Skip to content

Feature: Add Inventory Property with parsed CPE #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JustinGrote wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Feature: Add Inventory Property with parsed CPE #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6fcfc2e
Feature: Add PoshNmapHost Table Format
Mar 27, 2019
0c8f5ef
Feature: Make the user specified hostname the primary FQDN
Mar 27, 2019
b4e9708
Feature: Add Inventory Property with parsed CPE
Mar 27, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions PoshNmap/Formats/PoshNmapHost.Format.ps1xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
<?xml version="1.0" encoding="utf-8" ?>
<Configuration>
<ViewDefinitions>
<View>
<Name>PoshNmapHost</Name>
<ViewSelectedBy>
<TypeName>PoshNmapHost</TypeName>
</ViewSelectedBy>
<TableControl>
<AutoSize />
<TableHeaders>
<TableColumnHeader>
<Width>15</Width>
</TableColumnHeader>
<TableColumnHeader>
</TableColumnHeader>
<TableColumnHeader>
<Width>6</Width>
</TableColumnHeader>
<TableColumnHeader>
<Width>5</Width>
</TableColumnHeader>
<TableColumnHeader>
<Label>Ports</Label>
</TableColumnHeader>
</TableHeaders>
<TableRowEntries>
<TableRowEntry>
<TableColumnItems>
<TableColumnItem>
<PropertyName>IPv4</PropertyName>
</TableColumnItem>
<TableColumnItem>
<PropertyName>FQDN</PropertyName>
</TableColumnItem>
<TableColumnItem>
<PropertyName>Status</PropertyName>
</TableColumnItem>
<TableColumnItem>
<PropertyName>OpenPorts</PropertyName>
</TableColumnItem>
<TableColumnItem>
<ScriptBlock>
$ports = @()
foreach ($portItem in $PSItem.ports) {
if ($portItem.Services.Name -ne 'unknown') {$ports += $portItem.Services.Name}
else {$ports += $portItem.protocol,$portItem.port -join '/'}
}
$ports -join ', '
<!--
foreach ($portItem in $PSItem.ports) {
if ($PortItem.services.name -not 'unknown') {$PortItem.services.name}
else {$PortItem.protocol,$PortItem.port -join ':'}
}-->
</ScriptBlock>
</TableColumnItem>
</TableColumnItems>
</TableRowEntry>
</TableRowEntries>
</TableControl>
</View>
</ViewDefinitions>
</Configuration>
2 changes: 1 addition & 1 deletion PoshNmap/PoshNmap.psd1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ PowerShellVersion = '5.1'
# TypesToProcess = @()

# Format files (.ps1xml) to be loaded when importing this module
# FormatsToProcess = @()
FormatsToProcess = @('.\Formats\*.Format.ps1xml')

# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
# NestedModules = @()
Expand Down
40 changes: 40 additions & 0 deletions PoshNmap/Private/ConvertFromCPE.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
function ConvertFromCPE {
<#
.SYNOPSIS
Converts a common platform enumeration string into a powershell object
.LINK
https://nmap.org/book/output-formats-cpe.html
#>
[CmdletBinding()]
param (
[Parameter(Mandatory,ValueFromPipeline)][String]$CPE
)

process {
if ($CPE -notlike 'cpe:/*') {write-error "$CPE is not a valid CPE string";return}

$CPEParts = $CPE -split ':'

[PSCustomObject]@{
PSTypeName = 'PoshNmapCommonPlatformEnumeration'
Type = switch ($CPEParts[1]) {
'/a' {
'Application'
}
'/h' {
'Hardware'
}
'/o' {
'OS'
}
}
Product = $CPEParts[2]
Version = $CPEParts[3]
Update = $CPEParts[4]
Edition = $CPEParts[5]
Language = $CPEParts[6]
}
}


}
20 changes: 5 additions & 15 deletions PoshNmap/Private/FormatPoshNmapHost.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
using namespace Management.Automation
Update-TypeData -TypeName PoshNmapHost -DefaultDisplayPropertySet IPv4,FQDN,Status,OpenPorts -Force
function FormatPoshNmapHost {
[CmdletBinding()]
param (
Expand All @@ -19,15 +18,14 @@ function FormatPoshNmapHost {
Hostname = $null
Status = ($hostnode.status.state.Trim() | where length -ge 2)
FQDNs = $hostnode.hostnames.hostname.name | select -Unique
FDQN = $null
IPv4 = $null
IPv6 = $null
MAC = $null
#Arraylist used for performance as this can get large quickly
Ports = New-Object Collections.ArrayList
OpenPorts = $hostnode.ports.port | measure | % count
}
$entry.FQDN = $entry.FQDNs | select -first 1
$entry.FQDN = if ($hostnode.hostnames.hostname | where type -eq 'user') {$hostnode.hostnames.hostname | where type -eq 'user' | % name} else {$entry.FQDNs | select -first 1}
$entry.Hostname = $entry.FQDN -replace '^(\w+)\..*$','$1'
FormatStringOut -InputObject $entry.Ports {$this.ports | measure | % count}

Expand All @@ -49,21 +47,10 @@ function FormatPoshNmapHost {
State=$_.state
ScriptResult = @{}
}
$portResult | FormatStringOut -scriptblock {$this.protocol,$this.port -join ':'}
$portResult | FormatStringOut -scriptblock {$this.services.name -join ','}
$portResult.State | FormatStringOut -scriptblock {$this.state}
$portResult.Services | FormatStringOut -scriptblock {($this.name,$this.product -join ':') + " ($([int]($this.conf) * 10)%)"}

#TODO: Refactor this now that I'm better at Powershell :)
# Build Services property. What a mess...but exclude non-open/non-open|filtered ports and blank service info, and exclude servicefp too for the sake of tidiness.
if ($_.state.state -like "open*" -and ($_.service.tunnel.length -gt 2 -or $_.service.product.length -gt 2 -or $_.service.proto.length -gt 2)) {
$OutputDelimiter = ', '
$entry.Services += ($_.protocol,$_.portid,$service -join ':')+
':'+
($_.service.product,$_.service.version,$_.service.tunnel,$_.service.proto,$_.service.rpcnum -join " ").Trim() +
" <" +
([Int] $_.service.conf * 10) + "%-confidence>$OutputDelimiter"
}

#Port Script Result Processing
foreach ($scriptItem in $_.script) {
$scriptResultEntry = [ordered]@{
Expand Down Expand Up @@ -97,6 +84,9 @@ function FormatPoshNmapHost {
$entry.OSGuesses = $hostnode.os.osmatch
if (@($entry.OSGuesses).count -lt 1) { $entry.OS = $null }

$entry.Inventory = $hostnode.ports.port.service.cpe | select -unique | ConvertFromCpe

#TODO: Refactor this
if ($hostnode.hostscript -ne $null) {
$hostnode.hostscript.script | foreach-object {
$entry.Script += '<HostScript id="' + $_.id + '">' + $OutputDelimiter + ($_.output.replace("`n","$OutputDelimiter")) + "$OutputDelimiter</HostScript> $OutputDelimiter $OutputDelimiter"
Expand Down