Jump to content

I'd like to capture IP addresses that are attacking my email server

Docfxit
 Share
Go to solution Solved by Docfxit,

Recommended Posts

Docfxit Universalist

Docfxit

Posted
Posted (edited)

I'm trying to format the current date into this format yyyy-mm-dd

and put it into the last line where CurrentDate is. 

; Find IP addresses trying to attack my email server
#include <Date.au3>
#include <MsgBoxConstants.au3>
Local $sDate

$CurrentDate = _NowCalcDate ( )

Func FormatDate($DATE)
    $SPLIT = StringSplit($DATE,"/")
    $YYYY = StringLeft($SPLIT[1],4)
    $MM = StringMid($SPLIT[2],1)
    $DD = StringRight($SPLIT[3],2)
    Return $YYYY & "-" & $MM & "-" & $DD
EndFunc

MsgBox(0,"",FormatDate($CurrentDATE))
ShellExecute("\\192.168.168.16\C\Programs\CommuniGate Files\SystemLogs\" & FormatDate($CurrentDate) & ".log")

What I am getting is    2024-06-21

What it should be is    2024-06-21

I don't understand why this: $MM = StringMid($SPLIT[2],1)

                    shouldn't be this: $MM = StringMid($SPLIT[2],2)

Edited by Docfxit
Docfxit Universalist

Docfxit

Posted
  • Author
Posted

This is working: $MM = StringMid($SPLIT[2],1)

My understanding is $Split[2] says to start in the second position.

and ,1 says for a length of one.

It's actually giving me two positions.

If I use $MM = StringMid($SPLIT[2],2)

It only gives me one character.

Andreik Universalist

Andreik

Posted
Posted (edited)
  On 6/22/2024 at 5:39 AM, Docfxit said:

This is working: $MM = StringMid($SPLIT[2],1)

My understanding is $Split[2] says to start in the second position.

and ,1 says for a length of one.

It's actually giving me two positions.

If I use $MM = StringMid($SPLIT[2],2)

It only gives me one character.

Expand  

This is not how it's working. $Split[2] contains 06 part of your date. Then using StringMid() it's kinda useless in this case because it says start from first character and extract the entire remainder of the string. Basically it does nothing to your string. If you still want to use StringSplit() you don't need all these StringLeft(), StringMid() and StringRight() because you already have your data in the correct format. 

#include <Date.au3>

$CurrentDate = _NowCalcDate()
MsgBox(0, '', FormatDate($CurrentDate))

Func FormatDate($Date)
    Local $aSplit = StringSplit($Date, '/')
    Return ($aSplit[0] = 3 ? $aSplit[1] & '-' & $aSplit[2] & '-' & $aSplit[3] : '')
EndFunc

Also, if you want to use StringLeft(), StringMid() and StringRight() then you don't need StringSplit(). 

#include <Date.au3>

$CurrentDate = _NowCalcDate()
MsgBox(0, '', FormatDate($CurrentDate))

Func FormatDate($Date)
    Return StringLeft($Date, 4) & '-' & StringMid($Date, 6, 2) & '-' & StringRight($Date, 2)
EndFunc

 

Edited by Andreik
Docfxit Universalist

Docfxit

Posted
  • Author
Posted

I have a text file with thousands of lines.

I need to search every line to find the text myemail@mydomain.com and SMTPI

This is what a line looks like:

00:02:35.787 5 SMTPI-062727([166.154.243.74]) SASL-0(LOGIN) inp: myemail@mydomain.com

If I find the line I need to the put IP address within the [ ] into a variable called @IPAddress

On this line it's 166.154.243.74

If @IPAddress is not = 55.55.55.55

Run some code.

I have the code to read the file: 

; Find IP addresses trying to attack my email server
#include <Date.au3>
#include <MsgBoxConstants.au3>
#include <FileConstants.au3>
#include <WinAPIFiles.au3>

Example()
$CurrentDate = _NowCalcDate()
StringReplace($CurrentDate, '/', '-')
Func Example()
    ; filename to read
    $file_to_read = "\\192.168.168.16\C\Programs\CommuniGate Files\SystemLogs\" & @YEAR & '-' & @MON & '-' & @MDAY & ".log"
    ; open file to read and store the handle
    $handle_read = FileOpen($file_to_read, 0)
    ; check the handle is valid
    If $handle_read = -1 Then
        ; show warning and exit with code 1
        MsgBox(0, @ScriptName, 'failed to open & @YEAR & ' - ' & @MON & ' - ' & @MDAY & ".log"')
        Exit 1
    EndIf

    ; loop through each line of the file
    While 1
        ; read each line from a file
        $line_read = FileReadLine($handle_read)
        ; exit the loop if end of file
        If @error Then ExitLoop
        ; show the line read (just for testing)
        MsgBox(0, 'Line read', $line_read)
        ;*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
        ; I will put the code here
        ;*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
    WEnd

    ; close the file handle for read
    FileClose($handle_read)
EndFunc   ;==>Example

 

Andreik Universalist

Andreik

Posted
Posted

Since you didn't said anything about what contains the rest of the file here is a naive approach: 

;~ $sText = FileRead('your_file.ext')
$sText = '00:02:35.787 5 SMTPI-062727([166.154.243.74]) SASL-0(LOGIN) inp: myemail@mydomain.com '

$aInfo = StringRegExp($sText, 'SMTP(?:.*?)\(\[(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]\)(?:.*?)inp: ([^ ]+@[^ ]+)', 3)

MsgBox(0,'', $aInfo[0] & @CRLF & $aInfo[1])

Be aware that these regex patterns are not enough to match all possible valid IP addresses or email addresses but it might be enough for what you need. For a better answer post or explain what contain the entire file.

Docfxit Universalist

Docfxit

Posted
  • Author
Posted

I have added some code that I think explains what I would like.  Please help me get it correct. 

; Find IP addresses trying to attack my email server
#include <Date.au3>
#include <MsgBoxConstants.au3>
#include <FileConstants.au3>
#include <WinAPIFiles.au3>
Local $aInfo

Example()
$CurrentDate = _NowCalcDate()
StringReplace($CurrentDate, '/', '-')
Func Example()
    ; filename to read
    $file_to_read = "\\192.168.168.16\C\Programs\CommuniGate Files\SystemLogs\" & @YEAR & '-' & @MON & '-' & @MDAY & ".log"
    ; open file to read and store the handle
    $handle_read = FileOpen($file_to_read, 0)
    ; check the handle is valid
    If $handle_read = -1 Then
        ; show warning and exit with code 1
        MsgBox(0, @ScriptName, 'failed to open & @YEAR & ' - ' & @MON & ' - ' & @MDAY & ".log"')
        Exit 1
    EndIf

    ; loop through each line of the file
    While 1
        ; read each line from a file
        $sText = FileReadLine($handle_read)
        ; exit the loop if end of file
        If @error Then ExitLoop
        ;*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
        ; Please help me with this code
        ;*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
        $sSearchEmail = "myemail@mydomain.com"  ; This never changes
        $sSearchIP = "55.55.55.55"              ; This never changes
; The line I'm searching looks like this:
;   00:02:35.787 5 SMTPI-062727([166.154.243.74]) SASL-0(LOGIN) inp: myemail@mydomain.com
        If StringInStr($sText, $sSearchEmail) & StringInStr($sText, "SMTPI") Then
            If Not StringInStr($sText, $sSearchIP) Then
                Local $IPAddress = StringRegExp($sText, ; Get everything in between "[" and "]"
                MsgBox(0, '', $IPAddress & @CRLF & 'Line read - ' & $sText)
            EndIf
        EndIf
    WEnd

    ; close the file handle for read
    FileClose($handle_read)
EndFunc   ;==>Example

 

Andreik Universalist

Andreik

Posted
Posted (edited) 
;~ Uncomment this in your code and comment test data below
;~ $sData = FileRead("\\192.168.168.16\C\Programs\CommuniGate Files\SystemLogs\" & @YEAR & '-' & @MON & '-' & @MDAY & ".log")

; Simulate some data
$sData = '00:02:35.787 5 SMTPI-062727([166.154.243.74]) SASL-0(LOGIN) inp: myemail@mydomain.com ' & @CRLF
$sData &= '00:02:35.787 5 SMTPI-062727([55.55.55.55]) SASL-0(LOGIN) inp: myemail@mydomain.com ' & @CRLF
$sData &= '00:02:35.787 5 SMTPI-062727([55.55.55.55]) SASL-0(LOGIN) inp: differentemail@mydomain.com ' & @CRLF
$sData &= '00:02:35.787 5 SMTPI-062727([25.25.25.25]) SASL-0(LOGIN) inp: myemail@mydomain.com ' & @CRLF

$aData = StringRegExp($sData, '(?m)^(?:.*?)SMTP(?:.*?)\(\[(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]\)(?:.*?)inp: ([^ ]+@[^ ]+)(?:.*?)$', 3)

$sSearchEmail = "myemail@mydomain.com"  ; This never changes
$sSearchIP = "55.55.55.55"              ; This never changes

If IsArray($aData) Then
    For $Index = 0 To UBound($aData) - 1 Step 2
        If $aData[$Index] = $sSearchIP And $aData[$Index + 1] = $sSearchEmail Then
            MsgBox(0, 'This is what I need', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1])
        Else
            MsgBox(0, 'This is what I read', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1])
        EndIf
    Next
EndIf

As you can see the MsgBox with title "This is what I need" will be called just once when IP address is 55.55.55.55 and when email address is myemail@mydomain.com. In your code you can remove data used to test and uncomment the file read. And yes, you don't need to read the file line by line but to process each line.

Edited by Andreik
Andreik Universalist

Andreik

Posted
Posted (edited)

And when exactly will happens that? If the format of a line is what OP said it is then you never get as a result an array with an odd number as size. Even malformed lines results in a match (with 2 groups) or nothing so the size should always be even.

Edited by Andreik
  • Solution
Docfxit Universalist

Docfxit

Posted
  • Author
  • Solution
Posted (edited)

I got it working with this code: 

; Find IP addresses trying to attack my email server
#include <Date.au3>
#include <MsgBoxConstants.au3>
#include <FileConstants.au3>
#include <WinAPIFiles.au3>
Local $aInfo

Example()
$CurrentDate = _NowCalcDate()
StringReplace($CurrentDate, '/', '-')
Func Example()
    ; filename to read
    $file_to_read = "\\192.168.168.16\C\Programs\CommuniGate Files\SystemLogs\" & @YEAR & '-' & @MON & '-' & @MDAY & ".log"
    ; open file to read and store the handle
    $handle_read = FileOpen($file_to_read, 0)
    ; check the handle is valid
    If $handle_read = -1 Then
        ; show warning and exit with code 1
        MsgBox(0, @ScriptName, 'failed to open & @YEAR & ' - ' & @MON & ' - ' & @MDAY & ".log"')
        Exit 1
    EndIf

    ; loop through each line of the file
    While 1
        ; read each line from a file
        $sData = FileReadLine($handle_read)
        ; exit the loop if end of file
        If @error Then ExitLoop
                $sSearchEmail = "myemail@mydomain.com"     ; This never changes
                $sSearchIP = "55.55.55.55"                ; This never changes
        ; The line I'm searching looks like this:
        ;   00:02:35.787 5 SMTPI-062727([166.154.243.74]) SASL-0(LOGIN) inp: myemail@mydomain.com
        $aData = StringRegExp($sData, '(?m)^(?:.*?)SMTP(?:.*?)\(\[(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]\)(?:.*?)inp: ([^ ]+@[^ ]+)(?:.*?)$', 3)

        If IsArray($aData) Then
            For $Index = 0 To UBound($aData) - 1 Step 2
                If $aData[$Index + 1] = $sSearchEmail Then
                    If $aData[$Index] = $sSearchIP Then
                        MsgBox(0, 'This is what I skip', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1] & @CRLF & 'Line read - ' & $sData)
                    Else
                        MsgBox(0, 'This is what I need', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1] & @CRLF & 'Line read - ' & $sData)
                    EndIf
                EndIf
            Next
        EndIf
    WEnd

    ; close the file handle for read
    FileClose($handle_read)
EndFunc   ;==>Example


 

Edited by Docfxit
Andreik Universalist

Andreik

Posted
Posted

Because you don't stop to understand code, you just simply copy/paste. 

If $aData[$Index] = $sSearchIP And $aData[$Index + 1] = $sSearchEmail Then
    MsgBox(0, 'This is what I skip', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1] & @CRLF & 'Line read - ' & $sData)
Else
    MsgBox(0, 'This is what I need', 'IP: ' & $aData[$Index] & @CRLF & 'Email: ' & $aData[$Index + 1] & @CRLF & 'Line read - ' & $sData)
EndIf

It's clear enough that when the desired IP and email is identified your MsgBox display This is what I skip and when they are not identified you display the message This is what I need. :ermm:

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...