#!/usr/bin/env python3
"""Agentless Vulnerability Scanning agent - uses AWS Inspector2 and SSM APIs
via boto3 to perform agentless scans of EC2 instances through EBS snapshot
analysis without requiring installed agents."""

import argparse
import json
import sys
from collections import Counter
from datetime import datetime
from pathlib import Path

try:
    import boto3
    from botocore.exceptions import ClientError
except ImportError:
    print("Install boto3: pip install boto3", file=sys.stderr)
    sys.exit(1)


def get_inspector_client(region: str = "us-east-1", profile: str = None):
    """Create AWS Inspector2 client."""
    session = boto3.Session(profile_name=profile, region_name=region)
    return session.client("inspector2")


def get_ec2_client(region: str = "us-east-1", profile: str = None):
    """Create EC2 client."""
    session = boto3.Session(profile_name=profile, region_name=region)
    return session.client("ec2")


def check_inspector_status(client) -> dict:
    """Check Inspector2 enablement status."""
    try:
        response = client.batch_get_account_status(
            accountIds=[boto3.client("sts").get_caller_identity()["Account"]]
        )
        accounts = response.get("accounts", [])
        if accounts:
            status = accounts[0].get("state", {}).get("status", "UNKNOWN")
            return {"enabled": status == "ENABLED", "status": status}
        return {"enabled": False, "status": "NO_DATA"}
    except ClientError as e:
        return {"enabled": False, "error": str(e)}


def list_ec2_scan_coverage(client) -> list[dict]:
    """List EC2 instances and their scan coverage status."""
    coverage = []
    paginator = client.get_paginator("list_coverage")
    for page in paginator.paginate(
        filterCriteria={"resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}]}
    ):
        for item in page.get("coveredResources", []):
            coverage.append({
                "resource_id": item.get("resourceId", ""),
                "resource_type": item.get("resourceType", ""),
                "scan_status": item.get("scanStatus", {}).get("statusCode", "UNKNOWN"),
                "scan_type": item.get("scanType", ""),
                "account_id": item.get("accountId", ""),
            })
    return coverage


def list_findings(client, severity_filter: list[str] = None,
                  max_results: int = 500) -> list[dict]:
    """List vulnerability findings from Inspector2."""
    filter_criteria = {}
    if severity_filter:
        filter_criteria["severity"] = [
            {"comparison": "EQUALS", "value": s} for s in severity_filter
        ]
    findings = []
    paginator = client.get_paginator("list_findings")
    params = {"filterCriteria": filter_criteria, "maxResults": min(max_results, 100)}
    count = 0
    for page in paginator.paginate(**params):
        for finding in page.get("findings", []):
            findings.append({
                "finding_arn": finding.get("findingArn", ""),
                "title": finding.get("title", ""),
                "severity": finding.get("severity", ""),
                "status": finding.get("status", ""),
                "type": finding.get("type", ""),
                "resource_id": finding.get("resources", [{}])[0].get("id", ""),
                "resource_type": finding.get("resources", [{}])[0].get("type", ""),
                "vulnerability_id": finding.get("packageVulnerabilityDetails", {}).get("vulnerabilityId", ""),
                "cvss_score": finding.get("packageVulnerabilityDetails", {}).get("cvss", [{}])[0].get("baseScore", 0),
                "fixed_in": finding.get("packageVulnerabilityDetails", {}).get("fixedInVersion", ""),
                "first_observed": str(finding.get("firstObservedAt", "")),
            })
            count += 1
            if count >= max_results:
                return findings
    return findings


def create_ebs_snapshot_scan(ec2_client, instance_id: str) -> dict:
    """Create EBS snapshots for agentless scanning."""
    try:
        volumes = ec2_client.describe_volumes(
            Filters=[{"Name": "attachment.instance-id", "Values": [instance_id]}]
        )
        snapshots = []
        for vol in volumes.get("Volumes", []):
            snap = ec2_client.create_snapshot(
                VolumeId=vol["VolumeId"],
                Description=f"Agentless scan snapshot for {instance_id}",
                TagSpecifications=[{
                    "ResourceType": "snapshot",
                    "Tags": [{"Key": "Purpose", "Value": "AgentlessVulnScan"},
                             {"Key": "SourceInstance", "Value": instance_id}]
                }]
            )
            snapshots.append({"volume_id": vol["VolumeId"], "snapshot_id": snap["SnapshotId"]})
        return {"instance_id": instance_id, "snapshots": snapshots}
    except ClientError as e:
        return {"instance_id": instance_id, "error": str(e)}


def generate_report(region: str, profile: str = None,
                    severity_filter: list[str] = None) -> dict:
    """Run agentless scanning assessment and build report."""
    inspector = get_inspector_client(region, profile)
    status = check_inspector_status(inspector)
    coverage = list_ec2_scan_coverage(inspector)
    findings = list_findings(inspector, severity_filter)

    severity_counts = Counter(f["severity"] for f in findings)
    uncovered = [c for c in coverage if c["scan_status"] != "ACTIVE"]
    return {
        "report": "agentless_vulnerability_scanning",
        "generated_at": datetime.utcnow().isoformat() + "Z",
        "region": region,
        "inspector_status": status,
        "total_resources_scanned": len(coverage),
        "uncovered_resources": len(uncovered),
        "total_findings": len(findings),
        "severity_summary": dict(severity_counts),
        "uncovered_resources_list": uncovered[:20],
        "findings": findings,
    }


def main():
    parser = argparse.ArgumentParser(description="Agentless Vulnerability Scanning Agent")
    parser.add_argument("--region", default="us-east-1", help="AWS region")
    parser.add_argument("--profile", help="AWS CLI profile name")
    parser.add_argument("--severity", nargs="+", choices=["CRITICAL", "HIGH", "MEDIUM", "LOW"],
                        help="Filter by severity")
    parser.add_argument("--output", help="Output JSON file path")
    args = parser.parse_args()

    report = generate_report(args.region, args.profile, args.severity)
    output = json.dumps(report, indent=2)
    if args.output:
        Path(args.output).write_text(output, encoding="utf-8")
        print(f"Report written to {args.output}")
    else:
        print(output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Agentless Vulnerability Scanning Orchestrator

Performs SSH-based agentless vulnerability scanning on Linux hosts
by enumerating packages and checking against known vulnerabilities.

Requirements:
    pip install paramiko requests pandas

Usage:
    python process.py scan --hosts hosts.txt --key /path/to/ssh_key
    python process.py check --host 192.168.1.10 --user scanner --key /path/to/ssh_key
    python process.py report --input scan_results.json --output report.csv
"""

import argparse
import json
import sys
from datetime import datetime

import pandas as pd
import paramiko
import requests


NVD_API = "https://services.nvd.nist.gov/rest/json/cves/2.0"


class AgentlessScanner:
    """SSH-based agentless vulnerability scanner."""

    def __init__(self, key_path, username="scanner"):
        self.key_path = key_path
        self.username = username

    def _connect(self, hostname, port=22):
        """Establish SSH connection."""
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        try:
            key = paramiko.Ed25519Key.from_private_key_file(self.key_path)
        except paramiko.ssh_exception.SSHException:
            key = paramiko.RSAKey.from_private_key_file(self.key_path)
        client.connect(hostname, port=port, username=self.username,
                       pkey=key, timeout=30)
        return client

    def _exec(self, client, command, timeout=30):
        """Execute command and return output."""
        _, stdout, stderr = client.exec_command(command, timeout=timeout)
        return stdout.read().decode().strip(), stderr.read().decode().strip()

    def get_os_info(self, client):
        """Detect OS distribution and version."""
        out, _ = self._exec(client, "cat /etc/os-release")
        info = {}
        for line in out.split("\n"):
            if "=" in line:
                k, v = line.split("=", 1)
                info[k] = v.strip('"')
        return info

    def get_packages_dpkg(self, client):
        """Get packages via dpkg (Debian/Ubuntu)."""
        out, _ = self._exec(
            client,
            "dpkg-query -W -f='${Package}|${Version}|${Architecture}\\n'"
        )
        packages = []
        for line in out.split("\n"):
            parts = line.split("|")
            if len(parts) >= 2:
                packages.append({
                    "name": parts[0],
                    "version": parts[1],
                    "arch": parts[2] if len(parts) > 2 else "",
                })
        return packages

    def get_packages_rpm(self, client):
        """Get packages via rpm (RHEL/CentOS/Fedora)."""
        out, _ = self._exec(
            client,
            "rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\n'"
        )
        packages = []
        for line in out.split("\n"):
            parts = line.split("|")
            if len(parts) >= 2:
                packages.append({
                    "name": parts[0],
                    "version": parts[1],
                    "arch": parts[2] if len(parts) > 2 else "",
                })
        return packages

    def get_kernel(self, client):
        """Get running kernel version."""
        out, _ = self._exec(client, "uname -r")
        return out

    def get_listening_services(self, client):
        """Get listening network services."""
        out, _ = self._exec(client, "ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null")
        return out

    def scan_host(self, hostname, port=22):
        """Perform full agentless scan."""
        result = {
            "hostname": hostname,
            "scan_time": datetime.utcnow().isoformat(),
            "status": "success",
            "os_info": {},
            "kernel": "",
            "packages": [],
            "listening_services": "",
        }

        try:
            client = self._connect(hostname, port)
            result["os_info"] = self.get_os_info(client)
            result["kernel"] = self.get_kernel(client)

            os_id = result["os_info"].get("ID", "").lower()
            if os_id in ("ubuntu", "debian", "kali"):
                result["packages"] = self.get_packages_dpkg(client)
            else:
                result["packages"] = self.get_packages_rpm(client)

            result["listening_services"] = self.get_listening_services(client)
            client.close()

            print(f"  [+] {hostname}: {result['os_info'].get('PRETTY_NAME', 'Unknown')} | "
                  f"{len(result['packages'])} packages | kernel {result['kernel']}")

        except Exception as e:
            result["status"] = "error"
            result["error"] = str(e)
            print(f"  [!] {hostname}: {e}")

        return result

    def scan_hosts(self, hosts, port=22):
        """Scan multiple hosts."""
        results = []
        for host in hosts:
            host = host.strip()
            if not host or host.startswith("#"):
                continue
            print(f"[*] Scanning {host}...")
            results.append(self.scan_host(host, port))
        return results


def main():
    parser = argparse.ArgumentParser(
        description="Agentless Vulnerability Scanning Orchestrator"
    )
    subparsers = parser.add_subparsers(dest="command")

    scan_p = subparsers.add_parser("scan", help="Scan hosts from file")
    scan_p.add_argument("--hosts", required=True, help="File with hostnames/IPs")
    scan_p.add_argument("--key", required=True, help="SSH private key path")
    scan_p.add_argument("--user", default="scanner", help="SSH username")
    scan_p.add_argument("--port", type=int, default=22, help="SSH port")
    scan_p.add_argument("--output", default="scan_results.json")

    check_p = subparsers.add_parser("check", help="Scan a single host")
    check_p.add_argument("--host", required=True)
    check_p.add_argument("--key", required=True)
    check_p.add_argument("--user", default="scanner")
    check_p.add_argument("--port", type=int, default=22)

    report_p = subparsers.add_parser("report", help="Generate CSV report")
    report_p.add_argument("--input", required=True, help="Scan results JSON")
    report_p.add_argument("--output", default="scan_report.csv")

    args = parser.parse_args()

    if args.command == "scan":
        scanner = AgentlessScanner(args.key, args.user)
        with open(args.hosts) as f:
            hosts = f.readlines()
        results = scanner.scan_hosts(hosts, args.port)
        with open(args.output, "w") as f:
            json.dump(results, f, indent=2)
        print(f"\n[+] Results saved to {args.output}")
        successful = sum(1 for r in results if r["status"] == "success")
        print(f"    Scanned: {len(results)} | Success: {successful}")

    elif args.command == "check":
        scanner = AgentlessScanner(args.key, args.user)
        result = scanner.scan_host(args.host, args.port)
        print(json.dumps(result, indent=2, default=str))

    elif args.command == "report":
        with open(args.input) as f:
            results = json.load(f)
        rows = []
        for r in results:
            for pkg in r.get("packages", []):
                rows.append({
                    "hostname": r["hostname"],
                    "os": r.get("os_info", {}).get("PRETTY_NAME", ""),
                    "kernel": r.get("kernel", ""),
                    "package": pkg["name"],
                    "version": pkg["version"],
                })
        df = pd.DataFrame(rows)
        df.to_csv(args.output, index=False)
        print(f"[+] Report with {len(rows)} package entries saved to {args.output}")

    else:
        parser.print_help()


if __name__ == "__main__":
    main()