#!/usr/bin/perl
use File::Copy;
use Nmap::Parser;
use Net::DNS::Sendmail;
use warnings;
use strict;
 
#config begin
my $nmap_path = "/usr/bin/nmap"; #path to nmap binary
my $nmap_args = "-T5 -F -sV"; #nmap arguments (accepts multiple), do not specify any output arguments!
my $ips = ""; #networks to scan, accepts standard nmap input
my $save_as = "/root/parser-cache.xml"; #path to storage file - this file is used for comparative scans, so it's best not to place it in /tmp.
my $email_from_address = ''; #from address to use when sending mail - should probably exist to avoid sender callouts
my $email_to_address = ''; #address you want results delivered to
my $email_sender_domain = ''; #domain to masquerade as - useful in cases where remote mta checks helo.
my $email_subject = "Nmap Network Scan Results"; #subject for email.
my $debug = "false"; #enables some output if you need to test auto on the cli - i.e. why mail isn't being sent.
#config end
 
my $np = new Nmap::Parser;
my $old = new Nmap::Parser;
my $curr = new Nmap::Parser;
my $tempstore = "/tmp/parser-cache.tmp";
my $emailfile = "/tmp/nmap-notify";
my $newmachines = 0;
my $auto = (lc($ARGV[0]) eq "auto");
my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localtime(time);
 
sub debug
{
    print "@_\n" if($debug eq "true");
}
 
sub print_twice
{
    print "@_";
    print EMAIL "@_";
}
 
sub create_files
{
    foreach (@_)
        {
            if(!-e $_)
                {
                    print "$_ does not exist... creating\n" if(!$auto);
                    open(TEMP,">$_") or die "Can't create $_: $!";
                    close(TEMP) or die "Couldn't close $_: $!";
                }
        }
}
 
create_files($save_as,$tempstore);
 
if($auto)
{
    open(EMAIL,">$emailfile") or die "Can't create $emailfile: $!";
    print EMAIL "Nmap Scan Report.  Hosts/Ports changed!\nGenerated on: ";
    printf EMAIL "%4d-%02d-%02d %02d:%02d:%02d\n\n",$year+1900,$mon+1,$mday,$hour,$min,$sec;
    print EMAIL "--------BEGIN--------\n";
}
 
if($auto)
{
    debug("Running auto mode");
 
    if(-s $save_as)
    {
        $old->parsefile($save_as); #load previous state
        $curr->cache_scan($tempstore); #set temporary file to store xml after we're done
        $curr->parsescan($nmap_path, $nmap_args, $ips); #scan current hosts
 
        for my $ip ($curr->get_ips('up'))
        {
            my $ip_old = $old->get_host($ip);
            my $ip_curr = $curr->get_host($ip);
            my @alltcp = $ip_curr->tcp_open_ports();
            my $numtcp = $#alltcp + 1;
            if(!$ip_old)
            {
                print_twice("$ip is a new host with".$numtcp."ports open/filtered.\n");
                ++$newmachines;
            }
        }
 
        print_twice("\n") if($newmachines != 0);
 
        for my $ip ($curr->get_ips('up'))
        {
            my $ip_old = $old->get_host($ip);
            my $ip_curr = $curr->get_host($ip);
            my %port = ();
 
            if($ip_old)
            {
                my @tcpdiff = grep { $port{$_} < 2}
                                    (map {$port{$_}++; $_}
                                    ( $ip_curr->tcp_open_ports , $ip_old->tcp_open_ports));
 
                if(scalar @tcpdiff)
                {
                    print_twice("$ip has these new ports open: ".join(',',@tcpdiff)."\n");
                    for (@tcpdiff)
                    {
                        print_twice("\t"."$_ might be ",$ip_curr->tcp_service($_)->name,"\n");
                    }
                    print_twice("\n");
                }
            }else{
                my @tcp = (map {$port{$_}++; $_}
                            ( $ip_curr->tcp_ports('open') ));
 
                if(scalar @tcp)
                {
                    print_twice("$ip has these ports open: ".join(',',@tcp)."\n");
                    for (@tcp)
                    {
                        print_twice("\t"."$_ might be ",$ip_curr->tcp_service($_)->name,"\n");
                    }
                    print_twice("\n");
                }
            }
        }
    }else{
        $curr->cache_scan($tempstore); #set temporary file to store xml after we're done
        $curr->parsescan($nmap_path, $nmap_args, $ips); #scan current hosts
 
        for my $ip ($curr->get_ips('up'))
        {
            my $ip_curr = $curr->get_host($ip);
            my @alltcp = $ip_curr->tcp_open_ports();
            my $numtcp = $#alltcp + 1;
            print_twice("$ip is a new host with ".$numtcp." ports open/filtered.\n");
            ++$newmachines;
        }
 
        print_twice("\n") if($newmachines != 0);
 
        for my $ip ($curr->get_ips('up'))
        {
            my $ip_curr = $curr->get_host($ip);
            my %port = ();
 
            my @tcp = (map {$port{$_}++; $_}
                      ( $ip_curr->tcp_ports('open') ));
 
            if(scalar @tcp)
            {
                print_twice("$ip has these ports open: ".join(',',@tcp)."\n");
 
                for (@tcp)
                {
                    print_twice("\t"."$_ might be ",$ip_curr->tcp_service($_)->name,"\n");
                }
 
                print_twice("\n");
            }
        }
    }
    move($tempstore, $save_as);
    print EMAIL "--------END--------";
    close EMAIL;
 
    open(EMAIL,"<$emailfile") or die "Can't read $emailfile: $!";
    my $mail = Net::DNS::Sendmail->new();
    $mail->verbose() if($debug eq "true");
    $mail->senderdomain( "$email_sender_domain" );
    $mail->to( "$email_to_address" );
    $mail->from( "$email_from_address" );
    $mail->subject( "$email_subject" );
    while () { $mail->data($_); }
    $mail->sendmail() if($newmachines != 0);
    debug("mail sent");
    close EMAIL;
} else {
    #Unsure whether or not to move the output of this into $save_as... it may
    #be that someone runs this, and doesn't take care of the output, in which
    #case, we still want to be notified that night.
    $np->cache_scan($save_as);
    $np->parsescan($nmap_path, $nmap_args, $ips);
    print "IP,OPEN TCP PORTS\n";
    for my $ip ($np->get_ips('up'))
    {
        my $ip_check = $np->get_host($ip);
        my %port = ();
 
        my @tcp = (map {$port{$_}++; $_}
                  ( $ip_check->tcp_ports('open') ));
 
        print "$ip,".join(' ',@tcp)."\n" if(scalar @tcp);
    }
}