Module: PWN::Plugins::NmapIt

Defined in:
lib/pwn/plugins/nmap_it.rb

Overview

This plugin is used as an interface to nmap, the exploration tool and security / port scanner. More info on available options can be found at: https://github.com/postmodern/ruby-nmap/blob/main/lib/nmap/command.rb

Class Method Summary collapse

Class Method Details

.authors ⇒ Object

Author(s)

0day Inc. [email protected]



144
145
146
147
148
 
# File 'lib/pwn/plugins/nmap_it.rb', line 144

public_class_method def self.authors
  "AUTHOR(S):
    0day Inc. <[email protected]>
  "
end

.diff_xml_results(opts = {}) ⇒ Object

Supported Method Parameters

PWN::Plugins::NmapIt.diff_xml_results( xml_a: 'required - path to nmap xml results', xml_b: 'required - path to nmap xml results', diff: 'required - path to nmap xml results diff' )



101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'lib/pwn/plugins/nmap_it.rb', line 101

public_class_method def self.diff_xml_results(opts = {})
  xml_a = opts[:xml_a].to_s.scrub.strip.chomp
  xml_b = opts[:xml_b].to_s.scrub.strip.chomp
  diff = opts[:diff].to_s.scrub.strip.chomp

  stdout, _stderr, _status = Open3.capture3(
    'ndiff',
    '--xml',
    xml_a,
    xml_b
  )

  File.write(diff, stdout)
rescue StandardError => e
  raise e
end

.help ⇒ Object

Display Usage for this Module



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
 
# File 'lib/pwn/plugins/nmap_it.rb', line 152

public_class_method def self.help
  puts "USAGE:
    # nmap.connect_scan = true
    #{self}.port_scan(
      targets: 'optional - hostname, IP, CIDR, or list of targets',
      ports: 'optional - port, list, or range (e.g. 22,80,443 or 1-1024)',
      connect_scan: 'optional - connect scan value consumed by #port_scan',
      service_scan: 'optional - service scan value consumed by #port_scan',
      script: 'optional - script value consumed by #port_scan',
      xml: 'optional - /tmp/nmap_port_scan_res.xml'
    )

    # xml.each_host do |host|
    #{self}.parse_xml_results(
      xml_file: 'optional - xml file value consumed by #parse_xml_results'
    )

    # Run diff xml results and return its result
    #{self}.diff_xml_results(
      xml_a: 'required - path to nmap xml results',
      xml_b: 'required - path to nmap xml results',
      diff: 'required - path to nmap xml results diff'
    )

    # Normalize nmap XML into {host, port, proto, service, version} rows.
    #{self}.to_findings(
      xml_file: 'required - path to nmap XML output'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end

.parse_xml_results(opts = {}) ⇒ Object

Supported Method Parameters

PWN::Plugins::NmapIt.parse_xml_results(:xml_file => 'required - path to nmap xml results') do |xml| puts xml.public_methods xml.each_host do |host| puts "[#hosthost.ip]"

host.scripts.each do |name,output|
  output.each_line { |line| puts "  #{line}" }
end

host.each_port do |port|
  puts "  [#{port.number}/#{port.protocol}]"

  port.scripts.each do |name,output|
    puts "    [#{name}]"
    output.each_line { |line| puts "      #{line}" }
  end
end
end

end



85
86
87
88
89
90
91
92
93
 
# File 'lib/pwn/plugins/nmap_it.rb', line 85

public_class_method def self.parse_xml_results(opts = {})
  xml_file = opts[:xml_file].to_s.scrub.strip.chomp if File.exist?(opts[:xml_file].to_s.scrub.strip.chomp)

  Nmap::XML.open(xml_file) do |xml|
    yield(xml)
  end
rescue StandardError => e
  raise e
end

.port_scan(opts = {}) ⇒ Object

Supported Method Parameters

PWN::Plugins::NmapIt.port_scan do |nmap| puts nmap.public_methods nmap.connect_scan = true nmap.service_scan = true nmap.verbose = true nmap.ports = [1..1024, 1337] nmap.targets = '127.0.0.1' nmap.xml = '/tmp/nmap_port_scan_res.xml' # alias of output_xml end

PWN::Plugins::NmapIt.port_scan( targets: '127.0.0.1', ports: '1-65535', connect_scan: true, service_scan: true, script: 'vuln,safe', xml: '/tmp/nmap_port_scan_res.xml' )



31
32
33
34
35
36
37
38
 
# File 'lib/pwn/plugins/nmap_it.rb', line 31

public_class_method def self.port_scan(opts = {})
  Nmap::Command.sudo do |nmap|
    apply_port_scan_opts(nmap: nmap, opts: opts)
    yield(nmap_compat(nmap: nmap)) if block_given?
  end
rescue StandardError => e
  raise e
end

.to_findings(opts = {}) ⇒ Object 



118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
 
# File 'lib/pwn/plugins/nmap_it.rb', line 118

public_class_method def self.to_findings(opts = {})
  xml_file = opts[:xml_file].to_s
  raise 'ERROR: xml_file is required' if xml_file.empty?
  return [] unless File.file?(xml_file)

  rows = []
  parse_xml_results(xml_file: xml_file) do |xml|
    xml.each_host do |host|
      host.each_port do |port|
        rows << {
          host: host.ip.to_s,
          port: port.number,
          proto: port.protocol.to_s,
          service: (port.service.name if port.respond_to?(:service) && port.service),
          version: (port.service.version if port.respond_to?(:service) && port.service.respond_to?(:version)),
          template_id: nil,
          severity: 'info'
        }
      end
    end
  end
  rows
end