import paramiko
import sys

sys.stdout.reconfigure(encoding='utf-8')
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)

new_watcher = """#!/usr/bin/env python3
import json
import os
import sys
import time
import urllib.request
import urllib.error

sys.stdout.reconfigure(line_buffering=True)

LOG_FILE = "/opt/opencanary/logs/opencanary.log"
GOTIFY_URL = "http://127.0.0.1:8090/message?token=A9oPeNcAnArYhOnEyPoT"

LOGTYPE_NAMES = {
    1000: "Portscan Syn Probe",
    1001: "Canary System Event",
    1002: "Portscan Null Scan",
    1003: "Portscan Xmas Scan",
    1004: "Portscan Fin Scan",
    2000: "FTP Connection",
    2001: "FTP Auth Attempt",
    3000: "HTTP Connection",
    3001: "HTTP Web Login Attempt",
    4000: "SSH Connection",
    4001: "SSH Auth Attempt",
    5000: "SMB Session Request",
    6001: "Telnet Login Attempt",
    7001: "HTTP Proxy Request",
    8001: "MySQL Login Attempt",
    9001: "MSSQL Login Attempt",
    10001: "VNC Connection",
    11001: "Git Clone / Pull Attempt",
    12001: "RDP Connection"
}

def send_alert(event):
    logtype = event.get("logtype", 0)
    # Don't alert on internal canary startup messages
    if logtype == 1001 and "Canary" in str(event.get("logdata", {})):
        return
        
    service_name = LOGTYPE_NAMES.get(logtype, f"Canary Event {logtype}")
    src_host = event.get("src_host", "Unknown IP")
    src_port = event.get("src_port", "Unknown Port")
    dst_port = event.get("dst_port", "")
    logdata = event.get("logdata", {})
    
    title = f"🚨 [Honeypot Alert] {service_name} from {src_host}"
    
    details = []
    details.append(f"• Attacker IP: {src_host}:{src_port}")
    if dst_port and dst_port != -1:
        details.append(f"• Targeted Port: {dst_port}")
    details.append(f"• Decoy IP: 14.4.4.99 (VLAN 50 Smart Home)")
    
    if isinstance(logdata, dict):
        if "USERNAME" in logdata:
            details.append(f"• Username attempted: {logdata.get('USERNAME')}")
        if "PASSWORD" in logdata:
            details.append(f"• Password attempted: {logdata.get('PASSWORD')}")
        if "PATH" in logdata:
            details.append(f"• Path: {logdata.get('PATH')}")
        if "USERAGENT" in logdata:
            details.append(f"• User-Agent: {logdata.get('USERAGENT')}")
    elif logdata:
        details.append(f"• Payload: {str(logdata)[:200]}")
        
    body = "\\n".join(details)
    
    payload = {
        "title": title,
        "message": body,
        "priority": 8
    }
    
    try:
        req = urllib.request.Request(
            GOTIFY_URL,
            data=json.dumps(payload).encode('utf-8'),
            headers={"Content-Type": "application/json"}
        )
        with urllib.request.urlopen(req, timeout=5) as r:
            pass
        print(f"[Alert Sent] {title}", flush=True)
    except Exception as e:
        print(f"[Alert Error] {e}", flush=True)

def main():
    print("OpenCanary Gotify Watcher started...", flush=True)
    if not os.path.exists(LOG_FILE):
        open(LOG_FILE, 'a').close()
        
    f = open(LOG_FILE, 'r')
    f.seek(0, os.SEEK_END)
    
    while True:
        line = f.readline()
        if line:
            line = line.strip()
            if line:
                try:
                    event = json.loads(line)
                    send_alert(event)
                except Exception as e:
                    pass
        else:
            time.sleep(0.5)

if __name__ == '__main__':
    main()
"""

c.exec_command("cat << 'EOF' > /opt/opencanary/alert_watcher.py\n" + new_watcher + "\nEOF\n")
c.exec_command("systemctl restart opencanary-watcher.service")
print("Restarted watcher service")

c.close()