nJcx's Blog

十年生死两茫茫,写程序,到天亮。相顾无言,惟有泪千行

使用Masscan、Nmap、ELK做内网资产收集


安装

安装masscan

# yum install git gcc make libpcap-devel

#git clone https://github.com/robertdavidgraham/masscan
# cd masscan
# make

# cp bin/masscan  /bin

安装最新nmap 7.8

wget https://nmap.org/dist/nmap-7.80-1.x86_64.rpm

rpm -ivh nmap-7.80-1.x86_64.rpm

安装es 和 kibana

docker run -d --name es -p 127.0.0.1:9201:9200 -p 9300:9300 -e ES_JAVA_OPTS="-Xms2G -Xmx2G" -e "discovery.type=single-node"  docker.elastic.co/elasticsearch/elasticsearch-oss:7.1.1   

docker run --name kibana -d -p 5601:5601 -e ELASTICSEARCH_HOSTS=http://127.0.0.1:9201   docker.elastic.co/kibana/kibana-oss:7.1.1   

大致逻辑就是, 1,使用 Masscan 做主机存活扫描 2,然后使用Nmap扫描上面存活的主机,导出xml 3,格式化xml,写入es,然后kibana做可视化

上代码

from elasticsearch import Elasticsearch
from settings import es_ip, es_port, ip_list
from utils import Logger
import xmltodict
import os
import threading
import time
import json

logger = Logger.get_logger(__name__, path=os.getcwd())
es = Elasticsearch([{'host': es_ip, 'port': es_port}])


def xml_to_json(path):
    try:
        with open(path, 'r') as load_f:
            temp_ = xmltodict.parse(load_f).get("nmaprun")
            return {key: temp_[key]
                    for key in temp_
                    if key not in ["verbose", 'scaninfo', 'taskbegin', 'taskend', "debugging"]}

    except Exception as e:
        logger.error(str(e)+path)
        return {}


def json_to_es(index, json_):
    try:
        es.index(index=index, doc_type="vuln", body=json_)
    except Exception as e:
        try:
            es.index(index=index + '_', doc_type="vuln", body=json.dumps(json_))
        except Exception as e:
            try:
                es.index(index=index + '__', doc_type="vuln", body=json.dumps(json_))
            except Exception as e:
                logger.error(str(e))
                pass


def masscan_scan(ip):
    try:
        if ip:
            if not os.path.exists('tmp'):
                os.makedirs('tmp')
            os.system('masscan --ping {0} --rate 1000 -oL tmp/{1}.txt'.format(ip, ip.split('/')[0]))
    except Exception as e:
        logger.error(str(e))


def nmap_scan(ip):
    try:
        if ip:
            if not os.path.exists('report'):
                os.makedirs('report')
            os.system('nmap -sV -Pn -A -T5 --script=nmap-vulners/vulners.nse -oX report/{0}.xml {1}'.format(ip, ip))
    except Exception as e:
        logger.error(str(e))


def masscan_scan_worker():

    t_obj = []
    for i in range(len(ip_list)):
        t = threading.Thread(target=masscan_scan, args=(ip_list[i],))
        t_obj.append(t)
        t.start()
    for t in t_obj:
        t.join()
    if not os.path.exists('alive_host'):
        os.makedirs('alive_host')
    cmd = """ awk '{print $4}' tmp/*.txt | tr -s '\n' > alive_host/host.txt """
    os.system(cmd)
    os.system("""rm -f tmp/*.txt""")


def read_txt(path):
    lines = []
    try:
        with open(path, 'r') as file_to_read:
            while True:
                line = file_to_read.readline()
                if not line:
                    break
                line = line.strip('\n')
                lines.append(line)
    except Exception as e:
        logger.error(str(e))
    return lines


def nmap_scan_worker():
    lst = read_txt('alive_host/host.txt')
    tmp_ = [lst[i:i+5] for i in range(0, len(lst), 5)]
    print tmp_
    if tmp_:
        for list_ in tmp_:
            t_obj = []
            for i in range(len(list_)):
                t = threading.Thread(target=nmap_scan, args=(list_[i],))
                t_obj.append(t)
                t.start()
            for t in t_obj:
                t.join()


def nmap_to_es(index):
        if os.path.exists('report'):
            files = os.listdir('report')
        for file in files:
                json_to_es(index, xml_to_json('report'+'/'+file))
        os.system("""rm -f report/*.xml""")


if __name__ == '__main__':

    while True:
        now = time.strftime('%Y-%m-%d')
        masscan_scan_worker()
        nmap_scan_worker()
        es.indices.delete('nmap-*')
        nmap_to_es('nmap-' + now)

完整代码

https://github.com/njcx/nmap_to_es.git

icmp