exploitationtoolkitmenu.sh

#!/usr/bin/env bash
# -*- coding: utf-8 -*-

######################################################################
# exploitationtoolkitmenu -- A toolkit that offer several exploitation
# tools in a fancy and simple menu
#
# Copyright (c) 2021, Scan0r
#
# This program is free software: you can redistribute it and/or modifyç
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>.
#
# @Author       Scan0r
# @Date         25/10/2021
# @Version      0.1
######################################################################

######################################################################
#
# Global definitions
#
######################################################################

# Global script variables
SCRIPT_NAME="${0%.sh}"
SCRIPT_VERSION="0.1"
AUTHOR_NAME="DR"

# Exit and termination state variables
EXIT_SUCCESS=0
EXIT_FAILURE=-1

# Font color variables
NC='\033[0m' # No Color
RED='\033[0;31m'
GREEN='\033[0;32m'

######################################################################
#
# Auxiliary functions
#
######################################################################

# Prints a formatted message of type notification
#
# @param  The message to print
# @return None
info() {
  echo -e "${GREEN}$SCRIPT_NAME: info: $1${NC}"
}

# Prints a formatted message of type error
#
# @param  The message to print
# @param  An optional exit status
# @return None
error() {
  echo -e "${RED}$SCRIPT_NAME: error: $1${NC}"

  if [[ -n "$2" ]]; then
    exit "$2"
  fi
}

# Checks that a passed command as an argument is installed in the system
#
# @param  The command to check
# @return True | False
cmd_is_installed() {
  if [[ -z "$1" ]]; then
    return "$EXIT_FAILURE"
  fi

  local cmd="$1"

  [[ -n $(which "$cmd") ]]

  return "$?"
}

# Asks the user to provide an input with a message passed
# as an argument
#
# @param  The message to provide to the user
# @return The user input
get_input() {
  # Checks the number and validity of the arguments
  if [[ -z "$1" ]]; then
    return "$EXIT_FAILURE"
  fi

  local phrase="$1"
  local valid_input=1

  # Asks the user to provide an input while isnt valid
  # else provides an error
  while [[ "$valid_input" -ne 0 ]]; do
    echo -en "$phrase"
    read -r user_input
    if [[ -n "$user_input" ]]; then
      valid_input=0
    else
      error "Invalid input '$user_input'"
    fi
  done

  # Return the string input as a global variable
  RETURN="$user_input"
}

# Asks to the user to provide the IP required for nmap
#
# @param  The message to provide to the user
# @return The IP provided by the user
get_nmap_ip() {
  get_input "Provide an IP or a range of IPs (ej. 127.0.0.1; ej. 192.168.1.0-250)\n> "
  IP="$RETURN"
}

# Asks to the user to provide the port required for nmap
#
# @param  The message to provide to the user
# @return The port provided by the user
get_nmap_port() {
  get_input "Provide a port, range or list of ports (ej. 80; ej. 0-100; ej. 22,23,24,25)\n> "
  PORT="$RETURN"
}

# Asks the user to provide the port and IP required for nmap
#
# @param  None
# @return The IP and port provided by the user
get_nmap_ip_port() {
  get_nmap_ip
  get_nmap_port
}

######################################################################
#
# Main functions
#
######################################################################

# Calls the metasploit tool
#
# @param  None
# @return None
call_metasploit() {
  msfconsole
}

# Calls the dirbuster tool
#
# @param  None
# @return None
call_dirbuster() {
  dirbuster
}

# Displays the Nmap menu managing the calls to the tool with the diferent
# types of options
#
# @param  None
# @return None
call_nmap() {
  # Displays the Nmap menu
  while true; do
    echo "1) Basic scan"
    echo "2) Advanced Scan"
    echo "3) Host Discovery"
    echo "4) Portscan Techniques"
    echo "5) Exit"
    echo
    read -r -p "Select NMAP operation: " operation

    case "$operation" in
    1)
      # Basic scan
      get_nmap_ip
      nmap "$IP"
      ;;
    2)
      # Advanced scan
      get_nmap_ip
      nmap -A "$IP"
      ;;
    3)
      # Displays the Host discovery menu
      while true; do
        echo "1) Ping discovery (ARP)"
        echo "2) Ping sweep (no ARP)"
        echo "3) Exit"
        echo
        read -r -p "Select Discovery option: " option1

        case "$option1" in
        1)
          # Ping discovery
          get_nmap_ip
          # disable port scan, enable arp
          nmap -sn -PR "$IP"
          ;;
        2)
          # Ping sweep
          get_nmap_ip
          # disable port scan, disable arp
          nmap -sn --disable-arp-ping "$IP"
          ;;
        3)
          # Exits Discovery menu
          break
          ;;
        *)
          # Bad choice managing
          error "Invalid Discovery option '$option1'"
          ;;
        esac

        # Intentional delay and empty line
        sleep 0.5
        echo ""
      done
      ;;
    4)
      # Displays the Portscan menu
      while true; do
        echo "1) TCP SYN"
        echo "2) Connect" Exits Portscan menu
        echo "4) Window"
        echo "5) Maimon"
        echo "6) UDP"
        echo "7) TCP NULL"
        echo "8) FIN"
        echo "9) Xmas"
        echo "10) Exit"
        echo
        read -r -p "Select Portscan option: " option2

        case "$option2" in
        1)
          # TCP SYN
          get_nmap_ip_port
          nmap -sS -p "$PORT" "$IP"
          ;;
        2)
          # Connect
          get_nmap_ip_port
          nmap -sT -p "$PORT" "$IP"
          ;;
        3)
          # ACK
          get_nmap_ip_port Exits Portscan menu
          nmap -sA -p "$PORT" "$IP"
          ;;
        4)
          # Window
          get_nmap_ip_port
          nmap -sW -p "$PORT" "$IP"
          ;;
        5)
          # Maimon
          get_nmap_ip_port
          nmap -sM -p "$PORT" "$IP"
          ;;
        6)
          # UDP
          get_nmap_ip_port
          nmap -sU -p "$PORT" "$IP"
          ;;
        7)
          # TCP NULL
          get_nmap_ip_port
          nmap -sN -p "$PORT" "$IP"
          ;;
        8)
          # FIN
          get_nmap_ip_port
          nmap -sF -p "$PORT" "$IP"
          ;;
        9)
          # Xmas
          get_nmap_ip_port
          nmap -sX -p "$PORT" "$IP"
          ;;
        10)
          # Exits Portscan menu
          break
          ;;
        *)
          # Bad choice managing for Portscan menu
          error "Invalid PortScan option '$option2'"
          ;;
        esac
        
        # Intentional delay and empty line
        sleep 0.5
        echo ""
      done
      ;;
    5)
      # Exits Nmap menu
      break
      ;;
    *)
      # Bad choice managing for Nmap menu
      error "Invalid NMAP operation '$operation'"
      ;;
    esac

    # Intentional delay and empty line
    sleep 0.5
    echo ""
  done
}

# Inits a shell listening in a local port waiting incoming
# connections
#
# @param  None
# @return None
call_local_shell() {
  # Asks the user to provide the local port where will
  # be the shell listening
  get_input "Provide local port (ej. 4444): "

  local port="$RETURN"

  # Init a local shell listening in the given port
  nc -nvlp "$port" -e "$(which bash)"
}

# Performs a connection with a shell listening in a remote
# IP and port
#
# @param  None
# @return None
call_remote_shell() {
  # Asks the user to provide the remote IP of the machine
  # with the shell
  get_input "Provide remote IP (ej. 190.60.1.4): "

  local target_ip="$RETURN"

  # Asks the user to provide the remote port where the shell
  # is lestening
  get_input "Provide remote port (ej. 4444): "

  local target_port="$RETURN"

  # Performs the connection with the remote shell
  nc -nv "$target_ip" "$target_port"
}

# Exits the program
#
# @param  None
# @return None
call_exit() {
  echo
  echo "Exiting...."
  echo

  exit "$EXIT_SUCCESS"
}

######################################################################
#
# Init function
#
######################################################################

# Exits
#
# @param  None
# @return None
main() {
  # Checks that the user executing the script is root
  if [[ "$EUID" -ne 0 ]]; then
    error "You should be root to execute properly this tool.\n"
    exit "$EXIT_FAILURE"
  fi

  # Checks the number of arguments required by the program
  if [[ "$#" -ne 0 ]]; then
    echo -e "Usage: $0\n"
    exit "$EXIT_FAILURE"
  fi

  # Relational array with the desired commands to execute
  declare -A cmds=([Metasploit]="msfconsole" [Dirbuster]="dirbuster" [Nmap]="nmap" [Netcat]="nc")

  # Checks that the tools are already installed in the local machine
  for cmd in "${!cmds[@]}"; do
    if ! cmd_is_installed "${cmds[$cmd]}"; then
      error "command '$cmd' is not installed! please, install it before" "$EXIT_FAILURE"
    fi
  done

  # Displays the main menu of the possible operations
  while true; do
    echo "=================================================="
    echo -e "$SCRIPT_NAME ($SCRIPT_VERSION) with ♥️ by $AUTHOR_NAME."
    echo -e "Simple automated exploitation toolkit menu."
    echo "=================================================="
    echo
    echo "1) Metasploit"
    echo "2) Dirbuster"
    echo "3) Nmap"
    echo "4) Offer a shell via Netcat on a local port"
    echo "5) Connect to a remote shell through Netcat"
    echo "6) Exit"
    echo
    read -r -p "Select Menu operation: " operation

    case "$operation" in
    1)
      call_metasploit
      clear
      ;;
    2)
      call_dirbuster
      clear
      ;;
    3)
      call_nmap
      clear
      ;;
    4)
      call_local_shell
      clear
      ;;
    5)
      call_remote_shell
      clear
      ;;
    6)
      call_exit
      ;;
    *)
      error "Invalid Menu operation '$operation'"
      ;;
    esac

    # Intentional delay and empty line
    sleep 0.5
    echo ""
  done
}

# The main function of the program is invoked with the same parameters received
# by the user
main "$@"