hostdiscovery

#!/bin/sh
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# Copyright 2014 Jeremy Brubaker <jbru362@gmail.com>
#
################################################################################
# file:		hostdiscovery
# usage:	hostdiscovery
# abstract:	get hardware, software, network, user, etc info from a host
################################################################################

FG=""
RST=""
HOSTNAME=$(hostname)
outdir="$HOSTNAME.results"
outdir=/tmp/TEST
mkdir "$outdir"

################################################################################
# stuff that could take a while
################################################################################

exit
# grab the config files
( 	printf "%sCopying /etc/...%s\n" "$FG" "$RST"			;
	cp -a /etc/ "$outdir" 2>/dev/null					&&
	printf "%sCopying /etc/ Succeeded.%s\n" "$FG" "$RST"		||
	printf "%sCopying /etc/ Failed.%s\n" "$FG" "$RST" 		; ) &

# grab the log files
( 	printf "%sCopying /var/log/...%s\n" "$FG" "$RST"		;
	cp -a /var/log/ "$outdir" 2>/dev/null					&&
	printf "%sCopying /var/log/ Succeeded.%s\n" "$FG" "$RST"	||
	printf "%sCopying /var/log/ Failed.%s\n" "$FG" "$RST" 		; ) &

# grab the website if available
( 	printf "%sCopying /var/www/...%s\n" "$FG" "$RST"		;
	cp -a /var/www/ "$outdir" 2>/dev/null					&&
	printf "%sCopying /var/www/ Succeeded.%s\n" "$FG" "$RST"	||
	printf "%sCopying /var/www/ Failed.%s\n" "$FG" "$RST" 		; ) &

# grab the locate database
( 	printf "%sCopying mlocate.db...%s\n" "$FG" "$RST"		;
	( updatedb ; cp /var/lib/mlocate/mlocate.db "$outdir" 2>/dev/null ; )	&&
	printf "%sCopying mlocate.db Succeeded.%s\n" "$FG" "$RST"	||
	printf "%sCopying mlocate.db Failed.%s\n" "$FG" "$RST" 		; ) &

# grab the mysql database
( service mysql start && mysqldump --all-databases > "$HOSTNAME.mysql" ; ) &

# grab all files ending in .conf and store them in a directory hierarchy
(
	mkdir conf ; cd conf || exit; 
    find / -name '*.conf' -exec cp --parents {} . \;
) &

################################################################################
# Hardware
################################################################################
mkdir hardware && cd hardware || exit

printf "%sBeginning hardware discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

# what make/model of machine?
# what serial number?
printf "%sMake sure you photograph the machine to get make/model, ports, etc.%s\n" "$FG" "$RST"

echo "Manufacturer: $(dmidecode -s system-manufacturer)"		| tee    hardwareinfo.out
echo "Product Name: $(dmidecode -s system-product-name)"		| tee -a hardwareinfo.out
echo "Serial Number: $(dmidecode -s system-serial-number)" 	| tee -a hardwareinfo.out
echo "BIOS Vendor: $(dmidecode -s bios-vendor)"			| tee -a hardwareinfo.out
echo "BIOS Version: $(dmidecode -s bios-version)"		| tee -a hardwareinfo.out
echo "BIOS Release Date: $(dmidecode -s bios-release-date)" 	| tee -a hardwareinfo.out
# ...

# what type of CPU?
lscpu								| tee lscpu.out
cp /proc/cpuinfo .

# how much ram total / used?
free -th							| tee free.out
cp /proc/meminfo .

# how much hard drive space total / used?
df -h								| tee df.out

# which partitions are mounted? size? partition type?
mount								| tee mount.out
cp /proc/partitions .

# what usb devices were connected?
lsusb								| tee lsusb.out

# what pci devices were connected?
lspci								| tee lspci.out

# other hardware stuff...
lshal 								> lshal.out
dmidecode							> dmidecode.out

printf "%sFinished hardware discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

cd ..

################################################################################
# software
################################################################################
mkdir software && cd software || exit

printf "%sBeginning software discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

# kernel version?
# distribution?
uname -a 						| tee uname.out
cp /proc/version .
lsb_release -a						> lsb_release.out

# which software packages were installed?
dpkg -l							> dpkg.out
apt-cache dump						> apt-cache-dump.out

# what processes are currently running?
ps aufxw						| tee psafuxw.out

# what web server / version was installed?
apache2 -v						| tee apache.out
nginx -v						| tee nginx.out

# what database server / version was installed? running?
mysql -V						| tee mysql.out

# which other network services were installed? running?
netstat -pant | grep LISTEN				| tee netstat-pant-listen.out

netstat -n						> netstat.out

printf "%sFinished software discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

cd ..
	
################################################################################
# network
################################################################################
mkdir network && cd network || exit

# ip address
# subnet mask
# mac address
ifconfig -a							| tee ifconfig.out

# show the routing table
route -n							| tee route.out
netstat -rn							> netstat-rn.out

# show wireless information
iwconfig							| tee iwconfig.out

# what nameservers does might machine commonly access?
cp /etc/resolv.conf .

# what other hosts/ips might this machine commonly access?
arp -a								| tee arp.out

# what other machine was connected to this one? on what service? from what ip address?
netstat -pant | grep ESTABLISHED				| tee netstat-pant-established.out

cd ..

################################################################################
# users
################################################################################
mkdir users && cd users || exit

printf "%sBeginning user discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

# which users have a password set?  did you retrieve the password hashes?
cp /etc/passwd .
cp /etc/shadow .
cp /etc/group .

# which users have logged in previously?
last								| tee last.out

# what other user was logged in when you were logged in?
who								| tee who.out

# which user had files stored in their home directory? did you retrieve them?
du /home/ -h --max-depth 1					| tee home-du.out

# which user had a mozilla profile? did you retrieve cookies / stored settings / history / etc?
################################################################################
# grab user files of interest in /home
################################################################################
for USER in /home/* ; do
	
	mkdir "$USER" && cd "$USER" || exit
	
	cp "/home/$USER/.bash_history"		./bash_history		2>/dev/null
	cp "/home/$USER/.bash_logout"		./bash_logout		2>/dev/null
	cp "/home/$USER/.bashrc"			./bashrc		2>/dev/null
	cp "/home/$USER/.profile"			./profile		2>/dev/null
	
	cp -a "/home/$USER/.config"		./config		2>/dev/null
	cp -a "/home/$USER/.local"		./local			2>/dev/null
	cp -a "/home/$USER/.mozilla"		./mozilla		2>/dev/null

	cp -a "/home/$USER/.cache/google-chrome"	./cache-google-chrome	2>/dev/null
	cp -a "/home/$USER/.config/google-chrome"	./config-google-chrome	2>/dev/null

	cp -a "/home/$USER/.ssh"			./ssh			2>/dev/null

	cd ..

done
################################################################################
# grab user files of interest in /root
################################################################################

mkdir root && cd root || exit
	
	cp /root/.bash_history			./bash_history		2>/dev/null
	cp /root/.bash_logout			./bash_logout		2>/dev/null
	cp /root/.bashrc			./bashrc		2>/dev/null
	cp /root/.profile			./profile		2>/dev/null
	
	cp -a /root/.config			./config		2>/dev/null
	cp -a /root/.local			./local			2>/dev/null
	cp -a /root/.mozilla			./mozilla		2>/dev/null

	cp -a /root/.cache/google-chrome	./cache-google-chrome	2>/dev/null
	cp -a /root/.config/google-chrome	./config-google-chrome	2>/dev/null

	cp -a /root/.ssh			./ssh			2>/dev/null

cd ..

printf "%sFinished software discovery of %s...%s\n" "$FG" "$RST" "$HOSTNAME"

cd ..

################################################################################
# odball stuff and cleanup
################################################################################

cd ..