diff --git a/windows-exploit-suggester.py b/windows-exploit-suggester.py index 108c1b6..13d4db1 100755 --- a/windows-exploit-suggester.py +++ b/windows-exploit-suggester.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # Windows Exploit Suggester @@ -327,10 +327,10 @@ import argparse import subprocess import csv -import StringIO +from io import StringIO import os import datetime -import urllib2 +import urllib.request import io from random import randint from time import sleep @@ -387,7 +387,7 @@ def main(): try: dbfile = open(ARGS.database, 'r') - except IOError, e: + except IOError as e: ALERT("could not open the file %s" % filename, ALERT.BAD) exit(1) @@ -425,13 +425,13 @@ def main(): data = '' # loop through xls - for rownum in xrange(sh.nrows): + for rownum in range(sh.nrows): values = sh.row_values(rownum) # loop through row values, and process input for i in range(len(values)): - values[i] = unicode(values[i]).encode('utf8') + values[i] = str(values[i]) values[i] = values[i].replace('\n',' ') values[i] = values[i].replace(',','') values[i] = values[i].replace('.0','') @@ -662,7 +662,7 @@ def run(database): # get the potential bulletins try: - for row in csv.reader(StringIO.StringIO(database)): + for row in csv.reader(StringIO(database)): bulletinid=row[1] affected=row[6] @@ -676,7 +676,7 @@ def run(database): if ARGS.verbose: ALERT("%s has been added to potential list '%s'" % (bulletinid, affected)) - except csv.Error, e: + except csv.Error as e: ALERT('could not parse database file, make sure it is in the proper format', ALERT.BAD) exit(1) @@ -705,7 +705,7 @@ def run(database): ALERT(" %s hotfix triggered a removal of %skb and the %s bulletin; componentkb is %s" % (hotfix,kb,bulletinid,componentkb)) # get the linked ms, this will automatically calculate the superseded by as well - linkedms = getlinkedms([bulletinid], csv.reader(StringIO.StringIO(database))) + linkedms = getlinkedms([bulletinid], csv.reader(StringIO(database))) linkedmsstr = '' # calculate the pretty string, only care when verbose @@ -735,7 +735,7 @@ def run(database): if bulletinid in bulletinids and not "elevation of privilege" in impact.lower(): - remove = getlinkedms([bulletinid], csv.reader(StringIO.StringIO(database))) + remove = getlinkedms([bulletinid], csv.reader(StringIO(database))) if ARGS.verbose: ALERT(" removing %s (total of %s MS ids), because of its impact %s" % (bulletinid, len(remove), impact)) @@ -752,7 +752,7 @@ def run(database): if bulletinid in bulletinids and not "remote code execution" in impact.lower(): - remove = getlinkedms([bulletinid], csv.reader(StringIO.StringIO(database))) + remove = getlinkedms([bulletinid], csv.reader(StringIO(database))) if ARGS.verbose: ALERT(" removing %s (total of %s MS ids), because of its impact %s" % (bulletinid, len(remove), impact)) @@ -830,7 +830,7 @@ def run(database): if ARGS.sub: # linked ms, the children of this msid - linked = set(getlinkedms([msid], csv.reader(StringIO.StringIO(database)))) + linked = set(getlinkedms([msid], csv.reader(StringIO(database)))) linked = linked.intersection(msids) # loop through the linked msids, and only display those that qualify and @@ -844,7 +844,7 @@ def run(database): ALERT("|_%s: %s (%s) - %s" % (lmsid, vulns[lmsid][0], vulns[lmsid][1], vulns[lmsid][2]), lalert) # only allow duplicate events to be displayed when command-line args passed - if not ARGS.duplicates: alerted.add(lmsid) + if not ARGS.duplicates: alerted.add(lmsid) # end run() @@ -871,7 +871,7 @@ def trace(database): ALERT("searching for bulletin id %s" % bulletinid) # get linked msids - lmsids = getlinkedms([bulletinid], csv.reader(StringIO.StringIO(database))) + lmsids = getlinkedms([bulletinid], csv.reader(StringIO(database))) msids = [] @@ -895,7 +895,7 @@ def trace(database): exit(1) # get linked msids, loop through the row - for row in csv.reader(StringIO.StringIO(database)): + for row in csv.reader(StringIO(database)): msid = row[1] affected = row[6] @@ -920,7 +920,7 @@ def patches(database): ALERT("searching all kb's for bulletin id %s" % bulletinid) # get linked msids, loop through the row - for row in csv.reader(StringIO.StringIO(database)): + for row in csv.reader(StringIO(database)): bulletinkb=row[2] componentkb=row[7] @@ -1530,7 +1530,7 @@ def update(): csvFile = '%s.%s' % (filenames, 'csv') # url request opener with user-agent - opener = urllib2.build_opener() + opener = urllib.request.build_opener() opener.addheaders = [('User-agent', 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36')] # grab the new data from ms and scrape the site @@ -1564,7 +1564,7 @@ def update(): try: #sleep(randint(1,3)) response = opener.open(bulletinUrl) - except urllib2.URLError, e: + except urllib.request.URLError as e: ALERT("error getting ms sb url %s" % bulletinUrl, ALERT.BAD) exit(1) @@ -1581,7 +1581,7 @@ class ALERT(object): def __init__(self, message, level=0, ansi=True): # default to ansi alerting, if it's detected as windows platform then disable - if platform.system() is "Windows": ansi = False + if platform.system() == "Windows": ansi = False good = '[+]' bad = '[-]' @@ -1591,20 +1591,20 @@ def __init__(self, message, level=0, ansi=True): exploit = '[E]' if ansi == True: - if level == ALERT.GOOD: print("%s%s%s" % ('\033[1;32m',good,"\033[0;0m")), - elif level == ALERT.BAD: print("%s%s%s" % ('\033[1;31m',bad,"\033[0;0m")), - elif level == ALERT.MSF: print("%s%s%s" % ('\033[1;32m',msf,"\033[0;0m")), - elif level == ALERT.EXP: print("%s%s%s" % ('\033[1;32m',exploit,"\033[0;0m")), - else: print("%s%s%s" % ('\033[1;34m',normal,"\033[0;0m")), + if level == ALERT.GOOD: print("%s%s%s" % ('\033[1;32m',good,"\033[0;0m"), end=''), + elif level == ALERT.BAD: print("%s%s%s" % ('\033[1;31m',bad,"\033[0;0m"), end=''), + elif level == ALERT.MSF: print("%s%s%s" % ('\033[1;32m',msf,"\033[0;0m"), end=''), + elif level == ALERT.EXP: print("%s%s%s" % ('\033[1;32m',exploit,"\033[0;0m"), end=''), + else: print("%s%s%s" % ('\033[1;34m',normal,"\033[0;0m"), end=''), else: - if level == ALERT.GOOD: print('%s' % good), - elif level == ALERT.BAD: print('%s' % bad), - elif level == ALERT.MSF: print('%s' % msf), - elif level == ALERT.EXP: print('%s' % exploit), - else: print('%s' % normal), + if level == ALERT.GOOD: print('%s' % good, end=''), + elif level == ALERT.BAD: print('%s' % bad, end=''), + elif level == ALERT.MSF: print('%s' % msf, end=''), + elif level == ALERT.EXP: print('%s' % exploit, end=''), + else: print('%s' % normal, end=''), - print message + print (message) @staticmethod @property