def render_to_file_and_deploy(self):
username = ''
password = ''
try:
username, acc, password = \
netrc.netrc().authenticators(self._device.name)
account = Account(name=username, password=password, key=None)
except Exception, e:
print e
print("ERROR: could not find device in ~/.netrc file")
print("HINT: either update .netrc or enter username + pass now.")
try:
account = read_login()
except EOFError:
print("ERROR: could not find proper username + pass")
print("HINT: set username & pass in ~/.netrc for device %s"
% self._device.name)
sys.exit(2)
def deploy(hostname=None, acls=None, transport='ssh', save_config=False):
"""
Deploy code in a safe way o a Cisco IOS device.
"""
try:
username, enable_pass, password = \
netrc.netrc().authenticators(hostname)
account = Account(name=username, password=password,
password2=enable_pass)
except:
account = read_login()
def s(conn, line):
print(" %s" % line)
conn.execute(line)
def collect_interfaces(conn):
template = """# textfsm
Value Required Aclname ([^ ]+)
Value Required Direction ([^ ]+)
Value Required Interface (.*)
Start
^access-group ${Aclname} ${Direction} interface ${Interface} -> Record Start
"""
template_file = StringIO(template)
table = textfsm.TextFSM(template_file)
conn.execute('show run | include ^access-group')
map_acl_int = {}
for aclname, direction, interface in table.ParseText(conn.response):
if aclname in map_acl_int.keys():
map_acl_int[aclname].append({"dir": direction,
"int": interface})
else:
map_acl_int[aclname] = [{"dir": direction, "int": interface}]
return map_acl_int
# main flow of the program starts here
if transport == 'ssh':
conn = SSH2(verify_fingerprint=False, debug=0)
elif transport == 'telnet':
conn = Telnet(debug=0)
else:
print("ERROR: Unknown transport mechanism: %s" %
transport)
sys.exit(2)
conn.set_driver('ios')
conn.connect(hostname)
try:
conn.login(account)
except LoginFailure:
print("ERROR: Username or Password incorrect for %s" % hostname)
print("HINT: verify authentication details in your .netrc file")
sys.exit(2)
s(conn, "terminal pager 0")
map_pol_int = collect_interfaces(conn)
pprint(map_pol_int)
def lock_step(lock, pol):
name = acls[pol]['name']
afi = acls[pol]['afi']
policy = acls[pol]['policy']
print("INFO: uploading name: %s, afi: %s" % (name, afi))
s(conn, 'configure terminal')
if afi == 4:
try:
s(conn, "clear configure access-list %s%s" % (lock, name))
except:
pass
for line in policy.split('\n'):
if lock:
line = line.replace("access-list %s " % name,
"access-list %s%s " % (lock, name))
s(conn, line)
if afi == 6:
try:
s(conn, "clear configure ipv6 access-list %s%s" % (lock, name))
except:
pass
for line in policy.split('\n'):
if lock:
line = line.replace("access-list %s " % name,
"access-list %s%s " % (lock, name))
s(conn, line)
s(conn, "end")
# then replace ACL on all interfaces / VTYs
if name in map_pol_int:
for entry in map_pol_int[name]:
print("INFO: lockstepping policy %s afi %s" % (name, afi))
s(conn, "configure terminal")
s(conn, "access-group %s%s %s interface %s"
% (lock, name, entry['dir'], entry['int']))
s(conn, "end")
for policy in acls:
for lock in ["LOCKSTEP-", ""]:
lock_step(lock, policy)
# cleanup
s(conn, "configure terminal")
if acls[policy]['afi'] == 4:
s(conn, "clear configure access-list LOCKSTEP-%s"
% acls[policy]['name'])
if acls[policy]['afi'] == 6:
s(conn, "clear configure ipv6 access-list LOCKSTEP-%s"
% acls[policy]['name'])
s(conn, "end")
if save_config == True:
s(conn, "write")
def deploy(hostname=None, acls=None, transport='ssh', save_config=False,
timeout=60):
"""
Deploy code in a safe way o a Cisco IOS device.
"""
try:
username, enable_pass, password = \
netrc.netrc().authenticators(hostname)
account = Account(name=username, password=password,
password2=enable_pass)
except:
print("ERROR: could not find device in ~/.netrc file")
print("HINT: either update .netrc or enter username + pass now.")
try:
account = read_login()
except EOFError:
print("ERROR: could not find proper username + pass")
print("HINT: set username & pass in ~/.netrc for device %s"
% hostname)
import sys
sys.exit(2)
def s(conn, line):
print(" %s" % line)
conn.execute(line)
def collect_interfaces(conn):
template = """# textfsm
Value Required Interface ([^ ]+)
Value Inbound (.*)
Value Outbound (.*)
Start
^${Interface} is up
^ Outgoing access list is ${Outbound}
^ Inbound access list is ${Inbound} -> Record Start
"""
template_file = StringIO(template)
table = textfsm.TextFSM(template_file)
s(conn, 'show ip int | inc ine pro|list is')
interface_acl_v4 = table.ParseText(conn.response)
template = """# textfsm
Value Required Interface ([^ ]+)
Value Inbound (.*)
Value Outbound (.*)
Start
^${Interface} is up
^ Inbound access list ${Inbound}
^ Outgoing access list ${Outbound} -> Record Start
"""
template_file = StringIO(template)
table = textfsm.TextFSM(template_file)
s(conn, 'show ipv6 int | i ine pro|access list')
interface_acl_v6 = table.ParseText(conn.response)
template = """# textfsm
Value Required Vty (\d+\s\d+)
Value Inbound4 ([^ ]+)
Value Outbound4 ([^ ]+)
Value Inbound6 ([^ ]+)
Value Outbound6 ([^ ]+)
Start
^line vty ${Vty}
^ access-class ${Inbound4} in
^ access-class ${Outbound4} out
^ ipv6 access-class ${Inbound6} in
^ ipv6 access-class ${Outbound6} out -> Record Start
"""
template_file = StringIO(template)
table = textfsm.TextFSM(template_file)
s(conn, 'show run | begin ^line vty')
interface_acl_vty = table.ParseText(conn.response)
results = {4: interface_acl_v4, 6: interface_acl_v6}
# add vty lines
for vty in interface_acl_vty:
# v4 inbound
v4_inbound = vty[1] if vty[1] else "not set"
v4_outbound = vty[2] if vty[1] else "not set"
v6_inbound = vty[3] if vty[1] else "not set"
v6_outbound = vty[4] if vty[1] else "not set"
results[4].append(["vty %s" % vty[0], v4_inbound, v4_outbound])
results[6].append(["vty %s" % vty[0], v6_inbound, v6_outbound])
return results
# main flow of the program starts here
if transport == 'ssh':
conn = SSH2(verify_fingerprint=False, debug=0, timeout=timeout)
elif transport == 'telnet':
conn = Telnet(debug=0)
else:
print("ERROR: Unknown transport mechanism: %s"
% transport)
sys.exit(2)
conn.set_driver('ios')
conn.connect(hostname)
conn.login(account)
conn.execute('terminal length 0')
conn.auto_app_authorize(account)
capabilities = {}
s(conn, "show ipv6 cef")
capabilities['ipv6'] = False if "%IPv6 CEF not running" in conn.response else True
if capabilities['ipv6']:
print("INFO: IPv6 support detected")
else:
print("INFO: NO IPv6 support detected, skipping IPv6 ACLs")
# map into structure:
# policyname { (int, afi, direction) }
map_pol_int = {}
interfaces_overview = collect_interfaces(conn)
for afi in interfaces_overview:
for interface, inbound, outbound in interfaces_overview[afi]:
# add inbound rules to map
if inbound not in map_pol_int.keys():
map_pol_int[inbound] = [{"int": interface,
"afi": afi,
"dir": "in"}]
else:
map_pol_int[inbound].append({"int": interface,
"afi": afi,
"dir": "in"})
# add outbound
if outbound not in map_pol_int.keys():
map_pol_int[outbound] = [{"int": interface,
"afi": afi,
"dir": "in"}]
else:
map_pol_int[outbound].append({"int": interface,
"afi": afi,
"dir": "out"})
print("INFO: interface / policy mapping:")
pprint(map_pol_int)
def lock_step(lock, pol, capabilities):
name = acls[pol]['name']
afi = acls[pol]['afi']
if afi == 6 and not capabilities['ipv6']:
return
policy = acls[pol]['policy']
print("INFO: uploading name: %s, afi: %s" % (name, afi))
s(conn, 'configure terminal')
if afi == 4:
try:
s(conn, "no ip access-list extended %s%s" % (lock, name))
except:
pass
s(conn, "ip access-list extended %s%s" % (lock, name))
for line in policy.split('\n'):
s(conn, line)
if afi == 6:
try:
s(conn, "no ipv6 access-list %s%s" % (lock, name))
except:
pass
s(conn, "ipv6 access-list %s%s" % (lock, name))
for line in policy.split('\n'):
s(conn, line)
s(conn, "end")
# then replace ACL on all interfaces / VTYs
if name in map_pol_int:
for entry in map_pol_int[name]:
if not entry['afi'] == afi:
continue
print("INFO: lockstepping policy %s afi %s" % (name, afi))
s(conn, "configure terminal")
if entry['int'].startswith('vty '):
s(conn, "line %s" % entry['int'])
if afi == 4:
s(conn, "access-class %s%s %s"
% (lock, name, entry['dir']))
if afi == 6:
s(conn, "ipv6 access-class %s%s %s"
% (lock, name, entry['dir']))
else:
s(conn, "interface %s" % entry['int'])
if afi == 4:
s(conn, "ip access-group %s%s %s"
% (lock, name, entry['dir']))
if afi == 6:
s(conn, "ipv6 traffic-filter %s%s %s"
% (lock, name, entry['dir']))
s(conn, "end")
for policy in acls:
for lock in ["LOCKSTEP-", ""]:
lock_step(lock, policy, capabilities)
# cleanup
s(conn, "configure terminal")
if acls[policy]['afi'] == 4:
s(conn, "no ip access-list extended LOCKSTEP-%s"
% acls[policy]['name'])
if acls[policy]['afi'] == 6 and capabilities['ipv6']:
s(conn, "no ipv6 access-list LOCKSTEP-%s"
% acls[policy]['name'])
s(conn, "end")
if save_config == True:
s(conn, "write")
def main():
args = args_parser()
print_banner()
host = args.host
port = args.port
username = args.username
password = args.password
privatekey = args.privatekey
passphrase = args.passphrase
keytype = args.keytype
ssh = args.ssh
telnet = args.telnet
category = args.category
plugin = args.plugin
if plugin and (category == None):
sys.exit(RED + '\n[!] No category\n' + ENDC)
# Set host
if host == None:
host = raw_input('set host' + BLUE + ' > ' + ENDC)
# Set service
if (ssh == False) and (telnet == False):
service = raw_input('set service [ssh|telnet]' + BLUE + ' > ' + ENDC)
if service.lower() == 'ssh':
ssh = True
elif service.lower() == 'telnet':
telnet = True
if ssh:
conn = SSH2()
elif telnet:
conn = Telnet()
else:
sys.exit(RED + '\n[!] Bad service type. Options: [ssh|telnet]\n' + ENDC)
# Set username
if username == None:
username = raw_input('set username' + BLUE + ' > ' + ENDC)
# Set password
if (password == None) and (privatekey == None):
password = getpass.getpass('set password (leave blank to enter a private key)' + BLUE + ' > ' + ENDC)
#set privatekey
if (password == None):
#set privatekey
if (privatekey == None):
privatekey = getpass.getpass('set private key path' + BLUE + ' > ' + ENDC)
#set passphrase
if (passphrase == None):
passphrase = getpass.getpass('set private key passphrase (optional)' + BLUE + ' > ' + ENDC)
#set keytype
if (keytype == None):
keytype = raw_input('set keytype (optional)' + BLUE + ' > ' + ENDC)
if (keytype != "") and (passphrase != ""):
key = PrivateKey.from_file(privatekey, password=passphrase, keytype=keytype)
elif (keytype != ""):
key = PrivateKey.from_file(privatekey, password=passphrase)
else:
key = PrivateKey.from_file(privatekey)
else:
key = None
# Create account
account = Account(username, password, key = key)
# Connect and login
conn.connect(host, port)
conn.login(account)
# Try to disable history for current shell session
conn.execute('unset HISTFILE')
# Print info about used Exscript driver
driver = conn.get_driver()
print BLUE + '\n[i] Using driver: ' + ENDC + driver.name
# Set logs directory
logs_path = LOGS_PATH + '/' + host + '-' + str(int(time.time()))
if category:
print BLUE + '\n[i] Plugins category: ' + ENDC + category + '\n'
dict_categories = {}
dict_plugins = {}
# Run single plugin
if plugin:
try:
eval_file(conn, INSTALL_PATH + '/plugins/' + category + '/' + plugin)
dict_plugins[plugin] = conn.response
print ' %-20s' % (plugin) + '[' + GREEN + 'ok' + ENDC + ']'
except:
print ' %-20s' % (plugin) + '[' + RED + 'ko' + ENDC + ']'
pass
dict_categories[category] = dict_plugins
# Run plugins by single category
else:
for plugin in sorted(os.listdir(INSTALL_PATH + '/plugins/' + category)):
try:
eval_file(conn, INSTALL_PATH + '/plugins/' + category + '/' + plugin)
dict_plugins[plugin] = conn.response
print ' %-20s' % (plugin) + '[' + GREEN + 'ok' + ENDC + ']'
except:
print ' %-20s' % (plugin) + '[' + RED + 'ko' + ENDC + ']'
pass
dict_categories[category] = dict_plugins
# Run all plugins by category
if (category == None) and (plugin == None):
dict_categories = {}
for category in sorted(os.listdir(INSTALL_PATH + '/plugins')):
print BLUE + '\n[i] Plugins category: ' + ENDC + category + '\n'
dict_plugins = {}
for plugin in sorted(os.listdir(INSTALL_PATH + '/plugins/' + category)):
try:
eval_file(conn, INSTALL_PATH + '/plugins/' + category + '/' + plugin)
dict_plugins[plugin] = conn.response
print ' %-20s' % (plugin) + '[' + GREEN + 'ok' + ENDC + ']'
except:
print ' %-20s' % (plugin) + '[' + RED + 'ko' + ENDC + ']'
pass
dict_categories[category] = dict_plugins
# Exit and close remote connection
conn.send('exit\r')
conn.close()
# Generate report
html_report(dict_categories, logs_path)
print BLUE + '\n[i] Report saved to: ' + ENDC + logs_path + '/index.html\n'