Package: jarvis-pentest
Jarvis is a very simple pentest companion that provides the following features:penetration tests results directory managementunified structure for all assessmentshooks for useful commands and automated output savingunified command history fileeasy way to take screenshotscreation of an easily reachable symlink that always point to your current pentestIt is fully written in Python and is designed to be easily extended.This project is currently under development and many bugs may appear, do not hesitate to open issues or submit pull requestsCommand hookingAs a pentester, I often faced with difficulties related to output recording. Sometimes, a very looonnnngnmapscan launched without output options and cancelled may be very painful due to the lack of exploitable files. I’m not even talking about closed terminals containing juicy outputs that may lack in a security assessment report.For these reasons, I decided to implement a command hooking feature that would automatically add output options to command lines and record outputs if such options would not exist.Basically, each command exposed by Jarvis is a specific method called on a Python class. This method retrieves the supplied command line, adds arguments and patches the command lines, and finally runs the built command in a patched environnement.InstallationSeeinstallUsageInitial configurationFor using Jarvis, you will have to fill a/etc/jarvis.conffile:[jarvis]
pentests_history = /home/user/.pentests_history
user_directory = user
output_directory = records
img_directory = img
pentest_tree = [
        "%(user_directory)s",
        "%(user_directory)s/img",
        "%(user_directory)s/scripts",
        "%(user_directory)s/records"
        ]
notesfiles = notes.txt
interface = eth0
editor = vimHere is a quick description of available options (all of them are mandatory):pentests_history: path to the file that will contain all the paths to performed pentestsuser_directory: since a pentest is supposed to be performed by several persons, this is the name of your directory within the pentest’s oneoutput_directory: the directory within your user’s directory that will contain all records produced by available hooksimg_directory: the directory within your user’s directory that will contain screenshotspentest_tree: this is a very important configuration, it describes the structure of your pentest directory that will be created after apentest init. For the moment, I’m too lazy for creating directories according to previously described options so the directory tree must be fully described in this setting. This advanced feature should come soon. Note that some commands will obviously fail if you do not createuser_directoryoroutput_directorynotesfiles: the file that will be used for taking notesinterface: the network interface through which test are going to be performededitor: your preferred editor (vim,emacs, whatever)Pentest directory managementIf you want to start a new pentest, run the following commands:$ pentest start /path/to/pentest
$ pentest initThe first command will append an entry inside the pentests history file. The second will create your pentest directory structure.After init, the pentest directory is created:$ tree /path/to/pentest
/path/to/pentest
└── user
    ├── img
    ├── records
    └── scriptsNote that pentests arestackedin thepentests_historyfile:$ cat .pentests_history
/tmp/pentest-1
/tmp/pentest-2
/tmp/pentest-3Stopping a pentest withpentest stopwill simplypopthe last entry from the history file.You can then define useful aliases. The most explicit example isjumpingto the current pentest with a bash alias:alias gopentest="cd $(tail -n 1 /path/to/.pentests_history)"Command hookingJarvis is shipped with many commands hooks that can be listed:$ pentest hooks
airodump
arpscan
crackmapexec
curl
dnsmap
dnsrecon
hping3
http
hydra
nikto
nmap
patator
smbclient
smbmap
sslyze
wfuzzPlease note that Jarvisdoes notships packages providings hookable scripts or binaries. Jarvis also expects that each hooked command should runnable as-is. Basically,wfuzzshould be callable without Jarvis installed.Currently, Jarvis throws an exception with the underlying command does not exist on the installed systemLet’s try running annmapscan, which is one of the currently available hooks:$ nmap 127.0.0.1
 Starting Nmap 7.60 ( https://nmap.org ) at 2018-09-15 11:08 CEST
 Nmap scan report for factory (127.0.0.1)
 [...]Now, thecommands.logfile is populated (noted that commands are also properly escape):$ cat commands.log
[192.168.1.19] 2018-09-15 11:08:13,978 :: nmap -oA /tmp/peni/b0z/records/nmap-127.0.0.1-2018-09-15-11-08-13 127.0.0.1You can see that output options have been added, and output files created automatically:$ ls records/
nmap-127.0.0.1-2018-09-15-11-08-13.gnmap  nmap-127.0.0.1-2018-09-15-11-08-13.nmap
nmap-127.0.0.1-2018-09-15-11-08-13.xmlOutput files naming follows a basic format. Note that naming is really efficient whentargetsare placed atregularpositions. For example,nmapwill process the target independantly from its position within the command line. This is achieved through a huge parsing effort on the command line that I don’t want to reimplement in Python and for each hook. Thus, it is recommend to put the targetat the end of the command linewhen tools are agnostic about its position.Finally, it should be highlighted that some command line arguments automatically disable the hooking mechanism. Especially, when help is invoked (-hor--help), or when output options are passed (basically-oJ,-oAor whatever innmap), hooking is not performed.Some commands don’t provide output options, so recording is achieved by passing them to thescriptutility:$ curl -s https://google.fr
$ cat records/curl-record-2018-09-15-11-13-23.txt
curl -s https://google.fr
Script started on 2018-09-15 11:13:23+02:00
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.fr/">here</A>.
</BODY></HTML>

Script done on 2018-09-15 11:13:23+02:00Disable hooking at runtimeSometimes, manymanycommands are typed and recording is not especially needed. Jarvis allows users to circumvent the hooking mechanism by using the--nojarvisoption. This option will be consumed by Jarvis witout consequences on subsequent commands.ScreenshotsTaking screenshot is also made easy withpentest screenshot. This command will run the Imagemagickimportcommand with manual selection options. Once the screenshot is taken, you are prompted for a screenshot name (I usedzenityfor this purpose):I recommend associating this command to a keybinding :-)You can then list your screenshots:$ pentest img
screen-1.png
screen-2.pngAnd edit any screenshot withpinta, which is one of the most convenientquickwineditor from my point of view:$ pentest edit screen-1.pngAdding a new hookTODOExtending JarvisJarvis is mainly a python module that can be used for various purposes based on pentest needings. Thesharifyscript was developed for saving files efficiently when crawling CIFS share. Usually you do:$ smbclient -U "domain\user%password" //host/share
cd directory
get filefileis then stored in the same directory from which you ransmbclient.sharifyconsumes the Jarvis setup to drop downloaded files in thefilesdirectory within your current pentest directory:$ sharify -u USERNAME -p PASSWORD -d DOMAIN //host/share
cd directory
get file

$ tree /path/to/pentest/<user>/files
/path/to/pentest/<user>/files
└── host
    ├── share1
    │   ├── file-1
    │   └── file-2
    └── share2
        ├── file-1
        └── file-2