提交 92c4e702 authored 作者: wangqiang's avatar wangqiang

1119问题修改

上级 07c508e4
......@@ -36,9 +36,17 @@
</properties>
<dependencies>
<!-- SpringBoot Web容器 -->
<!--web 模块 -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.hibernate.validator</groupId>
......
package com.priusis.client.service;
import cn.hutool.json.JSONUtil;
import com.priusis.ApqClientApplication;
import com.priusis.client.service.conf.PcPersistenceConfiguration;
import com.priusis.dto.RegisterParamDto;
import com.sun.jna.Platform;
import lombok.extern.slf4j.Slf4j;
......@@ -163,7 +165,8 @@ public class PersistentFileServiceImpl implements PersistentFileService {
public File flushRpcDataToFile(MqttRpcDataMessage mqttRpcDataMessage) throws IOException {
ObjectOutputStream outStream = null;
try {
File newFile = new File(storageDir, STORAGE_FILE_PREFIX + mqttRpcDataMessage.getMethod());
String method = mqttRpcDataMessage.getMethod();
File newFile = new File(storageDir, STORAGE_FILE_PREFIX + method);
outStream = new ObjectOutputStream(new FileOutputStream(newFile));
outStream.writeObject(mqttRpcDataMessage);
return newFile;
......
......@@ -360,7 +360,7 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
}
if ("remote_control".equals(mqttRpcDataMessage.getMethod())) {// 远程控制请求
log.info("收到远程控制请求!!!");
if (vncServerIsRunning()) {
if (StrUtil.equals("RUNNING", remoteControlController.vncServerIsRunning())) {
log.warn("VNC Server 已在运行中,忽略此次请求");
return;
}
......@@ -374,9 +374,14 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
}
if ("remote_control_accept".equals(mqttRpcDataMessage.getMethod())) {
log.info("远程控制请求接受!!! params: {}", mqttRpcDataMessage.getParams());
Long minutes = Convert.toLong(mqttRpcDataMessage.getParams());
remoteControlController.startVncServer(minutes);
return;
if (StrUtil.equals("RUNNING", remoteControlController.vncServerIsRunning())) {
log.warn("VNC Server 已在运行中,忽略此次请求");
return;
} else {
Long minutes = Convert.toLong(mqttRpcDataMessage.getParams());
remoteControlController.startVncServer(minutes);
return;
}
}
if ("facility_scan".equals(mqttRpcDataMessage.getMethod())) {
log.info("收到平台扫描软件请求");
......@@ -391,19 +396,6 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
}
}
private static boolean vncServerIsRunning() throws IOException {
Process process = Runtime.getRuntime().exec("cmd /c sc query uvnc_service");
try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
String line;
while ((line = reader.readLine()) != null) {
line = line.trim();
if (line.startsWith("STATE")) return line.endsWith("RUNNING");
}
process.destroy();
}
return false;
}
private void onGatewayAttributesGet(String message) {
log.info("Configuration arrived! {}", message);
JsonNode payload = fromString(message);
......
package com.priusis.client.util;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.extern.slf4j.Slf4j;
import org.apache.tomcat.util.codec.binary.Base64;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.*;
import java.security.cert.X509Certificate;
/**
* Created by priusis on 16.01.17.
......@@ -19,15 +14,6 @@ public class ConfigurationTools {
private static final ObjectMapper mapper = new ObjectMapper();
public static <T> T readConfiguration(JsonNode configurationNode, Class<T> clazz) throws IOException {
try {
return mapper.treeToValue(configurationNode, clazz);
} catch (IOException e) {
log.error("Failed to load {} configuration from {}", clazz, configurationNode);
throw e;
}
}
public static <T> T readFileConfiguration(String configurationFile, Class<T> clazz) throws IOException {
try {
return mapper.readValue(getFileAsStream(configurationFile), clazz);
......@@ -37,35 +23,6 @@ public class ConfigurationTools {
}
}
public static CertificateInfo loadCertificate(KeystoreConfiguration configuration, Boolean isRemote) throws GeneralSecurityException, IOException {
try {
KeyStore keyStore = KeyStore.getInstance(configuration.getType());
if (isRemote) {
keyStore.load(getResourceAsStream(configuration.getFileContent()), configuration.getPassword().toCharArray());
} else {
keyStore.load(getFileAsStream(configuration.getLocation()), configuration.getPassword().toCharArray());
}
Key key = keyStore.getKey(configuration.getAlias(), configuration.getKeyPassword().toCharArray());
if (key instanceof PrivateKey) {
X509Certificate certificate = (X509Certificate) keyStore.getCertificate(configuration.getAlias());
PublicKey publicKey = certificate.getPublicKey();
KeyPair keyPair = new KeyPair(publicKey, (PrivateKey) key);
return new CertificateInfo(certificate, keyPair);
} else {
throw new GeneralSecurityException(configuration.getAlias() + " is not a private key!");
}
} catch (IOException | GeneralSecurityException e) {
log.error("Keystore configuration: [{}] is invalid!", configuration, e);
throw e;
}
}
private static InputStream getResourceAsStream(String fileContent) {
byte[] decoded = Base64.decodeBase64(fileContent);
return new ByteArrayInputStream(decoded);
}
private static InputStream getFileAsStream(String configurationFile) {
return ConfigurationTools.class.getClassLoader().getResourceAsStream(configurationFile);
}
......
......@@ -241,8 +241,14 @@ public class ProgramController {
.stream().map(p -> p.get("name")).sorted().collect(Collectors.toList());
// 扫描进程列表
Set<String> processNames = new HashSet<>();
///FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "USERNAME ne 暂缺"
Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY SYSTEM" + '"' + " -fi " + '"' + "USERNAME ne 暂缺" + '"' + " /fo csv");
Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"'
+ " -fi " + '"' + "USERNAME ne NT AUTHORITY\\NETWORK SERVICE" + '"'
+ " -fi " + '"' + "USERNAME ne NT AUTHORITY\\LOCAL SERVICE" + '"'
+ " -fi " + '"' + "USERNAME ne Window Manager\\UMFD-0" + '"'
+ " -fi " + '"' + "USERNAME ne Font Driver Host\\UMFD-1" + '"'
+ " -fi " + '"' + "USERNAME ne Font Driver Host\\DWM-1" + '"'
+ " -fi " + '"' + "USERNAME ne 暂缺" + '"'
+ " /fo csv");
try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
reader.readLine();
String line;
......
......@@ -23,8 +23,10 @@ import org.springframework.web.bind.annotation.RestController;
import javax.annotation.PostConstruct;
import javax.annotation.Resource;
import javax.validation.constraints.NotNull;
import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Timer;
import java.util.TimerTask;
......@@ -81,11 +83,37 @@ public class RemoteControlController {
throws IOException, ConfigParser.DuplicateSectionException, ConfigParser.NoSectionException, InterruptedException {
Boolean hasRequest = Convert.toBool(SysConfigUtil.saveProperty("control.request", "0"), false);
if (!hasRequest) return R.error("无远程请求");
if (StrUtil.equals("NO SERVICE", vncServerIsRunning())) {
return R.error("没有安装VNC服务,请先安装VNC程序!");
}
return startVncServer(minutes);
}
private Timer timer = new Timer();
public String vncServerIsRunning() throws IOException {
Process process = Runtime.getRuntime().exec("cmd /c sc query uvnc_service");
try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
String line;
while ((line = reader.readLine()) != null) {
line = line.trim();
if (line.startsWith("STATE")) {
if (line.endsWith("RUNNING")) {
return "RUNNING";
} else {
return "STOPPED";
}
}
if (line.startsWith("指定的服务未安装")) {
return "NO SERVICE";
}
}
process.destroy();
}
return "STOPPED";
}
public synchronized R<Void> startVncServer(long minutes)
throws IOException, ConfigParser.DuplicateSectionException, ConfigParser.NoSectionException, InterruptedException {
// 查询设备的远程ID
......@@ -138,7 +166,11 @@ public class RemoteControlController {
}
@GetMapping(value = "send_request")
public R<Void> sendRequest(@RequestParam @NotNull Long minutes) {
public R<Void> sendRequest(@RequestParam @NotNull Long minutes) throws IOException {
if (StrUtil.equals("NO SERVICE", vncServerIsRunning())) {
return R.error("没有安装VNC服务,请先安装VNC程序!");
}
JSONObject rsp = JSONUtil.parseObj(HttpUtil.post(gateway + sendControlReqUrl,
JSONUtil.createObj().set("controlDate", minutes)
.set("macAddress", MacAddrUtil.get())
......
package com.priusis.job;
import cn.hutool.core.util.StrUtil;
import cn.hutool.json.JSONUtil;
import com.priusis.dto.RegisterParamDto;
import com.priusis.utils.WinExecuteUtils;
import com.priusis.vo.MqttRpcDataMessage;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.http.ResponseEntity;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;
import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestTemplate;
import java.io.IOException;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@Slf4j
@Component
@ConditionalOnExpression("'${apq.job.type:null}'=='all' || '${apq.job.type:null}'=='register'")
public class ApqRegister4BackListJob {
// "params":
// {
// "type":1
// "programs": [
// {
// "name":"qq"
// }
// ]
// }
@Autowired
private RestTemplate restTemplate;
@Scheduled(fixedDelay = 30000L)
protected void registerProgramTask() {
log.info("软件检测上报=================");
/* try {
WinExecuteUtils.killProc("TIM.exe");
} catch (IOException e) {
log.error("杀进程异常", e);
}*/
// 获取软件检测监控配置 params == data
ResponseEntity<MqttRpcDataMessage> forEntity = null;
try {
forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/BlackList", MqttRpcDataMessage.class);
} catch (RestClientException e) {
log.error("软件检测上报异常", e.getMessage());
}
if (null != forEntity) {
MqttRpcDataMessage body = forEntity.getBody();
String params = body.getParams();
if (StrUtil.isNotBlank(params)) {
Long sendTime = body.getSendTime();
//long current = System.currentTimeMillis();
RegisterParamDto registerParamDto = JSONUtil.toBean(params, RegisterParamDto.class);
// 收到软件检测下发请求
log.info("收到软件检测下发请求, sendTime:{}, params:{}", sendTime, params);
List<RegisterParamDto.RegisterDetailParamDto> programs = registerParamDto.getPrograms();
// 上报软件检测监控数据
List<String> mapSoftRequest = null;
log.info("收到软件检测黑名单");
for (RegisterParamDto.RegisterDetailParamDto program : programs) {
String name = program.getName().trim();
log.info("软件检测软件: {}", name);
boolean isE = WinExecuteUtils.findProcess(name);
if (isE) {
// 杀进程
log.info("存在黑名单软件, 进行进程查杀: {}", name);
try {
WinExecuteUtils.killProc(name);
} catch (Exception e) {
log.error("杀进程异常", e);
}
// 上报黑名单异常
mapSoftRequest.add(name);
}
}
// 上报黑白名单异常
if (null != mapSoftRequest && mapSoftRequest.size() > 0) {
Map eventMapRequest = new HashMap();
Map mapRequest = new HashMap();
eventMapRequest.put("requestId", 2);
//eventMapRequest.put("methodName", type == 1 ? "BlackList" : "WhiteList"); // BlackList WriteList
eventMapRequest.put("methodName", "BlackList"); // BlackList WriteList
eventMapRequest.put("params", mapRequest);
for (String mapSoftRequestData : mapSoftRequest) {
mapRequest.put("wbl", mapSoftRequestData);
Map map = restTemplate.postForObject("http://localhost:8765/uplink_event/oc-client", eventMapRequest, Map.class);
log.info("存在软件检测接口扫码告警,上报告警事件: mapData:{}, ret:{}", mapRequest, map);
}
}
} else {
log.info("未获取到获取软件检测监控配置");
}
} else {
log.info("未获取到获取软件检测监控配置");
}
}
public static void main(String[] args) {
try {
WinExecuteUtils.killProc("Xshell.exe");
} catch (IOException e) {
log.error("杀进程异常", e);
}
}
}
package com.priusis.job;
import cn.hutool.core.collection.ListUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.json.JSONUtil;
import com.priusis.dto.RegisterParamDto;
......@@ -22,7 +23,7 @@ import java.util.*;
@Slf4j
@Component
@ConditionalOnExpression("'${apq.job.type:null}'=='all' || '${apq.job.type:null}'=='register'")
public class ApqRegisterJob {
public class ApqRegister4WhiteListJob {
// "params":
// {
......@@ -34,6 +35,38 @@ public class ApqRegisterJob {
// ]
// }
private List<String> excludePrograms = ListUtil.of("svchost.exe", "explorer.exe", "dwm.exe"
, "apq-client.exe"
, "alg.exe"
, "csrss.exe"
, "ctfmon.exe"
, "lsass.exe"
, "nvvsvc.exe"
, "services.exe"
, "smss.exe"
, "winlogon.exe"
, "mstask.exe"
, "winmgmt.exe"
, "conhost.exe"
, "sihost.exe"
, "dllhost.exe"
, "smartscreen.exe"
, "SearchUI.exe"
, "igfxEM.exe"
, "Taskmgr.exe"
, "fontdrvhost.exe"
, "wscript.exe"
, "taskhostw.exe"
, "StartMenuExperienceHost.exe"
, "ShellExperienceHost.exe"
, "SettingSyncHost.exe"
, "RuntimeBroker.exe"
, "igfxext.exe"
, "ApplicationFrameHost.exe"
, "LockApp.exe"
, "Microsoft.Photos.exe"
);
@Autowired
private RestTemplate restTemplate;
......@@ -50,7 +83,7 @@ public class ApqRegisterJob {
// 获取软件检测监控配置 params == data
ResponseEntity<MqttRpcDataMessage> forEntity = null;
try {
forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/register", MqttRpcDataMessage.class);
forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/WhiteList", MqttRpcDataMessage.class);
} catch (RestClientException e) {
log.error("软件检测上报异常", e.getMessage());
}
......@@ -70,85 +103,73 @@ public class ApqRegisterJob {
List<RegisterParamDto.RegisterDetailParamDto> programs = registerParamDto.getPrograms();
// 上报软件检测监控数据
List<String> mapSoftRequest = null;
if (type == 1) {
log.info("收到软件检测黑名单");
for (RegisterParamDto.RegisterDetailParamDto program : programs) {
String name = program.getName().trim();
log.info("软件检测软件: {}", name);
boolean isE = WinExecuteUtils.findProcess(name);
if (isE) {
// 杀进程
log.info("存在黑名单软件, 进行进程查杀: {}", name);
try {
WinExecuteUtils.killProc(name);
} catch (Exception e) {
log.error("杀进程异常", e);
}
// 上报黑名单异常
mapSoftRequest.add(name);
}
log.info("收到软件检测白名单");
try {
// 扫描进程列表
Set<String> processNames = new HashSet<>();
Set<String> killProcessNames = new HashSet<>();
///FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "USERNAME ne 暂缺"
Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"'
+ " -fi " + '"' + "USERNAME ne NT AUTHORITY\\NETWORK SERVICE" + '"'
+ " -fi " + '"' + "USERNAME ne NT AUTHORITY\\LOCAL SERVICE" + '"'
+ " -fi " + '"' + "USERNAME ne Window Manager\\UMFD-0" + '"'
+ " -fi " + '"' + "USERNAME ne Font Driver Host\\UMFD-1" + '"'
+ " -fi " + '"' + "USERNAME ne Font Driver Host\\DWM-1" + '"'
+ " -fi " + '"' + "USERNAME ne 暂缺" + '"'
+ " /fo csv");
try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
reader.readLine();
String line;
while ((line = reader.readLine()) != null)
processNames.add(line.substring(1, line.indexOf("\",\"")).trim());
process.destroy();
}
} else {
log.info("收到软件检测白名单");
try {
// 扫描进程列表
Set<String> processNames = new HashSet<>();
Set<String> killProcessNames = new HashSet<>();
///FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "USERNAME ne 暂缺"
Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"' + " -fi " + '"' + "USERNAME ne 暂缺" + '"' + " /fo csv");
try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
reader.readLine();
String line;
while ((line = reader.readLine()) != null)
processNames.add(line.substring(1, line.indexOf("\",\"")).trim());
process.destroy();
}
for (String processName : processNames) {
boolean isContains = false;
for (RegisterParamDto.RegisterDetailParamDto program : programs) {
String name = program.getName().trim();
if (processNames.contains(name)) {
isContains = true;
break;
}
}
if (!isContains) {
// 上报白名单异常
killProcessNames.add(processName);
for (String processName : processNames) {
if (excludePrograms.contains(processName)) {
continue;
}
boolean isContains = false;
for (RegisterParamDto.RegisterDetailParamDto program : programs) {
String name = program.getName().trim();
if (StrUtil.equals(processName, name)) {
isContains = true;
break;
}
}
if (killProcessNames.size() > 0) {
mapSoftRequest = new ArrayList<>();
for (String name : killProcessNames) {
log.info("软件检测软件: {}", name);
boolean isE = WinExecuteUtils.findProcess(name);
if (isE) {
// 杀进程
log.info("存在黑名单软件, 进行进程查杀: {}", name);
try {
WinExecuteUtils.killProc(name);
} catch (Exception e) {
log.error("杀进程异常", e);
}
// 上报白名单异常
mapSoftRequest.add(name);
if (!isContains) {
killProcessNames.add(processName);
}
}
if (killProcessNames.size() > 0) {
mapSoftRequest = new ArrayList<>();
for (String name : killProcessNames) {
log.info("软件检测软件: {}", name);
boolean isE = WinExecuteUtils.findProcess(name);
if (isE) {
// 杀进程
log.info("存在白名单软件, 进行进程查杀: {}", name);
try {
WinExecuteUtils.killProc(name);
} catch (Exception e) {
log.error("杀进程异常", e);
}
// 上报白名单异常
mapSoftRequest.add(name);
}
}
} catch (IOException e) {
log.error("软件检测上报异常", e.getMessage());
}
} catch (IOException e) {
log.error("软件检测上报异常", e.getMessage());
}
// 上报黑白名单异常
if (mapSoftRequest.size() > 0) {
if (null != mapSoftRequest && mapSoftRequest.size() > 0) {
Map eventMapRequest = new HashMap();
Map mapRequest = new HashMap();
eventMapRequest.put("requestId", 2);
eventMapRequest.put("methodName", type == 1 ? "BlackList" : "WhiteList"); // BlackList WriteList
eventMapRequest.put("requestId", 22);
eventMapRequest.put("methodName", "WhiteList"); // BlackList WriteList
eventMapRequest.put("params", mapRequest);
for (String mapSoftRequestData : mapSoftRequest) {
......@@ -166,12 +187,4 @@ public class ApqRegisterJob {
}
}
public static void main(String[] args) {
try {
WinExecuteUtils.killProc("Xshell.exe");
} catch (IOException e) {
log.error("杀进程异常", e);
}
}
}
......@@ -2,7 +2,7 @@
; SEE THE DOCUMENTATION FOR DETAILS ON CREATING INNO SETUP SCRIPT FILES!
#define MyAppName "阿普奇检测客户端"
#define MyAppVersion "V1.0"
#define MyAppVersion "V1.0"
#define MyAppPublisher "阿普奇"
#define MyAppURL "https://www.apq.com/"
#define MyAppDirName "apq-client"
......
......@@ -5,9 +5,9 @@
#define MyAppVersion "V1.0"
#define MyAppPublisher "阿普奇"
#define MyAppURL "https://www.apq.com/"
#define MyAppDirName "apq-client"
#define MyAppEnName "apq-client"
#define MyAppExeName "apq-client.exe"
#define MyAppDirName "apq-client"
#define MyAppEnName "apq-client"
#define MyAppExeName "apq-client.exe"
[Setup]
; 注: AppId的值为单独标识该应用程序。
......
Copyright (c) Electron contributors
Copyright (c) 2013-2020 GitHub Inc.
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
No preview for this file type
Markdown 格式
0%
您添加了 0 到此讨论。请谨慎行事。
请先完成此评论的编辑!
注册 或者 后发表评论