Package: centrifuge-cli
Centrifuge is an automated firmware analysis platform. It allows users to upload
their firmware images to be analyzed for various security issues. This utility
gives users the ability to interact and automate tasks via the Centrifuge
RESTful API.FeaturesUpload firmwareDelete firmware reportsQuery firmware analysis resultsSearch for firmware uploadsQuick StartCheck your Python version (must be 3.6 or later):$python--versionTo install the Centrifuge CLI, simply:$pipinstallcentrifuge-cliConfigure your environment:$exportCENTRIFUGE_APIKEY=xxxx$exportCENTRIFUGE_URL=https://centrifuge.refirmlabs.com# change this if you're single tenant or on-premiseTo query the list of available reports:$centrifugereportslistUnder the hood the Centrifuge CLI is using python Pandas data frames to report
the results to the user. Since the API is json, which has hierarchical structure
to it, we have chosen to flatten all the results into a column/row format for
viewing inside of a terminal or for importing into spreadsheets, etc. However
the cli can also output CSV, and the original json results. For example:CSV:$centrifuge--outfmt=csvreportslistJSON:$centrifuge--outfmt=jsonreportslistWhen generating the human-readable Pandas output or when generating CSV you have
the option of choosing which columns you wish to export. For example, to display
only the original filename and model number of the firmware that was uploaded:$centrifuge-foriginalFilename-fdevicereportslistUploading FirmwareUploading firmware to centrifuge is quite simple. All you need to do is supply
make/model/version and the file you want to upload:$centrifugeupload--make=Linksys--model=E1200--version=1.0.04/path/to/FW_E1200_v1.0.04.001_US_20120307.binSearching Through Firmware UploadsYou can search through the uploaded firmware for keywords in username, filename, make, model, etc:$centrifugereportssearch"Linksys"Querying Report ResultsAll the following commands require access to what we refer to as a “UFID” or
Upload File ID. This ID can be seen through the web interface, its also the last
part of the URL when viewing a report, it is also theidfield when running
thecentrifuge reports listcommand above. It should also be noted that all of
these commands also support the--outfmtargument so you can export to CSV and
to JSON. However be aware that these arguments are positional in nature, you
must supply the--outfmtargument betweencentrifugeandreporton the
command line or it will not be accepted.You can see the available commands by viewing the help output:$centrifugereport--helpUsage:centrifugereport[OPTIONS]COMMAND[ARGS]...Options:--ufidIDCentrifugereportID[required]--helpShowthismessageandexit.Commands:binary-hardeningcertificatescheck-policycode-emulatedcode-staticcode-summarycryptodeprecated(usecertificates,public-keys,and...deleteguardianinfopasshashprivate-keyspublic-keyssbomsecurity-checklistGet basic information about the report (User, Make, Model, Version, filename, etc):$centrifugereport--ufid=<REPORT_ID>infoGet Guardian Results:$centrifugereport--ufid=<REPORT_ID>guardianGet Password Hashes:$centrifugereport--ufid=<REPORT_ID>passhashGet Certificates:$centrifugereport--ufid=<REPORT_ID>certificatesGet Public Keys:$centrifugereport--ufid=<REPORT_ID>public-keysGet Private Keys:$centrifugereport--ufid=<REPORT_ID>private-keysGet SBOM Results:$centrifugereport--ufid=<REPORT_ID>sbomGet Security Checklist Results:$centrifugereport--ufid=<REPORT_ID>security-checklistGet Legacy Crypto Results (firmware uploaded before September 30th 2019). Refer tocertificates,public-key, andprivate-keynow.$centrifugereport--ufid=<REPORT_ID>cryptoThe code analysis section is a little bit more complicated, since the data is
more structured. To understand how to access this data you need to understand
that when we process a firmware we must extract it first, each time we extract a
filesystem or file container those groups of files are given anextraction IDorEXID. To get code analysis results for an individual file you must know theEXIDand the file’sPATHwithin that EXID. Luckily there is acode-summarycommand which will give you the data you need to find into thecode-staticandcode-emulatedcommands.Get a Summary of the Code Analysis:$centrifugereport--ufid=<REPORT_ID>code-summaryWhen looking at the results above from thecode-summarycommand you need to
record theexidandpath(NOTfullPath), to feed into the next two commands.Get static code analysis results:$centrifugereport--ufid=<REPORT_ID>code-static--exid=<EXID>--path=<PATH>Get emulated code analysis results:$centrifugereport--ufid=<REPORT_ID>code-emulated--exid=<EXID>--path=<PATH>Deleting Firmware UploadsDeleting a previously uploaded firmware is an unrecoverable action. Unlike the
web interface the command line interface will not prompt you if you are sure.
So use this command carefully.To delete a firmware:$centrifugereport--ufid=<REPORT_ID>deleteChecking Against a Policy YAMLYou can check that the results of a firmware analysis are within compliance criteria
defined in a yaml file. Example usage:$centrifugereport--ufid=<REPORT_ID>check-policy--policy-yaml=<PATHTOYAML>More information on this feature can be found in thePolicy Documentation.Gathering Upload StatisticsFor deployments that support multiple organizations or business units we have the ability
to gather useful statistics for the uploaded firmware based on organization. One command
will simply give you the total number of firmware that each organization uploaded, the other
command will give more detailed information about each upload.To summarize multiple organizations you need to be an Administrator. If these commands are
run by a non-admin, instead of summarizing multiple organizations it will summarize the users
within that organization.To get upload count statistics:$centrifugereportsstats-summaryTo get detailed upload statistics:$centrifugereportsstats-detailedListing Centrifuge Supported Component DetectorsCentrifuge uses binary heuristic detection to identify 3rd party components in firmware,
and also maps known vulnerabilities (CVEs) to those components. New components and CVEs
are added regularly to Centrifuge.To get a list of the supported components and a count of CVEs for each component:$centrifugesupported-components