From 8b29595f18d73255877f1ebf330bd6b4ebba2d4d Mon Sep 17 00:00:00 2001 From: Eli McRae Date: Mon, 20 Feb 2023 09:35:49 -0600 Subject: [PATCH] option to disable dirbuster. --- autorecon/default-plugins/__init__.py | 0 autorecon/default-plugins/bruteforce-ftp.py | 17 ++++ autorecon/default-plugins/bruteforce-http.py | 20 ++++ autorecon/default-plugins/bruteforce-rdp.py | 17 ++++ autorecon/default-plugins/bruteforce-smb.py | 17 ++++ autorecon/default-plugins/bruteforce-ssh.py | 17 ++++ .../default-plugins/curl-known-security.py | 26 ++++++ autorecon/default-plugins/curl-robots.py | 26 ++++++ autorecon/default-plugins/curl.py | 18 ++++ .../default-plugins/dns-reverse-lookup.py | 14 +++ .../default-plugins/dns-zone-transfer.py | 18 ++++ .../dnsrecon-subdomain-bruteforce.py | 27 ++++++ autorecon/default-plugins/dnsrecon.py | 30 ++++++ autorecon/default-plugins/enum4linux.py | 34 +++++++ autorecon/default-plugins/get-arch.py | 16 ++++ autorecon/default-plugins/ldap-search.py | 16 ++++ autorecon/default-plugins/lookup-sid.py | 16 ++++ autorecon/default-plugins/nbtscan.py | 17 ++++ autorecon/default-plugins/nikto.py | 16 ++++ autorecon/default-plugins/nmap-ajp.py | 14 +++ autorecon/default-plugins/nmap-cassandra.py | 14 +++ autorecon/default-plugins/nmap-cups.py | 14 +++ autorecon/default-plugins/nmap-distccd.py | 14 +++ autorecon/default-plugins/nmap-dns.py | 14 +++ autorecon/default-plugins/nmap-finger.py | 14 +++ autorecon/default-plugins/nmap-ftp.py | 14 +++ autorecon/default-plugins/nmap-http.py | 17 ++++ autorecon/default-plugins/nmap-imap.py | 14 +++ autorecon/default-plugins/nmap-irc.py | 14 +++ autorecon/default-plugins/nmap-kerberos.py | 17 ++++ autorecon/default-plugins/nmap-ldap.py | 14 +++ autorecon/default-plugins/nmap-mongodb.py | 14 +++ autorecon/default-plugins/nmap-mountd.py | 14 +++ autorecon/default-plugins/nmap-msrpc.py | 14 +++ autorecon/default-plugins/nmap-mssql.py | 18 ++++ .../default-plugins/nmap-multicast-dns.py | 14 +++ autorecon/default-plugins/nmap-mysql.py | 18 ++++ autorecon/default-plugins/nmap-nfs.py | 14 +++ autorecon/default-plugins/nmap-nntp.py | 14 +++ autorecon/default-plugins/nmap-ntp.py | 14 +++ autorecon/default-plugins/nmap-oracle.py | 17 ++++ autorecon/default-plugins/nmap-pop3.py | 14 +++ autorecon/default-plugins/nmap-rdp.py | 14 +++ autorecon/default-plugins/nmap-redis.py | 14 +++ autorecon/default-plugins/nmap-rmi.py | 14 +++ autorecon/default-plugins/nmap-rsync.py | 14 +++ autorecon/default-plugins/nmap-sip.py | 14 +++ autorecon/default-plugins/nmap-smb.py | 14 +++ autorecon/default-plugins/nmap-smtp.py | 14 +++ autorecon/default-plugins/nmap-snmp.py | 14 +++ autorecon/default-plugins/nmap-ssh.py | 14 +++ autorecon/default-plugins/nmap-telnet.py | 14 +++ autorecon/default-plugins/nmap-tftp.py | 14 +++ autorecon/default-plugins/nmap-vnc.py | 14 +++ autorecon/default-plugins/onesixtyone.py | 18 ++++ autorecon/default-plugins/oracle-odat.py | 21 +++++ autorecon/default-plugins/oracle-patator.py | 14 +++ autorecon/default-plugins/oracle-scanner.py | 20 ++++ autorecon/default-plugins/oracle-tnscmd.py | 22 +++++ .../default-plugins/portscan-all-tcp-ports.py | 52 +++++++++++ .../portscan-guess-tcp-ports.py | 48 ++++++++++ .../portscan-top-100-udp-ports.py | 40 ++++++++ autorecon/default-plugins/redis-cli.py | 24 +++++ .../default-plugins/reporting-cherrytree.py | 91 +++++++++++++++++++ .../default-plugins/reporting-markdown.py | 75 +++++++++++++++ autorecon/default-plugins/rpcclient.py | 14 +++ autorecon/default-plugins/rpcdump.py | 16 ++++ autorecon/default-plugins/rsync-list-files.py | 14 +++ autorecon/default-plugins/showmount.py | 14 +++ autorecon/default-plugins/sipvicious.py | 15 +++ autorecon/default-plugins/smb-vuln.py | 18 ++++ autorecon/default-plugins/smbclient.py | 16 ++++ autorecon/default-plugins/smbmap.py | 20 ++++ autorecon/default-plugins/smtp-user-enum.py | 20 ++++ autorecon/default-plugins/snmpwalk.py | 23 +++++ autorecon/default-plugins/sslscan.py | 16 ++++ .../default-plugins/subdomain-enumeration.py | 34 +++++++ .../virtual-host-enumeration.py | 39 ++++++++ autorecon/default-plugins/whatweb.py | 16 ++++ autorecon/default-plugins/winrm-detection.py | 32 +++++++ autorecon/default-plugins/wkhtmltoimage.py | 23 +++++ autorecon/default-plugins/wpscan.py | 20 ++++ 82 files changed, 1644 insertions(+) create mode 100644 autorecon/default-plugins/__init__.py create mode 100644 autorecon/default-plugins/bruteforce-ftp.py create mode 100644 autorecon/default-plugins/bruteforce-http.py create mode 100644 autorecon/default-plugins/bruteforce-rdp.py create mode 100644 autorecon/default-plugins/bruteforce-smb.py create mode 100644 autorecon/default-plugins/bruteforce-ssh.py create mode 100644 autorecon/default-plugins/curl-known-security.py create mode 100644 autorecon/default-plugins/curl-robots.py create mode 100644 autorecon/default-plugins/curl.py create mode 100644 autorecon/default-plugins/dns-reverse-lookup.py create mode 100644 autorecon/default-plugins/dns-zone-transfer.py create mode 100644 autorecon/default-plugins/dnsrecon-subdomain-bruteforce.py create mode 100644 autorecon/default-plugins/dnsrecon.py create mode 100644 autorecon/default-plugins/enum4linux.py create mode 100644 autorecon/default-plugins/get-arch.py create mode 100644 autorecon/default-plugins/ldap-search.py create mode 100644 autorecon/default-plugins/lookup-sid.py create mode 100644 autorecon/default-plugins/nbtscan.py create mode 100644 autorecon/default-plugins/nikto.py create mode 100644 autorecon/default-plugins/nmap-ajp.py create mode 100644 autorecon/default-plugins/nmap-cassandra.py create mode 100644 autorecon/default-plugins/nmap-cups.py create mode 100644 autorecon/default-plugins/nmap-distccd.py create mode 100644 autorecon/default-plugins/nmap-dns.py create mode 100644 autorecon/default-plugins/nmap-finger.py create mode 100644 autorecon/default-plugins/nmap-ftp.py create mode 100644 autorecon/default-plugins/nmap-http.py create mode 100644 autorecon/default-plugins/nmap-imap.py create mode 100644 autorecon/default-plugins/nmap-irc.py create mode 100644 autorecon/default-plugins/nmap-kerberos.py create mode 100644 autorecon/default-plugins/nmap-ldap.py create mode 100644 autorecon/default-plugins/nmap-mongodb.py create mode 100644 autorecon/default-plugins/nmap-mountd.py create mode 100644 autorecon/default-plugins/nmap-msrpc.py create mode 100644 autorecon/default-plugins/nmap-mssql.py create mode 100644 autorecon/default-plugins/nmap-multicast-dns.py create mode 100644 autorecon/default-plugins/nmap-mysql.py create mode 100644 autorecon/default-plugins/nmap-nfs.py create mode 100644 autorecon/default-plugins/nmap-nntp.py create mode 100644 autorecon/default-plugins/nmap-ntp.py create mode 100644 autorecon/default-plugins/nmap-oracle.py create mode 100644 autorecon/default-plugins/nmap-pop3.py create mode 100644 autorecon/default-plugins/nmap-rdp.py create mode 100644 autorecon/default-plugins/nmap-redis.py create mode 100644 autorecon/default-plugins/nmap-rmi.py create mode 100644 autorecon/default-plugins/nmap-rsync.py create mode 100644 autorecon/default-plugins/nmap-sip.py create mode 100644 autorecon/default-plugins/nmap-smb.py create mode 100644 autorecon/default-plugins/nmap-smtp.py create mode 100644 autorecon/default-plugins/nmap-snmp.py create mode 100644 autorecon/default-plugins/nmap-ssh.py create mode 100644 autorecon/default-plugins/nmap-telnet.py create mode 100644 autorecon/default-plugins/nmap-tftp.py create mode 100644 autorecon/default-plugins/nmap-vnc.py create mode 100644 autorecon/default-plugins/onesixtyone.py create mode 100644 autorecon/default-plugins/oracle-odat.py create mode 100644 autorecon/default-plugins/oracle-patator.py create mode 100644 autorecon/default-plugins/oracle-scanner.py create mode 100644 autorecon/default-plugins/oracle-tnscmd.py create mode 100644 autorecon/default-plugins/portscan-all-tcp-ports.py create mode 100644 autorecon/default-plugins/portscan-guess-tcp-ports.py create mode 100644 autorecon/default-plugins/portscan-top-100-udp-ports.py create mode 100644 autorecon/default-plugins/redis-cli.py create mode 100644 autorecon/default-plugins/reporting-cherrytree.py create mode 100644 autorecon/default-plugins/reporting-markdown.py create mode 100644 autorecon/default-plugins/rpcclient.py create mode 100644 autorecon/default-plugins/rpcdump.py create mode 100644 autorecon/default-plugins/rsync-list-files.py create mode 100644 autorecon/default-plugins/showmount.py create mode 100644 autorecon/default-plugins/sipvicious.py create mode 100644 autorecon/default-plugins/smb-vuln.py create mode 100644 autorecon/default-plugins/smbclient.py create mode 100644 autorecon/default-plugins/smbmap.py create mode 100644 autorecon/default-plugins/smtp-user-enum.py create mode 100644 autorecon/default-plugins/snmpwalk.py create mode 100644 autorecon/default-plugins/sslscan.py create mode 100644 autorecon/default-plugins/subdomain-enumeration.py create mode 100644 autorecon/default-plugins/virtual-host-enumeration.py create mode 100644 autorecon/default-plugins/whatweb.py create mode 100644 autorecon/default-plugins/winrm-detection.py create mode 100644 autorecon/default-plugins/wkhtmltoimage.py create mode 100644 autorecon/default-plugins/wpscan.py diff --git a/autorecon/default-plugins/__init__.py b/autorecon/default-plugins/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/autorecon/default-plugins/bruteforce-ftp.py b/autorecon/default-plugins/bruteforce-ftp.py new file mode 100644 index 0000000..24cd7c8 --- /dev/null +++ b/autorecon/default-plugins/bruteforce-ftp.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class BruteforceFTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Bruteforce FTP" + self.tags = ['default', 'ftp'] + + def configure(self): + self.match_service_name(['^ftp', '^ftp\-data']) + + def manual(self, service, plugin_was_run): + service.add_manual_commands('Bruteforce logins:', [ + 'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_ftp_hydra.txt" ftp://{addressv6}', + 'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_ftp_medusa.txt" -M ftp -h {addressv6}' + ]) diff --git a/autorecon/default-plugins/bruteforce-http.py b/autorecon/default-plugins/bruteforce-http.py new file mode 100644 index 0000000..d735ac4 --- /dev/null +++ b/autorecon/default-plugins/bruteforce-http.py @@ -0,0 +1,20 @@ +from autorecon.plugins import ServiceScan + +class BruteforceHTTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Bruteforce HTTP" + self.tags = ['default', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + def manual(self, service, plugin_was_run): + service.add_manual_commands('Credential bruteforcing commands (don\'t run these without modifying them):', [ + 'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_{http_scheme}_auth_hydra.txt" {http_scheme}-get://{addressv6}/path/to/auth/area', + 'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_{http_scheme}_auth_medusa.txt" -M http -h {addressv6} -m DIR:/path/to/auth/area', + 'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_{http_scheme}_form_hydra.txt" {http_scheme}-post-form://{addressv6}/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"', + 'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_{http_scheme}_form_medusa.txt" -M web-form -h {addressv6} -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"' + ]) diff --git a/autorecon/default-plugins/bruteforce-rdp.py b/autorecon/default-plugins/bruteforce-rdp.py new file mode 100644 index 0000000..fb38e82 --- /dev/null +++ b/autorecon/default-plugins/bruteforce-rdp.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class BruteforceRDP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Bruteforce RDP" + self.tags = ['default', 'rdp'] + + def configure(self): + self.match_service_name(['^rdp', '^ms\-wbt\-server', '^ms\-term\-serv']) + + def manual(self, service, plugin_was_run): + service.add_manual_commands('Bruteforce logins:', [ + 'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_rdp_hydra.txt" rdp://{addressv6}', + 'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_rdp_medusa.txt" -M rdp -h {addressv6}' + ]) diff --git a/autorecon/default-plugins/bruteforce-smb.py b/autorecon/default-plugins/bruteforce-smb.py new file mode 100644 index 0000000..da658cc --- /dev/null +++ b/autorecon/default-plugins/bruteforce-smb.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class BruteforceSMB(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Bruteforce SMB' + self.tags = ['default', 'safe', 'active-directory'] + + def configure(self): + self.match_service('tcp', 445, '^microsoft\-ds') + self.match_service('tcp', 139, '^netbios') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Bruteforce SMB', [ + 'crackmapexec smb {address} --port={port} -u "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -p "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '"' + ]) diff --git a/autorecon/default-plugins/bruteforce-ssh.py b/autorecon/default-plugins/bruteforce-ssh.py new file mode 100644 index 0000000..75bb436 --- /dev/null +++ b/autorecon/default-plugins/bruteforce-ssh.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class BruteforceSSH(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Bruteforce SSH" + self.tags = ['default', 'ssh'] + + def configure(self): + self.match_service_name('ssh') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Bruteforce logins:', [ + 'hydra -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e nsr -s {port} -o "{scandir}/{protocol}_{port}_ssh_hydra.txt" ssh://{addressv6}', + 'medusa -U "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -P "' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '" -e ns -n {port} -O "{scandir}/{protocol}_{port}_ssh_medusa.txt" -M ssh -h {addressv6}' + ]) diff --git a/autorecon/default-plugins/curl-known-security.py b/autorecon/default-plugins/curl-known-security.py new file mode 100644 index 0000000..554db9e --- /dev/null +++ b/autorecon/default-plugins/curl-known-security.py @@ -0,0 +1,26 @@ +from autorecon.plugins import ServiceScan +from autorecon.io import fformat + +class CurlKnownSecurity(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Known Security" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + async def run(self, service): + if service.protocol == 'tcp': + process, stdout, _ = await service.execute('curl -sSikf {http_scheme}://{addressv6}:{port}/.well-known/security.txt', future_outfile='{protocol}_{port}_{http_scheme}_known-security.txt') + + lines = await stdout.readlines() + + if process.returncode == 0 and lines: + filename = fformat('{scandir}/{protocol}_{port}_{http_scheme}_known-security.txt') + with open(filename, mode='wt', encoding='utf8') as robots: + robots.write('\n'.join(lines)) + else: + service.info('{bblue}[' + fformat('{tag}') + ']{rst} There did not appear to be a .well-known/security.txt file in the webroot (/).') diff --git a/autorecon/default-plugins/curl-robots.py b/autorecon/default-plugins/curl-robots.py new file mode 100644 index 0000000..7158b25 --- /dev/null +++ b/autorecon/default-plugins/curl-robots.py @@ -0,0 +1,26 @@ +from autorecon.plugins import ServiceScan +from autorecon.io import fformat + +class CurlRobots(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Curl Robots" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + async def run(self, service): + if service.protocol == 'tcp': + process, stdout, _ = await service.execute('curl -sSikf {http_scheme}://{addressv6}:{port}/robots.txt', future_outfile='{protocol}_{port}_{http_scheme}_curl-robots.txt') + + lines = await stdout.readlines() + + if process.returncode == 0 and lines: + filename = fformat('{scandir}/{protocol}_{port}_{http_scheme}_curl-robots.txt') + with open(filename, mode='wt', encoding='utf8') as robots: + robots.write('\n'.join(lines)) + else: + service.info('{bblue}[' + fformat('{tag}') + ']{rst} There did not appear to be a robots.txt file in the webroot (/).') diff --git a/autorecon/default-plugins/curl.py b/autorecon/default-plugins/curl.py new file mode 100644 index 0000000..5155f50 --- /dev/null +++ b/autorecon/default-plugins/curl.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class Curl(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Curl" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.add_option("path", default="/", help="The path on the web server to curl. Default: %(default)s") + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + self.add_pattern('(?i)powered[ -]by[^\n]+') + + async def run(self, service): + if service.protocol == 'tcp': + await service.execute('curl -sSik {http_scheme}://{addressv6}:{port}' + self.get_option('path'), outfile='{protocol}_{port}_{http_scheme}_curl.html') diff --git a/autorecon/default-plugins/dns-reverse-lookup.py b/autorecon/default-plugins/dns-reverse-lookup.py new file mode 100644 index 0000000..513cba5 --- /dev/null +++ b/autorecon/default-plugins/dns-reverse-lookup.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class DNSReverseLookup(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'DNS Reverse Lookup' + self.tags = ['default', 'safe', 'dns'] + + def configure(self): + self.match_service_name('^domain') + + async def run(self, service): + await service.execute('dig -p {port} -x {address} @{address}', outfile='{protocol}_{port}_dns_reverse-lookup.txt') diff --git a/autorecon/default-plugins/dns-zone-transfer.py b/autorecon/default-plugins/dns-zone-transfer.py new file mode 100644 index 0000000..49bb9cb --- /dev/null +++ b/autorecon/default-plugins/dns-zone-transfer.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class DNSZoneTransfer(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'DNS Zone Transfer' + self.tags = ['default', 'safe', 'dns'] + + def configure(self): + self.match_service_name('^domain') + + async def run(self, service): + if self.get_global('domain'): + await service.execute('dig AXFR -p {port} @{address} ' + self.get_global('domain'), outfile='{protocol}_{port}_dns_zone-transfer-domain.txt') + if service.target.type == 'hostname': + await service.execute('dig AXFR -p {port} @{address} {address}', outfile='{protocol}_{port}_dns_zone-transfer-hostname.txt') + await service.execute('dig AXFR -p {port} @{address}', outfile='{protocol}_{port}_dns_zone-transfer.txt') diff --git a/autorecon/default-plugins/dnsrecon-subdomain-bruteforce.py b/autorecon/default-plugins/dnsrecon-subdomain-bruteforce.py new file mode 100644 index 0000000..8f082bb --- /dev/null +++ b/autorecon/default-plugins/dnsrecon-subdomain-bruteforce.py @@ -0,0 +1,27 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class DnsReconSubdomainBruteforce(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "DnsRecon Bruteforce Subdomains" + self.slug = 'dnsrecon-brute' + self.priority = 0 + self.tags = ['default', 'safe', 'long', 'dns'] + + def configure(self): + self.match_service_name('^domain') + + def check(self): + if which('dnsrecon') is None: + self.error('The program dnsrecon could not be found. Make sure it is installed. (On Kali, run: sudo apt install dnsrecon)') + return False + + def manual(self, service, plugin_was_run): + domain_name = '' + if self.get_global('domain'): + domain_name = self.get_global('domain') + service.add_manual_command('Use dnsrecon to bruteforce subdomains of a DNS domain.', [ + 'dnsrecon -n {address} -d ' + domain_name + ' -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee {scandir}/{protocol}_{port}_dnsrecon_subdomain_bruteforce.txt', + ]) diff --git a/autorecon/default-plugins/dnsrecon.py b/autorecon/default-plugins/dnsrecon.py new file mode 100644 index 0000000..cfb9edc --- /dev/null +++ b/autorecon/default-plugins/dnsrecon.py @@ -0,0 +1,30 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class DnsRecon(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "DnsRecon Default Scan" + self.slug = 'dnsrecon' + self.priority = 0 + self.tags = ['default', 'safe', 'dns'] + + def configure(self): + self.match_service_name('^domain') + + def check(self): + if which('dnsrecon') is None: + self.error('The program dnsrecon could not be found. Make sure it is installed. (On Kali, run: sudo apt install dnsrecon)') + return False + + def manual(self, service, plugin_was_run): + service.add_manual_command('Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.', [ + 'dnsrecon -n {address} -d 2>&1 | tee {scandir}/{protocol}_{port}_dnsrecon_default_manual.txt' + ]) + + async def run(self, service): + if self.get_global('domain'): + await service.execute('dnsrecon -n {address} -d ' + self.get_global('domain') + ' 2>&1', outfile='{protocol}_{port}_dnsrecon_default.txt') + else: + service.error('A domain name was not specified in the command line options (--global.domain). If you know the domain name, look in the _manual_commands.txt file for the dnsrecon command.') diff --git a/autorecon/default-plugins/enum4linux.py b/autorecon/default-plugins/enum4linux.py new file mode 100644 index 0000000..ac3e787 --- /dev/null +++ b/autorecon/default-plugins/enum4linux.py @@ -0,0 +1,34 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class Enum4Linux(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Enum4Linux" + self.tags = ['default', 'safe', 'active-directory'] + + def configure(self): + self.add_choice_option('tool', default=('enum4linux-ng' if which('enum4linux-ng') else 'enum4linux'), choices=['enum4linux-ng', 'enum4linux'], help='The tool to use for doing Windows and Samba enumeration. Default: %(default)s') + self.match_service_name(['^ldap', '^smb', '^microsoft\-ds', '^netbios']) + self.match_port('tcp', [139, 389, 445]) + self.match_port('udp', 137) + self.run_once(True) + + def check(self): + tool = self.get_option('tool') + if tool == 'enum4linux' and which('enum4linux') is None: + self.error('The enum4linux program could not be found. Make sure it is installed. (On Kali, run: sudo apt install enum4linux)') + return False + elif tool == 'enum4linux-ng' and which('enum4linux-ng') is None: + self.error('The enum4linux-ng program could not be found. Make sure it is installed. (https://github.com/cddmp/enum4linux-ng)') + return False + + async def run(self, service): + if service.target.ipversion == 'IPv4': + tool = self.get_option('tool') + if tool is not None: + if tool == 'enum4linux': + await service.execute('enum4linux -a -M -l -d {address} 2>&1', outfile='enum4linux.txt') + elif tool == 'enum4linux-ng': + await service.execute('enum4linux-ng -A -d -v {address} 2>&1', outfile='enum4linux-ng.txt') diff --git a/autorecon/default-plugins/get-arch.py b/autorecon/default-plugins/get-arch.py new file mode 100644 index 0000000..e6ee411 --- /dev/null +++ b/autorecon/default-plugins/get-arch.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class GetArch(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'get-arch' + self.tags = ['default', 'safe', 'rpc'] + + def configure(self): + self.match_service_name(['^msrpc']) + self.match_port('tcp', 135) + self.add_pattern(' is ((32|64)-bit)', description='Identified Architecture: {match1}') + + async def run(self, service): + await service.execute('impacket-getArch -target {address}', outfile='{protocol}_{port}_rpc_architecture.txt') diff --git a/autorecon/default-plugins/ldap-search.py b/autorecon/default-plugins/ldap-search.py new file mode 100644 index 0000000..527d1d8 --- /dev/null +++ b/autorecon/default-plugins/ldap-search.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class LDAPSearch(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'LDAP Search' + self.tags = ['default', 'safe', 'ldap', 'active-directory'] + + def configure(self): + self.match_service_name('^ldap') + + def manual(self, service, plugin_was_run): + service.add_manual_command('ldapsearch command (modify before running):', [ + 'ldapsearch -x -D "" -w "" -H ldap://{address}:{port} -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "{scandir}/{protocol}_{port}_ldap_all-entries.txt"' + ]) diff --git a/autorecon/default-plugins/lookup-sid.py b/autorecon/default-plugins/lookup-sid.py new file mode 100644 index 0000000..5c4bb4d --- /dev/null +++ b/autorecon/default-plugins/lookup-sid.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class LookupSID(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'lookupsid' + self.tags = ['default', 'safe', 'active-directory'] + + def configure(self): + self.match_service('tcp', 445, '^microsoft\-ds') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Lookup SIDs', [ + 'impacket-lookupsid \'[username]:[password]@{address}\'' + ]) diff --git a/autorecon/default-plugins/nbtscan.py b/autorecon/default-plugins/nbtscan.py new file mode 100644 index 0000000..9036d02 --- /dev/null +++ b/autorecon/default-plugins/nbtscan.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class NBTScan(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'nbtscan' + self.tags = ['default', 'safe', 'netbios', 'active-directory'] + + def configure(self): + self.match_service_name(['^smb', '^microsoft\-ds', '^netbios']) + self.match_port('udp', 137) + self.run_once(True) + + async def run(self, service): + if service.target.ipversion == 'IPv4': + await service.execute('nbtscan -rvh {ipaddress} 2>&1', outfile='nbtscan.txt') diff --git a/autorecon/default-plugins/nikto.py b/autorecon/default-plugins/nikto.py new file mode 100644 index 0000000..b696cb5 --- /dev/null +++ b/autorecon/default-plugins/nikto.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class Nikto(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'nikto' + self.tags = ['default', 'safe', 'long', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + def manual(self, service, plugin_was_run): + if service.target.ipversion == 'IPv4': + service.add_manual_command('(nikto) old but generally reliable web server enumeration tool:', 'nikto -ask=no -h {http_scheme}://{address}:{port} 2>&1 | tee "{scandir}/{protocol}_{port}_{http_scheme}_nikto.txt"') diff --git a/autorecon/default-plugins/nmap-ajp.py b/autorecon/default-plugins/nmap-ajp.py new file mode 100644 index 0000000..fcba5a0 --- /dev/null +++ b/autorecon/default-plugins/nmap-ajp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapAJP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap AJP' + self.tags = ['default', 'safe', 'ajp'] + + def configure(self): + self.match_service_name(['^ajp13']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ajp-* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ajp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ajp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-cassandra.py b/autorecon/default-plugins/nmap-cassandra.py new file mode 100644 index 0000000..54778a3 --- /dev/null +++ b/autorecon/default-plugins/nmap-cassandra.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapCassandra(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap Cassandra" + self.tags = ['default', 'safe', 'cassandra'] + + def configure(self): + self.match_service_name('^apani1') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(cassandra* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_cassandra_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_cassandra_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-cups.py b/autorecon/default-plugins/nmap-cups.py new file mode 100644 index 0000000..d8d532f --- /dev/null +++ b/autorecon/default-plugins/nmap-cups.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapCUPS(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap CUPS" + self.tags = ['default', 'safe', 'cups'] + + def configure(self): + self.match_service_name('^ipp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(cups* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_cups_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_cups_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-distccd.py b/autorecon/default-plugins/nmap-distccd.py new file mode 100644 index 0000000..ecf99c0 --- /dev/null +++ b/autorecon/default-plugins/nmap-distccd.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapDistccd(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap distccd" + self.tags = ['default', 'safe', 'distccd'] + + def configure(self): + self.match_service_name('^distccd') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,distcc-cve2004-2687" --script-args="distcc-cve2004-2687.cmd=id" -oN "{scandir}/{protocol}_{port}_distcc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_distcc_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-dns.py b/autorecon/default-plugins/nmap-dns.py new file mode 100644 index 0000000..479ac42 --- /dev/null +++ b/autorecon/default-plugins/nmap-dns.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapDNS(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap DNS' + self.tags = ['default', 'safe', 'dns'] + + def configure(self): + self.match_service_name('^domain') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_dns_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_dns_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-finger.py b/autorecon/default-plugins/nmap-finger.py new file mode 100644 index 0000000..2f8d38c --- /dev/null +++ b/autorecon/default-plugins/nmap-finger.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapFinger(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap finger" + self.tags = ['default', 'safe', 'finger'] + + def configure(self): + self.match_service_name('^finger') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,finger" -oN "{scandir}/{protocol}_{port}_finger_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_finger_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-ftp.py b/autorecon/default-plugins/nmap-ftp.py new file mode 100644 index 0000000..ea87573 --- /dev/null +++ b/autorecon/default-plugins/nmap-ftp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapFTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap FTP' + self.tags = ['default', 'safe', 'ftp'] + + def configure(self): + self.match_service_name(['^ftp', '^ftp\-data']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ftp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ftp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ftp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-http.py b/autorecon/default-plugins/nmap-http.py new file mode 100644 index 0000000..0dbeb69 --- /dev/null +++ b/autorecon/default-plugins/nmap-http.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class NmapHTTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap HTTP" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + self.add_pattern('Server: ([^\n]+)', description='Identified HTTP Server: {match1}') + self.add_pattern('WebDAV is ENABLED', description='WebDAV is enabled') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN "{scandir}/{protocol}_{port}_{http_scheme}_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_{http_scheme}_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-imap.py b/autorecon/default-plugins/nmap-imap.py new file mode 100644 index 0000000..95d1169 --- /dev/null +++ b/autorecon/default-plugins/nmap-imap.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapIMAP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap IMAP" + self.tags = ['default', 'safe', 'imap', 'email'] + + def configure(self): + self.match_service_name('^imap') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(imap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_imap_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_imap_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-irc.py b/autorecon/default-plugins/nmap-irc.py new file mode 100644 index 0000000..ebfbf45 --- /dev/null +++ b/autorecon/default-plugins/nmap-irc.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapIrc(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap IRC' + self.tags = ['default', 'safe', 'irc'] + + def configure(self): + self.match_service_name('^irc') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -oN "{scandir}/{protocol}_{port}_irc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_irc_nmap.xml" -p {port} {address}') diff --git a/autorecon/default-plugins/nmap-kerberos.py b/autorecon/default-plugins/nmap-kerberos.py new file mode 100644 index 0000000..0830ff5 --- /dev/null +++ b/autorecon/default-plugins/nmap-kerberos.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class NmapKerberos(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap Kerberos" + self.tags = ['default', 'safe', 'kerberos', 'active-directory'] + + def configure(self): + self.match_service_name(['^kerberos', '^kpasswd']) + + async def run(self, service): + if self.get_global('domain') and self.get_global('username-wordlist'): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,krb5-enum-users" --script-args krb5-enum-users.realm="' + self.get_global('domain') + '",userdb="' + self.get_global('username-wordlist') + '" -oN "{scandir}/{protocol}_{port}_kerberos_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_kerberos_nmap.xml" {address}') + else: + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,krb5-enum-users" -oN "{scandir}/{protocol}_{port}_kerberos_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_kerberos_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-ldap.py b/autorecon/default-plugins/nmap-ldap.py new file mode 100644 index 0000000..77aab20 --- /dev/null +++ b/autorecon/default-plugins/nmap-ldap.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapLDAP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap LDAP" + self.tags = ['default', 'safe', 'ldap', 'active-directory'] + + def configure(self): + self.match_service_name('^ldap') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ldap_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ldap_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-mongodb.py b/autorecon/default-plugins/nmap-mongodb.py new file mode 100644 index 0000000..833c628 --- /dev/null +++ b/autorecon/default-plugins/nmap-mongodb.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapMongoDB(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap MongoDB" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^mongod') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(mongodb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mongodb_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mongodb_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-mountd.py b/autorecon/default-plugins/nmap-mountd.py new file mode 100644 index 0000000..848a77a --- /dev/null +++ b/autorecon/default-plugins/nmap-mountd.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapMountd(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap Mountd" + self.tags = ['default', 'safe', 'nfs'] + + def configure(self): + self.match_service_name('^mountd') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,nfs* and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mountd_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mountd_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-msrpc.py b/autorecon/default-plugins/nmap-msrpc.py new file mode 100644 index 0000000..e374412 --- /dev/null +++ b/autorecon/default-plugins/nmap-msrpc.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapRPC(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap MSRPC" + self.tags = ['default', 'rpc'] + + def configure(self): + self.match_service_name(['^msrpc', '^rpcbind', '^erpc']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "{scandir}/{protocol}_{port}_rpc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rpc_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-mssql.py b/autorecon/default-plugins/nmap-mssql.py new file mode 100644 index 0000000..6e55d45 --- /dev/null +++ b/autorecon/default-plugins/nmap-mssql.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class NmapMSSQL(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap MSSQL" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name(['^mssql', '^ms\-sql']) + + def manual(self, service, plugin_was_run): + if service.target.ipversion == 'IPv4': + service.add_manual_command('(sqsh) interactive database shell:', 'sqsh -U -P -S {address}:{port}') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ms-sql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" --script-args="mssql.instance-port={port},mssql.username=sa,mssql.password=sa" -oN "{scandir}/{protocol}_{port}_mssql_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mssql_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-multicast-dns.py b/autorecon/default-plugins/nmap-multicast-dns.py new file mode 100644 index 0000000..1edb391 --- /dev/null +++ b/autorecon/default-plugins/nmap-multicast-dns.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapMulticastDNS(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap Multicast DNS' + self.tags = ['default', 'safe', 'dns'] + + def configure(self): + self.match_service_name(['^mdns', '^zeroconf']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_multicastdns_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_multicastdns_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-mysql.py b/autorecon/default-plugins/nmap-mysql.py new file mode 100644 index 0000000..68a01d5 --- /dev/null +++ b/autorecon/default-plugins/nmap-mysql.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class NmapMYSQL(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap MYSQL" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^mysql') + + def manual(self, service, plugin_was_run): + if service.target.ipversion == 'IPv4': + service.add_manual_command('(sqsh) interactive database shell:', 'sqsh -U -P -S {address}:{port}') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(mysql* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_mysql_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_mysql_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-nfs.py b/autorecon/default-plugins/nmap-nfs.py new file mode 100644 index 0000000..b8fabce --- /dev/null +++ b/autorecon/default-plugins/nmap-nfs.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapNFS(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap NFS" + self.tags = ['default', 'safe', 'nfs'] + + def configure(self): + self.match_service_name(['^nfs', '^rpcbind']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rpcinfo or nfs*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_nfs_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_nfs_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-nntp.py b/autorecon/default-plugins/nmap-nntp.py new file mode 100644 index 0000000..1c7db5b --- /dev/null +++ b/autorecon/default-plugins/nmap-nntp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapNNTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap NNTP" + self.tags = ['default', 'safe', 'nntp'] + + def configure(self): + self.match_service_name('^nntp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,nntp-ntlm-info" -oN "{scandir}/{protocol}_{port}_nntp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_nntp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-ntp.py b/autorecon/default-plugins/nmap-ntp.py new file mode 100644 index 0000000..d04679e --- /dev/null +++ b/autorecon/default-plugins/nmap-ntp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapNTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap NTP" + self.tags = ['default', 'safe', 'ntp'] + + def configure(self): + self.match_service_name('^ntp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_ntp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ntp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-oracle.py b/autorecon/default-plugins/nmap-oracle.py new file mode 100644 index 0000000..d8ff6bd --- /dev/null +++ b/autorecon/default-plugins/nmap-oracle.py @@ -0,0 +1,17 @@ +from autorecon.plugins import ServiceScan + +class NmapOracle(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap Oracle" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^oracle') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Brute-force SIDs using Nmap:', 'nmap {nmap_extra} -sV -p {port} --script="banner,oracle-sid-brute" -oN "{scandir}/{protocol}_{port}_oracle_sid-brute_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_oracle_sid-brute_nmap.xml" {address}') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(oracle* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_oracle_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_oracle_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-pop3.py b/autorecon/default-plugins/nmap-pop3.py new file mode 100644 index 0000000..f4ed3a6 --- /dev/null +++ b/autorecon/default-plugins/nmap-pop3.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapPOP3(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap POP3" + self.tags = ['default', 'safe', 'pop3', 'email'] + + def configure(self): + self.match_service_name('^pop3') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(pop3* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_pop3_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_pop3_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-rdp.py b/autorecon/default-plugins/nmap-rdp.py new file mode 100644 index 0000000..13a16f6 --- /dev/null +++ b/autorecon/default-plugins/nmap-rdp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapRDP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap RDP" + self.tags = ['default', 'safe', 'rdp'] + + def configure(self): + self.match_service_name(['^rdp', '^ms\-wbt\-server', '^ms\-term\-serv']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rdp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_rdp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rdp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-redis.py b/autorecon/default-plugins/nmap-redis.py new file mode 100644 index 0000000..46fa920 --- /dev/null +++ b/autorecon/default-plugins/nmap-redis.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapRedis(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap Redis' + self.tags = ['default', 'safe', 'redis'] + + def configure(self): + self.match_service_name('^redis$') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,redis-info" -oN "{scandir}/{protocol}_{port}_redis_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_redis_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-rmi.py b/autorecon/default-plugins/nmap-rmi.py new file mode 100644 index 0000000..7c1d277 --- /dev/null +++ b/autorecon/default-plugins/nmap-rmi.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapRMI(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap RMI" + self.tags = ['default', 'safe', 'rmi'] + + def configure(self): + self.match_service_name(['^java\-rmi', '^rmiregistry']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,rmi-vuln-classloader,rmi-dumpregistry" -oN "{scandir}/{protocol}_{port}_rmi_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rmi_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-rsync.py b/autorecon/default-plugins/nmap-rsync.py new file mode 100644 index 0000000..3e8251d --- /dev/null +++ b/autorecon/default-plugins/nmap-rsync.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapRsync(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap Rsync' + self.tags = ['default', 'safe', 'rsync'] + + def configure(self): + self.match_service_name('^rsync') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(rsync* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_rsync_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_rsync_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-sip.py b/autorecon/default-plugins/nmap-sip.py new file mode 100644 index 0000000..837b059 --- /dev/null +++ b/autorecon/default-plugins/nmap-sip.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapSIP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap SIP" + self.tags = ['default', 'safe', 'sip'] + + def configure(self): + self.match_service_name(['^asterisk', '^sip']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,sip-enum-users,sip-methods" -oN "{scandir}/{protocol}_{port}_sip_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_sip_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-smb.py b/autorecon/default-plugins/nmap-smb.py new file mode 100644 index 0000000..5f9bb52 --- /dev/null +++ b/autorecon/default-plugins/nmap-smb.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapSMB(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap SMB" + self.tags = ['default', 'safe', 'smb', 'active-directory'] + + def configure(self): + self.match_service_name(['^smb', '^microsoft\-ds', '^netbios']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_smb_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-smtp.py b/autorecon/default-plugins/nmap-smtp.py new file mode 100644 index 0000000..962d87c --- /dev/null +++ b/autorecon/default-plugins/nmap-smtp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapSMTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap SMTP" + self.tags = ['default', 'safe', 'smtp', 'email'] + + def configure(self): + self.match_service_name('^smtp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(smtp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_smtp_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_smtp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-snmp.py b/autorecon/default-plugins/nmap-snmp.py new file mode 100644 index 0000000..29305f0 --- /dev/null +++ b/autorecon/default-plugins/nmap-snmp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapSNMP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap SNMP" + self.tags = ['default', 'safe', 'snmp'] + + def configure(self): + self.match_service_name('^snmp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(snmp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "{scandir}/{protocol}_{port}_snmp-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_snmp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-ssh.py b/autorecon/default-plugins/nmap-ssh.py new file mode 100644 index 0000000..6c2acda --- /dev/null +++ b/autorecon/default-plugins/nmap-ssh.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapSSH(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Nmap SSH" + self.tags = ['default', 'safe', 'ssh'] + + def configure(self): + self.match_service_name('^ssh') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,ssh2-enum-algos,ssh-hostkey,ssh-auth-methods" -oN "{scandir}/{protocol}_{port}_ssh_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_ssh_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-telnet.py b/autorecon/default-plugins/nmap-telnet.py new file mode 100644 index 0000000..c989d82 --- /dev/null +++ b/autorecon/default-plugins/nmap-telnet.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapTelnet(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap Telnet' + self.tags = ['default', 'safe', 'telnet'] + + def configure(self): + self.match_service_name('^telnet') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,telnet-encryption,telnet-ntlm-info" -oN "{scandir}/{protocol}_{port}_telnet-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_telnet_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-tftp.py b/autorecon/default-plugins/nmap-tftp.py new file mode 100644 index 0000000..c0c0994 --- /dev/null +++ b/autorecon/default-plugins/nmap-tftp.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapTFTP(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap TFTP' + self.tags = ['default', 'safe', 'tftp'] + + def configure(self): + self.match_service_name('^tftp') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,tftp-enum" -oN "{scandir}/{protocol}_{port}_tftp-nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_tftp_nmap.xml" {address}') diff --git a/autorecon/default-plugins/nmap-vnc.py b/autorecon/default-plugins/nmap-vnc.py new file mode 100644 index 0000000..806a8ff --- /dev/null +++ b/autorecon/default-plugins/nmap-vnc.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class NmapVNC(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Nmap VNC' + self.tags = ['default', 'safe', 'vnc'] + + def configure(self): + self.match_service_name('^vnc') + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="banner,(vnc* or realvnc* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_vnc_nmap.txt" -oX "{scandir}/xml/{protocol}_{port}_vnc_nmap.xml" {address}') diff --git a/autorecon/default-plugins/onesixtyone.py b/autorecon/default-plugins/onesixtyone.py new file mode 100644 index 0000000..e99d621 --- /dev/null +++ b/autorecon/default-plugins/onesixtyone.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class OneSixtyOne(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "OneSixtyOne" + self.tags = ['default', 'safe', 'snmp'] + + def configure(self): + self.match_service_name('^snmp') + self.match_port('udp', 161) + self.run_once(True) + self.add_option('community-strings', default='/usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt', help='The file containing a list of community strings to try. Default: %(default)s') + + async def run(self, service): + if service.target.ipversion == 'IPv4': + await service.execute('onesixtyone -c ' + self.get_option('community-strings') + ' -dd {address} 2>&1', outfile='{protocol}_{port}_snmp_onesixtyone.txt') diff --git a/autorecon/default-plugins/oracle-odat.py b/autorecon/default-plugins/oracle-odat.py new file mode 100644 index 0000000..ac4613f --- /dev/null +++ b/autorecon/default-plugins/oracle-odat.py @@ -0,0 +1,21 @@ +from autorecon.plugins import ServiceScan + +class OracleODAT(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Oracle ODAT" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^oracle') + + def manual(self, service, plugin_was_run): + service.add_manual_commands('Install ODAT (https://github.com/quentinhardy/odat) and run the following commands:', [ + 'python odat.py tnscmd -s {address} -p {port} --ping', + 'python odat.py tnscmd -s {address} -p {port} --version', + 'python odat.py tnscmd -s {address} -p {port} --status', + 'python odat.py sidguesser -s {address} -p {port}', + 'python odat.py passwordguesser -s {address} -p {port} -d --accounts-file accounts/accounts_multiple.txt', + 'python odat.py tnspoison -s {address} -p {port} -d --test-module' + ]) diff --git a/autorecon/default-plugins/oracle-patator.py b/autorecon/default-plugins/oracle-patator.py new file mode 100644 index 0000000..594b531 --- /dev/null +++ b/autorecon/default-plugins/oracle-patator.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class OraclePatator(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Oracle Patator" + self.tags = ['default', 'databases'] + + def configure(self): + self.match_service_name('^oracle') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Install Oracle Instant Client (https://github.com/rapid7/metasploit-framework/wiki/How-to-get-Oracle-Support-working-with-Kali-Linux) and then bruteforce with patator:', 'patator oracle_login host={address} port={port} user=COMBO00 password=COMBO01 0=/usr/share/seclists/Passwords/Default-Credentials/oracle-betterdefaultpasslist.txt -x ignore:code=ORA-01017 -x ignore:code=ORA-28000') diff --git a/autorecon/default-plugins/oracle-scanner.py b/autorecon/default-plugins/oracle-scanner.py new file mode 100644 index 0000000..16653cc --- /dev/null +++ b/autorecon/default-plugins/oracle-scanner.py @@ -0,0 +1,20 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class OracleScanner(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Oracle Scanner" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^oracle') + + def check(self): + if which('oscanner') is None: + self.error('The oscanner program could not be found. Make sure it is installed. (On Kali, run: sudo apt install oscanner)') + return False + + async def run(self, service): + await service.execute('oscanner -v -s {address} -P {port} 2>&1', outfile='{protocol}_{port}_oracle_scanner.txt') diff --git a/autorecon/default-plugins/oracle-tnscmd.py b/autorecon/default-plugins/oracle-tnscmd.py new file mode 100644 index 0000000..7ea12c1 --- /dev/null +++ b/autorecon/default-plugins/oracle-tnscmd.py @@ -0,0 +1,22 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class OracleTNScmd(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Oracle TNScmd" + self.tags = ['default', 'safe', 'databases'] + + def configure(self): + self.match_service_name('^oracle') + + def check(self): + if which('tnscmd10g') is None: + self.error('The tnscmd10g program could not be found. Make sure it is installed. (On Kali, run: sudo apt install tnscmd10g)') + return False + + async def run(self, service): + if service.target.ipversion == 'IPv4': + await service.execute('tnscmd10g ping -h {address} -p {port} 2>&1', outfile='{protocol}_{port}_oracle_tnscmd_ping.txt') + await service.execute('tnscmd10g version -h {address} -p {port} 2>&1', outfile='{protocol}_{port}_oracle_tnscmd_version.txt') diff --git a/autorecon/default-plugins/portscan-all-tcp-ports.py b/autorecon/default-plugins/portscan-all-tcp-ports.py new file mode 100644 index 0000000..c6dc70e --- /dev/null +++ b/autorecon/default-plugins/portscan-all-tcp-ports.py @@ -0,0 +1,52 @@ +from autorecon.plugins import PortScan +from autorecon.config import config +import re, requests + +class AllTCPPortScan(PortScan): + + def __init__(self): + super().__init__() + self.name = 'All TCP Ports' + self.description = 'Performs an Nmap scan of all TCP ports.' + self.type = 'tcp' + self.specific_ports = True + self.tags = ['default', 'default-port-scan', 'long'] + + async def run(self, target): + if config['proxychains']: + traceroute_os = '' + else: + traceroute_os = ' -A --osscan-guess' + + if target.ports: + if target.ports['tcp']: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -sV -sC --version-all' + traceroute_os + ' -p ' + target.ports['tcp'] + ' -oN "{scandir}/_full_tcp_nmap.txt" -oX "{scandir}/xml/_full_tcp_nmap.xml" {address}', blocking=False) + else: + return [] + else: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -sV -sC --version-all' + traceroute_os + ' -p- -oN "{scandir}/_full_tcp_nmap.txt" -oX "{scandir}/xml/_full_tcp_nmap.xml" {address}', blocking=False) + services = [] + while True: + line = await stdout.readline() + if line is not None: + match = re.search('^Discovered open port ([0-9]+)/tcp', line) + if match: + target.info('Discovered open port {bmagenta}tcp/' + match.group(1) + '{rst} on {byellow}' + target.address + '{rst}', verbosity=1) + service = target.extract_service(line) + + if service: + # Check if HTTP service appears to be WinRM. If so, override service name as wsman. + if service.name == 'http' and service.port in [5985, 5986]: + wsman = requests.get(('https' if service.secure else 'http') + '://' + target.address + ':' + str(service.port) + '/wsman', verify=False) + if wsman.status_code == 405: + service.name = 'wsman' + wsman = requests.post(('https' if service.secure else 'http') + '://' + target.address + ':' + str(service.port) + '/wsman', verify=False) + else: + if wsman.status_code == 401: + service.name = 'wsman' + + services.append(service) + else: + break + await process.wait() + return services diff --git a/autorecon/default-plugins/portscan-guess-tcp-ports.py b/autorecon/default-plugins/portscan-guess-tcp-ports.py new file mode 100644 index 0000000..1919fff --- /dev/null +++ b/autorecon/default-plugins/portscan-guess-tcp-ports.py @@ -0,0 +1,48 @@ +from autorecon.plugins import PortScan +from autorecon.targets import Service +import re + +class GuessPortScan(PortScan): + + def __init__(self): + super().__init__() + self.name = 'Guess TCP Ports' + self.type = 'tcp' + self.description = 'Performs an Nmap scan of the all TCP ports but guesses services based off the port found. Can be quicker. Proper service matching is performed at the end of the scan.' + self.tags = ['guess-port-scan', 'long'] + self.priority = 0 + + async def run(self, target): + if target.ports: + if target.ports['tcp']: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -A --osscan-guess --version-all -p ' + target.ports['tcp'] + ' -oN "{scandir}/_custom_ports_tcp_nmap.txt" -oX "{scandir}/xml/_custom_ports_tcp_nmap.xml" {address}', blocking=False) + else: + return [] + else: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -A --osscan-guess --version-all -p- -oN "{scandir}/_quick_tcp_nmap.txt" -oX "{scandir}/xml/_quick_tcp_nmap.xml" {address}', blocking=False) + + insecure_ports = { + '20':'ftp', '21':'ftp', '22':'ssh', '23':'telnet', '25':'smtp', '53':'domain', '69':'tftp', '79':'finger', '80':'http', '88':'kerberos', '109':'pop3', '110':'pop3', '111':'rpcbind', '119':'nntp', '135':'msrpc', '139':'netbios-ssn', '143':'imap', '161':'snmp', '220':'imap', '389':'ldap', '433':'nntp', '445':'smb', '587':'smtp', '631':'ipp', '873':'rsync', '1098':'java-rmi', '1099':'java-rmi', '1433':'mssql', '1521':'oracle', '2049':'nfs', '2483':'oracle', '3020':'smb', '3306':'mysql', '3389':'rdp', '3632':'distccd', '5060':'asterisk', '5500':'vnc', '5900':'vnc', '5985':'wsman', '6379':'redis', '8080':'http-proxy', '27017':'mongod', '27018':'mongod', '27019':'mongod' + } + secure_ports = { + '443':'https', '465':'smtp', '563':'nntp', '585':'imaps', '593':'msrpc', '636':'ldap', '989':'ftp', '990':'ftp', '992':'telnet', '993':'imaps', '995':'pop3s', '2484':'oracle', '5061':'asterisk', '5986':'wsman' + } + + services = [] + while True: + line = await stdout.readline() + if line is not None: + match = re.match('^Discovered open port ([0-9]+)/tcp', line) + if match: + if match.group(1) in insecure_ports.keys(): + await target.add_service(Service('tcp', match.group(1), insecure_ports[match.group(1)])) + elif match.group(1) in secure_ports.keys(): + await target.add_service(Service('tcp', match.group(1), secure_ports[match.group(1)], True)) + service = target.extract_service(line) + if service is not None: + services.append(service) + else: + break + + await process.wait() + return services diff --git a/autorecon/default-plugins/portscan-top-100-udp-ports.py b/autorecon/default-plugins/portscan-top-100-udp-ports.py new file mode 100644 index 0000000..7f28de3 --- /dev/null +++ b/autorecon/default-plugins/portscan-top-100-udp-ports.py @@ -0,0 +1,40 @@ +from autorecon.plugins import PortScan +from autorecon.config import config +import os, re + +class Top100UDPPortScan(PortScan): + + def __init__(self): + super().__init__() + self.name = 'Top 100 UDP Ports' + self.description = 'Performs an Nmap scan of the top 100 UDP ports.' + self.type = 'udp' + self.specific_ports = True + self.tags = ['default', 'default-port-scan', 'long'] + + async def run(self, target): + # Only run UDP scan if user is root. + if os.getuid() == 0 or config['disable_sanity_checks']: + if target.ports: + if target.ports['udp']: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -sU -A --osscan-guess -p ' + target.ports['udp'] + ' -oN "{scandir}/_custom_ports_udp_nmap.txt" -oX "{scandir}/xml/_custom_ports_udp_nmap.xml" {address}', blocking=False) + else: + return [] + else: + process, stdout, stderr = await target.execute('nmap {nmap_extra} -sU -A --top-ports 100 -oN "{scandir}/_top_100_udp_nmap.txt" -oX "{scandir}/xml/_top_100_udp_nmap.xml" {address}', blocking=False) + services = [] + while True: + line = await stdout.readline() + if line is not None: + match = re.search('^Discovered open port ([0-9]+)/udp', line) + if match: + target.info('Discovered open port {bmagenta}udp/' + match.group(1) + '{rst} on {byellow}' + target.address + '{rst}', verbosity=1) + service = target.extract_service(line) + if service: + services.append(service) + else: + break + await process.wait() + return services + else: + target.error('UDP scan requires AutoRecon be run with root privileges.') diff --git a/autorecon/default-plugins/redis-cli.py b/autorecon/default-plugins/redis-cli.py new file mode 100644 index 0000000..74b3803 --- /dev/null +++ b/autorecon/default-plugins/redis-cli.py @@ -0,0 +1,24 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class RedisCli(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Redis Cli' + self.tags = ['default', 'safe', 'redis'] + + def configure(self): + self.match_service_name('^redis$') + + def check(self): + if which('redis-cli') is None: + self.error('The redis-cli program could not be found. Make sure it is installed. (On Kali, run: sudo apt install redis-tools)') + return False + + async def run(self, service): + if which('redis-cli') is not None: + _, stdout, _ = await service.execute('redis-cli -p {port} -h {address} INFO', outfile='{protocol}_{port}_redis_info.txt') + if not (await stdout.readline()).startswith('NOAUTH Authentication required'): + await service.execute('redis-cli -p {port} -h {address} CONFIG GET \'*\'', outfile='{protocol}_{port}_redis_config.txt') + await service.execute('redis-cli -p {port} -h {address} CLIENT LIST', outfile='{protocol}_{port}_redis_client-list.txt') diff --git a/autorecon/default-plugins/reporting-cherrytree.py b/autorecon/default-plugins/reporting-cherrytree.py new file mode 100644 index 0000000..bd1d4d8 --- /dev/null +++ b/autorecon/default-plugins/reporting-cherrytree.py @@ -0,0 +1,91 @@ +from autorecon.plugins import Report +from autorecon.config import config +from xml.sax.saxutils import escape +import os, glob + +class CherryTree(Report): + + def __init__(self): + super().__init__() + self.name = 'CherryTree' + self.tags = [] + + async def run(self, targets): + if len(targets) > 1: + report = os.path.join(config['output'], 'report.xml.ctd') + elif len(targets) == 1: + report = os.path.join(targets[0].reportdir, 'report.xml.ctd') + else: + return + + with open(report, 'w') as output: + output.writelines('\n\n') + for target in targets: + output.writelines('\n') + + files = [os.path.abspath(filename) for filename in glob.iglob(os.path.join(target.scandir, '**/*'), recursive=True) if os.path.isfile(filename) and filename.endswith(('.txt', '.html'))] + + if target.scans['ports']: + output.writelines('\n') + for scan in target.scans['ports'].keys(): + if len(target.scans['ports'][scan]['commands']) > 0: + output.writelines('\n') + for command in target.scans['ports'][scan]['commands']: + output.writelines('' + escape(command[0])) + for filename in files: + if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]): + output.writelines('\n\n' + escape(filename) + ':\n\n') + with open(filename, 'r') as file: + output.writelines(escape(file.read()) + '\n') + output.writelines('\n') + output.writelines('\n') + output.writelines('\n') + if target.scans['services']: + output.writelines('\n') + for service in target.scans['services'].keys(): + output.writelines('\n') + for plugin in target.scans['services'][service].keys(): + if len(target.scans['services'][service][plugin]['commands']) > 0: + output.writelines('\n') + for command in target.scans['services'][service][plugin]['commands']: + output.writelines('' + escape(command[0])) + for filename in files: + if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]): + output.writelines('\n\n' + escape(filename) + ':\n\n') + with open(filename, 'r') as file: + output.writelines(escape(file.read()) + '\n') + output.writelines('\n') + output.writelines('\n') + output.writelines('\n') + output.writelines('\n') + + manual_commands = os.path.join(target.scandir, '_manual_commands.txt') + if os.path.isfile(manual_commands): + output.writelines('\n') + with open(manual_commands, 'r') as file: + output.writelines('' + escape(file.read()) + '\n') + output.writelines('\n') + + patterns = os.path.join(target.scandir, '_patterns.log') + if os.path.isfile(patterns): + output.writelines('\n') + with open(patterns, 'r') as file: + output.writelines('' + escape(file.read()) + '\n') + output.writelines('\n') + + commands = os.path.join(target.scandir, '_commands.log') + if os.path.isfile(commands): + output.writelines('\n') + with open(commands, 'r') as file: + output.writelines('' + escape(file.read()) + '\n') + output.writelines('\n') + + errors = os.path.join(target.scandir, '_errors.log') + if os.path.isfile(errors): + output.writelines('\n') + with open(errors, 'r') as file: + output.writelines('' + escape(file.read()) + '\n') + output.writelines('\n') + output.writelines('\n') + + output.writelines('') diff --git a/autorecon/default-plugins/reporting-markdown.py b/autorecon/default-plugins/reporting-markdown.py new file mode 100644 index 0000000..bba0330 --- /dev/null +++ b/autorecon/default-plugins/reporting-markdown.py @@ -0,0 +1,75 @@ +from autorecon.plugins import Report +from autorecon.config import config +import os, glob + +class Markdown(Report): + + def __init__(self): + super().__init__() + self.name = 'Markdown' + + async def run(self, targets): + if len(targets) > 1: + report = os.path.join(config['output'], 'report.md') + elif len(targets) == 1: + report = os.path.join(targets[0].reportdir, 'report.md') + else: + return + + os.makedirs(report, exist_ok=True) + + for target in targets: + os.makedirs(os.path.join(report, target.address), exist_ok=True) + + files = [os.path.abspath(filename) for filename in glob.iglob(os.path.join(target.scandir, '**/*'), recursive=True) if os.path.isfile(filename) and filename.endswith(('.txt', '.html'))] + + if target.scans['ports']: + os.makedirs(os.path.join(report, target.address, 'Port Scans'), exist_ok=True) + for scan in target.scans['ports'].keys(): + if len(target.scans['ports'][scan]['commands']) > 0: + with open(os.path.join(report, target.address, 'Port Scans', 'PortScan - ' + target.scans['ports'][scan]['plugin'].name + '.md'), 'w') as output: + for command in target.scans['ports'][scan]['commands']: + output.writelines('```bash\n' + command[0] + '\n```') + for filename in files: + if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]): + output.writelines('\n\n[' + filename + '](file://' + filename + '):\n\n') + with open(filename, 'r') as file: + output.writelines('```\n' + file.read() + '\n```\n') + if target.scans['services']: + os.makedirs(os.path.join(report, target.address, 'Services'), exist_ok=True) + for service in target.scans['services'].keys(): + os.makedirs(os.path.join(report, target.address, 'Services', 'Service - ' + service.tag().replace('/', '-')), exist_ok=True) + for plugin in target.scans['services'][service].keys(): + if len(target.scans['services'][service][plugin]['commands']) > 0: + with open(os.path.join(report, target.address, 'Services', 'Service - ' + service.tag().replace('/', '-'), target.scans['services'][service][plugin]['plugin'].name + '.md'), 'w') as output: + for command in target.scans['services'][service][plugin]['commands']: + output.writelines('```bash\n' + command[0] + '\n```') + for filename in files: + if filename in command[0] or (command[1] is not None and filename == command[1]) or (command[2] is not None and filename == command[2]): + output.writelines('\n\n[' + filename + '](file://' + filename + '):\n\n') + with open(filename, 'r') as file: + output.writelines('```\n' + file.read() + '\n```\n') + + manual_commands = os.path.join(target.scandir, '_manual_commands.txt') + if os.path.isfile(manual_commands): + with open(os.path.join(report, target.address, 'Manual Commands' + '.md'), 'w') as output: + with open(manual_commands, 'r') as file: + output.writelines('```bash\n' + file.read() + '\n```') + + patterns = os.path.join(target.scandir, '_patterns.log') + if os.path.isfile(patterns): + with open(os.path.join(report, target.address, 'Patterns' + '.md'), 'w') as output: + with open(patterns, 'r') as file: + output.writelines(file.read()) + + commands = os.path.join(target.scandir, '_commands.log') + if os.path.isfile(commands): + with open(os.path.join(report, target.address, 'Commands' + '.md'), 'w') as output: + with open(commands, 'r') as file: + output.writelines('```bash\n' + file.read() + '\n```') + + errors = os.path.join(target.scandir, '_errors.log') + if os.path.isfile(errors): + with open(os.path.join(report, target.address, 'Errors' + '.md'), 'w') as output: + with open(errors, 'r') as file: + output.writelines('```\n' + file.read() + '\n```') diff --git a/autorecon/default-plugins/rpcclient.py b/autorecon/default-plugins/rpcclient.py new file mode 100644 index 0000000..052b20a --- /dev/null +++ b/autorecon/default-plugins/rpcclient.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class RPCClient(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "rpcclient" + self.tags = ['default', 'safe', 'rpc'] + + def configure(self): + self.match_service_name(['^msrpc', '^rpcbind', '^erpc']) + + def manual(self, service, plugin_was_run): + service.add_manual_command('RPC Client:', 'rpcclient -p {port} -U "" {address}') diff --git a/autorecon/default-plugins/rpcdump.py b/autorecon/default-plugins/rpcdump.py new file mode 100644 index 0000000..51aa3e7 --- /dev/null +++ b/autorecon/default-plugins/rpcdump.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class RPCDump(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'rpcdump' + self.tags = ['default', 'safe', 'rpc'] + + def configure(self): + self.match_service_name(['^msrpc', '^rpcbind', '^erpc', '^ncacn_http$']) + self.match_port('tcp', [135, 139, 443, 445, 593]) + + async def run(self, service): + if service.protocol == 'tcp': + await service.execute('impacket-rpcdump -port {port} {address}', outfile='{protocol}_{port}_rpc_rpcdump.txt') diff --git a/autorecon/default-plugins/rsync-list-files.py b/autorecon/default-plugins/rsync-list-files.py new file mode 100644 index 0000000..a058336 --- /dev/null +++ b/autorecon/default-plugins/rsync-list-files.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class RsyncList(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Rsync List Files' + self.tags = ['default', 'safe', 'rsync'] + + def configure(self): + self.match_service_name('^rsync') + + async def run(self, service): + await service.execute('rsync -av --list-only rsync://{addressv6}:{port}', outfile='{protocol}_{port}_rsync_file_list.txt') diff --git a/autorecon/default-plugins/showmount.py b/autorecon/default-plugins/showmount.py new file mode 100644 index 0000000..6b14951 --- /dev/null +++ b/autorecon/default-plugins/showmount.py @@ -0,0 +1,14 @@ +from autorecon.plugins import ServiceScan + +class Showmount(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "showmount" + self.tags = ['default', 'safe', 'nfs'] + + def configure(self): + self.match_service_name(['^nfs', '^rpcbind']) + + async def run(self, service): + await service.execute('showmount -e {address} 2>&1', outfile='{protocol}_{port}_showmount.txt') diff --git a/autorecon/default-plugins/sipvicious.py b/autorecon/default-plugins/sipvicious.py new file mode 100644 index 0000000..86db374 --- /dev/null +++ b/autorecon/default-plugins/sipvicious.py @@ -0,0 +1,15 @@ +from autorecon.plugins import ServiceScan + +class SIPVicious(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SIPVicious" + self.tags = ['default', 'safe', 'sip'] + + def configure(self): + self.match_service_name(['^asterisk', '^sip']) + + def manual(self, service, plugin_was_run): + if service.target.ipversion == 'IPv4': + service.add_manual_command('svwar:', 'svwar -D -m INVITE -p {port} {address}') diff --git a/autorecon/default-plugins/smb-vuln.py b/autorecon/default-plugins/smb-vuln.py new file mode 100644 index 0000000..d82ec6f --- /dev/null +++ b/autorecon/default-plugins/smb-vuln.py @@ -0,0 +1,18 @@ +from autorecon.plugins import ServiceScan + +class SMBVuln(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SMB Vulnerabilities" + self.tags = ['unsafe', 'smb', 'active-directory'] + + def configure(self): + self.match_service_name(['^smb', '^microsoft\-ds', '^netbios']) + + async def run(self, service): + await service.execute('nmap {nmap_extra} -sV -p {port} --script="smb-vuln-*" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_smb_vulnerabilities.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_vulnerabilities.xml" {address}') + + def manual(self, service, plugin_was_run): + if not plugin_was_run: # Only suggest these if they weren't run. + service.add_manual_commands('Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:', 'nmap {nmap_extra} -sV -p {port} --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "{scandir}/{protocol}_{port}_smb_vulnerabilities.txt" -oX "{scandir}/xml/{protocol}_{port}_smb_vulnerabilities.xml" {address}') diff --git a/autorecon/default-plugins/smbclient.py b/autorecon/default-plugins/smbclient.py new file mode 100644 index 0000000..64ad0df --- /dev/null +++ b/autorecon/default-plugins/smbclient.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class SMBClient(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SMBClient" + self.tags = ['default', 'safe', 'smb', 'active-directory'] + + def configure(self): + self.match_service_name(['^smb', '^microsoft\-ds', '^netbios']) + self.match_port('tcp', [139, 445]) + self.run_once(True) + + async def run(self, service): + await service.execute('smbclient -L //{address} -N -I {address} 2>&1', outfile='smbclient.txt') diff --git a/autorecon/default-plugins/smbmap.py b/autorecon/default-plugins/smbmap.py new file mode 100644 index 0000000..de500f7 --- /dev/null +++ b/autorecon/default-plugins/smbmap.py @@ -0,0 +1,20 @@ +from autorecon.plugins import ServiceScan + +class SMBMap(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SMBMap" + self.tags = ['default', 'safe', 'smb', 'active-directory'] + + def configure(self): + self.match_service_name(['^smb', '^microsoft\-ds', '^netbios']) + + async def run(self, service): + if service.target.ipversion == 'IPv4': + await service.execute('smbmap -H {address} -P {port} 2>&1', outfile='smbmap-share-permissions.txt') + await service.execute('smbmap -u null -p "" -H {address} -P {port} 2>&1', outfile='smbmap-share-permissions.txt') + await service.execute('smbmap -H {address} -P {port} -R 2>&1', outfile='smbmap-list-contents.txt') + await service.execute('smbmap -u null -p "" -H {address} -P {port} -R 2>&1', outfile='smbmap-list-contents.txt') + await service.execute('smbmap -H {address} -P {port} -x "ipconfig /all" 2>&1', outfile='smbmap-execute-command.txt') + await service.execute('smbmap -u null -p "" -H {address} -P {port} -x "ipconfig /all" 2>&1', outfile='smbmap-execute-command.txt') diff --git a/autorecon/default-plugins/smtp-user-enum.py b/autorecon/default-plugins/smtp-user-enum.py new file mode 100644 index 0000000..5a995b2 --- /dev/null +++ b/autorecon/default-plugins/smtp-user-enum.py @@ -0,0 +1,20 @@ +from autorecon.plugins import ServiceScan + +class SMTPUserEnum(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'SMTP-User-Enum' + self.tags = ['default', 'safe', 'smtp', 'email'] + + def configure(self): + self.match_service_name('^smtp') + + async def run(self, service): + await service.execute('hydra smtp-enum://{addressv6}:{port}/vrfy -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" 2>&1', outfile='{protocol}_{port}_smtp_user-enum_hydra_vrfy.txt') + await service.execute('hydra smtp-enum://{addressv6}:{port}/expn -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" 2>&1', outfile='{protocol}_{port}_smtp_user-enum_hydra_expn.txt') + + def manual(self, service, plugin_was_run): + service.add_manual_command('Try User Enumeration using "RCPT TO". Replace with the target\'s domain name:', [ + 'hydra smtp-enum://{addressv6}:{port}/rcpt -L "' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '" -o "{scandir}/{protocol}_{port}_smtp_user-enum_hydra_rcpt.txt" -p ' + ]) diff --git a/autorecon/default-plugins/snmpwalk.py b/autorecon/default-plugins/snmpwalk.py new file mode 100644 index 0000000..5263700 --- /dev/null +++ b/autorecon/default-plugins/snmpwalk.py @@ -0,0 +1,23 @@ +from autorecon.plugins import ServiceScan + +class SNMPWalk(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SNMPWalk" + self.tags = ['default', 'safe', 'snmp'] + + def configure(self): + self.match_service_name('^snmp') + self.match_port('udp', 161) + self.run_once(True) + + async def run(self, service): + await service.execute('snmpwalk -c public -v 1 {address} 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.1.6.0 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_system_processes.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.4.2.1.2 2>&1', outfile='{scandir}/{protocol}_{port}_snmp_snmpwalk_running_processes.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.4.2.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_process_paths.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.2.3.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_storage_units.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.25.2.3.1.4 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_software_names.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.4.1.77.1.2.25 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_user_accounts.txt') + await service.execute('snmpwalk -c public -v 1 {address} 1.3.6.1.2.1.6.13.1.3 2>&1', outfile='{protocol}_{port}_snmp_snmpwalk_tcp_ports.txt') diff --git a/autorecon/default-plugins/sslscan.py b/autorecon/default-plugins/sslscan.py new file mode 100644 index 0000000..43071ac --- /dev/null +++ b/autorecon/default-plugins/sslscan.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class SSLScan(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "SSL Scan" + self.tags = ['default', 'safe', 'ssl', 'tls'] + + def configure(self): + self.match_all_service_names(True) + self.require_ssl(True) + + async def run(self, service): + if service.protocol == 'tcp' and service.secure: + await service.execute('sslscan --show-certificate --no-colour {addressv6}:{port} 2>&1', outfile='{protocol}_{port}_sslscan.html') diff --git a/autorecon/default-plugins/subdomain-enumeration.py b/autorecon/default-plugins/subdomain-enumeration.py new file mode 100644 index 0000000..185f5a3 --- /dev/null +++ b/autorecon/default-plugins/subdomain-enumeration.py @@ -0,0 +1,34 @@ +from autorecon.plugins import ServiceScan +import os + +class SubdomainEnumeration(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "Subdomain Enumeration" + self.slug = "subdomain-enum" + self.tags = ['default', 'safe', 'long', 'dns'] + + def configure(self): + self.add_option('domain', help='The domain to use as the base domain (e.g. example.com) for subdomain enumeration. Default: %(default)s') + self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating subdomains. Separate multiple wordlists with spaces. Default: %(default)s') + self.add_option('threads', default=10, help='The number of threads to use when enumerating subdomains. Default: %(default)s') + self.match_service_name('^domain') + + async def run(self, service): + domains = [] + + if self.get_option('domain'): + domains.append(self.get_option('domain')) + if service.target.type == 'hostname' and service.target.address not in domains: + domains.append(service.target.address) + if self.get_global('domain') and self.get_global('domain') not in domains: + domains.append(self.get_global('domain')) + + if len(domains) > 0: + for wordlist in self.get_option('wordlist'): + name = os.path.splitext(os.path.basename(wordlist))[0] + for domain in domains: + await service.execute('gobuster dns -d ' + domain + ' -r {addressv6} -w ' + wordlist + ' -o "{scandir}/{protocol}_{port}_' + domain + '_subdomains_' + name + '.txt"') + else: + service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.') diff --git a/autorecon/default-plugins/virtual-host-enumeration.py b/autorecon/default-plugins/virtual-host-enumeration.py new file mode 100644 index 0000000..96e2561 --- /dev/null +++ b/autorecon/default-plugins/virtual-host-enumeration.py @@ -0,0 +1,39 @@ +from autorecon.plugins import ServiceScan +from shutil import which +import os, random, string + +class VirtualHost(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Virtual Host Enumeration' + self.slug = 'vhost-enum' + self.tags = ['default', 'safe', 'http', 'long'] + + def configure(self): + self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') + self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') + self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + async def run(self, service): + hostnames = [] + if self.get_option('hostname'): + hostnames.append(self.get_option('hostname')) + if service.target.type == 'hostname' and service.target.address not in hostnames: + hostnames.append(service.target.address) + if self.get_global('domain') and self.get_global('domain') not in hostnames: + hostnames.append(self.get_global('domain')) + + if len(hostnames) > 0: + for wordlist in self.get_option('wordlist'): + name = os.path.splitext(os.path.basename(wordlist))[0] + for hostname in hostnames: + _, stdout, _ = await service.execute('curl -sk -o /dev/null -H "Host: ' + ''.join(random.choice(string.ascii_letters) for i in range(20)) + '.' + hostname + '" {http_scheme}://' + hostname + ':{port}/ -w "%{{size_download}}"') + + size = ''.join(await stdout.readlines()) + + await service.execute('ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -fs ' + size + ' -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"') + else: + service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.') diff --git a/autorecon/default-plugins/whatweb.py b/autorecon/default-plugins/whatweb.py new file mode 100644 index 0000000..017d80c --- /dev/null +++ b/autorecon/default-plugins/whatweb.py @@ -0,0 +1,16 @@ +from autorecon.plugins import ServiceScan + +class WhatWeb(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "whatweb" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + async def run(self, service): + if service.protocol == 'tcp' and service.target.ipversion == 'IPv4': + await service.execute('whatweb --color=never --no-errors -a 3 -v {http_scheme}://{address}:{port} 2>&1', outfile='{protocol}_{port}_{http_scheme}_whatweb.txt') diff --git a/autorecon/default-plugins/winrm-detection.py b/autorecon/default-plugins/winrm-detection.py new file mode 100644 index 0000000..8742f47 --- /dev/null +++ b/autorecon/default-plugins/winrm-detection.py @@ -0,0 +1,32 @@ +from autorecon.plugins import ServiceScan +from autorecon.io import fformat + +class WinRMDetection(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'WinRM Detection' + self.tags = ['default', 'safe', 'winrm'] + + def configure(self): + self.match_service_name('^wsman') + self.match_service('tcp', [5985, 5986], '^http') + + async def run(self, service): + filename = fformat('{scandir}/{protocol}_{port}_winrm-detection.txt') + with open(filename, mode='wt', encoding='utf8') as winrm: + winrm.write('WinRM was possibly detected running on ' + service.protocol + ' port ' + str(service.port) + '.\nCheck _manual_commands.txt for manual commands you can run against this service.') + + def manual(self, service, plugin_was_run): + service.add_manual_commands('Bruteforce logins:', [ + 'crackmapexec winrm {address} -d \'' + self.get_global('domain', default='') + '\' -u \'' + self.get_global('username_wordlist', default='/usr/share/seclists/Usernames/top-usernames-shortlist.txt') + '\' -p \'' + self.get_global('password_wordlist', default='/usr/share/seclists/Passwords/darkweb2017-top100.txt') + '\'' + ]) + + service.add_manual_commands('Check login (requires credentials):', [ + 'crackmapexec winrm {address} -d \'' + self.get_global('domain', default='') + '\' -u \'\' -p \'\'' + ]) + + service.add_manual_commands('Evil WinRM (gem install evil-winrm):', [ + 'evil-winrm -u \'\' -p \'\' -i {address}', + 'evil-winrm -u \'\' -H \'\' -i {address}' + ]) diff --git a/autorecon/default-plugins/wkhtmltoimage.py b/autorecon/default-plugins/wkhtmltoimage.py new file mode 100644 index 0000000..d4d30ba --- /dev/null +++ b/autorecon/default-plugins/wkhtmltoimage.py @@ -0,0 +1,23 @@ +from autorecon.plugins import ServiceScan +from shutil import which + +class WkHTMLToImage(ServiceScan): + + def __init__(self): + super().__init__() + self.name = "wkhtmltoimage" + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + def check(self): + if which('wkhtmltoimage') is None: + self.error('The wkhtmltoimage program could not be found. Make sure it is installed. (On Kali, run: sudo apt install wkhtmltopdf)') + return False + + async def run(self, service): + if which('wkhtmltoimage') is not None: + if service.protocol == 'tcp': + await service.execute('wkhtmltoimage --format png {http_scheme}://{addressv6}:{port}/ {scandir}/{protocol}_{port}_{http_scheme}_screenshot.png') diff --git a/autorecon/default-plugins/wpscan.py b/autorecon/default-plugins/wpscan.py new file mode 100644 index 0000000..a5a9249 --- /dev/null +++ b/autorecon/default-plugins/wpscan.py @@ -0,0 +1,20 @@ +from autorecon.plugins import ServiceScan + +class WPScan(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'WPScan' + self.tags = ['default', 'safe', 'http'] + + def configure(self): + self.add_option('api-token', help='An API Token from wpvulndb.com to help search for more vulnerabilities.') + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + def manual(self, service, plugin_was_run): + api_token = '' + if self.get_option('api-token'): + api_token = ' --api-token ' + self.get_option('api-token') + + service.add_manual_command('(wpscan) WordPress Security Scanner (useful if WordPress is found):', 'wpscan --url {http_scheme}://{addressv6}:{port}/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color' + api_token + ' 2>&1 | tee "{scandir}/{protocol}_{port}_{http_scheme}_wpscan.txt"')