Skip to content

Commit 8d586fa

Browse files
ziadhanyziadhany
committed
Add support for metasploit
Signed-off-by: ziadhany <ziadhany2016@gmail.com>
1 parent 4168eae commit 8d586fa

3 files changed

Lines changed: 199 additions & 18 deletions

File tree

‎vulnerabilities/improvers/__init__.py‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,28 +7,29 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99

10-
from vulnerabilities.improvers import valid_versions
10+
from vulnerabilities.improvers import valid_versions, metasploit
1111
from vulnerabilities.improvers import vulnerability_kev
1212
from vulnerabilities.improvers import vulnerability_status
1313

1414
IMPROVERS_REGISTRY = [
15-
valid_versions.GitHubBasicImprover,
16-
valid_versions.GitLabBasicImprover,
17-
valid_versions.NginxBasicImprover,
18-
valid_versions.ApacheHTTPDImprover,
19-
valid_versions.DebianBasicImprover,
20-
valid_versions.NpmImprover,
21-
valid_versions.ElixirImprover,
22-
valid_versions.ApacheTomcatImprover,
23-
valid_versions.ApacheKafkaImprover,
24-
valid_versions.IstioImprover,
25-
valid_versions.DebianOvalImprover,
26-
valid_versions.UbuntuOvalImprover,
27-
valid_versions.OSSFuzzImprover,
28-
valid_versions.RubyImprover,
29-
valid_versions.GithubOSVImprover,
30-
vulnerability_status.VulnerabilityStatusImprover,
31-
vulnerability_kev.VulnerabilityKevImprover,
15+
# valid_versions.GitHubBasicImprover,
16+
# valid_versions.GitLabBasicImprover,
17+
# valid_versions.NginxBasicImprover,
18+
# valid_versions.ApacheHTTPDImprover,
19+
# valid_versions.DebianBasicImprover,
20+
# valid_versions.NpmImprover,
21+
# valid_versions.ElixirImprover,
22+
# valid_versions.ApacheTomcatImprover,
23+
# valid_versions.ApacheKafkaImprover,
24+
# valid_versions.IstioImprover,
25+
# valid_versions.DebianOvalImprover,
26+
# valid_versions.UbuntuOvalImprover,
27+
# valid_versions.OSSFuzzImprover,
28+
# valid_versions.RubyImprover,
29+
# valid_versions.GithubOSVImprover,
30+
# vulnerability_status.VulnerabilityStatusImprover,
31+
# vulnerability_kev.VulnerabilityKevImprover,
32+
metasploit.MetasploitImprover,
3233
]
3334

3435
IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY}

‎vulnerabilities/improvers/metasploit.py‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
import logging
2+
from typing import Iterable
3+
4+
from django.db.models import QuerySet
5+
from sphinx.util import requests
6+
7+
from vulnerabilities.improver import Improver
8+
from vulnerabilities.improver import Inference
9+
from vulnerabilities.models import Advisory, VulnerabilityReference, VulnerabilityRelatedReference
10+
from vulnerabilities.models import Alias
11+
12+
logger = logging.getLogger(__name__)
13+
14+
15+
class MetasploitImprover(Improver):
16+
"""
17+
Metasploit Improver
18+
"""
19+
20+
@property
21+
def interesting_advisories(self) -> QuerySet:
22+
# TODO Modify Metasploit Improver to iterate over the vulnerabilities alias, not the advisory
23+
return [Advisory.objects.first()]
24+
25+
def get_inferences(self, advisory_data) -> Iterable[Inference]:
26+
"""
27+
"""
28+
29+
metasploit_modules_url = (
30+
"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/db/modules_metadata_base.json"
31+
)
32+
response = requests.get(metasploit_modules_url)
33+
metasploit_data = response.json()
34+
if response.status_code != 200:
35+
logger.error(
36+
f"Failed to fetch the Metasploit Exploits: {metasploit_modules_url}"
37+
)
38+
return []
39+
try:
40+
for file_path, record in metasploit_data.items():
41+
file_url = f"https://github.com/rapid7/metasploit-framework/tree/master/modules/{file_path}"
42+
43+
ref_list = []
44+
vulnerabilities = set()
45+
for ref in record.get("references"):
46+
if ref.startswith("URL-"):
47+
ref_list.append(ref[4::])
48+
49+
alias = Alias.objects.get_or_none(alias=ref)
50+
51+
if not alias:
52+
continue
53+
54+
vul = alias.vulnerability
55+
56+
if not vul:
57+
continue
58+
59+
ref, created = VulnerabilityReference.objects.update_or_create(
60+
reference_id=alias,
61+
reference_type=VulnerabilityReference.EXPLOIT,
62+
defaults={"url": file_url},
63+
)
64+
65+
if created:
66+
VulnerabilityRelatedReference.objects.create(
67+
vulnerability=vul,
68+
reference=ref,
69+
)
70+
vulnerabilities.add(vul)
71+
72+
for vul in vulnerabilities:
73+
for ref in ref_list:
74+
ref_obj, created = VulnerabilityReference.objects.update_or_create(
75+
reference_id=ref,
76+
defaults={"url": file_url},
77+
)
78+
79+
if created:
80+
VulnerabilityRelatedReference.objects.create(
81+
vulnerability=vul,
82+
reference=ref_obj,
83+
)
84+
except Exception as e:
85+
logger.error(e)
86+
87+
return []

‎vulnerabilities/tests/test_data/metasploit_improver/modules_metadata_base.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"auxiliary_admin/2wire/xslt_password_reset": {
3+
"name": "2Wire Cross-Site Request Forgery Password Reset Vulnerability",
4+
"fullname": "auxiliary/admin/2wire/xslt_password_reset",
5+
"aliases": [
6+
],
7+
"rank": 300,
8+
"disclosure_date": "2007-08-15",
9+
"type": "auxiliary",
10+
"author": [
11+
"hkm <hkm@hakim.ws>",
12+
"Travis Phillips"
13+
],
14+
"description": "This module will reset the admin password on a 2Wire wireless router. This is\n done by using the /xslt page where authentication is not required, thus allowing\n configuration changes (such as resetting the password) as administrators.",
15+
"references": [
16+
"CVE-2007-4387",
17+
"OSVDB-37667",
18+
"BID-36075",
19+
"URL-https://seclists.org/bugtraq/2007/Aug/225"
20+
],
21+
"platform": "",
22+
"arch": "",
23+
"rport": 80,
24+
"autofilter_ports": [
25+
80,
26+
8080,
27+
443,
28+
8000,
29+
8888,
30+
8880,
31+
8008,
32+
3000,
33+
8443
34+
],
35+
"autofilter_services": [
36+
"http",
37+
"https"
38+
],
39+
"targets": null,
40+
"mod_time": "2020-10-02 17:38:06 +0000",
41+
"path": "/modules/auxiliary/admin/2wire/xslt_password_reset.rb",
42+
"is_install_path": true,
43+
"ref_name": "admin/2wire/xslt_password_reset",
44+
"check": false,
45+
"post_auth": false,
46+
"default_credential": false,
47+
"notes": {
48+
},
49+
"session_types": false,
50+
"needs_cleanup": false,
51+
"actions": [
52+
]
53+
},
54+
"post_firefox/manage/webcam_chat": {
55+
"name": "Firefox Webcam Chat on Privileged Javascript Shell",
56+
"fullname": "post/firefox/manage/webcam_chat",
57+
"aliases": [
58+
59+
],
60+
"rank": 300,
61+
"disclosure_date": "2014-05-13",
62+
"type": "post",
63+
"author": [
64+
"joev <joev@metasploit.com>"
65+
],
66+
"description": "This module allows streaming a webcam from a privileged Firefox Javascript shell.",
67+
"references": [
68+
"URL-http://www.rapid7.com/db/modules/exploit/firefox/local/exec_shellcode"
69+
],
70+
"platform": "",
71+
"arch": "",
72+
"rport": null,
73+
"autofilter_ports": null,
74+
"autofilter_services": null,
75+
"targets": null,
76+
"mod_time": "2023-02-08 13:47:34 +0000",
77+
"path": "/modules/post/firefox/manage/webcam_chat.rb",
78+
"is_install_path": true,
79+
"ref_name": "firefox/manage/webcam_chat",
80+
"check": false,
81+
"post_auth": false,
82+
"default_credential": false,
83+
"notes": {
84+
},
85+
"session_types": [
86+
87+
],
88+
"needs_cleanup": null,
89+
"actions": [
90+
91+
]
92+
}
93+
}

0 commit comments

Comments
 (0)