cloud_one_antimalware_test.py

from cloud_one_workload_security_demo_utils import sendheartbeat
import zipfile #importing zipfile module
import os
import urllib3
import urllib.request
import urllib.parse
from bs4 import BeautifulSoup
import random
import rarfile

def getfile(http):

    files_url = "http://www.tekdefense.com/downloads/malware-samples/"
    download_base_url = "http://www.tekdefense.com"

    r = http.request('GET', files_url)

    parsed_html = BeautifulSoup(r.data, 'html.parser')

    tempList = parsed_html.body.find_all('h3', attrs={'class': 'title'})

    linksDict = {}

    for link in tempList:

        linksDict.update({link.text: download_base_url + link.find('a').get("href")})

    tempDict = {}

    for link in linksDict.keys():

        if ".exe.zip" not in link:

            tempDict.update({link: linksDict[link]})    
    
    return random.choice(list(tempDict.items()))

# This is the anti-malware test
# It assumes that real-time antimalware is on the system
# It then attempts to download various versions of the eicar file
# If real-time anti-malware is on the system then these tests should trigger events
# The test will also perform a heartbeat to ensure the events get back to 
# Cloud One Workload Security or Deep Security Manager
def antimalwaretest (operating_system):

    userAgent = {'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15'}
    http = urllib3.PoolManager(5, headers=userAgent)

    file = getfile(http)

    fileName = file[0]
    fileUrl = file[1]

    zipPassword = 'infected'

    # Attempt to download the various eicar test files
    print("---Running Anti-Malware Test---")
    print("Downloading Malware -", fileUrl)

    # Download file
    urllib.request.urlretrieve(fileUrl, fileName)

    if fileName.endswith ('.zip'):
        with zipfile.ZipFile(fileName) as file:
            file.extractall (pwd=bytes(zipPassword, 'utf-8'))
    elif fileName.endswith ('.rar'):
        with rarfile.Rarfile (file) as file:
            fileName.extractall(pwd=zipPassword)
    else:
        print('pass')

    #Perform a heartbeat to get the events to Cloud One or Deep Security Manager
    sendheartbeat(operating_system)
    os.remove (fileName)

    # TODO: Needs cleanup of the extracted files

    print ("Remove all Malware Files")