recon.py

# -*- coding: utf-8 -*-
#!/usr/bin/env python
import subprocess
import multiprocessing
from multiprocessing import Process, Queue
import os
import time
import fileinput
import atexit
import sys
import socket
import argparse
import nmap
import re
from time import sleep

start = time.time()

class bcolors:
    HEADER = '\033[00;31m'
    TITLE = '\033[0;33m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

def parse_args():
    parser = argparse.ArgumentParser(description='Automate the recon process')
    parser.add_argument('-f', '--dir', help='Local directory where information should be written to',
                        required=True)
    group = parser.add_mutually_exclusive_group()
    group.add_argument('-i', '--ip', help='IP or IPRange')
    group.add_argument('-d','--dns', help='DNS Hostname/Domain')
    return parser.parse_args()

def main():
    args = parse_args()
    ip = args.ip
    domain = args.dns
    dir = args.dir
    dir = os.path.abspath(dir) + "/"

    print bcolors.HEADER + '#############################' + bcolors.ENDC
    print bcolors.TITLE + 'Basic Recon & Enumeration' + bcolors.ENDC
    print bcolors.HEADER + '#############################' + bcolors.ENDC

    if ip is None:
        p = multiprocessing.Process(target=dnsRecon, args=(domain,dir,))
        p.start()
    else:
        activeHosts = netdiscover(ip, dir)
        p = multiprocessing.Process(target=tcpScan, args=(activeHosts,))
        p.start()
        p = multiprocessing.Process(target=udpScan, args=(activeHosts,))
        p.start()

def multProc(targetin, scanip, port, dir):
    jobs = []
    p = multiprocessing.Process(target=targetin, args=(scanip,port,dir,))
    jobs.append(p)
    p.start()
    return

def dnsRecon(domain, dir):
    print bcolors.TITLE + "\n[*] Gathering DNS information..." + bcolors.ENDC
    resolve_to_ip = 'dig +short ' + domain
    results_resolve_to_ip = subprocess.check_output(resolve_to_ip, shell=True)
    print "\t" + domain + " ---> " + results_resolve_to_ip.strip()
    dnsrecon = "dnsrecon -D /usr/share/wordlists/dnsmap.txt -t std -d %s --xml '%sdns_information_%s'" % (domain, dir, resolve_to_ip)
    results_dnsrecon = subprocess.check_output(dnsrecon, shell=True)
    print bcolors.TITLE + "[*] DNS information collected\n"
    activeHosts = netdiscover(results_resolve_to_ip, dir)

def netdiscover(ip, dir):
    activeHosts = []
    print bcolors.OKGREEN + "[*] Netdiscovery started" + bcolors.ENDC
    nm = nmap.PortScanner()
    nm.scan(hosts=ip, arguments='-sn', sudo=True)
    hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
    for host in hosts_list:
        host_to_scan = Host(host[0],nm[host[0]].hostname(), dir, nm[host[0]].state())
        activeHosts.append(host_to_scan)
    print bcolors.OKGREEN + "[*] Netdiscovery finished. Found " + str(len(activeHosts)) + " active host(s)." + bcolors.ENDC
    print "\t-------------------"
    for host in hosts_list:
        ipString = '{:^15}'.format(str(host[0]))
        print "\t| " + ipString + " |"
    print "\t-------------------"
    return activeHosts

def tcpScan(activeHosts):
    ipList = getStringList(activeHosts)
    print bcolors.OKGREEN + "[*] TCP Scan running..." + bcolors.ENDC
    nm = nmap.PortScanner()
    nm.scan(hosts=ipList, arguments='-sS -T4 -Pn -p- --open', sudo=True)
    parseTcpAndUdp(nm, activeHosts, 'TCP')
    print bcolors.OKGREEN + "[*] TCP Scan finished" + bcolors.ENDC
    p = multiprocessing.Process(target=serviceScan, args=(activeHosts,'TCP',))
    p.start()

def udpScan(activeHosts):
    ipList = getStringList(activeHosts)
    ports = []
    print bcolors.OKGREEN + "[*] UDP Scan running..." + bcolors.ENDC
    nm = nmap.PortScanner()
    nm.scan(hosts=ipList, arguments='-sU -T4 -Pn -sC --top-ports 200 --open', sudo=True)
    parseTcpAndUdp(nm, activeHosts, 'UDP')
    print bcolors.OKGREEN + "[*] UDP Scan finished" + bcolors.ENDC
    p = multiprocessing.Process(target=serviceScan, args=(activeHosts,'UDP',))
    p.start()

def parseTcpAndUdp(nm, activeHosts, proto):
    for host in nm.all_hosts():
        for proto in nm[host].all_protocols():
            ports = []
            lport = list(nm[host][proto].keys())
            lport.sort()
            for port in lport:
                port_host = Port(port, proto)
                ports.append(port_host)
            for activeHost in activeHosts:
                if activeHost.getIp() == str(host):
                    if proto == 'UDP':
                        activeHost.setUdpPorts(ports)
                    else:
                        activeHost.setTcpPorts(ports)

def getStringList(activeHosts):
    ipList = ""
    for host in activeHosts:
        ipList += host.getIp() + " "
    return ipList

def serviceScan(activeHosts, proto):
    for activeHost in activeHosts:
        portsToBeScanned = ""
        portList = activeHost.getPorts(proto)
        for port in portList:
            portsToBeScanned += str(port.getPortNumber()) + ","
        portsToBeScanned = portsToBeScanned[:-1]
        if len(portList) != 0:
            print bcolors.OKGREEN + "[*] " + proto + " Service Scan running..." + bcolors.ENDC
            NMAP_ServiceScan = "nmap -sV -A -T4 -Pn -oN '" + activeHost.getDir() + "Nmap_results.nmap' -p" + portsToBeScanned + " " + activeHost.getIp()
            results_servicescan = subprocess.check_output(NMAP_ServiceScan, shell=True)
            initServiceTesting(results_servicescan, activeHost, proto)
        else:
            print bcolors.OKBLUE + "[*] No open " + proto + " ports found." + bcolors.ENDC

def initServiceTesting(results, activeHost, proto):
    lines = results.split("\n")
    ports = activeHost.getPorts(proto)
    count = 0
    for line in lines:
        line = line.strip()
        if ("tcp" in line) and ("open" in line) and not ("Discovered" in line):
            while "  " in line:
                line = line.replace("  ", " ");
            linesplit = line.split(" ")

            service = linesplit[2]
            port_ = linesplit[0]
            port_ = re.sub(r'/.*', '', port_)
            ports[count].setService(service)
            count += 1
    print bcolors.OKGREEN + "[*] " + proto + " Service Scan finished" + bcolors.ENDC

    for port in ports:
        serv = port.getService()
        if (serv == "http") or (serv == "http-proxy") or (serv == "http-alt") or (serv == "http?"):
            multProc(httpEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif (serv == "ssl/http") or ("https" == serv) or ("https?" == serv):
            multProc(httpsEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "smtp":
            multProc(smtpEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "ftp":
            multProc(ftpEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif (serv == "microsoft-ds") or (serv == "netbios-ssn"):
            multProc(smbEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
            multProc(smbNmap, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "ms-sql":
            multProc(mssqlEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "ssh":
            multProc(sshScan, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "msrpc":
            multProc(rpcEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "oracle-tns":
            multProc(oracleTnsEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())
        elif serv == "snmp":
            multProc(snmpEnum, activeHost.getIp(), str(port.getPortNumber()), activeHost.getDir())


def connect_to_port(ip_address, port, service, dir):
    total_communication = ""
    service = ""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip_address, int(port)))
    banner = s.recv(1024)

    if service == "ftp":
        s.send("USER anonymous\r\n")
        user = s.recv(1024)
        s.send("PASS anonymous\r\n")
        password = s.recv(1024)
        total_communication = banner + "\r\n" + user + "\r\n" + password
    elif service == "smtp":
        total_communication = banner + "\r\n"
    elif service == "ssh":
        total_communication = banner
    elif service == "pop3":
        s.send("USER root\r\n")
        user = s.recv(1024)
        s.send("PASS root\r\n")
        password = s.recv(1024)
        total_communication = banner +  "\r\n" + user + "\r\n" + password
    s.close()

    f = open(dir + "/1. Recon/Service_banner_information.txt", "w+")
    f.write(service + "\r\n" + total_communication + "\r\n#######################################\r\n")
    f.close()

def oracleTnsEnum(ip_address, port, dir):
    print "INFO: Detected Oracle TNS Listener on " + ip_address + ":" + port
    ORACLETNSv = "tnscmd10g version -h %s -p %s | tee '%sOracle_TNS_%s_%s.txt'" % (ip_address, port, dir, ip_address, port)
    ORACLETNSs = "tnscmd10g status -h %s -p %s | tee -a '%sOracle_TNS_%s_%s.txt'" % (ip_address, port, dir, ip_address, port)
    results_oracletnsv = subprocess.check_output(ORACLETNSv, shell=True)
    results_oracletnss = subprocess.check_output(ORACLETNSs,shell=True)
    print "INFO: Finished with OracleTNS scan for " + ip_address + ":" + port
    return

def rpcEnum(ip_address, port, dir):
    print "INFO: Detected RPC on " + ip_address + ":" + port
    print "INFO: Starting RPC script nmap scan " + ip_address + ":" + port
    RPCSCAN = "nmap -p %s --script=msrpc-enum %s -oN '%sRPC-Nmap_%s_%s.nmap'" % (port, ip_address, dir, ip_address, port)
    results_rpc = subprocess.check_output(RPCSCAN, shell=True)
    print "INFO: Finished with RPC script nmap scan for " + ip_address + ":" + port
    return

def dirb_soft(ip_address, port, url_start, dir):
    print "INFO: Starting soft dirb scan for " + ip_address + ":" + port
    DIRBSCAN = "dirb %s://%s:%s /usr/share/wordlists/dirb/big.txt -o '%sdirb_%s_%s.txt' " % (url_start, ip_address, port, dir, ip_address, port)
    results_dirb = subprocess.check_output(DIRBSCAN, shell=True)
    print "INFO: Finished with soft dirb scan for " + ip_address + ":" + port
    return

def dirb_hard(ip_address, port, url_start, dir):
    print "INFO: Starting hard dirb scan for " + ip_address + ":" + port
    DIRBSCAN = "dirb %s://%s:%s /usr/share/wordlists/dirb/big.txt -x /usr/share/wordlists/dirb/extensions_common.txt -o '%sdirb_hard_%s_%s.txt' " % (url_start, ip_address, port, dir, ip_address, port)
    results_dirb = subprocess.check_output(DIRBSCAN, shell=True)
    print "INFO: Finished with hard dirb scan for " + ip_address + ":" + port
    return

def nikto(ip_address, port, url_start, dir):
    print "INFO: Starting nikto scan for " + ip_address + ":" + port
    NIKTOSCAN = "nikto -h %s://%s:%s -p %s -o '%snikto_%s_%s_%s.txt' -Format txt -Tuning 1,2,3,a,b,d,e" % (url_start, ip_address, port, port, dir, url_start, ip_address, port)
    results_nikto = subprocess.check_output(NIKTOSCAN, shell=True)
    print "INFO: Finished with NIKTO-scan for " + ip_address + ":" + port
    return

def httpEnum(ip_address, port, dir):
    print "INFO: Detected http on " + ip_address + ":" + port
    print "INFO: Performing nmap web script scan for " + ip_address + ":" + port

    dirb_soft_process = multiprocessing.Process(target=dirb_soft, args=(ip_address,port,"http", dir,))
    dirb_soft_process.start()
    dirb_hard_process = multiprocessing.Process(target=dirb_hard, args=(ip_address,port,"http", dir,))
    dirb_hard_process.start()
    nikto_process = multiprocessing.Process(target=nikto, args=(ip_address,port,"http", dir))
    nikto_process.start()

    HTTPSCAN = "nmap -sV -Pn -vv -p %s --script=http-vhosts,http-userdir-enum,http-apache-negotiation,http-backup-finder,http-config-backup,http-default-accounts,http-methods,http-method-tamper,http-passwd,http-robots.txt,http-devframework,http-enum,http-frontpage-login,http-git,http-iis-webdav-vuln,http-php-version,http-shellshock,http-vuln-cve2015-1635,http-vuln-cve2006-3392,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-apache-server-status,http-vuln-cve2013-7091,http-aspnet-debug,http-vuln-cve2014-2126,http-enum,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-trace,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-useragent-tester,http-vuln-cve2017-5689,http-vuln-cve2017-8917 -oN '%shttp_%s_%s.nmap' %s" % (port, dir, ip_address, port, ip_address)

    http_results = subprocess.check_output(HTTPSCAN, shell=True)
    print "INFO: Finished with HTTP-SCAN for " + ip_address + ":" + port
    return

def httpsEnum(ip_address, port, dir):
    print "INFO: Detected https on " + ip_address + ":" + port
    print "INFO: Performing nmap web script scan for " + ip_address + ":" + port

    dirb_soft_process = multiprocessing.Process(target=dirb_soft, args=(ip_address,port,"https", dir,))
    dirb_soft_process.start()
    dirb_hard_process = multiprocessing.Process(target=dirb_hard, args=(ip_address,port,"https", dir,))
    dirb_hard_process.start()
    nikto_process = multiprocessing.Process(target=nikto, args=(ip_address,port,"https", dir,))
    nikto_process.start()

    dir = dir.replace(" ", "\ ")
    SSLSCAN = "sslscan %s:%s >> %sssl_scan_%s_%s" % (ip_address, port, dir, port, ip_address)
    ssl_results = subprocess.check_output(SSLSCAN, shell=True)
    print "INFO: CHECK FILE - Finished with SSLSCAN for " + ip_address + ":" + port

    dir = dir.replace("\ ", " ")
    HTTPSCANS = "nmap -sV -Pn -vv -p %s --script=http-vhosts,http-userdir-enum,http-apache-negotiation,http-backup-finder,http-config-backup,http-default-accounts,http-methods,http-method-tamper,http-passwd,http-robots.txt,http-devframework,http-enum,http-frontpage-login,http-git,http-iis-webdav-vuln,http-php-version,http-shellshock,http-vuln-cve2015-1635,http-vuln-cve2006-3392,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786http-apache-server-status,http-vuln-cve2013-7091,http-aspnet-debug,http-vuln-cve2014-2126,http-enum,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-trace,http-vuln-cve2015-1635,http-vuln-cve2017-1001000,http-vuln-cve2017-5638,http-useragent-tester,http-vuln-cve2017-5689,http-vuln-cve2017-8917 -oN '%shttp_%s_%s.nmap' %s" % (port, dir, ip_address, port, ip_address)

    https_results = subprocess.check_output(HTTPSCANS, shell=True)
    print "INFO: Finished with HTTPS-scan for " + ip_address + ":" + port
    return

def mssqlEnum(ip_address, port, dir):
    print "INFO: Detected MS-SQL on " + ip_address + ":" + port
    print "INFO: Performing nmap mssql script scan for " + ip_address + ":" + port
    MSSQLSCAN = "nmap -sV -Pn -p %s --script=ms-sql-info,ms-sql-config,ms-sql-dump-hashes --script-args=mssql.instance-port=1433,smsql.username-sa,mssql.password-sa -oN '%smssql_%s_%s.nmap' %s" % (port, dir, ip_address, port,  ip_address)
    mssql_results = subprocess.check_output(MSSQLSCAN, shell=True)
    print "INFO: Finished with MSSQL-scan for " + ip_address + ":" + port
    return

def smtpEnum(ip_address, port, dir):
    print "INFO: Detected smtp on " + ip_address + ":" + port
    connect_to_port(ip_address, port, "smtp", dir)
    SMTPSCAN = "nmap -sV -Pn -p %s --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 %s -oN '%ssmtp_%s_%s.nmap'" % (port, ip_address, dir, port, ip_address)
    smtp_results = subprocess.check_output(SMTPSCAN, shell=True)
    print "INFO: Finished with SMTP-scan for " + ip_address + ":" + port
    return

def smbNmap(ip_address, port, dir):
    print "INFO: Detected SMB on " + ip_address + ":" + port
    smbNmap = "nmap --script=smb2-capabilities,smb-double-pulsar-backdoor,smb-enum-shares,smb-os-discovery,smb-server-stats,smb-vuln-cve-2017-7494,smb-vuln-ms10-061,smb2-security-mode,smb-enum-domains,smb-enum-users,smb-print-text,smb-system-info,smb-vuln-ms06-025,smb-vuln-ms17-010,smb2-time,smb-enum-groups,smb-protocols,smb-vuln-ms07-029,smb2-vuln-uptime,smb-enum-processes,smb-ls,smb-psexec,smb-vuln-conficker,smb-vuln-ms08-067,smb-enum-sessions,smb-mbenum,smb-security-mode,smb-vuln-cve2009-3103,smb-vuln-ms10-054 %s -oN '%ssmb_%s_%s.nmap'" % (ip_address, dir, ip_address, port)

    smbNmap_results = subprocess.check_output(smbNmap, shell=True)
    print "INFO: Finished with SMB-Nmap-scan for " + ip_address + ":" + port
    return

def smbEnum(ip_address, port, dir):
    print "INFO: Detected SMB on " + ip_address + ":" + port
    dir = dir.replace(" ", "\ ")
    enum4linux = "enum4linux -a %s > %senum4linux_%s_%s" % (ip_address, dir, ip_address, port)
    enum4linux_results = subprocess.check_output(enum4linux, shell=True)
    print "INFO: CHECK FILE - Finished with ENUM4LINUX-Nmap-scan for " + ip_address + ":" + port
    return

def ftpEnum(ip_address, port, dir):
    print "INFO: Detected ftp on " + ip_address + ":" + port
    connect_to_port(ip_address, port, "ftp", dir)
    FTPSCAN = "nmap -sV -Pn -vv -p %s --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221 -oN '%sftp_%s_%s.nmap' %s" % (port, dir, ip_address, ip_address, port)
    results_ftp = subprocess.check_output(FTPSCAN, shell=True)
    print "INFO: Finished with FTP-Nmap-scan for " + ip_address + ":" + port
    return

def snmpEnum(ip_address, port, dir):
    print "INFO: Detected SNMP on " + ip_address + ":" + port
    SNMPWALK = "snmpwalk -c public -v1 %s | tee '%ssnmp_%s_%s.txt'" % (ip_address, dir, ip_address, port)
    results_snmpwalk = subprocess.check_output(SNMPWALK, shell=True)
    ONESIXTYONE = "onesixtyone -c community-names-snmp.txt -i %s | tee -a '%ssnmp_%s_%s.txt'" % (ip_address, dir, ip_address, port)
    results_onesixtyone = subprocess.check_output(ONESIXTYONE, shell=True)
    print "INFO: Finished with SNMP scan for " + ip_address + ":" + port

def sshScan(ip_address, port, dir):
    print "INFO: Detected SSH on " + ip_address + ":" + port
    connect_to_port(ip_address, port, "ssh", dir)

def pop3Scan(ip_address, port, dir):
    print "INFO: Detected POP3 on " + ip_address + ":" + port
    connect_to_port(ip_address, port, "pop3", dir)

class Host:
    def __init__(self, ip, hostname, dir, state):
        self.ip = ip
        self.hostname = hostname
        self.dir = dir
        self.state = state
        self.tcpPorts = []
        self.udpPorts = []

        self.createFolderStructure()

    def createFolderStructure(self):
        if not os.path.exists(self.dir):
            os.makedirs(self.dir)

        dirs = os.listdir(self.dir)
        if not self.ip in dirs:
            os.mkdir(self.dir + self.ip)
            os.mkdir(self.dir + self.ip + "/1. Recon/")
            os.mkdir(self.dir + self.ip + "/2. Exploit/")
            os.mkdir(self.dir + self.ip + "/3. Privilege Escalation/")
        self.setDir(self.dir + self.ip + "/1. Recon/")

    def setDir(self,dir):
        self.dir = dir

    def setTcpPorts(self, ports):
        self.tcpPorts = ports

    def setUdpPorts(self, ports):
        self.UdpPorts = ports

    def getIp(self):
        return self.ip

    def getDir(self):
        return self.dir

    def getState(self):
        return self.state

    def getPorts(self,proto):
        if proto == 'TCP':
            return self.tcpPorts
        else:
            return self.udpPorts

    def getHostname(self):
        return self.hostname

class Port:
    def __init__(self, portNumber, proto):
        self.portNumber = portNumber
        self.proto = proto
        self.service = None

    def getPortNumber(self):
        return self.portNumber

    def getService(self):
        return self.service

    def setPortNumner(self, portNumber):
        self.portNumber = portNumber

    def setService(self, service):
        self.service = service

if __name__=='__main__':
    exit(main())