Dumb script to bulk parse the output of CVE-2018-13379 (https://gist.github.com/code-machina/bae5555a771062f2a8225fd4731ae3f7) (SSLVPN Fortigate)

fortissl_parse_dump.py

import re
import mmap

CHECKING = re.compile("\[Checking: .*\]\n")
IPADDR = re.compile(
    r"((?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2})\.(?:(0|1)\d{2}|2[0-4]\d|25[0-5]|\d{1,2}))"
)
DOTS = re.compile(".*\.{2,}.*")


def normalize(str):
    output = ""
    for line in str:
        if DOTS.match(line):
            output = output + line.strip().replace("\n", "")
        else:
            output = output + line
    output = re.sub("\.{3,}", "\n", output)
    return output


with open("dump.txt", "r") as dump:
    data = dump.readlines()
normal = open("normalized.txt", "w")
normal.write(normalize(data))
normal.close()

with open("normalized.txt", "r") as normal:
    data = normal.readlines()
    output = ""
    with open("cleaned.txt", "w") as clean:
        for i in range(0, len(data)):
            if CHECKING.match(data[i]):
                clean.write(output)
                output = "\n" + data[i]
            elif (
                "[*} Web session at" not in data[i] and len(IPADDR.findall(data[i])) > 0
            ):
                line = data[i + 1].strip() + ":" + data[i + 2]
                if line not in output:
                    output = output + line