pfSense » pfSense Packages

<?php

/*

 * nmap_scan.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2022-2022 Rubicon Communications, LLC (Netgate)

 * All rights reserved.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

require_once("guiconfig.inc");

/* require_once("pfsense-utils.inc"); */

require_once("ipsec.inc");

if ($_POST['downloadbtn'] == gettext("Download Results")) {

	$nocsrf = true;

}

$fp = "/root/";

$fn = "nmap.result";

$fe = "nmap.error"; // stderr

$max_display_size = 50*1024*1024; // 50MB limit on GUI results display. See https://redmine.pfsense.org/issues/9239

$interfaces = get_configured_interface_with_descr();

if (ipsec_enabled()) {

	$interfaces['enc0'] = "IPsec";

}

$interfaces['lo0'] = "Localhost";

foreach (array('server' => gettext('OpenVPN Server'), 'client' => gettext('OpenVPN Client')) as $mode => $mode_descr) {

	if (is_array($config['openvpn']["openvpn-{$mode}"])) {

		foreach ($config['openvpn']["openvpn-{$mode}"] as $id => $setting) {

			if (!isset($setting['disable'])) {

				$interfaces['ovpn' . substr($mode, 0, 1) . $setting['vpnid']] = $mode_descr . ": ".htmlspecialchars($setting['description']);

			}

		}

	}

}

$interfaces = array_merge($interfaces, interface_ipsec_vti_list_all());

$interfaces = array_merge(array('' => 'Any'), $interfaces);

$scan_types = array(

	'syn' => gettext('SYN'),

	'connect' => gettext('TCP connect()'),

	'icmp' => gettext('Ping'),

	'udp' => gettext('UDP'),

	'arp' => gettext('ARP (directly connected networks only!)')

);

function nmap_get_running_process(){

	$processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep '/usr/local/bin/nmap' | /usr/bin/grep '{$fn}' | /usr/bin/egrep -v '(pflog|grep)'")));

	return $processcheck;

}

// only accept alphanumeric, spaces (040) and '.,-_' chars, and do not allow '-o? ' for output files

function valid_input($str) {

	$valid_str = (preg_match('/^[a-z0-9\040\.,\-_]+$/i', $str) === 1) && (preg_match('/-o.\040/', $str) === 0);

	//$valid_str = (preg_match('/^[a-z0-9\040\.,\-_]+$/i', $str) === 1) && (strpos($str, '-o') === false);

	return $valid_str;

}

$input_errors = array();

$do_nmapscan = false;

if ($_POST) {

	$hostname = $_POST['hostname'];

	$interface = $_POST['interface'];

	$scantype = $_POST['scantype'];

	$noping = isset($_POST['noping']);

	$servicever = isset($_POST['servicever']);

	$osdetect = isset($_POST['osdetect']);

	$custom_scantype = $_POST['custom_scantype'];

	$custom_options = $_POST['custom_options'];

	$custom_targetspecs = $_POST['custom_targetspecs'];

	if ($_POST['startbtn'] != "") {

		$action = gettext("Start");

		// check for input errors

		if (empty($hostname)) {

			$input_errors[] = gettext("You must enter an IP address to scan.");

		} elseif (!(is_ipaddr($hostname) || is_subnet($hostname) || is_hostname($hostname))) {

			$input_errors[] = gettext("You must enter a valid IP address to scan.");

		}

		if(!empty($interface)) {

			if (!array_key_exists($interface, $interfaces)) {

				$input_errors[] = gettext("Invalid interface.");

			}

		}

		// process scan options

		if (!count($input_errors)) {

			// prevent use of any deprecated option

			$nmap_options = " -d";

			if (is_ipaddrv6($hostname) || is_subnetv6($hostname)) {

				$nmap_options .= " -6";

			}

			// scan type

			if (empty($custom_scantype)) {

				switch($scantype) {

					case 'syn':

						$nmap_options .= " -sS";

						break;

					case 'connect':

						$nmap_options .= " -sT";

						break;

					case 'icmp':

						$nmap_options .= " -sn"; // previously -sP

						break;

					case 'udp':

						$nmap_options .= " -sU";

						break;

					case 'arp':

						$nmap_options .= " -sn -PR";

						break;

				}

			} elseif (valid_input($custom_scantype)) {

					$nmap_options .= " " . $custom_scantype;

			} else {

					$input_errors[] = gettext("Invalid characters in Custom Scan Type. Only alphanumeric, spaces and '.,-_' chars are allowed. Custom output options -o are not allowed");

			}

			// scan options

			if ($noping) {

				$nmap_options .= " -P0";

			}

			if ($servicever) {

				$nmap_options .= " -sV";

			}

			if ($osdetect) {

				$nmap_options .= " -O";

			}

			if (!empty($custom_options)) {

				if (valid_input($custom_options)) {

					$nmap_options .= " " . $custom_options;

				} else {

					$input_errors[] = gettext("Invalid characters in custom options. Only alphanumeric, spaces and '.,-_' chars are allowed. Custom output options -o are not allowed");

				}

			}

			// append summary output to results file (doesn't contain stderr)

			// prevent using source stylesheets for xls output (not really needed)

			$nmap_options .= " -oN {$fp}{$fn} --append-output --no-stylesheet";

			if (!empty($interface)) {

				$nmap_options .= " -e " . get_real_interface($interface);

			}

			if (!empty($custom_targetspecs)) {

				if (valid_input($custom_targetspecs)) {

					$nmap_options .= " " . $custom_targetspecs;

				} else {

					$input_errors[] = gettext("Invalid characters in custom target options. Only alphanumeric, spaces and '.,-_' chars are allowed. Custom output options -o are not allowed");

				}

			}

			$nmap_options .= " " . escapeshellarg($hostname);

			if (!count($input_errors)) {

				$do_nmapscan = true;

			}

		}

	} elseif ($_POST['stopbtn'] != "") {

		$action = gettext("Stop");

		/* check if nmap scan is already running */

		$processes_running = nmap_get_running_process();

		$processisrunning = ($processes_running != "");

		//explode processes into an array, (delimiter is new line)

		$processes_running_array = explode("\n", $processes_running);

		if ($processisrunning != true) {

			$input_errors[] = gettext("Process nmap already completed. Check results below.");

		} else {

			//kill each of the nmap processes

			foreach ($processes_running_array as $process) {

				$process_id_pos = strpos($process, ' ');

				$process_id = substr($process, 0, $process_id_pos);

				exec("kill $process_id");

			}				

		}

	} elseif ($_POST['viewbtn'] != "" or $_POST['refreshbtn'] != "") {

		$action = gettext("View");

	} elseif ($_POST['downloadbtn'] != "") {

		$action = gettext("Download");

		//download file

		send_user_download('file', $fp.$fn);

	} elseif ($_POST['clearbtn'] != "") {

		$action = gettext("Delete");

		//delete previous nmap results file if it exists

		unlink_if_exists($fp.$fn);

		unlink_if_exists($fp.$fe);

	}

}

$pgtitle = array("Package", "Diagnostics: Nmap");

include("head.inc");

/*

$tab_array = array();

$tab_array[] = array(gettext("Nmap Scan"), true, "/nmap_scan.php");

display_top_tabs($tab_array);

*/

if ($input_errors) {

	print_input_errors($input_errors);

}

$form = new Form(false); // No button yet. We add those later depending on the required action

$section = new Form_Section('General Options');

$section->addInput(new Form_Input(

	'hostname',

	'*IP or Hostname',

	'text',

	$hostname

))->setHelp('Enter the IP address or hostname that you would like to scan.');

$section->addInput(new Form_Select(

	'interface',

	'Interface',

	$interface,

	$interfaces

))->setHelp('Select the source interface here.');

$section->addInput(new Form_Select(

	'scantype',

	'*Scan Type',

	$scantype,

	$scan_types

))->setHelp('Select the scan type');

$section->addInput(new Form_Checkbox(

	'noping',

	'-P0',

	'Do not attempt to ping hosts before scanning',

	$_POST['noping']

))->setHelp('Allow scanning of networks that do not answer echo requests.%1$s' .

			'%2$smicrosoft.com is an example of such a network, and thus you should always use -P0 or -PT80 when port scanning microsoft.com.%3$s' .

			'Note the "ping" in this context may involve more than the traditional ICMP echo request packet. Nmap supports many such probes, including arbitrary combinations of TCP, UDP, and ICMP probes.%3$s' .

			'By default, Nmap sends an ICMP echo request and a TCP ACK packet to port 80.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

$section->addInput(new Form_Checkbox(

	'servicever',

	'-sV',

	'Attempt to identify service versions',

	$_POST['servicever']

))->setHelp('Try to detect services running on discoverd ports.%1$s' .

			'%2$sAfter TCP and/or UDP ports are discovered using one of the other scan types, version detection communicates with those ports to try and determine more about what is actually running.%3$s' .

			'A file called nmap-service-probes is used to determine the best probes for detecting various services and the match strings to expect.%3$s' .

			'Nmap tries to determine the service protocol (e.g. ftp, ssh, telnet, http), the application name (e.g. ISC Bind, Apache httpd, Solaris telnetd), ' .

			'the version number, and sometimes miscellaneous details like whether an X server is open to connections or the SSH protocol version).%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

$section->addInput(new Form_Checkbox(

	'osdetect',

	'-O',

	'Enable Operating System detection',

	$_POST['osdetect']

))->setHelp('Try to identify remote host via TCP/IP fingerprinting.%1$s' .

			'%2$sIn other words, it uses techniques to detect subtleties in the underlying operating system network stack of the computers being scanned.%3$s' .

			'It uses this information to create a "fingerprint" which it compares with its database of known OS fingerprints' .

			'(the nmap-os-fingerprints file) to determine the operating system of the target host.%4$s',

			'<span class="infoblock" style="font-size:90%"><br />',

			'<p style="margin:0px;padding:0px">',

			'<br />',

			'</p></span>');

$section->addInput(new Form_Input(

	'custom_scantype',

	'Custom Scan Type',

	'text',

	$custom_scantype

))->setHelp('Enter a custom Scan Type. It will override above selected Scan Type.%1$s' .

			'%2$sExp: -sA -sW -sFs%3$s',

			'<br />',

			'<p style="margin:0px;padding:0px;font-size:90%">',

			'</p>');

$section->addInput(new Form_Input(

	'custom_options',

	'Custom Options',

	'text',

	$custom_options

))->setHelp('Enter extra scan options.%1$s' .

			'%2$sExp: --traceroute --dns-servers server1 -p <port ranges>%3$s',

			'<br />',

			'<p style="margin:0px;padding:0px;font-size:90%">',

			'</p>');

$section->addInput(new Form_Input(

	'custom_targetspecs',

	'Custom Target Specs',

	'text',

	$custom_targetspecs

))->setHelp('Enter additional hosts or extra target options.%1$s' .

			'%2$sExp: ip hostname --exclude host1,host2 -iR <num hosts>%3$s',

			'<br />',

			'<p style="margin:0px;padding:0px;font-size:90%">',

			'</p>');

$form->add($section);

/* check if nmap scan is already running */

$processes_running = nmap_get_running_process();

$processisrunning = ($processes_running != "");

if ($processisrunning or $do_nmapscan) {

	$form->addGlobal(new Form_Button(

		'stopbtn',

		'Stop',

		null,

		'fa-stop-circle'

	))->addClass('btn-warning');

	$form->addGlobal(new Form_Button(

		'refreshbtn',

		'Refresh Results',

		null,

		'fa-retweet'

	))->addClass('btn-primary');

} else {

	$form->addGlobal(new Form_Button(

		'startbtn',

		'Start',

		null,

		'fa-play-circle'

	))->addClass('btn-success');

	if (file_exists($fp.$fn) or file_exists($fp.$fe)) {

		$form->addGlobal(new Form_Button(

			'viewbtn',

			'View Results',

			null,

			'fa-file-text-o'

		))->addClass('btn-primary');

		$form->addGlobal(new Form_Button(

			'downloadbtn',

			'Download Results',

			null,

			'fa-download'

		))->addClass('btn-primary');

		$form->addGlobal(new Form_Button(

			'clearbtn',

			'Clear Results',

			null,

			'fa-trash'

		))->addClass('btn-danger');

	}

}

if (file_exists($fp.$fn)) {

	$section->addInput(new Form_StaticText(

		'Last scan results',

		date("F jS, Y g:i:s a.", filemtime($fp.$fn))

	));

}

if (file_exists($fp.$fe) and filesize($fp.$fe) > 0) {

	$section->addInput(new Form_StaticText(

		'Last scan error',

		date("F jS, Y g:i:s a.", filemtime($fp.$fe))

	));

}

print($form);

if ($do_nmapscan) {

	$cmd = "/usr/local/bin/nmap {$nmap_options} >/dev/null 2>{$fp}{$fe} &";

	exec($cmd);

	print_info_box(gettext('Nmap scan is running' . '<br />' . 'Press info button to show command'), 'info');

	?>

	<div class="infoblock">

	<? print_info_box(gettext('Command line') . ': ' . htmlspecialchars($cmd), 'info', false); ?>

	</div>

	<?php

} elseif ($action == gettext("View") or $action == gettext("Stop")) {

		if (file_exists($fp.$fe) and filesize($fp.$fe) > 0) {

?>

<div class="panel panel-default">

	<div class="panel-heading"><h2 class="panel-title"><?=gettext('Scan Errors')?></h2></div>

	<div class="panel-body">

		<div class="form-group">

<?php

			print('<textarea class="form-control" rows="10" style="font-size: 13px; font-family: consolas,monaco,roboto mono,liberation mono,courier;">');

			if (filesize($fp.$fe) > $max_display_size) {

				print(gettext("Nmap scan error file is too large to display in the GUI.") .

					"\n" .

					gettext("Download the file, or view it in the console or ssh shell.") .

					"\n" .

					gettext("Error file: {$fp}{$fe}"));

			} else {

				print(file_get_contents($fp.$fe));

			}

			print('</textarea>');

?>

		</div>

	</div>

</div>

<?php

		}

?>

<div class="panel panel-default">

	<div class="panel-heading"><h2 class="panel-title"><?=gettext('Scan Results')?></h2></div>

	<div class="panel-body">

		<div class="form-group">

<?php

		print('<textarea class="form-control" rows="20" style="font-size: 13px; font-family: consolas,monaco,roboto mono,liberation mono,courier;">');

		if (file_exists($fp.$fn) and (filesize($fp.$fn) > $max_display_size)) {

			print(gettext("Nmap scan results file is too large to display in the GUI.") .

				"\n" .

				gettext("Download the file, or view it in the console or ssh shell.") .

				"\n" .

				gettext("Results file: {$fp}{$fn}"));

		} elseif (!file_exists($fp.$fn) || (filesize($fp.$fn) === 0)) {

			print(gettext("No nmap scan results to display."));

		} else {

			print(file_get_contents($fp.$fn));

		}

		print('</textarea>');

?>

		</div>

	</div>

</div>

<?php

}

include("foot.inc");