#!/bin/sh
###
### probe v2.3 (Extended Stealth Host Scanner - (c) 1998 by van Hauser / THC)
###
### Syntax : probe [-p] [-s] [-e] [-u] [-i] HOST
###		HOST	target to probe
###		p	don't ping                   (if pinging doesn't work)
###		s	don't show the output file       (for script scanning)
###		e	don't do extended high-port scanning          (faster)
###		u	don't do UDP port scanning     (faster, more stealth!)
###		i	don't do information gathering         (more stealth!)
###		f	don't do FIN scanning    (doesn't work on a slow link)
###
### if called as "sprobe", -u and -i are turned on (stealth-probe)
### if called as "mprobe", -e -u and -f are turned on (my-standard-probe)
###
### you need :	nmap v1.5 (http://www.dhp.com/~fyodor/nmap)
###		tcp_scan  (from SATAN [note you need the linux version!])
###		fping     (from SATAN too)
###		netcat	  (from ftp.avian.org)
### plus the standard utilities finger, rpcinfo, showmount, rusers, dig & whois.
###


###
### If you need some configs:
### this is a misc config for me (I need that if scanning from a ppp dialup)
### you must program that small script. all it does is giving back the
### current ip address used. If you've got a static ip, set it to ""
#NMAP_CONFIG="-S `myip`"
#NMAP_CONFIG="-S 127.0.0.1"
###
### additional PATH stuff where needed binaries are (not in PATH)
PATH=$PATH:/prg/etc;
###
### If you want to use a WWW or FINGER proxy, define them here
#WWW_PROXY=www.anonymizer.com
#FINGER_PROXY=@ix.netcom.com
###

###
### Init of help, functions and variables
###
if [ "$1" = "" ]; then 
	echo "probe v2.3 (Extended Stealth Host Scanner - (c) 1998 by van Hauser / [THC])"
	echo -e "Syntax: $0 [-p] [-s] [-e] [-u] [-i] [-f] host\n   host - host to probe\n   p    - don't ping to be sure it's alive\n   s    - don't run 'less' on the outputfile at the end (for scripts)\n   e    - No extended high-port scanning\n   u    - don't do a UDP portscan\n   i    - No information gathering on the TCP ports (for full stealth)\n   f    - don't use FIN scanning. SYN scanning is used (for slow links)"
	exit 1
fi
DONT_PING=;DONT_SHOW=;DONT_PORTS=;DONT_UDP=;DONT_INFO=;DONT_FIN=U;STEALTH_CONF=;MY_CONF=;
###
### if called as "sprobe" all stealth options are turned on
###
if [ "`echo $0|grep sprobe`" != "" ]; then
        DONT_UDP=D;
	DONT_INFO=D;
        STEALTH_CONF=D;
fi
###
### if called as "mprobe", all these special configs are turned on (my confs)
###
if [ "`echo $0|grep mprobe`" != "" ]; then
        DONT_UDP=D;
#        DONT_FIN=s;
	DONT_PORTS=D;
	MY_CONF=D;
fi
for ARGV in $1 $2 $3 $4 $5 $6 $7; do
        if [ "$ARGV" = "p" ]; then DONT_PING=-D; else
        if [ "$ARGV" = "s" ]; then DONT_SHOW=D; else
        if [ "$ARGV" = "e" ]; then DONT_PORTS=D;else
        if [ "$ARGV" = "u" ]; then DONT_UDP=D;  else
        if [ "$ARGV" = "i" ]; then DONT_INFO=D; else
        if [ "$ARGV" = "f" ]; then DONT_FIN=s; else
        if [ "$ARGV" = "-p" ]; then DONT_PING=-D; else
        if [ "$ARGV" = "-s" ]; then DONT_SHOW=D; else
        if [ "$ARGV" = "-e" ]; then DONT_PORTS=D;else
        if [ "$ARGV" = "-u" ]; then DONT_UDP=D;  else
        if [ "$ARGV" = "-i" ]; then DONT_INFO=D; else
        if [ "$ARGV" = "-f" ]; then DONT_FIN=s; else
	TARGET=$ARGV
fi;fi;fi;fi;fi;fi;fi;fi;fi;fi;fi;fi;done

###
### Now we go for the realstuff
###
if [ "$DONT_PING" = "" ]; then fping $TARGET || exit 2; fi
echo ------------------------------------------------------------------------------ > /tmp/$TARGET.probe.tmp
echo Target: $TARGET   >> /tmp/$TARGET.probe.tmp
echo Date: `date` >> /tmp/$TARGET.probe.tmp
echo ------------------------------------------------------------------------------ >> /tmp/$TARGET.probe.tmp
echo "" >> /tmp/$TARGET.probe.tmp


###
### First a stealth-portscan (FIN)
###
nmap $DONT_PING -"$DONT_FIN"rp 11,15,21,23,25,53,69,70,79,80,81,110,111,113,143,512-515,2049,6000,8080 $NMAP_CONFIG $TARGET > /tmp/$TARGET.probe.nmap 2> /dev/null


###
### Check the open ports now we are interested in
###
if [ "$DONT_INFO" = "" ]; then
 if [ "`grep "^11 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo Systat ...
	echo "--- PORT 11 (systat) ---" >> /tmp/$TARGET.probe.tmp
	netcat $TARGET 11 >> /tmp/$TARGET.probe.tmp
	echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^15 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo Netstat ...
        echo "--- PORT 15 (netstat) ---" >> /tmp/$TARGET.probe.tmp
        netcat $TARGET 15 >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^21 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo FTP ...
        echo "--- PORT 21 (ftp) ---" >> /tmp/$TARGET.probe.tmp
	tcp_scan -b -w 5 -s "\r" $TARGET 21 >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^23 " /tmp/$TARGET.probe.nmap`" != "" ]; then
        echo Telnet ...
        echo "--- PORT 23 (telnet) ---" >> /tmp/$TARGET.probe.tmp
        tcp_scan -b -w 5 -s "\r" $TARGET 23 >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^25 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo SMTP ...
        echo "--- PORT 25 (smtp) ---" >> /tmp/$TARGET.probe.tmp
        tcp_scan -b -w 5 -s "\r" $TARGET 25 >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^53 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo "--- PORT 53 (DNS) ---" >> /tmp/$TARGET.probe.tmp
	dig "@"$TARGET version.bind txt chaos | grep -i version | grep -i bind >> /tmp/$TARGET.probe.tmp
	echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^79 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo Finger ...
	echo "--- PORT 79 (finger) ---" >> /tmp/$TARGET.probe.tmp
        finger -l ftp@$TARGET$FINGER_PROXY >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^80 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo WWW ...
        echo "--- PORT 80 (www) ---" >> /tmp/$TARGET.probe.tmp
	if [ "$WWW_PROXY" = "" ]; then
           echo -e "GET / HTTP 1.0\n" | netcat $TARGET 80 | head -13 >> /tmp/$TARGET.probe.tmp
	else
	   echo -e "GET /$TARGET:80/ HTTP 1.0\n" | netcat $WWW_PROXY 80 | head -13 >> /tmp/$TARGET.probe.tmp
	fi
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^110 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo POP3 ...
        echo "--- PORT 110 (pop3) ---" >> /tmp/$TARGET.probe.tmp
        tcp_scan -b -w 5 -s "\r" $TARGET 110 >> /tmp/$TARGET.probe.tmp
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
 if [ "`grep "^111 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo Portmapper ...
        echo "--- PORT 111 (portmapper) ---" >> /tmp/$TARGET.probe.tmp
	rpcinfo -p $TARGET >> /tmp/$TARGET.probe.tmp
	echo "" >> /tmp/$TARGET.probe.tmp
    if [ "`grep "\^2049 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	    echo NFS ...
	    echo "--- PORT 2049 (portmapper) ---" >> /tmp/$TARGET.probe.tmp
    	    showmount -e $TARGET >> /tmp/$TARGET.probe.tmp
	    echo "" >> /tmp/$TARGET.probe.tmp
    fi
    if [ "`grep -i rusers /tmp/$TARGET.probe.tmp`" != "" ]; then
	    echo Rusers ...
	    echo "--- PORTMAPPER (rusers) ---" >> /tmp/$TARGET.probe.tmp
	    /usr/bin/rusers -al $TARGET >> /tmp/$TARGET.probe.tmp
	    echo "" >> /tmp/$TARGET.probe.tmp
    fi
 fi
 if [ "`grep "^8080 " /tmp/$TARGET.probe.nmap`" != "" ]; then
	echo WWW-high ...
        echo "--- PORT 8080 (www) ---" >> /tmp/$TARGET.probe.tmp
        if [ "$WWW_PROXY" = "" ]; then
           echo -e "GET / HTTP 1.0\n" | netcat $TARGET 8080 | head -13 >> /tmp/$TARGET.probe.tmp
	else
           echo -e "GET /$TARGET:8080/ HTTP 1.0\n" | netcat $WWW_PROXY 80 | head -13 >> /tmp/$TARGET.probe.tmp
	fi
        echo "" >> /tmp/$TARGET.probe.tmp
 fi
fi
echo -n "------ THE PORTSCAN ------" >> /tmp/$TARGET.probe.tmp
cat /tmp/$TARGET.probe.nmap >> /tmp/$TARGET.probe.tmp
echo -e "\n" >> /tmp/$TARGET.probe.tmp
rm /tmp/$TARGET.probe.nmap

if [ "$DONT_PORTS" = "" ]; then
	echo extended portscan ...
	echo -n "------ EXTENDED PORTSCAN ------" >> /tmp/$TARGET.probe.tmp
	nmap $DONT_PING -"$DONT_FIN"rp 516-2048,2050-5999 $NMAP_CONFIG $TARGET >> /tmp/$TARGET.probe.tmp 2> /dev/null
	echo "" >> /tmp/$TARGET.probe.tmp
fi


###
### Let's look out for open udp ports
###
if [ "$DONT_UDP" = "" ]; then
	echo "UDP scanning ..."
	echo -n "------ UDP PORTSCAN ------" >> /tmp/$TARGET.probe.tmp
	nmap $DONT_PING -rup 11,15,23,53,66,69,70,111,161,162,514-1024,2049 $NMAP_CONFIG $TARGET >> /tmp/$TARGET.probe.tmp 2> /dev/null
	echo -e "\n" >> /tmp/$TARGET.probe.tmp
fi


###
### additional stuff
###
echo Running dig ...
echo "--- DIG ---" >> /tmp/$TARGET.probe.tmp
dig $TARGET 2> /dev/null | tail -29 >> /tmp/$TARGET.probe.tmp
echo "" >> /tmp/$TARGET.probe.tmp
echo Running whois ...
echo "--- WHOIS ---" >> /tmp/$TARGET.probe.tmp
whois `nslookup $TARGET|grep Address|tail -1|awk '{ print $2 }'` >> /tmp/$TARGET.probe.tmp 2> /dev/null
echo "" >> /tmp/$TARGET.probe.tmp
echo Running traceroute ...
echo "--- TRACEROUTE ---" >> /tmp/$TARGET.probe.tmp
traceroute -m 15 $TARGET >> /tmp/$TARGET.probe.tmp 2> /dev/null
echo "" >> /tmp/$TARGET.probe.tmp

###
### Finishing up ...
###
mv /tmp/$TARGET.probe.tmp /tmp/$TARGET.probe
echo 
if [ "$DONT_SHOW" = "" ]; then less /tmp/$TARGET.probe; fi
