misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/circl_passivessl.py

@@ -0,0 +1,113 @@
+import json
+import pypssl
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+mispattributes = {'input': ['ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Raphaël Vinot',
+    'description': 'Modules to access CIRCL Passive SSL.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'CIRCL Passive SSL',
+    'logo': 'passivessl.png',
+    'requirements': ['pypssl: Passive SSL python library', 'A CIRCL passive SSL account with username & password'],
+    'features': 'This module takes an ip-address (ip-src or ip-dst) attribute as input, and queries the CIRCL Passive SSL REST API to gather the related certificates and return the corresponding MISP objects.\n\nTo make it work a username and a password are required to authenticate to the CIRCL Passive SSL API.',
+    'references': ['https://www.circl.lu/services/passive-ssl/'],
+    'input': 'IP address attribute.',
+    'output': 'x509 certificate objects seen by the IP address(es).',
+}
+moduleconfig = ['username', 'password']
+
+
+class PassiveSSLParser():
+    def __init__(self, attribute, authentication):
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.attribute)
+        self.pssl = pypssl.PyPSSL(basic_auth=authentication)
+        self.cert_hash = 'x509-fingerprint-sha1'
+        self.cert_type = 'pem'
+        self.mapping = {'issuer': ('text', 'issuer'),
+                        'keylength': ('text', 'pubkey-info-size'),
+                        'not_after': ('datetime', 'validity-not-after'),
+                        'not_before': ('datetime', 'validity-not-before'),
+                        'subject': ('text', 'subject')}
+
+    def get_results(self):
+        if hasattr(self, 'result'):
+            return self.result
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object')}
+        return {'results': results}
+
+    def parse(self):
+        value = self.attribute.value.split('|')[0] if '|' in self.attribute.type else self.attribute.value
+
+        try:
+            results = self.pssl.query(value)
+        except Exception:
+            self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
+            return
+
+        if not results:
+            self.result = {'error': 'Not found'}
+            return
+
+        if 'error' in results:
+            self.result = {'error': results['error']}
+            return
+
+        for ip_address, certificates in results.items():
+            ip_uuid = self._handle_ip_attribute(ip_address)
+            for certificate in certificates['certificates']:
+                self._handle_certificate(certificate, ip_uuid)
+
+    def _handle_certificate(self, certificate, ip_uuid):
+        x509 = MISPObject('x509')
+        x509.add_attribute(self.cert_hash, type=self.cert_hash, value=certificate)
+        cert_details = self.pssl.fetch_cert(certificate)
+        info = cert_details['info']
+        for feature, mapping in self.mapping.items():
+            attribute_type, object_relation = mapping
+            x509.add_attribute(object_relation, type=attribute_type, value=info[feature])
+        x509.add_attribute(self.cert_type, type='text', value=self.cert_type)
+        x509.add_reference(ip_uuid, 'seen-by')
+        self.misp_event.add_object(**x509)
+
+    def _handle_ip_attribute(self, ip_address):
+        if ip_address == self.attribute.value:
+            return self.attribute.uuid
+        ip_attribute = MISPAttribute()
+        ip_attribute.from_dict(**{'type': self.attribute.type, 'value': ip_address})
+        self.misp_event.add_attribute(**ip_attribute)
+        return ip_attribute.uuid
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config'):
+        return {'error': 'CIRCL Passive SSL authentication is missing.'}
+    if not request['config'].get('username') or not request['config'].get('password'):
+        return {'error': 'CIRCL Passive SSL authentication is incomplete, please provide your username and password.'}
+    authentication = (request['config']['username'], request['config']['password'])
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
+        return {'error': 'Unsupported attribute type.'}
+    pssl_parser = PassiveSSLParser(attribute, authentication)
+    pssl_parser.parse()
+    return pssl_parser.get_results()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/clamav.py

@@ -0,0 +1,129 @@
+import base64
+import io
+import logging
+import sys
+import zipfile
+import clamd
+from . import check_input_attribute, standard_error_message
+from typing import Optional
+from pymisp import MISPEvent, MISPObject
+
+log = logging.getLogger("clamav")
+log.setLevel(logging.DEBUG)
+sh = logging.StreamHandler(sys.stdout)
+sh.setLevel(logging.DEBUG)
+fmt = logging.Formatter(
+    "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
+)
+sh.setFormatter(fmt)
+log.addHandler(sh)
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Jakub Onderka',
+    'description': 'Submit file to ClamAV',
+    'module-type': ['expansion'],
+    'name': 'ClaamAV',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+moduleconfig = ["connection"]
+mispattributes = {
+    "input": ["attachment", "malware-sample"],
+    "format": "misp_standard"
+}
+
+
+def create_response(original_attribute: dict, software: str, signature: Optional[str] = None) -> dict:
+    misp_event = MISPEvent()
+    if signature:
+        misp_event.add_attribute(**original_attribute)
+
+        av_signature_object = MISPObject("av-signature")
+        av_signature_object.add_attribute("signature", signature)
+        av_signature_object.add_attribute("software", software)
+        av_signature_object.add_reference(original_attribute["uuid"], "belongs-to")
+        misp_event.add_object(av_signature_object)
+
+    event = misp_event.to_dict()
+    results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+    return {"results": results}
+
+
+def connect_to_clamav(connection_string: str) -> clamd.ClamdNetworkSocket:
+    if connection_string.startswith("unix://"):
+        return clamd.ClamdUnixSocket(connection_string.replace("unix://", ""))
+    elif ":" in connection_string:
+        host, port = connection_string.split(":")
+        return clamd.ClamdNetworkSocket(host, int(port))
+    else:
+        raise Exception("ClamAV connection string is invalid. It must be unix socket path with 'unix://' prefix or IP:PORT.")
+
+
+def dict_handler(request: dict):
+    connection_string: str = request["config"].get("connection")
+    if not connection_string:
+        return {"error": "No ClamAV connection string provided"}
+
+    attribute = request.get("attribute")
+    if not attribute:
+        return {"error": "No attribute provided"}
+
+    if not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+
+    if attribute["type"] not in mispattributes["input"]:
+        return {"error": "Invalid attribute type provided, expected 'malware-sample' or 'attachment'"}
+
+    attribute_data = attribute.get("data")
+    if not attribute_data:
+        return {"error": "No attribute data provided"}
+
+    try:
+        clamav = connect_to_clamav(connection_string)
+        software_version = clamav.version()
+    except Exception:
+        logging.exception("Could not connect to ClamAV")
+        return {"error": "Could not connect to ClamAV"}
+
+    try:
+        data = base64.b64decode(attribute_data, validate=True)
+    except Exception:
+        logging.exception("Provided data is not valid base64 encoded string")
+        return {"error": "Provided data is not valid base64 encoded string"}
+
+    if attribute["type"] == "malware-sample":
+        try:
+            with zipfile.ZipFile(io.BytesIO(data)) as zipf:
+                data = zipf.read(zipf.namelist()[0], pwd=b"infected")
+        except Exception:
+            logging.exception("Could not extract malware sample from ZIP file")
+            return {"error": "Could not extract malware sample from ZIP file"}
+
+    try:
+        status, reason = clamav.instream(io.BytesIO(data))["stream"]
+    except Exception:
+        logging.exception("Could not send attribute data to ClamAV. Maybe file is too big?")
+        return {"error": "Could not send attribute data to ClamAV. Maybe file is too big?"}
+
+    if status == "ERROR":
+        return {"error": "ClamAV returned error message: {}".format(reason)}
+    elif status == "OK":
+        return {"results": {}}
+    elif status == "FOUND":
+        return create_response(attribute, software_version, reason)
+    else:
+        return {"error": "ClamAV returned invalid status {}: {}".format(status, reason)}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/cluster25_expand.py

@@ -0,0 +1,239 @@
+import json
+import requests
+import uuid
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Milo Volpicelli',
+    'description': 'Module to query Cluster25 CTI.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Cluster25 Expand',
+    'logo': 'cluster25.png',
+    'requirements': ['A Cluster25 API access (API id & key)'],
+    'features': 'This module takes a MISP attribute value as input to query the Cluster25CTI API. The result is then mapped into compatible MISP Objects and relative attributes.\n',
+    'references': [''],
+    'input': 'An Indicator value of type included in the following list:\n- domain\n- email-src\n- email-dst\n- filename\n- md5\n- sha1\n- sha256\n- ip-src\n- ip-dst\n- url\n- vulnerability\n- btc\n- xmr\n ja3-fingerprint-md5',
+    'output': 'A series of c25 MISP Objects with colletion of attributes mapped from Cluster25 CTI query result.',
+}
+moduleconfig = ['api_id', 'apikey', 'base_url']
+misperrors = {'error': 'Error'}
+misp_type_in = ['domain', 'email-src', 'email-dst', 'filename', 'md5', 'sha1', 'sha256', 'ip-src', 'ip-dst', 'url',
+                'vulnerability', 'btc', 'xmr', 'ja3-fingerprint-md5']
+
+mapping_out = {  # mapping between the MISP attributes type and the compatible Cluster25 indicator types.
+    'domain': {'type': 'domain', 'to_ids': True},
+    'email-src': {'type': 'email-src', 'to_ids': True},
+    'email-dst': {'type': 'email-dst', 'to_ids': True},
+    'filename': {'type': 'filename', 'to_ids': True},
+    'md5': {'type': 'md5', 'to_ids': True},
+    'sha1': {'type': 'sha1', 'to_ids': True},
+    'sha256': {'type': 'sha256', 'to_ids': True},
+    'ip-src': {'type': 'ip-src', 'to_ids': True},
+    'ip-dst': {'type': 'ip-dst', 'to_ids': True},
+    'url': {'type': 'url', 'to_ids': True},
+    'cve': {'type': 'vulnerability', 'to_ids': True},
+    'btcaddress': {'type': 'btc', 'to_ids': True},
+    'xmraddress': {'type': 'xmr', 'to_ids': True},
+    'ja3': {'type': 'ja3-fingerprint-md5', 'to_ids': True},
+}
+misp_type_out = [item['type'] for item in mapping_out.values()]
+misp_attributes = {'input': misp_type_in, 'format': 'misp_standard'}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    # validate Cluster25 params
+    if request.get('config'):
+        if request['config'].get('apikey') is None:
+            misperrors['error'] = 'Cluster25 apikey is missing'
+            return misperrors
+        if request['config'].get('api_id') is None:
+            misperrors['error'] = 'Cluster25 api_id is missing'
+            return misperrors
+        if request['config'].get('base_url') is None:
+            misperrors['error'] = 'Cluster25 base_url is missing'
+            return misperrors
+
+    # validate attribute
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request.get('attribute')
+    if not any(input_type == attribute.get('type') for input_type in misp_type_in):
+        return {'error': 'Unsupported attribute type.'}
+
+    client = Cluster25CTI(request['config']['api_id'], request['config']['apikey'], request['config']['base_url'])
+
+    return lookup_indicator(client, request.get('attribute'))
+
+
+def format_content(content):
+    if isinstance(content, str) or isinstance(content, bool) or isinstance(content, int) or isinstance(content, float):
+        return content
+    ret = ""
+    tmp_ret = []
+    if content is None:
+        return ret
+    is_dict = isinstance(content, dict)
+    is_list = isinstance(content, list)
+    for index, key in enumerate(content):
+        if is_dict:
+            if isinstance(content[key], dict):
+                ret = format_content(content[key])
+            elif isinstance(content[key], list):
+                for list_item in content[key]:
+                    tmp_ret.append(format_content(list_item))
+            else:
+                tmp_ret.append(f"{key}: {content[key]}")
+        elif is_list:
+            if isinstance(content[index], str):
+                ret = ", ".join(content)
+            else:
+                ret = format_content(content)
+    if tmp_ret:
+        ret = " ".join(tmp_ret)
+    return ret
+
+
+def lookup_indicator(client, attr):
+    result = client.investigate(attr)
+    if result.get('error'):
+        return result
+    misp_event = MISPEvent()
+    attribute = MISPAttribute()
+    attribute.from_dict(**attr)
+    misp_event.add_attribute(**attribute)
+
+    misp_object_g = MISPObject('c25_generic_info')
+    misp_object_g.template_uuid = uuid.uuid4()
+    misp_object_g.description = 'c25_generic_info'
+    setattr(misp_object_g, 'meta-category', 'network')
+
+    misp_objects = []
+    for ind, entry in enumerate(result):
+        if isinstance(result[entry], dict):
+            tmp_obj = MISPObject(f"c25_{entry}")
+            tmp_obj.template_uuid = uuid.uuid4()
+            tmp_obj.description = f"c25_{entry}"
+            setattr(tmp_obj, 'meta-category', 'network')
+            tmp_obj.add_reference(attribute['uuid'], 'related-to')
+            for key in result[entry]:
+                if isinstance(result[entry][key], dict):
+                    for index, item in enumerate(result[entry][key]):
+                        if result[entry][key][item]:
+                            tmp_obj.add_attribute(f"{entry}_{key}_{item}", **{'type': 'text', 'value': format_content(
+                                result[entry][key][item])})
+
+                elif isinstance(result[entry][key], list):
+                    for index, item in enumerate(result[entry][key]):
+                        if isinstance(item, dict):
+                            tmp_obj_2 = MISPObject(f"c25_{entry}_{key}_{index + 1}")
+                            tmp_obj_2.template_uuid = uuid.uuid4()
+                            tmp_obj_2.description = f"c25_{entry}_{key}"
+                            setattr(tmp_obj_2, 'meta-category', 'network')
+                            tmp_obj_2.add_reference(attribute['uuid'], 'related-to')
+                            for sub_key in item:
+                                if isinstance(item[sub_key], list):
+                                    for sub_item in item[sub_key]:
+                                        if isinstance(sub_item, dict):
+                                            tmp_obj_3 = MISPObject(f"c25_{entry}_{sub_key}_{index + 1}")
+                                            tmp_obj_3.template_uuid = uuid.uuid4()
+                                            tmp_obj_3.description = f"c25_{entry}_{sub_key}"
+                                            setattr(tmp_obj_3, 'meta-category', 'network')
+                                            tmp_obj_3.add_reference(attribute['uuid'], 'related-to')
+                                            for sub_sub_key in sub_item:
+                                                if isinstance(sub_item[sub_sub_key], list):
+                                                    for idx, sub_sub_item in enumerate(sub_item[sub_sub_key]):
+                                                        if sub_sub_item.get("name"):
+                                                            sub_sub_item = sub_sub_item.get("name")
+                                                        tmp_obj_3.add_attribute(f"{sub_sub_key}_{idx + 1}",
+                                                                                **{'type': 'text',
+                                                                                   'value': format_content(
+                                                                                       sub_sub_item)})
+                                                else:
+                                                    tmp_obj_3.add_attribute(sub_sub_key,
+                                                                            **{'type': 'text',
+                                                                               'value': format_content(
+                                                                                   sub_item[sub_sub_key])})
+                                            misp_objects.append(tmp_obj_3)
+                                        else:
+                                            tmp_obj_2.add_attribute(sub_key, **{'type': 'text',
+                                                                                'value': format_content(sub_item)})
+
+                                elif item[sub_key]:
+                                    tmp_obj_2.add_attribute(sub_key,
+                                                            **{'type': 'text', 'value': format_content(item[sub_key])})
+                            misp_objects.append(tmp_obj_2)
+                        elif item is not None:
+                            tmp_obj.add_attribute(f"{entry}_{key}", **{'type': 'text', 'value': format_content(item)})
+                elif result[entry][key] is not None:
+                    tmp_obj.add_attribute(key, **{'type': 'text', 'value': result[entry][key]})
+
+            if tmp_obj.attributes:
+                misp_objects.append(tmp_obj)
+
+        elif isinstance(result[entry], list):
+            for index, key in enumerate(result[entry]):
+                if isinstance(key, dict):
+                    tmp_obj = MISPObject(f"c25_{entry}_{index + 1}")
+                    tmp_obj.template_uuid = uuid.uuid4()
+                    tmp_obj.description = f"c25_{entry}_{index + 1}"
+                    setattr(tmp_obj, 'meta-category', 'network')
+                    tmp_obj.add_reference(attribute['uuid'], 'related-to')
+                    for item in key:
+                        if key[item]:
+                            tmp_obj.add_attribute(item, **{'type': 'text', 'value': format_content(key[item])})
+                    tmp_obj.add_reference(attribute['uuid'], 'related-to')
+                    misp_objects.append(tmp_obj)
+                elif key is not None:
+                    misp_object_g.add_attribute(f"{entry}_{index + 1}",
+                                                **{'type': 'text', 'value': format_content(key)})
+        else:
+            if result[entry]:
+                misp_object_g.add_attribute(entry, **{'type': 'text', 'value': result[entry]})
+
+    misp_object_g.add_reference(attribute['uuid'], 'related-to')
+    misp_event.add_object(misp_object_g)
+    for misp_object in misp_objects:
+        misp_event.add_object(misp_object)
+
+    event = json.loads(misp_event.to_json())
+    results = {key: event[key] for key in ('Attribute', 'Object')}
+    return {'results': results}
+
+
+def introspection():
+    return misp_attributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+class Cluster25CTI:
+    def __init__(self, customer_id=None, customer_key=None, base_url=None):
+        self.client_id = customer_id
+        self.client_secret = customer_key
+        self.base_url = base_url
+        self.current_token = self._get_cluster25_token()
+        self.headers = {"Authorization": f"Bearer {self.current_token}"}
+
+    def _get_cluster25_token(self):
+        payload = {"client_id": self.client_id, "client_secret": self.client_secret}
+        r = requests.post(url=f"{self.base_url}/token", json=payload, headers={"Content-Type": "application/json"})
+        if r.status_code != 200:
+            return {'error': f"Unable to retrieve the token from C25 platform, status {r.status_code}"}
+        return r.json()["data"]["token"]
+
+    def investigate(self, indicator) -> dict:
+        params = {'indicator': indicator.get('value')}
+        r = requests.get(url=f"{self.base_url}/investigate", params=params, headers=self.headers)
+        if r.status_code != 200:
+            return {'error': f"Unable to retrieve investigate result for indicator '{indicator.get('value')}' "
+                             f"from C25 platform, status {r.status_code}"}
+        return r.json()["data"]
+

misp_modules/modules/expansion/countrycode.py

@@ -0,0 +1,69 @@
+import json
+import requests
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain']}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'Hannah Ward',
+    'description': 'Module to expand country codes.',
+    'module-type': ['hover'],
+    'name': 'Country Code',
+    'logo': '',
+    'requirements': [],
+    'features': 'The module takes a domain or a hostname as input, and returns the country it belongs to.\n\nFor non country domains, a list of the most common possible extensions is used.',
+    'references': [],
+    'input': 'Hostname or domain attribute.',
+    'output': 'Text with the country code the input belongs to.',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = []
+
+common_tlds = {"com": "Commercial (Worldwide)",
+               "org": "Organisation (Worldwide)",
+               "net": "Network (Worldwide)",
+               "int": "International (Worldwide)",
+               "edu": "Education (Usually USA)",
+               "gov": "Government (USA)"
+               }
+
+
+def parse_country_code(extension):
+    # Retrieve a json full of country info
+    try:
+        codes = requests.get("http://www.geognos.com/api/en/countries/info/all.json").json()
+    except Exception:
+        return "http://www.geognos.com/api/en/countries/info/all.json not reachable"
+    if not codes.get('StatusMsg') or not codes["StatusMsg"] == "OK":
+        return 'Not able to get the countrycode references from http://www.geognos.com/api/en/countries/info/all.json'
+    for country in codes['Results'].values():
+        if country['CountryCodes']['tld'] == extension:
+            return country['Name']
+    return "Unknown"
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    domain = request["domain"] if "domain" in request else request["hostname"]
+
+    # Get the extension
+    ext = domain.split(".")[-1]
+
+    # Check if it's a common, non country one
+    val = common_tlds[ext] if ext in common_tlds.keys() else parse_country_code(ext)
+    r = {'results': [{'types': ['text'], 'values':[val]}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo