-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpwnbox.sh
397 lines (337 loc) · 14.5 KB
/
pwnbox.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
#!/bin/bash
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
NC='\033[0m'
CYAN='\033[0;36m'
unset GREP_OPTIONS
inf= # network interface
loc= # location of where all the files from this script will be put
box_ip= # the IP of the target box
ipurl= # web address if website
box_host= # the hostname of the target box with domain extension for DNS stuff
hosturl= # web address if website
web1=80 # default http port
i_progress=1
t_progress=6
script_date=$(date +"%D")
PWNBOX_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # the directory of where the script is being run, reference to copy notes from
usage() {
echo -e "
${NC}usage: $0 -d DEVICE -n NAME -i IP -n HOSTNAME
OPTIONS:
-h show this menu
-d DEVICE network interface of target network
-o NAME target box name (does not need to = HOSTNAME)
-i IP ip of the target box
-n HOSTNAME hostname of the target box
"
}
while getopts “:hd:t:o:i:n:w:” OPTION
do
case $OPTION in
h)
usage
exit 1
;;
d)
inf=$OPTARG
;;
o)
box_name=$OPTARG
;;
i)
box_ip=$OPTARG
ipurl="http://${box_ip}"
;;
n)
box_host=$OPTARG
hosturl="http://${box_host}"
;;
?)
usage
exit
;;
:)
echo "Option -$OPTARG requires an argument."
exit 1
;;
esac
done
##############################
# Troubleshooting #
##############################
troubleshooting () {
# If Required Args are empty
if [ -z ${inf} ]; then
printf "${RED}[x] (-d) No Network Interface Provided!!!\n"
exit 1
elif [ -z ${box_name} ]; then
printf "${RED}[x] (-o) No Box Name Provided!!! \n"
exit 1
elif [ -z ${box_ip} ]; then
printf "${RED}[x] (-i) No IP Provided... \n"
exit 1
elif [ -z ${box_host} ]; then
printf "${RED}[x] (-n) No Hostname provided!!! \nAt least give box name with a '.tld'. You can change all the scripts later with change_box_info.sh\n"
exit 1
fi
attack_ip=$(ip a s | grep $inf | grep inet | cut -f2 -d "t" | cut -f2 -d " " | cut -f1 -d "/")
net_subnet=$(ip a s | grep $inf | grep inet | cut -f2 -d "t" | cut -f2 -d " " | cut -f2 -d "/")
}
troubleshooting
export loc=$(pwd)/${box_name}
folder_names=("1-recon" "2-enum" "3-xp" "4-privesc" "5-misc-tools" "6-ad" "7-networking" "8-screenshots" "9-notesdb")
sub_recon=("nmap")
sub_enum=("web" "ftp" "ssh" "sql" "smtp" "snmp" "smb" "nfs" "dns" "pop3" "imap" "OSINT")
sub_misc_tools=("autorecon" "nuclei" "photon_ip" "photon_host" "cewl")
ad_actions=("Accounts" "Groups" "Services" "Account_Perms" "Group_Perms" "Pwn_Paths" "Machines" "Shares" "Kerberos" "Certs" "Pivot" "Privesc")
printf "${GREEN}[${i_progress}/${t_progress}]${NC} Setting up Basic FS..."
i_progress=$((i_progress+1))
setup_fs () {
mkdir -p ${loc}
for folder_name in "${folder_names[@]}"; do
mkdir -p ${loc}/${folder_name}
touch ${loc}/${folder_name}/${folder_name}_mini_report.md
done
# Create subfolders and files for tools and services
for recon_tool in "${sub_recon[@]}"; do
mkdir -p ${loc}/${folder_names[0]}/${recon_tool}
touch ${loc}/${folder_names[0]}/${recon_tool}/${recon_tool}_mini_report.md
done
for enum_service in "${sub_enum[@]}"; do
mkdir -p ${loc}/${folder_names[1]}/${enum_service}
touch ${loc}/${folder_names[1]}/${enum_service}/${enum_service}_mini_report.md
done
for misc_tool in "${sub_misc_tools[@]}"; do
mkdir -p ${loc}/${folder_names[4]}/${misc_tool}
touch ${loc}/${folder_names[4]}/${misc_tool}/${misc_tool}_mini_report.md
done
for ad_action in "${ad_actions[@]}"; do
touch ${loc}/${folder_names[5]}/AD_${ad_action}_mini_report.md
done
}
setup_fs
printf "\n${GREEN}[+]${NC} FS Setup Complete..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Discovering Tool Locations...\n"
i_progress=$((i_progress+1))
toolLocations() {
# Function to check and update shell configuration files with a variable
update_shell_config() {
local var_name="$1"
local dir_path="$2"
# Update .bashrc
if [ -f ${HOME}/.bashrc ]; then
if ! grep -q "^export $var_name=" ${HOME}/.bashrc; then
echo "export $var_name=\"$dir_path\"" >> ${HOME}/.bashrc
echo "Added $var_name to ${HOME}/.bashrc"
fi
fi
# Update .zshrc
if [ -f ${HOME}/.zshrc ]; then
if ! grep -q "^export $var_name=" ${HOME}/.zshrc; then
echo "export $var_name=\"$dir_path\"" >> ${HOME}/.zshrc
echo "Added $var_name to ${HOME}/.zshrc"
fi
fi
}
# make a directory to store repositories if not located on system
notesdb_dir="${HOME}/Downloads/PWNBOX_NOTESDB"
if [[ ! -d "$notesdb_dir" ]]; then
echo "Creating notes database directory: $notesdb_dir"
mkdir -p "$notesdb_dir"
fi
# Check or set seclists_dir
declare -g seclists_dir=${seclists_dir:-$(grep -oP '(?<=^export\sseclists_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$seclists_dir" ]]; then
echo "Searching for SecLists directory..."
seclists_dir=$(find / -type d -name "SecLists" 2>/dev/null | head -n 1)
if [[ -z "$seclists_dir" ]]; then
echo "SecLists directory not found. Cloning SecLists..."
git clone https://github.com/danielmiessler/SecLists.git ${notesdb_dir}/SecLists
seclists_dir=${notesdb_dir}/SecLists
fi
update_shell_config "seclists_dir" "$seclists_dir"
fi
# Check or set impacket_dir
declare -g impacket_dir=${impacket_dir:-$(grep -oP '(?<=^export\simpacket_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$impacket_dir" ]]; then
echo "Searching for Impacket directory..."
impacket_dir=$(find / -type d -name "impacket" 2>/dev/null | head -n 1)
if [[ -z "$impacket_dir" ]]; then
echo "Impacket directory not found. Cloning Impacket..."
git clone https://github.com/SecureAuthCorp/impacket.git ${notesdb_dir}/impacket
impacket_dir=${notesdb_dir}/impacket/examples
fi
update_shell_config "impacket_dir" "$impacket_dir"
fi
# Check or set swisskeyrepo payloads_dir
declare -g payloads_dir=${payloads_dir:-$(grep -oP '(?<=^export\spayloads_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$payloads_dir" ]]; then
echo "Searching for PayloadsAllTheThings directory..."
payloads_dir=$(find / -type d -name "PayloadsAllTheThings" 2>/dev/null | head -n 1)
if [[ -z "$payloads_dir" ]]; then
echo "PayloadsAllTheThings directory not found. Cloning PayloadsAllTheThings..."
git clone https://github.com/swisskyrepo/PayloadsAllTheThings.git ${notesdb_dir}/PayloadsAllTheThings
payloads_dir=${notesdb_dir}/PayloadsAllTheThings
fi
update_shell_config "payloads_dir" "$payloads_dir"
fi
declare -g gtfobins_dir=${gtfobins_dir:-$(grep -oP '(?<=^export\sgtfobins_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$gtfobins_dir" ]]; then
echo "Searching for GTFOBins directory..."
gtfobins_dir=$(find / -type d -name "GTFOBins.github.io" 2>/dev/null | head -n 1)
if [[ -z "$gtfobins_dir" ]]; then
echo "GTFOBins directory not found. Cloning GTFOBins repository..."
git clone https://github.com/GTFOBins/GTFOBins.github.io.git ${notesdb_dir}/GTFOBins.github.io
gtfobins_dir=${notesdb_dir}/GTFOBins.github.io
fi
update_shell_config "gtfobins_dir" "$gtfobins_dir"
fi
declare -g lolbas_dir=${lolbas_dir:-$(grep -oP '(?<=^export\slolbas_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$lolbas_dir" ]]; then
echo "Searching for LOLBAS directory..."
lolbas_dir=$(find / -type d -name "LOLBAS" 2>/dev/null | head -n 1)
if [[ -z "$lolbas_dir" ]]; then
echo "LOLBAS directory not found. Cloning LOLBAS repository..."
git clone https://github.com/LOLBAS-Project/LOLBAS.git ${notesdb_dir}/LOLBAS
lolbas_dir=${notesdb_dir}/LOLBAS
fi
update_shell_config "lolbas_dir" "$lolbas_dir"
fi
declare -g taoi_dir=${taoi_dir:-$(grep -oP '(?<=^export\staoi_dir=").*(?=")' ${HOME}/.bashrc ${HOME}/.zshrc | head -n 1)}
if [[ -z "$taoi_dir" ]]; then
echo "Searching for 740i directory..."
taoi_dir=$(find / -type d -name "740i" 2>/dev/null | head -n 1)
if [[ -z "$taoi_dir" ]]; then
echo "740i Notes directory not found. Cloning 740i Notes repository..."
git clone https://github.com/740i/pentest-notes.git ${notesdb_dir}/740i
taoi_dir=${notesdb_dir}/740i
fi
update_shell_config "taoi_dir" "$taoi_dir"
fi
# Verbose output for the directories
#echo "SecLists directory: $seclists_dir"
#echo "Impacket directory: $impacket_dir"
#echo "PayloadsAllThings directory: $payloads_dir"
# Set the wordlist paths based on the SecLists directory
export directory_list1="/usr/share/wordlists/dirb/big.txt"
export directory_list2="/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
export domain_list="${seclists_dir}/DNS/subdomains-top1000000.txt"
export user_list="${seclists_dir}/Usernames/xato-net-10-million-usernames.txt"
export pass_list="${seclists_dir}/Passwords/xato-net-10-million-passwords-1000000.txt"
export subdomain_list1="${seclists_dir}/Discovery/DNS/subdomains-top1million-5000.txt"
export subdomain_list2="${seclists_dir}/Discovery/DNS/subdomains-top1million-110000.txt"
}
toolLocations
printf "${GREEN}[+]${NC} Tool Locations Complete..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Copying Commands and Notes..."
i_progress=$((i_progress+1))
copyNotes() {
cp -r ${PWNBOX_SCRIPT_DIR}/Generated_Commands/ ${loc}/
cp -r ${payloads_dir} ${loc}/${folder_names[8]}
cp -r ${gtfobins_dir} ${loc}/${folder_names[8]}
cp -r ${lolbas_dir} ${loc}/${folder_names[8]}
cp -r ${taoi_dir} ${loc}/${folder_names[8]}
}
copyNotes
printf "\n${GREEN}[+]${NC} Notes Copied..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Setting Up Reporting..."
i_progress=$((i_progress+1))
reporting() {
# Replace variables in helpful scripts and markdown files with values of variables found in this script
for file in ${loc}/Generated_Commands/1\ -\ Reporting/*; do
if [[ -f "$file" ]]; then
#echo "Processing file: $file"
# Perform sed replacements
sed -i "s|BOXLOCATION|${loc}|g" "$file"
sed -i "s|BOXNAME|${box_name}|g" "$file"
sed -i "s|SCREENSHOTSDIR|${folder_names[7]}|g" "$file"
sed -i "s|REPORTAUTHOR|${USER}|g" "$file"
sed -i "s|REPORTDATE|${script_date}|g" "$file"
# Check if file is *.md
if [[ "$file" != *.md && "$file" != *.tex ]]; then
# if its a .sh file, just move it to the main dir
mv "$file" "$loc/"
fi
fi
done
mv ${loc}/Generated_Commands/1\ -\ Reporting/box_dump_report.md ${loc}/${box_name}_dump_report.md
echo -e "## Enumerated\n\n\`\`\`\n\`\`\`\n\n\n## USER\n\n\`\`\`\n\`\`\`\n\n\n## ROOT\n\n\`\`\`\n\`\`\`" >> ${loc}/${box_name}_proofs.md
mv ${loc}/Generated_Commands/1\ -\ Reporting/report_template.md ${loc}/${box_name}_report.md
}
reporting
printf "\n${GREEN}[+]${NC} Reporting Setup"
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Formatting Notes..."
i_progress=$((i_progress+1))
formatNotes() {
# Dictionary for search-and-replace strings
declare -A replacements=(
["\${inf}"]="${inf}"
["\${box_name}"]="${box_name}"
["\${box_ip}"]="${box_ip}"
["\${ipurl}"]="${ipurl}"
["\${box_host}"]="${box_host}"
["\${hosturl}"]="${hosturl}"
["\${web1}"]="${web1}"
["\${rtemp}"]="${rtemp}"
["\${imp_dir}"]="${imp_dir}"
["\${directory_list1}"]="${directory_list1}"
["\${directory_list2}"]="${directory_list2}"
["\${user_list}"]="${user_list}"
["\${pass_list}"]="${pass_list}"
["\${loc}"]="${loc}"
["SUBDOMAIN_LIST1"]="${subdomain_list1}"
["SUBDOMAIN_LIST2"]="${subdomain_list2}"
# Add more pairs as needed
)
# Function to replace strings in a file
replace_in_file() {
local file=$1
for search in "${!replacements[@]}"; do
# Escape replacement value to safely handle special characters
replacement=$(printf '%s' "${replacements[$search]}" | sed 's+[&+\]+\\&+g')
# Use | as a delimiter to avoid conflicts with /
sed -i "s|$search|$replacement|g" "$file"
done
}
# Find and process all markdown files
find ${loc} -type f -name "*.md" | while read -r file; do
replace_in_file "$file"
done
# Find and process all bash files (this is why external scripts are downloaded later)
find ${loc} -type f -name "*.sh" | while read -r file; do
replace_in_file "$file"
done
}
formatNotes
printf "\n${GREEN}[+]${NC} Notes Formatted..."
printf "\n${GREEN}[${i_progress}/${t_progress}]${NC} Generating Useful Files...\n"
usefulFiles(){
# Generate an SSH key for ssh persistence
ssh-keygen -t rsa -b 4096 -C "your_email@example.com" -f ${loc}/${folder_names[3]}/persis_rsa -N "" > /dev/null 2>&1
chmod 600 ${loc}/${folder_names[3]}/persis_rsa
# Add public SSH key to the mini report
{
persis_rsa=$(cat ${loc}/${folder_names[3]}/persis_rsa.pub)
echo -e "### New Usable SSH Pub Key\n\n> add to ${HOME}/.ssh/authorized_keys\n\n"
echo -e "User\n\`\`\`\necho -e \"${persis_rsa}\" >> /home/user/.ssh/authorized_keys"
echo -e "\n\`\`\`\n\nRoot\n\`\`\`\necho -e \"${persis_rsa}\" >> /root/.ssh/authorized_keys\n\`\`\`"
} >> ${loc}/${folder_names[3]}/${folder_names[3]}_mini_report.md
}
usefulFiles
printf "${GREEN}[+]${NC} Generated Useful Files...\n"
# update file permissions
find "$loc" -type f -exec chmod 664 {} \;
find "$loc" -type d -exec chmod 775 {} \;
find "$loc" -type f -name "*.sh" -exec chmod 777 {} \;
# add box to /etc/hosts
printf "\n${YELLOW}[-]${NC} Make sure to run the following:\n${CYAN}sudo sed -i \"1s/^/${box_ip} ${box_host}\\\\n/\" /etc/hosts${NC}"
# check if pandoc template for report exists on system where it should be
if [ ! -e /usr/share/pandoc/data/templates/eisvogel.tex ]; then
printf "\n${YELLOW}[-]${NC} Copy Latex Report Template:\n${CYAN}sudo cp ${loc}/Generated_Commands/1\ -\ Reporting/eisvogel_2.5.0.tex /usr/share/pandoc/data/templates/eisvogel.tex; sudo chmod 777 /usr/share/pandoc/data/templates/${NC}\n"
fi
# make sure you can quickly access lots of useful scripts for uploading/running on a target machine
#printf "\n\n${YELLOW}[-]${NC} Make sure your malicious files are ready to serve:\n${CYAN}${loc}/get_scripts.sh${NC}\n"
printf "\n\n${GREEN}DONE!!!\n"