from pyDes import triple_des,des
from Crypto.Cipher import DES3
from Crypto import Random
from Crypto.Cipher import AES
import re
import base64
import binascii
import magic
ms = magic.open(magic.MAGIC_NONE)
#documents = ("Text","Document")
ms.load()


def java_analysis_bot_sig(file_handle):
  
  try:
    
    print " Inside Java Bot analysis "
    file_name_list = file_handle.namelist()
    print file_name_list
    #Check if key.dat file exist
    for key_name in file_name_list:
      if "key.dat" in key_name:
	#print key_name
	for config_name in file_name_list:
	  if "config.dat" in config_name :
	    print "Jacksbot-G Bot found",key_name," ",config_name
	    return "Jacksbot-G",key_name,config_name
	  if  ("jar.dat" in config_name) or ("enc.dat" in config_name): # or
	    #print "Jacksbot-E Bot found",key_name," ",config_name
	    return "Jacksbot-E",key_name,config_name
	return 
    return
  except Exception as e:
    print "Exception:",e
    pass
  
  
    #jacksbot_decode_key(config_dat,key_dat)

def java_analysis_bot(file_handle):
  jack_bot_found ="" 
  key_name = "" 
  config_name = ""
  try:
    
    jack_bot_found ,key_name,config_name = java_analysis_bot_sig(file_handle)
    print "Found", jack_bot_found ,key_name,config_name
    
  except Exception as e:
    print "Exception in Nothing returned",e
    return
    
  try:
    
    if len(jack_bot_found) >1 :
      print "Inside Bot analysis"
      key_data    = file_handle.read(key_name)
      config_data = file_handle.read(config_name)
      decrypted_data =""
      decrypted_data = jacksbot_extract_key(key_data,config_data)
      #print type(decrypted_data)
      #Check if anything decrypted
      if len(str(decrypted_data)) > 5 :
	
	try:
	  
	
	  print "Back form Decryption, beautfying data"
	  decrypted_data = re.sub(r'[\x00-\x1f\x7f-\xff]', " ", decrypted_data)
	  #print jack_bot_found, decrypted_data.replace("SPLIT", "\n")
	  # , is used to split values with br in the front end
	  return jack_bot_found, decrypted_data.replace("SPLIT", ",")
	
      
        except Exception as e:
	  print "Exception in Beautify",e
	  
      else:
	print "Nothing decrypted"
	return "",""
    
  except Exception as e:
    print "Exception in bot analysis" ,e
    pass
  
  
  
  
  
    
def jacksbot_extract_key(key_data,config_data):
  
  try:
    
    #print key_data,config_data
    print "Module Extract key"
    #print len(key_data), type(key_data)
    if len(key_data) == 24:
      
      print "key is 24 byte:", len(key_data)
      
      #decrypted_data = triple_des_decryption_module(key_data,config_data)
      decrypted_data = triples_des_decrypt(key_data,config_data)
      return decrypted_data
    if len(key_data) == 16:
      print "This could be AES encrypted "
      print "key is 16 byte:" , len(key_data)
      
    
    if len(key_data) > 25 and "=" in key_data:
      print "This key is to be b64_decoded--> hex-decoded "
   
      b64_keys = key_data.split(",")
      for k in b64_keys:
	key_b64_decoded=base64.b64decode(k)
	key_data = binascii.unhexlify(key_b64_decoded)
	#print key_data
	if len(key_data) == 24:
	  print "Key found, decrypting",key_data
	  decrypted_data = triples_des_decrypt(key_data,config_data)
	  
	  file_type = ms.buffer(decrypted_data)
	  print file_type
	  if "Zip" in file_type:
	    import hashlib
	    md5hash = hashlib.md5(decrypted_data).hexdigest()
	    print "Zip File %s, Embedded, Uploading to sandy",md5hash
	    file_view = 'Embedded Jar found: Download :<a href="droped/'+str(md5hash)+'">'+str(md5hash)+'</a>'
	    file_write = open("/var/www/sandy/view/droped/"+md5hash,"w+");
	    file_write.write(decrypted_data)
	    file_write.close()
	    #print file_view
	    return file_view
	  
	  else:
	 
	    return decrypted_data
	  
	
  except Exception as e:
    print "Exception in extract:",e
    pass


def crypto_triple_des_decrypt(key_data,config_data):
  
  key = key_data
  iv = Random.new().read(DES3.block_size)
  cipher = DES3.new(key, DES3.MODE_OFB, iv)
  decrypted_data = iv + cipher.decrypt(config_data)
  #print decrypted_data
  return decrypted_data
  
  

#Decryption using m2crypto module
def triples_des_decrypt(key_data,config_data):
  try:
    
    from M2Crypto import EVP
    dec = 0
    key=key_data
    cipher = EVP.Cipher(alg='des_ede3_ecb', key=key, op=dec,iv='\0'*16)
    decrypted_data = cipher.update(config_data)
    decrypted_data = decrypted_data + cipher.final()
    #print decrypted_data
    return decrypted_data
  except Exception as e:
    print "Exception in Des",e
    pass

def two_des_decrypt(key_data,config_data):
  try:
    
    from M2Crypto import EVP
    dec = 0
    key=key_data
    cipher = EVP.Cipher(alg='des_ede2_ecb', key=key, op=dec,iv='\0'*16)
    decrypted_data = cipher.update(config_data)
    decrypted_data = decrypted_data + cipher.final()
    #print decrypted_data
    return decrypted_data
  except Exception as e:
    print e
    pass
      
#Decryption using pydes module
    
def triple_des_decryption_module(key_data,config_data):
  
  try:
    
    
    des_decryption = triple_des(key_data)
    decrypted_data = des_decryption.decrypt(config_data)
    return decrypted_data
  
  except Exception as e:
    print e
    pass

def des_decryption_module(key_data,config_data):
  
  try:
    
    des_decryption = des(key_data)
    decrypted_data = des_decryption.decrypt(config_data)
    return decrypted_data
  
  except Exception as e:
    print e
    pass    
  


if __name__ == "__main__":
  java_analysis_bot(file_handle)
  ##http://blogs.mcafee.com/mcafee-labs/java-back-door-acts-as-bot
  #