misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/iprep.py

@@ -0,0 +1,98 @@
+# -*- coding: utf-8 -*-
+
+import json
+import requests
+
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst'], 'output': ['text']}
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Keith Faber',
+    'description': 'Module to query IPRep data for IP addresses.',
+    'module-type': ['expansion'],
+    'name': 'IPRep Lookup',
+    'logo': '',
+    'requirements': ['An access to the packetmail API (apikey)'],
+    'features': 'This module takes an IP address attribute as input and queries the database from packetmail.net to get some information about the reputation of the IP.',
+    'references': ['https://github.com/mahesh557/packetmail'],
+    'input': 'An IP address MISP attribute.',
+    'output': 'Text describing additional information about the input after a query on the IPRep API.',
+}
+
+moduleconfig = ['apikey']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('ip-dst'):
+        toquery = request['ip-dst']
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+
+    if not request.get('config') and not request['config'].get('apikey'):
+        misperrors['error'] = 'IPRep api key is missing'
+        return misperrors
+
+    err, rep = parse_iprep(toquery, request['config'].get('apikey'))
+    if len(err) > 0:
+        misperrors['error'] = ','.join(err)
+        return misperrors
+    return {'results': rep}
+
+
+def parse_iprep(ip, api):
+    meta_fields = ['origin', 'Query_Time', 'created_on', 'IP_Lookup_History', 'IPs_in_collection', '_id', 'disclaimer',
+                   'MaxMind_Free_GeoIP', 'Unique_Lookups', 'query_result']
+    rep = []
+    err = []
+    full_text = ''
+    url = 'https://www.packetmail.net/iprep.php/%s' % ip
+    try:
+        data = requests.get(url, params={'apikey': api}).json()
+    except Exception:
+        return ['Error pulling data'], rep
+    # print '%s' % data
+    for name, val in data.items():
+        if name not in meta_fields:
+            try:
+                context = val['context']
+                if type(context) is list:
+                    if context[0].get('alert'):
+                        context = ','.join([hit['alert']['signature'] for hit in context])
+                    elif context[0].get('signature'):
+                        context = ','.join([hit['signature'] for hit in context])
+                    elif context[0].get('target_port') and context[0].get('protocol'):
+                        context = ','.join(
+                            ['Port Attacked: %s %s' % (hit['target_port'], hit['protocol']) for hit in context])
+                    elif context[0].get('phishing_kit') and context[0].get('url'):
+                        context = ','.join(['%s (%s)' % (hit['phishing_kit'], hit['url']) for hit in context])
+                    else:
+                        context = ';'.join(['%s: %s' % (k, v) for k, v in context[0].items()])
+
+                if val.get('special_note'):
+                    context += '; ' + val['special_note']
+
+                misp_val = context
+                full_text += '\n%s' % context
+                misp_comment = 'IPRep Source %s: %s' % (name, val['last_seen'])
+                rep.append({'types': mispattributes['output'], 'categories': ['External analysis'], 'values': misp_val, 'comment': misp_comment})
+            except Exception:
+                err.append('Error parsing source: %s' % name)
+
+    rep.append({'types': ['freetext'], 'values': full_text, 'comment': 'Free text import of IPRep'})
+    return err, rep
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/jinja_template_rendering.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python\
+
+import json
+from jinja2.sandbox import SandboxedEnvironment
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['text'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Sami Mokaddem',
+    'description': 'Render the template with the data passed',
+    'module-type': ['expansion'],
+    'name': 'Ninja Template Rendering',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+
+default_template = '- Default template -'
+
+def renderTemplate(data, template=default_template):
+    env = SandboxedEnvironment()
+    return env.from_string(template).render(data)
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('text'):
+        data = request['text']
+    else:
+        return False
+    data = json.loads(data)
+    template = data.get('template', default_template)
+    templateData = data.get('data', {})
+    try:
+        rendered = renderTemplate(templateData, template)
+    except TypeError:
+        rendered = ''
+
+    r = {'results': [{'types': mispattributes['output'],
+                      'values':[rendered]}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo

misp_modules/modules/expansion/joesandbox_query.py

@@ -0,0 +1,91 @@
+# -*- coding: utf-8 -*-
+import jbxapi
+import json
+from . import check_input_attribute, checking_error, standard_error_message
+from joe_parser import JoeParser
+
+misperrors = {'error': 'Error'}
+
+inputSource = ['link']
+
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Christian Studer',
+    'description': 'Query Joe Sandbox API with a submission url to get the json report and extract its data that is parsed and converted into MISP attributes and objects.',
+    'module-type': ['expansion'],
+    'name': 'Joe Sandbox Import',
+    'logo': 'joesandbox.png',
+    'requirements': ['jbxapi: Joe Sandbox API python3 library'],
+    'features': "Module using the new format of modules able to return attributes and objects.\n\nThe module returns the same results as the import module [joe_import](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/import_mod/joe_import.py) taking directly the json report as input.\n\nEven if the introspection will allow all kinds of links to call this module, obviously only the ones presenting a sample or url submission in the Joe Sandbox API will return results.\n\nTo make it work you will need to fill the 'apikey' configuration with your Joe Sandbox API key and provide a valid link as input.",
+    'references': ['https://www.joesecurity.org', 'https://www.joesandbox.com/'],
+    'input': 'Link of a Joe Sandbox sample or url submission.',
+    'output': 'MISP attributes & objects parsed from the analysis report.',
+}
+moduleconfig = ['apiurl', 'apikey', 'import_executable', 'import_mitre_attack']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    apiurl = request['config'].get('apiurl') or 'https://jbxcloud.joesecurity.org/api'
+    apikey = request['config'].get('apikey')
+    parser_config = {
+        "import_executable": request["config"].get('import_executable', "false") == "true",
+        "mitre_attack": request["config"].get('import_mitre_attack', "false") == "true",
+    }
+
+    if not apikey:
+        return {'error': 'No API key provided'}
+
+    if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+        return {'error': f'{standard_error_message}, {checking_error} that is the link to the Joe Sandbox report.'}
+    if request['attribute']['type'] != 'link':
+        return {'error': 'Unsupported attribute type.'}
+    url = request['attribute']['value']
+    if "/submissions/" not in url:
+        return {'error': "The URL does not point to a Joe Sandbox analysis."}
+
+    submission_id = url.split('/')[-1]  # The URL has the format https://example.net/submissions/12345
+    joe = jbxapi.JoeSandbox(apiurl=apiurl, apikey=apikey, user_agent='MISP joesandbox_query')
+
+    try:
+        joe_info = joe.submission_info(submission_id)
+    except jbxapi.ApiError as e:
+        return {'error': str(e)}
+
+    if joe_info["status"] != "finished":
+        return {'error': "The analysis has not finished yet."}
+
+    if joe_info['most_relevant_analysis'] is None:
+        return {'error': "No analysis belongs to this submission."}
+
+    analysis_webid = joe_info['most_relevant_analysis']['webid']
+
+    joe_parser = JoeParser(parser_config)
+    joe_data = json.loads(joe.analysis_download(analysis_webid, 'jsonfixed')[1])
+    joe_parser.parse_data(joe_data['analysis'])
+    joe_parser.finalize_results()
+
+    return {'results': joe_parser.results}
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['input'] = inputSource
+    except NameError:
+        pass
+    modulesetup['format'] = 'misp_standard'
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/joesandbox_submit.py

@@ -0,0 +1,147 @@
+import jbxapi
+import base64
+import io
+import json
+import logging
+import sys
+import zipfile
+import re
+
+from urllib.parse import urljoin
+
+
+log = logging.getLogger(__name__)
+log.setLevel(logging.DEBUG)
+sh = logging.StreamHandler(sys.stdout)
+sh.setLevel(logging.DEBUG)
+fmt = logging.Formatter(
+    "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
+)
+sh.setFormatter(fmt)
+log.addHandler(sh)
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Joe Security LLC',
+    'description': 'A module to submit files or URLs to Joe Sandbox for an advanced analysis, and return the link of the submission.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Joe Sandbox Submit',
+    'logo': 'joesandbox.png',
+    'requirements': ['jbxapi: Joe Sandbox API python3 library'],
+    'features': 'The module requires a Joe Sandbox API key to submit files or URL, and returns the link of the submitted analysis.\n\nIt is then possible, when the analysis is completed, to query the Joe Sandbox API to get the data related to the analysis, using the [joesandbox_query module](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/joesandbox_query.py) directly on this submission link.',
+    'references': ['https://www.joesecurity.org', 'https://www.joesandbox.com/'],
+    'input': 'Sample, url (or domain) to submit to Joe Sandbox for an advanced analysis.',
+    'output': 'Link of the report generated in Joe Sandbox.',
+}
+moduleconfig = [
+    "apiurl",
+    "apikey",
+    "accept-tac",
+    "report-cache",
+    "systems",
+]
+
+mispattributes = {
+    "input": ["attachment", "malware-sample", "url", "domain"],
+    "output": ["link"],
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    apiurl = request["config"].get("apiurl") or "https://jbxcloud.joesecurity.org/api"
+    apikey = request["config"].get("apikey")
+
+    # systems
+    systems = request["config"].get("systems") or ""
+    systems = [s.strip() for s in re.split(r"[\s,;]", systems) if s.strip()]
+
+    try:
+        accept_tac = _parse_bool(request["config"].get("accept-tac"), "accept-tac")
+        report_cache = _parse_bool(request["config"].get("report-cache"), "report-cache")
+    except _ParseError as e:
+        return {"error": str(e)}
+
+    params = {
+        "report-cache": report_cache,
+        "systems": systems,
+    }
+
+    if not apikey:
+        return {"error": "No API key provided"}
+
+    joe = jbxapi.JoeSandbox(apiurl=apiurl, apikey=apikey, user_agent="MISP joesandbox_submit", accept_tac=accept_tac)
+
+    try:
+        is_url_submission = "url" in request or "domain" in request
+
+        if is_url_submission:
+            url = request.get("url") or request.get("domain")
+
+            log.info("Submitting URL: %s", url)
+            result = joe.submit_url(url, params=params)
+        else:
+            if "malware-sample" in request:
+                filename = request.get("malware-sample").split("|", 1)[0]
+                data = _decode_malware(request["data"], True)
+            elif "attachment" in request:
+                filename = request["attachment"]
+                data = _decode_malware(request["data"], False)
+
+            data_fp = io.BytesIO(data)
+            log.info("Submitting sample: %s", filename)
+            result = joe.submit_sample((filename, data_fp), params=params)
+
+        assert "submission_id" in result
+    except jbxapi.JoeException as e:
+        return {"error": str(e)}
+
+    link_to_analysis = urljoin(apiurl, "../submissions/{}".format(result["submission_id"]))
+
+    return {
+        "results": [{
+            "types": "link",
+            "categories": "External analysis",
+            "values": link_to_analysis,
+        }]
+    }
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo
+
+
+def _decode_malware(data, is_encrypted):
+    data = base64.b64decode(data)
+
+    if is_encrypted:
+        with zipfile.ZipFile(io.BytesIO(data)) as zipf:
+            data = zipf.read(zipf.namelist()[0], pwd=b"infected")
+
+    return data
+
+
+class _ParseError(Exception):
+    pass
+
+
+def _parse_bool(value, name="bool"):
+    if value is None or value == "":
+        return None
+
+    if value == "true":
+        return True
+
+    if value == "false":
+        return False
+
+    raise _ParseError("Cannot parse {}. Must be 'true' or 'false'".format(name))

misp_modules/modules/expansion/lastline_query.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""
+Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.
+
+Module (type "expansion") to query a Lastline report from an analysis link.
+"""
+import json
+import lastline_api
+from . import check_input_attribute, checking_error, standard_error_message
+
+
+misperrors = {
+    "error": "Error",
+}
+
+mispattributes = {
+    "input": [
+        "link",
+    ],
+    "output": ["text"],
+    "format": "misp_standard",
+}
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Stefano Ortolani',
+    'description': 'Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.\n\nQuery Lastline with an analysis link and parse the report into MISP attributes and objects.',
+    'module-type': ['expansion'],
+    'name': 'Lastline Lookup',
+    'logo': 'lastline.png',
+    'requirements': [],
+    'features': 'The module requires a Lastline Portal `username` and `password`.\nThe module uses the new format and it is able to return MISP attributes and objects.\nThe module returns the same results as the [lastline_import](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/import_mod/lastline_import.py) import module.',
+    'references': ['https://www.lastline.com'],
+    'input': 'Link to a Lastline analysis.',
+    'output': 'MISP attributes and objects parsed from the analysis report.',
+}
+
+moduleconfig = [
+    "username",
+    "password",
+    "verify_ssl",
+]
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    # Parse the init parameters
+    try:
+        config = request["config"]
+        auth_data = lastline_api.LastlineAbstractClient.get_login_params_from_dict(config)
+        if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+            return {'error': f'{standard_error_message}, {checking_error} that is the link to a Lastline analysis.'}
+        analysis_link = request['attribute']['value']
+        # The API url changes based on the analysis link host name
+        api_url = lastline_api.get_portal_url_from_task_link(analysis_link)
+    except Exception as e:
+        misperrors["error"] = "Error parsing configuration: {}".format(e)
+        return misperrors
+
+    # Parse the call parameters
+    try:
+        task_uuid = lastline_api.get_uuid_from_task_link(analysis_link)
+    except (KeyError, ValueError) as e:
+        misperrors["error"] = "Error processing input parameters: {}".format(e)
+        return misperrors
+
+    # Make the API calls
+    try:
+        api_client = lastline_api.PortalClient(api_url, auth_data, verify_ssl=config.get('verify_ssl', True).lower() in ("true"))
+        response = api_client.get_progress(task_uuid)
+        if response.get("completed") != 1:
+            raise ValueError("Analysis is not finished yet.")
+
+        response = api_client.get_result(task_uuid)
+        if not response:
+            raise ValueError("Analysis report is empty.")
+
+    except Exception as e:
+        misperrors["error"] = "Error issuing the API call: {}".format(e)
+        return misperrors
+
+    # Parse and return
+    result_parser = lastline_api.LastlineResultBaseParser()
+    result_parser.parse(analysis_link, response)
+
+    event = result_parser.misp_event
+    event_dictionary = json.loads(event.to_json())
+
+    return {
+        "results": {
+            key: event_dictionary[key]
+            for key in ('Attribute', 'Object', 'Tag')
+            if (key in event and event[key])
+        }
+    }
+
+
+if __name__ == "__main__":
+    """Test querying information from a Lastline analysis link."""
+    import argparse
+    import configparser
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-c", "--config-file", dest="config_file")
+    parser.add_argument("-s", "--section-name", dest="section_name")
+    args = parser.parse_args()
+    c = configparser.ConfigParser()
+    c.read(args.config_file)
+    a = lastline_api.LastlineAbstractClient.get_login_params_from_conf(c, args.section_name)
+
+    j = json.dumps(
+        {
+            "config": a,
+            "attribute": {
+                "value": (
+                    "https://user.lastline.com/portal#/analyst/task/"
+                    "1fcbcb8f7fb400100772d6a7b62f501b/overview"
+                )
+            }
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))
+
+    j = json.dumps(
+        {
+            "config": a,
+            "attribute": {
+                "value": (
+                    "https://user.lastline.com/portal#/analyst/task/"
+                    "f3c0ae115d51001017ff8da768fa6049/overview"
+                )
+            }
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))