[enhancement] Improve CLI help text and add additional listener options (#96)

* feat: add --path-ip argument for exploit path generation in listener group

* enhancement: improve argument help descriptions and add SMB port logging in coercion

Author: r74tech

coercer/__main__.py

@@ -40,8 +40,8 @@ def parseArgs():
     mode_scan_advanced_config.add_argument("--export-xlsx", default=None, type=str, help="Export results to specified XLSX file.")
     mode_scan_advanced_config.add_argument("--export-sqlite", default=None, type=str, help="Export results to specified SQLITE3 database file.")
     mode_scan_advanced_config.add_argument("--delay", default=None, type=int, help="Delay between attempts (in seconds)")
-    mode_scan_advanced_config.add_argument("--min-http-port", default=64000, type=int, help="Verbose mode (default: False)")
-    mode_scan_advanced_config.add_argument("--max-http-port", default=65000, type=int, help="Verbose mode (default: False)")
+    mode_scan_advanced_config.add_argument("--min-http-port", default=64000, type=int, help="Minimum HTTP port for listening (default: 64000)")
+    mode_scan_advanced_config.add_argument("--max-http-port", default=65000, type=int, help="Maximum HTTP port for listening (default: 65000)")
     mode_scan_advanced_config.add_argument("--http-port", default=80, type=int, help="HTTP port (default: 80)")
     mode_scan_advanced_config.add_argument("--smb-port", default=445, type=int, help="SMB port (default: 445)")
     mode_scan_advanced_config.add_argument("--dce-port", default=135, type=int, help="DCERPC port (default: 135)")
@@ -50,10 +50,10 @@ def parseArgs():
     mode_scan_advanced_config.add_argument("--stop-on-ntlm-auth", default=False, action="store_true", help="Move on to next target on successful NTLM authentication.")
     # Filters
     mode_scan_filters = mode_scan.add_argument_group("Filtering")
-    mode_scan_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="")
-    mode_scan_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="")
-    mode_scan_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="")
-    mode_scan_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="")
+    mode_scan_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="Filter by method name")
+    mode_scan_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="Filter by protocol name")
+    mode_scan_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="Filter by pipe name")
+    mode_scan_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="Filter by transport name")
     # Credentials
     mode_scan_credentials = mode_scan.add_argument_group("Credentials")
     mode_scan_credentials.add_argument("-u", "--username", default="", help="Username to authenticate to the remote machine.")
@@ -87,18 +87,19 @@ def parseArgs():
     mode_fuzz_advanced_config.add_argument("--export-xlsx", default=None, type=str, help="Export results to specified XLSX file.")
     mode_fuzz_advanced_config.add_argument("--export-sqlite", default=None, type=str, help="Export results to specified SQLITE3 database file.")
     mode_fuzz_advanced_config.add_argument("--delay", default=None, type=int, help="Delay between attempts (in seconds)")
-    mode_fuzz_advanced_config.add_argument("--min-http-port", default=64000, type=int, help="Verbose mode (default: False)")
-    mode_fuzz_advanced_config.add_argument("--max-http-port", default=65000, type=int, help="Verbose mode (default: False)")
+    mode_fuzz_advanced_config.add_argument("--min-http-port", default=64000, type=int, help="Minimum HTTP port for listening (default: 64000)")
+    mode_fuzz_advanced_config.add_argument("--max-http-port", default=65000, type=int, help="Maximum HTTP port for listening (default: 65000)")
+    mode_fuzz_advanced_config.add_argument("--http-port", default=80, type=int, help="HTTP port (default: 80)")
     mode_fuzz_advanced_config.add_argument("--smb-port", default=445, type=int, help="SMB port (default: 445)")
     mode_fuzz_advanced_config.add_argument("--dce-port", default=135, type=int, help="DCERPC port (default: 135)")
     mode_fuzz_advanced_config.add_argument("--dce-ports", default=[], nargs='+', type=int, help="DCERPC ports")
     mode_fuzz_advanced_config.add_argument("--auth-type", default=None, type=str, help="Desired authentication type ('smb' or 'http').")
     # Filters
     mode_fuzz_filters = mode_fuzz.add_argument_group("Filtering")
-    mode_fuzz_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="")
-    mode_fuzz_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="")
-    mode_fuzz_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="")
-    mode_fuzz_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="")
+    mode_fuzz_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="Filter by method name")
+    mode_fuzz_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="Filter by protocol name")
+    mode_fuzz_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="Filter by pipe name")
+    mode_fuzz_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="Filter by transport name")
     # Credentials
     mode_fuzz_credentials = mode_fuzz.add_argument_group("Credentials")
     mode_fuzz_credentials.add_argument("--only-known-exploit-paths", action="store_true", default=False, help="Only test known exploit paths for each functions")
@@ -138,10 +139,10 @@ def parseArgs():
     mode_coerce_advanced_config.add_argument("--auth-type", default=None, type=str, help="Desired authentication type ('smb' or 'http').")
     # Filters
     mode_coerce_filters = mode_coerce.add_argument_group("Filtering")
-    mode_coerce_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="")
-    mode_coerce_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="")
-    mode_coerce_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="")
-    mode_coerce_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="")
+    mode_coerce_filters.add_argument("--filter-method-name", default=[], action='append', type=str, help="Filter by method name")
+    mode_coerce_filters.add_argument("--filter-protocol-name", default=[], action='append', type=str, help="Filter by protocol name")
+    mode_coerce_filters.add_argument("--filter-pipe-name", default=[], action='append', type=str, help="Filter by pipe name")
+    mode_coerce_filters.add_argument("--filter-transport-name", default=["msrpc", "dcerpc"], choices=["msrpc", "dcerpc"], nargs='*', type=str, help="Filter by transport name")
     # Credentials
     mode_coerce_credentials = mode_coerce.add_argument_group("Credentials")
     mode_coerce_credentials.add_argument("-u", "--username", default="", help="Username to authenticate to the machine.")
@@ -157,6 +158,9 @@ def parseArgs():
     # Listener
     listener_group = mode_coerce.add_argument_group("Listener")
     listener_group.add_argument("-l", "--listener-ip", required=True, type=str, help="IP address or hostname of the listener machine")
+    listener_group.add_argument("-i", "--interface", default=None, help="Interface to listen on incoming authentications.")
+    listener_group.add_argument("-I", "--ip-address", default=None, help="IP address to listen on incoming authentications.")
+    listener_group.add_argument("--path-ip", default=None, help="IP address to use when generating exploit paths.")
     # Logging
     mode_coerce_logging = mode_coerce.add_argument_group("Logging")
     mode_coerce_logging.add_argument("--minimum-log-level", default=0, help="Minimum logging level (integer).")

coercer/core/modes/coerce.py

@@ -36,5 +36,6 @@ def action_coerce(target, available_methods, options, credentials):
     # Executing tasks =======================================================================================================================
 
     reporter.print_info("Coercing '%s' to authenticate to '%s'" % (target, options.listener_ip), verbose=True)
+    reporter.print_info("Using SMB port %d for authentication" % options.smb_port, verbose=True)
 
-    execute_tasks(tasks, options, target, credentials, Modes.COERCE)
+    execute_tasks(tasks, options, target, credentials, Modes.COERCE)