aikido bash script
#!/bin/bash
#based on a script by I.Verges
#made by prowl3r
#declare arrays
declare -a WHITE_IPS
declare -a WHITE_MACS
#set here (known) white ips (include the router one). No need to include local IP.
WHITE_IPS=( “192.168.1.1” “192.168.1.2” “192.168.1.3” )
#set here (known)white macs.
WHITE_MACS=( “00:11:22:33:44:55” “22:33:44:55:66” )
#Network interface (eth0, wlan0, ra0)
DEVICE=”eth0”
#network mask (24=255.255.255.0, 16=255.255.0.0)
MASK=24
#help
for opt in $@; do
if [ “$opt” = “-h” ]; then
echo “”
echo “aikido dirty script by prowl3r for those bt4f paranoids”
echo “”
echo “Create the daemon: ‘crontab -e’ and then add the following line:”
echo “*/5 * * * * /path-to-aikido/aikido”
echo “(execute every 5 minutes)”
echo “”
echo “Start cron just for this session: /etc/init.d/cron start”
echo “update-rc.d cron defaults (to start cron at boot time)”
echo “”
echo “Dont forget to set execution rights and run as root. English lang required”
echo “”
echo “To remove, edit crontab and delete aikido line”
echo “”
echo “It looks for connected hosts and records IP (and MAC if available).”
echo “Then confirms it’s a known IP, otherwise it nmap it and prompts for further actions.”
echo “Please, add your interface as well as known IPs and MACs by editing the script.”
echo “”
echo “Use: ./aikido”
echo “Options:”
echo ” -h Show this help stuff”
exit
fi
done
#obtain local ip
ip=$(/sbin/ifconfig “$DEVICE” | grep “inet” | awk ‘{print $2}’ | cut -c 6-)
#add local ip to array
WHITE_IPS[${#WHITE_IPS[*]}]=$ip
#get connected hosts and save them in “-” file (standar output)
#redirected to HOST_IPS variable
HOST_IPS=$(/usr/bin/nmap -sP ${WHITE_IPS[0]}/$MASK -oG -)
#cut to get only valid ip format
IPS=$(echo “$HOST_IPS” | grep Host | cut -c 7-20 | tr -d “\()”)
#count lines in archive, or in other words, ips in archive
counter=$(echo “$IPS” | wc -l - | cut -c 1-2)
total=$(expr $counter - 1)
#allow access to X from crontab
export DISPLAY=:0
export XAUTHORITY=”$HOME/.Xauthority”
#search loop
var=0
while [ $var -le $total ]; do
SKIP_LOOP=0
let var=$var+1
#capture ip by line
adds=$(echo “$IPS” | sed -n “$var p”)
#remove spaces
adds=${adds/ /}
for i in ${WHITE_IPS[*]}
do
if [ “$i” == “$adds” ]; then
SKIP_LOOP=1
break
fi
done
if [ “$SKIP_LOOP” == “1” ]; then
continue
fi
#obtain and format mac
ARP=$(/usr/sbin/arp -a $adds)
if [ “$ARP” == “arp: in 1 entries no match found.” ]; then
MAC=”Not cached yet”
else
MAC=$(echo “$ARP” | awk ‘{print $4}’)
MAC=${MAC/ /}
fi
for i in ${WHITE_MACS[*]}
do
if [ “$i” == “$MAC” ]; then
SKIP_LOOP=1
break
fi
done
if [ “$SKIP_LOOP” == “1” ]; then
continue
fi
#warn about intruder
WARNING=$(echo `/bin/date —rfc-3339=seconds`” \n HOST: $adds \n ARP: $MAC”)
zenity —timeout 20 —title “aikido: Intruder detected” —question —text “$WARNING \n\n*** Is this a known host? *** \n\n .- OK: No action will be taken \n .- Cancel: Full scan and log details”
case $? in
5)
echo “$WARNING” » /root/aikido.log
echo “*** Logged due to dialog timeout / unattended computer ***” » /root/aikido.log
echo “—————————————- x —————————————-” » /root/aikido.log;;
0)
zenity —title “aikido: Known/safe IP notification” —info —text “\n\nPlease add $adds to the whitelist by manually editing the aikido script, otherwise alerts will keep popping up at crontab execution.”;;
1)
SCAN=$(/usr/bin/nmap -A -T5 $adds)
echo “$WARNING” » /root/aikido.log
echo “$SCAN” » /root/aikido.log
echo “—————————————- x —————————————-” » /root/aikido.log
zenity —width 400 —title “aikido: Preliminary actions taken” —info —text “Host and port/services scan details logged at /root/aikido.log \n\n$WARNING \n\n$SCAN”
a=”Nah, I’ll take care myself (keep alert showing)”
b=”Try to autopwn using fast-track”
c=”Block this host with iptables”
d=”Capture tcpdump session for this host”
OPTION=$(zenity —width 380 —height 230 —title “aikido: Countermeasures” —list —text “Now for the fun part. What you wanna do?” —radiolist —column “Pick” —column “Action” TRUE “Nah, I’ll take care myself (keep alert showing)” FALSE “Try to autopwn using fast-track” FALSE “Block this host with iptables” FALSE “Capture tcpdump session for this host”)
case $OPTION in
$a) continue;;
$b) /opt/kde3/bin/konsole —vt_sz 80x40 -noclose —workdir /pentest/exploits/fasttrack/ -e sh -c ” python fast-track.py -c 2 $adds -r “;;
$c) tables=$(/sbin/iptables -A INPUT -s $adds -j DROP)
blocked=$(/sbin/iptables -L)
zenity —title “aikido: Blocked host notification” —info —text “$blocked”;;
$d) /usr/sbin/tcpdump -i $DEVICE host $adds -s 1500 -w /root/$adds.pcap &
zenity —title “aikido: Recording activity for host $adds” —info —text “\n\n *** To stop tcpdump recording, just press OK *** \n\n(Use the following command to replay: \n\ntcpdump -r /root/$adds.pcap)”
killall -9 tcpdump;;
esac;;
esac
done
