Initial commit

LICENSE.txt

@@ -0,0 +1,23 @@
+Copyright (c) 2015, Active Shadow LLC
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -1,2 +1,33 @@
-# maltego-nmap
-A few transforms and a machine for parsing Nmap XML results
+# Maltego Nmap Configuration
+
+A few Python-based Maltego transforms and a Maltego machine for parsing Nmap
+XML results into Maltego.
+
+Leverages the MaltegoTransform Python library located
+[here](https://github.com/sroberts/MaltegoTransform-Python).
+
+## Disclaimer
+
+I've only tested this on Kali...
+
+## Install
+
+Clone the repo or unpack the archive to `/opt/`, such that you now have
+`/opt/maltego-nmap`, and import `/opt/maltego-nmap/etc/maltego-nmap.mtz` into
+Maltego.
+
+This *should* create two transforms and a machine in Maltego.
+
+* Transforms
+  * `Nmap XML Parser`
+    - Operates on the `File` entity
+  * `Nmap Port Services`
+    - Operates on the `IPv4 Address` Entity
+* Machine
+  * `Nmap XML Parser`
+    - Expects a path to the Nmap XML file
+
+## Use
+
+From the `Run Machine` option, select `Nmap XML Parser` and enter the path to
+the Nmap XML file as the description.

units/MaltegoTransform.py

@@ -0,0 +1,170 @@
+#!/usr/bin/python 
+#######################################################
+# Maltego Python Local Transform Helper               #
+#   Version 0.2				              #
+#                                                     #
+# Local transform specification can be found at:      #
+#    http://ctas.paterva.com/view/Specification	      #
+#                                                     #
+# For more help and other local transforms            #
+# try the forum or mail me:                           #
+#                                                     #
+#   http://www.paterva.com/forum                      #
+#                                                     #
+#  Andrew MacPherson [ andrew <<at>> Paterva.com ]    #
+#                                                     #
+#######################################################
+import sys
+
+class MaltegoEntity(object):
+	value = "";
+	weight = 100;
+	displayInformation = ''
+	additionalFields = [];
+	iconURL = "";
+	entityType = "Phrase"
+
+	def __init__(self,eT=None,v=None):
+		if (eT is not None):
+			self.entityType = eT;
+		if (v is not None):
+			self.value = sanitise(v);
+		self.additionalFields = [];
+		self.displayInformation = ''
+
+	def setType(self,eT=None):
+		if (eT is not None):
+			self.entityType = eT;
+
+	def setValue(self,eV=None):
+		if (eV is not None):
+			self.value = sanitise(eV);
+
+	def setWeight(self,w=None):
+		if (w is not None):
+			self.weight = w;
+
+	def setDisplayInformation(self,di=None):
+		if (di is not None):
+			self.displayInformation = self.displayInformation+di;		
+
+	def addAdditionalFields(self,fieldName=None,displayName=None,matchingRule=False,value=None):
+		self.additionalFields.append([sanitise(fieldName),sanitise(displayName),matchingRule,sanitise(value)]);
+
+	def setIconURL(self,iU=None):
+		if (iU is not None):
+			self.iconURL = iU;
+
+	def returnEntity(self):
+		print "<Entity Type=\"" + str(self.entityType) + "\">";
+		print "<Value>" + str(self.value) + "</Value>";
+		print "<Weight>" + str(self.weight) + "</Weight>";
+		if (self.displayInformation is not None):
+			print "<DisplayInformation><Label Name=\"Transform Display Info\" Type=\"text/html\"><![CDATA[" + str(self.displayInformation) + "]]></Label></DisplayInformation>";
+		if (len(self.additionalFields) > 0):
+			print "<AdditionalFields>";
+			for i in range(len(self.additionalFields)):
+				if (str(self.additionalFields[i][2]) <> "strict"):
+					print "<Field Name=\"" + str(self.additionalFields[i][0]) + "\" DisplayName=\"" + str(self.additionalFields[i][1]) + "\">" + str(self.additionalFields[i][3]) + "</Field>";
+				else:
+					print "<Field MatchingRule=\"" + str(self.additionalFields[i][2]) + "\" Name=\"" + str(self.additionalFields[i][0]) + "\" DisplayName=\"" + str(self.additionalFields[i][1]) + "\">" + str(self.additionalFields[i][3]) + "</Field>";
+			print "</AdditionalFields>";
+		if (len(self.iconURL) > 0):
+			print "<IconURL>" + self.iconURL + "</IconURL>";
+		print "</Entity>";
+
+class MaltegoTransform(object):
+	entities = []
+	exceptions = []
+	UIMessages = []
+	values = {};
+
+	def __init__(self):
+		values = {};
+		value = None;
+
+	def parseArguments(self,argv):
+		if (argv[1] is not None):
+			self.value = argv[1];
+
+		if (len(argv) > 2):
+			if (argv[2] is not None):
+				vars = argv[2].split('#');
+				for x in range(0,len(vars)):
+					vars_values = vars[x].split('=')
+					if (len(vars_values) == 2):
+						self.values[vars_values[0]] = vars_values[1];
+
+	def getValue(self):
+		if (self.value is not None):
+			return self.value;
+
+	def getVar(self,varName):
+		if (varName in self.values.keys()):
+			if (self.values[varName] is not None):
+				return self.values[varName];
+
+	def addEntity(self,enType,enValue):
+		me = MaltegoEntity(enType,enValue);
+		self.addEntityToMessage(me);
+		return self.entities[len(self.entities)-1];
+
+	def addEntityToMessage(self,maltegoEntity):
+		self.entities.append(maltegoEntity);
+
+	def addUIMessage(self,message,messageType="Inform"):
+		self.UIMessages.append([messageType,message]);
+
+	def addException(self,exceptionString):
+		self.exceptions.append(exceptionString);
+
+	def throwExceptions(self):
+		print "<MaltegoMessage>";
+		print "<MaltegoTransformExceptionMessage>";
+		print "<Exceptions>"
+
+		for i in range(len(self.exceptions)):
+			print "<Exception>" + self.exceptions[i] + "</Exception>";
+		print "</Exceptions>"	
+		print "</MaltegoTransformExceptionMessage>";
+		print "</MaltegoMessage>";
+		exit();
+
+	def returnOutput(self):
+		print "<MaltegoMessage>";
+		print "<MaltegoTransformResponseMessage>";
+
+		print "<Entities>"
+		for i in range(len(self.entities)):
+			self.entities[i].returnEntity();
+		print "</Entities>"
+
+		print "<UIMessages>"
+		for i in range(len(self.UIMessages)):
+			print "<UIMessage MessageType=\"" + self.UIMessages[i][0] + "\">" + self.UIMessages[i][1] + "</UIMessage>";
+		print "</UIMessages>"
+
+		print "</MaltegoTransformResponseMessage>";
+		print "</MaltegoMessage>";
+
+	def writeSTDERR(self,msg):
+		sys.stderr.write(str(msg));
+
+	def heartbeat(self):
+		self.writeSTDERR("+");
+
+	def progress(self,percent):
+		self.writeSTDERR("%" + str(percent));
+
+	def debug(self,msg):
+		self.writeSTDERR("D:" + str(msg));
+
+
+
+def sanitise(value):
+	replace_these = ["&",">","<"];
+	replace_with = ["&amp;","&gt;","&lt;"];
+	tempvalue = value;
+	for i in range(0,len(replace_these)):
+		tempvalue = tempvalue.replace(replace_these[i],replace_with[i]);
+	return tempvalue;

units/nmap_port_services.py

@@ -0,0 +1,16 @@
+from MaltegoTransform import *
+
+m = MaltegoTransform()
+m.parseArguments(sys.argv)
+
+ports = m.getVar('service.ports') # string
+ports = ports.split('|')  # array
+
+for port in ports:
+  port, name = port.split('::')
+
+  svc = m.addEntity('maltego.Service', port)
+  svc.addAdditionalFields("port.number", "Port", "strict", port)
+  svc.addAdditionalFields("banner.text", "Service Banner", "strict", name)
+
+m.returnOutput()

units/nmap_xml_parser.py

@@ -0,0 +1,40 @@
+from MaltegoTransform import *
+from lxml             import etree
+
+m = MaltegoTransform()
+m.parseArguments(sys.argv)
+
+filename = m.getValue()
+document = etree.parse(filename)
+
+for host in document.xpath("//host[ports/port[state[@state='open']]]"):
+  iface = None
+
+  for addr in host.xpath("address[@addrtype='ipv4']"):
+    iface = m.addEntity("maltego.IPv4Address", addr.attrib['addr'])
+
+  if iface != None:
+    ports = []
+
+    for port in host.xpath("ports/port[state[@state='open']]"):
+      pnum = port.attrib['portid']
+      name = []
+
+      try:
+        svc = port.xpath("service")[0]
+
+        try:
+          name.append(svc.attrib['product'])
+          name.append(svc.attrib['version'])
+          name.append(svc.attrib['extrainfo'])
+        except KeyError:
+          if len(' '.join(name)) == 0:
+            name.append(svc.attrib['name'])
+      except:
+        pass
+
+      ports.append("%s::%s" % (pnum, ' '.join(name)))
+
+    iface.addAdditionalFields("service.ports", "Listening Ports", "strict", '|'.join(ports))
+
+m.returnOutput()