import argparse import re from collections import defaultdict import networkx as nx from networkx.drawing.nx_agraph import write_dot def create_graph_from_edges(lookup_table): graph = nx.DiGraph() for source, dest in lookup_table: graph.add_edge(source, dest) return graph def build_lookup_table(input_lines, ignore_dest_user): lookup_table = set() for line in input_lines: line = line.strip() line = re.sub(r"^\[?\d+\]?\s*", "", line) if ": " in line or ">" not in line or not line[-2].isdigit() or not line[-1] == ')': continue pattern = re.compile(r"(\w+)@\(([\d\.:]+)\)(\[[^\]]+\])->(?=(\w+)@\(([\d\.:]+)\))") matches = re.finditer(pattern, line) previous_dest_host = None for match in matches: user, host, _, dest_user, dest_host = match.groups() if host == "(127.0.0.1)" or host == "127.0.0.1": if prev_dest_host is not None: host = prev_dest_host if dest_host == "(127.0.0.1)" or dest_host == "127.0.0.1": dest_host = host prev_dest_host = dest_host else: prev_dest_host = None if ignore_dest_user: target_range = (host, dest_host) else: target_range = (f"{user}@{host}", f"{dest_user}@{dest_host}") lookup_table.add(target_range) return lookup_table if __name__ == "__main__": parser = argparse.ArgumentParser(description="Construct a graph file to visualize the relation between servers discovered by SSH-Snake.") parser.add_argument("--file", help="Path to a file containing the output of SSH-Snake.") parser.add_argument("--format", help="The format of the graph file to export. The options are gexf or dot.") parser.add_argument("--with-users", action="store_true", help="Create nodes based on their 'user@host' instead of just 'host'. This setting is optional and not recommended.") args = parser.parse_args() if not any(vars(args).values()): parser.print_help() exit() if args.format not in ("gexf", "dot"): print("Valid options for --format are: gexf or dot") exit() with open(args.file, 'r') as file: input_lines = file.readlines() ignore_dest_user = True if args.with_users: ignore_dest_user = False lookup_table = build_lookup_table(input_lines, ignore_dest_user) graph = create_graph_from_edges(lookup_table) if len(lookup_table) > 500 and args.format == "dot": print("The list of connections is quite big; YMMV with a .dot file.") # Set default edge color to green for edge in graph.edges(): graph.edges[edge]['color'] = '#006400' # Set default node color to lightgrey. for node in graph.nodes(): graph.nodes[node]['fillcolor'] = 'lightgrey' graph.nodes[node]['style'] = 'filled' # Set any edges that correspond to a dest1 being able to connect to dest2 and backwards (dest1<--->dest2) to red. for source, dest in graph.edges(): if (dest, source) in graph.edges(): graph.edges[(source, dest)]['dir'] = 'both' graph.edges[(source, dest)]['color'] = '#CD5C5C' # Set any node corresponding to a loopback (dest1<--->dest1) to blue for node in graph.nodes(): if graph.has_edge(node, node) or any((edge[0] == edge[1] == node) for edge in graph.edges()): graph.nodes[node]['fillcolor'] = '#00BFFF' output_dot_file_path = "SSHSnake_dot_file.dot" output_gexf_file_path = "SSHSnake_gexf_file.gexf" if args.format == "gexf": nx.write_gexf(graph, output_gexf_file_path) print("Your gexf file has been created in ./sshsnake_gexf_file.gexf") print("You can now open the file using Gephi.\n") print("Or you can use Cytoscape! Take a look at GRAPHICS.md") else: nx.drawing.nx_pydot.write_dot(graph, output_dot_file_path) print("Your dot file has been created in ./sshsnake_dot_file.dot.\n") print("To convert your dot file to a png or svg, use the following command to sample different algorithms available from graphviz:\n") print("for alg in sfdp fdp circo twopi neato dot; do\n\t$alg -Tpng -Gsplines=true -Gconcentrate=true -Gnodesep=0.1 -Goverlap=false SSHSnake_dot_file.dot -o $alg.png\ndone\n\n") print("Alternatively, you can just paste the .dot file into https://dreampuf.github.io/GraphvizOnline/ -- if pasting that type of information into your browser is in your threat model...\n\n") print("Try placing splines=true; concentrate=true; nodesep=0.1; overlap=false; in the file just after the first line, too!")