<repo_name>x0xr00t/HTB-CTF-Bot<file_sep>/ToDo.md
In short a crap load. Muhaha. Is there a need or want to continue this project.

- Scan.php need to figure out how slack processes the php results as html and \r does not process to seperate php output.
- Add scans as subprocesses with wait commands to make sure the user knwos it is running and the system waits till completed.
- Add error checking to the code
  - Check to see if VPN is up and start if not.
  - Maybe test malicious scan requests for security  (once all done)
- Add additional modules for enumeration.
 - directory checking
 - additional nmap with scripts
 - check exploit-db / search sploit for vulns.
 - exploiting
 - shared shells
- Add a DB or other storage for storing executed scans and have the system check locally before rescanning / unless forced. 
<file_sep>/scan.php
<?php
##########################################
## HTB SLackBot v1.0 DigitalOffensive
## This file is for the intitial scan
##########################################
# Values passed by Slack
#########################################
#token= your token <-- fidn in slack or tcpdump is your friend
#team_id=
#team_domain=
#enterprise_id
#enterprise_name=
#channel_id=  channel id it came from
#channel_name= channel name it came from
#user_id= user id it came from
#user_name= user id it came from
#command= commadn executed ie. /scan
#text= data to be ran by the command
#response_url=
#trigger_id=


//Make sure it is your app connecting to you by validating token
if ($_POST["token"] == "your_token_goes_here") {
	echo 'User: ' . htmlspecialchars($_POST["user_name"]) . ' Requested me to enumerate ' . htmlspecialchars($_POST["text"]) . '!';
} else {
	echo "You tried to execute a script without being authorized!";
	die;
}
//Validate input is equal to a IP address and launch the python scan in the background
if (filter_var($_POST["text"], FILTER_VALIDATE_IP)) {
	$cmd = ("python3 scan.py "  . $_POST["text"] . " " .  $_POST["user_name"] . "> /dev/null 2>/dev/null &");
	exec($cmd);
} else {
	echo($_POST["text"] . 'is not a valid IP address, please enter a valid IP');
	die;
}
?>
<file_sep>/scan.py
import nmap
import requests
import slack
import os
import sys
import subprocess

#slack chat function
def schat (arg1):
   client = slack.WebClient(token = "your_OA_Token_goes_here")
   response = client.chat_postMessage(
    channel = '#secbot',
    text = (arg1)
    )
   return;

if len(sys.argv) < 3:
    schat("Error IP not passed to Script\r\n")
    sys.exit(1)
schat("*HTB CTF Bot 1.0: Has been Started*\r" + "*User:* " + sys.argv[2] + " *Requested the asset* " + sys.argv[1] + " *to be enumerated*\r" + "*-=[ Scanning of:* " + sys.argv[1] + " *has started*\r")

# initialize the port scanner
nmScan = nmap.PortScanner()

# scan localhost for ports in range 21-443
nmScan.scan(sys.argv[1])

# run a loop to print all the found result about the ports
for host in nmScan.all_hosts():
     #print('Host : %s (%s)' % (host, nmScan[host].hostname()))
     #print('State : %s' % nmScan[host].state())
     sH = ('Host : %s (%s)' % (host, nmScan[host].hostname()))
     sHs = ('State : %s' % nmScan[host].state())
     #print (sH +"\r\n" + sHs + "\r\n")
     schat(sH +"\r\n" + sHs + "\r\n")
     
     for proto in nmScan[host].all_protocols():
      #   print('----------')
       #  print('Protocol : %s' % proto)
 
         lport = nmScan[host][proto].keys()
         data = sorted(lport)
         for port in data:
            pdata = ('port : %s\tstate : %s' % (port, nmScan[host][proto][port]['state']))
            client = slack.WebClient(token = "your_OA_Token_goes_here"")
            response = client.chat_postMessage(
            channel='#secbot',
            text = (pdata +"\r\n")
            )
schat("*-=[ Port Scaning of:* " + sys.argv[1] + " *has completed*\r")
if str(nmScan[sys.argv[1]].has_tcp(80)) == "True":
    cmd = ("python3 webenum.py " + sys.argv[1] + " 80" )
    proc = subprocess.Popen([cmd], stdout=subprocess.PIPE, shell=True)
    (out, err) = proc.communicate()
else:
    print ("not found")
<file_sep>/webenum.py
import nmap
import requests
import slack
import os
import sys
import subprocess
import re

#slack chat function
def schat (arg1):
   client = slack.WebClient(token = "<PASSWORD>co<PASSWORD>")
   response = client.chat_postMessage(
    channel = '#secbot',
    text = (arg1)
    )
   return;

#Recieve variables from scan.py (IP & PORT)

if len(sys.argv) < 3:
    schat("Error IP not passed to Script\r\n")
    sys.exit(1)
schat("*HTB CTF 1.0: Web Enumeration Started:*\r" + "Enumerating: " + sys.argv[1] + " on port  " + sys.argv[2] + "\r" + "*------------------------------------------*\r")

#WhatWeb Output

cmd = ("whatweb --color=never -a 3 " + sys.argv[1] + ":" +sys.argv[2])
proc = subprocess.Popen([cmd], stdout=subprocess.PIPE, shell=True)
(out, err) = proc.communicate()
result = re.findall(r'b\'(.*?)\\n', str(out))
schat("*WhatWeb Results:*\r " + result[0])
#schat(result)
<file_sep>/README.md
# HTB-CTF-Bot
Project I created to create a HTB bot for teams to use for working on challenges.

This project has alot of moving parts and is still far from a beta release. I have started to add modules and work on testing while developing the code.  Currently this is use at your own risk. You will need to do some manually configuration as this is not offered as an official slack app, meaning you will need to host your own backend and create your own / commands.

Technology pre-requisits
- Server where you can run a web server with php and python.
- This was developed on Ubuntu 18.
- nmap installed
- openvpn
- additional HTB account

Python Requirements
- Python 3
- pip3
- slack web client
- python-nmap

Slack
- Create a channel for your bot
- Give the bot the ability to create, write, message
- Get token
- Get incoming web hook
- Create slack / commands for each function. IE. /scan 
-- ./scan 10.10.10.157
--- this will call http://myhost/scap.php?=

Running:

Make sure you are connected to the HTB vpn
copy all files to /var/www/html
make files executable
Use common sense in securing them <-- No pentesting has been done to assure it cant be abused at current time :). Your Welcome!
Create / commands in your slac instance
Enter your slack channel and type the command /scan 10.10.10.x (replace x with host to scan)
