#!/usr/bin/env python3
# For authorized penetration testing and educational environments only.
# Usage against targets without prior mutual consent is illegal.
# It is the end user's responsibility to obey all applicable local, state and federal laws.
"""Internal network penetration testing agent using nmap and impacket."""

import json
import argparse
import subprocess
import socket
from datetime import datetime


def run_nmap_scan(target, scan_type="quick"):
    """Run nmap network discovery and port scanning."""
    scan_args = {
        "quick": ["-sV", "-sC", "--top-ports", "100", "-T4"],
        "full": ["-sV", "-sC", "-p-", "-T3"],
        "stealth": ["-sS", "-Pn", "-T2", "--top-ports", "1000"],
    }
    args = scan_args.get(scan_type, scan_args["quick"])
    cmd = ["nmap"] + args + ["-oX", "-", target]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
        return {"status": "completed", "output": result.stdout[:2000]}
    except FileNotFoundError:
        return {"status": "error", "message": "nmap not installed"}
    except subprocess.TimeoutExpired:
        return {"status": "timeout"}


def check_smb_signing(target):
    """Check if SMB signing is required on target hosts."""
    cmd = ["nmap", "--script", "smb2-security-mode", "-p", "445", target]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        signing_disabled = "not required" in result.stdout.lower()
        return {
            "target": target,
            "smb_signing_required": not signing_disabled,
            "vulnerable_to_relay": signing_disabled,
            "severity": "HIGH" if signing_disabled else "INFO",
        }
    except (FileNotFoundError, subprocess.TimeoutExpired):
        return {"target": target, "error": "nmap scan failed"}


def check_llmnr_nbns(interface="eth0"):
    """Check for LLMNR/NBT-NS poisoning opportunities."""
    return {
        "check": "LLMNR/NBT-NS",
        "tool": "Responder",
        "command": f"responder -I {interface} -A",
        "risk": "Cleartext credential capture via name resolution poisoning",
        "severity": "HIGH",
        "mitigation": "Disable LLMNR via GPO, disable NBT-NS in network adapter settings",
    }


def enumerate_ad_info(dc_ip, domain, username, password):
    """Enumerate Active Directory information via LDAP."""
    try:
        import ldap3
        server = ldap3.Server(dc_ip, get_info=ldap3.ALL)
        conn = ldap3.Connection(server, user=f"{domain}\\{username}",
                                password=password, authentication=ldap3.NTLM, auto_bind=True)
        base_dn = ",".join([f"DC={p}" for p in domain.split(".")])
        conn.search(base_dn, "(objectClass=computer)", attributes=["cn", "operatingSystem"])
        computers = [{"name": str(e.cn), "os": str(e.operatingSystem)} for e in conn.entries]
        conn.search(base_dn, "(&(objectClass=user)(adminCount=1))",
                     attributes=["sAMAccountName"])
        admins = [str(e.sAMAccountName) for e in conn.entries]
        conn.unbind()
        return {"computers": computers[:20], "admin_accounts": admins, "total_hosts": len(computers)}
    except Exception as e:
        return {"error": str(e)}


def check_common_vulns(target):
    """Check for common internal network vulnerabilities."""
    checks = []
    for port, service in [(21, "FTP"), (23, "Telnet"), (80, "HTTP"), (3389, "RDP"),
                          (5900, "VNC"), (1433, "MSSQL"), (3306, "MySQL")]:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(2)
        try:
            sock.connect((target, port))
            checks.append({"port": port, "service": service, "status": "open"})
        except (socket.timeout, ConnectionRefusedError, OSError):
            pass
        finally:
            sock.close()
    return checks


def run_pentest(target, dc_ip=None, domain=None, username=None, password=None):
    """Execute internal network penetration test."""
    print(f"\n{'='*60}")
    print(f"  INTERNAL NETWORK PENETRATION TEST")
    print(f"  Target: {target}")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    ports = check_common_vulns(target)
    print(f"--- OPEN PORTS ({len(ports)}) ---")
    for p in ports:
        print(f"  Port {p['port']}/{p['service']}: {p['status']}")

    smb = check_smb_signing(target)
    print(f"\n--- SMB SIGNING ---")
    print(f"  Signing required: {smb.get('smb_signing_required', 'N/A')}")
    print(f"  Relay vulnerable: {smb.get('vulnerable_to_relay', 'N/A')}")

    llmnr = check_llmnr_nbns()
    print(f"\n--- LLMNR/NBT-NS ---")
    print(f"  Risk: {llmnr['risk']}")
    print(f"  Severity: {llmnr['severity']}")

    ad_info = {}
    if dc_ip and domain and username and password:
        ad_info = enumerate_ad_info(dc_ip, domain, username, password)
        print(f"\n--- AD ENUMERATION ---")
        print(f"  Total hosts: {ad_info.get('total_hosts', 0)}")
        print(f"  Admin accounts: {ad_info.get('admin_accounts', [])}")

    return {"ports": ports, "smb": smb, "llmnr": llmnr, "ad": ad_info}


def main():
    parser = argparse.ArgumentParser(description="Internal Network Pentest Agent")
    parser.add_argument("--target", required=True, help="Target IP or CIDR range")
    parser.add_argument("--dc-ip", help="Domain controller IP for AD enumeration")
    parser.add_argument("--domain", help="AD domain name")
    parser.add_argument("--username", help="AD username")
    parser.add_argument("--password", help="AD password")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    report = run_pentest(args.target, args.dc_ip, args.domain, args.username, args.password)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Internal Network Penetration Test — Automation Process

Automates network discovery, AD enumeration, and reporting for internal pentests.
Requires: nmap, netexec, ldap3, bloodhound-python.

Usage:
    python process.py --subnet 10.0.0.0/24 --domain corp.local --dc-ip 10.0.0.5 --output ./results
"""

import subprocess
import json
import os
import sys
import argparse
import socket
import datetime
from pathlib import Path
from typing import Optional


def run_command(cmd: list[str], timeout: int = 300) -> tuple[str, str, int]:
    """Execute a shell command and return stdout, stderr, return code."""
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout, result.stderr, result.returncode
    except subprocess.TimeoutExpired:
        return "", f"Command timed out after {timeout}s", -1
    except FileNotFoundError:
        return "", f"Command not found: {cmd[0]}", -1


def discover_hosts(subnet: str, output_dir: Path) -> list[str]:
    """Discover live hosts on the internal network."""
    print(f"[*] Discovering live hosts on {subnet}...")
    output_file = output_dir / "host_discovery"

    stdout, stderr, rc = run_command(
        ["nmap", "-sn", subnet, "-oA", str(output_file)], timeout=600
    )

    live_hosts = []
    gnmap = f"{output_file}.gnmap"
    if os.path.exists(gnmap):
        with open(gnmap) as f:
            for line in f:
                if "Status: Up" in line:
                    ip = line.split(" ")[1]
                    live_hosts.append(ip)

    hosts_file = output_dir / "live_hosts.txt"
    with open(hosts_file, "w") as f:
        f.write("\n".join(live_hosts))

    print(f"[+] Found {len(live_hosts)} live hosts")
    return live_hosts


def port_scan(hosts_file: str, output_dir: Path) -> dict:
    """Run port scan against discovered hosts."""
    print("[*] Running port scan on live hosts...")
    output_prefix = str(output_dir / "port_scan")

    stdout, stderr, rc = run_command(
        ["nmap", "-sS", "-sV", "-T4", "--top-ports", "1000",
         "-iL", hosts_file, "-oA", output_prefix],
        timeout=3600
    )

    return {"output_prefix": output_prefix, "return_code": rc}


def enumerate_smb_shares(hosts: list[str], username: str, password: str,
                          domain: str, output_dir: Path) -> list[dict]:
    """Enumerate SMB shares across internal hosts."""
    print("[*] Enumerating SMB shares...")
    results = []

    for host in hosts:
        stdout, stderr, rc = run_command(
            ["netexec", "smb", host, "-u", username, "-p", password,
             "-d", domain, "--shares"],
            timeout=30
        )
        if rc == 0 and stdout:
            results.append({"host": host, "output": stdout})

    output_file = output_dir / "smb_shares.json"
    with open(output_file, "w") as f:
        json.dump(results, f, indent=2)

    print(f"[+] Enumerated shares on {len(results)} hosts")
    return results


def check_smb_signing(hosts: list[str], output_dir: Path) -> list[dict]:
    """Check SMB signing status on discovered hosts."""
    print("[*] Checking SMB signing status...")
    results = []

    for host in hosts:
        stdout, stderr, rc = run_command(
            ["netexec", "smb", host, "--gen-relay-list",
             str(output_dir / "relay_targets.txt")],
            timeout=30
        )
        if "signing:False" in stdout:
            results.append({"host": host, "smb_signing": False})
        elif "signing:True" in stdout:
            results.append({"host": host, "smb_signing": True})

    output_file = output_dir / "smb_signing.json"
    with open(output_file, "w") as f:
        json.dump(results, f, indent=2)

    unsigned = [r for r in results if not r.get("smb_signing")]
    print(f"[+] Found {len(unsigned)} hosts without SMB signing")
    return results


def run_bloodhound_collection(username: str, password: str,
                                domain: str, dc_ip: str,
                                output_dir: Path) -> str:
    """Run BloodHound data collection."""
    print("[*] Running BloodHound collection...")
    stdout, stderr, rc = run_command(
        ["bloodhound-python", "-u", username, "-p", password,
         "-d", domain, "-ns", dc_ip, "-c", "all",
         "--output-prefix", str(output_dir / "bloodhound")],
        timeout=600
    )

    if rc == 0:
        print("[+] BloodHound data collected successfully")
    else:
        print(f"[-] BloodHound collection issue: {stderr[:200]}")

    return str(output_dir)


def check_password_policy(domain: str, dc_ip: str, username: str,
                           password: str) -> dict:
    """Retrieve domain password policy."""
    print("[*] Retrieving domain password policy...")
    stdout, stderr, rc = run_command(
        ["netexec", "smb", dc_ip, "-u", username, "-p", password,
         "-d", domain, "--pass-pol"],
        timeout=30
    )

    return {"output": stdout, "return_code": rc}


def generate_report(live_hosts: list[str], smb_results: list[dict],
                     signing_results: list[dict], output_dir: Path) -> str:
    """Generate internal pentest summary report."""
    print("[*] Generating report...")
    report_file = output_dir / "internal_pentest_report.md"
    timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")

    with open(report_file, "w") as f:
        f.write("# Internal Network Penetration Test Report\n\n")
        f.write(f"**Generated:** {timestamp}\n\n---\n\n")

        f.write("## Network Discovery\n\n")
        f.write(f"Total live hosts: **{len(live_hosts)}**\n\n")

        f.write("## SMB Share Analysis\n\n")
        f.write(f"Hosts with accessible shares: **{len(smb_results)}**\n\n")

        f.write("## SMB Signing Status\n\n")
        unsigned = [r for r in signing_results if not r.get("smb_signing")]
        f.write(f"Hosts without SMB signing: **{len(unsigned)}** (vulnerable to relay)\n\n")
        if unsigned:
            f.write("| Host | SMB Signing |\n|------|------------|\n")
            for r in unsigned:
                f.write(f"| {r['host']} | Disabled |\n")
            f.write("\n")

        f.write("## Recommendations\n\n")
        f.write("1. Enable SMB signing on all domain-joined systems via GPO\n")
        f.write("2. Disable LLMNR and NBT-NS across the domain\n")
        f.write("3. Implement LAPS for unique local admin passwords\n")
        f.write("4. Deploy tiered admin model for Active Directory\n")
        f.write("5. Enforce strong password policy (14+ characters)\n")
        f.write("6. Use Group Managed Service Accounts (gMSA)\n\n")

    print(f"[+] Report generated: {report_file}")
    return str(report_file)


def main():
    parser = argparse.ArgumentParser(description="Internal Network Pentest Automation")
    parser.add_argument("--subnet", required=True, help="Target subnet (CIDR)")
    parser.add_argument("--domain", required=True, help="AD domain name")
    parser.add_argument("--dc-ip", required=True, help="Domain controller IP")
    parser.add_argument("--username", default="", help="Domain username")
    parser.add_argument("--password", default="", help="Domain password")
    parser.add_argument("--output", default="./results", help="Output directory")
    args = parser.parse_args()

    output_dir = Path(args.output)
    output_dir.mkdir(parents=True, exist_ok=True)

    print("=" * 60)
    print(" Internal Network Penetration Test")
    print(f" Subnet: {args.subnet}")
    print(f" Domain: {args.domain}")
    print("=" * 60)

    live_hosts = discover_hosts(args.subnet, output_dir)
    port_scan(str(output_dir / "live_hosts.txt"), output_dir)

    smb_results = []
    signing_results = check_smb_signing(live_hosts[:50], output_dir)

    if args.username and args.password:
        smb_results = enumerate_smb_shares(
            live_hosts[:50], args.username, args.password, args.domain, output_dir
        )
        run_bloodhound_collection(
            args.username, args.password, args.domain, args.dc_ip, output_dir
        )
        check_password_policy(args.domain, args.dc_ip, args.username, args.password)

    generate_report(live_hosts, smb_results, signing_results, output_dir)
    print("\n[+] Internal pentest automation complete")


if __name__ == "__main__":
    main()