From c7fedc0165ae7137fd065688ecb1f7320f9f5bf0 Mon Sep 17 00:00:00 2001 From: ekultek Date: Tue, 24 Oct 2017 01:22:21 -0500 Subject: [PATCH] fixed the nmap issues, it will run now it will also install itself if it's not there. working on sqlmap autostart (still). moved the function to create sqlmap and nmap arguments to settings.py. created two new scripts (one is still a work in progess) --- etc/checksum/md5sum.md5 | 10 ++-- etc/scripts/install_nmap.sh | 3 + etc/scripts/launch_sqlmap.sh | 7 +++ lib/attacks/nmap_scan/__init__.py | 60 +++++++++++--------- lib/attacks/sqlmap_scan/__init__.py | 42 ++++---------- lib/core/settings.py | 86 +++++++++++++++++++++++++++-- zeus.py | 68 ++--------------------- 7 files changed, 146 insertions(+), 130 deletions(-) create mode 100644 etc/scripts/install_nmap.sh create mode 100644 etc/scripts/launch_sqlmap.sh diff --git a/etc/checksum/md5sum.md5 b/etc/checksum/md5sum.md5 index 8dc715d..cdd2cd9 100644 --- a/etc/checksum/md5sum.md5 +++ b/etc/checksum/md5sum.md5 @@ -1,6 +1,8 @@ -0795e9e227fe78a89886155fe9daf559 ./zeus.py +be5c457a19611d8e7f22477ebf733e11 ./zeus.py 6ad5f22ec4a6f8324bfb1b01ab6d51ec ./etc/scripts/cleanup.sh 155c9482f690f1482f324a7ffd8b8098 ./etc/scripts/fix_pie.sh +0e435c641bc636ac0b3d54e032d9cf6a .etc/scripts/install_nmap.sh +fa53722189548fe405014fd3a4b32cc5 .etc/scripts/launch_sqlmap.sh 642a77905d8bb4e5533e0e9c2137c0fa ./etc/agents.txt 66b11aa388ea909de7b212341259a318 ./etc/auths/git_auth 8f686b05c5c5dfc02f0fcaa7ebc8677c ./etc/auths/whois_auth @@ -30,18 +32,18 @@ c10fdf73c2b655e07d13ac8103bd321e ./lib/tamper_scripts/space2null_encode.py 3b8c95a6a3b7cecce5118f2fb1ccc6b8 ./lib/tamper_scripts/appendnull_encode.py d41d8cd98f00b204e9800998ecf8427e ./lib/__init__.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py -6eddc0714ba922d750ab080f33b5bfd2 ./lib/attacks/sqlmap_scan/__init__.py +7aa70ffff764fc1d884adcc12f6825e1 ./lib/attacks/sqlmap_scan/__init__.py 5e5bb575014ebe613db6bf671d008cf8 ./lib/attacks/sqlmap_scan/sqlmap_opts.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/whois_lookup/__init__.py f27322b9716e1a2b0b0b0487f3149474 ./lib/attacks/whois_lookup/whois.py 2782c48ef762413f0e7ce7392786ce2d ./lib/attacks/admin_panel_finder/__init__.py 23c1e5e934029f9acc89d2c95e7748e7 ./lib/attacks/xss_scan/__init__.py -7870fc3ce4808b5c57dc32e9b84a90b3 ./lib/attacks/nmap_scan/__init__.py +f5e10264d98d8c59b3d5ae86051bbcf2 ./lib/attacks/nmap_scan/__init__.py 216999fa0e84866d5c1d96d5676034e4 ./lib/attacks/nmap_scan/nmap_opts.py c5ebb0c56c9ae3b9a72a14e3f05afa16 ./lib/attacks/intel_me/__init__.py 1faa2b5dfad6eb538bbfe42942d2a9da ./lib/core/errors.py d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py -d901189371e5cd4a32114ee63b611b11 ./lib/core/settings.py +98680e3f6a2618f9d2acdf89575afd17 ./lib/core/settings.py d41d8cd98f00b204e9800998ecf8427e ./var/google_search/__init__.py b8761604c5d4f88ae653526057491a5f ./var/google_search/search.py d41d8cd98f00b204e9800998ecf8427e ./var/__init__.py diff --git a/etc/scripts/install_nmap.sh b/etc/scripts/install_nmap.sh new file mode 100644 index 0000000..67e52db --- /dev/null +++ b/etc/scripts/install_nmap.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash + +sudo apt-get install nmap \ No newline at end of file diff --git a/etc/scripts/launch_sqlmap.sh b/etc/scripts/launch_sqlmap.sh new file mode 100644 index 0000000..2a2399c --- /dev/null +++ b/etc/scripts/launch_sqlmap.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash + +USR_PATH=$2 + +echo $USR_PATH + +python "$USR_PATH/sqlmapapi.py -s" \ No newline at end of file diff --git a/lib/attacks/nmap_scan/__init__.py b/lib/attacks/nmap_scan/__init__.py index 8bdb219..8fb2370 100644 --- a/lib/attacks/nmap_scan/__init__.py +++ b/lib/attacks/nmap_scan/__init__.py @@ -1,15 +1,11 @@ import json import os import socket +import subprocess import nmap -from lib.core.settings import ( - logger, - set_color, - create_dir, - find_application, -) +import lib.core.settings from var.auto_issue.github import request_issue_creation @@ -23,13 +19,12 @@ class NmapHook(object): def __init__(self, ip, verbose=False, pretty=True, dirname="{}/log/scanner-log".format(os.getcwd()), filename="nmap_scan-results-{}.json", - ports=None, opts=None): + opts=None): self.ip = ip self.verbose = verbose self.pretty = pretty self.dir = dirname self.file = filename - self.ports = ports if opts is None: self.opts = "" else: @@ -39,7 +34,7 @@ class NmapHook(object): """ get all the information from the scan """ - scanned_data = self.NM.scan(self.ip, ports=self.ports, arguments=self.opts) + scanned_data = self.NM.scan(self.ip, arguments=self.opts) if self.pretty: scanned_data = json.dumps(scanned_data, indent=4, sort_keys=True) return scanned_data @@ -48,7 +43,7 @@ class NmapHook(object): """ send all the information to a JSON file for further use """ - create_dir(self.dir) + lib.core.settings.create_dir(self.dir) full_nmap_path = "{}/{}".format(self.dir, self.file.format(self.ip)) with open(full_nmap_path, "a+") as log: log.write(data) @@ -60,7 +55,7 @@ class NmapHook(object): """ # have to create a spacer or the output comes out funky.. spacer_data = {4: " " * 8, 6: " " * 6, 8: " " * 4} - logger.info(set_color("finding data for IP '{}'...".format(self.ip))) + lib.core.settings.logger.info(lib.core.settings.set_color("finding data for IP '{}'...".format(self.ip))) json_data = json.loads(json_data)["scan"] print( "{}\nScanned: {} ({})\tStatus: {}\nProtocol: {}\n".format( @@ -85,59 +80,72 @@ class NmapHook(object): print("{}".format(sep)) -def find_nmap(item_name="nmap", verbose=False): +def find_nmap(item_name="nmap"): """ find nmap on the users system if they do not specify a path for it or it is not in their PATH """ - return find_application(item_name, verbose=verbose) + return lib.core.settings.find_application(item_name) -def perform_port_scan(url, ports=None, scanner=NmapHook, verbose=False, opts=None, **kwargs): +def perform_port_scan(url, scanner=NmapHook, verbose=False, opts=None, **kwargs): """ main function that will initalize the port scanning """ url = url.strip() - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "attempting to find IP address for hostname '{}'...".format(url) )) found_ip_address = socket.gethostbyname(url) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "found IP address for given URL -> '{}'...".format(found_ip_address) )) if verbose: - logger.debug(set_color( + lib.core.settings.logger.debug(lib.core.settings.set_color( "checking for nmap on your system...", level=10 )) - nmap_exists = "".join(find_nmap(verbose=verbose)) + nmap_exists = "".join(find_nmap()) if nmap_exists: if verbose: - logger.debug(set_color( + lib.core.settings.logger.debug(lib.core.settings.set_color( "nmap has been found under '{}'...".format(nmap_exists), level=10 )) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "starting port scan on IP address '{}'...".format(found_ip_address) )) try: - data = scanner(found_ip_address, ports=ports, opts=opts) + data = scanner(found_ip_address, opts=opts) json_data = data._get_all_info() data.show_open_ports(json_data) file_path = data.send_to_file(json_data) - logger.info(set_color( + lib.core.settings.logger.info(lib.core.settings.set_color( "port scan completed, all data saved to JSON file under '{}'...".format(file_path) )) except KeyError: - logger.fatal(set_color( + lib.core.settings.logger.fatal(lib.core.settings.set_color( "no port information found for '{}({})'...".format( url, found_ip_address ), level=50 )) except Exception as e: - logger.exception(set_color( + lib.core.settings.logger.exception(lib.core.settings.set_color( "ran into exception '{}', cannot continue quitting...".format(e), level=50 )) request_issue_creation() pass else: - logger.fatal(set_color( - "nmap was not found on your system, please install it...", level=50 + lib.core.settings.logger.fatal(lib.core.settings.set_color( + "nmap was not found on your system...", level=50 )) + question = lib.core.settings.prompt( + "would you like to automatically install it", opts="yN" + ) + if question.lower().startswith("y"): + subprocess.call(["sudo", "sh", "{}".format(lib.core.settings.NMAP_INSTALLER_TOOL)]) + lib.core.settings.logger.info(lib.core.settings.set_color( + "nmap has been successfully installed, re-running..." + )) + perform_port_scan(url, verbose=verbose, opts=opts) + else: + lib.core.settings.logger.fatal(lib.core.settings.set_color( + "nmap is not installed, please install it in order to continue...", level=50 + )) diff --git a/lib/attacks/sqlmap_scan/__init__.py b/lib/attacks/sqlmap_scan/__init__.py index 4528a0b..fcb300f 100644 --- a/lib/attacks/sqlmap_scan/__init__.py +++ b/lib/attacks/sqlmap_scan/__init__.py @@ -1,5 +1,4 @@ import json -import time import re import subprocess @@ -109,11 +108,11 @@ class SqlmapHook(object): already_displayed.add(log_json["log"][i]["message"]) -def find_sqlmap(to_find="sqlmap", verbose=False): +def find_sqlmap(to_find="sqlmap"): """ find sqlmap on the users system """ - found_path = lib.core.settings.find_application(to_find, verbose=verbose) + found_path = lib.core.settings.find_application(to_find) return found_path @@ -129,43 +128,22 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False): return {key: value for key, value in opts} is_started = lib.core.settings.search_for_process("sqlmapapi.py") + found_path = find_sqlmap() if auto_start: lib.core.settings.logger.error(lib.core.settings.set_color( - "auto starting sqlmap is not implemented yet, you will need to start " - "the API manually for now...", level=40 + "auto start is not enabled yet, please start the API manually..." )) lib.core.settings.prompt( - "press enter when ready to continue..." + "press enter when ready..." ) '''lib.core.settings.logger.info(lib.core.settings.set_color( - "attempting to find sqlmap on your system..." + "attempting to launch sqlmap API..." )) - try: - path = "".join(find_sqlmap("sqlmap", verbose=verbose)) - lib.core.settings.logger.info(lib.core.settings.set_color( - "attempting to call sqlmap API..." - )) - subprocess.Popen(["python {}/{} -s".format(path, "sqlmapapi.py")], shell=True, - close_fds=True, stdout=subprocess.PIPE) - lib.core.settings.logger.info(lib.core.settings.set_color( - "API started, continuing process..." - ) - ) - time.sleep(3) - if not is_started: - lib.core.settings.prompt( - "appears that sqlmap's API was not started successfully, start it manually and press" - " enter..." - ) - except Exception as e: - print e - lib.core.settings.logger.error(lib.core.settings.set_color( - "ran into an error while trying to start the sqlmap API, please do it manually...", level=50 - )) - lib.core.settings.prompt( - "press enter when ready to start..." - )''' + subprocess.call("sudo sh {} p {}".format(lib.core.settings.LAUNCH_SQLMAP_API_TOOL, found_path)) + lib.core.settings.logger.info(lib.core.settings.set_color( + "sqlmap API is up and running, continuing process..." + ))''' else: if not is_started: lib.core.settings.prompt( diff --git a/lib/core/settings.py b/lib/core/settings.py index e0cde10..390c918 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -22,6 +22,9 @@ import requests import bin.unzip_gecko import lib.core.errors +from lib.attacks.sqlmap_scan.sqlmap_opts import SQLMAP_API_OPTIONS +from lib.attacks.nmap_scan.nmap_opts import NMAP_API_OPTS + try: raw_input # Python 2 except NameError: @@ -32,7 +35,7 @@ PATCH_ID = str(subprocess.check_output(["git", "rev-parse", "origin/master"]))[: # clone link CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.0.59" +VERSION = "1.0.60" # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting @@ -69,8 +72,13 @@ GECKO_VERSION_INFO_PATH = "{}/bin/version_info".format(os.getcwd()) FIX_PROGRAM_INSTALL_PATH = "{}/etc/scripts/fix_pie.sh".format(os.getcwd()) # path to the auto clean tool CLEANUP_TOOL_PATH = "{}/etc/scripts/cleanup.sh".format(os.getcwd()) +# path to tool to launch sqlmap API +LAUNCH_SQLMAP_API_TOOL = "{}/etc/scripts/launch_sqlmap.sh".format(os.getcwd()) +# path to nmap installer +NMAP_INSTALLER_TOOL = "{}/etc/scripts/install_nmap.sh".format(os.getcwd()) # paths to sqlmap and nmap TOOL_PATHS = "{}/bin/paths/path_config.ini".format(os.getcwd()) +# log path to the whois results WHOIS_RESULTS_LOG_PATH = "{}/log/whois".format(os.getcwd()) # path to store robot.txt page in ROBOTS_PAGE_PATH = "{}/log/robots".format(os.getcwd()) @@ -294,7 +302,7 @@ def get_latest_log_file(log_path): return None -def replace_http(url): +def replace_http(url, queries=True, complete=False): """ replace the http in the url so we can get the IP address """ @@ -308,7 +316,13 @@ def replace_http(url): try: url_list = url.split("//") new_url = url_list[1] - return __remove_queries(new_url) + if queries: + retval = __remove_queries(new_url) + elif complete: + retval = __remove_queries(new_url) + if "www" in retval: + retval = retval.replace("www.", "") + return retval except IndexError: return url @@ -585,4 +599,68 @@ def config_search_engine(**kwargs): "using default search engine..." )) if enum is None else "" se = AUTHORIZED_SEARCH_ENGINES["google"] - return se \ No newline at end of file + return se + + +def create_arguments(**kwargs): + """ + create the arguments for sqlmap and nmap if arguments are passed + """ + nmap = kwargs.get("nmap", False) + sqlmap = kwargs.get("sqlmap", False) + sqlmap_args = kwargs.get("sqlmap_args", None) + nmap_args = kwargs.get("nmap_args", None) + + logger.info(set_color( + "creating arguments for {}...".format("sqlmap" if sqlmap else "nmap") + )) + retval = [] + splitter = {"sqlmap": ",", "nmap": "|"} + if sqlmap: + warn_msg = "option '{}' is not recognized by sqlmap API, skipping..." + if sqlmap_args is not None: + for line in sqlmap_args.split(splitter["sqlmap"]): + try: + to_use = line.strip().split(" ") + option = (to_use[0], to_use[1]) + if to_use[0] in SQLMAP_API_OPTIONS: + retval.append(option) + else: + logger.warning(set_color( + warn_msg.format(option[0]), + level=30 + )) + except IndexError: + option = (line.strip(), "true") + if line.strip() in SQLMAP_API_OPTIONS: + retval.append(option) + else: + logger.warning(set_color( + warn_msg.format(line.strip()), level=30 + )) + + elif nmap: + warning_msg = "option {} is not known by the nmap api, skipping..." + if nmap_args is not None: + for line in nmap_args.split(splitter["nmap"]): + try: + data = line.index(" ") + except Exception: + data = None + pass + if data is not None: + argument = line[0:data] + if argument in NMAP_API_OPTS: + retval.append(line) + else: + logger.warning(set_color( + warning_msg.format(argument), level=30 + )) + else: + if line in NMAP_API_OPTS: + retval.append(line) + else: + logger.warning(set_color( + warning_msg.format(line), level=30 + )) + return retval diff --git a/zeus.py b/zeus.py index 2f93251..708f022 100755 --- a/zeus.py +++ b/zeus.py @@ -53,7 +53,8 @@ from lib.core.settings import ( SPIDER_LOG_PATH, config_headers, config_search_engine, - find_running_opts + find_running_opts, + create_arguments ) if __name__ == "__main__": @@ -256,67 +257,6 @@ if __name__ == "__main__": )) - def __create_arguments(**kwargs): - nmap = kwargs.get("nmap", False) - sqlmap = kwargs.get("sqlmap", False) - """ - create the sqlmap arguments (a list of tuples) that will be passed to the API - """ - logger.info(set_color( - "creating arguments for {}...".format("sqlmap" if sqlmap else "nmap") - )) - retval = [] - splitter = {"sqlmap": ",", "nmap": "|"} - if sqlmap: - warn_msg = "option '{}' is not recognized by sqlmap API, skipping..." - if opt.sqlmapArguments is not None: - for line in opt.sqlmapArguments.split(splitter["sqlmap"]): - try: - to_use = line.strip().split(" ") - option = (to_use[0], to_use[1]) - if to_use[0] in SQLMAP_API_OPTIONS: - retval.append(option) - else: - logger.warning(set_color( - warn_msg.format(option[0]), - level=30 - )) - except IndexError: - option = (line.strip(), "true") - if line.strip() in SQLMAP_API_OPTIONS: - retval.append(option) - else: - logger.warning(set_color( - warn_msg.format(line.strip()), level=30 - )) - - elif nmap: - warning_msg = "option {} is not known by the nmap api, skipping..." - if opt.nmapArguments is not None: - for line in opt.nmapArguments.split(splitter["nmap"]): - try: - data = line.index(" ") - except Exception: - data = None - pass - if data is not None: - argument = line[0:data] - if argument in NMAP_API_OPTS: - retval.append(line) - else: - logger.warning(set_color( - warning_msg.format(argument), level=30 - )) - else: - if line in NMAP_API_OPTS: - retval.append(line) - else: - logger.warning(set_color( - warning_msg.format(line), level=30 - )) - return retval - - def __run_attacks(url, **kwargs): """ run the attacks if any are requested @@ -365,12 +305,12 @@ if __name__ == "__main__": if sqlmap: return sqlmap_scan.sqlmap_scan_main( url.strip(), verbose=verbose, - opts=__create_arguments(sqlmap=True), auto_start=auto_start) + opts=create_arguments(sqlmap=True, sqlmap_args=opt.sqlmapArguments), auto_start=auto_start) elif nmap: url_ip_address = replace_http(url.strip()) return nmap_scan.perform_port_scan( url_ip_address, verbose=verbose, - opts=__create_arguments(nmap=True) + opts=create_arguments(nmap=True, nmap_args=opt.nmapArguments) ) elif intel: url = get_true_url(url)