|
| 1 | +#!/usr/bin/env python |
| 2 | +# Copyright (c) 2012, AverageSecurityGuy |
| 3 | +# All rights reserved. |
| 4 | +# |
| 5 | +# Redistribution and use in source and binary forms, with or without modification, |
| 6 | +# are permitted provided that the following conditions are met: |
| 7 | +# |
| 8 | +# Redistributions of source code must retain the above copyright notice, this |
| 9 | +# list of conditions and the following disclaimer. |
| 10 | +# |
| 11 | +# Redistributions in binary form must reproduce the above copyright notice, |
| 12 | +# this list of conditions and the following disclaimer in the documentation |
| 13 | +# and/or other materials provided with the distribution. |
| 14 | +# |
| 15 | +# Neither the name of AverageSecurityGuy nor the names of its contributors may |
| 16 | +# be used to endorse or promote products derived from this software without |
| 17 | +# specific prior written permission. |
| 18 | +# |
| 19 | +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
| 20 | +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
| 21 | +# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 22 | +# IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, |
| 23 | +# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 24 | +# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, |
| 25 | +# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, |
| 26 | +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 27 | +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY |
| 28 | +# OF SUCH DAMAGE. |
| 29 | + |
| 30 | +import xml.etree.ElementTree |
| 31 | +import sys |
| 32 | +import re |
| 33 | +import os.path |
| 34 | + |
| 35 | +#------------------------------------ |
| 36 | +# Object to hold Nessus host items |
| 37 | +#------------------------------------ |
| 38 | + |
| 39 | +class VulnItem(): |
| 40 | + def __init__(self, ip, fqdn, op, port): |
| 41 | + self.ip = ip |
| 42 | + self.fqdn = fqdn |
| 43 | + self.os = op |
| 44 | + self.port = port |
| 45 | + |
| 46 | + |
| 47 | +class Vulnerability(): |
| 48 | + def __init__(self, pid): |
| 49 | + self.pid = pid |
| 50 | + self.name = '' |
| 51 | + self.desc = '' |
| 52 | + self.hosts = [] |
| 53 | + |
| 54 | + |
| 55 | +def usage(): |
| 56 | + print("plugin.py nessus_file plugin_id") |
| 57 | + sys.exit() |
| 58 | + |
| 59 | + |
| 60 | +## |
| 61 | +# function to return an IP address as a tuple of ints. Used for sorting by |
| 62 | +# IP address. |
| 63 | +def ip_key(ip): |
| 64 | + return tuple(int(part) for part in ip.split('.')) |
| 65 | + |
| 66 | + |
| 67 | +## |
| 68 | +# Take the filename and confirm that it exists, is not empty, and is a Nessus |
| 69 | +# file. |
| 70 | +def open_nessus_file(filename): |
| 71 | + if not os.path.exists(filename): |
| 72 | + print("{0} does not exist.".format(filename)) |
| 73 | + sys.exit() |
| 74 | + |
| 75 | + if not os.path.isfile(filename): |
| 76 | + print("{0} is not a file.".format(filename)) |
| 77 | + sys.exit() |
| 78 | + |
| 79 | + # Load Nessus XML file into the tree and get the root element. |
| 80 | + nf = xml.etree.ElementTree.ElementTree(file=filename) |
| 81 | + root = nf.getroot() |
| 82 | + |
| 83 | + # Make sure this is a Nessus v2 file |
| 84 | + if root.tag == 'NessusClientData_v2': |
| 85 | + return filename, root |
| 86 | + else: |
| 87 | + print("{0} is not a Nessus version 2 file.".format(filename)) |
| 88 | + sys.exit() |
| 89 | + |
| 90 | + |
| 91 | +#-------------------------# |
| 92 | +# Begin the main program. # |
| 93 | +#-------------------------# |
| 94 | + |
| 95 | +if len(sys.argv) != 3: |
| 96 | + usage() |
| 97 | + |
| 98 | +if sys.argv[1] == '-h': |
| 99 | + usage() |
| 100 | +else: |
| 101 | + file_name, nessus = open_nessus_file(sys.argv[1]) |
| 102 | + plugin = sys.argv[2] |
| 103 | + |
| 104 | +vuln = Vulnerability(plugin) |
| 105 | + |
| 106 | +## |
| 107 | +# Find all the reports in the Nessus file |
| 108 | +reports = nessus.findall('Report') |
| 109 | + |
| 110 | +## |
| 111 | +# Process each of the reports |
| 112 | +for report in reports: |
| 113 | + report_name = report.attrib['name'] |
| 114 | + |
| 115 | + # Process each host in the report |
| 116 | + report_hosts = report.findall('ReportHost') |
| 117 | + for host in report_hosts: |
| 118 | + hid = '' |
| 119 | + host_properties = host.find('HostProperties') |
| 120 | + |
| 121 | + for tag in host_properties.findall('tag'): |
| 122 | + if tag.attrib['name'] == 'host-ip': |
| 123 | + hid = tag.text |
| 124 | + |
| 125 | + # if hid is empty then the host scan did not complete or |
| 126 | + # some other error has occured. Skip this host. |
| 127 | + if (hid == ''): |
| 128 | + continue |
| 129 | + |
| 130 | + # Find and process all of the ReportItems |
| 131 | + report_items = host.findall('ReportItem') |
| 132 | + for item in report_items: |
| 133 | + item_plugin = item.attrib['pluginID'] |
| 134 | + |
| 135 | + if item_plugin == plugin: |
| 136 | + vuln.name = item.attrib['pluginName'] |
| 137 | + vuln.desc = item.find('description').text |
| 138 | + port = '{0}/{1}'.format(item.attrib['port'], item.attrib['protocol']) |
| 139 | + |
| 140 | + vuln.hosts.append((hid, port)) |
| 141 | + continue |
| 142 | + |
| 143 | + |
| 144 | +print("{0} ({1})".format(vuln.name, vuln.pid)) |
| 145 | +print("{0}\n".format(vuln.desc)) |
| 146 | + |
| 147 | +if len(vuln.hosts) > 0: |
| 148 | + for vi in sorted(vuln.hosts, key=lambda x: ip_key(x[0])): |
| 149 | + print('{0}\t{1}'.format(vi[0], vi[1])) |
| 150 | +else: |
| 151 | + print("No vulnerable hosts found.") |
0 commit comments