misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/lastline_submit.py

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""
+Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.
+
+Module (type "expansion") to submit files and URLs to Lastline for analysis.
+"""
+import base64
+import io
+import json
+import zipfile
+
+import lastline_api
+
+
+misperrors = {
+    "error": "Error",
+}
+
+mispattributes = {
+    "input": [
+        "attachment",
+        "malware-sample",
+        "url",
+    ],
+    "output": [
+        "link",
+    ],
+}
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Stefano Ortolani',
+    'description': 'Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.\n\nModule to submit a file or URL to Lastline.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Lastline Submit',
+    'logo': 'lastline.png',
+    'requirements': [],
+    'features': 'The module requires a Lastline Analysis `api_token` and `key`.\nWhen the analysis is completed, it is possible to import the generated report by feeding the analysis link to the [lastline_query](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/lastline_query.py) module.',
+    'references': ['https://www.lastline.com'],
+    'input': 'File or URL to submit to Lastline.',
+    'output': 'Link to the report generated by Lastline.',
+}
+
+moduleconfig = [
+    "url",
+    "api_token",
+    "key",
+]
+
+
+DEFAULT_ZIP_PASSWORD = b"infected"
+
+
+def __unzip(zipped_data, password=None):
+    data_file_object = io.BytesIO(zipped_data)
+    with zipfile.ZipFile(data_file_object) as zip_file:
+        sample_hashname = zip_file.namelist()[0]
+        data_zipped = zip_file.read(sample_hashname, password)
+    return data_zipped
+
+
+def __str_to_bool(x):
+    return x in ("True", "true", True)
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    # Parse the init parameters
+    try:
+        config = request.get("config", {})
+        auth_data = lastline_api.LastlineAbstractClient.get_login_params_from_dict(config)
+        api_url = config.get("url", lastline_api.DEFAULT_LL_ANALYSIS_API_URL)
+    except Exception as e:
+        misperrors["error"] = "Error parsing configuration: {}".format(e)
+        return misperrors
+
+    # Parse the call parameters
+    try:
+        call_args = {}
+        if "url" in request:
+            # URLs are text strings
+            api_method = lastline_api.AnalysisClient.submit_url
+            call_args["url"] = request.get("url")
+        else:
+            data = request.get("data")
+            # Malware samples are zip-encrypted and then base64 encoded
+            if "malware-sample" in request:
+                api_method = lastline_api.AnalysisClient.submit_file
+                call_args["file_data"] = __unzip(base64.b64decode(data), DEFAULT_ZIP_PASSWORD)
+                call_args["file_name"] = request.get("malware-sample").split("|", 1)[0]
+                call_args["password"] = DEFAULT_ZIP_PASSWORD
+            # Attachments are just base64 encoded
+            elif "attachment" in request:
+                api_method = lastline_api.AnalysisClient.submit_file
+                call_args["file_data"] = base64.b64decode(data)
+                call_args["file_name"] = request.get("attachment")
+
+            else:
+                raise ValueError("Input parameters do not specify either an URL or a file")
+
+    except Exception as e:
+        misperrors["error"] = "Error processing input parameters: {}".format(e)
+        return misperrors
+
+    # Make the API call
+    try:
+        api_client = lastline_api.AnalysisClient(api_url, auth_data)
+        response = api_method(api_client, **call_args)
+        task_uuid = response.get("task_uuid")
+        if not task_uuid:
+            raise ValueError("Unable to process returned data")
+        if response.get("score") is not None:
+            tags = ["workflow:state='complete'"]
+        else:
+            tags = ["workflow:state='incomplete'"]
+
+    except Exception as e:
+        misperrors["error"] = "Error issuing the API call: {}".format(e)
+        return misperrors
+
+    # Assemble and return
+    analysis_link = lastline_api.get_task_link(task_uuid, analysis_url=api_url)
+
+    return {
+        "results": [
+            {
+                "types": "link",
+                "categories": ["External analysis"],
+                "values": analysis_link,
+                "tags": tags,
+            },
+        ]
+    }
+
+
+if __name__ == "__main__":
+    """Test submitting a test subject to the Lastline backend."""
+    import argparse
+    import configparser
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-c", "--config-file", dest="config_file")
+    parser.add_argument("-s", "--section-name", dest="section_name")
+    args = parser.parse_args()
+    c = configparser.ConfigParser()
+    c.read(args.config_file)
+    a = lastline_api.LastlineAbstractClient.get_login_params_from_conf(c, args.section_name)
+
+    j = json.dumps(
+        {
+            "config": a,
+            "url": "https://www.google.exe.com",
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))
+
+    with open("./tests/test_files/test.docx", "rb") as f:
+        data = f.read()
+
+    j = json.dumps(
+        {
+            "config": a,
+            "data": base64.b64encode(data).decode("utf-8"),
+            "attachment": "test.docx",
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))

misp_modules/modules/expansion/macaddress_io.py

@@ -0,0 +1,130 @@
+import json
+
+from maclookup import ApiClient, exceptions
+
+misperrors = {
+    'error': 'Error'
+}
+
+mispattributes = {
+    'input': ['mac-address'],
+}
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'CodeLine OY - macaddress.io',
+    'description': 'MISP hover module for macaddress.io',
+    'module-type': ['hover'],
+    'name': 'Macaddress.io Lookup',
+    'logo': 'macaddress_io.png',
+    'requirements': ['maclookup: macaddress.io python library', 'An access to the macaddress.io API (apikey)'],
+    'features': 'This module takes a MAC address attribute as input and queries macaddress.io for additional information.\n\nThis information contains data about:\n- MAC address details\n- Vendor details\n- Block details',
+    'references': ['https://macaddress.io/', 'https://github.com/CodeLineFi/maclookup-python'],
+    'input': 'MAC address MISP attribute.',
+    'output': 'Text containing information on the MAC address fetched from a query on macaddress.io.',
+}
+
+moduleconfig = ['api_key']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    if request.get('mac-address'):
+        mac_address = request['mac-address']
+    else:
+        return False
+
+    if request.get('config') and request['config'].get('api_key'):
+        api_key = request['config'].get('api_key')
+    else:
+        misperrors['error'] = 'Authorization required'
+        return misperrors
+
+    api_client = ApiClient(api_key)
+
+    try:
+        response = api_client.get(mac_address)
+
+    except exceptions.EmptyResponseException:
+        misperrors['error'] = 'Empty response'
+        return misperrors
+
+    except exceptions.UnparsableResponseException:
+        misperrors['error'] = 'Unparsable response'
+        return misperrors
+
+    except exceptions.ServerErrorException:
+        misperrors['error'] = 'Internal server error'
+        return misperrors
+
+    except exceptions.UnknownOutputFormatException:
+        misperrors['error'] = 'Unknown output'
+        return misperrors
+
+    except exceptions.AuthorizationRequiredException:
+        misperrors['error'] = 'Authorization required'
+        return misperrors
+
+    except exceptions.AccessDeniedException:
+        misperrors['error'] = 'Access denied'
+        return misperrors
+
+    except exceptions.InvalidMacOrOuiException:
+        misperrors['error'] = 'Invalid MAC or OUI'
+        return misperrors
+
+    except exceptions.NotEnoughCreditsException:
+        misperrors['error'] = 'Not enough credits'
+        return misperrors
+
+    except Exception:
+        misperrors['error'] = 'Unknown error'
+        return misperrors
+
+    date_created = \
+        response.block_details.date_created.strftime('%d %B %Y') if response.block_details.date_created else None
+
+    date_updated = \
+        response.block_details.date_updated.strftime('%d %B %Y') if response.block_details.date_updated else None
+
+    results = {
+        'results':
+        [{'types': ['text'], 'values':
+            {
+                # Mac address details
+                'Valid MAC address': "True" if response.mac_address_details.is_valid else "False",
+                'Transmission type': response.mac_address_details.transmission_type,
+                'Administration type': response.mac_address_details.administration_type,
+
+                # Vendor details
+                'OUI': response.vendor_details.oui,
+                'Vendor details are hidden': "True" if response.vendor_details.is_private else "False",
+                'Company name': response.vendor_details.company_name,
+                'Company\'s address': response.vendor_details.company_address,
+                'County code': response.vendor_details.country_code,
+
+                # Block details
+                'Block found': "True" if response.block_details.block_found else "False",
+                'The left border of the range': response.block_details.border_left,
+                'The right border of the range': response.block_details.border_right,
+                'The total number of MAC addresses in this range': response.block_details.block_size,
+                'Assignment block size': response.block_details.assignment_block_size,
+                'Date when the range was allocated': date_created,
+                'Date when the range was last updated': date_updated
+        }}]
+    }
+
+    return results
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/macvendors.py

@@ -0,0 +1,55 @@
+import requests
+import json
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['mac-address'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Aurélien Schwab',
+    'description': 'Module to access Macvendors API.',
+    'module-type': ['hover'],
+    'name': 'Macvendors Lookup',
+    'logo': 'macvendors.png',
+    'requirements': [],
+    'features': 'The module takes a MAC address as input and queries macvendors.com for some information about it. The API returns the name of the vendor related to the address.',
+    'references': ['https://macvendors.com/', 'https://macvendors.com/api'],
+    'input': 'A MAC address.',
+    'output': 'Additional information about the MAC address.',
+}
+moduleconfig = ['user-agent']
+
+macvendors_api_url = 'https://api.macvendors.com/'
+default_user_agent = 'MISP-Module'
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    for input_type in mispattributes['input']:
+        if input_type in request:
+            mac = request[input_type]
+            break
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+    user_agent = request['config']['user-agent'] if request.get('config') and request['config'].get('user-agent') else default_user_agent
+    r = requests.get(macvendors_api_url + mac, headers={'user-agent': user_agent})  # Real request
+    if r.status_code == 200:  # OK (record found)
+        response = r.text
+        if response:
+            return {'results': [{'types': mispattributes['output'], 'values': response}]}
+    elif r.status_code == 404:  # Not found (not an error)
+        return {'results': [{'types': mispattributes['output'], 'values': 'Not found'}]}
+    else:  # Real error
+        misperrors['error'] = 'MacVendors API not accessible (HTTP ' + str(r.status_code) + ')'
+        return misperrors['error']
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/malshare_upload.py

@@ -0,0 +1,107 @@
+import json
+import sys
+import base64
+import io
+import zipfile
+import requests
+import hashlib
+import re
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment', 'malware-sample'], 'output': ['link']}
+moduleinfo = {
+    'version': '1',
+    'author': 'Karen Yousefi',
+    'description': 'Module to push malware samples to MalShare',
+    'module-type': ['expansion'],
+    'name': 'MalShare Upload',
+    'requirements': ['requests library'],
+    'logo': '',
+}
+
+moduleconfig = ['malshare_apikey']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    try:
+        data = request.get("data")
+        if 'malware-sample' in request:
+            sample_filename = request.get("malware-sample").split("|", 1)[0]
+            data = base64.b64decode(data)
+            fl = io.BytesIO(data)
+            zf = zipfile.ZipFile(fl)
+            sample_hashname = zf.namelist()[0]
+            data = zf.read(sample_hashname, b"infected")
+            zf.close()
+        elif 'attachment' in request:
+            sample_filename = request.get("attachment")
+            data = base64.b64decode(data)
+        else:
+            misperrors['error'] = "No malware sample or attachment supplied"
+            return misperrors
+    except Exception:
+        misperrors['error'] = "Unable to process submitted sample data"
+        return misperrors
+
+    if request["config"].get("malshare_apikey") is None:
+        misperrors["error"] = "Missing MalShare API key"
+        return misperrors
+
+    malshare_apikey = request["config"].get("malshare_apikey")
+
+    try:
+        url = "https://malshare.com/api.php"
+        params = {'api_key': malshare_apikey, 'action': 'upload'}
+        files = {"upload": (sample_filename, data)}
+        response = requests.post(url, params=params, files=files)
+        response.raise_for_status()
+
+        response_text = response.text.strip()
+
+        # Calculate SHA256 of the file
+        sha256 = hashlib.sha256(data).hexdigest()
+
+        if response_text.startswith("Success"):
+            # If upload was successful or file already exists
+            malshare_link = (
+                f"https://malshare.com/sample.php?action=detail&hash={sha256}"
+            )
+        elif "sample already exists" in response_text:
+            # If file already exists, extract SHA256 from response
+            match = re.search(r'([a-fA-F0-9]{64})', response_text)
+            if match:
+                sha256 = match.group(1)
+            malshare_link = (
+                f"https://malshare.com/sample.php?action=detail&hash={sha256}"
+            )
+        else:
+            # If there's any other error
+            raise Exception(f"Upload failed: {response_text}")
+
+    except Exception as e:
+        misperrors['error'] = f"Unable to send sample to MalShare: {str(e)}"
+        return misperrors
+
+    r = {
+        'results': [
+            {
+                'types': 'link',
+                'values': malshare_link,
+                'comment': 'Link to MalShare analysis',
+            }
+        ]
+    }
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/malwarebazaar.py

@@ -0,0 +1,67 @@
+import json
+import requests
+from . import check_input_attribute, checking_error, standard_error_message
+from pymisp import MISPEvent, MISPObject
+
+mispattributes = {'input': ['md5', 'sha1', 'sha256'],
+                  'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'description': 'Query Malware Bazaar to get additional information about the input hash.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Malware Bazaar Lookup',
+    'logo': '',
+    'requirements': [],
+    'features': "The module takes a hash attribute as input and queries MALWAREbazaar's API to fetch additional data about it. The result, if the payload is known on the databases, is at least one file object describing the file the input hash is related to.\n\nThe module is using the new format of modules able to return object since the result is one or multiple MISP object(s).",
+    'references': ['https://bazaar.abuse.ch/'],
+    'input': 'A hash attribute (md5, sha1 or sha256).',
+    'output': 'File object(s) related to the input attribute found on MALWAREbazaar databases.',
+}
+moduleconfig = []
+
+
+def parse_response(response):
+    mapping = {'file_name': {'type': 'filename', 'object_relation': 'filename'},
+               'file_size': {'type': 'size-in-bytes', 'object_relation': 'size-in-bytes'},
+               'file_type_mime': {'type': 'mime-type', 'object_relation': 'mimetype'},
+               'md5_hash': {'type': 'md5', 'object_relation': 'md5'},
+               'sha1_hash': {'type': 'sha1', 'object_relation': 'sha1'},
+               'sha256_hash': {'type': 'sha256', 'object_relation': 'sha256'},
+               'ssdeep': {'type': 'ssdeep', 'object_relation': 'ssdeep'}}
+    misp_event = MISPEvent()
+    for data in response:
+        misp_object = MISPObject('file')
+        for feature, attribute in mapping.items():
+            if feature in data:
+                misp_attribute = {'value': data[feature]}
+                misp_attribute.update(attribute)
+                misp_object.add_attribute(**misp_attribute)
+        misp_event.add_object(**misp_object)
+    return {'results': {'Object': [json.loads(misp_object.to_json()) for misp_object in misp_event.objects]}}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+        return {'error': f'{standard_error_message}, {checking_error} that is the hash to submit to Malware Bazaar.'}
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    url = 'https://mb-api.abuse.ch/api/v1/'
+    response = requests.post(url, data={'query': 'get_info', 'hash': attribute['value']}).json()
+    query_status = response['query_status']
+    if query_status == 'ok':
+        return parse_response(response['data'])
+    return {'error': 'Hash not found on MALWAREbazzar' if query_status == 'hash_not_found' else f'Problem encountered during the query: {query_status}'}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo