#!/usr/bin/env python3
"""
Анализ расшифрованных кредов из 49 баз i21
"""
import csv
import json
from pathlib import Path
from collections import defaultdict

OUTPUT_DIR = Path('/root/ir-assessment/redteam/irelydata/decrypted_creds')
SUMMARY_FILE = Path('/root/ir-assessment/redteam/irelydata/summary_decrypted_creds.csv')
ANALYSIS_DIR = Path('/root/ir-assessment/redteam/irelydata/analysis')
ANALYSIS_DIR.mkdir(exist_ok=True)

# Загружаем все креды
creds_by_db = defaultdict(list)
creds_by_user = defaultdict(list)
creds_by_password = defaultdict(list)
backdoor_users = set()
all_creds = []

print("Загрузка кредов...")
for csv_file in OUTPUT_DIR.glob('*_creds_decrypted.csv'):
    db_name = csv_file.stem.replace('_creds_decrypted', '')
    
    with open(csv_file, 'r', encoding='utf-8') as f:
        lines = f.readlines()
        # Пропускаем заголовок и разделитель
        for line in lines[2:]:
            parts = line.strip().split('|')
            if len(parts) >= 4 and parts[0].isdigit():
                cred_id, username, password, email = parts[0], parts[1], parts[2], parts[3]
                cred = {
                    'db': db_name,
                    'id': cred_id,
                    'username': username,
                    'password': password,
                    'email': email if email != 'NULL' else None
                }
                creds_by_db[db_name].append(cred)
                creds_by_user[username].append(cred)
                creds_by_password[password].append(cred)
                all_creds.append(cred)
                
                # Бэкдоры
                if password == 'i21By2015':
                    backdoor_users.add(username)

print(f"\n=== СТАТИСТИКА ===")
print(f"Всего кредов: {len(all_creds)}")
print(f"Уникальных пользователей: {len(creds_by_user)}")
print(f"Уникальных паролей: {len(creds_by_password)}")
print(f"Баз данных: {len(creds_by_db)}")

print(f"\n=== БЭКДОРЫ (пароль i21By2015) ===")
backdoor_creds = [c for c in all_creds if c['password'] == 'i21By2015']
print(f"Кредов с бэкдором: {len(backdoor_creds)}")
print(f"В скольких базах: {len(set(c['db'] for c in backdoor_creds))}")
print(f"Уникальные пользователи с бэкдором: {backdoor_users}")

print(f"\n=== ТОП-20 ПАРОЛЕЙ ===")
top_passwords = sorted(creds_by_password.items(), key=lambda x: len(x[1]), reverse=True)[:20]
for pwd, creds in top_passwords:
    dbs = sorted(set(c['db'] for c in creds))
    print(f"{pwd}: {len(creds)} кредов в {len(dbs)} базах")

print(f"\n=== ПОЛЬЗОВАТЕЛИ С КРЕДАМИ В 3+ БАЗАХ ===")
multi_db_users = [(u, creds) for u, creds in creds_by_user.items() 
                  if len(set(c['db'] for c in creds)) >= 3]
multi_db_users.sort(key=lambda x: len(set(c['db'] for c in x[1])), reverse=True)
for username, creds in multi_db_users[:30]:
    dbs = sorted(set(c['db'] for c in creds))
    passwords = sorted(set(c['password'] for c in creds))
    print(f"{username}: {len(dbs)} баз, пароли: {passwords[:3]}{'...' if len(passwords) > 3 else ''}")

print(f"\n=== БАЗЫ ПО КОЛИЧЕСТВУ КРЕДОВ ===")
dbs_sorted = sorted(creds_by_db.items(), key=lambda x: len(x[1]), reverse=True)
for db, creds in dbs_sorted[:15]:
    backdoor_count = sum(1 for c in creds if c['password'] == 'i21By2015')
    print(f"{db}: {len(creds)} кредов, {backdoor_count} с бэкдором")

# Сохраняем результаты
print(f"\n=== СОХРАНЕНИЕ РЕЗУЛЬТАТОВ ===")

# 1. Группировка по компаниям
with open(ANALYSIS_DIR / 'creds_by_company.json', 'w', encoding='utf-8') as f:
    json.dump({db: creds for db, creds in creds_by_db.items()}, f, indent=2, ensure_ascii=False)
print(f"✓ creds_by_company.json")

# 2. Общие пользователи
with open(ANALYSIS_DIR / 'multi_db_users.json', 'w', encoding='utf-8') as f:
    multi_db_data = {}
    for username, creds in multi_db_users:
        multi_db_data[username] = {
            'databases': sorted(set(c['db'] for c in creds)),
            'passwords': sorted(set(c['password'] for c in creds)),
            'total_creds': len(creds)
        }
    json.dump(multi_db_data, f, indent=2, ensure_ascii=False)
print(f"✓ multi_db_users.json")

# 3. Топ паролей
with open(ANALYSIS_DIR / 'top_passwords.json', 'w', encoding='utf-8') as f:
    top_pwd_data = {}
    for pwd, creds in top_passwords:
        top_pwd_data[pwd] = {
            'count': len(creds),
            'databases': sorted(set(c['db'] for c in creds)),
            'users': sorted(set(c['username'] for c in creds))
        }
    json.dump(top_pwd_data, f, indent=2, ensure_ascii=False)
print(f"✓ top_passwords.json")

# 4. Отчёт по бэкдорам
with open(ANALYSIS_DIR / 'backdoor_report.txt', 'w', encoding='utf-8') as f:
    f.write("=== БЭКДОР IRELY I21 (пароль i21By2015) ===\n\n")
    f.write(f"Всего кредов с бэкдором: {len(backdoor_creds)}\n")
    f.write(f"В скольких базах: {len(set(c['db'] for c in backdoor_creds))}\n")
    f.write(f"Уникальные пользователи: {sorted(backdoor_users)}\n\n")
    
    f.write("=== ПО БАЗАМ ===\n")
    for db, creds in sorted(creds_by_db.items()):
        backdoor_in_db = [c for c in creds if c['password'] == 'i21By2015']
        if backdoor_in_db:
            f.write(f"\n{db}:\n")
            for c in backdoor_in_db:
                f.write(f"  - {c['username']} (ID: {c['id']})\n")
print(f"✓ backdoor_report.txt")

print(f"\n=== АНАЛИЗ ЗАВЕРШЁН ===")