|
| 1 | +import logging |
| 2 | +from typing import Iterable |
| 3 | + |
| 4 | +from django.db.models import QuerySet |
| 5 | +from sphinx.util import requests |
| 6 | + |
| 7 | +from vulnerabilities.improver import Improver |
| 8 | +from vulnerabilities.improver import Inference |
| 9 | +from vulnerabilities.models import Advisory, VulnerabilityReference, VulnerabilityRelatedReference |
| 10 | +from vulnerabilities.models import Alias |
| 11 | + |
| 12 | +logger = logging.getLogger(__name__) |
| 13 | + |
| 14 | + |
| 15 | +class MetasploitImprover(Improver): |
| 16 | + """ |
| 17 | + Metasploit Improver |
| 18 | + """ |
| 19 | + |
| 20 | + @property |
| 21 | + def interesting_advisories(self) -> QuerySet: |
| 22 | + # TODO Modify Metasploit Improver to iterate over the vulnerabilities alias, not the advisory |
| 23 | + return [Advisory.objects.first()] |
| 24 | + |
| 25 | + def get_inferences(self, advisory_data) -> Iterable[Inference]: |
| 26 | + """ |
| 27 | + """ |
| 28 | + |
| 29 | + metasploit_modules_url = ( |
| 30 | + "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/db/modules_metadata_base.json" |
| 31 | + ) |
| 32 | + response = requests.get(metasploit_modules_url) |
| 33 | + metasploit_data = response.json() |
| 34 | + if response.status_code != 200: |
| 35 | + logger.error( |
| 36 | + f"Failed to fetch the Metasploit Exploits: {metasploit_modules_url}" |
| 37 | + ) |
| 38 | + return [] |
| 39 | + try: |
| 40 | + for file_path, record in metasploit_data.items(): |
| 41 | + file_url = f"https://github.com/rapid7/metasploit-framework/tree/master/modules/{file_path}" |
| 42 | + |
| 43 | + ref_list = [] |
| 44 | + vulnerabilities = set() |
| 45 | + for ref in record.get("references"): |
| 46 | + if ref.startswith("URL-"): |
| 47 | + ref_list.append(ref[4::]) |
| 48 | + |
| 49 | + alias = Alias.objects.get_or_none(alias=ref) |
| 50 | + |
| 51 | + if not alias: |
| 52 | + continue |
| 53 | + |
| 54 | + vul = alias.vulnerability |
| 55 | + |
| 56 | + if not vul: |
| 57 | + continue |
| 58 | + |
| 59 | + ref, created = VulnerabilityReference.objects.update_or_create( |
| 60 | + reference_id=alias, |
| 61 | + reference_type=VulnerabilityReference.EXPLOIT, |
| 62 | + defaults={"url": file_url}, |
| 63 | + ) |
| 64 | + |
| 65 | + if created: |
| 66 | + VulnerabilityRelatedReference.objects.create( |
| 67 | + vulnerability=vul, |
| 68 | + reference=ref, |
| 69 | + ) |
| 70 | + vulnerabilities.add(vul) |
| 71 | + |
| 72 | + for vul in vulnerabilities: |
| 73 | + for ref in ref_list: |
| 74 | + ref_obj, created = VulnerabilityReference.objects.update_or_create( |
| 75 | + reference_id=ref, |
| 76 | + defaults={"url": file_url}, |
| 77 | + ) |
| 78 | + |
| 79 | + if created: |
| 80 | + VulnerabilityRelatedReference.objects.create( |
| 81 | + vulnerability=vul, |
| 82 | + reference=ref_obj, |
| 83 | + ) |
| 84 | + except Exception as e: |
| 85 | + logger.error(e) |
| 86 | + |
| 87 | + return [] |
0 commit comments