whitzard-claw 1.0.0

package/scripts/scan.sh

@@ -0,0 +1,228 @@
+#!/bin/bash
+# Exit codes: 0=SECURE, 1=WARNINGS, 2=COMPROMISED
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+IOC_DIR="$PROJECT_DIR/ioc"
+SELF_DIR_NAME="$(basename "$PROJECT_DIR")"
+
+# Default OpenClaw paths - Use environment variable or default to user's home
+OPENCLAW_DIR="${OPENCLAW_HOME:-$HOME/.openclaw}"
+SKILLS_DIR="$OPENCLAW_DIR/workspace/skills"
+WORKSPACE_DIR="$OPENCLAW_DIR/workspace"
+LOG_DIR="$PROJECT_DIR/logs"
+LOG_FILE="$LOG_DIR/security-scan.log"
+TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+
+# Set PATH for Linux systems (adjust as needed for your environment)
+export PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:$PATH"
+
+# Overall counters
+CRITICAL=0
+WARNINGS=0
+CLEAN=0
+
+# Per-category counters
+CATEGORY_NAME=""
+CATEGORY_TOTAL_CHECKS=0
+CATEGORY_CRITICAL=0
+CATEGORY_WARNINGS=0
+CATEGORY_CLEAN=0
+
+mkdir -p "$LOG_DIR"
+
+log() {
+    echo "$1" | tee -a "$LOG_FILE"
+}
+
+header() {
+    # Usage: header <new_index> <message>
+    log ""
+    log "[$1/$CATEGORY_TOTAL_CHECKS] $2"
+}
+
+result_clean() {
+    log "CLEAN: $1"
+    CLEAN=$((CLEAN + 1))
+    CATEGORY_CLEAN=$((CATEGORY_CLEAN + 1))
+}
+
+result_warn() {
+    log "WARNING: $1"
+    WARNINGS=$((WARNINGS + 1))
+    CATEGORY_WARNINGS=$((CATEGORY_WARNINGS + 1))
+}
+
+result_critical() {
+    log "CRITICAL: $1"
+    CRITICAL=$((CRITICAL + 1))
+    CATEGORY_CRITICAL=$((CATEGORY_CRITICAL + 1))
+}
+
+category_start() {
+    # Usage: category_start <name> <total_checks>
+    CATEGORY_NAME="$1"
+    CATEGORY_TOTAL_CHECKS="$2"
+    CATEGORY_CRITICAL=0
+    CATEGORY_WARNINGS=0
+    CATEGORY_CLEAN=0
+
+    log ""
+    log "----------------------------------------"
+    log "CATEGORY START: $CATEGORY_NAME ($CATEGORY_TOTAL_CHECKS checks)"
+    log "----------------------------------------"
+}
+
+category_end() {
+    log ""
+    log "CATEGORY SUMMARY: $CATEGORY_NAME"
+    log "  critical: $CATEGORY_CRITICAL"
+    log "  warning : $CATEGORY_WARNINGS"
+    log "  clean   : $CATEGORY_CLEAN"
+    log "----------------------------------------"
+}
+
+# Use timeout if available (macOS may only have gtimeout via coreutils)
+TIMEOUT_BIN=""
+if command -v timeout >/dev/null 2>&1; then
+    TIMEOUT_BIN="timeout"
+elif command -v gtimeout >/dev/null 2>&1; then
+    TIMEOUT_BIN="gtimeout"
+fi
+
+run_with_timeout() {
+    local secs="$1"
+    shift
+
+    if [ -n "$TIMEOUT_BIN" ]; then
+        "$TIMEOUT_BIN" "$secs" "$@"
+    elif command -v python3 >/dev/null 2>&1; then
+        python3 - "$secs" "$@" <<'PY'
+import subprocess
+import sys
+
+def main():
+    try:
+        secs = float(sys.argv[1])
+    except Exception:
+        secs = 0
+
+    cmd = sys.argv[2:]
+    if not cmd:
+        sys.exit(1)
+
+    try:
+        proc = subprocess.Popen(cmd)
+        try:
+            proc.wait(timeout=secs if secs > 0 else None)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+            proc.wait()
+            sys.exit(124)
+        sys.exit(proc.returncode if proc.returncode is not None else 0)
+    except FileNotFoundError:
+        sys.exit(127)
+
+if __name__ == "__main__":
+    main()
+PY
+    else
+        "$@"
+    fi
+}
+
+# Load IOC data
+load_ips() {
+    if [ -f "$IOC_DIR/c2-ips.txt" ]; then
+        grep -v '^#' "$IOC_DIR/c2-ips.txt" | grep -v '^$' | cut -d'|' -f1
+    else
+        echo "91.92.242"
+    fi
+}
+
+load_domains() {
+    if [ -f "$IOC_DIR/malicious-domains.txt" ]; then
+        grep -v '^#' "$IOC_DIR/malicious-domains.txt" | grep -v '^$' | cut -d'|' -f1
+    else
+        echo "webhook.site"
+    fi
+}
+
+log "========================================"
+log "OPENCLAW SECURITY SCAN - $TIMESTAMP"
+log "========================================"
+log "PROJECT_DIR  : $PROJECT_DIR"
+log "OPENCLAW_DIR : $OPENCLAW_DIR"
+log "SKILLS_DIR   : $SKILLS_DIR"
+log "WORKSPACE_DIR: $WORKSPACE_DIR"
+log "LOG_FILE     : $LOG_FILE"
+
+# ============================================================
+# CATEGORY 1: NETWORK GATEWAY
+# ============================================================
+category_start "NETWORK_EXPOSURE" 12
+source "$SCRIPT_DIR/check/network_exposure.sh"
+category_end
+
+# ============================================================
+# CATEGORY 2: ACCESS CONTROL
+# ============================================================
+category_start "ACCESS_CONTROL" 5
+source "$SCRIPT_DIR/check/access_control.sh"
+category_end
+
+# ============================================================
+# CATEGORY 3: EXECUTION SANDBOX
+# ============================================================
+category_start "EXECUTION_SANDBOX" 13
+source "$SCRIPT_DIR/check/execution_sandbox.sh"
+category_end
+
+# ============================================================
+# CATEGORY 4: CREDENTIAL STORAGE
+# ============================================================
+category_start "CREDENTIAL_STORAGE" 3
+source "$SCRIPT_DIR/check/credential_storage.sh"
+category_end
+
+# ============================================================
+# CATEGORY 5: MEMORY POISONING
+# ============================================================
+category_start "MEMORY_POISONING" 5
+source "$SCRIPT_DIR/check/memory_poisoning.sh"
+category_end
+
+# ============================================================
+# CATEGORY 6: SUPPLY CHAIN
+# ============================================================
+category_start "SUPPLY_CHAIN" 18
+source "$SCRIPT_DIR/check/supply_chain.sh"
+category_end
+
+# ============================================================
+# CATEGORY 7: RESOURCE COST
+# ============================================================
+category_start "RESOURCE_COST" 3
+source "$SCRIPT_DIR/check/resource_cost.sh"
+category_end
+
+# ============================================================
+# FINAL SUMMARY
+# ============================================================
+log ""
+log "========================================"
+log "SCAN COMPLETE: $CRITICAL critical, $WARNINGS warnings, $CLEAN clean"
+log "========================================"
+
+if [ "$CRITICAL" -gt 0 ]; then
+    log "STATUS: COMPROMISED - Immediate action required"
+    exit 2
+elif [ "$WARNINGS" -gt 0 ]; then
+    log "STATUS: ATTENTION - Review warnings"
+    exit 1
+else
+    log "STATUS: SECURE"
+    exit 0
+fi