-
Notifications
You must be signed in to change notification settings - Fork 48
/
searchsploit
executable file
·396 lines (344 loc) · 10.2 KB
/
searchsploit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
#!/bin/bash
# Name: SearchSploit - Exploit-DB's CLI search tool
# Version: 3.3 (Release date: 2016-04-02)
# Written by: Offensive Security, Unix-Ninja & g0tmi1k
# Homepage: https://github.com/offensive-security/exploit-database
#
## NOTE:
# Exit code '0' means finished normally
# Exit code '1' means something went wrong
# Exit code '2' means finished help screen
# Exit code '6' means updated from GitHub
#set -x
## OS settings
gitpath="/usr/share/exploitdb"
csvpath="${gitpath}/files_exploits.csv"
## Program settings
gitremote="https://github.com/offensive-security/exploit-database.git"
progname="$( basename "$0" )"
## Default options
COLOUR=1
EDBID=0
EXACT=0
FILEPATH=1
GETPATH=0
OVERFLOW=0
WEBLINK=0
SCASE=0
TAGS=""
CASE_TAG_GREP="-i"
CASE_TAG_FGREP="tolower"
COLOUR_TAG=""
SEARCH=""
MSF=1
## Set LANG variable to avoid illegal byte sequence errors
LANG=C
## If files_exploits.csv is in the searchsploit path, use that instead
if [[ -f "$( dirname "$0" )/files_exploits.csv" ]]; then
gitpath="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
csvpath="${gitpath}/files_exploits.csv"
fi
## Usage info
function usage()
{
echo " Usage: ${progname} [options] term1 [term2] ... [termN]"
echo "Example:"
echo " ${progname} afd windows local"
echo " ${progname} -t oracle windows"
echo
echo "========="
echo " Options "
echo "========="
echo " -c, --case Perform a case-sensitive search (Default is inSEnsITiVe)."
echo " -e, --exact Perform an EXACT match on exploit title (Default is AND) [Implies \"-t\"]."
echo " -h, --help Show this help screen."
echo " -o, --overflow Exploit title's are allowed to overflow their columns."
echo " -p, --path Show the full path to an exploit (Copies path to clipboard if possible)."
echo " -t, --title Search just the exploit title (Default is title AND the file's path)."
# echo " -u, --update Update exploit database from git."
echo " -w, --www Show URLs to Exploit-DB.com rather than local path."
echo " --colour Disable colour highlighting."
echo " --id Display EDB-ID value rather than local path."
echo " --no-msf Exclude metasploit modules."
echo
echo "======="
echo " Notes "
echo "======="
echo " * Use any number of search terms."
echo " * Search terms are not case sensitive, and order is irrelevant."
echo " * Use '-c' if you wish to reduce results by case-sensitive searching."
echo " * And/Or '-e' if you wish to filter results by using an exact match."
echo " * Use '-t' to exclude the file's path to filter the search results."
echo " * Remove false positives (especially when searching numbers/major versions)."
echo " * When updating from git or displaying help, search terms will be ignored."
echo ""
exit 2
}
## Update database (via GIT)
#function update()
#{
# ## Make sure we are in the correct folder
# mkdir -p "${gitpath}/"
# cd "${gitpath}/"
#
# ## Are we in a git repo?
# if [[ "$( git rev-parse --is-inside-work-tree )" != "true" ]]; then
# if [[ "$( ls )" = "" ]]; then
# # If directory is empty, just clone
# echo -e '\n[i] Nothing here. Starting fresh...'
# git clone "${gitremote}" .
# fi
# fi
#
# # Is our git remote added? (aka homebrew)
# if [[ "$( git remote -v )" != *"${gitremote}"* ]]; then
# echo -e '\n[i] Missing git remote:' "${gitremote}"
# git init >/dev/null
# git remote add origin "${gitremote}" 2>/dev/null
# fi
#
# # Make sure to prep checkout first
# git checkout -- .
#
# # Update from git
# git pull origin master
#
# # If conflicts, clean and try again
# if [[ "$?" -ne 0 ]]; then
# git clean -d -fx ""
# git pull origin master
# fi
#
# echo -e "\n[*] Update finished."
# exit 6
#}
## Printing dotted lines in the correct manner
function drawline()
{
printf "%0.s-" $( eval echo {1..$(( COL1 + 1 ))} )
echo -n " "
printf "%0.s-" $( eval echo {1..$(( COL2 - 1 ))} )
echo ""
}
## Check for empty args
if [[ $# -eq 0 ]]; then
usage >&2
fi
## Parse long arguments
ARGS="-"
for param in "$@"; do
if [[ "${param}" == "--case" ]]; then
SCASE=1
elif [[ "${param}" == "--exact" ]]; then
EXACT=1
elif [[ "${param}" == "--help" ]]; then
usage >&2
elif [[ "${param}" == "--overflow" ]]; then
OVERFLOW=1
elif [[ "${param}" == "--path" ]]; then
GETPATH=1
elif [[ "${param}" == "--title" ]]; then
FILEPATH=0
#elif [[ "${param}" == "--update" ]]; then
# update
elif [[ "${param}" == "--www" ]]; then
WEBLINK=1
elif [[ "${param}" == "--colour" ]] || [[ "${param}" == "--color" ]]; then
COLOUR=""
elif [[ "${param}" == "--id" ]]; then
EDBID=1
elif [[ "${param}" == "--no-msf" ]]; then
MSF=0
else
if [[ "${param:0:1}" == "-" ]]; then
ARGS=${ARGS}${param:1}
shift
continue
fi
TAGS="${TAGS} ${param//\`/_}"
fi
done
## Parse short arguments
while getopts "cehoptuw" arg "${ARGS}"; do
if [[ "${arg}" = "?" ]]; then
usage >&2;
fi
case ${arg} in
c) SCASE=1;;
e) EXACT=1;;
h) usage >&2;;
o) OVERFLOW=1;;
p) GETPATH=1;;
t) FILEPATH=0;;
# u) update;;
w) WEBLINK=1;;
esac
shift $(( OPTIND - 1 ))
done
## Print the full path. If pbcopy/xclip is available then copy to the clipboard
if [[ "${GETPATH}" -eq 1 ]]; then
## Get EDB-ID from input
edbdb="$( echo ${TAGS} | tr -dc '0-9' )"
## Check files_exploits.csv
location=$( cut -d, -f2 "${csvpath}" | grep -m 1 -E "/${edbdb}(\..*)?$" )
title=$( grep -m 1 "${location}" "${csvpath}" | cut -d, -f3 | sed 's/"//g')
## Join paths
location="${gitpath}/${location}"
## Did we find the exploit?
if [[ -f "${location}" ]]; then
## Display out
echo "Exploit: ${title}"
echo " Path: ${location}"
echo ""
## Are any copy programs available?
if hash xclip 2>/dev/null || hash pbcopy 2>/dev/null; then
## Linux
if hash xclip 2>/dev/null; then
echo -ne "${location}" | xclip -selection clipboard
echo "Copied the file path to the clipboard."
## OSX
elif hash pbcopy 2>/dev/null; then
echo -ne "${location}" | pbcopy
echo "Copied the file path to the clipboard."
fi
fi
## Done
exit 0
else
## Feedback
echo "Could not find exploit EDB-ID #${edbdb}"
## Quit
exit 1
fi
fi
## If we are doing an exact match, do not check folder path.
if [[ "${EXACT}" -eq 1 ]]; then
FILEPATH=0
fi
## Case sensitive?
if [[ "${SCASE}" -eq 1 ]]; then
## Remove the default flags
CASE_TAG_GREP=""
CASE_TAG_FGREP=""
fi
## Dynamically set column widths to the current screen size
if [[ "${WEBLINK}" -eq 1 ]]; then
COL2=45
else
COL2=$(( ${#gitpath} + 15 ))
fi
COL1=$(( $( tput cols ) - COL2 - 1 ))
## Print header
drawline
printf "%-${COL1}s %s" " Exploit Title"
if [[ "${WEBLINK}" -eq 1 ]]; then
echo "| URL"
elif [[ "${EDBID}" -eq 1 ]]; then
echo "| EDB-ID"
else
echo "| Path"
printf "%-${COL1}s "
echo "| (${gitpath}/platforms)"
fi
drawline
## EXACT search command?
if [[ "${EXACT}" -eq 1 ]]; then
## Case sensitive?
if [[ "${SCASE}" -eq 1 ]]; then
SEARCH="${TAGS}"
else
SEARCH="$( echo ${TAGS} | tr '[:upper:]' '[:lower:]' )"
fi
## Remove leading space
SEARCH="$(echo ${SEARCH} | sed -e 's/^[[:space:]]//')"
## If we are to use colour, add the values to search for
if [[ "${COLOUR}" -eq 1 ]]; then
COLOUR_TAG="${SEARCH}"
fi
## or AND search command?
else
## For each term
for tag in ${TAGS}; do
## If we are to use colour, add the values to search for between "or"
if [[ "${COLOUR}" -eq 1 ]]; then
if [[ "${COLOUR_TAG}" ]]; then
COLOUR_TAG="${COLOUR_TAG}\|"
fi
COLOUR_TAG="${COLOUR_TAG}${tag}"
fi
## Search both title and path?
if [[ "${FILEPATH}" -eq 1 ]]; then
## Is there a value already?
if [[ "${SEARCH}" ]]; then
SEARCH="${SEARCH} |"
fi
## Search command for each term
SEARCH="${SEARCH} fgrep ${CASE_TAG_GREP} \"${tag}\""
## Search just the title, not the path
else
## If there is already a value, prepend text to get ready
if [[ "${SEARCH}" ]]; then
SEARCH="${SEARCH}/ && ${CASE_TAG_FGREP}(\$1) ~ /"
fi
## Case sensitive?
if [[ "${SCASE}" -eq 1 ]]; then
SEARCH="${SEARCH}${tag}"
else
SEARCH="${SEARCH}$( echo ${tag} | tr '[:upper:]' '[:lower:]' )"
fi
fi
done
fi
## If we are not to use the path name
if [[ "${FILEPATH}" -eq 0 ]]; then
SEARCH="awk -F '[|]' '${CASE_TAG_FGREP}(\$1) ~ /${SEARCH}/ {print}'"
fi
## If we are to use colour, add the value here
if [[ "${COLOUR_TAG}" ]]; then
SEARCH="${SEARCH} | grep --color=always -ie \"\${COLOUR_TAG}\""
fi
## Search, format, and print results
if [[ "${OVERFLOW}" -eq 1 ]]; then
FORMAT=${COL1}
else
FORMAT=${COL1}'.'${COL1}
fi
## Magic search Fu
## Excluding MSF modules
if [[ "${MSF}" -eq 0 ]]; then
## web link format?
if [[ "${WEBLINK}" -eq 1 ]]; then
awk -F "\"*,\"*" '{ if ( tolower($3) !~ /metasploit/ && tolower($5) != "metasploit" ) { printf "%-'${FORMAT}'s | %s\n", $3, "https://www.exploit-db.com/exploits/"$1"/"}}' "${csvpath}" \
| eval "${SEARCH}"
## Just the EDB-ID?
elif [[ "${EDBID}" -eq 1 ]]; then
awk -F "\"*,\"*" '{ if ( tolower($3) !~ /metasploit/ && tolower($5) != "metasploit" ) { printf "%-'${FORMAT}'s | %s\n", $3, $1}}' "${csvpath}" \
| eval "${SEARCH}"
## Default view
else
awk -F "\"*,\"*" '{ if ( tolower($3) !~ /metasploit/ && tolower($5) != "metasploit" ) { printf "%-'${FORMAT}'s | %s\n", $3, $2}}' "${csvpath}" \
| eval "${SEARCH}" \
| sed "s/| platforms/| ./"
fi
else
## Full search results
## Magic search Fu
## Web link format?
if [[ "${WEBLINK}" -eq 1 ]]; then
awk -F "\"*,\"*" '{ printf "%-'${FORMAT}'s | %s\n", $3, "https://www.exploit-db.com/exploits/"$1"/"}' "${csvpath}" \
| eval "${SEARCH}"
## Just the EDB-ID?
elif [[ "${EDBID}" -eq 1 ]]; then
awk -F "\"*,\"*" '{ printf "%-'${FORMAT}'s | %s\n", $3, $1}' "${csvpath}" \
| eval "${SEARCH}"
## Default view
else
awk -F "\"*,\"*" '{ printf "%-'${FORMAT}'s | %s\n", $3, $2}' "${csvpath}" \
| eval "${SEARCH}" \
| sed "s/| platforms/| ./"
fi
fi
## Print footer
drawline
## Done
exit 0