Your IP : 216.73.216.246


Current Path : /proc/self/root/opt/sharedrads/__pycache__/
Upload File :
Current File : //proc/self/root/opt/sharedrads/__pycache__/mail_sources.cpython-313.pyc

�

��}j����SrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK	J
r
 SrSrSSjr
SSjrSS	jrS
rSrSr\S
:Xa\"5 gg)z4List sources of email sent by address and directory.�N)�defaultdict)�ArgumentParserzDaniel Kzdanielk@inmotionhosting.comc	#�# �/nU(a�[R"S5nUHvn[RRU5(d$[	SU35 [
R"S5 [R"US5nUShv�N SSS5 Mx Sn[RRU5(d$[	SU35 [
R"S5 [US	S
9nUShv�N SSS5 gNy![a1n[	SUSU35 [
R"S5 SnAN�SnAff=f!,(df   GM3=fN`![a' [	SU35 [
R"S5 N�[a0n[	SUS
35 [	U5 [	S5 SnAN�SnAff=f!,(df   g=f7f)z$Return iterable over email log linesz/var/log/exim_mainlog?*zCould not find log file: ��rN�Error reading file '�': z/var/log/exim_mainlog�utf-8��encodingzError reading file zReceived decoding error for �:z
continuing...)�glob�os�path�exists�print�sys�exit�gzip�open�OSError�UnicodeDecodeError)�all_logs�log_list�log_file�mail_log�error�es      �/opt/sharedrads/mail_sources.py�email_linesr sz����H���9�9�6�7�� �H��7�7�>�>�(�+�+��1�(��<�=���������8�S�)�X� �'�'�'�*�)�
!�'�H�
�7�7�>�>�(�#�#�
�)�(��4�5������	
�h��	)�X�	#����
*�	)�(��� ��0��
�#�e�W�E�F��H�H�Q�K�K�� ��*�)��
 ���	��'��z�2�3��H�H�Q�K�!�	#��0��
�!�<�=��Q�C�M��/�"�"��	#��

*�	)�s��BG�E�D	�
D�D	�A G�2G�4E�9E�:E�>	G�D	�	
E�'D?�:E�?E�E�
E	�	G�E�.G�
G�	G�&G�;G�G�G�
G�Gc�^�US:Xag/nSU3n[RRU5(d0[SR	X55 [
R"S5 [R"S5n[USS9nUH<nURU5nUcMURURS5S
5 M> S	S	S	5 S
RU5$![a1n[SUSU35 [
R"S5 S	nANOS	nAff=f!,(df   N]=f)zGet domain regex for username�z[^@ ]+z/var/cpanel/users/zBCould not find domains for {}. Invalid cPanel user? Cannot find {}rz^DNS[0-9]*=(.*)$r
rNrrr	�|)rrrr�formatrr�re�compiler�search�append�groupsr�join)�username�domain_list�	user_file�dns_rxr�line�	dns_matchrs        r�get_domainsr18s���2�~���K�$�X�J�/�I�
�7�7�>�>�)�$�$�
�
2�28�&��2M�	
�	�����
�Z�Z�+�
,�F�	
�i�'�	*�h�	� ��"�M�M�$�/�	��(��&�&�y�'7�'7��':�1�'=�>�!�
+��8�8�K� � ��	�	��(���3�u�g�>�?��H�H�Q�K�K��	��

+�	*�s6�D�C � 'C � 
D�*'D�D�D�D�
D,c��[[5n[[5n[[5n[U5nUS:XaSnSnO[S[U5;aUnSnOG[	U[5(dS5eSn[U5n[
R
R
5n	[R"S5n
[R"SRU55n[R"SRU55n[R"SUS	35n
[U5GH�nUS:waURU5(dM"U
RU5(dM:US:�a:UW	[
R
RUS
SS5-
R5:�dMzURUR!55nU(aaS
RUR#S5UR#S55nUU[%UR#S5R'55-UU'URUR!55nU(aEUR#S5nUU[%UR#S5R'55-UU'GMlU
RU5nU(dGM�UR#S5nSU;aGM�UUS-UU'GM� X4U4$)z(Returns touple of dicts of email sourcesr"r�-zTime is not date or numberz#\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}zV(courier|dovecot)_(plain|login):(?P<login>[^@ ]+(@(?P<domain>{}))?) .*for (?P<for>.*)$z<= (?P<sender>[^@]*@[^@ ]+).*(courier|dovecot)_(plain|login):(?P<login>(?!(?P=sender))[^@ ]+(@(?P<sdom>{}))?).*for (?P<for>.*)$zcwd=(?P<directory>/home/z[^ ]*)N�z%Y-%m-%d %H:%M:%Sz{} as {}�login�sender�for�	directoryz/usr/local/cpanel/r)r�intr1�str�
isinstance�datetime�nowr%r&r$r �
startswith�match�strptime�
total_secondsr'�lower�group�len�split)rr+�time�email_logins�working_directories�spoofing�domains�date�duration�target�datetime_rx�login_rx�spoofing_rx�directory_rxr/�rx_match�	logged_in�addressr8s                   r�get_sourcesrUXs����s�#�L�%�c�*���3��H��(�#�G��r�z�����	��D�	�	������$��$�$�B�&B�B�$����t�9���"�"�&�&�(���*�*�C�D�K��z�z�	�$�f�W�o��H��*�*�	�%�f�W�o�	�K��:�:�!9�(��6�J�K�L��H�%���2�:�d�o�o�d�3�3��� � ��&�&���a�<����#�#�,�,�T�#�2�Y�8K�L�M��m�o�	
�
��%�%�d�j�j�l�3���"�)�)����w�'�����)A��I�#+�9�"5�����u�%�+�+�-�9�#�H�Y���?�?�4�:�:�<�0����n�n�W�-�G�$0��$9�C����u�%�+�+�-�=�%�L��!�
��&�&�t�,���8� ���{�3�I�#�y�0��-@��-K�a�-O��	�*��Q&�T
�x�8�8�c�^�[XRS9Hn[XSSU35 M g)z#Print a dictionary sorted by values)�keyz>7�	N)�sorted�getr)�
dictionary�values  r�print_sorted_dictr^�s0���
���7��
��"�2�&�b���0�1�8rVc	��[[S9nURSSSSS9 URSS[S	S
S9 UR	5nURSS
S[SSS9 URSSS[
SSS9 URSSSSS9 UR
5nURnURcSnOURn[R"S5nUR(aSnSnO�URS:wa[URUR5(d.[SUR35 [R "S5 URnO!UR"S:�aUR"nSnOSnX4U4$)zParse command line aruments)�descriptionz-az--all�
store_truez7Search all email logs, rather than only the recent log.)�action�helpr+�USER�?z4Search for only email from a specific cPanel account)�metavar�type�nargsrcz-dz--date�storer"zLSearch for entries from a certain date. Must be in the format of YYYY-MM-DD.)rbrg�defaultrcz-sz	--secondsrzWSearch entries which were made within the specified number of seconds. Overrides --all.z-rz--recentz\Search recent entries, from the last hour. This is the same as -s 3600. Also overrides --allz\d{4}-\d{2}-\d{2}iFz#Date is not in the correct format: r)r�__doc__�add_argumentr:�add_mutually_exclusive_groupr9�
parse_args�allr+r%r&�recentrKr?rrr�seconds)�parser�
time_group�argsrr+�date_rxrFs       rrnrn�s�����
0�F�
������
F�	�������
��
C����4�4�6�J�������
��
3��
�������
��
2��
�������
@�������D��x�x�H��}�}�����=�=���j�j�-�.�G��{�{�����	
���b���}�}�T�Y�Y�'�'��7��	�	�{�C�D��H�H�Q�K��y�y��	
����	��|�|�������t�#�#rVc��[5upn[XU5up4n[S5 [U5 [S5 [U5 [S5 [	U5S:Xd[U5 g[S5 g)zMain function for scriptz
Email Logins:z
Source directories:z
Possibly spoofed emails:rz	No obvious spoofs foundN)rnrUrr^rD)rr+rFrGrHrIs      r�mainrwsn��",���X��4?��D�5�1�\��
�/���l�#�	�
!�"��)�*�	�
&�'��x�=�A���(�#�
�)�*rV�__main__)F)r")Fr"r")rkrrr%rrr<�collectionsr�argparser�
__author__�	__email__r r1rUr^rnrw�__name__�rVr�<module>rsb��:�	�
�	����#�#�
�
�)�	�$#�N!�@L9�^2�Q$�h+�,�z���F�rV