CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
# -*- coding: binary -*-
2
require "rex/parser/nokogiri_doc_mixin"
3

4
module Rex
5
module Parser
6

7
load_nokogiri && class Outpost24Document < Nokogiri::XML::SAX::Document
8

9
  include NokogiriDocMixin
10

11
  def start_element(name, attrs)
12
    @state[:current_tag][name] = true
13
    case name
14
    when "description", "information"
15
      return unless in_tag("detaillist")
16
      return unless in_tag("detail")
17
      record_text
18
    when "detail"
19
      return unless in_tag("detaillist")
20
      record_vuln
21
    when "detaillist"
22
      record_vulns
23
    when "host"
24
      return unless in_tag("hostlist")
25
      record_host
26
    when "hostlist"
27
      record_hosts
28
    when "id"
29
      return unless in_tag("detaillist")
30
      return unless in_tag("detail")
31
      return unless in_tag("cve")
32
      record_text
33
    when "name"
34
      return unless in_tag("hostlist") || in_tag("detaillist")
35
      return unless in_tag("host") || in_tag("detail")
36
      record_text
37
    when "platform"
38
      return unless in_tag("hostlist")
39
      return unless in_tag("host")
40
      record_text
41
    when "portinfo"
42
      return unless in_tag("portlist")
43
      return unless in_tag("portlist-host")
44
      record_service
45
    when "portlist"
46
      record_services
47
    when "portnumber", "protocol", "service"
48
      return unless in_tag("portlist")
49
      return unless in_tag("portlist-host")
50
      return unless in_tag("portinfo")
51
      record_text
52
    when "report", "ip"
53
      record_text
54
    end
55
  end
56

57
  def end_element(name)
58
    case name
59
    when "description", "information"
60
      return unless in_tag("detaillist")
61
      return unless in_tag("detail")
62
      collect_vuln_data(name)
63
    when "detail"
64
      return unless in_tag("detaillist")
65
      collect_vuln
66
    when "detaillist"
67
      report_vulns
68
    when "host"
69
      return unless in_tag("hostlist")
70
      collect_host
71
    when "hostlist"
72
      report_hosts
73
    when "id"
74
      return unless in_tag("detaillist")
75
      return unless in_tag("detail")
76
      return unless in_tag("cve")
77
      collect_vuln_data(name)
78
    when "ip"
79
      collect_ip
80
    when "name"
81
      if in_tag("hostlist") && in_tag("host")
82
        collect_host_data(name)
83
      elsif in_tag("detaillist") && in_tag("detail")
84
        collect_vuln_data(name)
85
      end
86
    when "platform"
87
      return unless in_tag("hostlist")
88
      return unless in_tag("host")
89
      collect_host_data(name)
90
    when "portinfo"
91
      return unless in_tag("portlist")
92
      return unless in_tag("portlist-host")
93
      collect_service
94
    when "portlist"
95
      report_services
96
    when "portnumber", "protocol", "service"
97
      return unless in_tag("portlist")
98
      return unless in_tag("portlist-host")
99
      return unless in_tag("portinfo")
100
      collect_service_data(name)
101
    when "report"
102
      collect_product
103
    end
104
    @state[:current_tag].delete(name)
105
  end
106

107
  def record_hosts
108
    @report_data[:hosts] = []
109
  end
110

111
  def record_services
112
    @report_data[:services] = []
113
  end
114

115
  def record_vulns
116
    @report_data[:vulns] = []
117
  end
118

119
  def record_host
120
    @host = {}
121
  end
122

123
  def record_service
124
    @service = {}
125
  end
126

127
  def record_vuln
128
    @vuln = {}
129
    @refs = []
130
  end
131

132
  def record_text
133
    @state[:has_text] = true
134
  end
135

136
  def collect_host
137
    @host[:host] = @state[:host]
138
    @host[:name] = @state[:hname]
139
    @host[:os_name] = @state[:os_name]
140
    @host[:info] = @state[:pinfo]
141
    @report_data[:hosts] << @host
142
  end
143

144
  def collect_service
145
    @service[:host] = @state[:host]
146
    @service[:port] = @state[:port]
147
    @service[:proto] = @state[:proto]
148
    @service[:name] = @state[:sname]
149
    @service[:info] = @state[:pinfo]
150
    @report_data[:services] << @service
151
  end
152

153
  def collect_vuln
154
    @vuln[:host] = @state[:host]
155
    @vuln[:name] = @state[:vname]
156
    @vuln[:info] = @state[:vinfo]
157
    @vuln[:refs] = @refs
158
    @report_data[:vulns] << @vuln
159
  end
160

161
  def collect_product
162
    @state[:has_text] = false
163
    @state[:pinfo] = @text.strip if @text
164
    @text = nil
165
  end
166

167
  def collect_ip
168
    @state[:has_text] = false
169
    @state[:host] = @text.strip if @text
170
    @text = nil
171
  end
172

173
  def collect_host_data(name)
174
    @state[:has_text] = false
175
    if name == "name"
176
      @state[:hname] = @text.strip if @text
177
    elsif name == "platform"
178
      if @text
179
        @state[:os_name] = @text.strip
180
      else
181
        @state[:os_name] = Msf::OperatingSystems::UNKNOWN
182
      end
183
    end
184
    @text = nil
185
  end
186

187
  def collect_service_data(name)
188
    @state[:has_text] = false
189
    if name == "portnumber"
190
      @state[:port] = @text.strip if @text
191
    elsif name == "protocol"
192
      @state[:proto] = @text.strip.downcase if @text
193
    elsif name == "service"
194
      @state[:sname] = @text.strip if @text
195
    end
196
    @text = nil
197
  end
198

199
  def collect_vuln_data(name)
200
    @state[:has_text] = false
201
    if name == "name"
202
      @state[:vname] = @text.strip if @text
203
    elsif name == "description"
204
      @state[:vinfo] = @text.strip if @text
205
    elsif name == "information"
206
      @state[:vinfo] << " #{@text.strip if @text}"
207
    elsif name == "id"
208
      @state[:ref] = @text.strip if @text
209
      @refs << normalize_ref("CVE", @state[:ref])
210
    end
211
    @text = nil
212
  end
213

214
  def report_hosts
215
    block = @block
216
    @report_data[:hosts].each do |h|
217
      db.emit(:address, h[:host], &block) if block
218
      db_report(:host, h)
219
    end
220
  end
221

222
  def report_services
223
    block = @block
224
    @report_data[:services].each do |s|
225
      db.emit(:service, "#{s[:host]}:#{s[:port]}/#{s[:proto]}", &block) if block
226
      db_report(:service, s)
227
    end
228
  end
229

230
  def report_vulns
231
    block = @block
232
    @report_data[:vulns].each do |v|
233
      db.emit(:vuln, ["#{v[:name]} (#{v[:host]})", 1], &block) if block
234
      db_report(:vuln, v)
235
    end
236
  end
237

238
end
239
end
240
end
241

242