New Scan Script

#!/bin/bash

# Script made during the CyberWar class for the students to play with, debug, and improve.
# Take a look at the following websites for ideas:
# https://github.com/commonexploits/port-scan-automation
# https://www.commonexploits.com/penetration-testing-scripts/
# https://github.com/averagesecurityguy/scripts
# https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py



# Some thoughts of things to add to this script:
# Shodan queries (API key)
# AWS scanning (need credentials)
# Jenkins scanning
# Active Directory enumeration
# Github scanning (API key required)
# Blockchain platforms







#############################################
# Check to see if script is running as root #
#############################################
if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit
fi


####################################
# Check to see if gcc is installed #
####################################
file1="/usr/bin/gcc"
if [ -f "$file1" ]
then
	echo "$file is installed."
    clear
else
	echo "$file not found."
	echo Installing gcc
    apt-get install -y gcc
	clear
fi

########################
# Make the directories #
########################
cd /tmp
rm -rf customerAudit/
rm -rf NetworkAudit/
mkdir -p /tmp/NetworkAudit/discovered_services/
mkdir -p /tmp/NetworkAudit/scan/windows/
mkdir -p /tmp/NetworkAudit/scan/sunrpc/
mkdir -p /tmp/NetworkAudit/scan/ssh/
mkdir -p /tmp/NetworkAudit/scan/ftp/
mkdir -p /tmp/NetworkAudit/scan/http/
mkdir -p /tmp/NetworkAudit/scan/telnet/
mkdir -p /tmp/NetworkAudit/scan/pop3/
mkdir -p /tmp/NetworkAudit/scan/printers/
mkdir -p /tmp/NetworkAudit/scan/mssql_databases/
mkdir -p /tmp/NetworkAudit/scan/oracle_databases/
mkdir -p /tmp/NetworkAudit/scan/mysql_databases/
mkdir -p /tmp/NetworkAudit/scan/mongodb_databases/


#####################
# Download propecia #
#####################
file2="/bin/propecia"
if [ -f "$file2" ]
then
	echo "$file is installed."
    clear
else
	echo "$file not found."
	echo Installing propecia
    cd /tmp
    wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
    gcc propecia.c -o propecia
    cp propecia /bin
fi

######################
# Find Windows Hosts #
######################
clear
echo "Scanning for windows hosts."
propecia 172.31.2 445 >> /tmp/NetworkAudit/discovered_services/windows_hosts
clear
echo "Done scanning for windows hosts. FTP is next."


##################
# Find FTP Hosts #
##################
echo "Scanning for hosts running FTP."
propecia 172.31.2 21 >> /tmp/NetworkAudit/discovered_services/ftp_hosts
clear
echo "Done scanning for FTP hosts. SSH is next."

##################
# Find SSH Hosts #
##################
echo "Scanning for hosts running SSH."
propecia 172.31.2 22 >> /tmp/NetworkAudit/discovered_services/ssh_hosts
clear
echo "Done scanning for SSH hosts. POP3 is next."


###################
# Find POP3 Hosts #
###################
echo "Scanning for hosts running POP3."
propecia 172.31.2 110 >> /tmp/NetworkAudit/discovered_services/pop3_hosts
clear
echo "Done scanning for POP3 hosts. SunRPC is next."


#####################
# Find SunRPC Hosts #
#####################
echo "Scanning for hosts running SunRPC."
propecia 172.31.2 111 >> /tmp/NetworkAudit/discovered_services/sunrpc_hosts
clear
echo "Done scanning for SunRPC hosts. Telnet is next."


#####################
# Find Telnet Hosts #
#####################
echo "Scanning for hosts running Telnet."
propecia 172.31.2 23 >> /tmp/NetworkAudit/discovered_services/telnet_hosts
clear
echo "Done scanning for Telnet hosts. HTTP is next."


###################
# Find HTTP Hosts #
###################
echo "Scanning for hosts running HTTP"
propecia 172.31.2 80 >> /tmp/NetworkAudit/discovered_services/http_hosts
clear
echo "Done scanning for HTTP hosts. HTTPS hosts are next."


###################
# Find HTTPS Hosts #
###################
echo "Scanning for hosts running HTTP"
propecia 172.31.2 443 >> /tmp/NetworkAudit/discovered_services/https_hosts
clear
echo "Done scanning for HTTPS hosts. Databases are next."


##################
# Find Databases #
##################
echo "Scanning for hosts running MS SQL Server"
propecia 172.31.2 1433 >> /tmp/NetworkAudit/discovered_services/mssql_hosts
clear

echo "Scanning for hosts running Oracle"
propecia 172.31.2 1521 >> /tmp/NetworkAudit/discovered_services/oracle_hosts
clear

echo "Scanning for hosts running Postgres"
propecia 172.31.2 5432 >> /tmp/NetworkAudit/discovered_services/postgres_hosts
clear

echo "Scanning for hosts running MongoDB"
propecia 172.31.2 27017 >> /tmp/NetworkAudit/discovered_services/mongodb_hosts
clear

echo "Scanning for hosts running MySQL"
propecia 172.31.2 3306 >> /tmp/NetworkAudit/discovered_services/mysql_hosts
clear
echo "Done doing the host discovery. Moving on to nmap'ing each host discovered. Windows hosts are first."


###############################
# Ok, let's do the NMAP files #
###############################
clear
# Windows
for x in `cat /tmp/NetworkAudit/discovered_services/windows_hosts` ; do nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect $x > /tmp/NetworkAudit/scan/windows/$x ; done
echo "Done with Windows."

clear
# FTP
for x in `cat /tmp/NetworkAudit/discovered_services/ftp_hosts` ; do nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor $x > /tmp/NetworkAudit/scan/ftp/$x ; done
echo "Done with FTP."

clear
# SSH
for x in `cat /tmp/NetworkAudit/discovered_services/ssh_hosts` ; do nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos $x > /tmp/NetworkAudit/scan/ssh/$x ; done
echo "Done with SSH."

clear
# SUNRPC
for x in `cat /tmp/NetworkAudit/discovered_services/sunrpc_hosts` ; do nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo $x > /tmp/NetworkAudit/scan/sunrpc/$x ; done
echo "Done with SunRPC."

clear
# POP3
for x in `cat /tmp/NetworkAudit/discovered_services/pop3_hosts` ; do nmap -Pn -n --open -p110 --script=banner,pop3-capabilities,pop3-ntlm-info,ssl*,tls-nextprotoneg  $x > /tmp/NetworkAudit/scan/pop3/$x ; done
echo "Done with POP3."

# clear
# HTTP Fix this...maybe use https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py
# as a good reference for what nmap nse scripts to run against port 80 and 443
# for x in `cat /tmp/NetworkAudit/discovered_services/http_hosts` ; do nmap -sV -O --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" $x > /tmp/NetworkAudit/scan/http/$x ; done
# echo "Done with HTTP."


# clear
# HTTP Fix this...maybe use https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py
# as a good reference for what nmap nse scripts to run against port 80 and 443
# for x in `cat /tmp/NetworkAudit/discovered_services/https_hosts` ; do nmap -sV -O --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" $x > /tmp/NetworkAudit/scan/http/$x ; done
# echo "Done with HTTP."


clear
# SQL Servers
for x in `cat /tmp/NetworkAudit/discovered_services/mssql_hosts` ; do -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info $x > /tmp/NetworkAudit/scan/mssql_databases/$x ; done
echo "Done with MS SQL."

clear
# Oracle Servers
# FIX THIS: needs brute force wordlists for this to run correctly
# for x in `cat /tmp/NetworkAudit/discovered_services/oracle_hosts` ; do nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt $x >> /tmp/NetworkAudit/scan/oracle_databases/$x ; done
# echo "Done with Oracle."

clear
# MongoDB
for x in `cat /tmp/NetworkAudit/discovered_services/mongodb_hosts` ; do nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info  $x > /tmp/NetworkAudit/scan/mongodb_databases/$x ; done
echo "Done with MongoDB."


clear
# MySQL Servers
for x in `cat /tmp/NetworkAudit/discovered_services/mysql_hosts` ; do nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables $x >> /tmp/NetworkAudit/scan/mysql_databases/$x ; done
echo "Done with MySQL."


# Add postgres nse scripts
# References:
# https://nmap.org/nsedoc/lib/pgsql.html
# https://nmap.org/nsedoc/scripts/pgsql-brute.html
#

echo " "
echo " "
sleep 1
clear
echo "Done, now check your results."
sleep 2
clear
cd /tmp/NetworkAudit/scan/
ls