diff --git a/etc/checksum/md5sum.md5 b/etc/checksum/md5sum.md5 index 8dc715d..cdd2cd9 100644 --- a/etc/checksum/md5sum.md5 +++ b/etc/checksum/md5sum.md5 @@ -1,6 +1,8 @@ -0795e9e227fe78a89886155fe9daf559 ./zeus.py +be5c457a19611d8e7f22477ebf733e11 ./zeus.py 6ad5f22ec4a6f8324bfb1b01ab6d51ec ./etc/scripts/cleanup.sh 155c9482f690f1482f324a7ffd8b8098 ./etc/scripts/fix_pie.sh +0e435c641bc636ac0b3d54e032d9cf6a .etc/scripts/install_nmap.sh +fa53722189548fe405014fd3a4b32cc5 .etc/scripts/launch_sqlmap.sh 642a77905d8bb4e5533e0e9c2137c0fa ./etc/agents.txt 66b11aa388ea909de7b212341259a318 ./etc/auths/git_auth 8f686b05c5c5dfc02f0fcaa7ebc8677c ./etc/auths/whois_auth @@ -30,18 +32,18 @@ c10fdf73c2b655e07d13ac8103bd321e ./lib/tamper_scripts/space2null_encode.py 3b8c95a6a3b7cecce5118f2fb1ccc6b8 ./lib/tamper_scripts/appendnull_encode.py d41d8cd98f00b204e9800998ecf8427e ./lib/__init__.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py -6eddc0714ba922d750ab080f33b5bfd2 ./lib/attacks/sqlmap_scan/__init__.py +7aa70ffff764fc1d884adcc12f6825e1 ./lib/attacks/sqlmap_scan/__init__.py 5e5bb575014ebe613db6bf671d008cf8 ./lib/attacks/sqlmap_scan/sqlmap_opts.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/whois_lookup/__init__.py f27322b9716e1a2b0b0b0487f3149474 ./lib/attacks/whois_lookup/whois.py 2782c48ef762413f0e7ce7392786ce2d ./lib/attacks/admin_panel_finder/__init__.py 23c1e5e934029f9acc89d2c95e7748e7 ./lib/attacks/xss_scan/__init__.py -7870fc3ce4808b5c57dc32e9b84a90b3 ./lib/attacks/nmap_scan/__init__.py +f5e10264d98d8c59b3d5ae86051bbcf2 ./lib/attacks/nmap_scan/__init__.py 216999fa0e84866d5c1d96d5676034e4 ./lib/attacks/nmap_scan/nmap_opts.py c5ebb0c56c9ae3b9a72a14e3f05afa16 ./lib/attacks/intel_me/__init__.py 1faa2b5dfad6eb538bbfe42942d2a9da ./lib/core/errors.py d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py -d901189371e5cd4a32114ee63b611b11 ./lib/core/settings.py +98680e3f6a2618f9d2acdf89575afd17 ./lib/core/settings.py d41d8cd98f00b204e9800998ecf8427e ./var/google_search/__init__.py b8761604c5d4f88ae653526057491a5f ./var/google_search/search.py d41d8cd98f00b204e9800998ecf8427e ./var/__init__.py diff --git a/etc/scripts/install_nmap.sh b/etc/scripts/install_nmap.sh new file mode 100644 index 0000000..67e52db --- /dev/null +++ b/etc/scripts/install_nmap.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash + +sudo apt-get install nmap \ No newline at end of file diff --git a/etc/scripts/launch_sqlmap.sh b/etc/scripts/launch_sqlmap.sh new file mode 100644 index 0000000..2a2399c --- /dev/null +++ b/etc/scripts/launch_sqlmap.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash + +USR_PATH=$2 + +echo $USR_PATH + +python "$USR_PATH/sqlmapapi.py -s" \ No newline at end of file diff --git a/lib/attacks/nmap_scan/__init__.py b/lib/attacks/nmap_scan/__init__.py index 8bdb219..8fb2370 100644 --- a/lib/attacks/nmap_scan/__init__.py +++ b/lib/attacks/nmap_scan/__init__.py @@ -1,15 +1,11 @@ import json import os import socket +import subprocess import nmap -from lib.core.settings import ( - logger, - set_color, - create_dir, - find_application, -) +import lib.core.settings from var.auto_issue.github import request_issue_creation @@ -23,13 +19,12 @@ class NmapHook(object): def __init__(self, ip, verbose=False, pretty=True, dirname="{}/log/scanner-log".format(os.getcwd()), filename="nmap_scan-results-{}.json", - ports=None, opts=None): + opts=None): self.ip = ip self.verbose = verbose self.pretty = pretty self.dir = dirname self.file = filename - self.ports = ports if opts is None: self.opts = "" else: @@ -39,7 +34,7 @@ class NmapHook(object): """ get all the information from the scan """ - scanned_data = self.NM.scan(self.ip, ports=self.ports, arguments=self.opts) + scanned_data = self.NM.scan(self.ip, arguments=self.opts) if self.pretty: scanned_data = json.dumps(scanned_data, indent=4, sort_keys=True) return scanned_data @@ -48,7 +43,7 @@ class NmapHook(object): """ send all the information to a JSON file for further use """ - create_dir(self.dir) + lib.core.settings.create_dir(self.dir) full_nmap_path = "{}/{}".format(self.dir, self.file.format(self.ip)) with open(full_nmap_path, "a+") as log: log.write(data) @@ -60,7 +55,7 @@ class NmapHook(object): """ # have to create a spacer or the output comes out funky.. spacer_data = {4: " " * 8, 6: " " * 6, 8: " " * 4} - logger.info(set_color("finding data for IP '{}'...".format(self.ip))) + lib.core.settings.logger.info(lib.core.settings.set_color("finding data for IP '{}'...".format(self.ip))) json_data = json.loads(json_data)["scan"] print( "{}\nScanned: {} ({})\tStatus: {}\nProtocol: {}\n".format( @@ -85,59 +80,72 @@ class NmapHook(object): print("{}".format(sep)) -def find_nmap(item_name="nmap", verbose=False): +def find_nmap(item_name="nmap"): """ find nmap on the users system if they do not specify a path for it or it is not in their PATH """ - return find_application(item_name, verbose=verbose) + return lib.core.settings.find_application(item_name) -def perform_port_scan(url, ports=None, scanner=NmapHook, verbose=False, opts=None, **kwargs): +def perform_port_scan(url, scanner=NmapHook, verbose=False, opts=None, **kwargs): """ main function that will initalize the port scanning """ url = url.strip() - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "attempting to find IP address for hostname '{}'...".format(url) )) found_ip_address = socket.gethostbyname(url) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "found IP address for given URL -> '{}'...".format(found_ip_address) )) if verbose: - logger.debug(set_color( + lib.core.settings.logger.debug(lib.core.settings.set_color( "checking for nmap on your system...", level=10 )) - nmap_exists = "".join(find_nmap(verbose=verbose)) + nmap_exists = "".join(find_nmap()) if nmap_exists: if verbose: - logger.debug(set_color( + lib.core.settings.logger.debug(lib.core.settings.set_color( "nmap has been found under '{}'...".format(nmap_exists), level=10 )) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "starting port scan on IP address '{}'...".format(found_ip_address) )) try: - data = scanner(found_ip_address, ports=ports, opts=opts) + data = scanner(found_ip_address, opts=opts) json_data = data._get_all_info() data.show_open_ports(json_data) file_path = data.send_to_file(json_data) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "port scan completed, all data saved to JSON file under '{}'...".format(file_path) )) except KeyError: - logger.fatal(set_color( + lib.core.settings.logger.fatal(lib.core.settings.set_color( "no port information found for '{}({})'...".format( url, found_ip_address ), level=50 )) except Exception as e: - logger.exception(set_color( + lib.core.settings.logger.exception(lib.core.settings.set_color( "ran into exception '{}', cannot continue quitting...".format(e), level=50 )) request_issue_creation() pass else: - logger.fatal(set_color( - "nmap was not found on your system, please install it...", level=50 + lib.core.settings.logger.fatal(lib.core.settings.set_color( + "nmap was not found on your system...", level=50 )) + question = lib.core.settings.prompt( + "would you like to automatically install it", opts="yN" + ) + if question.lower().startswith("y"): + subprocess.call(["sudo", "sh", "{}".format(lib.core.settings.NMAP_INSTALLER_TOOL)]) + lib.core.settings.logger.info(lib.core.settings.set_color( + "nmap has been successfully installed, re-running..." + )) + perform_port_scan(url, verbose=verbose, opts=opts) + else: + lib.core.settings.logger.fatal(lib.core.settings.set_color( + "nmap is not installed, please install it in order to continue...", level=50 + )) diff --git a/lib/attacks/sqlmap_scan/__init__.py b/lib/attacks/sqlmap_scan/__init__.py index 4528a0b..fcb300f 100644 --- a/lib/attacks/sqlmap_scan/__init__.py +++ b/lib/attacks/sqlmap_scan/__init__.py @@ -1,5 +1,4 @@ import json -import time import re import subprocess @@ -109,11 +108,11 @@ class SqlmapHook(object): already_displayed.add(log_json["log"][i]["message"]) -def find_sqlmap(to_find="sqlmap", verbose=False): +def find_sqlmap(to_find="sqlmap"): """ find sqlmap on the users system """ - found_path = lib.core.settings.find_application(to_find, verbose=verbose) + found_path = lib.core.settings.find_application(to_find) return found_path @@ -129,43 +128,22 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False): return {key: value for key, value in opts} is_started = lib.core.settings.search_for_process("sqlmapapi.py") + found_path = find_sqlmap() if auto_start: lib.core.settings.logger.error(lib.core.settings.set_color( - "auto starting sqlmap is not implemented yet, you will need to start " - "the API manually for now...", level=40 + "auto start is not enabled yet, please start the API manually..." )) lib.core.settings.prompt( - "press enter when ready to continue..." + "press enter when ready..." ) '''lib.core.settings.logger.info(lib.core.settings.set_color( - "attempting to find sqlmap on your system..." + "attempting to launch sqlmap API..." )) - try: - path = "".join(find_sqlmap("sqlmap", verbose=verbose)) - lib.core.settings.logger.info(lib.core.settings.set_color( - "attempting to call sqlmap API..." - )) - subprocess.Popen(["python {}/{} -s".format(path, "sqlmapapi.py")], shell=True, - close_fds=True, stdout=subprocess.PIPE) - lib.core.settings.logger.info(lib.core.settings.set_color( - "API started, continuing process..." - ) - ) - time.sleep(3) - if not is_started: - lib.core.settings.prompt( - "appears that sqlmap's API was not started successfully, start it manually and press" - " enter..." - ) - except Exception as e: - print e - lib.core.settings.logger.error(lib.core.settings.set_color( - "ran into an error while trying to start the sqlmap API, please do it manually...", level=50 - )) - lib.core.settings.prompt( - "press enter when ready to start..." - )''' + subprocess.call("sudo sh {} p {}".format(lib.core.settings.LAUNCH_SQLMAP_API_TOOL, found_path)) + lib.core.settings.logger.info(lib.core.settings.set_color( + "sqlmap API is up and running, continuing process..." + ))''' else: if not is_started: lib.core.settings.prompt( diff --git a/lib/core/settings.py b/lib/core/settings.py index e0cde10..390c918 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -22,6 +22,9 @@ import requests import bin.unzip_gecko import lib.core.errors +from lib.attacks.sqlmap_scan.sqlmap_opts import SQLMAP_API_OPTIONS +from lib.attacks.nmap_scan.nmap_opts import NMAP_API_OPTS + try: raw_input # Python 2 except NameError: @@ -32,7 +35,7 @@ PATCH_ID = str(subprocess.check_output(["git", "rev-parse", "origin/master"]))[: # clone link CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.0.59" +VERSION = "1.0.60" # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting @@ -69,8 +72,13 @@ GECKO_VERSION_INFO_PATH = "{}/bin/version_info".format(os.getcwd()) FIX_PROGRAM_INSTALL_PATH = "{}/etc/scripts/fix_pie.sh".format(os.getcwd()) # path to the auto clean tool CLEANUP_TOOL_PATH = "{}/etc/scripts/cleanup.sh".format(os.getcwd()) +# path to tool to launch sqlmap API +LAUNCH_SQLMAP_API_TOOL = "{}/etc/scripts/launch_sqlmap.sh".format(os.getcwd()) +# path to nmap installer +NMAP_INSTALLER_TOOL = "{}/etc/scripts/install_nmap.sh".format(os.getcwd()) # paths to sqlmap and nmap TOOL_PATHS = "{}/bin/paths/path_config.ini".format(os.getcwd()) +# log path to the whois results WHOIS_RESULTS_LOG_PATH = "{}/log/whois".format(os.getcwd()) # path to store robot.txt page in ROBOTS_PAGE_PATH = "{}/log/robots".format(os.getcwd()) @@ -294,7 +302,7 @@ def get_latest_log_file(log_path): return None -def replace_http(url): +def replace_http(url, queries=True, complete=False): """ replace the http in the url so we can get the IP address """ @@ -308,7 +316,13 @@ def replace_http(url): try: url_list = url.split("//") new_url = url_list[1] - return __remove_queries(new_url) + if queries: + retval = __remove_queries(new_url) + elif complete: + retval = __remove_queries(new_url) + if "www" in retval: + retval = retval.replace("www.", "") + return retval except IndexError: return url @@ -585,4 +599,68 @@ def config_search_engine(**kwargs): "using default search engine..." )) if enum is None else "" se = AUTHORIZED_SEARCH_ENGINES["google"] - return se \ No newline at end of file + return se + + +def create_arguments(**kwargs): + """ + create the arguments for sqlmap and nmap if arguments are passed + """ + nmap = kwargs.get("nmap", False) + sqlmap = kwargs.get("sqlmap", False) + sqlmap_args = kwargs.get("sqlmap_args", None) + nmap_args = kwargs.get("nmap_args", None) + + logger.info(set_color( + "creating arguments for {}...".format("sqlmap" if sqlmap else "nmap") + )) + retval = [] + splitter = {"sqlmap": ",", "nmap": "|"} + if sqlmap: + warn_msg = "option '{}' is not recognized by sqlmap API, skipping..." + if sqlmap_args is not None: + for line in sqlmap_args.split(splitter["sqlmap"]): + try: + to_use = line.strip().split(" ") + option = (to_use[0], to_use[1]) + if to_use[0] in SQLMAP_API_OPTIONS: + retval.append(option) + else: + logger.warning(set_color( + warn_msg.format(option[0]), + level=30 + )) + except IndexError: + option = (line.strip(), "true") + if line.strip() in SQLMAP_API_OPTIONS: + retval.append(option) + else: + logger.warning(set_color( + warn_msg.format(line.strip()), level=30 + )) + + elif nmap: + warning_msg = "option {} is not known by the nmap api, skipping..." + if nmap_args is not None: + for line in nmap_args.split(splitter["nmap"]): + try: + data = line.index(" ") + except Exception: + data = None + pass + if data is not None: + argument = line[0:data] + if argument in NMAP_API_OPTS: + retval.append(line) + else: + logger.warning(set_color( + warning_msg.format(argument), level=30 + )) + else: + if line in NMAP_API_OPTS: + retval.append(line) + else: + logger.warning(set_color( + warning_msg.format(line), level=30 + )) + return retval diff --git a/zeus.py b/zeus.py index 2f93251..708f022 100755 --- a/zeus.py +++ b/zeus.py @@ -53,7 +53,8 @@ from lib.core.settings import ( SPIDER_LOG_PATH, config_headers, config_search_engine, - find_running_opts + find_running_opts, + create_arguments ) if __name__ == "__main__": @@ -256,67 +257,6 @@ if __name__ == "__main__": )) - def __create_arguments(**kwargs): - nmap = kwargs.get("nmap", False) - sqlmap = kwargs.get("sqlmap", False) - """ - create the sqlmap arguments (a list of tuples) that will be passed to the API - """ - logger.info(set_color( - "creating arguments for {}...".format("sqlmap" if sqlmap else "nmap") - )) - retval = [] - splitter = {"sqlmap": ",", "nmap": "|"} - if sqlmap: - warn_msg = "option '{}' is not recognized by sqlmap API, skipping..." - if opt.sqlmapArguments is not None: - for line in opt.sqlmapArguments.split(splitter["sqlmap"]): - try: - to_use = line.strip().split(" ") - option = (to_use[0], to_use[1]) - if to_use[0] in SQLMAP_API_OPTIONS: - retval.append(option) - else: - logger.warning(set_color( - warn_msg.format(option[0]), - level=30 - )) - except IndexError: - option = (line.strip(), "true") - if line.strip() in SQLMAP_API_OPTIONS: - retval.append(option) - else: - logger.warning(set_color( - warn_msg.format(line.strip()), level=30 - )) - - elif nmap: - warning_msg = "option {} is not known by the nmap api, skipping..." - if opt.nmapArguments is not None: - for line in opt.nmapArguments.split(splitter["nmap"]): - try: - data = line.index(" ") - except Exception: - data = None - pass - if data is not None: - argument = line[0:data] - if argument in NMAP_API_OPTS: - retval.append(line) - else: - logger.warning(set_color( - warning_msg.format(argument), level=30 - )) - else: - if line in NMAP_API_OPTS: - retval.append(line) - else: - logger.warning(set_color( - warning_msg.format(line), level=30 - )) - return retval - - def __run_attacks(url, **kwargs): """ run the attacks if any are requested @@ -365,12 +305,12 @@ if __name__ == "__main__": if sqlmap: return sqlmap_scan.sqlmap_scan_main( url.strip(), verbose=verbose, - opts=__create_arguments(sqlmap=True), auto_start=auto_start) + opts=create_arguments(sqlmap=True, sqlmap_args=opt.sqlmapArguments), auto_start=auto_start) elif nmap: url_ip_address = replace_http(url.strip()) return nmap_scan.perform_port_scan( url_ip_address, verbose=verbose, - opts=__create_arguments(nmap=True) + opts=create_arguments(nmap=True, nmap_args=opt.nmapArguments) ) elif intel: url = get_true_url(url)