# Copyright 2020 FireEye, Inc. and Citrix Systems, Inc.

declare -a http_err_regexes;
http_err_regexes[0]="curl";
http_err_regexes[1]="wget";
http_err_regexes[2]="Xferd";
http_err_regexes[3]="mkdir";
http_err_regexes[4]="netscalerd";
http_err_regexes[5]="fuck";
http_err_regexes[6]="/tmp/\.init/httpd";
http_err_regexes[7]="cat: /proc/version: No such file or directory";
http_err_regexes[8]="cat: /proc/cpuinfo: No such file or directory";
http_err_regexes[9]="socket.error: ";
http_err_regexes[10]="Traceback (most recent call last):";

error_log_post_exploitation() {
    if [ ! -d "$root_directory/var/log/" ]; then
        debug "didn't find /var/log/";
        return;
    fi

    local results="";
    for regex in "${http_err_regexes[@]}"; do
        hits=$(find "$root_directory/var/log/" -type f -iname "*httperr*" -exec zgrep -HEi "$regex" {} \;);
        results="$results"$'\n'"$hits";
    done

    local readonly deduped_results=$(echo "$results" | grep -E [a-zA-Z0-9]| sort | uniq);
    local readonly result_count=$(echo "$results" | grep -E [a-zA-Z0-9]| sort | uniq | wc -l);

    if [ $result_count -gt 0 ]; then
        report_match "web error logs show $result_count instances of post-exploitation";
        report "web error log entries:"
        report "$deduped_results";
    else
        debug "no instance of malicious commands found in the HTTP error logs";
    fi
}

scan_error_logs() {
    error_log_post_exploitation;
}