mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
Begin of restructuring ...
- deprecate old release - set virtual version - we need tpot user / group, adding to installer - tweaking - do not use the dev branch, it will break stuff
This commit is contained in:
Marco Ochse
94
docker/tpotinit/dist/bin/deprecated/export_kibana-objects.sh
vendored
Executable file
94
docker/tpotinit/dist/bin/deprecated/export_kibana-objects.sh
vendored
Executable file
@ -0,0 +1,94 @@
|
||||
#!/bin/bash
|
||||
# Export all Kibana objects through Kibana Saved Objects API
|
||||
# Make sure ES is available
|
||||
myES="http://127.0.0.1:64298/"
|
||||
myKIBANA="http://127.0.0.1:64296/"
|
||||
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
|
||||
if ! [ "$myESSTATUS" = "1" ]
|
||||
then
|
||||
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
|
||||
exit
|
||||
else
|
||||
echo "### Elasticsearch is available, now continuing."
|
||||
echo
|
||||
fi
|
||||
|
||||
# Set vars
|
||||
myDATE=$(date +%Y%m%d%H%M)
|
||||
myINDEXCOUNT=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=index-pattern' | jq '.saved_objects[].attributes' | tr '\\' '\n' | grep -E "scripted|url" | wc -w)
|
||||
myINDEXID=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=index-pattern' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myDASHBOARDS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=dashboard&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myVISUALIZATIONS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=visualization&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
mySEARCHES=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=search&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myCONFIGS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=config&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myCOL1="[0;34m"
|
||||
myCOL0="[0;0m"
|
||||
|
||||
# Let's ensure normal operation on exit or if interrupted ...
|
||||
function fuCLEANUP {
|
||||
rm -rf patterns/ dashboards/ visualizations/ searches/ configs/
|
||||
}
|
||||
trap fuCLEANUP EXIT
|
||||
|
||||
# Export index patterns
|
||||
mkdir -p patterns
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $myINDEXCOUNT $myCOL1"index pattern fields." $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' | jq '. | {attributes, references}' > patterns/$myINDEXID.json &
|
||||
echo
|
||||
|
||||
# Export dashboards
|
||||
mkdir -p dashboards
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/dashboard/'$i'' | jq '. | {attributes, references}' > dashboards/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export visualizations
|
||||
mkdir -p visualizations
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/visualization/'$i'' | jq '. | {attributes, references}' > visualizations/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export searches
|
||||
mkdir -p searches
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/search/'$i'' | jq '. | {attributes, references}' > searches/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export configs
|
||||
mkdir -p configs
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/config/'$i'' | jq '. | {attributes, references}' > configs/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Wait for background exports to finish
|
||||
wait
|
||||
|
||||
# Building tar archive
|
||||
echo $myCOL1"### Now building archive"$myCOL0 "kibana-objects_"$myDATE".tgz"
|
||||
tar cvfz kibana-objects_$myDATE.tgz patterns dashboards visualizations searches configs > /dev/null
|
||||
|
||||
# Stats
|
||||
echo
|
||||
echo $myCOL1"### Statistics"
|
||||
echo $myCOL1"###### Exported"$myCOL0 $myINDEXCOUNT $myCOL1"index patterns." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
echo
|
||||
122
docker/tpotinit/dist/bin/deprecated/hptest.sh
vendored
Executable file
122
docker/tpotinit/dist/bin/deprecated/hptest.sh
vendored
Executable file
@ -0,0 +1,122 @@
|
||||
#!/bin/bash
|
||||
|
||||
myHOST="$1"
|
||||
myPACKAGES="dcmtk netcat nmap"
|
||||
myMEDPOTPACKET="
|
||||
MSH|^~\&|ADT1|MCM|LABADT|MCM|198808181126|SECURITY|ADT^A01|MSG00001-|P|2.6
|
||||
EVN|A01|198808181123
|
||||
PID|||PATID1234^5^M11^^AN||JONES^WILLIAM^A^III||19610615|M||2106-3|677 DELAWARE AVENUE^^EVERETT^MA^02149|GL|(919)379-1212|(919)271-3434~(919)277-3114||S||PATID12345001^2^M10^^ACSN|123456789|9-87654^NC
|
||||
NK1|1|JONES^BARBARA^K|SPO|||||20011105
|
||||
NK1|1|JONES^MICHAEL^A|FTH
|
||||
PV1|1|I|2000^2012^01||||004777^LEBAUER^SIDNEY^J.|||SUR||-||ADM|A0
|
||||
AL1|1||^PENICILLIN||CODE16~CODE17~CODE18
|
||||
AL1|2||^CAT DANDER||CODE257
|
||||
DG1|001|I9|1550|MAL NEO LIVER, PRIMARY|19880501103005|F
|
||||
PR1|2234|M11|111^CODE151|COMMON PROCEDURES|198809081123
|
||||
ROL|45^RECORDER^ROLE MASTER LIST|AD|RO|KATE^SMITH^ELLEN|199505011201
|
||||
GT1|1122|1519|BILL^GATES^A
|
||||
IN1|001|A357|1234|BCMD|||||132987
|
||||
IN2|ID1551001|SSN12345678
|
||||
ROL|45^RECORDER^ROLE MASTER LIST|AD|RO|KATE^ELLEN|199505011201"
|
||||
|
||||
function fuGOTROOT {
|
||||
myWHOAMI=$(whoami)
|
||||
if [ "$myWHOAMI" != "root" ]
|
||||
then
|
||||
echo "Need to run as root ..."
|
||||
exit
|
||||
fi
|
||||
}
|
||||
|
||||
function fuCHECKDEPS {
|
||||
myINST=""
|
||||
for myDEPS in $myPACKAGES;
|
||||
do
|
||||
myOK=$(dpkg -s $myDEPS | grep ok | awk '{ print $3 }');
|
||||
if [ "$myOK" != "ok" ]
|
||||
then
|
||||
myINST=$(echo $myINST $myDEPS)
|
||||
fi
|
||||
done
|
||||
if [ "$myINST" != "" ]
|
||||
then
|
||||
apt-get update -y
|
||||
for myDEPS in $myINST;
|
||||
do
|
||||
apt-get install $myDEPS -y
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
function fuCHECKFORARGS {
|
||||
if [ "$myHOST" != "" ];
|
||||
then
|
||||
echo "All arguments met. Continuing."
|
||||
else
|
||||
echo "Usage: hp_test.sh <[host or ip]>"
|
||||
exit
|
||||
fi
|
||||
}
|
||||
|
||||
function fuGETPORTS {
|
||||
myDOCKERCOMPOSEPORTS=$(cat $myDOCKERCOMPOSEYML | yq -r '.services[].ports' | grep ':' | sed -e s/127.0.0.1// | tr -d '", ' | sed -e s/^:// | cut -f1 -d ':' | grep -v "6429\|6430" | sort -gu)
|
||||
myPORTS=$(for i in $myDOCKERCOMPOSEPORTS; do echo "$i"; done)
|
||||
echo "Found these ports enabled:"
|
||||
echo "$myPORTS"
|
||||
exit
|
||||
}
|
||||
|
||||
function fuSCAN {
|
||||
local myTIMEOUT="$1"
|
||||
local mySCANPORT="$2"
|
||||
local mySCANIP="$3"
|
||||
local mySCANOPTS="$4"
|
||||
|
||||
timeout --foreground ${myTIMEOUT} nmap ${mySCANOPTS} -T4 -v -p ${mySCANPORT} ${mySCANIP} &
|
||||
}
|
||||
|
||||
# Main
|
||||
fuGOTROOT
|
||||
fuCHECKDEPS
|
||||
fuCHECKFORARGS
|
||||
|
||||
echo "Starting scans ..."
|
||||
echo "$myMEDPOTPACKET" | nc "$myHOST" 2575 &
|
||||
curl -XGET "http://$myHOST:9200/logstash-*/_search" &
|
||||
curl -XPOST -H "Content-Type: application/json" -d '{"name":"test","email":"test@test.com"}' "http://$myHOST:9200/test" &
|
||||
echo "I20100" | timeout --foreground 3 nc "$myHOST" 10001 &
|
||||
findscu -P -k PatientName="*" $myHOST 11112 &
|
||||
getscu -P -k PatientName="*" $myHOST 11112 &
|
||||
telnet $myHOST 3299 &
|
||||
fuSCAN "180" "7,8,102,135,161,1025,1080,5000,9200" "$myHOST" "-sC -sS -sU -sV"
|
||||
fuSCAN "180" "2048,4096,5432" "$myHOST" "-sC -sS -sU -sV --version-light"
|
||||
fuSCAN "120" "20,21" "$myHOST" "--script=ftp* -sC -sS -sV"
|
||||
fuSCAN "120" "22" "$myHOST" "--script=ssh2-enum-algos,ssh-auth-methods,ssh-hostkey,ssh-publickey-acceptance,sshv1 -sC -sS -sV"
|
||||
fuSCAN "30" "22" "$myHOST" "--script=ssh-brute"
|
||||
fuSCAN "120" "23,2323,2324" "$myHOST" "--script=telnet-encryption,telnet-ntlm-info -sC -sS -sV --version-light"
|
||||
fuSCAN "120" "25" "$myHOST" "--script=smtp* -sC -sS -sV"
|
||||
fuSCAN "180" "42" "$myHOST" "-sC -sS -sV"
|
||||
fuSCAN "120" "69" "$myHOST" "--script=tftp-enum -sU"
|
||||
fuSCAN "120" "80,81,8080,8443" "$myHOST" "-sC -sS -sV"
|
||||
fuSCAN "120" "110,995" "$myHOST" "--script=pop3-capabilities,pop3-ntlm-info -sC -sS -sV --version-light"
|
||||
fuSCAN "30" "110,995" "$myHOST" "--script=pop3-brute -sS"
|
||||
fuSCAN "120" "143,993" "$myHOST" "--script=imap-capabilities,imap-ntlm-info -sC -sS -sV --version-light"
|
||||
fuSCAN "30" "143,993" "$myHOST" "--script=imap-brute -sS"
|
||||
fuSCAN "240" "445" "$myHOST" "--script=smb-vuln* -sS -sU"
|
||||
fuSCAN "120" "502" "$myHOST" "--script=modbus-discover -sS -sU"
|
||||
fuSCAN "120" "623" "$myHOST" "--script=ipmi-cipher-zero,ipmi-version,supermicro-ipmi -sS -sU"
|
||||
fuSCAN "30" "623" "$myHOST" "--script=ipmi-brute -sS -sU"
|
||||
fuSCAN "120" "1433" "$myHOST" "--script=ms-sql* -sS"
|
||||
fuSCAN "120" "1723" "$myHOST" "--script=pptp-version -sS"
|
||||
fuSCAN "120" "1883" "$myHOST" "--script=mqtt-subscribe -sS"
|
||||
fuSCAN "120" "2404" "$myHOST" "--script=iec-identify -sS"
|
||||
fuSCAN "120" "3306" "$myHOST" "--script=mysql-vuln* -sC -sS -sV"
|
||||
fuSCAN "120" "3389" "$myHOST" "--script=rdp* -sC -sS -sV"
|
||||
fuSCAN "120" "5000" "$myHOST" "--script=*upnp* -sS -sU"
|
||||
fuSCAN "120" "5060,5061" "$myHOST" "--script=sip-call-spoof,sip-enum-users,sip-methods -sS -sU"
|
||||
fuSCAN "120" "5900" "$myHOST" "--script=vnc-info,vnc-title,realvnc-auth-bypass -sS"
|
||||
fuSCAN "120" "27017" "$myHOST" "--script=mongo* -sS"
|
||||
fuSCAN "120" "47808" "$myHOST" "--script=bacnet* -sS"
|
||||
wait
|
||||
reset
|
||||
echo "Done."
|
||||
126
docker/tpotinit/dist/bin/deprecated/import_kibana-objects.sh
vendored
Executable file
126
docker/tpotinit/dist/bin/deprecated/import_kibana-objects.sh
vendored
Executable file
@ -0,0 +1,126 @@
|
||||
#!/bin/bash
|
||||
# Import Kibana objects
|
||||
# Make sure ES is available
|
||||
myES="http://127.0.0.1:64298/"
|
||||
myKIBANA="http://127.0.0.1:64296/"
|
||||
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
|
||||
if ! [ "$myESSTATUS" = "1" ]
|
||||
then
|
||||
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
|
||||
exit
|
||||
else
|
||||
echo "### Elasticsearch is available, now continuing."
|
||||
echo
|
||||
fi
|
||||
|
||||
# Set vars
|
||||
myDUMP=$1
|
||||
myCOL1="[0;34m"
|
||||
myCOL0="[0;0m"
|
||||
|
||||
# Let's ensure normal operation on exit or if interrupted ...
|
||||
function fuCLEANUP {
|
||||
rm -rf patterns/ dashboards/ visualizations/ searches/ configs/
|
||||
}
|
||||
trap fuCLEANUP EXIT
|
||||
|
||||
# Check if parameter is given and file exists
|
||||
if [ "$myDUMP" = "" ];
|
||||
then
|
||||
echo $myCOL1"### Please provide a backup file name."$myCOL0
|
||||
echo $myCOL1"### import_kibana-objects.sh <kibana-objects.tgz>"$myCOL0
|
||||
echo
|
||||
exit
|
||||
fi
|
||||
if ! [ -a $myDUMP ];
|
||||
then
|
||||
echo $myCOL1"### File not found."$myCOL0
|
||||
exit
|
||||
fi
|
||||
|
||||
# Unpack tar
|
||||
tar xvfz $myDUMP > /dev/null
|
||||
|
||||
# Restore index patterns
|
||||
myINDEXID=$(ls patterns/*.json | cut -c 10- | rev | cut -c 6- | rev)
|
||||
myINDEXCOUNT=$(cat patterns/$myINDEXID.json | tr '\\' '\n' | grep -E "scripted|url" | wc -w)
|
||||
echo $myCOL1"### Now importing"$myCOL0 $myINDEXCOUNT $myCOL1"index pattern fields." $myCOL0
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/index-pattern/logstash-*' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @patterns/$myINDEXID.json > /dev/null &
|
||||
echo
|
||||
|
||||
# Restore dashboards
|
||||
myDASHBOARDS=$(ls dashboards/*.json | cut -c 12- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myDASHBOARDS | wc -w)$myCOL1 "dashboards." $myCOL0
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/dashboard/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/dashboard/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @dashboards/$i.json > /dev/null &
|
||||
done;
|
||||
wait
|
||||
echo
|
||||
|
||||
# Restore visualizations
|
||||
myVISUALIZATIONS=$(ls visualizations/*.json | cut -c 16- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myVISUALIZATIONS | wc -w)$myCOL1 "visualizations." $myCOL0
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/visualization/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/visualization/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @visualizations/$i.json > /dev/null &
|
||||
done;
|
||||
wait
|
||||
echo
|
||||
|
||||
# Restore searches
|
||||
mySEARCHES=$(ls searches/*.json | cut -c 10- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $mySEARCHES | wc -w)$myCOL1 "searches." $myCOL0
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/search/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/search/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @searches/$i.json > /dev/null &
|
||||
done;
|
||||
echo
|
||||
wait
|
||||
|
||||
# Restore configs
|
||||
myCONFIGS=$(ls configs/*.json | cut -c 9- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myCONFIGS | wc -w)$myCOL1 "configs." $myCOL0
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/configs/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/configs/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @configs/$i.json > /dev/null &
|
||||
done;
|
||||
echo
|
||||
wait
|
||||
|
||||
# Stats
|
||||
echo
|
||||
echo $myCOL1"### Statistics"
|
||||
echo $myCOL1"###### Imported"$myCOL0 $myINDEXCOUNT $myCOL1"index patterns." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
echo
|
||||
|
||||
Reference in New Issue
Block a user