CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
# -*- coding: binary -*-
2
module Rex
3
module Parser
4

5
# XXX doesn't tie services to vulns
6
class NexposeXMLStreamParser
7

8
  attr_accessor :callback
9

10
  def initialize(callback = nil)
11
    reset_state
12
    self.callback = callback if callback
13
  end
14

15
  def reset_state
16
    @state = :generic_state
17
    @only_vuln_states_needed = true
18
    @current_vuln_id = nil
19
    @vulnerable_markers = ['vulnerable-exploited', 'vulnerable-version', 'potential']
20
    @host = {"status" => nil, "endpoints" => [], "names" => [], "vulns" => {}}
21
    @vuln = {"refs" => [], "description" => [], "solution" => []}
22
  end
23

24
  # If all vuln states are required set this to false
25
  def parse_vulnerable_states_only only_vuln_states_needed
26
    @only_vuln_states_needed = only_vuln_states_needed
27
  end
28

29
  def tag_start(name, attributes)
30
    case name
31
    when "node"
32
      @host["hardware-address"] = attributes["hardware-address"]
33
      @host["addr"] = attributes["address"]
34
      @host["status"] = attributes["status"]
35
    when "os"
36
      # Take only the highest certainty
37
      if not @host["os_certainty"] or (@host["os_certainty"].to_f < attributes["certainty"].to_f)
38
        @host["os_vendor"]    = attributes["vendor"]
39
        @host["os_family"]    = attributes["family"]
40
        @host["os_product"]   = attributes["product"]
41
        @host["os_version"]   = attributes["version"]
42
        @host["arch"]         = attributes["arch"]
43
        @host["os_certainty"] = attributes["certainty"]
44
      end
45
    when "name"
46
      #@host["names"].push attributes["name"]
47
      @state = :in_name
48
    when "endpoint"
49
      # This is a port in NeXpose parlance
50
      @host["endpoints"].push(attributes)
51
    when "service"
52
      @state = :in_service
53
      # Store any service info with the associated port.  There shouldn't
54
      # be any collisions on attribute names here, so just merge them.
55
      @host["endpoints"].last.merge!(attributes)
56
    when "fingerprint"
57
      if @state == :in_service
58
        @host["endpoints"].last.merge!(attributes)
59
      end
60
      when "test"
61
        if (not @only_vuln_states_needed) or (@vulnerable_markers.include? attributes["status"].to_s.chomp and @only_vuln_states_needed)
62
          @state = :in_test
63
          @current_vuln_id = attributes["id"]
64
          @host["vulns"][@current_vuln_id] = attributes.dup
65
          # Append the endpoint info for how the vuln was discovered
66
          unless @host["endpoints"].empty?
67
            @host["vulns"][@current_vuln_id].merge!("endpoint_data" => @host["endpoints"].last)
68
          end
69
          if attributes["key"]
70
            @host["notes"] ||= []
71
            @host["notes"] << [@current_vuln_id, attributes["key"]]
72
          end
73
        end
74
      when "vulnerability"
75
        @vuln.merge! attributes
76
      when "reference"
77
        @state = :in_reference
78
        @vuln["refs"].push attributes
79
      when "solution"
80
        @state = :in_solution
81
      when "description"
82
        @state = :in_description
83
      when "URLLink"
84
        @vuln["solution"] << attributes
85
    end
86
  end
87

88
  def text(str)
89
    case @state
90
    when :in_name
91
      @host["names"].push str
92
    when :in_reference
93
      @vuln["refs"].last["value"] = str
94
    when :in_solution
95
      @vuln["solution"] << str
96
    when :in_description
97
      @vuln["description"] << str
98
    when :in_test
99
      if @host["vulns"][@current_vuln_id]
100
         proof = @host["vulns"][@current_vuln_id]["proof"] || []
101
         proof << str
102
         @host["vulns"][@current_vuln_id]["proof"] = proof
103
      end
104
    end
105
  end
106

107
  def tag_end(name)
108
    case name
109
    when "node"
110
      callback.call(:host, @host) if callback
111
      reset_state
112
    when "vulnerability"
113
      callback.call(:vuln, @vuln) if callback
114
      reset_state
115
    when "service","reference","names"
116
      @state = :generic_state
117
    end
118
  end
119

120
  # We don't need these methods, but they're necessary to keep REXML happy
121
  def xmldecl(version, encoding, standalone) # :nodoc:
122
  end
123
  def cdata # :nodoc:
124
  end
125
  def comment(str) # :nodoc:
126
  end
127
  def instruction(name, instruction) # :nodoc:
128
  end
129
  def attlist # :nodoc:
130
  end
131
end
132
end
133
end
134

135
__END__
136

137
<node address="10.1.1.10" status="alive" hardware-address="0007371F3BE8">
138
<names>
139
<name>NETBIOSNAME</name>
140
<name>hostname.example.com</name>
141
</names>
142
<fingerprints>
143
<os  certainty="1.00" device-class="Domain controller" vendor="Microsoft" family="Windows" product="Windows Server 2003, Standard Edition" version="SP2" arch="x86"/>
144
<os  certainty="0.85" device-class="General" vendor="Microsoft" family="Windows" product="Windows Server 2003"/>
145
<os  certainty="0.70" vendor="Microsoft" family="Windows" product="Windows Server 2003"/>
146
</fingerprints>
147
<software>
148
<fingerprint  certainty="1.00" vendor="Acronis" product="Acronis&#160;True&#160;Image&#160;Echo&#160;Server" version="9.5.8163"/>
149
<fingerprint  certainty="1.00" vendor="Acronis" product="Acronis&#160;Universal&#160;Restore for Acronis&#160;True&#160;Image&#160;Echo&#160;Server" version="9.5.8076"/>
150
<fingerprint  certainty="1.00" software-class="Internet Client" vendor="Microsoft" family="Internet Explorer" product="Internet Explorer" version="7.0.5730.11"/>
151
<fingerprint  certainty="1.00" software-class="Database Client" vendor="Microsoft" family="MDAC" product="MDAC" version="2.8"/>
152
<fingerprint  certainty="1.00" software-class="Media Client" vendor="Microsoft" family="Windows Media Player" product="Windows Media Player" version="10.0.0.3997"/>
153
<fingerprint  certainty="1.00" vendor="MySolutions NORDIC" product="NSClient++ (Win32)" version="0.3.4.0"/>
154
<fingerprint  certainty="1.00" vendor="Symantec Corporation" product="LiveUpdate 3.1 (Symantec Corporation)" version="3.1.0.99"/>
155
<fingerprint  certainty="1.00" vendor="Symantec Corporation" product="Symantec AntiVirus" version="10.1.5000.5"/>
156
</software>
157
<tests>
158
<test status="not-vulnerable" id="backdoor-ckb.cfaae1e6">
159

160
<endpoint protocol="tcp" port="139" status="open">
161
<services>
162
<service name="CIFS">
163
<fingerprints>
164
<fingerprint  certainty="1.00" product="Windows Server 2003 R2 5.2"/>
165
</fingerprints>
166
<tests>
167
</tests>
168
</service>
169
</services>
170
</endpoint>
171
</node>
172

173

174