1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307 | """Adobe plugin for THAT."""
from collections import OrderedDict
VERSION = "1.1.0"
"""Version of this set of plugin definitions."""
MINIMUM_THAT_VERSION = "1.1.0"
"""Minimum THAT version required to run these plugin definitions."""
NAME = "adobe"
PRIORITY = 1
ANALYZE_DATA = OrderedDict()
GET_TANIUM_DATA = OrderedDict()
GET_INTERNET_DATA = [
"shockwave_vul_count",
"flash_vul_count",
"latest_shockwave_vul_version",
"latest_flash_vul_version",
]
# ask the question 'Get Installed Applications containing "adobe" from all machines'
# and store results in "adobe.csv"
GET_TANIUM_DATA["adobe.csv"] = {
"filters": [],
"sensors": ["Installed Applications, that contains:adobe"],
}
# ask the question 'Get Online from all machines where Installed Applications contains "adobe"'
# and store results in "adobetargets.csv"
GET_TANIUM_DATA["adobetargets.csv"] = {
"filters": ["Installed Applications, that contains:adobe"],
"sensors": ["Online"],
}
ANALYZE_DATA["cleaned_adobe_df"] = """
# clean out noise from adobe.csv
csv = "adobe.csv"
df = self.load_csv_as_df(csv)
result = self.clean_df(df, columns=["Name"])
"""
ANALYZE_DATA["product_count"] = """
# get total count of adobe products installed across endpoints
df = self.get_result("cleaned_adobe_df")
result = len(df['Name'].unique())
"""
ANALYZE_DATA["install_count"] = """
# get total number of times adobe products installed across all endpoints
df = self.get_result("cleaned_adobe_df")
result = df['Count'].sum()
"""
ANALYZE_DATA["ep_install_total"] = """
# get total number endpoints reporting any adobe product installed from adobetargets.csv
csv = "adobetargets.csv"
df = self.load_csv_as_df(csv)
result = df['Count'].sum()
"""
ANALYZE_DATA["install_avg"] = """
# get average install per endpoint given number of machines reporting adobe product installed
ep_install_total = self.get_result("ep_install_total")
install_count = self.get_result("install_count")
if ep_install_total > 0:
if (float(install_count) / float(ep_install_total)) < 1:
result = math.ceil(float(install_count) / float(ep_install_total))
else:
result = float(install_count) / float(ep_install_total)
else:
result = 0
result = int(result)
"""
ANALYZE_DATA["shockwave_df"] = """
# build shockwave data frame from cleaned_adobe_df
df = self.get_result("cleaned_adobe_df")
result = df[df['Name'].str.contains("Shockwave Player")]
"""
ANALYZE_DATA["shockwave_count"] = """
# get Number of Shockwave Products Installed from shockwave data frame
df = self.get_result("shockwave_df")
result = len(df["Version"].unique())
"""
ANALYZE_DATA["shockwave_vul_count"] = """
# Get shockwave Vulnerability Count from CVEDetails.com
csv = "internet_data.csv"
df = self.load_csv_as_df(csv)
result = df.iloc[0]["shockwave_vul_count"]
"""
ANALYZE_DATA["latest_shockwave_vul_version"] = """
# Get Latest known Shockwave Vulnerable Version from CVEDetails.com
csv = "internet_data.csv"
df = self.load_csv_as_df(csv)
result = df.iloc[0]["latest_shockwave_vul_version"]
"""
ANALYZE_DATA["shockwave_vul_endpoints"] = """
# Approximate Total Number of Vulnerable Endpoints (Compare latest version Across Endpoints to CVE Data)
df = self.get_result("shockwave_df")
latest_ver = self.get_result("latest_shockwave_vul_version")
result = df.loc[df['Version'] <= latest_ver, 'Count'].sum()
"""
ANALYZE_DATA["flash_df"] = """
# build flash data frame from cleaned_adobe_df
df = self.get_result("cleaned_adobe_df")
result = df[df['Name'].str.contains("Flash Player")]
"""
ANALYZE_DATA["flash_count"] = """
# Number of Flash Products Installed
df = self.get_result("flash_df")
result = len(df["Version"].unique())
"""
ANALYZE_DATA["flash_vul_count"] = """
# Flash Vulnerability Count from CVEDetails.com
csv = "internet_data.csv"
df = self.load_csv_as_df(csv)
result = df.iloc[0]["flash_vul_count"]
"""
ANALYZE_DATA["latest_flash_vul_version"] = """
# Latest known Flash Vulnerable Version from CVEDetails.com
csv = "internet_data.csv"
df = self.load_csv_as_df(csv)
result = df.iloc[0]["latest_flash_vul_version"]
"""
ANALYZE_DATA["flash_vul_endpoints"] = """
# Approximate Total Number of Vulnerable Endpoints (Compare latest version Across Endpoints to CVE Data)
df = self.get_result("flash_df")
latest_ver = self.get_result("latest_flash_vul_version")
result = df.loc[df['Version'] <= latest_ver, 'Count'].sum()
"""
def shockwave_vul_count(wequests, pkgs, **kwargs):
"""Get shockwave vulnerability count from cvedetails.com."""
# content url
url = "http://www.cvedetails.com/product/6670/Adobe-Shockwave-Player.html"
r = wequests.request(url=url)
# soupify it
soup = pkgs.BeautifulSoup(r.content, "lxml")
# find table with versions from website
souptable = soup.body.find(text='Total').parent
# get total from TD next to it
totalvul = souptable.find_next_sibling('td')
# cleanup
ret = totalvul.string.replace("\t", "").replace("\n", "")
return ret
def latest_shockwave_vul_version(wequests, pkgs, **kwargs):
"""Get latest shockwave vulnerable version from cvedetails.com."""
# content url
url = "http://www.cvedetails.com/version-list/53/6670/1/Adobe-Shockwave-Player.html"
r = wequests.request(url=url)
# soupify it
soup = pkgs.BeautifulSoup(r.content, "lxml")
# find table with versions from website
souptable = soup.find('table', attrs={'class': 'listtable'})
# declare empty arrays for data
data = []
versions = []
# for each row in table, place it inside data array
for row in souptable.findAll("tr"):
cells = row.findAll("td")
if len(cells) > 0:
data.append(cells)
# for each td in table, extract data into an array
for ele in data:
# text cleanup from HTML obfuscation
test = ele[0].string.replace("\t", "").replace("\n", "")
# make sure its a version number, not an application name
if test[0].isdigit():
# create sub version array
subversion = []
# get first column with Version Number
for td in ele[:1]:
# cleanup html some more
td = td.string.replace("\t", "").replace("\n", "")
# make sure cell is not empty
if len(td) > 0:
# make sure cell isn't text
if td[0].isdigit():
subversion.append(td)
versions.append(subversion)
ret = pkgs.natsorted(versions, reverse=True)[0]
return ret[0]
def flash_vul_count(wequests, pkgs, **kwargs):
"""Get flash vulnerability count from cvedetails.com."""
# content url
url = "http://www.cvedetails.com/product/6761/Adobe-Flash-Player.html"
r = wequests.request(url=url)
# soupify it
soup = pkgs.BeautifulSoup(r.content, "lxml")
# find table with versions from website
souptable = soup.body.find(text='Total').parent
# get total from TD next to it
totalvul = souptable.find_next_sibling('td')
# cleanup
ret = totalvul.string.replace("\t", "").replace("\n", "")
return ret
def latest_flash_vul_version(wequests, pkgs, **kwargs):
"""Get latest flash vulnerable version from cvedetails.com."""
# content url
url = "http://www.cvedetails.com/version-list/53/6761/1/Adobe-Flash-Player.html"
r = wequests.request(url=url)
# soupify it
soup = pkgs.BeautifulSoup(r.content, "lxml")
# find table with versions from website
souptable = soup.find('table', attrs={'class': 'listtable'})
# declare empty arrays for data
data = []
versions = []
# for each row in table, place it inside data array
for row in souptable.findAll("tr"):
cells = row.findAll("td")
if len(cells) > 0:
data.append(cells)
# for each td in table, extract data into an array
for ele in data:
# text cleanup from HTML obfuscation
test = ele[0].string.replace("\t", "").replace("\n", "")
# make sure its a version number, not an application name
if test[0].isdigit():
# create sub version array
subversion = []
# get first column Version Number
for td in ele[:1]:
# cleanup html some more
td = td.string.replace("\t", "").replace("\n", "")
# make sure cell is not empty
if len(td) > 0:
# make sure cell isn't text
if td[0].isdigit():
subversion.append(td)
versions.append(subversion)
ret = pkgs.natsorted(versions, reverse=True)[0]
return ret[0]
|