Write an Automated Script to Perform a Vulnerability Scan and Log the Results

Note: Please provide the lab an extra 1-2 minutes before logging in to make sure the lab is fully provisioned. A local SSH terminal must be used for this lab (This lab cannot use the Instant Terminal). You will find the necessary login credentials on the lab page.

Create and open a file /home/cloud_user/ourScript.py.

vim /home/cloud_user/ourScript.py

Define which interpreter is to be used for the script.

#!/bin/python3.6

import subprocess
import socket

Get Apache web server version.

def get_apache_version():       
    return subprocess.check_output(['httpd', '-v'], stdin=None, stderr=None, shell=False, universal_newlines=True)

Get SELinux status.

def get_selinux_status():
    return subprocess.check_output(['getenforce'], stdin=None, stderr=None, shell=False, universal_newlines=True)

Get the current firewall configuration for the default zone.

def get_firewall_rules():
    return subprocess.check_output(['firewall-cmd', '--list-all'], stdin=None, stderr=None, shell=False, universal_newlines=True)

Create a function to find a line containing a string in a file.

def find_line_in_file(file_path, str_to_find):
        for line in open(file_path):
                if str_to_find in line:
                        return line

Get the port number from the ssh configuration file.

sshd_config = "/etc/ssh/sshd_config"

def get_ssh_port():
    return find_line_in_file(sshd_config, "Port")

Get PermitRootLogin.

def get_root_login():
    return find_line_in_file(sshd_config, "PermitRootLogin")

Get the value of PasswordAuthentication.

def get_ssh_password_config():
    return find_line_in_file(sshd_config, "PasswordAuthentication")

Get the ports in ssh_port_t.

def get_selinux_ssh_port_label():
return subprocess.check_output(['sepolicy', 'network', '-t', 'ssh_port_t'], stdin=None, stderr=None, shell=False, universal_newlines=True)

Get the public IP address of the server.

def get_server_IP():
    s = socket.socket(socket.AF_INET, 	socket.SOCK_DGRAM)
    s.connect(("8.8.8.8", 80))
    return s.getsockname()[0]

Save and quit.

ESC
:wq
ENTER

Install Nmap.

sudo yum install nmap

Change directory to /usr/share/nmap/scripts/.

cd /usr/share/nmap/scripts/

Clone https://github.com/vulnersCom/nmap-vulners.git and https://github.com/scipag/vulscan.git

sudo git clone https://github.com/vulnersCom/nmap-vulners.git

sudo git clone https://github.com/scipag/vulscan.git

vim /home/cloud_user/ourScript.py

def vuln_scan():
    serverIP = get_server_IP() 
    return subprocess.check_output(['nmap', '--script', 'vulscan', '--script-args', 'vulscandb=scipvuldb.csv', '-sV', '-p80', serverIP], stdin=None, stderr=None, shell=False, universal_newlines=True)

Log file path.

log_file="/home/cloud_user/ourLog.log"

def generate_report():
    apache_version = get_apache_version()
    selinux_status = get_selinux_status()
    firewall_rules = get_firewall_rules()
    ssh_port = get_ssh_port()
    permit_root_login = get_root_login()
    permit_pass_auth = get_ssh_password_config() 
    selinux_label = get_selinux_ssh_port_label()
    nmapScan = vuln_scan()
    
    log_record = apache_version + "\n" + selinux_status + "\n" + firewall_rules + "\n" + ssh_port + "\n" + permit_root_login + "\n" + permit_pass_auth + "\n" + selinux_label + "\n" + 
    nmapScan
    
    text_file=open(log_file, "w")
    text_file.write(log_record)
    text_file.close()
    
    print(apache_version)
    print("SELinux Status: " + selinux_status)
    print("Firewall - Default Zone\n " + 	firewall_rules)
    print("SSH Port: " + str(ssh_port))
    print("Password Authentication: " + 	str(permit_pass_auth))
    print("SELinux Label: " + selinux_label)
    print(nmapScan)

generate_report()

Save and close.

ESC
:wq
ENTER

Change permissions on the file.

chmod 700 /home/cloud_user/ourScript.py

sudo ./ourScript.py