attack_technique: T1046
display_name: Network Service Scanning
atomic_tests:
- name: Port Scan
  auto_generated_guid: 68e907da-2539-48f6-9fc9-257a78c05540
  description: |
    Scan ports to check for listening ports.

    Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.
  supported_platforms:
  - linux
  - macos
  executor:
    command: |
      for port in {1..65535};
      do
        echo >/dev/tcp/192.168.1.1/$port && echo "port $port is open" || echo "port $port is closed" : ;
      done
    name: sh
- name: Port Scan Nmap
  auto_generated_guid: 515942b0-a09f-4163-a7bb-22fefb6f185f
  description: |
    Scan ports to check for listening ports with Nmap.

    Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of adresseses on port 80 to determine if listening. Results will be via stdout.
  supported_platforms:
  - linux
  - macos
  input_arguments:
    host:
      description: Host to scan.
      type: String
      default: 192.168.1.1
    port:
      description: Ports to scan.
      type: String
      default: "80"
    network_range:
      description: Network Range to Scan.
      type: String
      default: 192.168.1.0/24
  dependency_executor_name: sh
  dependencies:
  - description: |
      Check if nmap command exists on the machine
    prereq_command: |
      if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      (which yum && yum -y epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)
  executor:
    command: |
      nmap -sS #{network_range} -p #{port}
      telnet #{host} #{port}
      nc -nv #{host} #{port}
    name: sh
- name: Port Scan NMap for Windows
  auto_generated_guid: d696a3cb-d7a8-4976-8eb5-5af4abf2e3df
  description: Scan ports to check for listening ports for the local host 127.0.0.1
  supported_platforms:
  - windows
  input_arguments:
    nmap_url:
      description: NMap installer download URL
      type: Url
      default: https://nmap.org/dist/nmap-7.80-setup.exe
    host_to_scan:
      description: The host to scan with NMap
      type: String
      default: 127.0.0.1
  dependency_executor_name: powershell
  dependencies:
  - description: |
      NMap must be installed
    prereq_command: 'if (cmd /c "nmap 2>nul") {exit 0} else {exit 1}'
    get_prereq_command: |
      Invoke-WebRequest -OutFile $env:temp\nmap-7.80-setup.exe #{nmap_url}
      Start-Process $env:temp\nmap-7.80-setup.exe /S
  executor:
    command: |-
      nmap #{host_to_scan}
    name: powershell
    elevation_required: true
- name: Port Scan using python
  auto_generated_guid: 6ca45b04-9f15-4424-b9d3-84a217285a5c
  description: |
    Scan ports to check for listening ports with python
  supported_platforms:
  - windows
  input_arguments:
    host_ip:
      description: Host to scan.
      type: String
      default: 127.0.0.1
    filename:
      description: Location of the project file
      type: Path
      default: PathToAtomicsFolder\T1046\src\T1046.py
  dependency_executor_name: powershell
  dependencies:
    - description: |
        Check if python exists on the machine
      prereq_command: |
        if (python --version) {exit 0} else {exit 1}
      get_prereq_command: |
        echo "Python 3 must be installed manually"
  executor:
    command: |
      python #{filename} -i #{host_ip}
    name: powershell
