From bed46278bce5b410c05e9e51887545cccf16df27 Mon Sep 17 00:00:00 2001 From: Nick Cottrell Date: Thu, 13 Aug 2020 17:07:54 -0400 Subject: [PATCH 1/7] Improved highlighter to highlight multiple terms (#11) --- searchsploit.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/searchsploit.py b/searchsploit.py index 1d04b77..9e15d6c 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -203,15 +203,16 @@ def highlightTerm(line, term): @term: the term that will be found in line and used to highlight the line\n @autoComp: [optional] if true, then it will output the string with the flags already turned into ANSI """ - try: - term = term.lower() - part1 = line[:line.lower().index(term)] - part2 = line[line.lower().index( - term): line.lower().index(term) + len(term)] - part3 = line[line.lower().index(term) + len(term):] - line = part1 + '\033[91m' + part2 + '\033[0m' + part3 - except: - line = line + marker = 0 # marks where the term is first found + term = term.lower() + + while (line.lower().find(term, marker) >= 0): + marker = line.lower().find(term, marker) # update location of new found term + part1 = line[:marker] + part2 = line[marker: marker + len(term)] + part3 = line[marker + len(term):] + line = "{0}\033[91m{1}\033[0m{2}".format(part1, part2, part3) + marker += len(term) + 4 return line From 1d92feadb2be0f5c10ac6be108cc4e5baff9df82 Mon Sep 17 00:00:00 2001 From: Nick Cottrell Date: Thu, 13 Aug 2020 17:08:58 -0400 Subject: [PATCH 2/7] Made display functions leave ansi on colour (#11) --- searchsploit.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/searchsploit.py b/searchsploit.py index 9e15d6c..8b653a0 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -203,6 +203,10 @@ def highlightTerm(line, term): @term: the term that will be found in line and used to highlight the line\n @autoComp: [optional] if true, then it will output the string with the flags already turned into ANSI """ + # immediate override if colour option is used + if not parseArgs.colour: + return line + marker = 0 # marks where the term is first found term = term.lower() @@ -229,6 +233,11 @@ def separater(lim, line1:str, line2:str): line2_length = int(COL) - lim - 2 - 1 # -2 for divider padding and -1 for terminal padding format_string = "{{title:{title_length}.{title_length}s}}\033[0m | {{path:{path_length}.{path_length}s}}\033[0m" + # Escape options for colour + if not parseArgs.colour: + print("{{0:{0}.{0}s}} | {{1:{1}.{1}s}}".format(line1_length, line2_length).format(line1, line2)) + return + # increase lim by markers to not include highlights in series last_mark = 0 while (line1.find("\033[91m", last_mark, line1_length + 5) >= 0): From 2c783f8520bac733787b7459bf69b06f42b923dc Mon Sep 17 00:00:00 2001 From: Nick Cottrell Date: Thu, 13 Aug 2020 17:10:37 -0400 Subject: [PATCH 3/7] Replaced Beautiful Soup with xmltree (#4) --- searchsploit.py | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/searchsploit.py b/searchsploit.py index 8b653a0..01afbca 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -471,6 +471,8 @@ def nmapxml(file=""): if no file name is given, then it tries stdin\n @return: returns true if it fails """ + import xml.etree.ElementTree as ET + global terms global STDIN @@ -496,47 +498,42 @@ def nmapxml(file=""): if content == "" or content[:5] != " Date: Thu, 13 Aug 2020 17:25:32 -0400 Subject: [PATCH 4/7] Refactored how program was finding configs --- searchsploit.py | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/searchsploit.py b/searchsploit.py index 01afbca..bf5b6bf 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -34,19 +34,20 @@ def scrapeRC(): """ divider = [] - try: - settingsFile = open("/etc/.searchsploit_rc", "r") - except: - try: - settingsFile = open(os.path.expanduser("~/.searchsploit_rc"), "r") - except: - settingsFile = open(os.path.abspath( - os.sys.path[0] + "/.searchsploit_rc"), "r") - # Checks for config in home directory - - settings = settingsFile.read().split("\n") - settingsFile.close() - + paths = [ + "/etc/.searchsploit_rc", + os.path.expanduser("~/.searchsploit_rc"), + os.path.expanduser("~/.local/.searchsploit_rc"), + os.path.abspath(os.path.join(os.sys.path[0], "/.searchsploit_rc")) + ] + + for p in paths: + if os.path.exists(p): + with open(p, "r") as settingsFile: + settings = settingsFile.read().split("\n") + settingsFile.close() + break + for i in settings: if(i == "" or i[0] == "#"): continue # Ignores lines that are empty or are just comments From e48ddb175b878aa47fa24d0e7c7f4b3044cc664f Mon Sep 17 00:00:00 2001 From: Rad10 Date: Thu, 13 Aug 2020 18:15:23 -0400 Subject: [PATCH 5/7] Added warning if DBs arent cloned --- searchsploit.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/searchsploit.py b/searchsploit.py index bf5b6bf..3bf1947 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -38,7 +38,7 @@ def scrapeRC(): "/etc/.searchsploit_rc", os.path.expanduser("~/.searchsploit_rc"), os.path.expanduser("~/.local/.searchsploit_rc"), - os.path.abspath(os.path.join(os.sys.path[0], "/.searchsploit_rc")) + os.path.abspath(os.path.join(os.sys.path[0], ".searchsploit_rc")) ] for p in paths: @@ -47,6 +47,12 @@ def scrapeRC(): settings = settingsFile.read().split("\n") settingsFile.close() break + else: + print("ERROR: Cannot find .searchsploit_rc\nPlease make sure it is located in one of its well known locations.") + print("It can be anywhere in one of these locations:") + for p in paths: + print("\"{0}\"".format(p)) + exit(2) for i in settings: if(i == "" or i[0] == "#"): From 22610a70674964f9eedea6554cb3ee8e1a672985 Mon Sep 17 00:00:00 2001 From: Rad10 Date: Thu, 13 Aug 2020 18:16:19 -0400 Subject: [PATCH 6/7] Refactored process of determining nonexistant DB's (#5) --- searchsploit.py | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/searchsploit.py b/searchsploit.py index 3bf1947..ace56fc 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -69,17 +69,8 @@ def scrapeRC(): # This section is to remove database paths that do not exist larray = len(files_array) - for i in range(larray - 1, 0, -1): - try: - tempRead = open(os.path.abspath(os.path.join(path_array[i], files_array[i])), - "r", encoding="utf8") - tempRead.read() - tempRead.close() - except: - try: - tempRead.close() - except: - pass + for i in range(larray - 1, -1, -1): + if not os.path.exists(os.path.abspath(os.path.join(path_array[i], files_array[i]))): files_array.pop(i) name_array.pop(i) path_array.pop(i) From 429b2bbf0ba42a3ea3d895b7864d1358e339e261 Mon Sep 17 00:00:00 2001 From: Rad10 Date: Thu, 13 Aug 2020 18:16:50 -0400 Subject: [PATCH 7/7] Formatted Document --- searchsploit.py | 40 +++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/searchsploit.py b/searchsploit.py index ace56fc..96f96e4 100755 --- a/searchsploit.py +++ b/searchsploit.py @@ -22,7 +22,7 @@ # RC info progname = os.path.basename(argv[0]) -VERSION = "v1.5" # Program version +VERSION = "v1.5" # Program version files_array = [] # Array options with file names name_array = [] # Array options with database names path_array = [] # Array options with paths to database files @@ -53,7 +53,7 @@ def scrapeRC(): for p in paths: print("\"{0}\"".format(p)) exit(2) - + for i in settings: if(i == "" or i[0] == "#"): continue # Ignores lines that are empty or are just comments @@ -149,7 +149,8 @@ def scrapeRC(): help="Display the EDB-ID value rather than local path.") parser.add_argument("--nmap", metavar="file.xml", nargs="?", type=argparse.FileType("r"), default=None, const=os.sys.stdin, help="Checks all results in Nmap's XML output with service version (e.g.: nmap -sV -oX file.xml).\nUse \"-v\" (verbose) to try even more combinations") -parser.add_argument("--version", action="version", version="%(prog)s {0}".format(VERSION)) +parser.add_argument("--version", action="version", + version="%(prog)s {0}".format(VERSION)) parser.add_argument("--exclude", nargs="*", type=str, default=list(), metavar="[terms]", help="Remove certain terms from the results. Option best added after all other terms have been gathered.") @@ -169,7 +170,7 @@ def update(): # update via git os.chdir(path_array[i]) # set path to repos directory - os.system("git pull -v upstream master") + os.system("git pull -v origin master") print("[i] Git Pull Complete") os.chdir(cwd) return @@ -181,7 +182,7 @@ def update(): def drawline(): """ Draws a line in the terminal. """ - line = "" * (int(COL) - 1) + line = "" * (int(COL) - 1) print(line) @@ -191,7 +192,7 @@ def drawline(lim): """ line = "-" * lim line += "+" - line += "-" * (COL - lim - 2) # -2 for terminal padding + line += "-" * (COL - lim - 2) # -2 for terminal padding print(line) @@ -205,11 +206,11 @@ def highlightTerm(line, term): if not parseArgs.colour: return line - marker = 0 # marks where the term is first found + marker = 0 # marks where the term is first found term = term.lower() while (line.lower().find(term, marker) >= 0): - marker = line.lower().find(term, marker) # update location of new found term + marker = line.lower().find(term, marker) # update location of new found term part1 = line[:marker] part2 = line[marker: marker + len(term)] part3 = line[marker + len(term):] @@ -218,7 +219,7 @@ def highlightTerm(line, term): return line -def separater(lim, line1:str, line2:str): +def separater(lim, line1: str, line2: str): """ Splits the two texts to fit perfectly within the terminal width """ lim = int(lim) @@ -227,13 +228,15 @@ def separater(lim, line1:str, line2:str): print(line) return - line1_length = lim - 1 # subtract 1 for padding - line2_length = int(COL) - lim - 2 - 1 # -2 for divider padding and -1 for terminal padding - format_string = "{{title:{title_length}.{title_length}s}}\033[0m | {{path:{path_length}.{path_length}s}}\033[0m" - + line1_length = lim - 1 # subtract 1 for padding + # -2 for divider padding and -1 for terminal padding + line2_length = int(COL) - lim - 2 - 1 + format_string = "{{title:{title_length}.{title_length}s}}\033[0m | {{path:{path_length}.{path_length}s}}\033[0m" + # Escape options for colour if not parseArgs.colour: - print("{{0:{0}.{0}s}} | {{1:{1}.{1}s}}".format(line1_length, line2_length).format(line1, line2)) + print("{{0:{0}.{0}s}} | {{1:{1}.{1}s}}".format( + line1_length, line2_length).format(line1, line2)) return # increase lim by markers to not include highlights in series @@ -254,9 +257,9 @@ def separater(lim, line1:str, line2:str): line2_length += 4 last_mark = line2.find("\033[0m", last_mark, line2_length + 4) + 4 - # Creating format string for print - fstring = format_string.format(title_length=line1_length, path_length=line2_length) + fstring = format_string.format( + title_length=line1_length, path_length=line2_length) line = fstring.format(title=line1, path=line2) print(line) @@ -508,7 +511,6 @@ def nmapxml(file=""): # ## Read in XMP (IP, name, service, and version) root = ET.fromstring(content) - hostsheet = root.findall("host") for host in hostsheet: # made these lines to separate searches by machine @@ -531,7 +533,7 @@ def nmapxml(file=""): print("Searching terms:", terms) # displays terms found by xml searchsploitout() # tests search terms by machine terms = [] # emptys search terms for next search - + return True @@ -698,7 +700,7 @@ def run(): elif parseArgs.examine != None: examine(parseArgs.examine) return - + # formatting exclusions if not parseArgs.case: for i in range(len(parseArgs.exclude)):