Commit a6e6b1c4 authored by Your Name's avatar Your Name
Browse files

Do nothing script python

parent 4c556deb
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# Init
def scan_nmap_top_15k(IP, file):
print("# Scan for service")
print("mkdir nmap")
print("sudo nmap -sS -sV -sC --top-port=15000 " + IP + " -oX " + file + ".xml | tee " + file)
print()
def scan_searchsploit(file):
print("# Scan for vulns")
print("searchsploit --nmap " + file + ".xml")
print()
def scan_FTP_annonymous_login(IP):
print("# Scan FTP Annonymous login")
print("ftp " + IP)
print("Name (10.129.230.162:kali): anonymous")
print("Password: <empty>")
print()
def scan_nmap_ftp(IP):
print("# Scan Nmap FTP")
print("sudo nmap --script ftp-* -p 21 " + IP)
print()
# Dirbuster
#
\ No newline at end of file
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# Init
def run_proxy():
print("# Run the proxy")
print("sudo openvpn /home/kali/lab_AGS.ovpn")
print()
def add_IP_TO_ETC(IP, HOSTNAME):
print("# Add hostname IP to /etc/hosts")
print("cat /etc/hosts")
print("sudo echo \"" + str(IP) + "\t" + str(HOSTNAME)+"\" >> /etc/hosts")
print()
http://cap.htb// (Status: 200) [Size: 19386]
http://cap.htb//data/.html (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//data/.txt (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//data/.php (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//?q=user/register/ (Status: 200) [Size: 19386]
http://cap.htb//?q=user/login/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=user/password/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=search/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=node/add/ (Status: 200) [Size: 19386]
http://cap.htb//?q=admin/ (Status: 200) [Size: 19386]
http://cap.htb//?q=user/register/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=comment/reply/ (Status: 200) [Size: 19386]
http://cap.htb//?q=user/login/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=search/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=user/password/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=node/add/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=admin/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=user/register/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=comment/reply/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=user/password/ (Status: 200) [Size: 19386]
http://cap.htb//?q=user/login/ (Status: 200) [Size: 19386]
http://cap.htb//?q=search/ (Status: 200) [Size: 19386]
http://cap.htb//?q=node/add/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=admin/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=user/register/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=comment/reply/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=user/password/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=user/login/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=search/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=node/add/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=admin/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=comment/reply/.php (Status: 200) [Size: 19386]
http://cap.htb//download/.txt (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//download/.php (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//download/.html (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb//?q=user/logout/ (Status: 200) [Size: 19386]
http://cap.htb//?q=filter/tips/ (Status: 200) [Size: 19386]
http://cap.htb//?q=user/logout/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=filter/tips/.txt (Status: 200) [Size: 19386]
http://cap.htb//?level=12.php (Status: 200) [Size: 19386]
http://cap.htb//? (Status: 200) [Size: 19386]
http://cap.htb//?q=user/logout/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=filter/tips/.php (Status: 200) [Size: 19386]
http://cap.htb//?level=12 (Status: 200) [Size: 19386]
http://cap.htb//?.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=user/logout/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=filter/tips/.html (Status: 200) [Size: 19386]
http://cap.htb//?.php (Status: 200) [Size: 19386]
http://cap.htb//?level=12.html (Status: 200) [Size: 19386]
http://cap.htb//?.html (Status: 200) [Size: 19386]
http://cap.htb//?level=12.txt (Status: 200) [Size: 19386]
http://cap.htb/?&what= (Status: 200) [Size: 19386]
http://cap.htb/?&what=.html (Status: 200) [Size: 19386]
http://cap.htb/?&what=.txt (Status: 200) [Size: 19386]
http://cap.htb/?&what=.php (Status: 200) [Size: 19386]
http://cap.htb//?q=logout/ (Status: 200) [Size: 19386]
http://cap.htb//?q=contact/ (Status: 200) [Size: 19386]
http://cap.htb//?q=*.php (Status: 200) [Size: 19386]
http://cap.htb//?q=logout/.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=contact/.html (Status: 200) [Size: 19386]
http://cap.htb//?msk.php (Status: 200) [Size: 19386]
http://cap.htb//?q=*.html (Status: 200) [Size: 19386]
http://cap.htb//?q=logout/.php (Status: 200) [Size: 19386]
http://cap.htb//?q=contact/.txt (Status: 200) [Size: 19386]
http://cap.htb//?favorites (Status: 200) [Size: 19386]
http://cap.htb//?msk (Status: 200) [Size: 19386]
http://cap.htb//?*.html (Status: 200) [Size: 19386]
http://cap.htb//?q=* (Status: 200) [Size: 19386]
http://cap.htb//?q=logout/.html (Status: 200) [Size: 19386]
http://cap.htb//?q=contact/.php (Status: 200) [Size: 19386]
http://cap.htb//?favorites.html (Status: 200) [Size: 19386]
http://cap.htb//?msk.html (Status: 200) [Size: 19386]
http://cap.htb//?*.txt (Status: 200) [Size: 19386]
http://cap.htb//?q=*.txt (Status: 200) [Size: 19386]
http://cap.htb//?favorites.txt (Status: 200) [Size: 19386]
http://cap.htb//?msk.txt (Status: 200) [Size: 19386]
http://cap.htb//?*.php (Status: 200) [Size: 19386]
http://cap.htb//?favorites.php (Status: 200) [Size: 19386]
http://cap.htb//?* (Status: 200) [Size: 19386]
http://cap.htb/capture (Status: 302) [Size: 220] [--> http://cap.htb/data/8]
http://cap.htb/data (Status: 302) [Size: 208] [--> http://cap.htb/]
http://cap.htb/ip (Status: 200) [Size: 17376]
http://cap.htb/netstat (Status: 200) [Size: 29724]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
#!/usr/bin/python3
#-*- coding:utf-8 -*-
import Auto_recon_setup
import Auto_recon_service_scan
import argparse
from pprint import pprint
parser = argparse.ArgumentParser(description='Nothing do script to for pentest')
parser.add_argument('hostname', help='hostname of the HTB box')
parser.add_argument('IP', help='IP of the HTB box')
parser.add_argument('-n', help='Step of processus', type=int, default=0)
args = parser.parse_args()
if __name__ == "__main__":
# Init
if args.n == 0:
Auto_recon_setup.run_proxy()
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
if args.n == 1:
Auto_recon_setup.add_IP_TO_ETC(args.hostname, args.IP)
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
if args.n == 2:
Auto_recon_service_scan.scan_nmap_top_15k(args.IP, "nmap/top15k")
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
if args.n == 3:
Auto_recon_service_scan.scan_searchsploit("nmap/top15k")
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
if args.n == 4:
Auto_recon_service_scan.scan_FTP_annonymous_login(args.IP)
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
if args.n == 5:
Auto_recon_service_scan.scan_nmap_ftp(args.IP)
print("Step: " + str(args.n))
input("enter to next step\n")
args.n += 1
\ No newline at end of file
#!/bin/bash
source utils.sh
# Setup
echo "[*] Param checking"
source colors.sh
!!§!# Setup
echo -e "[*] Param checking\n"
if [ "$(id -u)" != "0" ]; then
echo -e "\t[!] This script must be run as root" 1>&2
echo -e "sudo $0 IP DOMAIN_NAME"
exit 1
fi
if [ -n "$1" ]; then
IP=$1
......@@ -24,7 +24,7 @@ else
fi
# Ping Scan
echo "[*] Connectivity check"
echo -e "[*] Connectivity check\n"
if ping -c 4 > /dev/null $IP
then
echo -e "\t[*] Ping scan OK"
......@@ -34,7 +34,7 @@ else
fi
# Adding IP to /etc/hosts
echo "[*] Setup /etc/hosts"
echo -e "[*] Setup /etc/hosts\n"
## Check if /etc/hosts contains domain name
if cat /etc/hosts | grep $DOM_NAME > /dev/null
then
......@@ -57,7 +57,7 @@ else
fi
# Scan service
echo "[*] Scanning service"
echo -e "[*] Scanning service\n"
mkdir nmap_scans 2>/dev/null
file_nmap_scan_init="nmap_scans/nmap_top_15k_ports"
if test -f "$file_nmap_scan_init"; then
......@@ -71,8 +71,11 @@ file_open_services_banner="nmap_scans/open_services_banner"
cat $file_nmap_scan_init | grep -E "[0-9].\/tcp|udp" | tee $file_open_services_banner
## Search for vulnerability
echo "[*] search for vulns"
searchsploit --nmap $file_nmap_scan_init".xml"
echo -e "[*] search for vulns\n"
cmd="searchsploit --nmap $file_nmap_scan_init.xml"
savefile="searchsploit_init"
#run_prog_in_another_tab "$cmd" "$savefile"
searchsploit --nmap $file_nmap_scan_init.xml
## Si service FTP
......@@ -81,14 +84,64 @@ searchsploit --nmap $file_nmap_scan_init".xml"
## Si service HTTP
if cat $file_open_services_banner | grep 80/tcp > /dev/null
then
# Spider web
echo -e "[*] Spider web\n"
cmd="python3 /opt/MyOwnPentestToolsByAGS/SimpleSpider.py http://$DOM_NAME"
savefile="Web/spideredLinks.txt"
run_prog_in_another_tab "$cmd" "$savefile"
#gnome-terminal --tab --title="spider" -- /bin/bash -c "python3 /opt/MyOwnPentestToolsByAGS/SimpleSpider.py http://$DOM_NAME"
fi
# Dirbuster
#run_prog_in_another_tab "$cmd" "$savefile"
echo "#########"
echo "# spider #"
echo "#########"
if test -f "$savefile"; then
echo "$savefile exists."
else
python3 /opt/MyOwnPentestToolsByAGS/SimpleSpider.py http://$DOM_NAME | tee $savefile
fi
echo -e "[*] Run firefox & burp\n"
burpsuite&
firefox -proxy-server 127.0.0.1 -proxy-port 8080 http://$DOM_NAME/ &
echo -e "[*] Dirbuster\n"
echo -e "\t[*] big.txt (from seclist)"
echo "#########"
echo "# gobuster #"
echo "#########"
savefile="Web/gobuster_big.txt"
if test -f "$savefile"; then
echo "$savefile exists."
else
gobuster dir -u $DOM_NAME -w /opt/SecLists/Discovery/Web-Content/big.txt -e -s '200,301,302,401' -x 'html,txt,php' -t 15 -o $savefile
echo "saved results as $savefile"
fi
echo "#########"
echo "# gobuster #"
echo "#########"
echo -e "\t[*] RobotsDisallowed (from seclist)"
savefile="Web/RobotsDisallowed-Top1000.txt"
if test -f "$savefile"; then
echo "$savefile exists."
else
gobuster dir -u $DOM_NAME -w /opt/SecLists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -e -s '200,301,302,401' -x 'html,txt,php' -t 15 -o $savefile
echo "saved results as $savefile"
fi
# Vhost enum
echo -e "[*] Vhost enum (from seclist)\n"
savefile="Web/vhost_enum.txt"
if test -f "$savefile"; then
echo "$savefile exists."
else
gobuster vhost --url $DOM_NAME --wordlist /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -t 15 -o $savefile
fi
# robots.txt (gobuster sur local wordlist)
# robots.txt enum
echo -e "[*] Robot txt check\n"
cmd="curl http://$DOM_NAME/robots.txt"
savefile="Web/robot.txt"
#run_prog_in_another_tab "$cmd" "$savefile"
fiu_4u7
## Password
\ No newline at end of file
# Reset
Color_Off='\033[0m' # Text Reset
# Regular Colors
Black='\033[0;30m' # Black
Red='\033[0;31m' # Red
Green='\033[0;32m' # Green
Yellow='\033[0;33m' # Yellow
Blue='\033[0;34m' # Blue
Purple='\033[0;35m' # Purple
Cyan='\033[0;36m' # Cyan
White='\033[0;37m' # White
\ No newline at end of file
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption | linux/dos/5814.pl
vsftpd 2.0.5 - 'deny_file' Option Remote Denial of Service (1) | windows/dos/31818.sh
vsftpd 2.0.5 - 'deny_file' Option Remote Denial of Service (2) | windows/dos/31819.pl
vsftpd 2.3.2 - Denial of Service | linux/dos/16270.c
vsftpd 2.3.4 - Backdoor Command Execution | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit) | unix/remote/17491.rb
vsftpd 3.0.3 - Remote Denial of Service | multiple/remote/49719.py
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Debian OpenSSH - (Authenticated) Remote SELinux Privilege Escalation | linux/remote/6094.txt
Dropbear / OpenSSH Server - 'MAX_UNAUTH_CLIENTS' Denial of Service | multiple/dos/1572.pl
FreeBSD OpenSSH 3.5p1 - Remote Command Execution | freebsd/remote/17462.txt
glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read | linux/local/258.sh
Novell Netware 6.5 - OpenSSH Remote Stack Overflow | novell/dos/14866.txt
OpenSSH 1.2 - '.scp' File Create/Overwrite | linux/remote/20253.sh
OpenSSH 2.3 < 7.7 - Username Enumeration | linux/remote/45233.py
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) | linux/remote/45210.py
OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One | unix/remote/21314.txt
OpenSSH 2.x/3.x - Kerberos 4 TGT/AFS Token Buffer Overflow | linux/remote/21402.txt
OpenSSH 3.x - Challenge-Response Buffer Overflow (1) | unix/remote/21578.txt
OpenSSH 3.x - Challenge-Response Buffer Overflow (2) | unix/remote/21579.txt
OpenSSH 4.3 p1 - Duplicated Block Remote Denial of Service | multiple/dos/2444.sh
OpenSSH 6.8 < 6.9 - 'PTY' Local Privilege Escalation | linux/local/41173.c
OpenSSH 7.2 - Denial of Service | linux/dos/40888.py
OpenSSH 7.2p1 - (Authenticated) xauth Command Injection | multiple/remote/39569.py
OpenSSH 7.2p2 - Username Enumeration | linux/remote/40136.py
OpenSSH < 6.6 SFTP (x64) - Command Execution | linux_x86-64/remote/45000.c
OpenSSH < 6.6 SFTP - Command Execution | linux/remote/45001.py
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation | linux/local/40962.txt
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading | linux/remote/40963.txt
OpenSSH < 7.7 - User Enumeration (2) | linux/remote/45939.py
OpenSSH SCP Client - Write Arbitrary Files | multiple/remote/46516.py
OpenSSH/PAM 3.6.1p1 - 'gossh.sh' Remote Users Ident | linux/remote/26.sh
OpenSSH/PAM 3.6.1p1 - Remote Users Discovery Tool | linux/remote/25.c
OpenSSHd 7.2p2 - Username Enumeration | linux/remote/40113.txt
Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack | multiple/remote/3303.sh
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment