Recon/Invoke-Portscan.ps1
|
function Invoke-Portscan { <# .SYNOPSIS Simple portscan module PowerSploit Function: Invoke-Portscan Author: Rich Lundeen (http://webstersProdigy.net) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None .DESCRIPTION Does a simple port scan using regular sockets, based (pretty) loosely on nmap .PARAMETER Hosts Include these comma seperated hosts (supports IPv4 CIDR notation) or pipe them in .PARAMETER HostFile Input hosts from file rather than commandline .PARAMETER ExcludeHosts Exclude these comma seperated hosts .PARAMETER Ports Include these comma seperated ports (can also be a range like 80-90) .PARAMETER PortFile Input ports from a file .PARAMETER TopPorts Include the x top ports - only goes to 1000, default is top 50 .PARAMETER ExcludedPorts Exclude these comma seperated ports .PARAMETER SkipDiscovery Treat all hosts as online, skip host discovery .PARAMETER PingOnly Ping scan only (disable port scan) .PARAMETER DiscoveryPorts Comma separated ports used for host discovery. -1 is a ping .PARAMETER Threads number of max threads for the thread pool (per host) .PARAMETER nHosts number of hosts to concurrently scan .PARAMETER Timeout Timeout time on a connection in miliseconds before port is declared filtered .PARAMETER SleepTimer Wait before thread checking, in miliseconds .PARAMETER SyncFreq How often (in terms of hosts) to sync threads and flush output .PARAMETER T [0-5] shortcut performance options. Default is 3. higher is more aggressive. Sets (nhosts, threads,timeout) 5 {$nHosts=30; $Threads = 1000; $Timeout = 750 } 4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 } 3 {$nHosts=20; $Threads = 100; $Timeout = 2500 } 2 {$nHosts=15; $Threads = 32; $Timeout = 3000 } 1 {$nHosts=10; $Threads = 32; $Timeout = 5000 } .PARAMETER GrepOut Greppable output file .PARAMETER XmlOut output XML file .PARAMETER ReadableOut output file in 'readable' format .PARAMETER AllformatsOut output in readable (.nmap), xml (.xml), and greppable (.gnmap) formats .PARAMETER noProgressMeter Suppresses the progress meter .PARAMETER quiet supresses returned output and don't store hosts in memory - useful for very large scans .PARAMETER ForceOverwrite Force Overwrite if output Files exist. Otherwise it throws exception .EXAMPLE C:\PS> Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50 Description ----------- Scans the top 50 ports for hosts found for webstersprodigy.net,google.com, and microsoft.com .EXAMPLE C:\PS> echo webstersprodigy.net | Invoke-Portscan -oG test.gnmap -f -ports "80,443,8080" Description ----------- Does a portscan of "webstersprodigy.net", and writes a greppable output file .EXAMPLE C:\PS> Invoke-Portscan -Hosts 192.168.1.1/24 -T 4 -TopPorts 25 -oA localnet Description ----------- Scans the top 20 ports for hosts found in the 192.168.1.1/24 range, outputs all file formats .LINK http://webstersprodigy.net #> [CmdletBinding()]Param ( #Host, Ports [Parameter(ParameterSetName="cmdHosts", ValueFromPipeline=$True, Mandatory = $True)] [String[]] $Hosts, [Parameter(ParameterSetName="fHosts", Mandatory = $True)] [Alias("iL")] [String] $HostFile, [Parameter(Mandatory = $False)] [Alias("exclude")] [String] $ExcludeHosts, [Parameter(Mandatory = $False)] [Alias("p")] [String] $Ports, [Parameter(Mandatory = $False)] [Alias("iP")] [String] $PortFile, [Parameter(Mandatory = $False)] [String] $TopPorts, [Parameter(Mandatory = $False)] [Alias("xPorts")] [String] $ExcludedPorts, #Host Discovery [Parameter(Mandatory = $False)] [Alias("Pn")] [Switch] $SkipDiscovery, [Parameter(Mandatory = $False)] [Alias("sn")] [Switch] $PingOnly, [Parameter(Mandatory = $False)] [Alias("PS")] [string] $DiscoveryPorts = "-1,445,80,443", #Timing and Performance [Parameter(Mandatory = $False)] [int] $Threads = 100, [Parameter(Mandatory = $False)] [int] $nHosts = 25, [Parameter(Mandatory = $False)] [int] $Timeout = 2000, [Parameter(Mandatory = $False)] [int] $SleepTimer = 500, [Parameter(Mandatory = $False)] [int] $SyncFreq = 1024, [Parameter(Mandatory = $False)] [int] $T, #Output [Parameter(Mandatory = $False)] [Alias("oG")] [String] $GrepOut, [Parameter(Mandatory = $False)] [Alias("oX")] [String] $XmlOut, [Parameter(Mandatory = $False)] [Alias("oN")] [String] $ReadableOut, [Parameter(Mandatory = $False)] [Alias("oA")] [String] $AllformatsOut, [Parameter(Mandatory = $False)] [Switch] $noProgressMeter, [Parameter(Mandatory = $False)] [Alias("q")] [Switch] $quiet, [Parameter(Mandatory = $False)] [Alias("F")] [Switch] $ForceOverwrite #TODO add script parameter #TODO add resume parameter ) PROCESS { Set-StrictMode -Version 2.0 $version = .13 $hostList = New-Object System.Collections.ArrayList $portList = New-Object System.Collections.ArrayList $hostPortList = New-Object System.Collections.ArrayList $scannedHostList = @() function Parse-Hosts { Param ( [Parameter(Mandatory = $True)] [String] $Hosts ) [String[]] $iHosts = $Hosts.Split(",") foreach($iHost in $iHosts) { $iHost = $iHost.Replace(" ", "") if(!$iHost) { continue } if($iHost.contains("/")) { $netPart = $iHost.split("/")[0] [uint32]$maskPart = $iHost.split("/")[1] $address = [System.Net.IPAddress]::Parse($netPart) if ($maskPart -ge $address.GetAddressBytes().Length * 8) { throw "Bad host mask" } $numhosts = [System.math]::Pow(2,(($address.GetAddressBytes().Length *8) - $maskPart)) $startaddress = $address.GetAddressBytes() [array]::Reverse($startaddress) $startaddress = [System.BitConverter]::ToUInt32($startaddress, 0) [uint32]$startMask = ([System.math]::Pow(2, $maskPart)-1) * ([System.Math]::Pow(2,(32 - $maskPart))) $startAddress = $startAddress -band $startMask #in powershell 2.0 there are 4 0 bytes padded, so the [0..3] is necessary $startAddress = [System.BitConverter]::GetBytes($startaddress)[0..3] [array]::Reverse($startaddress) $address = [System.Net.IPAddress] [byte[]] $startAddress $hostList.Add($address.IPAddressToString) for ($i=0; $i -lt $numhosts-1; $i++) { $nextAddress = $address.GetAddressBytes() [array]::Reverse($nextAddress) $nextAddress = [System.BitConverter]::ToUInt32($nextAddress, 0) $nextAddress ++ $nextAddress = [System.BitConverter]::GetBytes($nextAddress)[0..3] [array]::Reverse($nextAddress) $address = [System.Net.IPAddress] [byte[]] $nextAddress $hostList.Add($address.IPAddressToString) } } else { $hostList.Add($iHost) } } } function Parse-ILHosts { Param ( [Parameter(Mandatory = $True)] [String] $HostFile ) Get-Content $HostFile | ForEach-Object { Parse-Hosts $_ } } function Exclude-Hosts { Param ( [Parameter(Mandatory = $True)] [String] $excludeHosts ) [String[]] $iHosts = $excludeHosts.Split(",") foreach($iHost in $iHosts) { $iHost = $iHost.Replace(" ", "") $hostList.Remove($iHost) } } function Get-TopPort { Param ( [Parameter(Mandatory = $True)] [ValidateRange(1,1000)] [int] $numPorts ) #list of top 1000 ports from nmap from Jun 2013 [int[]] $topPortList = @(80,23,443,21,3389,110,445,139,143,53,135,3306,8080,22 1723,111,995,993,5900,1025,1720,548,113,81,6001,179,1026,2000,8443, 8000,32768,554,26,1433,49152,2001,515,8008,49154,1027,5666,646,5000, 5631,631,49153,8081,2049,88,79,5800,106,2121,1110,49155,6000,513, 990,5357,49156,543,544,5101,144,7,389,8009,9999,5009,7070,5190,3000, 5432,1900,3986,13,1029,9,5051,6646,49157,1028,873,1755,2717,4899,9100, 119,37,1000,3001,5001,82,10010,1030,9090,2107,1024,2103,6004,1801, 5050,19,8031,1041,255,1048,1049,1053,1054,1056,1064,3703,17,808,3689, 1031,1044,1071,5901,100,9102,2869,4001,5120,8010,9000,2105,636,1038, 2601,1,7000,1066,1069,625,311,280,254,4000,1761,5003,2002,1998,2005, 1032,1050,6112,1521,2161,6002,2401,902,4045,787,7937,1058,2383,1033, 1040,1059,50000,5555,1494,3,593,2301,3268,7938,1022,1234,1035,1036,1037, 1074,8002,9001,464,497,1935,2003,6666,6543,24,1352,3269,1111,407,500, 20,2006,1034,1218,3260,15000,4444,264,33,2004,1042,42510,999,3052,1023, 222,1068,888,7100,1717,992,2008,7001,2007,8082,512,1043,2009,5801,1700, 7019,50001,4662,2065,42,2602,3333,9535,5100,2604,4002,5002,1047,1051,1052, 1055,1060,1062,1311,3283,4443,5225,5226,6059,6789,8089,8651,8652,8701,9415, 9593,9594,9595,16992,16993,20828,23502,32769,33354,35500,52869,55555,55600, 64623,64680,65000,65389,1067,13782,366,5902,9050,85,1002,5500,1863,1864, 5431,8085,10243,45100,49999,51103,49,90,6667,1503,6881,27000,340,1500,8021, 2222,5566,8088,8899,9071,5102,6005,9101,163,5679,146,648,1666,83,3476,5004, 5214,8001,8083,8084,9207,14238,30,912,12345,2030,2605,6,541,4,1248,3005,8007, 306,880,2500,1086,1088,2525,4242,8291,9009,52822,900,6101,2809,7200,211,800, 987,1083,12000,705,711,20005,6969,13783,1045,1046,1061,1063,1070,1072,1073, 1075,1077,1078,1079,1081,1082,1085,1093,1094,1096,1098,1099,1100,1104,1106, 1107,1108,1148,1169,1272,1310,1687,1718,1783,1840,2100,2119,2135,2144,2160, 2190,2260,2381,2399,2492,2607,2718,2811,2875,3017,3031,3071,3211,3300,3301, 3323,3325,3351,3404,3551,3580,3659,3766,3784,3801,3827,3998,4003,4126,4129, 4449,5222,5269,5633,5718,5810,5825,5877,5910,5911,5925,5959,5960,5961,5962, 5987,5988,5989,6123,6129,6156,6389,6580,6901,7106,7625,7777,7778,7911,8086, 8181,8222,8333,8400,8402,8600,8649,8873,8994,9002,9011,9080,9220,9290,9485, 9500,9502,9503,9618,9900,9968,10002,10012,10024,10025,10566,10616,10617,10621, 10626,10628,10629,11110,13456,14442,15002,15003,15660,16001,16016,16018,17988, 19101,19801,19842,20000,20031,20221,20222,21571,22939,24800,25734,27715,28201, 30000,30718,31038,32781,32782,33899,34571,34572,34573,40193,48080,49158,49159, 49160,50003,50006,50800,57294,58080,60020,63331,65129,691,212,1001,1999,2020, 2998,6003,7002,50002,32,2033,3372,99,425,749,5903,43,458,5405,6106,6502,7007, 13722,1087,1089,1124,1152,1183,1186,1247,1296,1334,1580,1782,2126,2179,2191,2251, 2522,3011,3030,3077,3261,3493,3546,3737,3828,3871,3880,3918,3995,4006,4111,4446, 5054,5200,5280,5298,5822,5859,5904,5915,5922,5963,7103,7402,7435,7443,7512,8011, 8090,8100,8180,8254,8500,8654,9091,9110,9666,9877,9943,9944,9998,10004,10778,15742, 16012,18988,19283,19315,19780,24444,27352,27353,27355,32784,49163,49165,49175, 50389,50636,51493,55055,56738,61532,61900,62078,1021,9040,666,700,84,545,1112, 1524,2040,4321,5802,38292,49400,1084,1600,2048,2111,3006,6547,6699,9111,16080, 555,667,720,801,1443,1533,2106,5560,6007,1090,1091,1114,1117,1119,1122,1131,1138, 1151,1175,1199,1201,1271,1862,2323,2393,2394,2608,2725,2909,3003,3168,3221,3322, 3324,3390,3517,3527,3800,3809,3814,3826,3869,3878,3889,3905,3914,3920,3945,3971, 4004,4005,4279,4445,4550,4567,4848,4900,5033,5080,5087,5221,5440,5544,5678,5730, 5811,5815,5850,5862,5906,5907,5950,5952,6025,6510,6565,6567,6689,6692,6779,6792, 6839,7025,7496,7676,7800,7920,7921,7999,8022,8042,8045,8093,8099,8200,8290,8292, 8300,8383,9003,9081,9099,9200,9418,9575,9878,9898,9917,10003,10180,10215,11111, 12174,12265,14441,15004,16000,16113,17877,18040,18101,19350,25735,26214,27356, 30951,32783,32785,40911,41511,44176,44501,49161,49167,49176,50300,50500,52673, 52848,54045,54328,55056,56737,57797,60443,70,417,714,722,777,981,1009,2022,4224, 4998,6346,301,524,668,765,2041,5999,10082,259,1007,1417,1434,1984,2038,2068,4343, 6009,7004,44443,109,687,726,911,1461,2035,4125,6006,7201,9103,125,481,683,903, 1011,1455,2013,2043,2047,6668,6669,256,406,843,2042,2045,5998,9929,31337,44442, 1092,1095,1102,1105,1113,1121,1123,1126,1130,1132,1137,1141,1145,1147,1149,1154, 1164,1165,1166,1174,1185,1187,1192,1198,1213,1216,1217,1233,1236,1244,1259,1277, 1287,1300,1301,1309,1322,1328,1556,1641,1688,1719,1721,1805,1812,1839,1875,1914, 1971,1972,1974,2099,2170,2196,2200,2288,2366,2382,2557,2800,2910,2920,2968,3007, 3013,3050,3119,3304,3307,3376,3400,3410,3514,3684,3697,3700,3824,3846,3848,3859, 3863,3870,3872,3888,3907,3916,3931,3941,3957,3963,3968,3969,3972,3990,3993,3994, 4009,4040,4080,4096,4143,4147,4200,4252,4430,4555,4600,4658,4875,4949,5040,5063, 5074,5151,5212,5223,5242,5279,5339,5353,5501,5807,5812,5818,5823,5868,5869,5899, 5905,5909,5914,5918,5938,5940,5968,5981,6051,6060,6068,6203,6247,6500,6504,6520, 6550,6600) $numPorts-- $portList.AddRange($topPortList[0..$numPorts]) } function Parse-Ports { Param ( [Parameter(Mandatory = $True)] [String] $Ports, [Parameter(Mandatory = $True)] $pList ) foreach ($pRange in $Ports.Split(",")) { #-1 is a special case for ping if ($pRange -eq "-1") { $pList.Add([int]$pRange) } elseif ($pRange.Contains("-")) { [int[]] $range = $pRange.Split("-") if ($range.Count -ne 2 -or $pRange.Split("-")[0] -eq "" -or $pRange.split("-")[1] -eq "") { throw "Invalid port range" } $pList.AddRange($range[0]..$range[1]) } else { $pList.Add([int]$pRange) } } foreach ($p in $pList) { if ($p -lt -1 -or $p -gt 65535) { throw "Port $p out of range" } } } function Parse-IpPorts { Param ( [Parameter(Mandatory = $True)] [String] $PortFile ) Get-Content $PortFile | ForEach-Object { Parse-Ports -Ports $_ -pList $portList } } function Remove-Ports { Param ( [Parameter(Mandatory = $True)] [string] $ExcludedPorts ) [int[]] $ExcludedPorts = $ExcludedPorts.Split(",") foreach ($x in $ExcludedPorts) { $portList.Remove($x) } } function Write-PortscanOut { Param ( [Parameter(Mandatory = $True, ParameterSetName="Comment")] [string] $comment, [Parameter(Mandatory = $True, ParameterSetName="HostOut")] [string] $outhost, [Parameter(Mandatory = $True, ParameterSetName="HostOut")] [bool] $isUp, [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $openPorts, [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $closedPorts, [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $filteredPorts, [Parameter()] [bool] $SkipDiscovery, [Parameter()] [System.IO.StreamWriter] $grepStream, [Parameter()] [System.Xml.XmlWriter] $xmlStream, [Parameter()] [System.IO.StreamWriter] $readableStream ) switch ($PSCmdlet.ParameterSetName) { "Comment" { Write-Verbose $comment if ($grepStream) { $grepStream.WriteLine("# " + $comment) } if ($xmlStream) { $xmlStream.WriteComment($comment) } if ($readableStream) { $readableStream.WriteLine($comment) } } "HostOut" { $oPort = [string]::join(",", $openPorts.ToArray()) $cPort = [string]::join(",", $closedPorts.ToArray()) $fPort = [string]::join(",", $filteredPorts.ToArray()) if ($grepStream) { #for grepstream use tabs - can be ugly, but easier for regex if ($isUp -and !$SkipDiscovery) { $grepStream.writeline("Host: $outhost`tStatus: Up") } if ($isUp -or $SkipDiscovery) { if ($oPort -ne "") { $grepStream.writeline("Host: $outhost`tOpen Ports: $oPort") } if ($cPort -ne "") { $grepStream.writeline("Host: $outhost`tClosed Ports: $cPort") } if ($fPort -ne "") { $grepStream.writeline("Host: $outhost`tFiltered Ports: $fPort") } } elseif (!$SkipDiscovery) { $grepStream.writeline("Host: $outhost`tStatus: Down") } } if ($xmlStream) { $xmlStream.WriteStartElement("Host") $xmlStream.WriteAttributeString("id", $outhost) if (!$SkipDiscovery) { if ($isUp) { $xmlStream.WriteAttributeString("Status", "Up") } else { $xmlStream.WriteAttributeString("Status", "Downs") } } $xmlStream.WriteStartElement("Ports") foreach($p in $openPorts) { $xmlStream.writestartElement("Port") $xmlStream.WriteAttributeString("id", [string]$p) $xmlStream.WriteAttributeString("state", "open") $xmlStream.WriteEndElement() } foreach ($p in $closedPorts) { $xmlStream.writestartElement("Port") $xmlStream.WriteAttributeString("id", [string]$p) $xmlStream.WriteAttributeString("state", "closed") $xmlStream.WriteEndElement() } foreach ($p in $filteredPorts) { $xmlStream.writestartElement("Port") $xmlStream.WriteAttributeString("id", [string]$p) $xmlStream.WriteAttributeString("state", "filtered") $xmlStream.WriteEndElement() } $xmlStream.WriteEndElement() $xmlStream.WriteEndElement() } if ($readableStream) { $readableStream.writeline("Porscan.ps1 scan report for $outhost") if ($isUp) { $readableStream.writeline("Host is up") } if ($isUp -or $SkipDiscovery) { $readableStream.writeline(("{0,-10}{1,0}" -f "PORT", "STATE")) [int[]]$allports = $openPorts + $closedPorts + $filteredPorts foreach($p in ($allports| Sort-Object)) { if ($openPorts.Contains($p)) { $readableStream.writeline(("{0,-10}{1,0}" -f $p, "open")) } elseif ($closedPorts.Contains($p)) { $readableStream.writeline(("{0,-10}{1,0}" -f $p, "closed")) } elseif ($filteredPorts.Contains($p)) { $readableStream.writeline(("{0,-10}{1,0}" -f $p, "filtered")) } } } elseif(!$SkipDiscovery) { $readableStream.writeline("Host is Down") } $readableStream.writeline("") } } } } #function for Powershell v2.0 to work function Convert-SwitchtoBool { Param ( [Parameter(Mandatory = $True)] $switchValue ) If ($switchValue) { return $True } return $False } try { [bool] $SkipDiscovery = Convert-SwitchtoBool ($SkipDiscovery) [bool] $PingOnly = Convert-SwitchtoBool ($PingOnly) [bool] $quiet = Convert-SwitchtoBool ($quiet) [bool] $ForceOverwrite = Convert-SwitchtoBool ($ForceOverwrite) ######### #parse arguments ######### [Environment]::CurrentDirectory=(Get-Location -PSProvider FileSystem).ProviderPath if ($PsCmdlet.ParameterSetName -eq "cmdHosts") { foreach($h in $Hosts) { Parse-Hosts($h) | Out-Null } } else { Parse-ILHosts($HostFile) | Out-Null } if($ExcludeHosts) { Exclude-Hosts($ExcludeHosts) } if (($TopPorts -and $Ports) -or ($TopPorts -and $PortFile)) { throw "Cannot set topPorts with other specific ports" } if($Ports) { Parse-Ports -Ports $Ports -pList $portList | Out-Null } if($PortFile) { Parse-IpPorts($PortFile) | Out-Null } if($portList.Count -eq 0) { if ($TopPorts) { Get-TopPort($TopPorts) | Out-Null } else { #if the ports still aren't set, give the deftault, top 50 ports Get-TopPort(50) | Out-Null } } if ($ExcludedPorts) { Remove-Ports -ExcludedPorts $ExcludedPorts | Out-Null } if($T) { switch ($T) { 5 {$nHosts=30; $Threads = 1000; $Timeout = 750 } 4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 } 3 {$nHosts=20; $Threads = 100; $Timeout = 2500 } 2 {$nHosts=15; $Threads = 32; $Timeout = 3000 } 1 {$nHosts=10; $Threads = 32; $Timeout = 5000 } default { throw "Invalid T parameter" } } } $grepStream = $null $xmlStream = $null $readableStream = $null if($AllformatsOut) { if ($GrepOut -or $XmlOut -or $ReadableOut) { Write-Warning "Both -oA specified with other output... going to ignore -oG/-oN/-oX" } $GrepOut = $AllformatsOut + ".gnmap" $XmlOut = $AllformatsOut + ".xml" $ReadableOut = $AllformatsOut + ".nmap" } if ($GrepOut) { if (!$ForceOverwrite -and (Test-Path $GrepOut)) { throw "Error: $AllformatsOut already exists. Either delete the file or specify the -f flag" } $grepStream = [System.IO.StreamWriter] $GrepOut } if ($ReadableOut) { if (!$ForceOverwrite -and (Test-Path $ReadableOut)) { throw "Error: $ReadableOut already exists. Either delete the file or specify the -f flag" } $readableStream = [System.IO.StreamWriter] $ReadableOut } if ($XmlOut) { if (!$ForceOverwrite -and (Test-Path $XmlOut)) { throw "Error: $XmlOut already exists. Either delete the file or specify the -f flag" } $xmlStream = [System.xml.xmlwriter]::Create([string]$XmlOut) $xmlStream.WriteStartDocument() $xmlStream.WriteStartElement("Portscanrun") $xmlStream.WriteAttributeString("version", $version) } Parse-Ports -Ports $DiscoveryPorts -pList $hostPortList | Out-Null $startdate = Get-Date $myInvocationLine = $PSCmdlet.MyInvocation.Line $startMsg = "Invoke-Portscan.ps1 v$version scan initiated $startdate as: $myInvocationLine" #TODO deal with output Write-PortscanOut -comment $startMsg -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream #converting back from int array gives some argument error checking $sPortList = [string]::join(",", $portList) $sHostPortList = [string]::join(",", $hostPortList) ######## #Port Scan Code - run on a per host basis ######## $portScanCode = { param ( [Parameter( Mandatory = $True)] [string] $thost, [Parameter( Mandatory = $True)][bool] $SkipDiscovery, [Parameter( Mandatory = $True)][bool] $PingOnly, [Parameter( Mandatory = $True)][int] $Timeout, [Parameter( Mandatory = $True)] $PortList, [Parameter( Mandatory = $True)] $hostPortList, [Parameter( Mandatory = $True)][int] $maxthreads) Process { $openPorts = New-Object System.Collections.ArrayList $closedPorts = New-Object System.Collections.ArrayList $filteredPorts = New-Object System.Collections.ArrayList $sockets = @{} $timeouts = New-Object Hashtable #set maximum $async threads $fThreads = New-Object int $aThreads = New-Object int [System.Threading.ThreadPool]::GetMaxThreads([ref]$fThreads, [ref]$aThreads) | Out-Null [System.Threading.ThreadPool]::SetMaxThreads($fthreads,$maxthreads) | Out-Null function New-ScriptBlockCallback { param( [parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] [scriptblock]$Callback ) #taken from http://www.nivot.org/blog/post/2009/10/09/PowerShell20AsynchronousCallbacksFromNET if (-not ("CallbackEventBridge" -as [type])) { Add-Type @" using System; public sealed class CallbackEventBridge { public event AsyncCallback CallbackComplete = delegate { }; private CallbackEventBridge() {} private void CallbackInternal(IAsyncResult result) { CallbackComplete(result); } public AsyncCallback Callback { get { return new AsyncCallback(CallbackInternal); } } public static CallbackEventBridge Create() { return new CallbackEventBridge(); } } "@ } $bridge = [CallbackEventBridge]::Create() Register-ObjectEvent -InputObject $bridge -EventName CallbackComplete -Action $Callback | Out-Null $bridge.Callback } function Test-Port { Param ( [Parameter(Mandatory = $True)] [String] $h, [Parameter(Mandatory = $True)] [int] $p, [Parameter(Mandatory = $True)] [int] $timeout ) try { $pAddress = [System.Net.IPAddress]::Parse($h) $sockets[$p] = new-object System.Net.Sockets.TcpClient $pAddress.AddressFamily } catch { #we're assuming this is a host name $sockets[$p] = new-object System.Net.Sockets.TcpClient } $scriptBlockAsString = @" #somewhat of a race condition with the timeout, but I don't think it matters if ( `$sockets[$p] -ne `$NULL) { if (!`$timeouts[$p].Disposed) { `$timeouts[$p].Dispose() } `$status = `$sockets[$p].Connected; if (`$status -eq `$True) { #write-host "$p is open" `$openPorts.Add($p) } else { #write-host "$p is closed" `$closedPorts.Add($p) } `$sockets[$p].Close(); `$sockets.Remove($p) } "@ $timeoutCallback = @" #write-host "$p is filtered" `$sockets[$p].Close() if (!`$timeouts[$p].Disposed) { `$timeouts[$p].Dispose() `$filteredPorts.Add($p) } `$sockets.Remove($p) "@ $timeoutCallback = [scriptblock]::Create($timeoutCallback) $timeouts[$p] = New-Object System.Timers.Timer Register-ObjectEvent -InputObject $timeouts[$p] -EventName Elapsed -Action $timeoutCallback | Out-Null $timeouts[$p].Interval = $timeout $timeouts[$p].Enabled = $true $myscriptblock = [scriptblock]::Create($scriptBlockAsString) $x = $sockets[$p].beginConnect($h, $p,(New-ScriptBlockCallback($myscriptblock)) , $null) } function PortScan-Alive { Param ( [Parameter(Mandatory = $True)] [String] $h ) Try { #ping if ($hostPortList.Contains(-1)) { $ping = new-object System.Net.NetworkInformation.Ping $pResult = $ping.send($h) if ($pResult.Status -eq "Success") { return $True } } foreach($Port in $hostPortList) { if ($Port -ne -1) { Test-Port -h $h -p $Port -timeout $Timeout } } do { Start-Sleep -Milli 100 if (($openPorts.Count -gt 0) -or ($closedPorts.Count -gt 0)) { return $True } } While ($sockets.Count -gt 0) } Catch { Write-Error "Exception trying to host scan $h" Write-Error $_.Exception.Message; } return $False } function Portscan-Port { Param ( [Parameter(Mandatory = $True)] [String] $h ) [string[]]$Ports = @() foreach($Port in $Portlist) { Try { Test-Port -h $h -p $Port -timeout $Timeout } Catch { Write-Error "Exception trying to scan $h port $Port" Write-Error $_.Exception.Message; } } } [bool] $hostResult = $False if(!$SkipDiscovery) { [bool] $hostResult = PortScan-Alive $thost $openPorts.clear() $closedPorts.clear() $filteredPorts.Clear() } if((!$PingOnly) -and ($hostResult -or $SkipDiscovery)) { Portscan-Port $thost } while ($sockets.Count -gt 0) { Start-Sleep -Milli 500 } return @($hostResult, $openPorts, $closedPorts, $filteredPorts) } } # the outer loop is to flush the loop. # Otherwise Get-Job | Wait-Job could clog, etc [int]$saveIteration = 0 [int]$computersDone=0 [int]$upHosts=0 while (($saveIteration * $SyncFreq) -lt $hostList.Count) { Get-Job | Remove-Job -Force $sIndex = ($saveIteration*$SyncFreq) $eIndex = (($saveIteration+1)*$SyncFreq)-1 foreach ($iHost in $hostList[$sIndex..$eIndex]) { $ctr = @(Get-Job -state Running) while ($ctr.Count -ge $nHosts) { Start-Sleep -Milliseconds $SleepTimer $ctr = @(Get-Job -state Running) } $computersDone++ if(!$noProgressMeter) { Write-Progress -status "Port Scanning" -Activity $startMsg -CurrentOperation "starting computer $computersDone" -PercentComplete ($computersDone / $hostList.Count * 100) } Start-Job -ScriptBlock $portScanCode -Name $iHost -ArgumentList @($iHost, $SkipDiscovery, $PingOnly, $Timeout, $portList, $hostPortList, $Threads) | Out-Null } Get-Job | Wait-Job | Out-Null foreach ($job in Get-Job) { $jobOut = @(Receive-Job $job) [bool]$hostUp = $jobOut[0] $jobName = $job.Name $openPorts = $jobOut[1] $closedPorts = $jobOut[2] $filteredPorts = $jobOut[3] if($hostUp) { $upHosts ++ } if (!$quiet) { $hostDate = Get-Date $hostObj = New-Object System.Object $hostObj | Add-Member -MemberType Noteproperty -Name Hostname -Value $jobName $hostObj | Add-Member -MemberType Noteproperty -Name alive -Value $hostUp $hostObj | Add-Member -MemberType Noteproperty -Name openPorts -Value $openPorts $hostObj | Add-Member -MemberType Noteproperty -Name closedPorts -Value $closedPorts $hostObj | Add-Member -MemberType Noteproperty -Name filteredPorts -Value $filteredPorts $hostObj | Add-Member -MemberType NoteProperty -Name finishTime -Value $hostDate $scannedHostList += $hostobj } Write-PortscanOut -outhost $jobName -isUp $hostUp -openPorts $openPorts -closedPorts $closedPorts -filteredPorts $filteredPorts -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream -SkipDiscovery $SkipDiscovery } if ($grepStream) { $grepStream.flush() } if ($xmlStream) { $xmlStream.flush() } if($readableStream) { $readableStream.flush() } $saveIteration ++ } $enddate = Get-Date $totaltime = ($enddate - $startdate).TotalSeconds $endMsg = "Port scan complete at $enddate ($totaltime seconds)" if (!$SkipDiscovery) { $endMsg += ", $upHosts hosts are up" } Write-PortscanOut -comment $endMsg -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream if($grepStream) { $grepStream.Close() } if ($xmlStream) { $xmlStream.Close() } if($readableStream) { $readableStream.Close() } return $scannedHostList } Catch { Write-Error $_.Exception.Message; } } } |