# Shell 脚本依赖
# Debian/Ubuntu
apt-get install jq gawk gzip

# RHEL/CentOS/Fedora
dnf install jq gawk gzip

# macOS
brew install jq gawk

# Python 依赖（用于 FTDC 解码）
pip install -r requirements.txt

# 克隆仓库
git clone https://github.com/your-org/mongobleed-detector.git
cd mongobleed-detector

# 赋予脚本可执行权限
chmod +x mongobleed-detector.sh
chmod +x mongobleed-remote.py
chmod +x ftdc-decode.py

# 安装 Python 依赖（可选，用于 FTDC 支持）
pip install -r requirements.txt

./collected-data/
├── logs/                    # MongoDB JSON 日志
│   ├── mongod.log
│   ├── mongod.log.1
│   └── mongod.log.2.gz
├── assert-counts/           # serverStatus().asserts 快照
│   ├── asserts-2025-01-01.json
│   └── asserts-2025-01-02.json
└── ftdc-files/              # FTDC diagnostic.data 内容
    ├── metrics.2025-01-02T10-00-00Z-00000
    └── metrics.interim

# 从远程主机复制
scp user@mongohost:/var/log/mongodb/mongod.log* ./collected-data/logs/

mongosh --quiet --eval 'JSON.stringify({
  timestamp: new Date().toISOString(),
  hostname: db.hostInfo().system.hostname,
  asserts: db.serverStatus().asserts,
  uptime: db.serverStatus().uptime
})' > asserts-$(date +%Y%m%d-%H%M%S).json

# 复制 FTDC 文件（可能需要 sudo）
sudo cp /var/lib/mongodb/diagnostic.data/metrics.* ./collected-data/ftdc-files/

# 自动发现模式 - 分析所有可用数据
./mongobleed-detector.sh --data-dir ./collected-data/

# 使用自定义阈值
./mongobleed-detector.sh --data-dir ./collected-data/ \
    -t 1440 \              # 24 小时回看窗口
    -c 50 \                # 更低的连接阈值
    --spike-threshold 50   # 更低的激增阈值

# 扫描默认路径
./mongobleed-detector.sh

# 扫描特定日志文件
./mongobleed-detector.sh -p /path/to/logs/*.json

# 取证模式（分析多台主机）
./mongobleed-detector.sh --forensic-dir /evidence/

# 创建主机列表文件
cat > hosts.txt << EOF
mongo-prod-01.example.com
mongo-prod-02.example.com
mongo-staging.example.com
EOF

# 采集并分析
./mongobleed-remote.py --hosts-file hosts.txt --user admin --output-dir ./collected-data/

# 使用指定的 SSH 密钥
./mongobleed-remote.py --hosts-file hosts.txt --user admin --key ~/.ssh/mongodb_key

# 并行执行
./mongobleed-remote.py --hosts-file hosts.txt --user admin --parallel 10

# 跳过 FTDC 采集（更快）
./mongobleed-remote.py --hosts-file hosts.txt --user admin --skip-ftdc

# 仅采集，稍后分析
./mongobleed-remote.py --hosts-file hosts.txt --user admin --collect-only

# 传递 SSH 选项（例如跳板主机）
./mongobleed-remote.py --hosts-file hosts.txt --user admin \
    -o "ProxyJump=bastion.example.com"

# 使用 sudo 访问受权限保护的文件（FTDC 文件通常受限）
./mongobleed-remote.py --hosts-file hosts.txt --user admin --sudo

# 调试模式，排查连接问题
./mongobleed-remote.py --hosts-file hosts.txt --user admin --debug

INFO: Auto-discovery mode: analyzing ./collected-data/
INFO: Module A: Analyzing 3 log file(s)...
INFO: Module B1: Analyzing assert-counts...

╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                              MongoBleed (CVE-2025-14847) Detection Results                                       ║
╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝

Module Status:
  [✓] Module A (Log Correlation): 3 log file(s) found
  [✓] Module B1 (Assert Counts): 4 snapshot(s) found
  [−] Module B2 (FTDC Spikes): No FTDC files or decoder unavailable

Analysis Parameters:
  Time Window:        4320 minutes
  Connection Thresh:  100
  Burst Rate Thresh:  400/min
  Metadata Rate:      0.10
  Spike Threshold:    100
  User Ratio Thresh:  250x

Module A - Log Correlation Findings:

Risk     SourceIP                                  ConnCount  MetaCount  DiscCount    MetaRate%    BurstRate/m FirstSeen (UTC)        LastSeen (UTC)        
-------- ---------------------------------------- ---------- ---------- ---------- ------------ -------------- ---------------------- ----------------------
HIGH     137.137.137.137                                8172          0       8172        0.00%         490.32 2025-12-27T12:55:52Z   2025-12-27T13:12:32Z  

Module B1 - Assert Counts Analysis:
  Analyzed 4 snapshots from 2025-01-01T10:00:00Z to 2025-01-01T11:30:00Z
    asserts.user: 100 -> 860 (delta: 760)
  SPIKE DETECTED: 2025-01-01T10:30:00Z to 2025-01-01T11:00:00Z
    Delta: +740 user asserts (110 -> 850)

═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Combined Verdict:
  MEDIUM CONFIDENCE - Investigation recommended
    - Suspicious connection patterns but FTDC data unavailable for correlation

⚠ IMPORTANT: If exploitation is confirmed, patching alone is insufficient.
  - Rotate all credentials that may have been exposed
  - Review accessed data for sensitive information disclosure
  - Check for lateral movement from affected systems
  - Preserve logs for forensic analysis

Caveats:
  - Connection metadata absence is PoC-specific and can be evaded
  - Assertion counters are cumulative - false positives possible without baseline
  - FTDC provides timing but not perfect attribution
  - Patch + rotate secrets remains mandatory regardless of detection results

example-data/
├── logs/                    # 包含攻击模式的真实 MongoDB 日志
│   ├── mongod.log
│   └── mongod.log.1.gz
├── assert-counts/           # 攻击后的 serverStatus().asserts 快照
│   └── asserts-post-attack.json
└── ftdc-files/              # 真实 FTDC 诊断数据文件
    └── metrics.*

./test/generate-test-logs.sh

./test/test-detector.sh

╔════════════════════════════════════════════════════════╗
║       MongoBleed Detector Test Suite                   ║
╚════════════════════════════════════════════════════════╝

Module A Tests (Log Correlation):
✓ PASS: Exit code is 1 (findings detected)
✓ PASS: Detected source IP 137.137.137.137
...

Module B1 Tests (Assert Counts):
✓ PASS: Shows Module B1 status
✓ PASS: Detected assert spike
...

Auto-Discovery Mode Tests:
✓ PASS: Shows Module A status
✓ PASS: Shows combined verdict
...

Results:
  Passed: 24
  Failed: 0

All tests passed!