API tools faq
paste
khalilasharen

getsploits

khalilasharen
Oct 9th, 2012
123
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.82 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/env python
  2.  
  3. #Name: getsploits.py
  4. #Version: 0.9.2
  5. #Author: s3my0n
  6.  
  7. #########################################################################
  8. # getsploits searches for specific exploits/shellcode/papers from #
  9. # exploit-db.com . #
  10. # #
  11. # Copyright (C) 2011 s3my0n #
  12. # #
  13. # This program is free software: you can redistribute it and/or modify #
  14. # it under the terms of the GNU General Public License as published by #
  15. # the Free Software Foundation, either version 3 of the License, or #
  16. # any later version. #
  17. # #
  18. # This program is distributed in the hope that it will be useful, #
  19. # but WITHOUT ANY WARRANTY; without even the implied warranty of #
  20. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
  21. # GNU General Public License for more details. #
  22. # #
  23. # You should have received a copy of the GNU General Public License #
  24. # along with this program. If not, see <http://www.gnu.org/licenses/>. #
  25. #########################################################################
  26.  
  27. import sys
  28. import urllib2
  29. import re
  30. import threading
  31. from optparse import OptionParser
  32.  
  33. class ExploitSearcher(threading.Thread):
  34. def __init__(self, search_url):
  35. threading.Thread.__init__(self)
  36. self.search_url = search_url
  37. self.results = {}
  38. self.error = False
  39.  
  40. exp = ('<a href="http://www.exploit-db\.com/exploits/\d+">\s*.+\s*</a>',
  41. 'http://www.exploit-db.com/exploits/\d+')
  42. pap = ('<a href="http://www.exploit-db\.com/papers/\d+">\s*.+\s*</a>',
  43. 'http://www.exploit-db.com/papers/\d+')
  44. pdf = ('<a href="http://www.exploit-db\.com/download_pdf/\d+">.+\s*</a>',
  45. 'http://www.exploit-db.com/download_pdf/\d+')
  46.  
  47. self.match_string = '%s|%s|%s' % (exp[0], pap[0], pdf[0])
  48. self.match_links = '%s|%s|%s' % (exp[1], pap[1], pdf[1])
  49.  
  50. def getPage(self):
  51. try:
  52. self.current_page = urllib2.urlopen(self.search_url, '80').read()
  53. except BaseException:
  54. self.error = '\n[-] Error: could not connect to exploit-db.com'
  55. def getResultsFromPage(self, papers=False):
  56.  
  57. try:
  58. found_results = re.findall(self.match_string, self.current_page)
  59. except AttributeError:
  60. exit(1)
  61.  
  62. for i in found_results:
  63.  
  64. name = ''.join(re.findall('>\s*.+\s*<', i))\
  65. .strip('></a\n\r').replace('&lt;', '<')\
  66. .replace('&gt;', '>').replace('&amp;', '&')\
  67. .replace('&quot;', '"')
  68.  
  69. link = ''.join(re.findall(self.match_links, i))
  70. self.results[name] = link
  71.  
  72. def run(self):
  73. self.getPage()
  74. self.getResultsFromPage()
  75.  
  76. class SearcherController(object):
  77. def __init__(self, searchopts, genopts):
  78. def setfromdic(opt, dic):
  79. # Return number of a platform/type
  80. if (opt in dic.values()) or (opt == ''):
  81. return opt
  82. elif dic.has_key(opt):
  83. return dic[opt]
  84. else:
  85. return None
  86.  
  87. allplatforms = {'sco': '34', 'bsdi/x86': '6',
  88. 'openbsd': '27', 'lin/amd64': '17',
  89. 'plan9': '32', 'bsd/x86': '5',
  90. 'openbsd/x86': '28', 'hardware': '12',
  91. 'bsd': '3', 'unix': '41',
  92. 'lin/x86-64': '22', 'netbsd/x86': '25',
  93. 'linux': '16', 'solaris': '36',
  94. 'ultrix': '40', 'arm': '46',
  95. 'php': '31', 'solaris/sparc': '37',
  96. 'osX': '30', 'os-x/ppc': '29',
  97. 'cfm': '47', 'generator': '11',
  98. 'freebsd/x86': '9', 'bsd/ppc': '4',
  99. 'minix': '23', 'unixware': '42',
  100. 'freebsd/x86-64': '10', 'cgi': '7',
  101. 'hp-ux': '13', 'multiple': '24',
  102. 'win64': '44', 'tru64': '39',
  103. 'jsp': '15', 'novell': '26',
  104. 'linux/mips': '18', 'solaris/x86': '38',
  105. 'aix': '1', 'windows': '45',
  106. 'linux/ppc': '19', 'irix': '14',
  107. 'QNX': '33', 'lin/x86': '21',
  108. 'win32': '43', 'linux/sparc': '20',
  109. 'freebsd': '8', 'asp': '2',
  110. 'any': '0', 'sco/x86': '35'}
  111.  
  112. alltypes = {'any': '0',
  113. 'local': '2',
  114. 'papers': '5',
  115. 'remote': '3',
  116. 'shellcode': '4',
  117. 'webapps': '6'}
  118.  
  119. # Search options
  120. self.description = searchopts['DESC'].replace(' ', '+')
  121. self.author = searchopts['AUTH']
  122. self.port = searchopts['PORT']
  123. self.osvdb = searchopts['OSVDB']
  124. self.cve = searchopts['CVE']
  125.  
  126. # Setting up platform
  127. self.platform = setfromdic(searchopts['PLAT'], allplatforms)
  128. if self.platform == None:
  129. print '\n[-] Error: invalid platform [%s]' % (searchopts['PLAT'])
  130. exit(1)
  131.  
  132. # Setting up type
  133. self.type = setfromdic(searchopts['TYPE'], alltypes)
  134. if self.type == None:
  135. print '\n[-] Error: invalid type [%s]' % (searchopts['TYPE'])
  136. exit(1)
  137.  
  138. # General options
  139. self.quiet = genopts['QUIET']
  140. self.output = genopts['OUTPUT']
  141.  
  142. self.page = 1 # First page
  143. self.pages = 1 # How many pages
  144. self.results = {}
  145.  
  146. self.createURL()
  147.  
  148. def createURL(self):
  149. self.search_url = 'http://exploit-db.com/search/?action=search'
  150. self.search_url += '&filter_page=%d' % (self.page)
  151. self.search_url += '&filter_description=%s' % (self.description)
  152. self.search_url += '&filter_author=%s' % (self.author)
  153. self.search_url += '&filter_platform=%s' % (self.platform)
  154. self.search_url += '&filter_type=%s' % (self.type)
  155. self.search_url += '&filter_port=%s' % (self.port)
  156. self.search_url += '&filter_osvdb=%s' % (self.osvdb)
  157. self.search_url += '&filter_cve=%s' % (self.cve)
  158.  
  159. def userOutput(self, what):
  160. outputs = {'How_many_pages':'\n[*] Found %d pages of results.' % (self.pages),
  161. 'No_results':'\n[*] "%s" was not found in the database.' % (self.description),
  162. 'First_connection':'\n[*] Connecting ...',
  163. 'Find_results':'\n[*] Searching found pages ...',
  164. 'Saving_links':'\n[*] Saving found results to %s'%(self.output)}
  165. return outputs[what]
  166.  
  167. def findPageNumbers(self):
  168. if self.quiet != True:
  169. print self.userOutput('First_connection')
  170.  
  171. exploits = '<a\s+href="http://www.exploit-db\.com/exploits/\d+">\s*.+\s*</a>'
  172. papers = '<a\s+href="http://www.exploit-db\.com/papers/\d+">\s*.+\s*</a>'
  173. pdf = '<a\s+href="http://www.exploit-db\.com/download_pdf/\d+">\s*.+\s*</a>'
  174.  
  175. match_highest = 'filter_page=\d+'
  176.  
  177. try:
  178. openpage = urllib2.urlopen(self.search_url, '80').read()
  179. except KeyboardInterrupt:
  180. print '\n[*] Aborted: exiting'
  181. exit(1)
  182. except BaseException:
  183. print '\n[-] Error: could not connect to exploit-db.com'
  184. exit(1)
  185. else:
  186. find_link = ''.join(re.findall(match_highest, openpage))
  187. if find_link != '':
  188. self.pages = max([int(i) for i in re.findall('\d+', find_link)])
  189. else:
  190. one_page_test = re.findall('%s|%s|%s'%(exploits, papers, pdf), openpage)
  191. if one_page_test == []:
  192. print self.userOutput('No_results')
  193. exit(0)
  194.  
  195. if self.quiet != True:
  196. print self.userOutput('How_many_pages')
  197.  
  198. def printResults(self, results):
  199. for i in results:
  200. print '\n[+] %s' % (i)
  201. print ' %s' % (results[i])
  202.  
  203. def saveLinks(self):
  204. if self.quiet != True:
  205. print self.userOutput('Saving_links')
  206. try:
  207. fopen = open(self.output, 'a')
  208. for i in self.results:
  209. fopen.write('\n%s\n%s\n'%(i, self.results[i]))
  210. except KeyboardInterrupt:
  211. print '\n[*] Aborted: exiting'
  212. exit(1)
  213. except IOError:
  214. print '\n[-] Error: cannot write to %s' % (self.output)
  215. exit(1)
  216. else:
  217. fopen.close()
  218.  
  219. class ArgCreator(object):
  220. def __init__(self):
  221. parser = OptionParser(add_help_option=False)
  222. parser.add_option('--author', dest='author', default='')
  223. parser.add_option('--platform', dest='platform', default='0')
  224. parser.add_option('--type', dest='type', default='0')
  225. parser.add_option('--port', dest='port', default='')
  226. parser.add_option('--osvdb', dest='osvdb', default='')
  227. parser.add_option('--cve', dest='cve', default='')
  228. parser.add_option('-o', dest='output', default='')
  229. parser.add_option('-q', action='store_true', dest='quiet', default=False)
  230. parser.add_option('-h', '--help', action='store_true', dest='help', default=False)
  231. (self.options, args) = parser.parse_args()
  232.  
  233. self.checkArgs() # Parsing arguments
  234.  
  235. def helpscreen(self):
  236. return '''
  237. getsploits v0.9.2
  238. s3my0n RuSH4ck3R[at]gmail[dot]com
  239.  
  240.  
  241. Usage: getsploits.py [OPTIONS] [SEARCH_OPTIONS] description
  242.  
  243. Example: getsploits.py -o linux_shellcode.txt --type shellcode --platform linux ""
  244. getsploits.py -o freebsd_x86-64_local.txt --platform 10 --type 2 ""
  245. getsploits.py --author maxe vbulletin
  246.  
  247. [Options]:
  248. -o: Write results to a file
  249. -q: Quiet mode
  250. -h: Show this help screen
  251.  
  252. [Search Options]:
  253. --author:
  254. --platform
  255. --type
  256. --port
  257. --osvdb
  258. --cve
  259.  
  260. [Platforms]:
  261. 0: any (default) 12: hardware 24: multiple 36: solaris
  262. 1: aix 13: hp-ux 25: netbsd/x86 37: solaris/sparc
  263. 2: asp 14: irix 26: novell 38: solaris/x86
  264. 3: bsd 15: jsp 27: openbsd 39: tru64
  265. 4: bsd/ppc 16: linux 28: openbsd/x86 40: ultrix
  266. 5: bsd/x86 17: linux/amd64 29: os-x/ppc 41: unix
  267. 6: bsdi/x86 18: linux/mips 30: osx 42: unixware
  268. 7: cgi 19: linux/ppc 31: php 43: win32
  269. 8: freebsd 20: linux/sparc 32: plan9 44: win64
  270. 9: freebsd/x86 21: linux/x86 33: qnx 45: windows
  271. 10: freebsd/x86-64 22: linux/x86-64 34: sco 46: arm
  272. 11: generator 23: minix 35: sco/x86 47: cfm
  273.  
  274. [Types]:
  275. 0: any (default)
  276. 2: local
  277. 5: papers
  278. 3: remote
  279. 4: shellcode
  280. 6: webapps'''
  281.  
  282. def checkArgs(self):
  283. def finddesc():
  284. args = sys.argv[:]
  285. search_options = ('--author', '--platform', '--type', '--port', '--osvdb', '--cve')
  286. lone_options = ('-h', '-q')
  287. arg_options = ('-o',)
  288. for i in args:
  289. if args.index(i) == 0:
  290. continue
  291. previous_i = args[args.index(i)-1]
  292. if (i in search_options) or (i in lone_options) or (i in arg_options):
  293. continue
  294. else:
  295. if previous_i in search_options:
  296. continue
  297. if previous_i in arg_options:
  298. continue
  299. elif previous_i in lone_options:
  300. return i
  301. else:
  302. return i
  303. else:
  304. return None
  305.  
  306. if (self.options.help == True) or (len(sys.argv) < 2):
  307. print self.helpscreen()
  308. exit(0)
  309. self.description = finddesc() # Description string
  310. if self.description == None:
  311. print '[-] Error: please enter exploit description or enter "" instead of description.'
  312. exit(1)
  313.  
  314. def search_options(self):
  315. return {'DESC':self.description,
  316. 'AUTH':self.options.author,
  317. 'PLAT':self.options.platform,
  318. 'TYPE':self.options.type,
  319. 'PORT':self.options.port,
  320. 'OSVDB':self.options.osvdb,
  321. 'CVE':self.options.cve}
  322. def general_options(self):
  323. return {'OUTPUT':self.options.output,
  324. 'QUIET':self.options.quiet}
  325.  
  326. def main():
  327. ac = ArgCreator()
  328. search_options = ac.search_options()
  329. general_options = ac.general_options()
  330.  
  331. sc = SearcherController(search_options, general_options)
  332. sc.findPageNumbers() # Find out how many pages there are
  333.  
  334. # Searching
  335. threads = []
  336. for i in xrange(1, sc.pages+1):
  337. sc.page = i # Changing page number
  338. sc.createURL() # Update search url with current page number
  339. t = ExploitSearcher(sc.search_url)
  340. threads.append(t)
  341. nthreads = len(threads)
  342. if sc.quiet != True:
  343. print sc.userOutput('Find_results')
  344.  
  345. # Running threads
  346. try:
  347. for i in xrange(nthreads):
  348. threads[i].start()
  349. for i in xrange(nthreads):
  350. threads[i].join()
  351. # Getting thread's results
  352. error = threads[i].error
  353. if error:
  354. print error
  355. exit(1)
  356. else:
  357. new_results = threads[i].results
  358. sc.results.update(new_results)
  359. if sc.quiet != True:
  360. sc.printResults(new_results)
  361. except KeyboardInterrupt:
  362. print '[*] Aborted: exiting'
  363. exit(1)
  364. else:
  365. # Saving links
  366. if sc.output != '':
  367. sc.saveLinks()
  368.  
  369. if __name__=='__main__':
  370. main()
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!