def test_et(self): e = ExploitTarget() e.title = UNICODE_STR e.description = UNICODE_STR e.short_description = UNICODE_STR e2 = round_trip(e) self._test_equal(e, e2)
def test_et(self): e = ExploitTarget() e.title = UNICODE_STR e.description = UNICODE_STR e.short_description = UNICODE_STR e2 = round_trip(e) self._test_equal(e, e2)
def cvebuild(var): """Search for a CVE ID and return a STIX formatted response.""" cve = CVESearch() data = json.loads(cve.id(var)) if data: try: from stix.utils import set_id_namespace namespace = {NS: NS_PREFIX} set_id_namespace(namespace) except ImportError: from mixbox.idgen import set_id_namespace from mixbox.namespaces import Namespace namespace = Namespace(NS, NS_PREFIX, "") set_id_namespace(namespace) pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg.stix_header.handling = _marking() # Define the exploit target expt = ExploitTarget() expt.title = data['id'] expt.description = data['summary'] expt.information_source = InformationSource( identity=Identity(name="National Vulnerability Database")) # Add the vulnerability object to the package object expt.add_vulnerability(_vulnbuild(data)) # Add the COA object to the ET object for coa in COAS: expt.potential_coas.append( CourseOfAction( idref=coa['id'], timestamp=expt.timestamp)) # Do some TTP stuff with CAPEC objects if TTPON is True: try: for i in data['capec']: pkg.add_ttp(_buildttp(i, expt)) except KeyError: pass expt.add_weakness(_weakbuild(data)) # Add the exploit target to the package object pkg.add_exploit_target(expt) xml = pkg.to_xml() title = pkg.id_.split(':', 1)[-1] # If the function is not imported then output the xml to a file. if __name__ == '__main__': _postconstruct(xml, title) return xml else: sys.exit("[-] Error retrieving details for " + var)
def cvebuild(var): """Search for a CVE ID and return a STIX formatted response.""" cve = CVESearch() data = json.loads(cve.id(var)) if data: try: from stix.utils import set_id_namespace namespace = {NS: NS_PREFIX} set_id_namespace(namespace) except ImportError: from mixbox.idgen import set_id_namespace from mixbox.namespaces import Namespace namespace = Namespace(NS, NS_PREFIX, "") set_id_namespace(namespace) pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg.stix_header.handling = _marking() # Define the exploit target expt = ExploitTarget() expt.title = data['id'] expt.description = data['summary'] expt.information_source = InformationSource(identity=Identity( name="National Vulnerability Database")) # Add the vulnerability object to the package object expt.add_vulnerability(_vulnbuild(data)) # Add the COA object to the ET object for coa in COAS: expt.potential_coas.append( CourseOfAction(idref=coa['id'], timestamp=expt.timestamp)) # Do some TTP stuff with CAPEC objects if TTPON is True: try: for i in data['capec']: pkg.add_ttp(_buildttp(i, expt)) except KeyError: pass expt.add_weakness(_weakbuild(data)) # Add the exploit target to the package object pkg.add_exploit_target(expt) xml = pkg.to_xml() title = pkg.id_.split(':', 1)[-1] # If the function is not imported then output the xml to a file. if __name__ == '__main__': _postconstruct(xml, title) return xml else: sys.exit("[-] Error retrieving details for " + var)
def cvebuild(var): """Search for a CVE ID and return a STIX formatted response.""" cve = CVESearch() data = json.loads(cve.id(var)) if data: try: from stix.utils import set_id_namespace namespace = {NS: NS_PREFIX} set_id_namespace(namespace) except ImportError: from stix.utils import idgen from mixbox.namespaces import Namespace namespace = Namespace(NS, NS_PREFIX, "") idgen.set_id_namespace(namespace) pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg = STIXPackage() pkg.stix_header = STIXHeader() pkg.stix_header.handling = marking() # Define the exploit target expt = ExploitTarget() expt.title = data['id'] expt.description = data['summary'] # Add the vulnerability object to the package object expt.add_vulnerability(vulnbuild(data)) # Do some TTP stuff with CAPEC objects try: for i in data['capec']: ttp = TTP() ttp.title = "CAPEC-" + str(i['id']) ttp.description = i['summary'] ttp.exploit_targets.append(ExploitTarget(idref=expt.id_)) pkg.add_ttp(ttp) except KeyError: pass # Do some weakness stuff if data['cwe'] != 'Unknown': weak = Weakness() weak.cwe_id = data['cwe'] expt.add_weakness(weak) # Add the exploit target to the package object pkg.add_exploit_target(expt) xml = pkg.to_xml() # If the function is not imported then output the xml to a file. if __name__ == '__main__': title = pkg.id_.split(':', 1)[-1] with open(title + ".xml", "w") as text_file: text_file.write(xml) return xml
def get_exploit_target_from_json(ttp_json): json_cve = ttp_json['value'] json_title = ttp_json['title'] # title は "%CVE番号% (index)" とする title = '%s (%s)' % (json_cve, json_title) # CVE 情報を circl から取得する cve_info = Cve.get_cve_info(json_cve) # 各種 CVE 情報のリンクを作成 mitre_url = 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=' + str( json_cve) circl_url = 'http://cve.circl.lu/cve/' + str(json_cve) # Expoit_Target, Vulnerability の Short Description は link common_short_description = '%s (<a href="%s" target="_blank">MITRE</a>, <a href="%s" target="_blank">circl.lu</a>)<br/>' % ( json_cve, mitre_url, circl_url) # base_score try: vul_cvss_score = CVSSVector() vul_cvss_score.base_score = cve_info['cvss'] except BaseException: vul_cvss_score = None # Expoit_Target, Vulnerability の Description 作成 common_decritpion = common_short_description # base_score があったら追加する if vul_cvss_score is not None: common_decritpion += ('Base Score: %s<br/>' % (vul_cvss_score.base_score)) # vulnerability の description は circl から取得した description try: common_decritpion += ('%s<br/>' % (cve_info['summary'])) except BaseException: # 取得失敗時は circl のページの url common_decritpion += ('%s<br/>' % (circl_url)) # ExploitTarget et = ExploitTarget() et.title = title et.description = common_decritpion et.short_description = common_short_description # Vulnerability vulnerablity = Vulnerability() vulnerablity.title = title vulnerablity.description = common_decritpion vulnerablity.short_description = common_short_description vulnerablity.cve_id = json_cve if vul_cvss_score is not None: vulnerablity.cvss_score = vul_cvss_score et.add_vulnerability(vulnerablity) return et
def buildTarget(input_dict): # add incident and confidence target = ExploitTarget() target.title = input_dict['title'] target.description = input_dict['description'] if input_dict['vulnerability']: target.add_vulnerability(input_dict['vulnerability']) if input_dict['weakness']: target.add_weakness(input_dict['weakness']) if input_dict['configuration']: target.configuration = input_dict['configuration'] if input_dict['informationSource']: target.information_source = InformationSource(input_dict['informationSource']) return target
def get_exploit_target_from_cve(cve): title = cve # description は mitreのページヘのリンク description = 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=' + str( cve) # ExploitTarget et = ExploitTarget() et.title = title et.description = description et.short_description = description # Vulnerability vulnerablity = Vulnerability() vulnerablity.title = title vulnerablity.description = description vulnerablity.short_description = description vulnerablity.cve_id = cve et.add_vulnerability(vulnerablity) return et
def get_exploit_target_from_json(ttp_json): json_cve = ttp_json['value'] json_title = ttp_json['title'] # title は "%CVE番号% (index)" とする title = '%s (%s)' % (json_cve, json_title) # # CVE 情報を circl から取得する cve_info = CommonExtractor.get_cve_info(json_cve) # Expoit_Target, Vulnerability の Short Description は link common_short_description = CommonExtractor.get_ttp_common_short_description( ttp_json) # # base_score vul_cvss_score = CommonExtractor.get_vul_cvss_score(cve_info) # Expoit_Target, Vulnerability の Description 作成 common_decritpion = CommonExtractor.get_ttp_common_description( ttp_json) # ExploitTarget et = ExploitTarget() et.title = title et.description = common_decritpion et.short_description = common_short_description # Vulnerability vulnerablity = Vulnerability() vulnerablity.title = title vulnerablity.description = common_decritpion vulnerablity.short_description = common_short_description vulnerablity.cve_id = json_cve if vul_cvss_score is not None: vulnerablity.cvss_score = vul_cvss_score et.add_vulnerability(vulnerablity) return et
from stix.coa import CourseOfAction from stix.core import STIXPackage from stix.exploit_target import ExploitTarget from stix.exploit_target.configuration import Configuration from stix.exploit_target.vulnerability import CVSSVector, Vulnerability from stix.exploit_target.weakness import Weakness # Exploit Target 1 et1 = ExploitTarget(title='Apache HTTP Vulnerability - CVE-2018-1312') et1.description = ( 'In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, ' 'the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed.' 'In a cluster of servers using a common Digest authentication configuration, ' 'HTTP requests could be replayed across servers by an attacker without detection.' ) et1.short_description = 'Apache httpd 2.2.0 to 2.4.29 is vulnerable' # Exploit Target 1 - Weakness weakness = Weakness(cwe_id='CWE-287', description='Improper Authentication') et1.add_weakness(weakness) # Exploit Target 1 - Configuration config = Configuration( cce_id='CCE-27686-5', description='The Apache web server be run with the appropriate privileges.', short_description='Configuration Short Description') et1.add_configuration(config) # Exploit Target 1 - Vulnerability vuln = Vulnerability() vuln.cve_id = 'CVE-2018-1312'