gitea-mirror/PEASS-ng
1
0
Fork 0
mirror of https://github.com/peass-ng/PEASS-ng.git synced 2026-07-30 23:50:27 -07:00
Code Issues Packages Projects Releases Wiki Activity

winpeas: use KB supersedence graph for windows version vuln filtering

Browse Source
This commit is contained in:
Carlos Polop
2026-02-26 01:52:42 +01:00
parent 75a67b4511
commit 1bb9b22958
3 changed files with 53 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build_lists/update_windows_version_defs.py
+18 -8
View File
@@ -34,18 +34,27 @@ def build_definitions(definitions_zip: Path) -> dict:
rows.extend(_read_csv_from_zip(zf, "Custom_"))
products: dict[str, dict[str, dict[str, str]]] = defaultdict(dict)
kb_supersedes: dict[str, set[str]] = defaultdict(set)
for row in rows:
if not (row.get("Exploits") or "").strip():
continue
product = (row.get("AffectedProduct") or "").strip()
if not product:
continue
if "windows" not in product.lower():
continue
cve = (row.get("CVE") or "").strip()
kb = (row.get("BulletinKB") or "").strip()
supersedes = (row.get("Supersedes") or "").strip()
if kb and supersedes:
for item in supersedes.split(";"):
item = item.strip()
if item:
kb_supersedes[kb].add(item)
if not (row.get("Exploits") or "").strip():
continue
if not product:
continue
cve = (row.get("CVE") or "").strip()
vuln_key = cve or f"KB{kb}"
if not vuln_key:
continue
@@ -58,13 +67,14 @@ def build_definitions(definitions_zip: Path) -> dict:
"kb": kb,
"severity": (row.get("Severity") or "").strip(),
"impact": (row.get("Impact") or "").strip(),
"supersedes": (row.get("Supersedes") or "").strip(),
}
data = {"generated": generated, "products": {}}
data = {"generated": generated, "products": {}, "kb_supersedes": {}}
for product in sorted(products):
entries = [products[product][key] for key in sorted(products[product])]
data["products"][product] = entries
for kb in sorted(kb_supersedes):
data["kb_supersedes"][kb] = sorted(kb_supersedes[kb])
return data
build_lists/windows_version_exploits.json
+1 -1
View File
File diff suppressed because one or more lines are too long
winPEAS/winPEASexe/winPEAS/Info/SystemInfo/WindowsVersionVulns.cs
+34 -73
View File
@@ -62,7 +62,7 @@ namespace winPEAS.Info.SystemInfo
report.MatchedProducts = matchedProducts.OrderBy(p => p).ToList();
report.TotalMatchedBeforeFiltering = matchedEntries.Count;
var filteredVulns = FilterPatchedVulnerabilities(matchedEntries, installedHotfixes);
var filteredVulns = FilterPatchedVulnerabilities(matchedEntries, installedHotfixes, definitions.kb_supersedes);
var vulnById = new Dictionary<string, WindowsVersionVulnEntry>(StringComparer.OrdinalIgnoreCase);
AddEntries(filteredVulns, vulnById);
@@ -168,89 +168,56 @@ namespace winPEAS.Info.SystemInfo
return hotfixes;
}
private static List<WindowsVersionVulnEntry> FilterPatchedVulnerabilities(List<WindowsVersionVulnEntry> entries, HashSet<string> installedHotfixes)
private static List<WindowsVersionVulnEntry> FilterPatchedVulnerabilities(
List<WindowsVersionVulnEntry> entries,
HashSet<string> installedHotfixes,
Dictionary<string, List<string>> kbSupersedes)
{
if (entries.Count == 0)
{
return entries;
}
var relevant = entries.Select(e => new RelevantVuln
{
Entry = e,
Relevant = true
}).ToList();
var initialHotfixes = new HashSet<string>(installedHotfixes, StringComparer.OrdinalIgnoreCase);
// This mirrors WES behavior to allow recursive supersedence pruning.
foreach (var rv in relevant)
{
foreach (var ss in ParseSupersedes(rv.Entry.supersedes))
var suppressed = ExpandSupersededHotfixes(installedHotfixes, kbSupersedes);
return entries
.Where(entry =>
{
initialHotfixes.Add(ss);
}
}
MarkSupersededHotfixes(relevant, initialHotfixes, new HashSet<string>(StringComparer.OrdinalIgnoreCase));
var supersedes = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
foreach (var rv in relevant.Where(r => r.Relevant))
{
foreach (var ss in ParseSupersedes(rv.Entry.supersedes))
{
supersedes.Add(ss);
}
}
foreach (var rv in relevant.Where(r => r.Relevant))
{
if (!string.IsNullOrWhiteSpace(rv.Entry.kb) && supersedes.Contains(rv.Entry.kb))
{
rv.Relevant = false;
}
}
return relevant.Where(r => r.Relevant).Select(r => r.Entry).ToList();
if (string.IsNullOrWhiteSpace(entry.kb))
{
return true;
}
return !suppressed.Contains(entry.kb);
})
.ToList();
}
private static void MarkSupersededHotfixes(List<RelevantVuln> relevant, HashSet<string> hotfixes, HashSet<string> visited)
private static HashSet<string> ExpandSupersededHotfixes(HashSet<string> installedHotfixes, Dictionary<string, List<string>> kbSupersedes)
{
foreach (var hotfix in hotfixes)
var suppressed = new HashSet<string>(installedHotfixes, StringComparer.OrdinalIgnoreCase);
if (kbSupersedes == null || kbSupersedes.Count == 0)
{
MarkHotfixAndChildren(relevant, hotfix, visited);
return suppressed;
}
}
private static void MarkHotfixAndChildren(List<RelevantVuln> relevant, string hotfix, HashSet<string> visited)
{
if (string.IsNullOrWhiteSpace(hotfix) || visited.Contains(hotfix))
var queue = new Queue<string>(installedHotfixes);
while (queue.Count > 0)
{
return;
}
visited.Add(hotfix);
foreach (var rv in relevant.Where(r => r.Relevant && string.Equals(r.Entry.kb, hotfix, StringComparison.OrdinalIgnoreCase)))
{
rv.Relevant = false;
foreach (var child in ParseSupersedes(rv.Entry.supersedes))
var current = queue.Dequeue();
if (!kbSupersedes.TryGetValue(current, out var children) || children == null)
{
MarkHotfixAndChildren(relevant, child, visited);
continue;
}
foreach (var child in children)
{
if (suppressed.Add(child))
{
queue.Enqueue(child);
}
}
}
}
private static IEnumerable<string> ParseSupersedes(string supersedes)
{
if (string.IsNullOrWhiteSpace(supersedes))
{
return Enumerable.Empty<string>();
}
return supersedes
.Split(new[] { ';' }, StringSplitOptions.RemoveEmptyEntries)
.Select(s => s.Trim())
.Where(s => !string.IsNullOrWhiteSpace(s));
return suppressed;
}
private static List<string> BuildCandidateProducts(Dictionary<string, string> basicInfo)
@@ -457,6 +424,7 @@ namespace winPEAS.Info.SystemInfo
{
public string generated { get; set; }
public Dictionary<string, List<WindowsVersionVulnEntry>> products { get; set; }
public Dictionary<string, List<string>> kb_supersedes { get; set; }
}
internal class WindowsVersionVulnEntry
@@ -465,12 +433,5 @@ namespace winPEAS.Info.SystemInfo
public string kb { get; set; }
public string severity { get; set; }
public string impact { get; set; }
public string supersedes { get; set; }
}
internal class RelevantVuln
{
public WindowsVersionVulnEntry Entry { get; set; }
public bool Relevant { get; set; }
}
}