pwn 0.5.508 → 0.5.509

data/bin/pwn_nmap_discover_tcp_udp

@@ -1,353 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'fileutils'
-require 'ipaddr'
-require 'pwn'
-require 'time'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-fFILE', '--target-file=FILE', '<Required if --target-range excluded - File containing one supported nmap target / line e.g. foo.bar, 10.1.1.1, 192.168.1.1-20, 192.168.1.0/24, etc>') do |f|
-    opts[:target_file] = f
-  end
-
-  options.on('-tRANGE', '--target-range=RANGE', '<Required if --target-file excluded - nmap supported host || ip range e.g. foo.bar, 10.1.1.1, 192.168.1.1-20, 192.168.1.0/24, etc>') do |t|
-    opts[:target_range] = t
-  end
-
-  options.on('-eFILE', '--target-exclude-file=FILE', '<Optional - IP excludes file>') do |e|
-    opts[:exclude_file] = e
-  end
-
-  options.on('-iINTERFACE', '--interface=INTERFACE', '<Optional - use specified network interface (Default: eth0)') do |i|
-    opts[:interface] = i
-  end
-
-  options.on('-rDIR', '--results-root=DIR', '<Optional - nmap results root (Default: /tmp)>') do |r|
-    opts[:results_root] = r
-  end
-
-  options.on('-S', '--stop-nse', '<Optional - Disable Nmap Scripting Engine>') do |n|
-    opts[:stop_nse] = n
-  end
-
-  options.on('-T', '--tor', '<Optional - Source Scans from Tor Nodes>') do |t|
-    opts[:with_tor] = t
-  end
-end.parse!
-
-ftimestr = '%Y-%m-%d %H:%M:%S.%N%z'
-started_at = Time.now.strftime(ftimestr)
-started_at_parse = Time.parse(started_at)
-banner = '-' * 64
-puts "\n\n\n#{banner}"
-puts "- STARTED: #{started_at} "
-
-target_file = opts[:target_file]
-target_range = opts[:target_range]
-if (target_file && target_range) || (!target_file && !target_range)
-  puts 'ERROR: Must specify --target-file OR --target-range'
-  exit 1
-end
-
-results_root = opts[:results_root]
-results_root ||= '/tmp'
-FileUtils.mkdir_p results_root
-puts "Results Saved in: #{results_root}"
-
-exclude_file = opts[:exclude_file]
-exclude_file ||= "#{results_root}/nmap_targets_exclude.txt"
-# We create an exclude file (even if its empty)
-File.new(exclude_file, 'w') unless File.exist?(exclude_file)
-
-interface = opts[:interface]
-interface ||= 'eth0'
-
-stop_nse = true if opts[:stop_nse]
-stop_nse ||= false
-
-with_tor = true if opts[:with_tor]
-with_tor ||= false
-
-if with_tor
-  tor_obj = PWN::Plugins::Tor.start
-  proxy = ["socks4://#{tor_obj[:ip]}:#{tor_obj[:port]}"]
-end
-
-discovery_tcp_ports = {
-  ftp: 21,
-  ssh: 22,
-  telnet: 23,
-  smtp: 25,
-  http: 80,
-  pop3: 110,
-  ident: 113,
-  msrpc: 135,
-  netbios_name_service: 137,
-  netbios_session_service: 139,
-  imap: 143,
-  ldap: 389,
-  https: 443,
-  smb: 445,
-  smtps: 465,
-  remote_process: 512,
-  login: 513,
-  ldaps: 636,
-  rsync: 873,
-  imaps: 993,
-  openvpn: 1194,
-  mssql: 1433,
-  oracle: 1521,
-  pptp: 1723,
-  radius: 1812,
-  nfs: 2049,
-  mysql: 3306,
-  rdp: 3389,
-  meterpreter: 4444,
-  upnp: 5000,
-  postgres: 5432,
-  postgres_alt: 5433,
-  amqp: 5672,
-  vnc: 5900,
-  vncs: 5901,
-  x11: 6000,
-  irc: 6667,
-  http_alt: 8080,
-  https_alt: 8443,
-  http_alt2: 8888,
-  http_alt3: 9090,
-  http_alt4: 9999
-}
-
-discovery_udp_ports = {
-  dns: 53,
-  dhcp: 67,
-  dhcp_client: 68,
-  tftp: 69,
-  nfs: 111,
-  ntp: 123,
-  snmp: 161,
-  snmp_traps: 162,
-  syslog: 514,
-  rip: 520,
-  iax: 4569,
-  sip: 5060,
-  mdns: 5353
-}
-
-discovery_sctp_ports = {
-  sigtran: 2905,
-  stl: 5000,
-  sap: 5004,
-  turn_ip: 5766,
-  sicc: 38_412
-}
-
-discovered_targets_file = "#{results_root}/nmap_discovery_results.txt"
-latest_discovery_results = "#{results_root}/nmap_discovery_results.xml"
-latest_tcp_results = "#{results_root}/nmap_tcp_results"
-latest_udp_results = "#{results_root}/nmap_udp_results"
-
-begin
-  # Per man nmap:
-  # The main effects of T0 are serializing the scan so only one port
-  # is scanned at a time, and waiting five minutes between sending
-  # each probe.
-  # T1 and T2 are similar but they only wait 15 seconds and 0.4 seconds,
-  # respectively, between probes.
-  # T3 is Nmap's default behavior, which includes parallelization.
-  # T4 does the equivalent of --max-rtt-timeout 1250ms --min-rtt-timeout 100ms
-  # --initial-rtt-timeout 500ms --max-retries 6 and sets the maximum TCP and
-  # SCTP scan delay to 10ms.
-  # T5 does the equivalent of --max-rtt-timeout 300ms --min-rtt-timeout 50ms
-  # --initial-rtt-timeout 250ms --max-retries 2 --host-timeout 15m
-  # --script-timeout 10m --max-scan-delay as well as setting the maximum TCP
-  # and SCTP scan delay to 5ms. Maximum UDP scan delay is not set by T4 or T5,
-  # but it can be set with the --max-scan-delay option.
-
-  # Target Discovery Scan
-  # Using -T5 template to reduce number of
-  # retransmission attempts on filtered ports.
-  puts banner
-  puts '- PHASE 1: Target Discovery'
-  PWN::Plugins::NmapIt.port_scan do |nmap|
-    if with_tor
-      nmap.proxies = proxy
-      nmap.ack_discovery = discovery_tcp_ports.values
-    else
-      nmap.udp_discovery = discovery_udp_ports.values
-    end
-    nmap.ping = true
-    nmap.arp_ping = true
-    nmap.icmp_echo_discovery = true
-    nmap.icmp_timestamp_discovery = true
-    nmap.syn_discovery = discovery_tcp_ports.values
-    nmap.sctp_init_ping = discovery_sctp_ports.values
-    nmap.verbose = true
-    nmap.exclude_file = exclude_file
-    nmap.interface = interface
-    nmap.insane_timing = true
-    nmap.output_xml = latest_discovery_results
-    nmap.targets = target_range if target_range
-    nmap.target_file = target_file if target_file
-    nmap.randomize_hosts = true
-    nmap.min_parallelism = 36
-    nmap.max_retries = 3
-    nmap.max_scan_delay = 3
-  end
-
-  # Generate targets.txt from discovery above
-  # taking into consideration IPs to skip scans
-  File.open(discovered_targets_file, 'w') do |f|
-    PWN::Plugins::NmapIt.parse_xml_results(
-      xml_file: latest_discovery_results
-    ) do |xml|
-      xml.each_host do |host|
-        next if File.read(exclude_file).include?(host.ip) ||
-                host.status.state != :up
-
-        f.puts host.ip
-      end
-    end
-  end
-
-  # Produce a good targets.txt redacting duplicates && sorting by IP
-  sorted_ips = File.readlines(discovered_targets_file).uniq.map do |ip|
-    IPAddr.new(ip.chomp)
-  end
-  sorted_ips = sorted_ips.sort_by(&:hton)
-
-  # Now Add additional info about the IP as a comment
-  File.open(discovered_targets_file, 'w') do |f|
-    sorted_ips.each do |ip|
-      PWN::Plugins::NmapIt.parse_xml_results(
-        xml_file: latest_discovery_results
-      ) do |xml|
-        xml.each_host do |host|
-          next unless host.ip.to_s == ip.to_s
-
-          hosts_arr = host.hostnames.map { |h| h[:name] }
-          f.puts "#{ip} # { \"hostnames\": #{hosts_arr}}, \"mac\": \"#{host.mac}\" }"
-        end
-      end
-    end
-  end
-
-  phase1_ended_at = Time.now.strftime(ftimestr)
-  phase1_ended_at_parse = Time.parse(phase1_ended_at)
-  elapsed_in_seconds = (phase1_ended_at_parse - started_at_parse).to_f
-  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
-  puts "\n#{banner}"
-  puts "- DISCOVERY COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
-  puts banner
-
-  puts "\n\n\n#{banner}"
-  puts '- PHASE 2: TCP Port Scanning'
-  puts banner
-  phase2_started_at = Time.now.strftime(ftimestr)
-  phase2_started_at_parse = Time.parse(phase2_started_at)
-
-  # Switch Tor Exit Node if with_tor
-  if with_tor
-    puts '- INFO: Switching to Clean Tor Circuit...'
-    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
-  end
-
-  # TCP Scan
-  # Using -T5 template to reduce number of
-  # retransmission attempts on filtered ports.
-  PWN::Plugins::NmapIt.port_scan do |nmap|
-    nmap.proxies = proxy if with_tor
-    unless stop_nse
-      nmap.default_script = true
-      nmap.update_scriptdb = true
-    end
-    nmap.verbose = true
-    nmap.target_file = discovered_targets_file
-    nmap.randomize_hosts = true
-    nmap.show_reason = true
-    nmap.exclude_file = exclude_file
-    nmap.interface = interface
-    nmap.min_host_group = 9
-    nmap.host_timeout = '36m'
-    nmap.insane_timing = true
-    nmap.skip_discovery = true
-    nmap.syn_scan = true
-    nmap.ports = [1..65_535]
-    nmap.output_all = latest_tcp_results
-    nmap.min_parallelism = 36
-    nmap.max_retries = 3
-    nmap.max_scan_delay = 3
-  end
-  FileUtils.cp("#{latest_tcp_results}.nmap", "#{latest_tcp_results}.txt")
-  phase2_ended_at = Time.now.strftime(ftimestr)
-  phase2_ended_at_parse = Time.parse(phase2_ended_at)
-  elapsed_in_seconds = (phase2_ended_at_parse - phase2_started_at_parse).to_f
-  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
-  puts "\n#{banner}"
-  puts "- TCP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
-  puts banner
-
-  puts "\n\n\n#{banner}"
-  puts '- PHASE 3: UDP Port Scanning'
-  puts banner
-  phase3_started_at = Time.now.strftime(ftimestr)
-  phase3_started_at_parse = Time.parse(phase3_started_at)
-
-  # Switch Tor Exit Node if with_tor
-  if with_tor
-    puts '- INFO: Switching to Clean Tor Circuit...'
-    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
-  end
-
-  # UDP Scan
-  # Using -T5 template to reduce number of
-  # retransmission attempts on filtered ports.
-  PWN::Plugins::NmapIt.port_scan do |nmap|
-    nmap.proxies = proxy if with_tor
-    unless stop_nse
-      nmap.default_script = true
-      nmap.update_scriptdb = true
-    end
-    nmap.verbose = true
-    nmap.target_file = discovered_targets_file
-    nmap.fast = true
-    nmap.randomize_hosts = true
-    nmap.show_reason = true
-    nmap.exclude_file = exclude_file
-    nmap.interface = interface
-    nmap.min_host_group = 9
-    nmap.host_timeout = '3m'
-    nmap.insane_timing = true
-    nmap.skip_discovery = true
-    nmap.udp_scan = true
-    nmap.output_all = latest_udp_results
-    nmap.min_parallelism = 36
-    nmap.max_retries = 0
-    nmap.max_scan_delay = 3
-    nmap.data_length = Random.rand(1..256)
-  end
-  FileUtils.cp("#{latest_udp_results}.nmap", "#{latest_udp_results}.txt")
-  phase3_ended_at = Time.now.strftime(ftimestr)
-  phase3_ended_at_parse = Time.parse(phase3_ended_at)
-  elapsed_in_seconds = (phase3_ended_at_parse - phase3_started_at_parse).to_f
-  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
-  puts "\n#{banner}"
-  puts "- UDP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
-  puts banner
-rescue SystemExit, Interrupt
-  puts "\nGoodbye."
-rescue StandardError => e
-  raise e
-ensure
-  tor_obj = PWN::Plugins::Tor.stop(tor_obj: tor_obj) if with_tor
-  ended_at = Time.now.strftime(ftimestr)
-  ended_at_parse = Time.parse(ended_at)
-  elapsed_in_seconds = (ended_at_parse - started_at_parse).to_f
-  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
-  puts "\n\n\n#{banner}"
-  puts "- ENDED: #{ended_at}"
-  puts "- SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
-  puts banner
-end

data/bin/pwn_openvas_vulnscan

@@ -1,104 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-cYPATH', '--yaml-config=YPATH', '<Required - YAML Config Containing Username & Password for Authentication>') do |c|
-    opts[:yaml_config] = c
-  end
-
-  options.on('-tTASK_NAME', '--task-name=TASK_NAME', '<Required - Task Name to Start>') do |t|
-    opts[:task_name] = t
-  end
-
-  options.on('-sDIR', '--save-report-to-dir=DIR', '<Required - Directory to Save Report>') do |d|
-    opts[:report_dir] = d
-  end
-
-  options.on('-fFILTER', '--report-filter=FILTER', '<Optional - GVM Results Filter (Default: "apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity")>') do |p|
-    opts[:password] = p
-  end
-end.parse!
-
-task_name = opts[:task_name]
-
-report_dir = opts[:report_dir].to_s.scrub
-raise "#{report_dir} Does Not Exist." unless Dir.exist?(
-  report_dir
-)
-
-yaml_config = opts[:yaml_config]
-
-raise "YAML Config Not Found: #{yaml_config}" unless File.exist?(yaml_config)
-
-yaml = YAML.load_file(
-  yaml_config,
-  symbolize_names: true
-)
-
-username = yaml[:username]
-password = if yaml[:password].nil?
-             PWN::Plugins::AuthenticationHelper.mask_password
-           else
-             yaml[:password].to_s.scrub
-           end
-
-report_filter = opts[:report_filter]
-
-begin
-  start_time = Time.now
-  puts "Started: #{start_time}"
-  PWN::Plugins::OpenVAS.start_task(
-    task_name: task_name,
-    username: username,
-    password: password
-  )
-
-  loop do
-    if PWN::Plugins::OpenVAS.get_task_status(
-      task_name: task_name,
-      username: username,
-      password: password
-    ).downcase == 'done'
-
-      end_time = Time.now
-      puts "\nCompleted: #{end_time}"
-      break
-    end
-
-    print '.'
-    sleep 30
-  end
-
-  end_time = Time.now
-  duration_mins = format(
-    '%0.2f',
-    (end_time - start_time) / 60
-  )
-
-  last_report_id = PWN::Plugins::OpenVAS.last_report_id(
-    task_name: task_name,
-    username: username,
-    password: password
-  )
-  puts "\nLast Report ID Generated by #{task_name}: #{last_report_id}"
-
-  print "Saving report in #{report_dir}..."
-  PWN::Plugins::OpenVAS.save_report(
-    report_type: :csv,
-    report_id: last_report_id,
-    report_dir: report_dir,
-    report_filter: report_filter,
-    username: username,
-    password: password
-  )
-  puts 'complete.'
-
-  puts "Task Duration (Minutes): #{duration_mins}"
-rescue Interrupt
-  puts 'CTRL+C detected...goodbye.'
-rescue StandardError => e
-  raise e
-end

data/bin/pwn_pastebin_sample_filter

@@ -1,47 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-rPATTERN', '--regex=PATTERN', "<Required - Regex Pattern for Interesting Pastes ('.*' for All)>") do |r|
-    opts[:regex] = r
-  end
-
-  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
-    opts[:proxy] = p
-  end
-end.parse!
-
-proxy = opts[:proxy]
-regex = opts[:regex]
-
-browser_obj = PWN::WWW::Pastebin.open(
-  browser_type: :headless,
-  proxy: proxy
-)
-
-browser = browser_obj[:browser]
-
-begin
-  loop do
-    browser.div(id: 'menu_2').links[0].click
-    code_frame = browser.div(id: 'code_frame').text
-    if code_frame.match?(/#{regex}/mi)
-      puts "\nCurrent Link: #{browser.url}"
-      puts "#{code_frame}\n\n\n"
-    else
-      print '.'
-    end
-    sleep 9
-  end
-rescue StandardError => e
-  raise e
-ensure
-  if browser_obj
-    browser_obj = PWN::Plugins::TransparentBrowser.close(
-      browser_obj: browser_obj
-    )
-  end
-end

data/bin/pwn_phone

@@ -1,129 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-# require 'fftw3'
-require 'fileutils'
-require 'pwn'
-require 'ruby-audio'
-require 'waveform'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-tPATH', '--target-file=PATH', '<Required - File Containing List of Targets to Dial>') do |t|
-    opts[:target_file] = t
-  end
-
-  options.on('-sSEC', '--seconds-to-record=SEC', '<Optional - Seconds to Record (Defaults to 60)>') do |s|
-    opts[:seconds_to_record] = s
-  end
-
-  options.on('-TTHREADS', '--max-threads=THREADS', '<Optional # Calls to Run Simultaneously (Defaults to 3)>') do |t|
-    opts[:max_threads] = t
-  end
-
-  options.on('-bPATH', '--baresip-binary=PATH', '<Optional - Path to baresip Binary (Defaults to /usr/bin/baresip)>') do |bs|
-    opts[:baresip_bin] = bs
-  end
-
-  options.on('-SSOX', '--sox-path=SOX', '<Optional - Path to SoX Binary, the Swiss Army knife of Audio (Defaults to /usr/bin/sox)>') do |sox|
-    opts[:sox_bin] = sox
-  end
-
-  options.on('-rDIR', '--session-root=DIR', '<Optional - Directory to Store Session Files (Defaults to Present Working Directory))>') do |sr|
-    opts[:session_root] = sr
-  end
-
-  options.on('-R', '--[no-]randomize', '<Optional - Randomize Number Range (Defaults to false)>') do |r|
-    opts[:randomize] = r
-  end
-
-  options.on('-nREPORTNAME', '--report-name=REPORTNAME', '<Optional Report Name (Defaults to, "File.basename(Dir.pwd)")>') do |n|
-    opts[:report_name] = n
-  end
-
-  options.on('-H', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
-    opts[:start_reporting_server] = s
-  end
-
-  options.on('-X', '--[no-]speech-to-text', '<Optional - Speech to Text from Audio Recordings>') do |x|
-    opts[:speech_to_text] = x
-  end
-
-  options.on('-xRULES', '--source-num-rules=RULES', '<Optional - Comma-delimited list of rules for src_num format (i.e. XXXXXXXXXX, static, self, same_country, same_area, and/or same_prefix [Defaults to random src_num w/ same length as target_num])>') do |x|
-    opts[:src_num_rules] = x
-  end
-
-  # TODO: Add an hours of operation flag.
-  # TODO: Add a resume feature to resume session following an interruption.
-  # TODO: Append results to pwn_phone_results.json as things are running #save_memory.
-end.parse!
-
-begin
-  pwn_provider = 'ruby-gem'
-  # pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.select { |s| s == 'PWN_PROVIDER' }.any?
-  pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.any? { |s| s == 'PWN_PROVIDER' }
-  $stdout.sync = true
-
-  # Required Flag Variables
-  target_file = opts[:target_file]
-  max_threads = opts[:max_threads]
-  seconds_to_record = opts[:seconds_to_record]
-  baresip_bin = opts[:baresip_bin]
-  sox_bin = opts[:sox_bin]
-  session_root = opts[:session_root] ||= '.'
-  # session_root = opts[:session_root] ||= Dir.pwd
-
-  # Optional Flag Variables
-  randomize = opts[:randomize]
-  report_name = opts[:report_name]
-  report_name ||= File.basename(Dir.pwd)
-  start_reporting_server = opts[:start_reporting_server]
-  speech_to_text = opts[:speech_to_text]
-  src_num_rules = opts[:src_num_rules]
-
-  # Initiallize Phone Reconaissance
-  results_hash = PWN::Plugins::BareSIP.recon(
-    baresip_bin: baresip_bin,
-    session_root: session_root,
-    target_file: target_file,
-    randomize: randomize,
-    src_num_rules: src_num_rules,
-    seconds_to_record: seconds_to_record,
-    sox_bin: sox_bin,
-    speech_to_text: speech_to_text,
-    report_name: report_name
-  )
-
-  # Generate HTML Report
-  print "#{File.basename($PROGRAM_NAME)} Generating Report..."
-  PWN::Reports::Phone.generate(
-    dir_path: session_root,
-    results_hash: results_hash
-  )
-  puts 'complete.'
-
-  # Start Simple HTTP Server (If Requested)
-  if start_reporting_server
-    listen_port = PWN::Plugins::Sock.get_random_unused_port.to_s
-
-    if pwn_provider == 'docker'
-      listen_ip = '0.0.0.0'
-    else
-      listen_ip = '127.0.0.1'
-    end
-
-    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/#{report_name}.html"
-    Dir.chdir(session_root)
-    system(
-      'pwn_simple_http_server',
-      '-i',
-      listen_ip,
-      '-p',
-      listen_port
-    )
-  end
-rescue StandardError => e
-  raise e.message
-rescue SystemExit, Interrupt
-  puts "\nGoodbye."
-end