#!/bin/bash
#####
# Description: Some information about the source
#
# Name: Malware URL 
# Host:
# Frequency: Daily
# Types: IPv4, domain
#####
# Some Variables
HOME="/tmp/osint"
SOURCES="/tmp/osint/sources"
HEADER="Accept: text/html"
UA21="Mozilla/5.0 Gecko/20100101 Firefox/21.0"
UA22="Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13; ) Gecko/20101203"
TODAY=$(date +"%Y-%m-%d")
if [ ! -d "/tmp/ossint/sources/murl" ]; then
        mkdir -p /tmp/osint/sources/murl;
fi
cd $HOME
datadirs=( ipv4 domains hashes rules )
for i in "${datadirs[@]}"; do
        if [ ! -d "$HOME/$i" ]; then
                mkdir -p $HOME/$i
        fi
done
#####################################
cd $SOURCES/murl;
wget --header="$HEADER" --user-agent="$UA22" "http://www.malwareurl.com/" -O malwareurl_homepage_$TODAY.txt
#
# Grab only the IPs
cat malwareurl_homepage_$TODAY.txt | grep -E -o '(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-5][0-9]|[01]?[0-9][0-9]?)' >> malwareurl_ipv4_$TODAY.txt
#
# This will grab all three level domain names
cat malwareurl_homepage_$TODAY.txt | grep "value" | awk -F\" '{print $(NF-5)}' | grep '[[:alpha:]][[:alnum:]\-]*\.[[:alpha:]][[:alnum:]\-]*\.[[:alpha:]][[:alnum:]\-]*$' >> murl_domains_working_$TODAY.txt
#
# This will grab all two and three level domains.
# This is a bit  redundant, but it is a precaution.
cat malwareurl_homepage_$TODAY.txt | grep "value" | awk -F\" '{print $(NF-5)}' | grep '[[:alpha:]][[:alnum:]\-]*\.[[:alpha:]][[:alnum:]\-]*\.*$' >> murl_domains_working.txt
cat murl_domains_working.txt | sort | uniq >> malwareURL_domains_$TODAY.txt
#
# Move our files to their locations.
cp malwareurl_ipv4_$TODAY.txt /tmp/osint/ipv4/malwareurl_ipv4_$TODAY.txt
cp malwareURL_domains_$TODAY.txt /tmp/osint/domains/malwareURL_domains_$TODAY.txt

#
#####
# Let's make some files
while read i; do
	echo "$i, " >> malwareURL_siem_ipv4_$TODAY.csv;
	echo "ALL:    $i" >> malwareURL_hostsdeny_$TODAY.deny
	echo "iptables -A INPUT -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwareURL_iptables_$TODAY.sh
	echo "iptables -A OUTPUT -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwareURL_iptables_$TODAY.sh
	echo "iptables -A FORWARD -s $i -j DROP LOG --log-prefix 'feodo tracker' " >> malwareURL_iptables_$TODAY.sh
done < malwareurl_ipv4_$TODAY.txt
#
cp malwareURL_siem_ipv4_$TODAY.csv /tmp/osint/rules/malwareURL_siem_ipv4_$TODAY.csv
cp malwareURL_iptables_$TODAY.sh /tmp/osint/rules/malwareURL_iptables_$TODAY.sh
###
while read i; do
	echo "127.0.0.1     www.$i $i" >> malwareURL_hosts_$TODAY.txt;
	echo "$i, " >> malwareURL_siem_domains_$TODAY.csv
	echo "ALL:    .$i" >> malwareURL_hostsdeny_$TODAY.deny
done < malwareURL_domains_$TODAY.txt
#
cp malwareURL_hosts_$TODAY.txt /tmp/osint/rules/malwareURL_hosts_$TODAY.txt
cp malwareURL_siem_domains_$TODAY.csv /tmp/osint/rules/malwareURL_siem_domains_$TODAY.csv
cp malwareURL_hostsdeny_$TODAY.deny /tmp/osint/rules/malwareURL_hostsdeny_$TODAY.deny



#
# EOF
