Newer
Older
DirtyScripts / ReportToolz / rep2.php
root on 28 Feb 2020 15 KB Info issues
  1. #!/usr/bin/php
  2. <?php
  3. //error_reporting(0);
  4.  
  5. /***
  6. * Configuration options
  7. */
  8. $sub1 = 5; // header no in doc e.g. "5 Discovered Vulnerabilities"
  9.  
  10. /***
  11. * Main program - Don't edit below
  12. */
  13. echo "_____ _____ _____ 2\n||_// ||== ||_// \n|| \\ ||___ || \n\n";
  14.  
  15. foreach (glob("classes/*.php") as $filename)
  16. include $filename;
  17.  
  18. $definitions = new \Clapp\CommandLineArgumentDefinition(
  19. array(
  20. "help|h" => "Shows help message",
  21. "doc|d=s" => "/path/to/doc.odt to use",
  22. )
  23. );
  24.  
  25. $filter = new \Clapp\CommandArgumentFilter($definitions, $argv);
  26.  
  27. if ($filter->getParam('h') === true || $argc < 2) {
  28. fwrite(STDERR, $definitions->getUsage());
  29. exit(0);
  30. }
  31.  
  32. // see if doc exists
  33. if ($filter->getParam("doc") == false)
  34. die("[-] no doc set\n");
  35.  
  36. echo "[!] doc: ".$filter->getParam("doc")."\n";
  37. if(!file_exists($filter->getParam("doc")))
  38. die("[-] no such file! \n");
  39.  
  40. // extract doc and get contents
  41. $rand = uniqid();
  42. mkdir("/tmp/$rand");
  43. if(unzipFolder($filter->getParam("doc"), "/tmp/$rand/")) {
  44. $source = file_get_contents("/tmp/$rand/content.xml");
  45. echo "[+] doc extracted\n";
  46. } else {
  47. die("[-] unable to extract doc\n");
  48. }
  49. // Parse Doc's XML
  50. $line = array();
  51. $reader = new XMLReader();
  52. if (!$reader->open("/tmp/$rand/content.xml")) die("[-] Failed to open 'content.xml'\n");
  53.  
  54. // font checker
  55. /***
  56. * FUTURE FEATURE PERHAPS
  57. */
  58. $fonts = array();
  59. while ($reader->read()){
  60. //print_r($reader->name);
  61. if ($reader->nodeType == XMLREADER::ELEMENT && ($reader->name === 'style:font-face')) {
  62. //if(!empty($reader->name)){
  63. //echo "here2\n";
  64. //$line[] = $reader->expand()->textContent; // Put the text into array in correct order...
  65. $fonts[] = $reader->getAttribute("style:name");
  66. //echo $font;echo "\n"; // DEBUG
  67. //}
  68. }
  69. }
  70. $reader->close();
  71. //die();
  72. echo "[=] fonts found: ".sizeof($fonts)."\n";
  73.  
  74. // get template version used
  75. $reader = new XMLReader();
  76. if (!$reader->open("/tmp/$rand/meta.xml")) die("[-] Failed to open 'meta.xml'\n");
  77. $templateVer = 0.0;
  78. while ($reader->read()) {
  79. if($reader->name == "dc:version"){
  80. $reader->read();
  81. $templateVer = number_format(floatval($reader->value), 2);
  82. break;
  83. }
  84. }
  85.  
  86. // step through text:h and text:p elements to put them into an array
  87. $reader = new XMLReader();
  88. if (!$reader->open("/tmp/$rand/content.xml")) die("[-] Failed to open 'content.xml'\n");
  89. while ($reader->read()){
  90. if ($reader->nodeType == XMLREADER::ELEMENT && ($reader->name === 'text:h' || $reader->name === 'text:p' || $reader->name === 'text:bookmark')) {
  91. if(!empty($reader->expand()->textContent))
  92. $line[] = $reader->expand()->textContent; // Put the text into array in correct order...
  93. //echo $reader->expand()->textContent;echo "\n"; // DEBUG
  94. }
  95. }
  96. $reader->close();
  97.  
  98. // find the content we want
  99. $start = 0; $end = 0;
  100. foreach($line as $key => $val){
  101. if(strpos($val, "Discovered Vulnerabilities") === 0){ $start = $key; }
  102. //if(strpos($val, "This section provides a quick guide to plan your remediation for the vulnerabilities discovered during the test.") === 0){ $end = $key-2; }
  103. if(strpos($val, "Observed Hosts and Services") === 0){ $end = $key-2; }
  104. $line[$key] = trim($val);
  105. }
  106.  
  107. // add to sexy array's
  108. $vuln = array();
  109. $vulnPlace = 0;
  110. $switch = 0;
  111. $sub2 = 0;
  112. $sub3 = 1;
  113. if(number_format($templateVer, 2) >= number_format(1.0, 2)){
  114. echo "[=] Template $templateVer used\n";
  115. for ($i=$start; $i <= $end ; $i++) {
  116. // change state (action to take)
  117. /***
  118. * ~states~
  119. * 0 = do nothing
  120. * 1 = next is title
  121. * 2 = next is description
  122. * 3 = next is solution
  123. * 4 = next is remediation
  124. * 5 = next is cvss no
  125. * 6 = next is risk level
  126. * 7 = next is hosts
  127. * 8 = next possibly title
  128. */
  129. switch ($line[$i]) {
  130. case 'Discovered Vulnerabilities':
  131. $switch = 0;
  132. break;
  133. case 'Serious Risk Vulnerabilities':
  134. $sub2++; $sub3 = 1;
  135. $switch = 1;
  136. break;
  137. case 'High Risk Vulnerabilities':
  138. $sub2++; $sub3 = 1;
  139. $switch = 1;
  140. break;
  141. case 'Medium Risk Vulnerabilities':
  142. $sub2++; $sub3 = 1;
  143. $switch = 1;
  144. break;
  145. case 'Low Risk Vulnerabilities':
  146. $sub2++; $sub3 = 1;
  147. $switch = 1;
  148. break;
  149. case 'Informational Risk Vulnerabilities':
  150. $sub2++; $sub3 = 1;
  151. $switch = 1;
  152. break;
  153. case 'Description':
  154. $switch = 2;
  155. break;
  156. case 'Solution':
  157. $switch = 3;
  158. break;
  159. case 'Remediation':
  160. $switch = 4;
  161. break;
  162. case 'CVSS Base Score':
  163. $switch = 5;
  164. break;
  165. case 'Risk Analysis':
  166. $switch = 6;
  167. break;
  168. case 'Vulnerabilities Exist On':
  169. $switch = 7;
  170. break;
  171. case 'Potential Impact':
  172. $switch = 9;
  173. break;
  174. default:
  175. # code...
  176. break;
  177. }
  178.  
  179. //take action
  180. switch ($switch) {
  181. case 1:
  182. $i++;
  183. $vuln[$vulnPlace]['title'] = $line[$i];
  184. $vuln[$vulnPlace]['ref'] = "$sub1.$sub2.$sub3";
  185. $sub3++;
  186. $switch = 0;
  187. break;
  188. case 2:
  189. @$vuln[$vulnPlace]['desc'] .= $line[$i];
  190. break;
  191. case 3:
  192. @$vuln[$vulnPlace]['fix'] .= $line[$i];
  193. break;
  194. case 4:
  195. $i++;
  196. //$vuln[$vulnPlace]['rem'] = trim(strtok($line[$i], " "));
  197. $switch = 0;
  198. break;
  199. case 5:
  200. $i++;
  201. $vuln[$vulnPlace]['cvss'] = $line[$i];
  202. $switch = 0;
  203. break;
  204. case 6:
  205. $i++;
  206. $line[$i+3] = str_replace("Vulnerability Img", "", $line[$i+3]);
  207. $vuln[$vulnPlace]['risk'] = strstr(trim($line[$i+3]), ":", true);
  208. $vuln[$vulnPlace]['owasp'] = trim(substr($line[$i+3], strpos($line[$i+3], ":") + 1));
  209. $vuln[$vulnPlace]['impact'] = trim(strtok($line[$i+4], " "));
  210. $vuln[$vulnPlace]['rem'] = trim(strtok($line[$i+5], " "));
  211. $switch = 0;
  212. break;
  213. case 7:
  214. $i++;
  215. $vuln[$vulnPlace]['hosts'] = $line[$i];
  216. $switch = 8;
  217. $vulnPlace++;
  218. break;
  219. case 8:
  220. $vuln[$vulnPlace]['title'] = trim($line[$i]);
  221. $vuln[$vulnPlace]['ref'] = "$sub1.$sub2.$sub3";
  222. $sub3++;
  223. $switch = 0;
  224. break;
  225. case 9:
  226. @$vuln[$vulnPlace]['impact'] .= $line[$i];
  227. break;
  228. default:
  229. # code...
  230. break;
  231. }
  232.  
  233. //echo $line[$i]."\n"; // DEBUG
  234. }
  235. $first_desc = explode("Description", $vuln[0]['desc']);
  236.  
  237. $vuln[0]['desc'] = $first_desc[sizeof($first_desc)-1];
  238. }else{ // old template or Dave's format
  239. for ($i=$start; $i <= $end ; $i++) {
  240. // change state (action to take)
  241. /***
  242. * ~states~
  243. * 0 = do nothing
  244. * 1 = next is title
  245. * 2 = next is description
  246. * 3 = next is solution
  247. * 4 = next is remediation
  248. * 5 = next is cvss no
  249. * 6 = next is risk level
  250. * 7 = next is hosts
  251. * 8 = next possibly title
  252. */
  253. switch ($line[$i]) {
  254. case 'Discovered Vulnerabilities':
  255. $switch = 0;
  256. break;
  257. case 'Serious Risk Vulnerabilities':
  258. $sub2++; $sub3 = 1;
  259. $switch = 1;
  260. break;
  261. case 'High Risk Vulnerabilities':
  262. $sub2++; $sub3 = 1;
  263. $switch = 1;
  264. break;
  265. case 'Medium Risk Vulnerabilities':
  266. $sub2++; $sub3 = 1;
  267. $switch = 1;
  268. break;
  269. case 'Low Risk Vulnerabilities':
  270. $sub2++; $sub3 = 1;
  271. $switch = 1;
  272. break;
  273. case 'Informational Risk Vulnerabilities':
  274. $sub2++; $sub3 = 1;
  275. $switch = 1;
  276. break;
  277. case 'Description':
  278. $switch = 2;
  279. break;
  280. case 'Solution':
  281. $switch = 3;
  282. break;
  283. case 'Remediation':
  284. $switch = 4;
  285. break;
  286. case 'CVSS Base Score':
  287. $switch = 5;
  288. break;
  289. case 'Risk Level':
  290. $switch = 6;
  291. break;
  292. case 'Vulnerabilities Exist On':
  293. $switch = 7;
  294. break;
  295. case 'Potential Impact':
  296. $switch = 9;
  297. break;
  298. default:
  299. # code...
  300. break;
  301. }
  302.  
  303. //take action
  304. switch ($switch) {
  305. case 1:
  306. $i++;
  307. $vuln[$vulnPlace]['title'] = $line[$i];
  308. $vuln[$vulnPlace]['ref'] = "$sub1.$sub2.$sub3";
  309. $sub3++;
  310. $switch = 0;
  311. break;
  312. case 2:
  313. @$vuln[$vulnPlace]['desc'] .= $line[$i];
  314. break;
  315. case 3:
  316. @$vuln[$vulnPlace]['fix'] .= $line[$i];
  317. break;
  318. case 4:
  319. $i++;
  320. $vuln[$vulnPlace]['rem'] = trim(strtok($line[$i], " "));
  321. $switch = 0;
  322. break;
  323. case 5:
  324. $i++;
  325. $vuln[$vulnPlace]['cvss'] = $line[$i];
  326. $switch = 0;
  327. break;
  328. case 6:
  329. $i++;
  330. $vuln[$vulnPlace]['risk'] = trim(strtok($line[$i], " "));
  331. $vuln[$vulnPlace]['owasp'] = trim(substr($line[$i], strpos($line[$i], ":") + 1));
  332. $switch = 0;
  333. break;
  334. case 7:
  335. $i++;
  336. $vuln[$vulnPlace]['hosts'] = $line[$i];
  337. $switch = 8;
  338. $vulnPlace++;
  339. break;
  340. case 8:
  341. $vuln[$vulnPlace]['title'] = trim($line[$i]);
  342. $vuln[$vulnPlace]['ref'] = "$sub1.$sub2.$sub3";
  343. $sub3++;
  344. $switch = 0;
  345. break;
  346. case 9:
  347. @$vuln[$vulnPlace]['impact'] .= $line[$i];
  348. break;
  349. default:
  350. # code...
  351. break;
  352. }
  353.  
  354. //echo $line[$i]."\n"; // DEBUG
  355. }
  356. }
  357. // minor tidying of arrays
  358. for ($i=0; $i < sizeof($vuln) ; $i++) {
  359. if (strpos($vuln[$i]['desc'], "Description") === 0) $vuln[$i]['desc'] = substr($vuln[$i]['desc'], strlen("Description"));
  360. if (strpos($vuln[$i]['fix'], "Solution") === 0) $vuln[$i]['fix'] = substr($vuln[$i]['fix'], strlen("Solution"));
  361. $vuln[$i]['risk'] = rtrim($vuln[$i]['risk'], ":");
  362. // remove html encoding
  363. foreach($vuln[$i] as $key => $val){
  364. $vuln[$i][$key] = mb_convert_encoding($val, "UTF-8", 'UTF-8');
  365. }
  366. }
  367.  
  368. //print_r($vuln); // DEBUG
  369. echo "[+] vulnerabilities identified\n";
  370.  
  371. delTree("/tmp/$rand");
  372. echo "[+] temp files removed\n";
  373.  
  374. $resultsFolder = substr($filter->getParam("doc"), 0, strrpos( $filter->getParam("doc"), '/') )."/rep2";
  375. if(!file_exists($resultsFolder."/")){
  376. mkdir($resultsFolder."/");
  377. echo "[+] created directory $resultsFolder/\n";
  378. }else{
  379. $i = 1;
  380. while (file_exists($resultsFolder."_$i/"))
  381. $i++;
  382. mkdir($resultsFolder."_$i/");
  383. $resultsFolder .= "_$i";
  384. echo "[+] created directory $resultsFolder/\n";
  385. }
  386.  
  387. if(writeIssueTable($vuln, "Serious", $resultsFolder."/findings_serious.csv"))
  388. echo "[+] serious issues: $resultsFolder/findings_serious.csv\n";
  389. if(writeIssueTable($vuln, "High", $resultsFolder."/findings_high.csv"))
  390. echo "[+] high issues: $resultsFolder/findings_high.csv\n";
  391. if(writeIssueTable($vuln, "Medium", $resultsFolder."/findings_medium.csv"))
  392. echo "[+] medium issues: $resultsFolder/findings_medium.csv\n";
  393. if(writeIssueTable($vuln, "Low", $resultsFolder."/findings_low.csv"))
  394. echo "[+] low issues: $resultsFolder/findings_low.csv\n";
  395. if(writeIssueTable($vuln, "Info", $resultsFolder."/findings_info.csv"))
  396. echo "[+] info issues: $resultsFolder/findings_info.csv\n";
  397.  
  398. $order = array('title', 'ref', 'desc', 'fix','rem','cvss','risk','impact','owasp','hosts');
  399. $orderedArray = array();
  400. foreach($vuln as $vn_no =>$vn){
  401. foreach ($order as $key) {
  402. //echo $key."\n";
  403. $orderedArray[$vn_no][$key] = $vuln[$vn_no][$key];
  404. }
  405. }
  406. if(writeAllTable($orderedArray, $resultsFolder."/findings_all.csv"))
  407. echo "[+] all issues: $resultsFolder/findings_all.csv\n";
  408.  
  409. if(writeRemediationTable($vuln, $resultsFolder."/remediation.csv"))
  410. echo "[+] remediation table: $resultsFolder/remediation.csv\n";
  411.  
  412. if(writeOWASPTable($vuln, $resultsFolder."/owasp.csv"))
  413. echo "[+] OWASP table: $resultsFolder/owasp.csv\n";
  414.  
  415. viewVulns($vuln);
  416.  
  417. function unzipFolder($zipInputFile, $outputFolder) {
  418. $zip = new ZipArchive;
  419. $res = $zip->open($zipInputFile);
  420. if ($res === true) {
  421. $zip->extractTo($outputFolder);
  422. $zip->close();
  423. return true;
  424. }
  425. else {
  426. return false;
  427. }
  428. }
  429.  
  430. function XML2Array(SimpleXMLElement $parent){
  431. $array = array();
  432.  
  433. foreach ($parent as $name => $element) {
  434. ($node = & $array[$name])
  435. && (1 === count($node) ? $node = array($node) : 1)
  436. && $node = & $node[];
  437.  
  438. $node = $element->count() ? XML2Array($element) : trim($element);
  439. }
  440.  
  441. return $array;
  442. }
  443.  
  444. function delTree($dir){
  445. $files = array_diff(scandir($dir), array('.', '..'));
  446.  
  447. foreach ($files as $file) {
  448. (is_dir("$dir/$file")) ? delTree("$dir/$file") : unlink("$dir/$file");
  449. }
  450.  
  451. return rmdir($dir);
  452. }
  453.  
  454. function viewVulns($vuln){
  455. $s = $h = $m = $l = $i = 0 ;
  456. for ($j=0; $j < sizeof($vuln) ; $j++) {
  457. switch ($vuln[$j]['risk']) {
  458. case 'Serious':
  459. $s++;
  460. break;
  461. case 'High':
  462. $h++;
  463. break;
  464. case 'Medium':
  465. $m++;
  466. break;
  467. case 'Low':
  468. $l++;
  469. break;
  470. case 'Info':
  471. $i++;
  472. break;
  473. }
  474. }
  475. echo "[=] Serious = $s, High = $h, Medium = $m, Low = $l, Info = $i\n";
  476.  
  477. echo"
  478. Ref | Title | Risk | CVSS | Remediation | OWASP
  479. -------|-----------------------------------|--------|--------|---------------|------------------------------\n";
  480. for ($i=0; $i < sizeof($vuln) ; $i++) {
  481. $ref = str_pad($vuln[$i]['ref'], 7);
  482. $title = str_pad($vuln[$i]['title'], 35);
  483. $risk = str_pad($vuln[$i]['risk'], 8);
  484. $cvs1 = explode("-", $vuln[$i]['cvss']);
  485. $cvss = str_pad($cvs1[0], 8);
  486. $rem = str_pad($vuln[$i]['rem'], 15);
  487. $owasp = str_pad($vuln[$i]['owasp'], 30);
  488.  
  489. echo substr($ref, 0, 7); echo "|";
  490. echo substr($title, 0, 35); echo "|";
  491. echo substr($risk, 0, 8); echo "|";
  492. echo substr($cvss, 0, 8); echo "|";
  493. echo substr($rem, 0, 15); echo "|";
  494. echo substr($owasp, 0, 30); echo "\n";
  495. }
  496. }
  497.  
  498. function writeIssueTable($vuln, $issue, $path){
  499. $towrite = array();
  500. for ($i=0; $i < sizeof($vuln) ; $i++) {
  501. if($vuln[$i]['risk'] == $issue){
  502. $towrite[$i]['desc'] = $vuln[$i]['title']." - ".$vuln[$i]['desc'];
  503. $towrite[$i]['fix'] = $vuln[$i]['fix'];
  504. $towrite[$i]['ref'] = $vuln[$i]['ref'];
  505. $towrite[$i]['hosts'] = $vuln[$i]['hosts'];
  506. }
  507. }
  508. if(sizeof($towrite) > 0){
  509. $fp = fopen($path, 'w');
  510. fprintf($fp, chr(0xEF).chr(0xBB).chr(0xBF));
  511. foreach ($towrite as $fields) {
  512. fputcsv($fp, $fields);
  513. }
  514. fclose($fp);
  515. return true;
  516. }else{
  517. return false;
  518. }
  519. }
  520.  
  521. function writeAllTable($vuln, $path){
  522. if(sizeof($vuln) > 0){
  523. $fp = fopen($path, 'w');
  524. fprintf($fp, chr(0xEF).chr(0xBB).chr(0xBF));
  525. fputcsv($fp, array("Title", "Ref", "Description", "Solution", "Remediation", "CVSS", "Risk","Impact", "OWASP", "Affected"));
  526.  
  527. //print_r($orderedArray);
  528. foreach ($vuln as $fields) {
  529. fputcsv($fp, $fields);
  530. }
  531. fclose($fp);
  532. return true;
  533. }else{
  534. return false;
  535. }
  536. }
  537.  
  538. function writeRemediationTable($vuln, $path){
  539. $towrite = array();
  540. for ($i=0; $i < sizeof($vuln) ; $i++) {
  541. $towrite[$i]['hosts'] = $vuln[$i]['hosts'];
  542. $towrite[$i]['ref'] = $vuln[$i]['ref'];
  543. $towrite[$i]['p'] = " ";
  544. $towrite[$i]['c'] = " ";
  545. $towrite[$i]['d'] = " ";
  546. $towrite[$i]['u'] = " ";
  547. switch ($vuln[$i]['rem']) {
  548. case 'Patch':
  549. $towrite[$i]['p'] = $vuln[$i]['risk'][0];
  550. break;
  551. case 'Configuration':
  552. $towrite[$i]['c'] = $vuln[$i]['risk'][0];
  553. break;
  554. case 'Development':
  555. $towrite[$i]['d'] = $vuln[$i]['risk'][0];
  556. break;
  557. case 'Upgrade':
  558. $towrite[$i]['u'] = $vuln[$i]['risk'][0];
  559. break;
  560. }
  561. }
  562. if(sizeof($towrite) > 0){
  563. $fp = fopen($path, 'w');
  564. fprintf($fp, chr(0xEF).chr(0xBB).chr(0xBF));
  565. fputcsv($fp, array("Host", "Ref", "P", "C", "D", "U"));
  566. foreach ($towrite as $fields) {
  567. fputcsv($fp, $fields);
  568. }
  569. fclose($fp);
  570. return true;
  571. }else{
  572. return false;
  573. }
  574. }
  575.  
  576. function writeOWASPTable($vuln, $path){
  577. $towrite = array();
  578. for ($i=0; $i < sizeof($vuln) ; $i++) {
  579. if(in_array($vuln[$i]['owasp'], array_column($towrite, 'owaspId'))){
  580. $towrite[$vuln[$i]['owasp']]['no']++;
  581. }else{
  582. $towrite[$vuln[$i]['owasp']]['owaspId'] = $vuln[$i]['owasp'];
  583. $towrite[$vuln[$i]['owasp']]['no'] = 1;
  584. }
  585. }
  586. if(sizeof($towrite) > 0){
  587. $fp = fopen($path, 'w');
  588. fprintf($fp, chr(0xEF).chr(0xBB).chr(0xBF));
  589. foreach ($towrite as $fields) {
  590. fputcsv($fp, $fields);
  591. }
  592. fclose($fp);
  593. return true;
  594. }else{
  595. return false;
  596. }
  597. }
  598.  
  599. ?>
Buy Me A Coffee