#!/usr/bin/env python3
"""
Глубокий анализ расшифрованных credentials
"""
import json
import csv
from pathlib import Path
from collections import defaultdict, Counter
import re

CREDS_DIR = Path('/root/ir-assessment/redteam/irelydata/decrypted_creds')

print("=" * 80)
print("ГЛУБОКИЙ АНАЛИЗ РАСШИФРОВАННЫХ CREDENTIALS")
print("=" * 80)

# Загрузка всех credentials
all_creds = []
creds_by_db = defaultdict(list)
creds_by_user = defaultdict(list)
creds_by_password = defaultdict(list)

for csv_file in CREDS_DIR.glob('*_creds_decrypted.csv'):
    db_name = csv_file.stem.replace('_creds_decrypted', '')
    
    with open(csv_file, 'r', encoding='utf-8', errors='ignore') as f:
        reader = csv.DictReader(f, delimiter='|')
        for row in reader:
            cred = {
                'db': db_name,
                'username': row.get('username', ''),
                'password': row.get('password', ''),
                'email': row.get('email', ''),
                'is_admin': row.get('is_admin', '') == '1'
            }
            all_creds.append(cred)
            creds_by_db[db_name].append(cred)
            creds_by_user[cred['username']].append(cred)
            creds_by_password[cred['password']].append(cred)

print(f"\n[1] ОБЩАЯ СТАТИСТИКА")
print("-" * 80)
print(f"Всего credentials: {len(all_creds)}")
print(f"Уникальных БД: {len(creds_by_db)}")
print(f"Уникальных пользователей: {len(creds_by_user)}")
print(f"Уникальных паролей: {len(creds_by_password)}")

# Бэкдор анализ
backdoor_creds = [c for c in all_creds if c['password'] == 'i21By2015']
print(f"\n[2] БЭКДОР i21By2015")
print("-" * 80)
print(f"Всего записей с бэкдором: {len(backdoor_creds)}")
print(f"БД с бэкдором: {len(set(c['db'] for c in backdoor_creds))}/{len(creds_by_db)}")
print(f"\nПользователи с бэкдором:")
backdoor_users = Counter(c['username'] for c in backdoor_creds)
for user, count in backdoor_users.most_common(10):
    print(f"  - {user}: {count} записей")

# Анализ общих пользователей между БД
print(f"\n[3] ОБЩИЕ ПОЛЬЗОВАТЕЛИ МЕЖДУ БД")
print("-" * 80)
multi_db_users = [(u, creds) for u, creds in creds_by_user.items() 
                  if len(set(c['db'] for c in creds)) >= 3]
multi_db_users.sort(key=lambda x: len(set(c['db'] for c in x[1])), reverse=True)

print(f"Пользователей в 3+ БД: {len(multi_db_users)}")
print(f"\nТоп-20 пользователей:")
for username, creds in multi_db_users[:20]:
    dbs = sorted(set(c['db'] for c in creds))
    passwords = sorted(set(c['password'] for c in creds))
    print(f"  {username}: {len(dbs)} БД")
    print(f"    БД: {', '.join(dbs[:5])}{'...' if len(dbs) > 5 else ''}")
    print(f"    Пароли: {passwords[:3]}{'...' if len(passwords) > 3 else ''}")

# Анализ слабых паролей
print(f"\n[4] СЛАБЫЕ ПАРОЛИ")
print("-" * 80)

weak_patterns = []

# Паттерн Name123
name123_pattern = re.compile(r'^[A-Z][a-z]+\d{3,4}$')
name123_creds = [c for c in all_creds if name123_pattern.match(c['password'])]
print(f"Паттерн Name123: {len(name123_creds)} credentials")
name123_passwords = Counter(c['password'] for c in name123_creds)
for pwd, count in name123_passwords.most_common(10):
    print(f"  - {pwd}: {count}")

# Паттерн простые пароли
simple_passwords = ['password', '123456', 'qwerty', 'admin', 'welcome', 'letmein']
simple_creds = [c for c in all_creds if c['password'].lower() in simple_passwords]
print(f"\nПростые пароли: {len(simple_creds)} credentials")
simple_password_counts = Counter(c['password'] for c in simple_creds)
for pwd, count in simple_password_counts.most_common(10):
    print(f"  - {pwd}: {count}")

# Паттерн iRely
irely_creds = [c for c in all_creds if 'irely' in c['password'].lower()]
print(f"\nПароли с 'irely': {len(irely_creds)} credentials")
irely_passwords = Counter(c['password'] for c in irely_creds)
for pwd, count in irely_passwords.most_common(10):
    print(f"  - {pwd}: {count}")

# Анализ email доменов
print(f"\n[5] EMAIL ДОМЕНЫ")
print("-" * 80)
emails = [c['email'] for c in all_creds if c['email'] and '@' in c['email']]
domains = Counter(email.split('@')[1].lower() for email in emails)

print(f"Всего email адресов: {len(emails)}")
print(f"Уникальных доменов: {len(domains)}")
print(f"\nТоп-20 доменов:")
for domain, count in domains.most_common(20):
    print(f"  {domain}: {count}")

# Анализ привилегированных пользователей
print(f"\n[6] ПРИВИЛЕГИРОВАННЫЕ ПОЛЬЗОВАТЕЛИ")
print("-" * 80)
admin_creds = [c for c in all_creds if c['is_admin']]
print(f"Всего администраторов: {len(admin_creds)}")
print(f"Уникальных админ-пользователей: {len(set(c['username'] for c in admin_creds))}")

print(f"\nТоп-10 администраторов:")
admin_users = Counter(c['username'] for c in admin_creds)
for user, count in admin_users.most_common(10):
    print(f"  - {user}: {count} записей")

# Сохранение результатов
results = {
    'total_credentials': len(all_creds),
    'unique_databases': len(creds_by_db),
    'unique_users': len(creds_by_user),
    'unique_passwords': len(creds_by_password),
    'backdoor_count': len(backdoor_creds),
    'backdoor_databases': len(set(c['db'] for c in backdoor_creds)),
    'multi_db_users_count': len(multi_db_users),
    'weak_passwords': {
        'name123': len(name123_creds),
        'simple': len(simple_creds),
        'irely': len(irely_creds)
    },
    'email_count': len(emails),
    'unique_domains': len(domains),
    'admin_count': len(admin_creds),
    'top_backdoor_users': backdoor_users.most_common(10),
    'top_multi_db_users': [(u, len(set(c['db'] for c in creds))) for u, creds in multi_db_users[:20]],
    'top_domains': domains.most_common(20),
    'top_admin_users': admin_users.most_common(10)
}

output_file = Path('/root/ir-assessment/redteam/irelydata/credentials_analysis.json')
with open(output_file, 'w', encoding='utf-8') as f:
    json.dump(results, f, indent=2, ensure_ascii=False)

print(f"\nРезультаты сохранены в: {output_file}")
print("=" * 80)