Skip to content

Instantly share code, notes, and snippets.

@obihann
Last active January 10, 2018 18:59
Show Gist options
  • Select an option

  • Save obihann/5609c4f38c6db33d0604a1b02d4de07e to your computer and use it in GitHub Desktop.

Select an option

Save obihann/5609c4f38c6db33d0604a1b02d4de07e to your computer and use it in GitHub Desktop.
function ImpactSwitch($imp){
switch ($imp)
{
1 {$imp = 0}
2 {$imp = 0.275}
3 {$imp = 0.660}
}
return $imp
}
$accessVector = Read-Host "What is the access vector?`n 1) Local`n 2) Adjacent`n 3) Network`n"
$accessComplexity = Read-Host "What is the access complexity?`n 1) High`n 2) Medium`n 3) Low`n"
$authentication = Read-Host "What level of authentication is required?`n 1) Multiple Instances`n 2) Single Instance`n 3) No Authentication`n"
$confImpact = ImpactSwitch(Read-Host "What is the level of impact on confidentiality?`n 1) None`n 2) Partial`n 3) Complete`n")
$integImpact = ImpactSwitch(Read-Host "What is the level of impact on integrigy?`n 1) None`n 2) Partial`n 3) Complete`n")
$availImpact = ImpactSwitch(Read-Host "What is the level of impact on availability?`n 1) None`n 2) Partial`n 3) Complete`n")
switch ($accessVector)
{
1 {$accessVector = 0.395}
2 {$accessVector = 0.646}
3 {$accessVector = 1.0}
}
switch ($accessComplexity)
{
1 {$accessComplexity = 0.35}
2 {$accessComplexity = 0.61}
3 {$accessComplexity = 0.71}
}
switch ($authentication)
{
1 {$authentication = 0.45}
2 {$authentication = 0.56}
3 {$authentication = 0.704}
}
$impact = 10.41 * (1 - (1 - $confImpact) * (1 - $integImpact) * (1 - $availImpact))
$exploitability = 20 * $accessVector * $accessComplexity * $authentication
$baseScore = "{0:N2}" -f (((0.6 * $impact) + (0.4 * $exploitability) - 1.5) * $(If ($impact -ne 0) {1.176} Else {0}))
Write-Output "Base score is: $baseScore"
$values = @{}
$coefficients = @{
'exp' = 8.22
'scope' = 1.08
}
$scores = @{
'impactSub' = 0
'exploitabalitySub' = 0
'base' = 0
}
$metrics = @{
'attack' = @{
'n' = 0.85
'a' = 0.62
'l' = 0.55
'p' = 0.22
}
'complexity' = @{
'l' = 0.77
'h' = 0.44
}
'privilage' = @{
'n' = 0.85
'l' = 0.62
'h' = 0.27
}
'user' = @{
'n' = 0.85
'r' = 0.62
}
'scope' = @{
'u' = 6.42
'c' = 7.52
}
'cia' = @{
'n' = 0
'l' = 0.22
'h' = 0.56
}
}
$values['attack'] = $(Read-Host "What is the attack vector?`n [p]hysical, [l]ocal, [a]djacent, [n]etwork")
$values['complexity'] = $(Read-Host "What is the attack complexity?`n [l]ow, [h]igh")
$values['privilage'] = $(Read-Host "What is the level of privilage required?`n [n]one, [l]ow, [h]igh")
$values['user'] = $(Read-Host "What is the level of user interaction required?`n [n]one, [r]equired")
$values['scope'] = Read-Host "How does this effect the scope?`n [u]nchanged, [c]hanged"
$values['c'] = $(Read-Host "What is the level of impact on confidentiality?`n [n]one, [l]ow, [h]igh")
$values['i'] = $(Read-Host "What is the level of impact on integrity?`n [n]one, [l]ow, [h]igh")
$values['a'] = $(Read-Host "What is the level of impact on availability?`n [n]one, [l]ow, [h]igh")
$vectorString = ("CVSS:3.0/AV:" + $values['attack'] + "/AC:" + $values['complexity'] + "/PR:" + $values['privilage'] + "UI:" + $values['user'] + "/S:" + $values['scope'] + "/C:" + $values['c'] + "/I:" + $values['i'] + "/A:" + $values['a']).ToUpper()
$scores['exploitabalitySub'] = $coefficients['exp'] * $metrics['attack'][$values['attack']] * $metrics['complexity'][$values['complexity']] * $metrics['privilage'][$values['privilage']] * $metrics['user'][$values['user']]
$impactSubMultiplier = 1 - ((1 - $metrics['cia'][$values['c']]) * (1 - $metrics['cia'][$values['i']]) * (1 - $metrics['cia'][$values['a']]))
switch ($values['scope'])
{
'u' {$scores['impactSub'] = [math]::Round($metrics['scope']['u'] * $impactSubMultiplier, 1)}
'c' {$scores['impactSub'] = [math]::Round($metrics['scope']['c'] * ($impactSubMultiplier - 0.029) - 3.25 * [math]::Pow(($impactSubMultiplier - 0.02), 15), 1)}
}
if ($scores['impactSub'] -gt 0)
{
switch ($values['scope'])
{
'u' {$scores['base'] = [math]::Round(($scores['impactSub'] + $scores['exploitabalitySub']), 1)}
'c' {$scores['base'] = [math]::Round($coefficients['scope'] * ($scores['impactSub'] * $scores['exploitabalitySub']), 1)}
}
}
Write-Output "Base score is: " $scores['base']
Write-Output "Vector String: $vectorString"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment