pwn 0.5.509 → 0.5.510

data/bin/pwn_nmap_discover_tcp_udp

@@ -0,0 +1,353 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'ipaddr'
+require 'pwn'
+require 'time'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-fFILE', '--target-file=FILE', '<Required if --target-range excluded - File containing one supported nmap target / line e.g. foo.bar, 10.1.1.1, 192.168.1.1-20, 192.168.1.0/24, etc>') do |f|
+    opts[:target_file] = f
+  end
+
+  options.on('-tRANGE', '--target-range=RANGE', '<Required if --target-file excluded - nmap supported host || ip range e.g. foo.bar, 10.1.1.1, 192.168.1.1-20, 192.168.1.0/24, etc>') do |t|
+    opts[:target_range] = t
+  end
+
+  options.on('-eFILE', '--target-exclude-file=FILE', '<Optional - IP excludes file>') do |e|
+    opts[:exclude_file] = e
+  end
+
+  options.on('-iINTERFACE', '--interface=INTERFACE', '<Optional - use specified network interface (Default: eth0)') do |i|
+    opts[:interface] = i
+  end
+
+  options.on('-rDIR', '--results-root=DIR', '<Optional - nmap results root (Default: /tmp)>') do |r|
+    opts[:results_root] = r
+  end
+
+  options.on('-S', '--stop-nse', '<Optional - Disable Nmap Scripting Engine>') do |n|
+    opts[:stop_nse] = n
+  end
+
+  options.on('-T', '--tor', '<Optional - Source Scans from Tor Nodes>') do |t|
+    opts[:with_tor] = t
+  end
+end.parse!
+
+ftimestr = '%Y-%m-%d %H:%M:%S.%N%z'
+started_at = Time.now.strftime(ftimestr)
+started_at_parse = Time.parse(started_at)
+banner = '-' * 64
+puts "\n\n\n#{banner}"
+puts "- STARTED: #{started_at} "
+
+target_file = opts[:target_file]
+target_range = opts[:target_range]
+if (target_file && target_range) || (!target_file && !target_range)
+  puts 'ERROR: Must specify --target-file OR --target-range'
+  exit 1
+end
+
+results_root = opts[:results_root]
+results_root ||= '/tmp'
+FileUtils.mkdir_p results_root
+puts "Results Saved in: #{results_root}"
+
+exclude_file = opts[:exclude_file]
+exclude_file ||= "#{results_root}/nmap_targets_exclude.txt"
+# We create an exclude file (even if its empty)
+File.new(exclude_file, 'w') unless File.exist?(exclude_file)
+
+interface = opts[:interface]
+interface ||= 'eth0'
+
+stop_nse = true if opts[:stop_nse]
+stop_nse ||= false
+
+with_tor = true if opts[:with_tor]
+with_tor ||= false
+
+if with_tor
+  tor_obj = PWN::Plugins::Tor.start
+  proxy = ["socks4://#{tor_obj[:ip]}:#{tor_obj[:port]}"]
+end
+
+discovery_tcp_ports = {
+  ftp: 21,
+  ssh: 22,
+  telnet: 23,
+  smtp: 25,
+  http: 80,
+  pop3: 110,
+  ident: 113,
+  msrpc: 135,
+  netbios_name_service: 137,
+  netbios_session_service: 139,
+  imap: 143,
+  ldap: 389,
+  https: 443,
+  smb: 445,
+  smtps: 465,
+  remote_process: 512,
+  login: 513,
+  ldaps: 636,
+  rsync: 873,
+  imaps: 993,
+  openvpn: 1194,
+  mssql: 1433,
+  oracle: 1521,
+  pptp: 1723,
+  radius: 1812,
+  nfs: 2049,
+  mysql: 3306,
+  rdp: 3389,
+  meterpreter: 4444,
+  upnp: 5000,
+  postgres: 5432,
+  postgres_alt: 5433,
+  amqp: 5672,
+  vnc: 5900,
+  vncs: 5901,
+  x11: 6000,
+  irc: 6667,
+  http_alt: 8080,
+  https_alt: 8443,
+  http_alt2: 8888,
+  http_alt3: 9090,
+  http_alt4: 9999
+}
+
+discovery_udp_ports = {
+  dns: 53,
+  dhcp: 67,
+  dhcp_client: 68,
+  tftp: 69,
+  nfs: 111,
+  ntp: 123,
+  snmp: 161,
+  snmp_traps: 162,
+  syslog: 514,
+  rip: 520,
+  iax: 4569,
+  sip: 5060,
+  mdns: 5353
+}
+
+discovery_sctp_ports = {
+  sigtran: 2905,
+  stl: 5000,
+  sap: 5004,
+  turn_ip: 5766,
+  sicc: 38_412
+}
+
+discovered_targets_file = "#{results_root}/nmap_discovery_results.txt"
+latest_discovery_results = "#{results_root}/nmap_discovery_results.xml"
+latest_tcp_results = "#{results_root}/nmap_tcp_results"
+latest_udp_results = "#{results_root}/nmap_udp_results"
+
+begin
+  # Per man nmap:
+  # The main effects of T0 are serializing the scan so only one port
+  # is scanned at a time, and waiting five minutes between sending
+  # each probe.
+  # T1 and T2 are similar but they only wait 15 seconds and 0.4 seconds,
+  # respectively, between probes.
+  # T3 is Nmap's default behavior, which includes parallelization.
+  # T4 does the equivalent of --max-rtt-timeout 1250ms --min-rtt-timeout 100ms
+  # --initial-rtt-timeout 500ms --max-retries 6 and sets the maximum TCP and
+  # SCTP scan delay to 10ms.
+  # T5 does the equivalent of --max-rtt-timeout 300ms --min-rtt-timeout 50ms
+  # --initial-rtt-timeout 250ms --max-retries 2 --host-timeout 15m
+  # --script-timeout 10m --max-scan-delay as well as setting the maximum TCP
+  # and SCTP scan delay to 5ms. Maximum UDP scan delay is not set by T4 or T5,
+  # but it can be set with the --max-scan-delay option.
+
+  # Target Discovery Scan
+  # Using -T5 template to reduce number of
+  # retransmission attempts on filtered ports.
+  puts banner
+  puts '- PHASE 1: Target Discovery'
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    if with_tor
+      nmap.proxies = proxy
+      nmap.ack_discovery = discovery_tcp_ports.values
+    else
+      nmap.udp_discovery = discovery_udp_ports.values
+    end
+    nmap.ping = true
+    nmap.arp_ping = true
+    nmap.icmp_echo_discovery = true
+    nmap.icmp_timestamp_discovery = true
+    nmap.syn_discovery = discovery_tcp_ports.values
+    nmap.sctp_init_ping = discovery_sctp_ports.values
+    nmap.verbose = true
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.insane_timing = true
+    nmap.output_xml = latest_discovery_results
+    nmap.targets = target_range if target_range
+    nmap.target_file = target_file if target_file
+    nmap.randomize_hosts = true
+    nmap.min_parallelism = 36
+    nmap.max_retries = 3
+    nmap.max_scan_delay = 3
+  end
+
+  # Generate targets.txt from discovery above
+  # taking into consideration IPs to skip scans
+  File.open(discovered_targets_file, 'w') do |f|
+    PWN::Plugins::NmapIt.parse_xml_results(
+      xml_file: latest_discovery_results
+    ) do |xml|
+      xml.each_host do |host|
+        next if File.read(exclude_file).include?(host.ip) ||
+                host.status.state != :up
+
+        f.puts host.ip
+      end
+    end
+  end
+
+  # Produce a good targets.txt redacting duplicates && sorting by IP
+  sorted_ips = File.readlines(discovered_targets_file).uniq.map do |ip|
+    IPAddr.new(ip.chomp)
+  end
+  sorted_ips = sorted_ips.sort_by(&:hton)
+
+  # Now Add additional info about the IP as a comment
+  File.open(discovered_targets_file, 'w') do |f|
+    sorted_ips.each do |ip|
+      PWN::Plugins::NmapIt.parse_xml_results(
+        xml_file: latest_discovery_results
+      ) do |xml|
+        xml.each_host do |host|
+          next unless host.ip.to_s == ip.to_s
+
+          hosts_arr = host.hostnames.map { |h| h[:name] }
+          f.puts "#{ip} # { \"hostnames\": #{hosts_arr}}, \"mac\": \"#{host.mac}\" }"
+        end
+      end
+    end
+  end
+
+  phase1_ended_at = Time.now.strftime(ftimestr)
+  phase1_ended_at_parse = Time.parse(phase1_ended_at)
+  elapsed_in_seconds = (phase1_ended_at_parse - started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n#{banner}"
+  puts "- DISCOVERY COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+  puts banner
+
+  puts "\n\n\n#{banner}"
+  puts '- PHASE 2: TCP Port Scanning'
+  puts banner
+  phase2_started_at = Time.now.strftime(ftimestr)
+  phase2_started_at_parse = Time.parse(phase2_started_at)
+
+  # Switch Tor Exit Node if with_tor
+  if with_tor
+    puts '- INFO: Switching to Clean Tor Circuit...'
+    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
+  end
+
+  # TCP Scan
+  # Using -T5 template to reduce number of
+  # retransmission attempts on filtered ports.
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.proxies = proxy if with_tor
+    unless stop_nse
+      nmap.default_script = true
+      nmap.update_scriptdb = true
+    end
+    nmap.verbose = true
+    nmap.target_file = discovered_targets_file
+    nmap.randomize_hosts = true
+    nmap.show_reason = true
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.min_host_group = 9
+    nmap.host_timeout = '36m'
+    nmap.insane_timing = true
+    nmap.skip_discovery = true
+    nmap.syn_scan = true
+    nmap.ports = [1..65_535]
+    nmap.output_all = latest_tcp_results
+    nmap.min_parallelism = 36
+    nmap.max_retries = 3
+    nmap.max_scan_delay = 3
+  end
+  FileUtils.cp("#{latest_tcp_results}.nmap", "#{latest_tcp_results}.txt")
+  phase2_ended_at = Time.now.strftime(ftimestr)
+  phase2_ended_at_parse = Time.parse(phase2_ended_at)
+  elapsed_in_seconds = (phase2_ended_at_parse - phase2_started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n#{banner}"
+  puts "- TCP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+  puts banner
+
+  puts "\n\n\n#{banner}"
+  puts '- PHASE 3: UDP Port Scanning'
+  puts banner
+  phase3_started_at = Time.now.strftime(ftimestr)
+  phase3_started_at_parse = Time.parse(phase3_started_at)
+
+  # Switch Tor Exit Node if with_tor
+  if with_tor
+    puts '- INFO: Switching to Clean Tor Circuit...'
+    PWN::Plugins::Tor.switch_exit_node(tor_obj: tor_obj)
+  end
+
+  # UDP Scan
+  # Using -T5 template to reduce number of
+  # retransmission attempts on filtered ports.
+  PWN::Plugins::NmapIt.port_scan do |nmap|
+    nmap.proxies = proxy if with_tor
+    unless stop_nse
+      nmap.default_script = true
+      nmap.update_scriptdb = true
+    end
+    nmap.verbose = true
+    nmap.target_file = discovered_targets_file
+    nmap.fast = true
+    nmap.randomize_hosts = true
+    nmap.show_reason = true
+    nmap.exclude_file = exclude_file
+    nmap.interface = interface
+    nmap.min_host_group = 9
+    nmap.host_timeout = '3m'
+    nmap.insane_timing = true
+    nmap.skip_discovery = true
+    nmap.udp_scan = true
+    nmap.output_all = latest_udp_results
+    nmap.min_parallelism = 36
+    nmap.max_retries = 0
+    nmap.max_scan_delay = 3
+    nmap.data_length = Random.rand(1..256)
+  end
+  FileUtils.cp("#{latest_udp_results}.nmap", "#{latest_udp_results}.txt")
+  phase3_ended_at = Time.now.strftime(ftimestr)
+  phase3_ended_at_parse = Time.parse(phase3_ended_at)
+  elapsed_in_seconds = (phase3_ended_at_parse - phase3_started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n#{banner}"
+  puts "- UDP SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+  puts banner
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+rescue StandardError => e
+  raise e
+ensure
+  tor_obj = PWN::Plugins::Tor.stop(tor_obj: tor_obj) if with_tor
+  ended_at = Time.now.strftime(ftimestr)
+  ended_at_parse = Time.parse(ended_at)
+  elapsed_in_seconds = (ended_at_parse - started_at_parse).to_f
+  fmt_elapsed_in_seconds = format('%0.2f', elapsed_in_seconds)
+  puts "\n\n\n#{banner}"
+  puts "- ENDED: #{ended_at}"
+  puts "- SCAN COMPLETE!  DURATION: #{fmt_elapsed_in_seconds} seconds"
+  puts banner
+end

data/bin/pwn_openvas_vulnscan

@@ -0,0 +1,104 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-cYPATH', '--yaml-config=YPATH', '<Required - YAML Config Containing Username & Password for Authentication>') do |c|
+    opts[:yaml_config] = c
+  end
+
+  options.on('-tTASK_NAME', '--task-name=TASK_NAME', '<Required - Task Name to Start>') do |t|
+    opts[:task_name] = t
+  end
+
+  options.on('-sDIR', '--save-report-to-dir=DIR', '<Required - Directory to Save Report>') do |d|
+    opts[:report_dir] = d
+  end
+
+  options.on('-fFILTER', '--report-filter=FILTER', '<Optional - GVM Results Filter (Default: "apply_overrides=0 levels=hml rows=1000 min_qod=70 first=1 sort-reverse=severity")>') do |p|
+    opts[:password] = p
+  end
+end.parse!
+
+task_name = opts[:task_name]
+
+report_dir = opts[:report_dir].to_s.scrub
+raise "#{report_dir} Does Not Exist." unless Dir.exist?(
+  report_dir
+)
+
+yaml_config = opts[:yaml_config]
+
+raise "YAML Config Not Found: #{yaml_config}" unless File.exist?(yaml_config)
+
+yaml = YAML.load_file(
+  yaml_config,
+  symbolize_names: true
+)
+
+username = yaml[:username]
+password = if yaml[:password].nil?
+             PWN::Plugins::AuthenticationHelper.mask_password
+           else
+             yaml[:password].to_s.scrub
+           end
+
+report_filter = opts[:report_filter]
+
+begin
+  start_time = Time.now
+  puts "Started: #{start_time}"
+  PWN::Plugins::OpenVAS.start_task(
+    task_name: task_name,
+    username: username,
+    password: password
+  )
+
+  loop do
+    if PWN::Plugins::OpenVAS.get_task_status(
+      task_name: task_name,
+      username: username,
+      password: password
+    ).downcase == 'done'
+
+      end_time = Time.now
+      puts "\nCompleted: #{end_time}"
+      break
+    end
+
+    print '.'
+    sleep 30
+  end
+
+  end_time = Time.now
+  duration_mins = format(
+    '%0.2f',
+    (end_time - start_time) / 60
+  )
+
+  last_report_id = PWN::Plugins::OpenVAS.last_report_id(
+    task_name: task_name,
+    username: username,
+    password: password
+  )
+  puts "\nLast Report ID Generated by #{task_name}: #{last_report_id}"
+
+  print "Saving report in #{report_dir}..."
+  PWN::Plugins::OpenVAS.save_report(
+    report_type: :csv,
+    report_id: last_report_id,
+    report_dir: report_dir,
+    report_filter: report_filter,
+    username: username,
+    password: password
+  )
+  puts 'complete.'
+
+  puts "Task Duration (Minutes): #{duration_mins}"
+rescue Interrupt
+  puts 'CTRL+C detected...goodbye.'
+rescue StandardError => e
+  raise e
+end

data/bin/pwn_pastebin_sample_filter

@@ -0,0 +1,47 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-rPATTERN', '--regex=PATTERN', "<Required - Regex Pattern for Interesting Pastes ('.*' for All)>") do |r|
+    opts[:regex] = r
+  end
+
+  options.on('-pPROXY', '--proxy=PROXY', '<Optional - HTTP or Socks Proxy || tor>') do |p|
+    opts[:proxy] = p
+  end
+end.parse!
+
+proxy = opts[:proxy]
+regex = opts[:regex]
+
+browser_obj = PWN::WWW::Pastebin.open(
+  browser_type: :headless,
+  proxy: proxy
+)
+
+browser = browser_obj[:browser]
+
+begin
+  loop do
+    browser.div(id: 'menu_2').links[0].click
+    code_frame = browser.div(id: 'code_frame').text
+    if code_frame.match?(/#{regex}/mi)
+      puts "\nCurrent Link: #{browser.url}"
+      puts "#{code_frame}\n\n\n"
+    else
+      print '.'
+    end
+    sleep 9
+  end
+rescue StandardError => e
+  raise e
+ensure
+  if browser_obj
+    browser_obj = PWN::Plugins::TransparentBrowser.close(
+      browser_obj: browser_obj
+    )
+  end
+end

data/bin/pwn_phone

@@ -0,0 +1,129 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# require 'fftw3'
+require 'fileutils'
+require 'pwn'
+require 'ruby-audio'
+require 'waveform'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-tPATH', '--target-file=PATH', '<Required - File Containing List of Targets to Dial>') do |t|
+    opts[:target_file] = t
+  end
+
+  options.on('-sSEC', '--seconds-to-record=SEC', '<Optional - Seconds to Record (Defaults to 60)>') do |s|
+    opts[:seconds_to_record] = s
+  end
+
+  options.on('-TTHREADS', '--max-threads=THREADS', '<Optional # Calls to Run Simultaneously (Defaults to 3)>') do |t|
+    opts[:max_threads] = t
+  end
+
+  options.on('-bPATH', '--baresip-binary=PATH', '<Optional - Path to baresip Binary (Defaults to /usr/bin/baresip)>') do |bs|
+    opts[:baresip_bin] = bs
+  end
+
+  options.on('-SSOX', '--sox-path=SOX', '<Optional - Path to SoX Binary, the Swiss Army knife of Audio (Defaults to /usr/bin/sox)>') do |sox|
+    opts[:sox_bin] = sox
+  end
+
+  options.on('-rDIR', '--session-root=DIR', '<Optional - Directory to Store Session Files (Defaults to Present Working Directory))>') do |sr|
+    opts[:session_root] = sr
+  end
+
+  options.on('-R', '--[no-]randomize', '<Optional - Randomize Number Range (Defaults to false)>') do |r|
+    opts[:randomize] = r
+  end
+
+  options.on('-nREPORTNAME', '--report-name=REPORTNAME', '<Optional Report Name (Defaults to, "File.basename(Dir.pwd)")>') do |n|
+    opts[:report_name] = n
+  end
+
+  options.on('-H', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
+    opts[:start_reporting_server] = s
+  end
+
+  options.on('-X', '--[no-]speech-to-text', '<Optional - Speech to Text from Audio Recordings>') do |x|
+    opts[:speech_to_text] = x
+  end
+
+  options.on('-xRULES', '--source-num-rules=RULES', '<Optional - Comma-delimited list of rules for src_num format (i.e. XXXXXXXXXX, static, self, same_country, same_area, and/or same_prefix [Defaults to random src_num w/ same length as target_num])>') do |x|
+    opts[:src_num_rules] = x
+  end
+
+  # TODO: Add an hours of operation flag.
+  # TODO: Add a resume feature to resume session following an interruption.
+  # TODO: Append results to pwn_phone_results.json as things are running #save_memory.
+end.parse!
+
+begin
+  pwn_provider = 'ruby-gem'
+  # pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.select { |s| s == 'PWN_PROVIDER' }.any?
+  pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.any? { |s| s == 'PWN_PROVIDER' }
+  $stdout.sync = true
+
+  # Required Flag Variables
+  target_file = opts[:target_file]
+  max_threads = opts[:max_threads]
+  seconds_to_record = opts[:seconds_to_record]
+  baresip_bin = opts[:baresip_bin]
+  sox_bin = opts[:sox_bin]
+  session_root = opts[:session_root] ||= '.'
+  # session_root = opts[:session_root] ||= Dir.pwd
+
+  # Optional Flag Variables
+  randomize = opts[:randomize]
+  report_name = opts[:report_name]
+  report_name ||= File.basename(Dir.pwd)
+  start_reporting_server = opts[:start_reporting_server]
+  speech_to_text = opts[:speech_to_text]
+  src_num_rules = opts[:src_num_rules]
+
+  # Initiallize Phone Reconaissance
+  results_hash = PWN::Plugins::BareSIP.recon(
+    baresip_bin: baresip_bin,
+    session_root: session_root,
+    target_file: target_file,
+    randomize: randomize,
+    src_num_rules: src_num_rules,
+    seconds_to_record: seconds_to_record,
+    sox_bin: sox_bin,
+    speech_to_text: speech_to_text,
+    report_name: report_name
+  )
+
+  # Generate HTML Report
+  print "#{File.basename($PROGRAM_NAME)} Generating Report..."
+  PWN::Reports::Phone.generate(
+    dir_path: session_root,
+    results_hash: results_hash
+  )
+  puts 'complete.'
+
+  # Start Simple HTTP Server (If Requested)
+  if start_reporting_server
+    listen_port = PWN::Plugins::Sock.get_random_unused_port.to_s
+
+    if pwn_provider == 'docker'
+      listen_ip = '0.0.0.0'
+    else
+      listen_ip = '127.0.0.1'
+    end
+
+    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/#{report_name}.html"
+    Dir.chdir(session_root)
+    system(
+      'pwn_simple_http_server',
+      '-i',
+      listen_ip,
+      '-p',
+      listen_port
+    )
+  end
+rescue StandardError => e
+  raise e.message
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+end