Automatic nmap scanning

[PeterZielony]

So this is one of the first templates i'd like to share

We needed some nmap scanning so i decided to integrate it with zabbix to be notified if one port had been open.

This is still work in progress - there are no triggers but after the initial test, it seems like it's working nicely.

So how does it work
there is a powershell script that need to setting up IP address of zabbix, URL and API key to zabbix - this script will be triggered by windows scheduler. Host have to have environmental value for Nmap.exe. Nmap takes right now only default values

zabbix_sender need to be present from machine we scanning from (and in PS var points to it)

Template will create 2x trapper items - names can be changed easily but there is a section in PS script where they are referenced.

We need also need macro {$ALLOWED.PORTS} assigned to the host and values of the ports that can be open with comma-separated ports like: 80,90,443 etc. Host will be skipped if macro doesn't exist - host will be scanned one-by-one so we dont overdo netowork

To enable scanning we need to assign them to a new host group called "PortScanGroup" - feel free to adjust code so you can search for hosts by template. I wanted them in separate host groups really to enable/disable.


PS script when run will create a folder with logs and XML files from nmap in the directory specified in PS script.




This is just the 1st release of this template - I will be working on it and fixing few things like:
-adding macro to template (oh forgot to do it),
-when host is disabled - skip it
-when host has more than one IP addresses (127.0.0.1 is already disabled from scanning) - so nmap can scan them all if needed
-adjusting logs to they are more readable and consistent
-maybe linux support? currently works on windows
-expand more options to nmap




So the workflow is like this:
get hostgroup id and then get all hosts
get IP addresses
scan with nmap with XML output
get macro value per host
read XML and compare with Macro value
if there is port that is not in macro - script will send this port number to hosts item


Approach with windows scheduler was because we cannot run PS scripts that are run too long (we can via hackery but not bothered) - this is controlled purely by windows task scheduler - feel free to adapt to your own case and take "magic vars" out so can be passed to script instead for security

enjoy

[PeterZielony]

Added condition to check if host is monitored by proxy or not - then it gets IP to send data to it instead Zabbix server - sending directly doesn't work when host is being monitored by proxy.

Added TLS option if it is monitored by proxy only - we have local unencrypted traffic but all of remote proxies/hosts are using TLS. You can change this in the code to do it for all hosts - I'll be working with this later to detect if host is with TLS or not - i don't need it for local but you can easily change this in code.
tls for key path and identity inluded on top of the script

added timer controlled by $WaitTimePerHost var in minutes. For example if its set to 10 minutes and scan takes 3 min per host it will wait 7 min until it starts with another host - just small throttling here. 0 means disabled wait

Cleaned some logging to include times when scan started, finished and how long it took to scan host.

Corrected template - didn't know it needed uuids etc. so the previous one is broken.

Edit: ill be working at some point to tidy up api calls so i can do less than currently

[HASHTAG="t4154"]edit[/HASHTAG] added a condition to skip if the host is disabled or under maintenance

[PeterZielony]

Cleaned a bit.

Removed unnecessary API call to retrieve IP addresses for the host.

Now script will detect if hosts are using TLS or not (had no chance to do SSL ones), and will send data to relevant proxies (also autodetected)

Noticed that it doesn't send date to host when scan is finished. Will fix it today, and if I'll got more time I'll setup more options for nmap
Edit: fixed

[vijayk]

Hi, Is it return the result in Zabbix server or in Windows created directory?

[PeterZielony]

Hi, Is it return the result in Zabbix server or in Windows created directory?

it saves XML file generated by nmap (saved it locally)
Then script reads XML and parse open ports and send them directly to zabbix server (or proxy if host is monitored by proxy)


XML:



then there is a trigger if anything comes to this item it will trigger an alert for each port if it doesn't exists in {$ALLOWED.PORTS} macro for this host




temp location for logs and XML can be controlled by this var:

Logs like this:

screenshots from testing

All settings are on top of the script

#For API calls use URL
$ZabbixServer = "http://zabbix.local/"
[HASHTAG="t17"]zabbix[/HASHTAG] server endpoint for sending data via zabbix_sender
$ZabbixServerIP = ""
[HASHTAG="t279"]api[/HASHTAG] Key
$ZabbixApiKey = ""
[HASHTAG="t3997"]path[/HASHTAG] to Zabbix_sender
$Zabbix_sender = 'C:\Program Files\Zabbix Agent 2\zabbix_sender.exe'
[HASHTAG="t3997"]path[/HASHTAG] to PSK key
$Zabbix_PSK = "C:\Program Files\Zabbix Agent 2\psk.key"
$Zabbix_PSK_Identity = ""

# Zabbix host group from which scan will take IPs
$SourceHostGroup = "PortScanGroup"
# Item key used to receive(trapper item) Unauthorised Ports not specified in {$ALLOWED.PORTS} macro
$HostItemKeyPort = "UnauthorisedPort"
# Item key used to receive(trapper item) date/time when scan is completed
$HostItemKeyFinished = "LastScannedPorts"
# Min time allocated per scan. If time is exceeded per host then next scan will start immediately after finishing current one
# 0 disable wait
$WaitTimePerHost = 0
# Temporary directory to store nmap scan results in xml and log files
$TempDirectory = "C:\Temp\nmap_results"
# Log file name
$LogFilePath = Join-Path $TempDirectory "nmap_log.txt"

[vijayk]

I have done the setup and run the script manual in my one host. It generate the log text file but not generate the XML file.

[PeterZielony]

what does it say in logs?

[PeterZielony]

I have done the setup and run the script manual in my one host. It generate the log text file but not generate the XML file.

also, do you have nmap in environmental vars?


try running from CMD: nmap -Pn -oX "C:\Temp\nmap_results\testhost.xml" <put_IPaddress_here>
and see if it is generating XML file


try the attached ps script. I commented out one line during testing (shouldn't effect XML tho) - there was problem with sender but now fixed with this one

There could few reasons, The script works if you have set IP for the host, not by DNS (will fix it in the next release)

Host group (PortScanGroup) doesn't contain this host so API cannot find IP address

Are your zabbix instance HTTPS or HTTP?

What ver of zabbix? Not sure if we can use "auth" key with latest ver.. i have v6.2

[vijayk]

Error in log file is "Zabbix sender failed with exitcode: 2"

[PeterZielony]

Error in log file is "Zabbix sender failed with exitcode: 2"

documentation says:
data was sent, but processing of at least one of the values failed, the exit status is 2

Did you assign template to host?
You can also manually create items for host - make sure key is the same
for data:


last scan date/time:



If host have TLS option try it from cmd (from where zabbix_sender.exe is) like this:

zabbix_sender.exe -z <Insert_IP_zabbixServer_or_Proxy> -s <insert_Hostname> --tls-connect psk --tls-psk-identity "<insert_PSK_Identity>" --tls-psk-file "C:\Program Files\Zabbix Agent 2\psk.key" -k UnauthorisedPort -o "test"

or w/o TLS:
zabbix_sender.exe -z <Insert_IP_zabbixServer_or_Proxy> -s <insert_Hostname> -k UnauthorisedPort -o "test"

and check output
it should look like this:



If output is different then it means host doesn't have item assigned..or psk you used is incorrect for this target host

this host you are targeting is monitored by zabbix server or proxy?

[vijayk]

Hi, I'm using without TLS. Host is monitored by zabbix server. Template is already assigned to host.

Below is output of zabbix_sender

[PeterZielony]

try adding -vv option after zabbix_sender.exe

it will give a clue what's wrong

[vijayk]

Below is output

[PeterZielony]

Below is output

hostname is exactly the same as in fronend?I read somewhere that underscore could cause it ... try enclosing it in double quotes
Hostname is case-sensitive. Host not disabled or under maintenance? or try different host

weird behaviour to be honest..

what version of agent you are using?

also your items are created by template or manually? make sure type of information is set to "text"

you could also check logs in server side... if you have debugging enabled

[vijayk]

Got it my firewall is causing the issue. I have allowed it now let me check with nmap.

[PeterZielony]

good catch!

[vijayk]

Hi,
One more thing in my zabbix server I have setup the Host with both fields Visible name and Host name and value for both are different. Whenever I run the script by default it get the Visible name instead of Host name. Because of Host name is different script gives same error.

So is it possible to get host name in script instead of visible name?

[PeterZielony]

Hi,
One more thing in my zabbix server I have setup the Host with both fields Visible name and Host name and value for both are different. Whenever I run the script by default it get the Visible name instead of Host name. Because of Host name is different script gives same error.

So is it possible to get host name in script instead of visible name?

Sure, it was an oversight. I don't use them really

attached corrected one with changed API call to use host rather than visible name

edit:removed write-host response from API. Keep forgetting to disable it when I'm changing things. Attached should be ok now

let me know if something needs changing, I'll be working on it and expanding it in future with different functions (like scanning by hostname rather than IP address etc)