diff --git a/README.md b/README.md index 84d0e7d..bdc33c5 100644 --- a/README.md +++ b/README.md @@ -21,5 +21,6 @@ Pastehunter supports several output modules: - Dump to JSON file. - Dump to CSV file. - Send to syslog. + - Send to telegram channel. For examples of data discovered using pastehunter check out my posts https://techanarchy.net/blog/hunting-pastebin-with-pastehunter and https://techanarchy.net/blog/pastehunter-the-results diff --git a/outputs/telegram_output.py b/outputs/telegram_output.py new file mode 100644 index 0000000..4a50270 --- /dev/null +++ b/outputs/telegram_output.py @@ -0,0 +1,25 @@ +from telegram.ext import Updater + +from common import parse_config +import logging + +logger = logging.getLogger('pastehunter') +config = parse_config() + + +class TelegramOutput(): + def __init__(self): + self.token = config['outputs']['telegram_output']['token'] + self.chat_id = config['outputs']['telegram_output']['chat_id'] + self.updater = Updater(token=self.token, + request_kwargs={"proxy_url": config['outputs']['telegram_output']['proxy_url']}) + + def store_paste(self, paste_data): + if paste_data['pastesite']=='pastebin.com': + url = paste_data['full_url'] + else: + url = paste_data['scrape_url'] + send_data = "From {0}: Matched Rule: {1}, See : {2}".format(paste_data['pastesite'], str(paste_data['YaraRule']), url) + + self.updater.bot.send_message(chat_id=self.chat_id, text=send_data) + logger.debug("send a message %s"%send_data) diff --git a/requirements.txt b/requirements.txt index 8ed65b5..3d57308 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,15 @@ requests>=2.20.0 +asn1crypto==0.24.0 +certifi==2018.11.29 +cffi==1.11.5 +chardet==3.0.4 +cryptography==2.4.2 elasticsearch>=5.0.0,<6.0.0 +future==0.17.1 +idna==2.6 +pycparser==2.19 +python-telegram-bot==11.1.0 +six==1.12.0 splunk-sdk -yara-python \ No newline at end of file +urllib3==1.22 +yara-python diff --git a/settings.json.sample b/settings.json.sample index f006a2e..5b7c08c 100644 --- a/settings.json.sample +++ b/settings.json.sample @@ -55,6 +55,14 @@ } }, "outputs": { + "telegram_output": { + "enabled": true, + "token": "xxx", + "chat_id": "", + "proxy_url": "", + "module": "outputs.telegram_output", + "classname": "TelegramOutput" + }, "elastic_output": { "enabled": true, "module": "outputs.elastic_output",