---
# System prepended metadata

title: Untitled

---

ppid pid name
0 1 initd
0 3 sysd
3 7 gnome
7 18 firefox
18 22 firefox
18 56 bash
56 66 python

[18, 22, 56, 66]

port bound_process source_ip
54 7 191.231.12.32
80 18 207.134.213.23
413 22 101.2.2.1
489 66 101.2.2.1

[207.134.213.23 = 1]

desired output
101.2.2.1

// find inbound connections to a browser
// browser is running
// c2 sends command to browser
// browser then starts a new process and that process could spawn other processes
// c2 server then connects to some service created by one of these processes
// output the ip addresses of the c2 server

type ProcTree struct {
    parent *ProcTree
    procName string
    pid    uint32
    children []ProcTree
}

//
// tree
// given a ppid, see if that exists, if it does not exist, add it to the tree. Then insert the pid as the ppid's child. 
// if the ppid exists, then add the pid as the ppid's child

// for a given bound_process, we would get the matching pid for it in the tree and get the process name, if it's not a browser, don't care.
// if it is a browser, 

// put the ip address in some hash map that we can look up later and see if we've seen it before
// if we've seen an ip address, before traverse back up the tree to see if we've seen it before. 

type IPProcPort {
    port
    pid
    ip
}

for _, entry range(ipProcPortEntries) {
    if entry.ip does not exist in seenIpsMap:
        add entry.ip to seenIpsMap
    else:
         
        getTreeNode tn with the same pid and entry.pid
        currtn = tn
        while tn.parent.procName != firefox && tn.parent != nil 
              tn = tn.parent
              
        if tn.parent == firefox:
            add currtn to some log to look at later. 
}