process_rsploit.py

import os,sys


if len(sys.argv) < 2:
	print("Usage: process_fuzzreplay [TARGET_FOLDER]")
	exit()
LOGFOLDER = sys.argv[1]

if not os.path.exists(LOGFOLDER) or not os.path.isdir(LOGFOLDER):
	print("Invalid dir")
	exit()

print("Working on %s..." % LOGFOLDER)


exploitmap = dict()
targetmap = dict()
rcemap = dict()
offbrandmap = dict()
samebrandmap = dict()
devicemap = dict()
blacklist = set()

IDS = os.listdir(LOGFOLDER)
total = len(IDS)
count = 0
extensions = [".rar", ".zip", ".tar", ".bin"]
print("    ids: ", total)

print("-"*50)
print("Processing exploit references...")
print("-"*50)

with open("blacklist.list", "r") as blacklistFile:
	for line in blacklistFile:
		line = line.strip()
		blacklist.add(line)
blacklistFile.close()

# with open("exploitdump.log", "w+") as eOutFile:
# 	for exploit, targets in exploitmap.items():
# 		# print(exploit)
# 		for target in sorted(targets):
# 			# print("%s,%s" % (target, exploit))
# 			line = "%s,%s" % (target, exploit)
# 			eOutFile.write(line)
# 			eOutFile.write("\n")

# eOutFile.close()

exploitlist = []
with open("exploits.list", "r") as exploitFile:
	for line in exploitFile:
		line = line.strip()
		if line.startswith("#"):
			continue
		exploitlist.append(line)

eollist = []
devicemap = dict()
with open("eol.list", "r") as eolFile:
	for line in eolFile:
		# print(line)
		line = line.strip()
		eollist.append(line)

		fields = line.split()
		brand = fields[0].strip()
		name = fields[1].strip()
		device = fields[2].split("/")[-2].strip()
		devicemap[name] = device

print("-"*50)
print("References compiled, writing processing logs...")
print("-"*50)

missing = set()
unknown = set()

for targetfile in IDS:
	count += 1
	if "_" not in targetfile:
		continue
	# print("    - processing [%d/%d]: %s" % (count, total, targetfile))
	if count % 250 == 0:
		print("    - processing %d/%d" % (count, total))
	target = targetfile.split("_")[0].strip()
	hashname = targetfile.split("_")[1].strip()
	targetpath = os.path.join(LOGFOLDER, targetfile)
	with open(targetpath, "rb") as targetFile:
		exploit = ""
		tag = ""
		brand = ""
		vulnerable = False
		validated = "N"
		for line in targetFile:
			if line.startswith(b"Target: "):
				targetname = line.split(b"/")[-1].strip().decode("utf-8", errors="ignore")
				for ext in extensions:
					if targetname.lower().endswith(ext):
						targetname = targetname.rsplit(".", 1)[0]
			if b"Running initializer on" in line:
				brand = line.split()[3].strip().decode("utf-8", errors="ignore")
				tag = "%s,%s,%s" % (brand, target, targetname)
				if targetname not in devicemap.keys() and targetfile not in missing:
					print("    - missing", targetname, targetfile)
					missing.add(targetfile)
				# print(targetname)
			if b"Testing exploit" in line:
				exploit = line.split()[-1].strip().decode("utf-8", errors="ignore").strip("/")
				exploitbrand = exploit.split("/")[-2].strip()
				vulnerable = False
				validated = "N"
				# print("    - processing: ", exploit)
			if exploit and line.startswith(b"SIGSEGV_HAPPENED") or b".core" in line or \
				 b"SERVER CRASHED" in line or line.startswith(b"GHRCE") or \
				(b"AAAAA" in line and b"is vulnerable" in line):
					if line.startswith(b"GHRCE") or \
				(b"AAAAA" in line and b"is vulnerable" in line):
						validated = "Y"
					vulnerable = True
			if b" >> SERVER" in line:
				if b"MALFUNCTION" not in line and exploit and vulnerable:
					if exploit not in exploitmap.keys():
						exploitmap[exploit] = list()
					if tag not in exploitmap[exploit]:
						exploitmap[exploit].append(tag)
						# print("    - adding", exploit, tag)
					if target not in targetmap.keys():
						targetmap[target] = list()
						offbrandmap[target] = list()
						samebrandmap[target] = list()
					rcetag = target+"_"+exploit
					if exploit not in targetmap[target]:
						if exploit not in exploitlist:
							if exploit not in unknown:
								print("    x - skipping unknown exploit", exploit)
								unknown.add(exploit)
						else:
							targetmap[target].append(exploit)
							rcemap[rcetag] = validated
							if brand != exploitbrand:
								offbrandmap[target].append(exploit)
							else:
								samebrandmap[target].append(exploit)
				exploit = b""



	targetFile.close()
print("    - processed  %d/%d" % (count, total))

total = len(eollist)
count = 0

# print("-"*50)
# print("Writing seed map")
# print("-"*50)
# for exploit in exploitlist:
# 	if exploit.startswith("#"):
# 		continue
# 	count += 1
# 	if count % 250 == 0:
# 		print("    - writing %d/%d" % (count, total))
# 	exploitname = exploit.strip()
# 	if exploit not  in exploitmap.keys():
# 		continue
# 	targets = exploitmap[exploit]
# 	for target in targets:
# 		fields = target.split(",")
# 		brand = fields[0].strip()
# 		devid = fields[1].strip()
# 		name = fields[2].strip()
# 		device = devicemap[name]
# 		if device in blacklist or exploitname.endswith(".txt"):
# 			continue
# 		seedpath = os.path.join("seedmap", devid)
# 		exploit_tag = exploitname.split("/")[1]+"_id_"+exploitname.split(":")[1].split(",")[0]
# 		# print("  >", exploit_tag)
# 		with open(seedpath, "w+") as seedFile:
# 			seedFile.write(exploit_tag+"\n")
# 		seedFile.close()

print("-"*50)
print("Writing device.matrix")
print("-"*50)
total = len(exploitlist)
count = 0
deviceList = []

with open("device.matrix", "w+") as matrixFile:
	for exploit in exploitlist:
		if exploit.startswith("#"):
			continue
		count += 1
		if count % 250 == 0:
			print("    - writing %d/%d" % (count, total))
		exploitname = exploit.strip()
		if exploit not  in exploitmap.keys():
			continue
		targets = exploitmap[exploit]
		hits = ""
		seen = set()
		for target in targets:
			# print(target)
			fields = target.split(",")
			brand = fields[0].strip()
			devid = fields[1].strip()
			name = fields[2].strip()
			if name not in devicemap.keys():
				print("    x - missing", name)
				continue
			device = devicemap[name]
			if device in seen:
				continue
			seen.add(device)
			targethits = len(targetmap[devid])
			offbrandhits = len(offbrandmap[devid])
			# print("%s,%s,%s,%s" % (brand, device, name, exploithits))
			outline = "%s %s %d %d\n" % (exploit, device, targethits, offbrandhits)
			matrixFile.write(outline)
			if device not in deviceList:
				deviceList.append(device)

falsepositive = set()
dedup = set()

count = 0
print("Writing exploits.matrix")
print("-"*50)
with open("exploits.matrix", "w") as matrixFile, open("exploits.same.matrix", "w") as matrixOnBrand, open("exploits.diff.matrix", "w") as matrixOffBrand:
	for exploit in exploitlist:
		if exploit.startswith("#"):
			continue
		count += 1
		if count % 250 == 0:
			print("    - writing %d/%d" % (count, total))
		exploitname = exploit.strip()
		exploitbrand =  exploit.split("/")[-2].strip()
		if exploit not  in exploitmap.keys():
			continue
		targets = exploitmap[exploit]
		hits = ""
		outline = None
		seen = set()
		exploit_numhits = len(targets)
		for target in targets:
			# print(target)
			fields = target.split(",")
			brand = fields[0].strip()
			devid = fields[1].strip()
			name = fields[2].strip()
			if name not in devicemap.keys():
				print("    x - missing", name)
				continue
			if name in blacklist:
				print("    x - blacklisted", name)
				continue
			device = devicemap[name]
			if device in seen:
				continue
			# seen.add(device)
			targethits = len(targetmap[devid])
			validated = rcemap[devid+"_"+exploit]
			# print("%s,%s,%s,%s" % (brand, device, name, exploithits))
			if targethits < len(exploitlist):
				# outline = "%s %s %s %s %s %d/%d:%d/%d\n" % (exploit, brand, device, name, devid, targethits, len(exploitlist), exploit_numhits, len(deviceList))
				outline = "%s %s %s %s %s %d %s\n" % (exploit, brand, device, name, devid, exploit_numhits, validated)
			else:
				if target not in falsepositive:
					print("    -x false positive", target)
					falsepositive.add(target)
			if outline and outline not in dedup:
				matrixFile.write(outline)
				if brand == exploitbrand:
					matrixOnBrand.write(outline)
				else:
					matrixOffBrand.write(outline)
				dedup.add(outline)
matrixFile.close()


print("-"*50)
print("Writing brand.matrix")
print("-"*50)
total = len(exploitlist)
count = 0
brands = ["asus",  "belkin",  "dlink",  "linksys",  "netgear",  "tenda",  "tplink",  "trendnet",  "ZyXEL"]

with open("brand.matrix", "w+") as matrixFile:
	outline = "crashname "
	for b in brands:
		outline += "%s " % b
	outline += "\n"
	matrixFile.write(outline)
	for exploit in exploitlist:
		if exploit.startswith("#"):
			continue
		count += 1
		if count % 250 == 0:
			print("    - writing %d/%d" % (count, total))

		outline = "%s" % (exploit)
		exploitname = exploit.strip()
		if exploit not  in exploitmap.keys():
			continue
		targets = exploitmap[exploit]
		hits = ""
		seen = set()
		brandcount = dict()
		for target in targets:
			# print(target)
			fields = target.split(",")
			brand = fields[0].strip()
			devid = fields[1].strip()
			name = fields[2].strip()
			if name not in devicemap.keys():
				print("    x - missing", name)
				continue
			device = devicemap[name]
			if device in seen:
				continue
			seen.add(device)
			if brand not in brandcount.keys():
				brandcount[brand] = 0
			brandcount[brand] += 1
		for brand in brands:
			if brand in brandcount.keys():
				numhits = brandcount[brand]
			else:
				numhits = 0
			outline += " %d" % (numhits)
		outline += "\n"

		matrixFile.write(outline)

print("-"*50)
print("Done")
print("-"*50)