pwn 0.4.673 → 0.4.676

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66259ccdc59be89f796f56e88a20f9eb5bef320c46a4b7fc268b62f664e50c6e
-  data.tar.gz: 162ad18b794121a96802d6f5de739b4fc22eb8c0dda0a780fc6144fedc107af3
+  metadata.gz: fa9249af262af0f9d2dbaea4245691d09da20bc452967e60095ff4c28a404eba
+  data.tar.gz: 02b24daf26e3107a37e25392e27fd4176a0a7c8af63f41d3f8c38bf2d3207abc
 SHA512:
-  metadata.gz: 2e6515b72bf8b01805b50cc9e5bb701edf2fb725182c1a1c425188e8d2542badd19cd93cbdf4c358fc2c2cfcb9c49341b4322cc76d596a200548eebe73c4ffd4
-  data.tar.gz: 846a1b1ca1f1ef9bc2affdb57ea1accf45f210e86085da968b54d01e45e9f6d6103f8108a7ef7a2888f4ebadd57988f68afafea86925f8c7c4867915388c36a7
+  metadata.gz: c648625f56139d973443eee4ba91478e6b9a6e67db1d38c65a86de2b8cba6b245046616a426d9c8ed865b1a20250744b4d5eaf158022b218e58d3ab9051edfbb
+  data.tar.gz: 3955ada6705bfefdc4ec255e60de2b9579dba5407e8ebb36cad2a20ed96ba89cb5285ab540ed0974bab11d381cf7cb2a35da63e81bf39212f388cd4e579bc9c0

data/Gemfile

@@ -66,7 +66,7 @@ gem 'rspec', '3.12.0'
 gem 'rtesseract', '3.1.2'
 gem 'rubocop', '1.50.2'
 gem 'rubocop-rake', '0.6.0'
-gem 'rubocop-rspec', '2.20.0'
+gem 'rubocop-rspec', '2.21.0'
 gem 'ruby-audio', '1.6.1'
 gem 'ruby-nmap', '1.0.1'
 gem 'ruby-saml', '1.15.0'

data/README.md

@@ -37,7 +37,7 @@ $ rvm use ruby-3.2.2@pwn
 $ rvm list gemsets
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.673]:001 >>> PWN.help
+pwn[v0.4.676]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.2.2@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.673]:001 >>> PWN.help
+pwn[v0.4.676]:001 >>> PWN.help
 ```
 
 

data/bin/pwn_nmap_discover_tcp_udp

@@ -3,6 +3,7 @@
 
 require 'optparse'
 require 'pwn'
+require 'time'
 
 opts = {}
 OptionParser.new do |options|
@@ -10,8 +11,8 @@ OptionParser.new do |options|
     #{$PROGRAM_NAME} [opts]
   "
 
-  options.on('-IRANGE', '--ip-range=RANGE', '<Required - nmap supported ip range e.g. 192.168.1.1-20, 192.168.1.0/24, etc>') do |i|
-    opts[:ip_range] = i
+  options.on('-tRANGE', '--target-range=RANGE', '<Required - nmap supported host || ip range e.g. foo.bar, 192.168.1.1-20, 192.168.1.0/24, etc>') do |t|
+    opts[:target_range] = t
   end
 
   options.on('-eFILE', '--target-exclude-file=FILE', '<Optional - nmap excludes file>') do |e|
@@ -32,7 +33,14 @@ if opts.empty?
   exit 1
 end
 
-ip_range = opts[:ip_range]
+ftimestr = '%Y-%m-%d %H:%M:%S.%N%z'
+started_at = Time.now.strftime(ftimestr)
+started_at_parse = Time.parse(started_at)
+banner = '-' * 64
+puts "\n\n\n#{banner}"
+puts "- STARTED: #{started_at} "
+
+target_range = opts[:target_range]
 exclude_file = opts[:exclude_file]
 exclude_file ||= '/tmp/nmap_targets_exclude.txt'
 interface = opts[:interface]
@@ -49,28 +57,24 @@ nmap_results_root = File.dirname(exclude_file)
 FileUtils.mkdir_p nmap_results_root
 puts "nmap Results Saved in: #{nmap_results_root}"
 
-discovery_ports = {
+discovery_tcp_ports = {
   ftp: 21,
   ssh: 22,
   telnet: 23,
   smtp: 25,
-  dns: 53,
   http: 80,
   pop3: 110,
-  rpc: 111,
   ident: 113,
-  ntp: 123,
+  msrpc: 135,
   netbios_name_service: 137,
   netbios_session_service: 139,
   imap: 143,
-  snmp: 161,
   ldap: 389,
   https: 443,
   smb: 445,
   smtps: 465,
   remote_process: 512,
   login: 513,
-  rsh: 514,
   ldaps: 636,
   rsync: 873,
   imaps: 993,
@@ -84,13 +88,12 @@ discovery_ports = {
   rdp: 3389,
   meterpreter: 4444,
   upnp: 5000,
-  sip: 5060,
   postgres: 5432,
   postgres_alt: 5433,
   amqp: 5672,
   vnc: 5900,
   vncs: 5901,
-  xfree86: 6000,
+  x11: 6000,
   irc: 6667,
   http_alt: 8080,
   https_alt: 8443,
@@ -99,10 +102,34 @@ discovery_ports = {
   http_alt4: 9999
 }
 
+discovery_udp_ports = {
+  dns: 53,
+  dhcp: 67,
+  dhcp_client: 68,
+  tftp: 69,
+  nfs: 111,
+  ntp: 123,
+  snmp: 161,
+  snmp_traps: 162,
+  syslog: 514,
+  rip: 520,
+  iax: 4569,
+  sip: 5060,
+  mdns: 5353
+}
+
+discovery_sctp_ports = {
+  sigtran: 2905,
+  stl: 5000,
+  sap: 5004,
+  turn_ip: 5766,
+  sicc: 38_412
+}
+
 target_file = "#{nmap_results_root}/nmap_targets.txt"
-latest_discovery_results = "#{nmap_results_root}/nmap_latest_discovery_results"
-latest_tcp_results = "#{nmap_results_root}/nmap_latest_tcp_results"
-latest_udp_results = "#{nmap_results_root}/nmap_latest_udp_results"
+latest_discovery_results = "#{nmap_results_root}/nmap_discovery_results.xml"
+latest_tcp_results = "#{nmap_results_root}/nmap_tcp_results"
+latest_udp_results = "#{nmap_results_root}/nmap_udp_results"
 
 begin
   # Per man nmap:
@@ -124,21 +151,30 @@ begin
   # Target Discovery Scan
   # Using -T5 template to reduce number of
   # retransmission attempts on filtered ports.
+  puts "\n\n\n#{banner}"
+  puts '- PHASE 1: Target Discovery'
   PWN::Plugins::NmapIt.port_scan do |nmap|
+    if with_tor
+      nmap.syn_discovery = discovery_tcp_ports.values
+      nmap.ack_discovery = discovery_tcp_ports.values
+    else
+      nmap.ping = true
+      nmap.arp_ping = true
+      nmap.icmp_echo_discovery = true
+      nmap.icmp_timestamp_discovery = true
+      nmap.udp_discovery = discovery_udp_ports.values
+      nmap.sctp_init_ping = discovery_sctp_ports.values
+    end
+    nmap.verbose = true
     nmap.exclude_file = exclude_file
     nmap.interface = interface
     nmap.insane_timing = true
-    nmap.ping = true
-    nmap.arp_ping = true
-    nmap.icmp_echo_discovery = true
-    nmap.icmp_timestamp_discovery = true
-    nmap.syn_discovery = discovery_ports.values
-    nmap.ack_discovery = discovery_ports.values
-    nmap.udp_discovery = discovery_ports.values
-    nmap.sctp_init_ping = discovery_ports.values
-    nmap.output_all = latest_discovery_results
-    nmap.targets = ip_range
+    nmap.output_xml = latest_discovery_results
+    nmap.targets = target_range
     nmap.randomize_hosts = true
+    nmap.min_parallelism = 36
+    nmap.max_retries = 3
+    nmap.max_scan_delay = 3
     nmap.proxies = proxy if with_tor
   end
 
@@ -146,76 +182,134 @@ begin
   # taking into consideration IPs to skip scans
   File.open(target_file, 'w') do |f|
     PWN::Plugins::NmapIt.parse_xml_results(
-      xml_file: "#{latest_discovery_results}.xml"
+      xml_file: latest_discovery_results
     ) do |xml|
       xml.each_host do |host|
-        f.puts host.ip unless File.read(exclude_file).include?(host.ip)
+        next if File.read(exclude_file).include?(host.ip) ||
+                host.status.state != :up
+
+        hosts_arr = host.hostnames.map { |h| h[:name] }
+        f.print host.ip
+        f.puts " # { \"hostnames\": #{hosts_arr}}, \"mac\": \"#{host.mac}\" }"
       end
     end
   end
+
+  # Produce a good targets.txt redacting duplicates
   sorted_targets = File.readlines(target_file).sort.join
   File.write(target_file, sorted_targets)
 
+  phase1_ended_at = Time.now.strftime(ftimestr)
+  phase1_ended_at_parse = Time.parse(phase1_ended_at)
+  elapsed_in_seconds = (phase1_ended_at_parse - started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n\n\n#{banner}"
+  puts "- DISCOVERY COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+
+  puts "\n\n\n#{banner}"
+  puts '- PHASE 2: TCP Port Scanning'
+  phase2_started_at = Time.now.strftime(ftimestr)
+  phase2_started_at_parse = Time.parse(phase2_started_at)
+
   # Switch Tor Exit Node if with_tor
-  PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj) if with_tor
+  if with_tor
+    puts "\n\n\n#{banner}"
+    puts '- INFO: Switching to Clean Tor Circuit...'
+    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
+  end
 
   # TCP Scan
   # Using -T5 template to reduce number of
   # retransmission attempts on filtered ports.
   PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.verbose = true
     nmap.target_file = target_file
     nmap.randomize_hosts = true
     nmap.show_reason = true
     nmap.exclude_file = exclude_file
     nmap.interface = interface
-    nmap.min_host_group = 3
-    nmap.host_timeout = '999m'
+    nmap.min_host_group = 9
+    nmap.host_timeout = '36m'
     nmap.insane_timing = true
     nmap.skip_discovery = true
     nmap.syn_scan = true
     nmap.default_script = true
     nmap.update_scriptdb = true
-    nmap.service_scan = true
-    nmap.os_fingerprint = true
-    nmap.verbose = true
-    nmap.all = true
     nmap.ports = [1..65_535]
     nmap.output_all = latest_tcp_results
+    nmap.min_parallelism = 36
+    nmap.max_retries = 3
+    nmap.max_scan_delay = 3
     nmap.proxies = proxy if with_tor
   end
   FileUtils.cp("#{latest_tcp_results}.nmap", "#{latest_tcp_results}.txt")
+  phase2_ended_at = Time.now.strftime(ftimestr)
+  phase2_ended_at_parse = Time.parse(phase2_ended_at)
+  elapsed_in_seconds = (phase2_ended_at_parse - phase2_started_at).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n\n\n#{banner}"
+  puts "- TCP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+
+  puts "\n\n\n#{banner}"
+  puts '- PHASE 3: UDP Port Scanning'
+  phase3_started_at = Time.now.strftime(ftimestr)
+  phase3_started_at_parse = Time.parse(phase3_started_at)
 
   # Switch Tor Exit Node if with_tor
-  PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj) if with_tor
+  if with_tor
+    puts "\n\n\n#{banner}"
+    puts '- INFO: Switching to Clean Tor Circuit...'
+    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
+  end
 
   # UDP Scan
   # Using -T5 template to reduce number of
   # retransmission attempts on filtered ports.
   PWN::Plugins::NmapIt.port_scan do |nmap|
+    unless with_tor
+      nmap.default_script = true
+      nmap.update_scriptdb = true
+    end
+    nmap.verbose = true
     nmap.target_file = target_file
+    nmap.fast = true
     nmap.randomize_hosts = true
     nmap.show_reason = true
     nmap.exclude_file = exclude_file
     nmap.interface = interface
-    nmap.min_host_group = 3
-    nmap.host_timeout = '999m'
+    nmap.min_host_group = 9
+    nmap.host_timeout = '3m'
     nmap.insane_timing = true
     nmap.skip_discovery = true
     nmap.udp_scan = true
-    nmap.default_script = true
-    nmap.update_scriptdb = true
-    nmap.service_scan = true
-    nmap.os_fingerprint = true
-    nmap.verbose = true
-    nmap.all = true
     nmap.output_all = latest_udp_results
+    nmap.min_parallelism = 36
+    nmap.max_retries = 0
+    nmap.max_scan_delay = 3
+    nmap.data_length = Random.rand(1..256)
     nmap.proxies = proxy if with_tor
   end
   FileUtils.cp("#{latest_udp_results}.nmap", "#{latest_udp_results}.txt")
+  phase3_ended_at = Time.now.strftime(ftimestr)
+  phase3_ended_at_parse = Time.parse(phase3_ended_at)
+  elapsed_in_seconds = (phase3_ended_at_parse - phase3_started_at).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n\n\n#{banner}"
+  puts "- UDP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
 rescue SystemExit, Interrupt
   puts "\nGoodbye."
 rescue StandardError => e
   raise e
 ensure
   tor_obj = PWN::Plugins::Tor.stop(tor_obj: tor_obj) if with_tor
+  ended_at = Time.now.strftime(ftimestr)
+  puts "\n\n\n#{banner}"
+  puts "- ENDED: #{ended_at}"
+
+  ended_at_parse = Time.parse(ended_at)
+  elapsed_in_seconds = (ended_at_parse - started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n\n\n#{banner}"
+  puts "- SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+  puts banner
 end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.4.673'
+  VERSION = '0.4.676'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.4.673
+  version: 0.4.676
 platform: ruby
 authors:
 - 0day Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-05-04 00:00:00.000000000 Z
+date: 2023-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -786,14 +786,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.20.0
+        version: 2.21.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.20.0
+        version: 2.21.0
 - !ruby/object:Gem::Dependency
   name: ruby-audio
   requirement: !ruby/object:Gem::Requirement