camscan.py

#!/usr/bin/python -B
# -*- coding: utf-8 -*-
#
#  camscan.py
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are
#  met:
#
#  * Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#  * Redistributions in binary form must reproduce the above
#    copyright notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
#  * Neither the name of the project nor the names of its
#    contributors may be used to endorse or promote products derived from
#    this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
#  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
#  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
#  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
#  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
#  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
#  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
#  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
#  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

__version__ = '0.1'

SSH_DEFAULT_PORT = 22
DEFAULT_SLEEP_TIME = 0.5
CISCO_NEW_LINE = '\r\n'
CISCO_MORE_LINE = ' --More--'
REPORT_BANNER = "{0:<17}  {1:<15}  {2:<15}  {3:<4}"

import argparse
import getpass
import logging
from time import sleep
from binascii import unhexlify
import sys
import os

sshlib = None
try:
	import ssh
	sshlib = ssh
except ImportError:
	pass

try:
	import paramiko
	sshlib = paramiko
except ImportError:
	pass

if sshlib == None:
	print 'Must have python-ssh or python-paramiko installed.'
	sys.exit(1)

def macMatch(control, test, wildcards = True):
	control = control.lower().split(':')
	test = test.lower().split(':')
	if len(control) != 6 or len(test) != 6:
		raise Exception('malformed MAC')
	for i in xrange(0, 6):
		if wildcards and control[i] == '*':
			continue
		if control[i] != test[i]:
			return False
	return True

class CiscoSwitch:
	def __init__(self, host, username = None, password = None):
		if not username:
			username = raw_input('Username: ')
		if not password:
			password = getpass.getpass('Password: ')

		self.host = host
		self.port = SSH_DEFAULT_PORT
		self.username = username
		self.password = password

		self.ssh = None
		self.logger = logging.getLogger('switch')
		self.connect()

	def close(self):
		self.ssh.close()

	def connect(self):
		self.ssh = sshlib.SSHClient()
		self.ssh.set_missing_host_key_policy(sshlib.AutoAddPolicy())
		self.ssh.connect(self.host, port = self.port, username = self.username, password = self.password)
		self.logger.info('successfully connected to: ' + self.username + '@' + self.host + ':' + str(self.port))
		self.shell = self.ssh.invoke_shell()

		sleep(DEFAULT_SLEEP_TIME)
		buff = ''
		while self.shell.recv_ready():	# flush the buffer in case there is a banner
		    buff += self.shell.recv(512)

		if self.privileges_sync() != 15:
			if not self.privileges_elevate():
				self.logger.critical('could not obtain the necessary privileges')
				raise Exception('could not obtain the necessary privileges')

	def privileges_elevate(self):
		self.logger.info('elevating privileges')

		self.shell.send('enable\n') # don't change this to CRLF
		sleep(DEFAULT_SLEEP_TIME)
		buff = ''
		while self.shell.recv_ready():
			buff += self.shell.recv(512)

		output = filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))
		if not output:
			raise Exception('failed to obtain privilege level 15')
		if not output[-1].lower().startswith('password:'):
			raise Exception('failed to obtain privilege level 15')

		self.shell.send(self.password + '\n')
		sleep(DEFAULT_SLEEP_TIME)
		buff = ''
		while self.shell.recv_ready():
			buff += self.shell.recv(512)
		output = filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))

		retries = 3
		while 'access denied' in output[0].lower() and retries:
			self.logger.warning('enable password rejected')
			self.shell.send('enable\n') # don't change this to CRLF
			sleep(DEFAULT_SLEEP_TIME)
			buff = ''
			while self.shell.recv_ready():
				buff += self.shell.recv(512)

			output = filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))
			if not output:
				raise Exception('failed to obtain privilege level 15')
			if not output[-1].lower().startswith('password:'):
				raise Exception('failed to obtain privilege level 15')

			password = getpass.getpass('Enable Password For ' + self.username + '@' + self.host + ': ')
			self.shell.send(password + '\n')
			sleep(DEFAULT_SLEEP_TIME)
			buff = ''
			while self.shell.recv_ready():
				buff += self.shell.recv(512)
			output = filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))
			retries -= 1
		if self.privileges_sync() == 15:
			self.logger.info('successfully elevated to privilege level 15')
			return True
		return False

	def privileges_sync(self):
		cmd = self.execute_command('show privilege')
		if not cmd:
			raise Exception('failed to identify privilege level')
		if cmd[0].lower()[:27] != 'current privilege level is ':
			raise Exception('failed to identify privilege level')
		self.privilege_level = int(cmd[0].split()[-1])
		return self.privilege_level

	def execute_command(self, command):
		self.logger.info('running command: ' + str(command))

		self.shell.send(command + '\n')
		sleep(DEFAULT_SLEEP_TIME)
		buff = ''
		while self.shell.recv_ready():
			buff += self.shell.recv(512)
		data = filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))[1:]

		while data[-1].startswith(CISCO_MORE_LINE):
			del data[-1]
			self.shell.send(' \n')
			sleep(DEFAULT_SLEEP_TIME)
			buff = ''
			while self.shell.recv_ready():
				buff += self.shell.recv(512)
			while buff[0] == '\x08' or buff[0] == ' ':
				buff = buff[1:]
			data.extend(filter(lambda x: x, buff.strip().split(CISCO_NEW_LINE))[1:])
		return data

	def get_cam_table(self):
		cam_table = []

		raw_data = self.execute_command('show mac address-table')

		raw_data = raw_data[4:]
		prompt = raw_data.pop()
		while raw_data[-1] == prompt:
			raw_data.pop()
		raw_data.pop()

		if not raw_data:
			return None
		for line in raw_data:
			line = line.split()
			if len(line) != 4:
				self.logger.error('invalid line in CAM table found')
				return
			entry = {}
			entry['vlan'] = line[0]
			entry['mac'] = ':'.join([x.encode('hex') for x in unhexlify(line[1].replace('.', ''))])
			entry['type'] = line[2]
			entry['ports'] = line[3]
			if entry['ports'] != 'CPU':
				cam_table.append(entry)
		return cam_table

def main():
	parser = argparse.ArgumentParser(description = 'Cisco Switch MAC Anomaly Detector', conflict_handler = 'resolve')
	parser.add_argument('-v', '--version', action = 'version', version = parser.prog + ' Version: ' + __version__)
	parser.add_argument('-L', '--log', dest = 'loglvl', action = 'store', choices = ['DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'], default = 'ERROR', help = 'set the logging level')
	parser.add_argument('-u', '--user', dest = 'ssh_user', action = 'store', required = False, help = 'default user to authenticate as')
	parser.add_argument('-p', '--pass', dest = 'ssh_pass', action = 'store', required = False, default = None, help = 'default password to authenticate with')
	parser.add_argument('-h', '--hosts', dest = 'host_file', action = 'store', required = True, type = argparse.FileType('r'), help = 'list of switches to scan')
	parser.add_argument('-m', '--macs', dest = 'mac_file', action = 'store', required = True, type = argparse.FileType('r'), help = 'list of MAC addresses to ignore')
	parser.add_argument('-r', '--report', dest = 'report_file', action = 'store', required = False, type = argparse.FileType('w'), default = 'report.csv', help = 'report CSV file')

	try:
		arguments = parser.parse_args()
	except IOError as error:
		if hasattr(error, 'filename'):
			print error.strerror + ': ' + error.filename
		else:
			print error.strerror
		return 1

	logging.basicConfig(level = getattr(logging, arguments.loglvl), format = "%(levelname)-8s %(message)s")
	logger = logging.getLogger('main')

	try:
		ssh_user = arguments.ssh_user
		if not ssh_user:
			ssh_user = raw_input('Switch Username: ')
		ssh_pass = arguments.ssh_pass
		if not ssh_pass:
			ssh_pass = getpass.getpass('Switch Password: ')
	except KeyboardInterrupt:
		return 1

	anomalies = 0
	switch_ip = arguments.host_file.readline().strip()
	while switch_ip:
		logger.info('now processing switch: ' + switch_ip)
		try:
			switch = CiscoSwitch(switch_ip, username = ssh_user, password = ssh_pass)
		except Exception as error:
			logger.error('received an error while connecting to: ' + switch_ip)
			switch_ip = arguments.host_file.readline().strip()
			continue
		cam_table = switch.get_cam_table()
		logger.debug('retreived ' + str(len(cam_table)) + ' entries from the CAM table')
		white_mac = arguments.mac_file.readline().strip()
		while white_mac:
			for entry in cam_table:
				if macMatch(white_mac, entry['mac']):
					continue
				if anomalies == 0:
					print REPORT_BANNER.format('MAC Address', 'Ports', 'Switch IP', 'VLAN')
					print REPORT_BANNER.format('-----------', '-----', '---------', '----')
				print REPORT_BANNER.format(entry['mac'], entry['ports'], switch_ip, entry['vlan'])
				arguments.report_file.write(",".join([entry['mac'], entry['ports'], switch_ip, entry['vlan']]) + os.linesep)
				anomalies += 1
			white_mac = arguments.mac_file.readline().strip()
		arguments.mac_file.seek(os.SEEK_SET, 0)
		arguments.report_file.flush()
		switch_ip = arguments.host_file.readline().strip()
		switch.close()
	print '\nIdentified ' + str(anomalies) + ' network anomalies.'
	return 0

if __name__ == '__main__':
	sys.exit(main())