使用Go开发一款调用各大杀毒软件的脚本

显示全部楼层 · 发表于 2024-3-29 11:06:13

因业务需要，领导让我收集市面上的杀毒软件命令行版本，目前已收集到Kaspersky、Microsoft_ Defender、Avast、Emsisoft、DrWeb、Sophos、Norton、ESET、ikarust、AdAware、clamav。欢迎大佬们补充。以下为客户端agent源码，小白水平，多多提建议。

package main
import (
"bytes"
"context"
"crypto/sha256"
"encoding/hex"
"errors"
"fmt"
_ "github.com/go-sql-driver/mysql"
"github.com/labstack/echo"
"github.com/labstack/echo/middleware"
"golang.org/x/text/encoding/simplifiedchinese"
"io"
"io/ioutil"
"log"
"net/http"
"os"
"os/exec"
"path/filepath"
"regexp"
"strings"
"time"
)
type avinfo struct {
//DisplayIcon string
Filename string
Virus string
Antivirus_name string
VirusClass string
Status string
UploadTime string
Hash256 string
//UninstallString string
}
func main() {
e := echo.New()
e.Use(middleware.Logger())
e.Use(middleware.Recover())
e.POST("/upload", uploadFile)
e.Logger.Fatal(e.Start(":8080"))
//log.Printf("class:%s", virusClass)
}
func uploadFile(c echo.Context) error {
// Get file from request
file, err := c.FormFile("file")
if err != nil {
return err
}
// Open the file
src, err := file.Open()
if err != nil {
return err
}
defer src.Close()
// Destination file path
dstPath := filepath.Join("C:\\Users\\admin\\Desktop\\test\\tmp", file.Filename)
// Create destination file
dst, err := os.Create(dstPath)
if err != nil {
return err
}
defer dst.Close()
// Copy the file content to the destination file
if _, err = io.Copy(dst, src); err != nil {
return err
}
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
defer cancel()
//virusClass, isVirus, err := avast(ctx, dstPath)
virusClass, isVirus, err := Microsoft_Defender(ctx, dstPath)
//log.Printf("class:%s\n, isVirus:%t\n, err:%v\n", virusClass, isVirus, err)
now := time.Now()
format1 := now.Format("2006/01/02 15:04")
file1, err := os.Open(dstPath)
defer file1.Close()
if err != nil {
fmt.Errorf("读取文件失败！")
}
hash := sha256.New()
if _, err := io.Copy(hash, file1); err != nil {
log.Fatal(err)
}
sum := hash.Sum(nil)
hash256 := hex.EncodeToString(sum[:])
u := &avinfo{
Filename: file.Filename,
Virus: isVirus,
VirusClass: virusClass,
Antivirus_name: "Microsoft_Defender",
Status: "finshed",
UploadTime: format1,
Hash256: hash256,
}
// Return success message
//dbinsert(u.Filename, u.Virus, u.VirusClass, u.Antivirus_name, u.Status)
return c.JSON(http.StatusOK, u)
}
func kaspersky(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("avp.com", "SCAN", "/i0", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "suspicion") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`suspicion\s+(.+)`)
matches := exp.FindStringSubmatch(outStr)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func avast(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("ashcmd.exe", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if strings.Contains(outStr, "OK") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(strings.Replace(filePath, `\`, `\\`, -1) + `(.+)`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
str := filterString(matches[0])
return strings.Replace(str, filePath, ``, -1), "true", nil
}
func eset(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("ecls.exe", "/files", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "威胁") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`威胁="([^"]+)"`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func emsisoft(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("a2cmd.exe", "/files", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "detected:") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`detected:([^"]+)Scanned`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func clamav(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("clamscan", "-r", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if strings.Contains(outStr, "OK") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(filePath + ":" + ` ([^"]+)` + "FOUND")
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func ikarust(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("t3scan_w64.exe", filePath)
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "found") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`'([^"]+)'`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func AdAware(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("AdAwareCommandLineScanner.exe", "--scan-result-stdout", "--custom", filePath)
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "ScanStatus="Infected"") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`ThreatName="([^"]+)"`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func Sophos(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("SophosInterceptXCLI.exe", "scan", filePath, "--noui")
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "type:") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`\(Detected as '([^"]+)' type`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func Drweb(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("dwscancl.exe", filePath, "/RP:C:\\Users\\CNIX\\Desktop\\drweb\\file.log")
_, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
filePath1 := "C:\\Users\\CNIX\\Desktop\\drweb\\file.log"
// 打开文件
file, err := os.Open(filePath1)
if err != nil {
fmt.Println("打开文件失败:", err)
return "", "", nil
}
defer file.Close()
// 读取文件内容
content, err := ioutil.ReadAll(file)
if err != nil {
fmt.Println("读取文件失败:", err)
return "", "", nil
}
// 正则表达式匹配
pattern := "infected with"
match := regexp.MustCompile(pattern).Match(content)
// 输出结果
if !match {
return "", "false", nil // no virus
}
// 正则表达式模式
pattern1 := `infected with (\S+)`
// 编译正则表达式
regexpPattern := regexp.MustCompile(pattern1)
// 使用正则表达式查找所有匹配项
matches := regexpPattern.FindAllStringSubmatch(string(content), -1)
// 输出匹配结果
x := string("")
for _, match := range matches {
if len(match) > 1 {
// 第一个捕获组的内容
result := match[1]
x = result
}
}
return x, "true", nil
}
func Norton(ctx context.Context, filePath string) (string, string, error) {
log.Println(filePath)
cmd := exec.Command("navw32.exe", filePath)
now := time.Now()
format2 := now.Format("2006/01/02 15:04")
log.Println(format2)
_, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
//cmd1 := exec.Command("MCUI32.exe /export C:\\Users\\CNIX\\Desktop\\norton\\log.txt")
//xx, err := cmd1.CombinedOutput()
//if err != nil {
//
// exitErr := &exec.ExitError{}
// if !errors.As(err, &exitErr) {
// return "", "false", fmt.Errorf("exec failed: %w", err)
// }
//}
//log.Println(xx)
// 文件路径
filePath1 := "C:\\Users\\CNIX\\Desktop\\norton\\log.txt"
// 打开文件
file, err := os.Open(filePath1)
if err != nil {
fmt.Println("打开文件失败:", err)
return "", "", nil
}
defer file.Close()
// 读取文件内容
content, err := ioutil.ReadAll(file)
if err != nil {
fmt.Println("读取文件失败:", err)
return "", "", nil
}
// 正则表达式匹配
pattern := format2
match := regexp.MustCompile(pattern).Match(content)
// 输出结果
if !match {
return "", "false", nil // no virus
}
// 正则表达式模式
pattern1 := format2 + `(\S+) 检测方自动防护,已阻止,已解决`
// 编译正则表达式
regexpPattern := regexp.MustCompile(pattern1)
// 使用正则表达式查找所有匹配项
matches := regexpPattern.FindAllStringSubmatch(string(content), -1)
// 输出匹配结果
x := string("")
for _, match := range matches {
if len(match) > 1 {
// 第一个捕获组的内容
result := match[1]
x = result
}
}
return x, "true", nil
}
func Microsoft_Defender(ctx context.Context, filePath string) (string, string, error) {
//shell := "MpCmdRun.exe -Scan -ScanType 3 -DisableRemediation -File " + filePath
//filePath1 := "C:\Users\admin\Desktop\test\\tmp\\MicroKMS_v21.12.08_Beta.exe"
cmd := exec.Command("MpCmdRun.exe", "-Scan", "-ScanType", "3", "-File", filePath, "-DisableRemediation")
//cmd := exec.Command("C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23110.3-0\\MpCmdRun.exe -Scan -ScanType 3 -File C:\\Users\\admin\\Desktop\\test\\tmp\\MicroKMS_v21.12.08_Beta.exe -DisableRemediation")
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "found 1 threats") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`Threat\s*:\s*([^[:space:]]+)`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func filterString(str string) string {
filteredStr := strings.ReplaceAll(str, "\r", "")
filteredStr = strings.ReplaceAll(filteredStr, "\t", "")
return filteredStr
}

复制代码

以下是服务端接口代码：

package main
import (
"bytes"
"context"
"crypto/sha256"
"encoding/hex"
"errors"
"fmt"
_ "github.com/go-sql-driver/mysql"
"github.com/labstack/echo"
"github.com/labstack/echo/middleware"
"golang.org/x/text/encoding/simplifiedchinese"
"io"
"io/ioutil"
"log"
"net/http"
"os"
"os/exec"
"path/filepath"
"regexp"
"strings"
"time"
)
type avinfo struct {
//DisplayIcon string
Filename string
Virus string
Antivirus_name string
VirusClass string
Status string
UploadTime string
Hash256 string
//UninstallString string
}
func main() {
e := echo.New()
e.Use(middleware.Logger())
e.Use(middleware.Recover())
e.POST("/upload", uploadFile)
e.Logger.Fatal(e.Start(":8080"))
//log.Printf("class:%s", virusClass)
}
func uploadFile(c echo.Context) error {
// Get file from request
file, err := c.FormFile("file")
if err != nil {
return err
}
// Open the file
src, err := file.Open()
if err != nil {
return err
}
defer src.Close()
// Destination file path
dstPath := filepath.Join("C:\\Users\\admin\\Desktop\\test\\tmp", file.Filename)
// Create destination file
dst, err := os.Create(dstPath)
if err != nil {
return err
}
defer dst.Close()
// Copy the file content to the destination file
if _, err = io.Copy(dst, src); err != nil {
return err
}
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
defer cancel()
//virusClass, isVirus, err := avast(ctx, dstPath)
virusClass, isVirus, err := Microsoft_Defender(ctx, dstPath)
//log.Printf("class:%s\n, isVirus:%t\n, err:%v\n", virusClass, isVirus, err)
now := time.Now()
format1 := now.Format("2006/01/02 15:04")
file1, err := os.Open(dstPath)
defer file1.Close()
if err != nil {
fmt.Errorf("读取文件失败！")
}
hash := sha256.New()
if _, err := io.Copy(hash, file1); err != nil {
log.Fatal(err)
}
sum := hash.Sum(nil)
hash256 := hex.EncodeToString(sum[:])
u := &avinfo{
Filename: file.Filename,
Virus: isVirus,
VirusClass: virusClass,
Antivirus_name: "Microsoft_Defender",
Status: "finshed",
UploadTime: format1,
Hash256: hash256,
}
// Return success message
//dbinsert(u.Filename, u.Virus, u.VirusClass, u.Antivirus_name, u.Status)
return c.JSON(http.StatusOK, u)
}
func kaspersky(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("avp.com", "SCAN", "/i0", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "suspicion") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`suspicion\s+(.+)`)
matches := exp.FindStringSubmatch(outStr)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func avast(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("ashcmd.exe", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if strings.Contains(outStr, "OK") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(strings.Replace(filePath, `\`, `\\`, -1) + `(.+)`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
str := filterString(matches[0])
return strings.Replace(str, filePath, ``, -1), "true", nil
}
func eset(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("ecls.exe", "/files", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "威胁") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`威胁="([^"]+)"`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func emsisoft(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("a2cmd.exe", "/files", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "detected:") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`detected:([^"]+)Scanned`)
matches := exp.FindStringSubmatch(outStr)
//log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func clamav(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("clamscan", "-r", filePath)
stdout := new(bytes.Buffer)
cmd.Stdout = stdout
stderr := new(bytes.Buffer)
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(stdout))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if strings.Contains(outStr, "OK") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(filePath + ":" + ` ([^"]+)` + "FOUND")
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func ikarust(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("t3scan_w64.exe", filePath)
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "found") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`'([^"]+)'`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func AdAware(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("AdAwareCommandLineScanner.exe", "--scan-result-stdout", "--custom", filePath)
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "ScanStatus="Infected"") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`ThreatName="([^"]+)"`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func Sophos(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("SophosInterceptXCLI.exe", "scan", filePath, "--noui")
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
log.Println(string(buf))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "type:") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`\(Detected as '([^"]+)' type`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func Drweb(ctx context.Context, filePath string) (string, string, error) {
cmd := exec.Command("dwscancl.exe", filePath, "/RP:C:\\Users\\CNIX\\Desktop\\drweb\\file.log")
_, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
//
//// GBK -> UTF-8
//dec := simplifiedchinese.GBK.NewDecoder()
//outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
//
//if err != nil {
// return "", "false", fmt.Errorf("decode failed: %w", err)
//}
//outStr := string(outBytes)
//// 打开文件以供日志输出
////file, err := os.OpenFile("logfile.txt", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
////if err != nil {
//// log.Fatal("无法打开日志文件：", err)
////}
////defer file.Close()
////// 将日志输出到文件
////log.SetOutput(file)
////log.Println(outStr)
////log.Println("-------------------------------------")
////log.Println(string(buf))
//// 获取当前可执行文件的路径
//exePath, err := os.Executable()
//if err != nil {
// fmt.Println("获取可执行文件路径失败：", err)
// return "", "", nil
//}
//
//// 获取当前可执行文件所在的目录
//exeDir := filepath.Dir(exePath)
//// 构建要读取的文件的路径
//x := filepath.Join(exeDir, "file.log")
//
//// 读取文件内容
//content, err := os.Open(x)
//if err != nil {
// fmt.Println("读取文件失败：", err)
// return "", "", nil
//}
//
//// 打印文件内容
//fmt.Println("文件内容：")
//fmt.Println(string(content))
//if !strings.Contains(content, "infected with") {
// return "", "false", nil // no virus
//}
// 文件路径
filePath1 := "C:\\Users\\CNIX\\Desktop\\drweb\\file.log"
// 打开文件
file, err := os.Open(filePath1)
if err != nil {
fmt.Println("打开文件失败:", err)
return "", "", nil
}
defer file.Close()
// 读取文件内容
content, err := ioutil.ReadAll(file)
if err != nil {
fmt.Println("读取文件失败:", err)
return "", "", nil
}
// 正则表达式匹配
pattern := "infected with"
match := regexp.MustCompile(pattern).Match(content)
// 输出结果
if !match {
return "", "false", nil // no virus
}
// 正则表达式模式
pattern1 := `infected with (\S+)`
// 编译正则表达式
regexpPattern := regexp.MustCompile(pattern1)
// 使用正则表达式查找所有匹配项
matches := regexpPattern.FindAllStringSubmatch(string(content), -1)
// 输出匹配结果
x := string("")
for _, match := range matches {
if len(match) > 1 {
// 第一个捕获组的内容
result := match[1]
x = result
}
}
return x, "true", nil
}
func Norton(ctx context.Context, filePath string) (string, string, error) {
log.Println(filePath)
cmd := exec.Command("navw32.exe", filePath)
now := time.Now()
format2 := now.Format("2006/01/02 15:04")
log.Println(format2)
_, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
//cmd1 := exec.Command("MCUI32.exe /export C:\\Users\\CNIX\\Desktop\\norton\\log.txt")
//xx, err := cmd1.CombinedOutput()
//if err != nil {
//
// exitErr := &exec.ExitError{}
// if !errors.As(err, &exitErr) {
// return "", "false", fmt.Errorf("exec failed: %w", err)
// }
//}
//log.Println(xx)
// 文件路径
filePath1 := "C:\\Users\\CNIX\\Desktop\\norton\\log.txt"
// 打开文件
file, err := os.Open(filePath1)
if err != nil {
fmt.Println("打开文件失败:", err)
return "", "", nil
}
defer file.Close()
// 读取文件内容
content, err := ioutil.ReadAll(file)
if err != nil {
fmt.Println("读取文件失败:", err)
return "", "", nil
}
// 正则表达式匹配
pattern := format2
match := regexp.MustCompile(pattern).Match(content)
// 输出结果
if !match {
return "", "false", nil // no virus
}
// 正则表达式模式
pattern1 := format2 + `(\S+) 检测方自动防护,已阻止,已解决`
// 编译正则表达式
regexpPattern := regexp.MustCompile(pattern1)
// 使用正则表达式查找所有匹配项
matches := regexpPattern.FindAllStringSubmatch(string(content), -1)
// 输出匹配结果
x := string("")
for _, match := range matches {
if len(match) > 1 {
// 第一个捕获组的内容
result := match[1]
x = result
}
}
return x, "true", nil
}
func Microsoft_Defender(ctx context.Context, filePath string) (string, string, error) {
//shell := "MpCmdRun.exe -Scan -ScanType 3 -DisableRemediation -File " + filePath
//filePath1 := "C:\Users\admin\Desktop\test\\tmp\\MicroKMS_v21.12.08_Beta.exe"
cmd := exec.Command("MpCmdRun.exe", "-Scan", "-ScanType", "3", "-File", filePath, "-DisableRemediation")
//cmd := exec.Command("C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23110.3-0\\MpCmdRun.exe -Scan -ScanType 3 -File C:\\Users\\admin\\Desktop\\test\\tmp\\MicroKMS_v21.12.08_Beta.exe -DisableRemediation")
//stdout := new(bytes.Buffer)
//cmd.Stdout = stdout
//stderr := new(bytes.Buffer)
//cmd.Stderr = stderr
buf, err := cmd.CombinedOutput()
if err != nil {
exitErr := &exec.ExitError{}
if !errors.As(err, &exitErr) {
return "", "false", fmt.Errorf("exec failed: %w", err)
}
}
// GBK -> UTF-8
dec := simplifiedchinese.GBK.NewDecoder()
outBytes, err := io.ReadAll(dec.Reader(bytes.NewReader(buf)))
if err != nil {
return "", "false", fmt.Errorf("decode failed: %w", err)
}
outStr := string(outBytes)
if !strings.Contains(outStr, "found 1 threats") {
return "", "false", nil // no virus
}
exp := regexp.MustCompile(`Threat\s*:\s*([^[:space:]]+)`)
matches := exp.FindStringSubmatch(outStr)
log.Println(matches)
if len(matches) != 2 {
return "", "false", fmt.Errorf("regexp match: %s", outStr)
}
return matches[1], "true", nil
}
func filterString(str string) string {
filteredStr := strings.ReplaceAll(str, "\r", "")
filteredStr = strings.ReplaceAll(filteredStr, "\t", "")
return filteredStr
}

复制代码

显示全部楼层 · 发表于 2024-3-30 16:36:32

居然占了沙发

显示全部楼层 · 发表于 2024-4-1 09:24:12

kafan988 发表于 2024-3-30 16:36
居然占了沙发

写脚本太菜了，没人看

显示全部楼层 · 发表于 2024-4-1 20:28:57

小白问下，这个怎么用呢？

显示全部楼层 · 发表于 2024-4-2 09:23:24

zjzyhong 发表于 2024-4-1 20:28
小白问下，这个怎么用呢？

需要把agent编译，分别在安装不同杀毒软件电脑上运行，通过服务端接口上传文件获取扫描结果。

显示全部楼层 · 发表于 2024-4-2 14:09:37

感谢分享了

显示全部楼层 · 发表于 2024-4-8 14:40:07

xyk001 发表于 2024-4-2 09:23
需要把agent编译，分别在安装不同杀毒软件电脑上运行，通过服务端接口上传文件获取扫描结果。

学习啦，谢谢回复。

显示全部楼层 · 发表于 2024-8-7 11:39:15

这个太棒了吧

显示全部楼层 · 发表于 2024-10-23 16:43:01

好厉害的样子

[原创工具] 使用Go开发一款调用各大杀毒软件的脚本

评分