pwn 0.4.669 → 0.4.671

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e96159a287c2265adb91e39a706e3c0a9548ddd2ba8d074578f2934e2775fe10
-  data.tar.gz: 2b4974403902f379fa8f2784c77092133f78efd2cba81ab5ca484f1312e4a6e3
+  metadata.gz: 7da5c11247c09b3a6355dd825d5b200c7b54845d2b02b4a91a2b651ac6e0f693
+  data.tar.gz: 8ae730c8dcc7af833543ac7b999fb075dd53e64cfb8a348791caadc03bf16c4a
 SHA512:
-  metadata.gz: a430615e3224be664dfe9a5a0c0f0c9bd5c91187bad66f512cddcd2d49eae7774f434d5df04f1460a2643812a93fc6e14ff6920daaeda644d825c7f5309b071e
-  data.tar.gz: 220f9d349bba6b0ccff98969372369faf2d562ae6de83811accdc8d0c604f86ff0e22fc513564ef487041eaa88e957eed1d29ad986df60ccf83a9e235d7821e3
+  metadata.gz: 7480b0859bedc2c26bc36fef113eeb0981169f500edfe0d3ece6a69b36a5c5e10bffc052c0640d705620e456233254224df1d5a8bb904b3301189572d8d0a2d9
+  data.tar.gz: 6486d7ffa7d468d772639c8666594e21b326de1a5acbafad7fdc966746237df97ed43e7883016d98df3692ad2c0b0a7b623a73162885da0f196f0b1260050375

data/README.md

@@ -37,7 +37,7 @@ $ rvm use ruby-3.2.2@pwn
 $ rvm list gemsets
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.669]:001 >>> PWN.help
+pwn[v0.4.671]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.2.2@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.669]:001 >>> PWN.help
+pwn[v0.4.671]:001 >>> PWN.help
 ```
 
 

data/bin/pwn_nmap_discover_tcp_udp

@@ -0,0 +1,195 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'optparse'
+require 'nokogiri'
+require 'pwn'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-IRANGE', '--ip-range=RANGE', '<Required - nmap supported ip range e.g. 192.168.1.1-20, 192.168.1.0/24, etc>') do |i|
+    opts[:ip_range] = i
+  end
+
+  options.on('-eFILE', '--target-exclude-file=FILE', '<Optional - nmap excludes file>') do |e|
+    opts[:exclude_file] = e
+  end
+
+  options.on('-iINTERFACE', '--interface=INTERFACE', '<Optional - use specified network interface (Default: eth0)') do |i|
+    opts[:interface] = i
+  end
+
+  options.on('-T', '--tor', '<Optional - Source Scans from Tor Nodes>') do |t|
+    opts[:with_tor] = t
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+ip_range = opts[:ip_range]
+exclude_file = opts[:exclude_file]
+exclude_file ||= '/tmp/nmap_targets_exclude.txt'
+interface = opts[:interface]
+interface ||= 'eth0'
+with_tor = true if opts[:with_tor]
+with_tor ||= false
+if with_tor
+  tor_obj = PWN::Plugins::Tor.start
+  proxy = "socks4://#{tor_obj[:ip]}:#{tor_obj[:port]}"
+end
+
+File.new(exclude_file, 'w') unless File.exist?(exclude_file)
+nmap_results_root = File.dirname(exclude_file)
+FileUtils.mkdir_p nmap_results_root
+puts "nmap Results Saved in: #{nmap_results_root}"
+
+discovery_ports = {
+  ftp: 21,
+  ssh: 22,
+  telnet: 23,
+  smtp: 25,
+  dns: 53,
+  http: 80,
+  pop3: 110,
+  rpc: 111,
+  ident: 113,
+  ntp: 123,
+  netbios_name_service: 137,
+  netbios_session_service: 139,
+  imap: 143,
+  snmp: 161,
+  ldap: 389,
+  https: 443,
+  smb: 445,
+  smtps: 465,
+  remote_process: 512,
+  login: 513,
+  rsh: 514,
+  ldaps: 636,
+  rsync: 873,
+  imaps: 993,
+  openvpn: 1194,
+  mssql: 1433,
+  oracle: 1521,
+  pptp: 1723,
+  radius: 1812,
+  nfs: 2049,
+  mysql: 3306,
+  rdp: 3389,
+  meterpreter: 4444,
+  upnp: 5000,
+  sip: 5060,
+  postgres: 5432,
+  postgres_alt: 5433,
+  amqp: 5672,
+  vnc: 5900,
+  vncs: 5901,
+  xfree86: 6000,
+  irc: 6667,
+  http_alt: 8080,
+  https_alt: 8443,
+  http_alt2: 8888,
+  http_alt3: 9090,
+  http_alt4: 9999
+}
+
+target_file = "#{nmap_results_root}/nmap_targets.txt"
+latest_discovery_results = "#{nmap_results_root}/nmap_latest_discovery_results"
+latest_tcp_results = "#{nmap_results_root}/nmap_latest_tcp_results"
+latest_udp_results = "#{nmap_results_root}/nmap_latest_udp_results"
+
+begin
+  # Target Discovery Scan
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.aggressive_timing = true
+    nmap.ping = true
+    nmap.arp_ping = true
+    nmap.icmp_echo_discovery = true
+    nmap.icmp_timestamp_discovery = true
+    nmap.syn_discovery = discovery_ports.values
+    nmap.ack_discovery = discovery_ports.values
+    nmap.udp_discovery = discovery_ports.values
+    nmap.sctp_init_ping = discovery_ports.values
+    nmap.output_all = latest_discovery_results
+    nmap.targets = ip_range
+    nmap.proxies = proxy if with_tor
+  end
+
+  # Generate targets.txt from discovery above
+  # taking into consideration IPs to skip scans
+  File.open(target_file, 'w') do |f|
+    PWN::Plugins::NmapIt.parse_xml_results(
+      xml_file: "#{latest_discovery_results}.xml"
+    ) do |xml|
+      xml.each_host do |host|
+        f.puts host.ip unless File.read(exclude_file).include?(host.ip)
+      end
+    end
+  end
+
+  # Switch Tor Exit Node if with_tor
+  PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj) if with_tor
+
+  # TCP Scan
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.target_file = target_file
+    nmap.show_reason = true
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.min_host_group = 3
+    nmap.host_timeout = '999m'
+    nmap.aggressive_timing = true
+    nmap.skip_discovery = true
+    nmap.syn_scan = true
+    nmap.default_script = true
+    nmap.update_scriptdb = true
+    nmap.service_scan = true
+    nmap.os_fingerprint = true
+    nmap.verbose = true
+    nmap.all = true
+    nmap.ports = [1..65_535]
+    nmap.output_all = latest_tcp_results
+    nmap.proxies = proxy if with_tor
+  end
+  FileUtils.cp("#{latest_tcp_results}.nmap", "#{latest_tcp_results}.txt")
+
+  # Switch Tor Exit Node if with_tor
+  PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj) if with_tor
+
+  # UDP Scan
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.target_file = target_file
+    nmap.show_reason = true
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.min_host_group = 3
+    nmap.host_timeout = '999m'
+    nmap.aggressive_timing = true
+    nmap.skip_discovery = true
+    nmap.udp_scan = true
+    nmap.default_script = true
+    nmap.update_scriptdb = true
+    nmap.service_scan = true
+    nmap.os_fingerprint = true
+    nmap.verbose = true
+    nmap.all = true
+    nmap.output_all = latest_udp_results
+    nmap.proxies = proxy if with_tor
+  end
+  FileUtils.cp("#{latest_udp_results}.nmap", "#{latest_udp_results}.txt")
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+rescue StandardError => e
+  raise e
+ensure
+  tor_obj = PWN::Plugins::Tor.stop(tor_obj: tor_obj) if with_tor
+end

data/bin/pwn_openvas_vulnscan

@@ -25,6 +25,10 @@ OptionParser.new do |options|
   options.on('-pPASSWORD', '--password=PASSWORD', '<Optional - Password to AuthN (Will Prompt if nil)>') do |p|
     opts[:password] = p
   end
+
+  options.on('-fFILTER', '--report-filter=FILTER', '<Optional - GVM Results Filter (Default: "apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity")>') do |p|
+    opts[:password] = p
+  end
 end.parse!
 
 if opts.empty?
@@ -46,6 +50,8 @@ password = if opts[:password].nil?
              opts[:password].to_s.scrub
            end
 
+report_filter = opts[:report_filter]
+
 begin
   start_time = Time.now
   puts "Started: #{start_time}"
@@ -89,6 +95,7 @@ begin
     report_type: :csv,
     report_id: last_report_id,
     report_dir: report_dir,
+    report_filter: report_filter,
     username: username,
     password: password
   )

data/lib/pwn/plugins/nmap_it.rb

@@ -5,11 +5,17 @@ require 'nmap/xml'
 
 module PWN
   module Plugins
-    # This plugin is used as an  interface to nmap, the exploration tool and security / port scanner.
+    # This plugin is used as an  interface to nmap, the exploration tool and security / port scanner.  More info on available options can be found at: https://github.com/postmodern/ruby-nmap/blob/main/lib/nmap/command.rb
     module NmapIt
       # Supported Method Parameters::
       # PWN::Plugins::NmapIt.port_scan do |nmap|
       #   puts nmap.public_methods
+      #   nmap.connect_scan = true
+      #   nmap.service_scan = true
+      #   nmap.verbose = true
+      #   nmap.ports = [1..1024,1337]
+      #   nmap.targets = '127.0.0.1'
+      #   nmap.xml = '/tmp/nmap_port_scan_res.xml'
       # end
 
       public_class_method def self.port_scan

data/lib/pwn/plugins/openvas.rb

@@ -147,8 +147,10 @@ module PWN
       # PWN::Plugins::OpenVAS.save_report(
       #   report_type: 'required report type (csv|itg|pdf|txt|xml)',
       #   report_id: 'required report id to save',
+      #   report_dir: 'required directory to save report',
       #   username: 'required username',
-      #   password: 'optional password (will prompt if nil)'
+      #   password: 'optional password (will prompt if nil)',
+      #   report_filter: 'optional - results filter (Default: "apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity")
       # )
 
       public_class_method def self.save_report(opts = {})
@@ -167,6 +169,9 @@ module PWN
                      opts[:password].to_s.scrub
                    end
 
+        report_filter = opts[:report_filter]
+        report_filter ||= 'apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity'
+
         case report_type.to_sym
         when :csv
           report_type_name = 'CSV Results'
@@ -203,7 +208,7 @@ module PWN
             --gmp-username '#{username}' \
             --gmp-password '#{password}' \
             socket \
-            --xml="<get_reports report_id='#{report_id}' format_id='#{format_id}' details='1' />"
+            --xml="<get_reports report_id='#{report_id}' format_id='#{format_id}' filter='#{report_filter}' details='1' />"
           `
         )
 
@@ -292,7 +297,8 @@ module PWN
             report_id: 'required report id to save',
             report_dir: 'required directory to save report',
             username: 'required username',
-            password: 'optional password (will prompt if nil)'
+            password: 'optional password (will prompt if nil)',
+            report_filter: 'optional - results filter (Default: \"apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity\")
           )
 
           report_types = #{self}.get_report_types(

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.4.669'
+  VERSION = '0.4.671'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.4.669
+  version: 0.4.671
 platform: ruby
 authors:
 - 0day Inc.
@@ -1123,6 +1123,7 @@ executables:
 - pwn_nessus_cloud_scan_crud
 - pwn_nessus_cloud_vulnscan
 - pwn_nexpose
+- pwn_nmap_discover_tcp_udp
 - pwn_openvas_vulnscan
 - pwn_owasp_zap_active_scan
 - pwn_pastebin_sample_filter
@@ -1190,6 +1191,7 @@ files:
 - bin/pwn_nessus_cloud_scan_crud
 - bin/pwn_nessus_cloud_vulnscan
 - bin/pwn_nexpose
+- bin/pwn_nmap_discover_tcp_udp
 - bin/pwn_openvas_vulnscan
 - bin/pwn_owasp_zap_active_scan
 - bin/pwn_pastebin_sample_filter