Network Audit Bash Script Using Netbios and Nmap

From: http://www.stardothosting.com

Working in a large office, it is sometimes necessary to use different network

audit tools in order to properly assess the integrity and security of networks.

In order to quickly audit a network , I created this script to scan selected IPs,
read from a configuration file, and compile a simple report to be emailed. The
script can be modified to suit your needs, such as exporting the data to a
database or perhaps an HTML report for a web based reporting site.

The script itself doesn’t do anything particularly special, however it has proven
useful when you want to do a quick & dirty network audit.

There are other tools out there, such as OpenAudit, Nessus and Nmap that could do
similar tasks. However, the important thing to remember here is that those tools
(with the exception of open audit perhaps) can be incorporated into this script to
perform regular scheduled audits.

This script could actually be updated to utilize nmap v5.0 — utilizing the new
features plus ndiff could turn this script into a very powerful network analysis
tool.

Hopefully some of you will find some use out of the script! Enjoy!

#!/bin/sh

# Basic Information Gathering

currentmonth=`date "+%Y-%m-%d"`

rm lindows.log

echo "Hostname Identification Audit: " $currentmonth >> lindows.log

echo -e "------------------------------------------" >> lindows.log
echo -e >> lindows.log
for obj0 in $(grep -v "^#" all_linux_windows_ips.txt);
do

# Check if windows
check=`nmap -e bge0 -p 3389 $obj0 | grep open`

if [ "$?" -eq 0 ]
then
windowshost=`nbtscan -v -s , $obj0 | head -n 1 | awk -F"," '{printf "%s",
$2}'`
if [ -n "${windowshost:+x}" ]
then
echo -e "$windowshost\t: $obj0\t: WINDOWS" >> lindows.log
else
echo -e "NETBIOS UNKOWN\t: $obj0\t: WINDOWS" >> lindows.log
fi
else
# Check if linux or freebsd
ssh_get=`ssh -l ims $obj0 '(uname | sed
'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/' && hostname | sed
'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/')'`
if [ "$?" -eq 0 ]
 then
uname=`echo $ssh_get | awk -F" " '{printf "%s", $1}'`
hostname1=`echo $ssh_get | awk -F" " '{printf "%s", $2}'`
hostname2=`echo $hostname1 | awk -F"." '{printf "%s", $1}'`
echo -e "$hostname2\t: $obj0\t: $uname" >> lindows.log
else
echo -e "UNKNOWN ERROR\t: $obj0\t: PLEASE CHECK HOST" >>
lindows.log
fi
fi
done

cat lindows.log | mail -s 'Windows/FreeBSD/Linux Host Audit' your@email.com

Note that the “all_windows_linux_ips.txt” is just a text file with the ip

addresses of all hostnames on your network. It can be modified to simply utilize
whole subnets to make it easier to perform the audit.