Load UCS Data

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346750);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_name(english:"Load UCS Data");

  script_set_attribute(attribute:"synopsis", value:"Load UCS Data");
  script_set_attribute(attribute:"description", value:"Load UCS Data");

  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"always_run", value:TRUE);
  script_set_attribute(attribute:"solution", value:"N/A");
  script_set_attribute(attribute:"risk_factor", value:"None");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");
  script_end_attributes();

  script_category(ACT_INIT);
  script_family(english:"General");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  exit(0);
}

# @collection-signature
var signature = {
  'Windows': {
    'RegKeys': [
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_os_version",
                "Key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "Name": "CurrentMajorVersionNumber"
            },
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_os_version",
                "Key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "Name": "CurrentBuildNumber"
            },
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_os_version",
                "Key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "Name": "ProductName"
            },
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_os_version",
                "Key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "Name": "SystemRoot"
            },
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_arch",
                "Key": "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment",
                "Name": "PROCESSOR_ARCHITECTURE"
            },
            {
                "Hive": "HKEY_LOCAL_MACHINE",
                "ID": "windows_hostname",
                "Key": "SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName",
                "Name": "ComputerName"
            }
    ],
    "Files": [
        {
            "ID": "windows_os_files",
            "Signature": [
                { "FilePath": { "EndsWith": "\\system32\\advapi32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\appinfo.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\bcastdvruserservice.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\bcrypt.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\coremessaging.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\crypt32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\cryptcatsvc.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\drivers\\nwifi.sys" } },
                { "FilePath": { "EndsWith": "\\system32\\drivers\\srv.sys" } },
                { "FilePath": { "EndsWith": "\\system32\\drivers\\tcpip.sys" } },
                { "FilePath": { "EndsWith": "\\system32\\gdi32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\gdiplus.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\hlink.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\inetcomm.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\ipnathlp.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\iprtrmgr.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\localspl.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\mprapi.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\ntdll.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\ntoskrnl.exe" } },
                { "FilePath": { "EndsWith": "\\system32\\oleaut32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\pcadm.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\pcasvc.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\puiobj.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\shell32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\tzres.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\user32.dll" } },
                { "FilePath": { "EndsWith": "\\system32\\win32k.sys" } },
                { "FilePath": { "EndsWith": "\\system32\\win32kfull.sys" } },
                { "FilePath": { "EndsWith": "\\system32\\winload.exe" } }
            ],
            "Get": {
                "PEVersion": [
                    {
                        "Value": "FileVersion",
                        "Label": "windows_os FileVersion"
                    }
                ]
            }
        }
    ]
  }
};

namespace load_ucs_sigmatch 
{

  function get_ucs_sigmatch_file_name()
  {
    var sigmatch_filename = strcat(nessus_get_dir(N_LIB_DIR), "/ucs/SigMatchOutput.json");
    replace_kb_item(name:"ucs/SigMatchOutput/FilePath", value:sigmatch_filename);
    return sigmatch_filename;
  }

  function load_ucs_file_from_disk()
  {
    var sigmatch_filename = get_ucs_sigmatch_file_name();
    dbg::detailed_log(lvl:1,msg:strcat("Looking for SigMatchOutput.json at: ", sigmatch_filename));
    if (!file_exists(sigmatch_filename))
    {
      dbg::detailed_log(lvl:1,msg:'SigMatchOutput.json is not present');
      return NULL; # UCS SigMatchOutput.json is not present
    }

    dbg::detailed_log(lvl:1,msg:'Loading UCS data');
    var sigMatchOutput_string = fread(sigmatch_filename);
    if (empty_or_null(sigMatchOutput_string))
    {
      dbg::detailed_log(lvl:1,msg:'SigMatchOutput.json is empty or cannot be read');
      return NULL; # UCS SigMatchOutput.json is empty or cannot be read
    }

    var sigMatchOutput_struct = deserialize(sigMatchOutput_string);
    return sigMatchOutput_struct;
  }

  function create_SigMatchData_table(){
    query_scratchpad("CREATE TABLE IF NOT EXISTS SigMatchData ( 
      id INTEGER PRIMARY KEY,
      collect_id TEXT,
      data TEXT
    );");
  }

  function insert_ucs_data_into_SigMatchData_table(&sigMatchOutput_struct)
  {
    create_SigMatchData_table();
    var SigMatchDataCount = length(sigMatchOutput_struct.SigMatchData);
    replace_kb_item(name:"ucs/SigMatchOutput/Count", value:SigMatchDataCount);
    foreach var sigMatch (sigMatchOutput_struct.SigMatchData)
    {
      query_scratchpad("INSERT INTO SigMatchData (collect_id, data) VALUES (?,?)", sigMatch.ID, serialize(sigMatch));
    }
  }

  function set_kb_keys_ucs_metadata(sigMatchOutput_struct_metadata)
  {
    if (!isnull(sigMatchOutput_struct_metadata.FileName))
      replace_kb_item(name:"ucs/Metadata/FileName", value:sigMatchOutput_struct_metadata.FileName);
    if (!isnull(sigMatchOutput_struct_metadata.TargetOS))
      replace_kb_item(name:"ucs/Metadata/TargetOS", value:sigMatchOutput_struct_metadata.TargetOS);
    if (!isnull(sigMatchOutput_struct_metadata.Collector.Name))
      replace_kb_item(name:"ucs/Metadata/Collector/Name", value:sigMatchOutput_struct_metadata.Collector.Name);
    if (!isnull(sigMatchOutput_struct_metadata.Collector.Version))
      replace_kb_item(name:"ucs/Metadata/Collector/Version", value:sigMatchOutput_struct_metadata.Collector.Version);
    if (!isnull(sigMatchOutput_struct_metadata.SchemaVersion))
      replace_kb_item(name:"ucs/Metadata/SchemaVersion", value:sigMatchOutput_struct_metadata.SchemaVersion);
  }

  function set_kb_keys_windows()
  {
    replace_kb_item(name:"SMB/Registry/Enumerated", value:true);
    replace_kb_item(name:"SMB/MS_Bulletin_Checks/Possible", value:true);
    replace_kb_item(name:"Ports/tcp/139", value:true);
    replace_kb_item(name:"Ports/tcp/445", value:true);

    # NOTE: This sets system data based on UCS data for inventory generation. May not stay here
    var os_version_rows = query_scratchpad("SELECT data FROM SigMatchData WHERE collect_id = ?", "windows_os_version");
    if (isnull(os_version_rows))
    {
      dbg::detailed_log(lvl:1,msg:'Windows OS Version not found in SigMatchData');
    }
    else
    {
      foreach var row (os_version_rows)
      {
        var sys_match = deserialize(row['data']);
        var reg_name = sys_match.CollectData.Name;
        var reg_value = sys_match.CollectData.RegValue;
        if (isnull(reg_value)) continue;
        if (reg_name == "CurrentMajorVersionNumber")
          replace_kb_item(name:"SMB/WindowsVersion", value:reg_value);
        else if (reg_name == "CurrentBuildNumber")
          replace_kb_item(name:"SMB/WindowsVersionBuild", value:reg_value);
        else if (reg_name == "ProductName")
          replace_kb_item(name:"Host/OS", value:reg_value);
        else if (reg_name == "SystemRoot")
          replace_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/SystemRoot", value:reg_value);
      }
    }

    var arch_rows = query_scratchpad("SELECT data FROM SigMatchData WHERE collect_id = ?", "windows_arch");
    if (isnull(arch_rows))
    {
      dbg::detailed_log(lvl:1,msg:'Windows Architecture not found in SigMatchData');
    }
    else
    {
      var arch_match = deserialize(arch_rows[0]['data']);
      var arch_raw = arch_match.CollectData.RegValue;
      if (!isnull(arch_raw))
      { # logic ported over from smb_enumerate_registry.nasl
        if ("64" >< arch_raw)
          replace_kb_item(name:"SMB/ARCH", value:"x86_64");
        else
          replace_kb_item(name:"SMB/ARCH", value:"x86");
      }
    }

    var hostname_rows = query_scratchpad("SELECT data FROM SigMatchData WHERE collect_id = ?", "windows_hostname");
    if (isnull(hostname_rows))
    {
      dbg::detailed_log(lvl:1,msg:'Windows Hostname not found in SigMatchData');
    }
    else
    {
      var hostname_match = deserialize(hostname_rows[0]['data']);
      var hostname_raw = hostname_match.CollectData.RegValue;
      if (!isnull(hostname_raw))
        replace_kb_item(name:"Host/hostname", value:hostname_raw);
    }

    # NOTE: This adds Windows Bulletin file data from UCS so it can be populated in the inventory. May not stay here
    var win_os_files_rows = query_scratchpad("SELECT data FROM SigMatchData WHERE collect_id = ?", "windows_os_files");
    if (isnull(win_os_files_rows))
    {
      dbg::detailed_log(lvl:1,msg:'Windows OS not found in SigMatchData');
    }
    else
    {
      foreach var win_os_file_row (win_os_files_rows)
      {
        var win_os_file_match = deserialize(win_os_file_row['data']);
        var file_path = win_os_file_match.CollectData.FilePath;
        if (isnull(file_path)) continue;

        var kb_path = "SMB/FileVersions/" + tolower(
          str_replace(string:str_replace(string:file_path, find:":", replace:""),
                      find:"\", replace:"/"));

        foreach var md (win_os_file_match.MatchData)
        {
          if (md.Label == "windows_os FileVersion" && !isnull(md.Values) && max_index(md.Values) > 0)
          {
            replace_kb_item(name:kb_path, value:md.Values[0]);
            break;
          }
        }
      }
    }
  }

  function set_kb_keys_linux()
  {
    # TODO: Implement Linux-specific KB key setting
    replace_kb_item(name:"Host/hostname", value:"localhost");
    replace_kb_item(name:"Host/cpu", value:"x64");
    replace_kb_item(name:"Host/uname", value:"Linux tar1wa 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7 15:06:04 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux\n");
    replace_kb_item(name:"Host/uname-r", value:"5.15.0-190-generic");
    replace_kb_item(name:"Host/uname-v", value:"#200-Ubuntu SMP Fri Aug 7 15:06:04 UTC 2026");
    replace_kb_item(name:"Host/uname/major_minor", value:"5.15");
  }

  function set_kb_keys(sigMatchOutput_struct_metadata)
  {
    set_kb_keys_ucs_metadata(sigMatchOutput_struct_metadata:sigMatchOutput_struct_metadata);

    if (sigMatchOutput_struct_metadata.TargetOS == "Windows") set_kb_keys_windows();
    else if (sigMatchOutput_struct_metadata.TargetOS == "Linux") set_kb_keys_linux();
    else return NULL;

    replace_kb_item(name:"goosin/ran", value:true); #legacy name, to be removed in favor of ucs/ran in the future
    replace_kb_item(name:"ucs/ran", value:true);
    replace_kb_item(name:"Host/local_checks_enabled", value:true);
    replace_kb_item(name:"Host/TCP/scanned", value:true);
  }

  function run()
  {
    var sigMatchOutput_struct = load_ucs_file_from_disk();
    if (isnull(sigMatchOutput_struct)) return {"state":"error","msg":"UCS Data is not loaded"};

    insert_ucs_data_into_SigMatchData_table(sigMatchOutput_struct:sigMatchOutput_struct);
    
    set_kb_keys(sigMatchOutput_struct_metadata:sigMatchOutput_struct.Metadata);

    return {"state":"success","msg":"UCS Data loaded successfully"};
  }
}

function load_ucs()
{
  if (CLI_SCAN)
  {
    dbg::enable();
    dbg::set_log_level(4);
    dbg::detailed_log(lvl:1,msg:'Running from CLI\n');
  }

  var run_result = load_ucs_sigmatch::run();
  replace_kb_item(name:"ucs/SigMatchOutput/RunResult", value:run_result.msg);
  if (run_result.state == "error")
  {
    exit(0, run_result.msg);
  }

  if (CLI_SCAN)
  { ## Used for developer testing from the CLI
    while (true)
    {
      var collect_id = prompt("Enter collect_id to query ('quit' to exit) :");
      if (collect_id == "quit") break;
      var output = query_scratchpad("SELECT * from SigMatchData where collect_id LIKE ?;", collect_id);
      dbg::detailed_log(lvl:1,msg:serialize(output));
    }
  }
}

global_var CLI_SCAN = false;
if (empty_or_null(get_preference("plugins_folder")))
{
  CLI_SCAN = true;
}
else
{
  # prevent UCS from running unless it is specifically configured to run in the preferences
  var ucs_enabled = get_preference("ucs_enabled");
  replace_kb_item(name:"ucs/enabled", value:typeof(ucs_enabled));
  if (empty_or_null(ucs_enabled)) exit(0, "UCS is not enabled");
}

load_ucs();