NetScan.sh

#!/bin/bash

# Script: RouterVulnScan.sh
# Description: Scans a network for router vulnerabilities using Nmap, Metasploit, and RouterSploit.
# Notes:
# - Requires Nmap, Metasploit, and RouterSploit installed.
# - Ensure you have permission to scan the target network.
# - For ethical use only.

# Default parameters
NETWORK_RANGE=""
OUTPUT_DIR="RouterVulnScan_$(date +%Y%m%d_%H%M%S)"
NMAP_PATH=$(which nmap)
MSFCONSOLE_PATH=$(which msfconsole)
ROUTERSPLT_PATH=$(which rsf.py)

# Usage function
usage() {
    echo "Usage: $0 -r <network_range> [-o <output_dir>] [-n <nmap_path>] [-m <msfconsole_path>] [-s <routersploit_path>]"
    echo "  -r: Network range (e.g., '192.168.1.0/24')"
    echo "  -o: Output directory (default: $OUTPUT_DIR)"
    echo "  -n: Path to Nmap (default: $NMAP_PATH)"
    echo "  -m: Path to Metasploit msfconsole (default: $MSFCONSOLE_PATH)"
    echo "  -s: Path to RouterSploit rsf.py (default: $ROUTERSPLT_PATH)"
    exit 1
}

# Parse arguments
while getopts "r:o:n:m:s:" opt; do
    case $opt in
        r) NETWORK_RANGE="$OPTARG" ;;
        o) OUTPUT_DIR="$OPTARG" ;;
        n) NMAP_PATH="$OPTARG" ;;
        m) MSFCONSOLE_PATH="$OPTARG" ;;
        s) ROUTERSPLT_PATH="$OPTARG" ;;
        *) usage ;;
    esac
done

# Check if network range is provided
if [ -z "$NETWORK_RANGE" ]; then
    usage
fi

# Function to check if required tools are installed
check_tools() {
    for tool in "$NMAP_PATH" "$MSFCONSOLE_PATH" "$ROUTERSPLT_PATH"; do
        if [ ! -x "$tool" ]; then
            echo "[ERROR] Tool not found or not executable: $tool"
            case $tool in
                "$NMAP_PATH") echo "Install Nmap: https://nmap.org/" ;;
                "$MSFCONSOLE_PATH") echo "Install Metasploit: https://www.metasploit.com/" ;;
                "$ROUTERSPLT_PATH") echo "Install RouterSploit: https://github.com/threat9/routersploit" ;;
            esac
            exit 1
        fi
    done
}

# Function to log output to file and console
log() {
    local message="$1"
    local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
    echo "[$timestamp] $message" | tee -a "$OUTPUT_DIR/scan_log.txt"
}

# Function to create output directory
init_output_dir() {
    if [ ! -d "$OUTPUT_DIR" ]; then
        mkdir -p "$OUTPUT_DIR"
        log "Created output directory: $OUTPUT_DIR"
    fi
}

# Function to scan for routers using Nmap
scan_routers() {
    local range="$1"
    log "Starting Nmap scan on $range..."

    # Run Nmap to discover live hosts and common router ports
    "$NMAP_PATH" -sn -PS80,443,23,8080,8443 "$range" -oG "$OUTPUT_DIR/nmap_hosts.txt" 2>&1 | tee -a "$OUTPUT_DIR/nmap_raw.txt"

    # Parse Nmap output for live hosts
    local live_hosts=($(grep "Up" "$OUTPUT_DIR/nmap_hosts.txt" | grep -oP "Host: \K\S+"))
    log "Found ${#live_hosts[@]} live hosts."

    echo "${live_hosts[@]}"
}

# Function to check router vulnerabilities using Nmap
check_nmap_vulnerabilities() {
    local ip="$1"
    log "Running Nmap vulnerability scan on $ip..."

    # Common router ports and vulnerability scripts
    local ports="80,443,23,8080,8443"
    local nmap_output_file="$OUTPUT_DIR/nmap_vuln_${ip}.txt"
    "$NMAP_PATH" -p "$ports" --script=http-title,http-methods,telnet-brute,http-auth,http-default-accounts,http-vuln-cve2017-5638,http-vuln-cve2018-13379 -sV "$ip" -oN "$nmap_output_file" 2>&1 | tee -a "$OUTPUT_DIR/nmap_vuln_raw.txt"

    # Parse Nmap output
    if grep -qi "http-title.*Router|Admin|Login|Management|Webinterface|Gateway" "$nmap_output_file"; then
        log "Device at $ip appears to be a router (based on HTTP title)."
    else
        log "Device at $ip may not be a router."
    fi

    # Check for open ports
    local open_ports=$(grep -oP "\d+/tcp\s+open" "$nmap_output_file" | cut -d'/' -f1)
    if [ -n "$open_ports" ]; then
        log "Open ports on $ip: $open_ports"
    else
        log "No open ports detected on $ip."
    fi

    # Check for default credentials
    if grep -qi "http-default-accounts.*found" "$nmap_output_file"; then
        local creds=$(grep -i "http-default-accounts" "$nmap_output_file" | grep -oP "found.*$")
        log "Potential default credentials found on $ip: $creds"
    fi

    # Check for CVEs
    if grep -qi "http-vuln-cve" "$nmap_output_file"; then
        local cves=$(grep -i "http-vuln-cve" "$nmap_output_file" | grep -oP "CVE-\S+")
        log "Potential CVEs found on $ip: $cves"
    fi

    # Check for Telnet
    if grep -qi "telnet.*open" "$nmap_output_file"; then
        log "Warning: Telnet is open on $ip. This is insecure and should be disabled."
    fi
}

# Function to check vulnerabilities using RouterSploit
check_routersploit_vulnerabilities() {
    local ip="$1"
    log "Running RouterSploit scan on $ip..."

    # Create temporary RouterSploit script
    local rsf_script="$OUTPUT_DIR/routersploit_temp.py"
    cat << EOF > "$rsf_script"
use scanners/autopwn
set target $ip
run
exit
EOF

    # Run RouterSploit
    local rsf_output_file="$OUTPUT_DIR/routersploit_${ip}.txt"
    python3 "$ROUTERSPLT_PATH" --script "$rsf_script" > "$rsf_output_file" 2>&1

    # Clean up
    rm -f "$rsf_script"

    # Check for vulnerabilities
    if grep -qi "vulnerable\|exploit" "$rsf_output_file"; then
        log "RouterSploit found potential vulnerabilities on $ip. See $rsf_output_file for details."
        grep -i "vulnerable\|exploit" "$rsf_output_file" | while read -r line; do
            log "$line"
        done
    else
        log "No RouterSploit vulnerabilities detected on $ip."
    fi
}

# Function to check vulnerabilities using Metasploit
check_metasploit_vulnerabilities() {
    local ip="$1"
    log "Running Metasploit scan on $ip..."

    # Create temporary Metasploit resource script
    local msf_script="$OUTPUT_DIR/msf_temp.rc"
    cat << EOF > "$msf_script"
use auxiliary/scanner/http/dlink_dir_615h_info_disclosure
set RHOSTS $ip
run
use auxiliary/scanner/http/netgear_nms300_login
set RHOSTS $ip
run
exit
EOF

    # Run Metasploit
    local msf_output_file="$OUTPUT_DIR/metasploit_${ip}.txt"
    "$MSFCONSOLE_PATH" -r "$msf_script" > "$msf_output_file" 2>&1

    # Clean up
    rm -f "$msf_script"

    # Check for vulnerabilities
    if grep -qi "vulnerable\|success" "$msf_output_file"; then
        log "Metasploit found potential vulnerabilities on $ip. See $msf_output_file for details."
        grep -i "vulnerable\|success" "$msf_output_file" | while read -r line; do
            log "$line"
        done
    else
        log "No Metasploit vulnerabilities detected on $ip."
    fi
}

# Main execution
main() {
    # Check for required tools
    check_tools

    # Initialize output directory
    init_output_dir

    # Scan for live hosts
    IFS=' ' read -r -a live_hosts < <(scan_routers "$NETWORK_RANGE")

    # Analyze each host
    for host in "${live_hosts[@]}"; do
        log "Analyzing $host..."
        check_nmap_vulnerabilities "$host"
        check_metasploit_vulnerabilities "$host"
        check_routersploit_vulnerabilities "$host"
    done

    log "Scan completed. Results saved to $OUTPUT_DIR."
}

# Trap errors
set -e
trap 'log "Error occurred: $BASH_COMMAND (line $BASH_LINENO)"; exit 1' ERR

# Run main
main