lins]=$c_date." 3 ".$ip5;	# <3> means illegal request method		#
print patk $c_date," IL_meth1 ",$ip5," ",$N5,"\n";    # to attackers			#
	  $lins++;			#						#
$line=readline(Film);			# 						#
chop $line;				#						#
@LL=split/\s+/,$line;			#						#
$ip6=$LL[0];				#						#
$N6=$LL[1];				#						#
if($N6>6){               		# If # attacks > 6 (ill METHOD)	#########	#
$recs[$lins]=$c_date." 3 ".$ip6;	#					#	#
print patk $c_date," IL_meth2 ",$ip6," ",$N6,"\n";    # put into attackers.txt	#	#
	  $lins++;			#					#	#
	 }				#########################################	#
	 }				#				#################

close(Film);

##################################################
# ERROR_LOG analyses (error.pl & error_short.pl	#
# ip_attacks.txt & ip_atck_er.txt (-)		#
##################################################

$line=readline(Fipe);		# Looking for files with known vulnerability
chop $line;				# remove end CR
@LL=split/\s+/,$line;		# Convert line into word array
#print "FIPE=",$line,"\n";
$ip7=$LL[0];				# The most popular IP for 
$N7=$LL[1];				# Attack number
if($N7>10){                	# If # attacks > 10		#################
print patk $c_date," Vuln_File1 ",$ip7," ",$N7,"\n";	# to attackers		#
$recs[$lins]=$c_date." 4 ".$ip7;# <4> means search of vulnerable file		#
$lins++;									#
$line=readline(Fipe);		# <ip_attack_er.txt>				#
chop $line;									#
@LL=split/\s+/,$line;								#
$ip8=$LL[0];									#
$N8=$LL[1];									#
if($N8>10) {               	# If # attacks > 10	#################	#
$recs[$lins]=$c_date." 4 ".$ip8;					#	#
print patk $c_date," Vuln_File2 ",$ip8," ",$N8,"\n";    # to attackers	#	#
	   $lins++;							#	#
	   }						#################	#
	   }						#########################
close(Fipe);

###########################################
# Upgrating the file <server_status.txt>  #
###########################################
#print "Lines=",$lins,"\n";
#print "L=",$recs[$lins-1],"\n";
if($lins>0)	{		# If number of deny-records > 0	#########
print p_stat $lins,"\n";						#

for($i=0;$i<$lins;$i++)	{						#
print p_stat $recs[$i],"\n";	# writing into <server_status.txt>	#
			}						#
#print "APACHE_RECON\n";
do "/home/crontab_files/apache_recon.pl";				#
		}						#########
close(patk);
close(p_stat);
exit(0);

