-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpwnbox.sh
343 lines (284 loc) · 11.7 KB
/
pwnbox.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
#!/bin/bash
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
NC='\033[0m'
CYAN='\033[0;36m'
unset GREP_OPTIONS
inf= # network interface
loc= # location of where all the files from this script will be put
box_ip= # the IP of the target box
ipurl= # web address if website
box_host= # the hostname of the target box with domain extension for DNS stuff
hosturl= # web address if website
web1=80 # default http port
i_progress=1
t_progress=6
script_date=$(date +"%D")
PWNBOX_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # the directory of where the script is being run, reference to copy notes from
usage() {
echo -e "
${NC}usage: $0 -d DEVICE -n NAME -i IP -n HOSTNAME
OPTIONS:
-h show this menu
-d DEVICE network interface of target network
-n NAME target box name (does not need to = HOSTNAME)
-i IP ip of the target box
-n HOSTNAME hostname of the target box
"
}
while getopts “:hd:t:o:i:n:w:” OPTION
do
case $OPTION in
h)
usage
exit 1
;;
d)
inf=$OPTARG
;;
o)
box_name=$OPTARG
;;
i)
box_ip=$OPTARG
ipurl="http://${box_ip}"
;;
n)
box_host=$OPTARG
hosturl="http://${box_host}"
;;
?)
usage
exit
;;
:)
echo "Option -$OPTARG requires an argument."
exit 1
;;
esac
done
##############################
# Troubleshooting #
##############################
troubleshooting () {
# If Required Args are empty
if [ -z ${inf} ]; then
printf "${RED}[x] (-d) No Network Interface Provided!!!\n"
exit 1
elif [ -z ${box_name} ]; then
printf "${RED}[x] (-o) No Box Name Provided!!! \n"
exit 1
elif [ -z ${box_ip} ]; then
printf "${RED}[x] (-i) No IP Provided... \n"
exit 1
elif [ -z ${box_host} ]; then
printf "${RED}[x] (-n) No Hostname provided!!! \nAt least give box name with a '.tld'. You can change all the scripts later with change_box_info.sh\n"
exit 1
fi
attack_ip=$(ip a s | grep $inf | grep inet | cut -f2 -d "t" | cut -f2 -d " " | cut -f1 -d "/")
net_subnet=$(ip a s | grep $inf | grep inet | cut -f2 -d "t" | cut -f2 -d " " | cut -f2 -d "/")
}
troubleshooting
export loc=$(pwd)/${box_name}
folder_names=("1-recon" "2-enum" "3-xp" "4-privesc" "5-misc-tools" "6-ad" "7-networking" "8-screenshots")
sub_recon=("nmap")
sub_enum=("web" "ftp" "ssh" "sql" "smtp" "snmp" "smb" "nfs" "dns" "pop3" "imap" "OSINT")
sub_misc_tools=("autorecon" "nuclei" "photon_ip" "photon_host" "cewl")
ad_actions=("Accounts" "Groups" "Services" "Account_Perms" "Group_Perms" "Pwn_Paths" "Machines" "Shares" "Kerberos" "Certs" "Pivot" "Privesc")
printf "${GREEN}[${i_progress}/${t_progress}]${NC} Setting up Basic FS..."
i_progress=$((i_progress+1))
setup_fs () {
mkdir -p ${loc}
for folder_name in "${folder_names[@]}"; do
mkdir -p ${loc}/${folder_name}
touch ${loc}/${folder_name}/${folder_name}_mini_report.md
done
# Create subfolders and files for tools and services
for recon_tool in "${sub_recon[@]}"; do
mkdir -p ${loc}/${folder_names[0]}/${recon_tool}
touch ${loc}/${folder_names[0]}/${recon_tool}/${recon_tool}_mini_report.md
done
for enum_service in "${sub_enum[@]}"; do
mkdir -p ${loc}/${folder_names[1]}/${enum_service}
touch ${loc}/${folder_names[1]}/${enum_service}/${enum_service}_mini_report.md
done
for misc_tool in "${sub_misc_tools[@]}"; do
mkdir -p ${loc}/${folder_names[4]}/${misc_tool}
touch ${loc}/${folder_names[4]}/${misc_tool}/${misc_tool}_mini_report.md
done
for ad_action in "${ad_actions[@]}"; do
touch ${loc}/${folder_names[5]}/AD_${ad_action}_mini_report.md
done
}
setup_fs
printf "\n${GREEN}[+]${NC} FS Setup Complete..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Copying Notes..."
i_progress=$((i_progress+1))
copyNotes() {
cp -r ${PWNBOX_SCRIPT_DIR}/Generated_Commands/ ${loc}/
}
copyNotes
printf "\n${GREEN}[+]${NC} Notes Copied..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Discovering Tool Locations...\n"
i_progress=$((i_progress+1))
toolLocations() {
# Function to check and update shell configuration files with a variable
update_shell_config() {
local var_name="$1"
local dir_path="$2"
# Update .bashrc
if [ -f ${HOME}/.bashrc ]; then
if ! grep -q "^export $var_name=" ${HOME}/.bashrc; then
echo "export $var_name=\"$dir_path\"" >> ${HOME}/.bashrc
echo "Added $var_name to ${HOME}/.bashrc"
fi
fi
# Update .zshrc
if [ -f ${HOME}/.zshrc ]; then
if ! grep -q "^export $var_name=" ${HOME}/.zshrc; then
echo "export $var_name=\"$dir_path\"" >> ${HOME}/.zshrc
echo "Added $var_name to ${HOME}/.zshrc"
fi
fi
}
# Check or set seclists_dir
seclists_dir=${seclists_dir:-$(grep -oP '(?<=^export\sseclists_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$seclists_dir" ]]; then
echo "Searching for SecLists directory..."
seclists_dir=$(find / -type d -name "SecLists" 2>/dev/null | head -n 1)
if [[ -z "$seclists_dir" ]]; then
echo "SecLists directory not found. Cloning SecLists..."
git clone https://github.com/danielmiessler/SecLists.git ${HOME}/Downloads/SecLists
seclists_dir=${HOME}/Downloads/SecLists
fi
update_shell_config "seclists_dir" "$seclists_dir"
fi
# Check or set impacket_dir
impacket_dir=${impacket_dir:-$(grep -oP '(?<=^export\simpacket_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$impacket_dir" ]]; then
echo "Searching for Impacket directory..."
impacket_dir=$(find / -type d -name "impacket" 2>/dev/null | head -n 1)
if [[ -z "$impacket_dir" ]]; then
echo "Impacket directory not found. Cloning Impacket..."
git clone https://github.com/SecureAuthCorp/impacket.git ${HOME}/Downloads/impacket
impacket_dir=${HOME}/Downloads/impacket/examples
fi
update_shell_config "impacket_dir" "$impacket_dir"
fi
# Verbose output for the directories
#echo "SecLists directory: $seclists_dir"
#echo "Impacket directory: $impacket_dir"
# Set the wordlist paths based on the SecLists directory
export directory_list1="/usr/share/wordlists/dirb/big.txt"
export directory_list2="/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
export domain_list="${seclists_dir}/DNS/subdomains-top1000000.txt"
export user_list="${seclists_dir}/Usernames/xato-net-10-million-usernames.txt"
export pass_list="${seclists_dir}/Passwords/xato-net-10-million-passwords-1000000.txt"
export subdomain_list1="${seclists_dir}/Discovery/DNS/subdomains-top1million-5000.txt"
export subdomain_list2="${seclists_dir}/Discovery/DNS/subdomains-top1million-110000.txt"
}
toolLocations
printf "${GREEN}[+]${NC} Tool Locations Complete..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Setting Up Reporting..."
i_progress=$((i_progress+1))
reporting() {
# Replace variables in helpful scripts and markdown files with values of variables found in this script
for file in ${loc}/Generated_Commands/1\ -\ Reporting/*; do
if [[ -f "$file" ]]; then
#echo "Processing file: $file"
# Perform sed replacements
sed -i "s|BOXLOCATION|${loc}|g" "$file"
sed -i "s|BOXNAME|${box_name}|g" "$file"
sed -i "s|SCREENSHOTSDIR|${folder_names[7]}|g" "$file"
sed -i "s|REPORTAUTHOR|${USER}|g" "$file"
sed -i "s|REPORTDATE|${script_date}|g" "$file"
# Check if file is *.md
if [[ "$file" != *.md && "$file" != *.tex ]]; then
# if its a .sh file, just move it to the main dir
mv "$file" "$loc/"
fi
fi
done
mv ${loc}/Generated_Commands/1\ -\ Reporting/box_dump_report.md ${loc}/${box_name}_dump_report.md
echo -e "## Enumerated\n\n\`\`\`\n\`\`\`\n\n\n## USER\n\n\`\`\`\n\`\`\`\n\n\n## ROOT\n\n\`\`\`\n\`\`\`" >> ${loc}/${box_name}_proofs.md
mv ${loc}/Generated_Commands/1\ -\ Reporting/report_template.md ${loc}/${box_name}_report.md
}
reporting
printf "\n${GREEN}[+]${NC} Reporting Setup"
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Formatting Notes..."
i_progress=$((i_progress+1))
formatNotes() {
# Dictionary for search-and-replace strings
declare -A replacements=(
["\${inf}"]="${inf}"
["\${box_name}"]="${box_name}"
["\${box_ip}"]="${box_ip}"
["\${ipurl}"]="${ipurl}"
["\${box_host}"]="${box_host}"
["\${hosturl}"]="${hosturl}"
["\${web1}"]="${web1}"
["\${rtemp}"]="${rtemp}"
["\${imp_dir}"]="${imp_dir}"
["\${directory_list1}"]="${directory_list1}"
["\${directory_list2}"]="${directory_list2}"
["\${user_list}"]="${user_list}"
["\${pass_list}"]="${pass_list}"
["\${loc}"]="${loc}"
["SUBDOMAIN_LIST1"]="${subdomain_list1}"
["SUBDOMAIN_LIST2"]="${subdomain_list2}"
# Add more pairs as needed
)
# Function to replace strings in a file
replace_in_file() {
local file=$1
for search in "${!replacements[@]}"; do
# Escape replacement value to safely handle special characters
replacement=$(printf '%s' "${replacements[$search]}" | sed 's+[&+\]+\\&+g')
# Use | as a delimiter to avoid conflicts with /
sed -i "s|$search|$replacement|g" "$file"
done
}
# Find and process all markdown files
find ${loc} -type f -name "*.md" | while read -r file; do
replace_in_file "$file"
done
# Find and process all bash files (this is why external scripts are downloaded later)
find ${loc} -type f -name "*.sh" | while read -r file; do
replace_in_file "$file"
done
}
formatNotes
printf "\n${GREEN}[+]${NC} Notes Formatted..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Generating Useful Files...\n"
usefulFiles(){
# Generate SSH keys
ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ${loc}/${folder_names[3]}/user_persis.rsa -N "" > /dev/null 2>&1
chmod 600 ${loc}/${folder_names[3]}/user_persis.rsa
ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ${loc}/${folder_names[3]}/root_persis.rsa -N "" > /dev/null 2>&1
chmod 600 ${loc}/${folder_names[3]}/root_persis.rsa
# Add public SSH keys to the mini report
{
user_rsa=$(cat ${loc}/${folder_names[3]}/user_persis.rsa.pub)
root_rsa=$(cat ${loc}/${folder_names[3]}/root_persis.rsa.pub)
echo -e "### New Usable SSH Pub Keys\n\n> add to ${HOME}/.ssh/authorized_keys\n\n"
echo -e "User\n\`\`\`\necho -e \"${user_rsa}\" >> /home/user/.ssh/authorized_keys"
echo -e "\n\`\`\`\n\nRoot\n\`\`\`\necho \"${root_rsa}\" >> /root/.ssh/authorized_keys\n\`\`\`"
} >> ${loc}/${folder_names[3]}/${folder_names[3]}_mini_report.md
}
usefulFiles
printf "${GREEN}[+]${NC} Generated Useful Files...\n"
# update file permissions
find "$loc" -type f -exec chmod 664 {} \;
find "$loc" -type d -exec chmod 775 {} \;
find "$loc" -type f -name "*.sh" -exec chmod 777 {} \;
# add box to /etc/hosts
printf "\n${YELLOW}[-]${NC} Make sure to run the following:\n${CYAN}sudo sed -i \"1s/^/${box_ip} ${box_host}\\\\n/\" /etc/hosts${NC}"
# check if pandoc template for report exists on system where it should be
if [ ! -e /usr/share/pandoc/data/templates/eisvogel.tex ]; then
printf "\n${YELLOW}[-]${NC} Copy Latex Report Template:\n${CYAN}sudo cp ${loc}/Generated_Commands/1\ -\ Reporting/eisvogel_2.5.0.tex /usr/share/pandoc/data/templates/eisvogel.tex; sudo chmod 777 /usr/share/pandoc/data/templates/${NC}\n"
fi
# make sure you can quickly access lots of useful scripts for uploading/running on a target machine
#printf "\n\n${YELLOW}[-]${NC} Make sure your malicious files are ready to serve:\n${CYAN}${loc}/get_scripts.sh${NC}\n"
printf "\n\n${GREEN}DONE!!!\n"