#!/usr/bin/env python

########################################################################################
## Python3 version of 3-mix-recon.py script from Mike Czumak (T_v3rn1x) -- @SecuritySift
## [Name]: 3-mix-recon.py -- a recon/enumeration script
## [Original Author]: Mike Czumak (T_v3rn1x) -- @SecuritySift
## [Author]: Re4son re4son [at] whitedome.com.au
##--------------------------------------------------------------
## [Details]: 
## This script is intended to be executed remotely against a 
## list of IPs to perform a detailed nmap scan.
##
## As opposed to Mike's script, this one only recommends further
## actions together with the correct command line syntax for
## cut and paste actions so you get immediate high level 
## information and can focus your next steps a little better. 
########################################################################################

import subprocess
import multiprocessing
from multiprocessing import Process, Queue
import os
import time 

DNSSRV=''

def multProc(targetin, scanip, port, outputdir):
    jobs = []
    p = multiprocessing.Process(target=targetin, args=(scanip, port, outputdir))
    jobs.append(p)
    p.start()
    return

def nmapScan(ip_address, outputdir):
    ip_address = ip_address.strip()
    outfile = "{}/{}_findings.txt".format(outputdir, ip_address)

    print("[+] Starting quick nmap scan for {}".format(ip_address))
    QUICKSCAN = "nmap -n -oN '{}/{}.quick.nmap' {}".format(outputdir, ip_address, ip_address)
    quickresults = subprocess.check_output(QUICKSCAN, shell=True)

    print("[+] Starting detailed TCP/UDP nmap scans for {}".format(ip_address))
    serv_dict = {}
    if DNSSRV:
        TCPSCAN = "nmap -vv -Pn -sS -A -sC -p- -T 3 -script-args=unsafe=1 --dns-servers {} -oN '{}/{}.nmap' -oX '{}/{}_nmap_scan_import.xml' {}".format(DNSSRV, outputdir, ip_address, outputdir, ip_address, ip_address)
        UDPSCAN = "nmap -vv -Pn -A -sC -sU -T 4 --top-ports 200 --dns-servers {} -oN '{}/{}U.nmap' -oX '{}/{}U_nmap_scan_import.xml' {}".format(DNSSRV, outputdir, ip_address, outputdir, ip_address, ip_address)
    else:
        TCPSCAN = "nmap -vv -Pn -sS -A -sC -p- -T 3 -script-args=unsafe=1 -n {} -oN '{}/{}.nmap' -oX '{}/{}_nmap_scan_import.xml' {}".format(DNSSRV, outputdir, ip_address, outputdir, ip_address, ip_address)
        UDPSCAN = "nmap -vv -Pn -A -sC -sU -T 4 --top-ports 200 -n {} -oN '{}/{}U.nmap' -oX '{}/{}U_nmap_scan_import.xml' {}".format(DNSSRV, outputdir, ip_address, outputdir, ip_address, ip_address)

    results = subprocess.check_output(TCPSCAN, shell=True)
    udpresults = subprocess.check_output(UDPSCAN, shell=True)

    lines = results.split("\n")
    for line in lines:
        ports = []
        line = line.strip()
        if ("tcp" in line) and ("open" in line) and not ("Discovered" in line):
            while "  " in line: 
                line = line.replace("  ", " ")
            service = line.split(" ")[2] # grab the service name
            port = line.split(" ")[0] # grab the port/proto
            if service in serv_dict:
                ports = serv_dict[service] # if the service is already in the dict, grab the port list
            
            ports.append(port) 
            serv_dict[service] = ports # add service to the dictionary along with the associated port(2)

    # go through the service dictionary to give some hints for further enumerations 
    with open(outfile, 'w') as f:
        for serv in serv_dict: 
            ports = serv_dict[serv]
            if ("ftp" in serv):
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found FTP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nmap scripts for further enumeration or hydra for password attack, e.g\n")
                    f.write("   [=] nmap -sV -Pn -vv -p{} --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221 -oN '{}/{}_ftp.nmap' -oX '{}/{}_ftp_nmap_scan_import.xml' {}\n".format(port, outputdir, scanip, outputdir, scanip, scanip))
                    f.write("   [=] hydra -L /usr/share/wordlists/webslayer/others/names.txt -P /usr/share/wordlists/webslayer/others/common_pass.txt -f -o {}/{}_ftphydra.txt -u {} -s {} ftp\n".format(outputdir, scanip, scanip, port))	
            elif (serv == "http"):
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found HTTP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nikto & dirb / dirbuster for service enumeration, e.g\n")
                    f.write("   [=] nikto -h {} -p {} > {}/{}_nikto.txt\n".format(scanip, port, outputdir, scanip))
                    f.write("   [=] dirb http://{}:{}/ -o {}/{}_dirb.txt -r -S -x ./dirb-extensions/php.ext\n".format(scanip, port, outputdir, scanip))
                    f.write("   [=] java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar -H -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -r {}/{}_dirbuster.txt -u http://{}:{}/\n".format(outputdir, scanip, scanip, port))
            elif (serv == "ssl/http") or ("https" in serv):
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found HTTP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nikto & dirb / dirbuster for service enumeration, e.g\n")
                    f.write("   [=] nikto -h {} -p {} > {}/{}_nikto.txt\n".format(scanip, port, outputdir, scanip))
                    f.write("   [=] dirb https://{}:{}/ -o {}/{}_dirb.txt -r -S -x ./dirb-extensions/php.ext\n".format(scanip, port, outputdir, scanip))
                    f.write("   [=] java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar -H -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -r {}/{}_dirbuster.txt -u http://{}:{}/\n".format(outputdir, scanip, scanip, port))
            elif "mysql" in serv:
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found mysql service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Check out the server for web applications with sqli vulnerabilities\n")
            elif "microsoft-ds" in serv:	
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found MS SMB service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nmap scripts or enum4linux for further enumeration, e.g\n")
                    f.write("   [=] nmap -sV -Pn -vv -p{} --script=\"smb-* -oN '{}/{}_smb.nmap' -oX '{}/{}_smb_nmap_scan_import.xml' {}\n".format(port, outputdir, ip_address, outputdir, ip_address, ip_address))
                    f.write("   [=] enum4linux {}\n".format(scanip))
            elif "ms-sql" in serv:
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found MS SQL service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nmap scripts for further enumeration, e.g\n")
                    f.write("   [=] nmap -vv -sV -Pn -p {} --script=ms-sql-info,ms-sql-config,ms-sql-dump-hashes --script-args=mssql.instance-port={},smsql.username-sa,mssql.password-sa -oX {}/{}_mssql_nmap_scan_import.xml {}".format(port, port, outputdir, ip_address, ip_address))
            elif ("msdrdp" in serv) or ("ms-wbt-server" in serv):
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found RDP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use ncrackpassword cracking, e.g\n")
                    f.write("   [=] ncrack -vv --user administrator -P /root/rockyou.txt rdp://{}\n".format(scanip))
            elif "smtp" in serv:
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found SMTP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use smtp-user-enum to find users, e.g\n")
                    f.write("   [=] smtp-user-enum -M VRFY -U /usr/share/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/names/namelist.txt -t {} -p {}\n".format(scanip, port))
            elif "snmp" in serv:
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found SNMP service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use nmap scripts, onesixtyone or snmwalk for further enumeration, e.g\n")
                    f.write("   [=] nmap -sV -Pn -vv -p{} --script=snmp-netstat,snmp-processes -oN '{}/{}_snmp.nmap' -oX '{}/{}_snmp_nmap_scan_import.xml' {}\n".format(port, outputdir, scanip, outputdir, scanip, scanip))
                    f.write("   [=] onesixtyone {}\n".format(scanip))
                    f.write("   [=] snmpwalk -c public -v1 {} > {}/{}_snmpwalk.txt\n".format(scanip, outputdir, scanip))
            elif "ssh" in serv:
                for port in ports:
                    port = port.split("/")[0]
                    f.write("[*] Found SSH service on {}:{}\n".format(scanip, port))
                    f.write("   [>] Use medusa or hydra (unreliable) for password cracking, e.g\n")
                    f.write("   [=] medusa -u root -P /root/rockyou.txt -e ns -h {} - {} -M ssh\n".format(scanip, port))
                    f.write("   [=] hydra -f -V -t 1 -l root -P /root/rockyou.txt -s {} {} ssh\n".format(port, scanip))
            
    print("[*] TCP/UDP Nmap scans completed for {}".format(ip_address))
    return

def main():
    print("\n")
    print("############################################################")
    print("####               NETWORK RECONNAISSANCE               ####")
    print("############################################################")
    print("\n")

    TARGETS='targets.txt'
    OUTDIR='Scan_Results'

    with open(TARGETS, 'r') as f:

        if OUTDIR == '':
            OUTDIR = "./mix-recon-OUTPUT"

        try:
            os.stat(OUTDIR)
        except:
            os.mkdir(OUTDIR)

        for scanip in f:
            scanip = scanip.strip()
            print("[+] Creating directory structure for {}".format(scanip))

            hostdir = OUTDIR + "/" + scanip
            try:
                os.stat(hostdir)
            except:
                os.mkdir(hostdir)

            nmapdir = hostdir + "/nmap"
            try:
                os.stat(nmapdir)
            except:
                os.mkdir(nmapdir)

            exploitdir = hostdir + "/exploit"
            try:
                os.stat(exploitdir)
            except:
                os.mkdir(exploitdir)

            lootdir = hostdir + "/loot"
            try:
                os.stat(lootdir)
            except:
                os.mkdir(lootdir)

            prooffile = hostdir + "/proof.txt"
            open(prooffile, 'a').close()

            namefile = hostdir + "/0-name"
            open(namefile, 'a').close()

            jobs = []
            p = multiprocessing.Process(target=nmapScan, args=(scanip, nmapdir))
            jobs.append(p)
            p.start()

if __name__ == "__main__":
    main()
