# 셸 스크립트 종속성
# Debian/Ubuntu
apt-get install jq gawk gzip

# RHEL/CentOS/Fedora
dnf install jq gawk gzip

# macOS
brew install jq gawk

# Python 종속성 (FTDC 디코딩용)
pip install -r requirements.txt

# 저장소 클론
git clone https://github.com/your-org/mongobleed-detector.git
cd mongobleed-detector

# 스크립트 실행 권한 부여
chmod +x mongobleed-detector.sh
chmod +x mongobleed-remote.py
chmod +x ftdc-decode.py

# Python 종속성 설치 (선택 사항, FTDC 지원용)
pip install -r requirements.txt

./collected-data/
├── logs/                    # MongoDB JSON 로그
│   ├── mongod.log
│   ├── mongod.log.1
│   └── mongod.log.2.gz
├── assert-counts/           # serverStatus().asserts 스냅샷
│   ├── asserts-2025-01-01.json
│   └── asserts-2025-01-02.json
└── ftdc-files/              # FTDC diagnostic.data 내용
    ├── metrics.2025-01-02T10-00-00Z-00000
    └── metrics.interim

# 원격 호스트에서 복사
scp user@mongohost:/var/log/mongodb/mongod.log* ./collected-data/logs/

mongosh --quiet --eval 'JSON.stringify({
  timestamp: new Date().toISOString(),
  hostname: db.hostInfo().system.hostname,
  asserts: db.serverStatus().asserts,
  uptime: db.serverStatus().uptime
})' > asserts-$(date +%Y%m%d-%H%M%S).json

# FTDC 파일 복사 (sudo가 필요할 수 있음)
sudo cp /var/lib/mongodb/diagnostic.data/metrics.* ./collected-data/ftdc-files/

# 자동 검색 모드 - 사용 가능한 모든 데이터 분석
./mongobleed-detector.sh --data-dir ./collected-data/

# 사용자 지정 임계값 사용
./mongobleed-detector.sh --data-dir ./collected-data/ \
    -t 1440 \              # 24시간 조회 기간
    -c 50 \                # 더 낮은 연결 임계값
    --spike-threshold 50   # 더 낮은 스파이크 임계값

# 기본 경로 스캔
./mongobleed-detector.sh

# 특정 로그 파일 스캔
./mongobleed-detector.sh -p /path/to/logs/*.json

# 포렌식 모드 (여러 호스트 분석)
./mongobleed-detector.sh --forensic-dir /evidence/

# 호스트 파일 생성
cat > hosts.txt << EOF
mongo-prod-01.example.com
mongo-prod-02.example.com
mongo-staging.example.com
EOF

# 수집 및 분석
./mongobleed-remote.py --hosts-file hosts.txt --user admin --output-dir ./collected-data/

# 특정 SSH 키 사용
./mongobleed-remote.py --hosts-file hosts.txt --user admin --key ~/.ssh/mongodb_key

# 병렬 실행
./mongobleed-remote.py --hosts-file hosts.txt --user admin --parallel 10

# FTDC 수집 건너뛰기 (더 빠름)
./mongobleed-remote.py --hosts-file hosts.txt --user admin --skip-ftdc

# 수집만 하고 나중에 분석
./mongobleed-remote.py --hosts-file hosts.txt --user admin --collect-only

# SSH 옵션 전달 (예: 점프 호스트)
./mongobleed-remote.py --hosts-file hosts.txt --user admin \
    -o "ProxyJump=bastion.example.com"

# 권한이 필요한 파일 접근에 sudo 사용 (FTDC 파일은 종종 제한됨)
./mongobleed-remote.py --hosts-file hosts.txt --user admin --sudo

# 연결 문제 해결을 위한 디버그 모드
./mongobleed-remote.py --hosts-file hosts.txt --user admin --debug

INFO: Auto-discovery mode: analyzing ./collected-data/
INFO: Module A: Analyzing 3 log file(s)...
INFO: Module B1: Analyzing assert-counts...

╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                              MongoBleed (CVE-2025-14847) Detection Results                                       ║
╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

Module Status:
  [✓] Module A (Log Correlation): 3 log file(s) found
  [✓] Module B1 (Assert Counts): 4 snapshot(s) found
  [−] Module B2 (FTDC Spikes): No FTDC files or decoder unavailable

Analysis Parameters:
  Time Window:        4320 minutes
  Connection Thresh:  100
  Burst Rate Thresh:  400/min
  Metadata Rate:      0.10
  Spike Threshold:    100
  User Ratio Thresh:  250x

Module A - Log Correlation Findings:

Risk     SourceIP                                  ConnCount  MetaCount  DiscCount    MetaRate%    BurstRate/m FirstSeen (UTC)        LastSeen (UTC)        
-------- ---------------------------------------- ---------- ---------- ---------- ------------ -------------- ---------------------- ----------------------
HIGH     137.137.137.137                                8172          0       8172        0.00%         490.32 2025-12-27T12:55:52Z   2025-12-27T13:12:32Z  

Module B1 - Assert Counts Analysis:
  Analyzed 4 snapshots from 2025-01-01T10:00:00Z to 2025-01-01T11:30:00Z
    asserts.user: 100 -> 860 (delta: 760)
  SPIKE DETECTED: 2025-01-01T10:30:00Z to 2025-01-01T11:00:00Z
    Delta: +740 user asserts (110 -> 850)

═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Combined Verdict:
  MEDIUM CONFIDENCE - Investigation recommended
    - Suspicious connection patterns but FTDC data unavailable for correlation

⚠ IMPORTANT: If exploitation is confirmed, patching alone is insufficient.
  - Rotate all credentials that may have been exposed
  - Review accessed data for sensitive information disclosure
  - Check for lateral movement from affected systems
  - Preserve logs for forensic analysis

Caveats:
  - Connection metadata absence is PoC-specific and can be evaded
  - Assertion counters are cumulative - false positives possible without baseline
  - FTDC provides timing but not perfect attribution
  - Patch + rotate secrets remains mandatory regardless of detection results

example-data/
├── logs/                    # 공격 패턴이 포함된 실제 MongoDB 로그
│   ├── mongod.log
│   └── mongod.log.1.gz
├── assert-counts/           # 공격 후 serverStatus().asserts 스냅샷
│   └── asserts-post-attack.json
└── ftdc-files/              # 실제 FTDC 진단 데이터 파일
    └── metrics.*

./test/generate-test-logs.sh

./test/test-detector.sh

╔════════════════════════════════════════════════════════╗
║       MongoBleed Detector Test Suite                   ║
╚════════════════════════════════════════════════════════╝

Module A Tests (Log Correlation):
✓ PASS: Exit code is 1 (findings detected)
✓ PASS: Detected source IP 137.137.137.137
...

Module B1 Tests (Assert Counts):
✓ PASS: Shows Module B1 status
✓ PASS: Detected assert spike
...

Auto-Discovery Mode Tests:
✓ PASS: Shows Module A status
✓ PASS: Shows combined verdict
...

Results:
  Passed: 24
  Failed: 0

All tests passed!