#!/usr/bin/env python3
"""Agent for deploying and monitoring ransomware honeypot canary files."""

import os
import json
import argparse
import hashlib
import time
from datetime import datetime
from pathlib import Path
from collections import Counter


CANARY_EXTENSIONS = [".docx", ".xlsx", ".pdf", ".pptx", ".csv", ".txt",
                     ".jpg", ".png", ".sql", ".bak"]
CANARY_PREFIX_NAMES = [
    "!Accounting_Report_2024", "!Budget_Final", "!Confidential_HR",
    "!Employee_SSN_List", "!Financial_Audit", "!Payroll_Records",
    "~$Customer_Database", "~$Executive_Compensation",
]


def create_canary_files(target_dir, count=10):
    """Create canary files in strategic locations for ransomware detection."""
    canaries = []
    target = Path(target_dir)
    for i in range(min(count, len(CANARY_PREFIX_NAMES))):
        for ext in CANARY_EXTENSIONS[:3]:
            name = f"{CANARY_PREFIX_NAMES[i]}{ext}"
            path = target / name
            content = os.urandom(1024 * (i + 1))
            path.write_bytes(content)
            file_hash = hashlib.sha256(content).hexdigest()
            canaries.append({
                "path": str(path),
                "hash": file_hash,
                "size": len(content),
                "created": datetime.utcnow().isoformat(),
            })
    return canaries


def generate_canary_manifest(canaries, manifest_path):
    """Save canary file manifest for integrity monitoring."""
    manifest = {
        "created_at": datetime.utcnow().isoformat(),
        "canary_count": len(canaries),
        "canaries": canaries,
    }
    with open(manifest_path, "w") as f:
        json.dump(manifest, f, indent=2)
    return manifest_path


def check_canary_integrity(manifest_path):
    """Check canary files against manifest to detect tampering/encryption."""
    with open(manifest_path) as f:
        manifest = json.load(f)
    alerts = []
    for canary in manifest.get("canaries", []):
        path = Path(canary["path"])
        if not path.exists():
            alerts.append({
                "type": "DELETED",
                "path": canary["path"],
                "severity": "CRITICAL",
                "detail": "Canary file deleted - possible ransomware wiper",
            })
            continue
        current_hash = hashlib.sha256(path.read_bytes()).hexdigest()
        if current_hash != canary["hash"]:
            alerts.append({
                "type": "MODIFIED",
                "path": canary["path"],
                "severity": "CRITICAL",
                "original_hash": canary["hash"],
                "current_hash": current_hash,
                "detail": "Canary file modified - possible ransomware encryption",
            })
        current_size = path.stat().st_size
        if abs(current_size - canary["size"]) > canary["size"] * 0.1:
            alerts.append({
                "type": "SIZE_CHANGE",
                "path": canary["path"],
                "severity": "HIGH",
                "original_size": canary["size"],
                "current_size": current_size,
            })
    checked = len(manifest.get("canaries", []))
    return {
        "checked": checked,
        "alerts": alerts,
        "alert_count": len(alerts),
        "status": "ALERT" if alerts else "CLEAN",
    }


def detect_ransomware_indicators(watch_dir, window_seconds=60):
    """Detect rapid file modifications indicative of ransomware."""
    watch_path = Path(watch_dir)
    now = time.time()
    recently_modified = []
    extension_changes = Counter()
    new_extensions = Counter()

    for fp in watch_path.rglob("*"):
        if not fp.is_file():
            continue
        try:
            mtime = fp.stat().st_mtime
            if now - mtime < window_seconds:
                recently_modified.append(str(fp))
                ext = fp.suffix.lower()
                if ext in (".encrypted", ".locked", ".crypto", ".crypt",
                           ".enc", ".pay", ".ransom"):
                    new_extensions[ext] += 1
        except (OSError, PermissionError):
            continue

    indicators = []
    if len(recently_modified) > 50:
        indicators.append({
            "indicator": "Mass file modification",
            "count": len(recently_modified),
            "severity": "CRITICAL",
            "detail": f"{len(recently_modified)} files modified in {window_seconds}s",
        })
    if new_extensions:
        indicators.append({
            "indicator": "Ransomware file extensions detected",
            "extensions": dict(new_extensions),
            "severity": "CRITICAL",
        })
    return {
        "files_checked_window": window_seconds,
        "recently_modified": len(recently_modified),
        "indicators": indicators,
        "status": "ALERT" if indicators else "CLEAN",
    }


def generate_honeypot_share_config(share_name="FinanceArchive", share_path="/srv/honeypot"):
    """Generate SMB honeypot share configuration."""
    return {
        "samba_config": {
            "share_name": share_name,
            "path": share_path,
            "comment": "Financial Archive (Read Only)",
            "read_only": False,
            "browseable": True,
            "guest_ok": False,
            "valid_users": "@domain_users",
            "vfs_objects": "full_audit",
            "full_audit_prefix": f"%u|%I|%S",
            "full_audit_success": "open opendir write rename unlink mkdir rmdir",
            "full_audit_failure": "open",
            "full_audit_facility": "LOCAL7",
            "full_audit_priority": "NOTICE",
        },
        "monitoring": {
            "log_path": "/var/log/samba/audit.log",
            "alert_on": ["write", "rename", "unlink"],
            "siem_integration": "syslog -> SIEM",
        },
    }


def analyze_honeypot_logs(log_path):
    """Analyze honeypot access logs for suspicious activity."""
    with open(log_path) as f:
        events = json.load(f)
    items = events if isinstance(events, list) else events.get("events", [])
    by_user = Counter(e.get("user", "unknown") for e in items)
    by_action = Counter(e.get("action", "unknown") for e in items)
    write_events = [e for e in items if e.get("action") in ("write", "rename", "delete")]
    return {
        "total_events": len(items),
        "by_user": dict(by_user.most_common(10)),
        "by_action": dict(by_action),
        "write_events": len(write_events),
        "suspicious": len(write_events) > 5,
        "severity": "CRITICAL" if len(write_events) > 20 else
                    "HIGH" if len(write_events) > 5 else "INFO",
    }


def main():
    parser = argparse.ArgumentParser(description="Ransomware Honeypot Agent")
    parser.add_argument("--deploy", help="Directory to deploy canary files")
    parser.add_argument("--manifest", help="Canary manifest JSON for integrity check")
    parser.add_argument("--watch", help="Directory to watch for ransomware indicators")
    parser.add_argument("--honeypot-log", help="Honeypot access log JSON")
    parser.add_argument("--action", choices=["deploy", "check", "detect", "analyze",
                                              "share-config", "full"], default="full")
    parser.add_argument("--output", default="ransomware_honeypot_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "results": {}}

    if args.action in ("deploy", "full") and args.deploy:
        canaries = create_canary_files(args.deploy)
        manifest = generate_canary_manifest(canaries, args.deploy + "/canary_manifest.json")
        report["results"]["deployed"] = {"count": len(canaries), "manifest": manifest}
        print(f"[+] Deployed {len(canaries)} canary files")

    if args.action in ("check", "full") and args.manifest:
        result = check_canary_integrity(args.manifest)
        report["results"]["integrity"] = result
        print(f"[+] Integrity: {result['status']} ({result['alert_count']} alerts)")

    if args.action in ("detect", "full") and args.watch:
        result = detect_ransomware_indicators(args.watch)
        report["results"]["detection"] = result
        print(f"[+] Detection: {result['status']}")

    if args.action in ("share-config", "full"):
        config = generate_honeypot_share_config()
        report["results"]["share_config"] = config
        print("[+] Honeypot share config generated")

    if args.action in ("analyze", "full") and args.honeypot_log:
        result = analyze_honeypot_logs(args.honeypot_log)
        report["results"]["log_analysis"] = result
        print(f"[+] Honeypot events: {result['total_events']}, writes: {result['write_events']}")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Ransomware Honeypot Deployment and Monitoring Tool

Deploys canary files across file shares and monitors for modifications
that indicate ransomware activity. Supports:
- Canary file generation with realistic content
- File system monitoring with immediate alerting
- Integration with SIEM via syslog
- Automated containment via API calls
"""

import hashlib
import json
import logging
import os
import sys
import time
from dataclasses import dataclass, field, asdict
from datetime import datetime
from pathlib import Path
from typing import Optional

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger("ransomware_honeypot")


@dataclass
class CanaryFile:
    path: str
    original_hash: str
    file_type: str
    deploy_time: str
    share_name: str
    status: str = "active"
    last_check: Optional[str] = None
    alert_triggered: bool = False


@dataclass
class CanaryAlert:
    timestamp: str
    canary_path: str
    change_type: str  # modified, deleted, renamed, extension_changed
    source_info: str
    severity: str = "CRITICAL"
    automated_response: str = ""


CANARY_TEMPLATES = {
    "finance": [
        ("!_Budget_FY2026_FINAL.xlsx", "FY2026 Budget Summary\nTotal Revenue: $142.3M\nTotal Expenses: $98.7M\nNet Income: $43.6M"),
        ("000_Quarterly_Earnings.docx", "Q4 2025 Earnings Report\nRevenue: $38.2M\nGross Margin: 67%\nEBITDA: $12.1M"),
        ("_Executive_Compensation.pdf", "Executive Compensation Committee Report\nCEO Total Comp: $2.1M\nCFO Total Comp: $1.4M"),
    ],
    "hr": [
        ("!_Employee_SSN_List.xlsx", "Employee ID | Name | SSN\n10001 | Smith, John | XXX-XX-1234\n10002 | Johnson, Mary | XXX-XX-5678"),
        ("000_Salary_Database_2026.csv", "Employee,Department,Base Salary,Bonus\nSmith J,Engineering,$145000,$29000"),
        ("_Termination_List_Q1.docx", "Planned Workforce Reduction Q1 2026\nDepartment: Operations\nHeadcount Impact: 45 positions"),
    ],
    "engineering": [
        ("!_Product_Roadmap_Confidential.docx", "Product Roadmap 2026-2028\nProject Phoenix: AI-powered analytics\nProject Titan: Next-gen platform"),
        ("000_Source_Code_Access_Keys.txt", "Repository Access Tokens\nGitHub Enterprise: ghp_XXXXXXXXXXXX\nAWS CodeCommit: AKIAIOSFODNN7EXAMPLE"),
        ("_Patent_Application_Draft.pdf", "US Patent Application\nTitle: Method for Distributed Computing\nInventor: Dr. Jane Smith"),
    ],
    "executive": [
        ("!_Board_Meeting_Minutes.docx", "Board of Directors Meeting Minutes\nDate: January 15, 2026\nAttendees: Full board present"),
        ("000_MA_Target_Analysis.xlsx", "M&A Target Analysis\nTarget: AcmeTech Inc\nValuation: $450M\nSynergies: $80M annual"),
        ("_Strategic_Plan_2026.pdf", "Strategic Plan 2026-2030\nVision: Market leader in three verticals\nCapEx Budget: $200M"),
    ],
}


class CanaryDeployer:
    """Deploys and manages canary files for ransomware detection."""

    def __init__(self, state_file: str = "canary_state.json"):
        self.state_file = state_file
        self.canaries: list[CanaryFile] = []
        self._load_state()

    def _load_state(self):
        if os.path.exists(self.state_file):
            with open(self.state_file, "r") as f:
                data = json.load(f)
                self.canaries = [CanaryFile(**c) for c in data.get("canaries", [])]

    def _save_state(self):
        with open(self.state_file, "w") as f:
            json.dump({"canaries": [asdict(c) for c in self.canaries],
                       "last_updated": datetime.now().isoformat()}, f, indent=2)

    def _compute_hash(self, filepath: str) -> str:
        if not os.path.exists(filepath):
            return ""
        h = hashlib.sha256()
        with open(filepath, "rb") as f:
            for chunk in iter(lambda: f.read(8192), b""):
                h.update(chunk)
        return h.hexdigest()

    def deploy_canaries(self, base_path: str, share_type: str = "finance") -> list:
        """Deploy canary files to a target directory."""
        templates = CANARY_TEMPLATES.get(share_type, CANARY_TEMPLATES["finance"])
        deployed = []

        base = Path(base_path)
        if not base.exists():
            logger.error(f"Target path does not exist: {base_path}")
            return deployed

        for filename, content in templates:
            filepath = base / filename
            try:
                filepath.write_text(content, encoding="utf-8")
                file_hash = self._compute_hash(str(filepath))

                canary = CanaryFile(
                    path=str(filepath),
                    original_hash=file_hash,
                    file_type=filepath.suffix,
                    deploy_time=datetime.now().isoformat(),
                    share_name=share_type,
                )
                self.canaries.append(canary)
                deployed.append(canary)
                logger.info(f"Deployed canary: {filepath}")
            except OSError as e:
                logger.error(f"Failed to deploy canary {filepath}: {e}")

        self._save_state()
        return deployed

    def check_canaries(self) -> list:
        """Check all deployed canaries for modifications."""
        alerts = []

        for canary in self.canaries:
            if canary.status != "active":
                continue

            canary.last_check = datetime.now().isoformat()

            if not os.path.exists(canary.path):
                # File deleted - strong ransomware indicator
                alert = CanaryAlert(
                    timestamp=datetime.now().isoformat(),
                    canary_path=canary.path,
                    change_type="deleted",
                    source_info="File no longer exists",
                    severity="CRITICAL",
                )
                alerts.append(alert)
                canary.alert_triggered = True
                canary.status = "triggered"
                logger.critical(f"CANARY DELETED: {canary.path}")
                continue

            current_hash = self._compute_hash(canary.path)
            if current_hash != canary.original_hash:
                # File modified - likely encryption
                alert = CanaryAlert(
                    timestamp=datetime.now().isoformat(),
                    canary_path=canary.path,
                    change_type="modified",
                    source_info=f"Hash changed: {canary.original_hash[:16]}... -> {current_hash[:16]}...",
                    severity="CRITICAL",
                )
                alerts.append(alert)
                canary.alert_triggered = True
                canary.status = "triggered"
                logger.critical(f"CANARY MODIFIED: {canary.path}")

            # Check for ransomware extension appended
            parent = Path(canary.path).parent
            base_name = Path(canary.path).name
            for f in parent.iterdir():
                if f.name.startswith(base_name) and f.name != base_name:
                    # Possible encrypted version (e.g., file.docx.lockbit)
                    alert = CanaryAlert(
                        timestamp=datetime.now().isoformat(),
                        canary_path=canary.path,
                        change_type="extension_changed",
                        source_info=f"Possible encrypted copy: {f.name}",
                        severity="CRITICAL",
                    )
                    alerts.append(alert)
                    canary.alert_triggered = True
                    logger.critical(f"CANARY EXTENSION CHANGE: {f.name}")

        self._save_state()
        return alerts

    def generate_report(self) -> str:
        """Generate deployment status report."""
        lines = []
        lines.append("=" * 60)
        lines.append("RANSOMWARE CANARY DEPLOYMENT REPORT")
        lines.append("=" * 60)
        lines.append(f"Report Time: {datetime.now().isoformat()}")
        lines.append(f"Total Canaries: {len(self.canaries)}")

        active = sum(1 for c in self.canaries if c.status == "active")
        triggered = sum(1 for c in self.canaries if c.status == "triggered")
        lines.append(f"Active: {active}")
        lines.append(f"Triggered: {triggered}")

        by_share = {}
        for c in self.canaries:
            by_share.setdefault(c.share_name, []).append(c)

        lines.append("\nDeployment by Share:")
        for share, canaries in by_share.items():
            lines.append(f"\n  {share.upper()}:")
            for c in canaries:
                status_icon = "OK" if c.status == "active" else "ALERT"
                lines.append(f"    [{status_icon}] {c.path}")

        lines.append("\n" + "=" * 60)
        return "\n".join(lines)

    def continuous_monitor(self, interval_seconds: int = 10):
        """Run continuous monitoring loop."""
        logger.info(f"Starting continuous canary monitoring (interval: {interval_seconds}s)")
        logger.info(f"Monitoring {len(self.canaries)} canary files")

        try:
            while True:
                alerts = self.check_canaries()
                if alerts:
                    logger.critical(f"!!! {len(alerts)} CANARY ALERTS DETECTED !!!")
                    for alert in alerts:
                        logger.critical(f"  {alert.change_type}: {alert.canary_path}")
                        # In production: trigger SIEM alert, NAC quarantine, EDR isolation
                time.sleep(interval_seconds)
        except KeyboardInterrupt:
            logger.info("Monitoring stopped by user")


def main():
    deployer = CanaryDeployer(
        state_file=str(Path(__file__).parent / "canary_state.json")
    )

    if len(sys.argv) > 1:
        command = sys.argv[1]

        if command == "deploy" and len(sys.argv) >= 4:
            target_path = sys.argv[2]
            share_type = sys.argv[3]
            deployed = deployer.deploy_canaries(target_path, share_type)
            print(f"Deployed {len(deployed)} canary files to {target_path}")

        elif command == "check":
            alerts = deployer.check_canaries()
            if alerts:
                print(f"\n!!! {len(alerts)} ALERTS !!!")
                for alert in alerts:
                    print(f"  [{alert.severity}] {alert.change_type}: {alert.canary_path}")
            else:
                print("All canaries intact - no alerts")

        elif command == "monitor":
            interval = int(sys.argv[2]) if len(sys.argv) > 2 else 10
            deployer.continuous_monitor(interval)

        elif command == "report":
            print(deployer.generate_report())

        else:
            print("Usage:")
            print("  python process.py deploy <path> <type>  - Deploy canaries (finance/hr/engineering/executive)")
            print("  python process.py check                 - Check all canaries for modifications")
            print("  python process.py monitor [interval]    - Continuous monitoring")
            print("  python process.py report                - Generate deployment report")
    else:
        # Demo mode
        print("Ransomware Honeypot - Demo Mode")
        print("=" * 40)
        demo_dir = Path(__file__).parent / "demo_share"
        demo_dir.mkdir(exist_ok=True)

        deployed = deployer.deploy_canaries(str(demo_dir), "finance")
        print(f"\nDeployed {len(deployed)} canary files")

        alerts = deployer.check_canaries()
        print(f"Initial check: {len(alerts)} alerts (expected: 0)")

        print("\n" + deployer.generate_report())


if __name__ == "__main__":
    main()