ghostbuster.sh

#█▀▀▀▀█▀▀▀▀▀██▀▀▀▀██▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▓▒▀▀▀▀▀▀▀▀▀▀█▓▀ ▀▀▀██▀▀▀▀▀▀▀▀▀▓▓▀▀▀▀▀▀▀▀▀▌
#▌▄██▌ ▄▓██▄ ▀▄█▓▄▐ ▄▓█▓▓▀█ ▄▓██▀▓██▓▄ ▌▄█▓█▀███▓▄ ▌▄█▓█ ▀ ▄▓██▀▓██▓▄ ▄█▓█▀███▄■
#▌▀▓█▓▐▓██▓▓█ ▐▓█▓▌▐▓███▌■ ▒▓██▌  ▓██▓▌▐▓▒█▌▄ ▓██▓▌▐▓▒█▌▐ ▒▓██▌  ▓██▓▌▓▒█▌  ▓█▓▌
#▐▓▄▄▌░▓▓█▓▐▓▌ █▓▓▌░▓▓█▓▄▄ ▓▓██▓▄▄▓█▓▓▌░▓█▓ █ ▓█▓▓▌░▓█▓ ▒ ▓▓██▓▄▄▓█▓▓▌▓█▓ ░ ▓█▓▓
#▐▓▓█▌▓▓▓█▌ █▓▐██▓▌▐▓▒▓▌ ▄ ▐░▓█▌▄  ▀▀▀ ▐▓▓▓ ▐▌ ▀▀▀ ▐▓▓▓▄▄ ▐░▓█▌▄  ▀▀▀ ▓▓▓ ░ ██▓▓
#▐▓▓▓█▐▓▒██  ██▓▓▓▌▐▓▓██ █▌▐▓▓▒▌▐ ███░▌▐▓▓▒▌▐ ███░▌▐▓▓▒▌  ▐▓▓▒▌▀ ███░▌▓▓▒▌  ███░
# ▒▓▓█▌▒▓▓█▌ ▐▓█▒▒  ▒▓██▌▐█ ▒▓▓█ ▐█▓▒▒  ▒▒▓█ ▐█▓▒▒  ▒▒▓█ ▓▌▒▓▓█ ▐█▓▒▒ ▒▒▓█ ▐█▓▒▌
#▌ ▒▒░▀ ▓▒▓▀ ▀░▒▓ ▐▌ ▓▓▓▀ █  █▒▓▀▀░█▓ ▄▌ ▒▒▓▀▀░█▓ ▄▌ ▒▒▓▀▀  █▒▓▀▀░█▓   ▒▒▓▀▀░█▀
#█▄ ▀ ▄▄ ▀▄▄▀■ ▀ ▀▓█▄ ▀ ▄█▓█▄ ▀ ▓▄▄▄▄▄█▀ ▄▀ ▄▄▄▄▄▄█▓▄ ▀ ▄▄█▓▄▀     ▄▓▄█▄▀  ▄▄▄█▌
#▐████▓█▀ ▄▄█▓▓███▄▄ ▀▓▓████████████▓▀▄██▄▀▓██████▓▓██▓▓▓█▀▀▄▄███▓▓▄▄▄▀▀█▓████▌
#░░▌▓▓▌ ▄▒▒▓▓▓▀▀█████▄ ▀▒░▄ ███▓█▀▀ ▄▓█▌▐▒█▄▀▀▀█▓█████▓▓▀ ▄█████▀▀▓▓▓▒▒▄ ▐▓▓▐░░
#▐▒▒█▌ ▐░▓▓██▌   ▀▀█▓█▓▄▄▄ ▀█▀▀ ▄▒▓██▀▀  ▀▀██▓▓▄ ▀▀█▀ ▄▄▄▓█▓█▀ ▀  ▐██▓▓░▌ ▐█▒▒▌
# ▀▓█  ░▒▓███   ▄█▀▀▀▀▀▀▀█▓ ▄▒▓██▀    ▄▓▄     ▀▓██▓▄ ▓█▀▀▀▀▀▀▀▄█   ███▓▒░  █▓▀
# ▄█▀  ▀▒▓██▓▌ █▓  ▄▄█▓▓▄▄▄░▒▀▀   ▄▄ ▓░▒▓▓ ▄▄    ▀▀█▓▄▄▄▓▓█▄▄ ▓ █ ▐▓██▓▒▀  ▀█▄
#▐▓▌     ▀▓█▀▀   ▄▓▓▓█▀  ▄▀▀  ▄▄▀▀    ▀▀▀    ▀▀▄▄   ▀▀▄  ▀█▓▓▓▄▄  ▀▀█▓▀     ▐▓▌
#██         ▄▄▒█▐▒██▀   ▐▌  ■▀   ▄▄░▒▒▓████▓▄▄   ▀■   ▐▌   ▀██▒▌█▒▄▄         ██
#▐▒▌      ▄▓▓▓█▒▒▒▓▌     ▀▄   ▄▓▒▒▒███████████▒▓▓▄   ▄▀     ▐▓▒▒▒█▓▓▓▄      ▐▒▌
# ▓▓▌    ▐▒██▀ ▐▒█▀       ▄▄▓▒▒▒▒▓███████████████▓▓▓▄        ▀█▒▌ ▀██▒▌    ▐▓▓
#  ▀█    ▒▒▓▌  ▒▓▌     ▄▓▒▒▒▒█░█▓██████████████████▓▓▓▓▄      ▐▓▒  ▐▓▒▒    █▀
# ▄█▀▀  ▐▒█▀   ▐▓▓    ▓░░▓▒▒▓▓▓████████████████████▓▓▓▓▒▓     ▓▓▌   ▀█▒▌  ▀▀█▄
#▐▓▌    ▒▓▌   ▄▄▒█▌▄ ▐░▒▒▓▓▓▀▀   ▀█▓█████████████▓▀▀█▓▓▓▓▌  ▄▐█▒▄▄   ▐▓▒    ▐▓▌
#██     ▐▓▓ ▄▓▓▓█▒▓▌ ░▒░░▒▀        ▓▓█████████▓▀     ▀░▓▒▓▌ ▐▓▒█▓▓▓▄ ▓▓▌     ██
#▐▒▌     ▒█▐▒██▀  ▒▓ ▐░░▒█  ▓  ▀   ▐▓████████▓▌  ▀  █ ▐▓▓▓  ▓▒  ▀██▒▌█▒     ▐▒▌
# ▓▓▌     ▒▒▒▓▌    ▀▒ ▀░▒▓▒▄ ▀▄▄█   █████████▓ ▐▌ ▄▀ ▄▒▓▒▌ ▒▀    ▐▓▒▒▒     ▐▓▓
#  ▀█     ▐▒█▀▄▄        ▀▀█▓█▄▄   ▄█▒█▓▓▓▀▓████▄▀▀ ▄█▓█▒▀       ▄▄▀█▒▌     █▀
# ▄█▀▀    ▒▓▌▒▓▓▓▄    ▄░▒▓▄▄▀▓█▓████▓▀▀    ▓███▓█████▀▄▄▄     ▄▓▓▓▒▐▓▒    ▀▀█▄
#▐▓▌      ▐▓▓ ▀██▒▌  ▐░▒▒▒▓██▄███▓▀         ▀▓██▓██▀▄█▓▒▓▓▄  ▐▒██▀ ▓▓▌      ▐▓▌
#██      ▒█▒█▌ ▐▓▒▒  ░░▒▒█▓▓▓███▓▀           ▀▓████▓▓█▓█▓▓█  ▒▒▓▌ ▐█▒█▒      ██
#▐▒▌    ▐▓▓ ▒▓▌ ▀█▒▌ ▒░▒░▒░▓▓██▓▄     ▄▄▄▓▄   ▄█▒▒█▒▒▓▓▒▓▓▓▌▐▒█▀ ▐▓▒ ▓▓▌    ▐▒▌
# ▓▓▌   ▒▓▌  ▒▓  ▐▓▒  ▀░░▒▒▒█████▓▄ ▄▓█████████▓██▒▒▒▒▓▓▓▒▓ ▒▓▌  ▓▒  ▐▓▒   ▐▓▓
#  ▀█   ▐▒█▄  ▀▒ ▓▓▌    ▀▒░▒▓███▀▀▀▀▓█▀▀▀▀▀█▀▀▀▀▓▓█▓▒▓▓▒░▀  ▐▓▓ ▒▀  ▄█▒▌   █▀
# ▄█▀▀   ▒▒▓▌   ▐▄▒        ▀▀ ▄▓▓ █▄▄ ▄▀▀▀▄▄▀▄▀▀▀▄ ▀▀▀▀      ▒▄▌   ▐▓▒▒   ▀▀█▄
#▐▓▌     ▐▒██▄ ▐▒▓   ▄▄▒█▌▄  ▐▒▒▌▀▐▌▀█▌ ▀▓ ▐█▌▀▀▌▒▌  ▄▐█▒▄▄   ▓▒▌ ▄██▒▌     ▐▓▌
#██ cXc[CPH]▓▓█▒▓▌ ▄▓▓▓█▒▓▌   ▒▒▒██▄ ▄▄▀  ▄▄█▓▓█▓▒   ▐▓▒█▓▓▓ ▄▐▓▒█▓▓▓▀       ██
#▐▒▌        ▀▀▒█▌▀▐▒██▀ ▐▒▓    ▀▒▒▒████████▓█▓▄▀▀    ▓▒▌ ▀██▐▒▀▐█▒▀▀        ▐▒▌
# ▓▓▌        ▐▓▓ ▒▒▒▓▌█▒▌▐▀▒      ▀░▒▒▓▓▓█▓▀▀       ▒▀▌▐▒█▐▓▒▒▒ ▓▓▌        ▐▓▓
# ▄▀█         ▒▄▌▐▒█▀▓▒▄▒ ▓▓▌        ▀▀▀▀          ▐▓▓ ▒▄▒▓▀▒█▌▐▄▒         █▀▄
#▐▓▌ ▀         ▓▒▌ ▄██▒▌                                ▐▒██ ▄▐▒▓         ▀ ▐▓▌
#██            ▐▓▒█▓▓▓▀                                  ▀▓▓█▓▒▓▌            ██
#▐▒▌    ▄▄▄▓█▀■▀▐█▒▀▀                                      ▀▒▀█▌▀■▀█▓▄▄▄    ▐▒▌
# ▓▄▄███▓▀▀                                                          ▀▀█▓██▄▄▓
#▄█▓▀▀                                                                    ▀▀▓█▄
#█▓                                                                          ▓█
#▓▒                                                                          ▒▓
#▓                                                                            ▓
#    Copyright (C) 2015 Jonathan Racicot
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
#    Description:
#
#		Simple script to copy a suspicious file from a given source to
#		a repository. The suspicious file is hashed using MD5. The MD5
#		hash is use to create a folder within the repository unless already
#		present and files are copied to it.
#
#	Usage:
#
#		TODO
#
#	TODO:
#		Use getops to parse parameters
#!/bin/bash
if [ $# -ne 2 ] ; then
        echo "Usage $0 <source-directory> <dest-directory>"
        exit 1
fi

DIR_SRC="$1*"
DIR_DEST="$2"
DIR_CUR=`pwd`
FILE_HASH=$DIR_CUR/hashes.md5
md5sum $DIR_SRC > $FILE_HASH
while read -r signature
do
  echo $signature
  MD5HASH=`echo $signature | cut -d" " -f1`
  FILE=`echo $signature | cut -d" " -f2`
  FILENAME=`basename $FILE`
  DIR_FILE_DEST="$DIR_DEST/$MD5HASH/"
  if [ -d $DIR_FILE_DEST ]; then
    echo "[!] Directory for $MD5HASH already exists. Skipping"
  else
    echo "[*] Creating $DIR_FILE_DEST"
    mkdir -p $DIR_FILE_DEST
    echo "[*] Moving $FILENAME to $DIR_FILE_DEST"
    mv $FILE $DIR_FILE_DEST
    if [ -e $DIR_FILE_DEST/$FILENAME ]; then
      echo "[+] File successfully captured."
    else
      echo "[-] File was not captured..."
    fi
  fi
done < "$FILE_HASH"
rm -f $FILE_HASH