I'm running through this proof of concept scenario at the moment. Don't complain about any code that I post below. Again, I'm just doing a quick POC, so the code is fairly poorly written. But it does work. If you'd like to make it better, please feel free. Please don't make functionality requests here. If you would like to see a feature added, please make the changes yourself. That's the beauty of having the code. In other words, I'm doing this for me and sharing it with the world. But in the end, it's for me. So if you don't like it, I don't want to hear about it because I don't care. Sorry for all that, just needed to get it out of the way, lest I become inundated with silly requests and negative opinions.
As far as OS and service fingerprinting goes, Nmap is fully capable of doing just that. So why reinvent the wheel? I first started trying to use Nmap along with a series of 'greps', but the command became long and well, pretty horrible looking.
Then I realized I could output the data from an Nmap scan to XML format. My command ended up looking like this:
nmap -A -T5 <IP Address(es) to scan> -oX output.xml
The above command will scan the hosts that you provide, attempting to identify the OS and services running on them. I usually use a CIDR block for the range to scan, such as 192.168.1.0/24, but you can use any nmap accepted format.
I chose to use perl to parse the output.xml file. That's because there is a great perl module called Nmap::Parser. It was built specifically for this sort of activity.
The script I have right now is below:
#!/usr/bin/perl -w
#
#
# Give the XML file as the only program argument
#
use strict;
use Nmap::Parser;
use DBI;
use DBD::mysql;
my $dbh = DBI->connect(
'DBI:mysql:database=nmap;host=localhost',
'<user>',
'<password>',
{ RaiseError => 1, AutoCommit => 1 },
);
# set the value of your SQL query
my $dquery1 = "delete from osdata";
my $dquery2 = "delete from servicedata";
my $query = "insert into osdata (ip, name, vendor, name_accuracy, class_accuracy)
values (?, ?, ?, ?, ?) ";
my $query2 = "insert into servicedata (ip, protocol, name, port, product, version, confidence) values (?,?,?,?,?,?,?)";
# prepare your statement for connecting to the database
my $statement = $dbh->prepare($query);
my $statement2 = $dbh->prepare($query2);
my $dstatement = $dbh->prepare($dquery1);
my $dstatement2 = $dbh->prepare($dquery2);
# execute your SQL delete statements
$dstatement->execute();
$dstatement2->execute();
my $np = new Nmap::Parser;
# Parse the input XML file
$np->parsefile("$ARGV[0]");
# Get an array of all hosts that are alive
my @hosts = $np->all_hosts("up");
foreach my $host_obj (@hosts) {
# Get the IP address of the current host
my $addr = $host_obj->addr();
my $hname = $host_obj->hostname();
if ($hname ne 00) {
print "$addr\t$hname\n";
} else {
print "$addr\n";
}
#Identify the Operating System
my $os = $host_obj->os_sig();
my $osname = $os->name();
my $osacc = $os->name_accuracy();
my $osven = $os->vendor();
my $osacc2 = $os->class_accuracy();
#print "$osname\t$osacc\t$osven\t$osacc2\n";
$statement->execute($addr, $osname, $osven, $osacc, $osacc2);
# Get a list of open TCP ports for this host
my @tcp_ports = $host_obj->tcp_open_ports();
# Enumerate the open TCP ports
foreach my $tcp_port (@tcp_ports) {
my $service = $host_obj->tcp_service($tcp_port);
no warnings;
my $svcname = $service->name();
my $svcport = $service->port();
my $svcprod = $service->product();
my $svcvers = $service->version();
my $svcconf = $service->confidence();
if (defined($svcname)) {
$statement2->execute($addr,'TCP',$svcname,$svcport,$svcprod,$svcvers,$svcconf);
use warnings;
}
}
}
You would need to replace <user> and <pass> with your database username and password.
For the sake of testing, I just created a new MySQL database called nmap along with two tables; osdata and servicedata.
mysql -uroot -p
mysql> create database nmap;
mysql> use nmap;
mysql> create table osdata ( id INT AUTO_INCREMENT PRIMARY KEY, ip varchar(20), name varchar(20), vendor varchar(20), name_accuracy int(3), class_accuracy int(3) );
mysql> create table servicedata ( id INT AUTO_INCREMENT PRIMARY KEY, ip varchar(20), protocol varchar(3), name varchar(20), port int(6), product varchar(20), version varchar(6), confidence int (3) );
After the fact, I went back and added a timestamp column to each table:
mysql> alter table `osdata` add `lastUpdated` timestamp;
mysql> alter table `servicedata` add `lastUpdated` timestamp;
With the database created, I can simply run the script from above, which I have saved as nmap_parser.pl like this:
./nmap_parser.pl output.xml
The script will run and populate the new database tables with the results it finds. Instead of dealing with checking if the database rows already exist and changing the insert to an update in the script, each time the script is executed, it completely deletes all the data in the osdata and servicedata tables.
My thought is that the nmap scan can be set as a cron job on the snort machine. Then the nmap_parser script can also be set to run after that cron job completes.
The next step will be to make modifications to the snort front-end, BASE. I hope to be able to add a new menu item which will read in the data from the osdata and servicedata tables and display them in a friendly format in the BASE UI. Not sure when I'll have time to get around to that. But I'll be sure to post my results whenever I do. And again, this is a work in progress, so I know much needs to be changed in the code I have provided today.
