HP System Management Homepage < 7

#!/usr/bin/env python3
# check_hpsmh_78090.py
# Detect HP System Management Homepage and determine whether version is < 7.4.0
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import ssl
import json
import platform
import subprocess
from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

TARGET = (7, 4, 0)
COMMON_URLS = [
    'https://127.0.0.1:2381/',
    'https://localhost:2381/',
    'http://127.0.0.1:2301/',
    'http://localhost:2301/'
]
PATTERNS = [
    r'HP\\s+System\\s+Management\\s+Homepage[^0-9]{0,20}(\\d+(?:\\.\\d+){1,3})',
    r'System\\s+Management\\s+Homepage[^0-9]{0,20}(\\d+(?:\\.\\d+){1,3})',
    r'Version[^0-9]{0,10}(\\d+(?:\\.\\d+){1,3})'
]


def norm_tuple(v):
    parts = [int(x) for x in v.split('.') if x.isdigit() or x.isnumeric()]
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts[:3])


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        return p.returncode, (p.stdout or '') + (p.stderr or '')
    except Exception:
        return 999, ''


def detect_windows_registry():
    keys = [
        r'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall',
        r'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall'
    ]
    for key in keys:
        rc, out = run_cmd(['reg', 'query', key, '/s'])
        if rc != 0 or not out:
            continue
        blocks = re.split(r'\r?\n\r?\n+', out)
        for block in blocks:
            if 'System Management Homepage' in block or 'HP System Management Homepage' in block or 'HPE System Management Homepage' in block:
                m = re.search(r'DisplayVersion\s+REG_\w+\s+([0-9]+(?:\.[0-9]+){1,3})', block)
                if m:
                    return m.group(1), 'registry'
    return None, None


def detect_windows_wmic():
    rc, out = run_cmd(['wmic', 'product', 'get', 'name,version'])
    if rc == 0 and out:
        for line in out.splitlines():
            if 'System Management Homepage' in line:
                m = re.search(r'([0-9]+(?:\.[0-9]+){1,3})', line)
                if m:
                    return m.group(1), 'wmic'
    return None, None


def detect_linux_pkg():
    for pkg in ['hpsmh', 'hp-smh', 'sysmgmt-homepage']:
        rc, out = run_cmd(['rpm', '-q', '--qf', '%{VERSION}\n', pkg])
        if rc == 0 and out.strip() and 'not installed' not in out.lower():
            m = re.search(r'([0-9]+(?:\.[0-9]+){1,3})', out)
            if m:
                return m.group(1), f'rpm:{pkg}'
    for pkg in ['hpsmh', 'hp-smh', 'sysmgmt-homepage']:
        rc, out = run_cmd(['dpkg-query', '-W', '-f=${Version}\n', pkg])
        if rc == 0 and out.strip():
            m = re.search(r'([0-9]+(?:\.[0-9]+){1,3})', out)
            if m:
                return m.group(1), f'dpkg:{pkg}'
    return None, None


def detect_http():
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    for url in COMMON_URLS:
        try:
            req = Request(url, headers={'User-Agent': 'noisgate-check/1.0'})
            with urlopen(req, timeout=5, context=ctx) as r:
                body = r.read(65536).decode('utf-8', errors='ignore')
                headers = '\n'.join(f'{k}: {v}' for k, v in r.headers.items())
                blob = body + '\n' + headers
                for pat in PATTERNS:
                    m = re.search(pat, blob, re.IGNORECASE)
                    if m:
                        return m.group(1), f'http:{url}'
        except (URLError, HTTPError, TimeoutError, ssl.SSLError, OSError):
            continue
    return None, None


def main():
    candidates = []

    system = platform.system().lower()
    if 'windows' in system:
        for fn in (detect_windows_registry, detect_windows_wmic, detect_http):
            v, src = fn()
            if v:
                candidates.append((v, src))
    else:
        for fn in (detect_linux_pkg, detect_http):
            v, src = fn()
            if v:
                candidates.append((v, src))

    # de-duplicate while preserving order
    seen = set()
    uniq = []
    for v, src in candidates:
        if (v, src) not in seen:
            uniq.append((v, src))
            seen.add((v, src))

    if not uniq:
        print('UNKNOWN - HP System Management Homepage not confidently identified')
        sys.exit(2)

    # Prefer highest-confidence local package/registry result over HTTP banner if multiple found
    ordered = sorted(uniq, key=lambda x: 0 if x[1].startswith(('registry', 'rpm', 'dpkg', 'wmic')) else 1)
    version, source = ordered[0]
    parsed = norm_tuple(version)

    result = {
        'product': 'HP System Management Homepage',
        'detected_version': version,
        'source': source,
        'target_fixed_version': '7.4.0',
        'comparison': 'vulnerable' if cmp_version(parsed, TARGET) < 0 else 'patched'
    }

    if cmp_version(parsed, TARGET) < 0:
        print('VULNERABLE - ' + json.dumps(result, separators=(',', ':')))
        sys.exit(1)
    else:
        print('PATCHED - ' + json.dumps(result, separators=(',', ':')))
        sys.exit(0)


if __name__ == '__main__':
    main()