SNMP Stalker

#!/usr/bin/env ruby
#
# SNMP Stalker
# By: Hood3dRob1n
#
# This is a tool for enumerating information from devices over SNMP.
# - Community String Bruteforcer
# - Read & Write Options
# - Targeted at Windows, but not limited to Windows
#   - Windows pre-built options for enumerating lots of juicy info
#
# ToDo:
# - Figure out how to fix the process killer
# - Add Common Cisco Options
#   - Config Downloader
#     - Built-in TFTP Server?
#   - Auto-Crack PIX Hashes?
#
# Requires NMAP for Recon & Discovery Scanning
#

###### STD GEMS ######
require 'fileutils'  #
require 'optparse'   #
#### NON-STD GEMS ####
require 'rubygems'   #
require 'colorize'   #
require 'readline'   #
require 'snmp'       #
require 'text-table' #
######################

HOME=File.expand_path(File.dirname(__FILE__))
RESULTS=HOME + '/results/'
include SNMP

# Trap Interupts
trap("SIGINT") {puts "\n\nWARNING! CTRL+C Detected, Shutting things down....."; exit 666;}

# 31337 Banner
def banner
  puts
  puts "SNMP Stalker".light_yellow
  puts "By".light_yellow + ": Hood3dRob1n".white
end

# Clear Terminal
def cls
  system('clear')
end

# Exec cmd in separate process we dont have to wait on
def fireNforget(command)
  pid = Process.fork
  if pid.nil?
    sleep(1)
    exec "#{command}"
  else
    Process.detach(pid)
  end
end

# Main Menu Help Options
def show_usage
  puts
  puts "Recon & Discovery:".white.underline
  puts "  nmap ".light_yellow + "       => ".white + "Quick NMAP SNMP Scan Builder".light_yellow
  puts "  bruteforce ".light_yellow + " => ".white + "Dictionary Attack SNMP Community String".light_yellow
  puts "  creds ".light_yellow + "      => ".white + "Setup Credentials & SNMP Connection".light_yellow
  puts
  puts "General Options:".white.underline
  puts "  basic ".light_yellow + "      => ".white + "Enumerate Basic Info".light_yellow
  puts "  dump ".light_yellow + "       => ".white + "Dump Full 'MGMT' Tree".light_yellow
  puts "  o2n OID ".light_yellow + "    => ".white + "Convert OID to Symbolic Name".light_yellow
  puts "  n2o NAME ".light_yellow + "   => ".white + "Convert Symbolic Name to OID".light_yellow
  puts "  walk OID ".light_yellow + "   => ".white + "Walk Tree by OID or Symbolic Name".light_yellow
  puts "  setstr OID STRING ".light_yellow + "  => ".white + "Set Value for Specified OID to String value".light_yellow
  puts "  setint OID INTEGER ".light_yellow + " => ".white + "Set Value for Specified OID to Integer Value".light_yellow
  puts
  puts "Windows Specific Options:".white.underline
  puts "  users ".light_yellow + "      => ".white + "Enumerate Usernames".light_yellow
  puts "  netstat ".light_yellow + "    => ".white + "Enumerate Currently Open TCP & UDP Ports".light_yellow
  puts "  services ".light_yellow + "   => ".white + "Enumerate Running Services".light_yellow
  puts "  software ".light_yellow + "   => ".white + "Enumerate Installed Software".light_yellow
  puts "  process ".light_yellow + "    => ".white + "Enumerate Running Processes".light_yellow
  puts "  kill PID ".light_yellow + "   => ".white + "Kill Running Processes by PID (write privs)".light_yellow
end

#Core/Main Menu
def core_shell
  puts
  prompt = "(SNMP_Stalker)> "
  while line = Readline.readline("#{prompt}", true)
    cmd = line.chomp
    case cmd
    when /^clear|^cls|^banner/i
      cls
      banner
      core_shell
    when /^help|^h$|^ls$/i
      show_usage
      core_shell
    when /^exit|^quit/i
      puts
      puts "OK".light_red + ",".white + " exiting SNMP Stalker session".light_red + "....".white
      puts
      exit 69;
    when /^nmap|^snmp_nmap/i
      puts
      nmap_snmp
      core_shell
    when /^bruteforce|^snmp_brute|^brute/i
      puts
      snmp_brute
      core_shell
    when /^creds|^credz|^credential/i
      puts
      snmp_creds
      core_shell
    when /^o2n (.+)/i
      oid=$1.chomp
      puts
      o2n(oid)
      puts
      core_shell
    when /^n2o (.+)/i
      name=$1.chomp
      puts
      n2o(name)
      puts
      core_shell
    when /^get (.+)/i
      oidname=$1.chomp
      puts
      get(oidname)
      puts
      core_shell
    when /^walk (.+)/i
      oidname=$1
      puts
      walk(oidname)
      puts
      core_shell
    when /^setstr (.+) (.+)/i
      oid=$1
      string=$2
      puts
      set(oid, string, 's')
      core_shell
    when /^setint (.+) (.+)/i
      oid=$1
      int=$2
      puts
      set(oid, int, 'i')
      core_shell
    when /^basic|^info/i
      puts
      basic
      puts
      core_shell
    when /^dump/i
      puts
      dump
      puts
      core_shell
    when /^users|^usernames/i
      puts
      users
      puts
      core_shell
    when /^software|^sw$/i
      puts
      software
      puts
      core_shell
    when /^services/i
      puts
      services
      puts
      core_shell
    when /^process|^ps$/i
      puts
      processes
      puts
      core_shell
    when /^kill (.+)/i
      pid=$1.chomp
      puts
      kill(pid)
      puts
      core_shell
    when /^netstat/i
      puts
      netstat
      puts
      core_shell
    else
      cls
      puts
      puts "Oops".light_red + ",".white + " Didn".light_red + "'".white + "t quite understand that one".light_red
      puts "Please Choose a Valid Option From Menu Below Next Time".light_red + ".....".white
      puts
      show_usage
      core_shell
    end
  end
end

# NMAP SNMP Quick Scan Builder
def nmap_snmp
  puts "NMAP SNMP Quick Scan Builder".white.underline
  line = Readline.readline("(Target IP)> ", true)
  target = line.chomp
  # Launch the scan in a new X-term window so we dont have to wait :)
  scan="xterm -title 'NMAP SNMP Quick Scan' -font -*-fixed-medium-r-*-*-18-*-*-*-*-*-iso8859-* -e \"bash -c 'nmap -sU -p 161 -sV "
  line = Readline.readline("(Enable NSE Scripts (Y/N))> ", true)
  answer=line.chomp
  if answer.upcase == 'YES' or answer.upcase == 'Y'
    scan += '-sC '
  end
  Dir.mkdir(RESULTS) unless File.exists?(RESULTS)
  Dir.mkdir("#{RESULTS}nmap/") unless File.exists?("#{RESULTS}nmap/")
  scan += "#{target} -oX #{RESULTS}nmap/#{target}.xml' && echo && echo '-- Press ENTER to close window --' && read\""
  puts "Launching NMAP Scan in new xterm window".light_yellow + ",".white + " hope you find something interesting".light_yellow + "....".white
  fireNforget(scan)
  puts
end

# Dictionary attack to find Community String
# say something gay about using the word bruteforce and you will instantly be banished!
# use your brain power, google and small lists with targeted strings
# Bad Connections and faulty credentials end up causing time-out error
# Simple use this to judge, moving on to next string in list if failed....not overly complex, sorry
def snmp_brute
  puts "SNMP Community String Bruteforcer".white.underline
  line = Readline.readline("(Target IP)> ", true)
  target = line.chomp
  line = Readline.readline("(Standard SNMP Port 161 (Y/N)?)> ", true)
  answer = line.chomp
  if answer.upcase == 'N' or answer.upcase == 'NO'
    line = Readline.readline("(SNMP Port)> ", true)
    zPORT = line.chomp
   else
    zPORT='161'
  end
  puts
  builtins = [ 'public', 'public123', 'private', 'private123', 'internal', 'internet', 'secret', 'write', 'read', 'MyPublicCommunityName', 'MyPrivateCommunityName', 'snmp', 'snmpd', 'all private' ]
  puts "Select Wordlist for Attack".light_yellow + ": ".white
  puts "1".white + ")".light_yellow + " Built-in Wordlist".white
  puts "2".white + ")".light_yellow + " Custom Wordlist".white
  answer=gets.chomp
  if answer == '2'
    line = Readline.readline("(Path to Wordlist)> ", true)
    zlist=line.strip.chomp
    if File.exists?(zlist)
      zWordlist = File.open(zlist).readlines
    else
      puts "Can".light_red + "'".white + "t find provided file".light_red + "!".white
      puts "Proceeding with built-in wordlist".light_red + ".....".white
      zWordlist = builtins
    end
  else
    zWordlist = builtins
  end
  puts "Loaded ".light_yellow + "#{zWordlist.size}".white + " strings from wordlist".light_yellow + ".....".white
  line = Readline.readline("(Stop on Firt Success (Y/N)?)> ", true)
  answer=line.chomp
  if answer.upcase == 'Y' or answer.upcase == 'YES'
    stop=true
  else
    stop=false
  end
  while(true)
    puts "Starting SNMP Bruteforce Attack".light_yellow + ",".white + " hang tight".light_yellow + "....".white
    zWordlist.each do |cs|
      if can_we_connect(target, zPORT.to_i, cs.chomp)
        puts "[".light_green + "*".white + "]".light_green + " Success using".light_yellow + ": #{cs.chomp}".white
        break if stop
      end
    end
    break
  end
end

# Test if we can connect with credentials or not
def can_we_connect(target, port, string)
  begin
    manager = SNMP::Manager.new(:Host => target, :Port => port.to_i, :Community => string)
    sys_time = manager.get_value("sysUpTime.0")
    manager.close if manager
    return true
  rescue SNMP::RequestTimeout => e
    return false
  end
end

# Establish Valid Credentials
# Creates Instance Variables for use throughout
def snmp_creds
  puts "SNMP Connection Datastore".white.underline
  line = Readline.readline("(Target IP)> ", true)
  snmp_target = line.chomp
  line = Readline.readline("(Standard SNMP Port 161 (Y/N)?)> ", true)
  answer = line.chomp
  if answer.upcase == 'N' or answer.upcase == 'NO'
    line = Readline.readline("(SNMP Port)> ", true)
    snmp_port = line.chomp
  else
    snmp_port='161'
  end
  line = Readline.readline("(Community String)> ", true)
  snmp_string = line.chomp
  puts "SNMP Connection Datastore Complete".light_yellow + "!".white
  puts
  puts "Confirming we can connect now".light_yellow + ".....".white
  if can_we_connect(snmp_target, snmp_port, snmp_string)
    @manager = SNMP::Manager.new(:Host => snmp_target, :Port => snmp_port, :Community => snmp_string)
    if can_we_write
      @wite_access=true
    else
      @wite_access=false
    end
    puts "SNMP Connection Established".light_green + "!".white
    puts "Target".light_yellow + ": #{snmp_target}".white
    puts "Port".light_yellow + ": #{snmp_port}".white
    puts "Community String".light_yellow + ": #{snmp_string}".white
    puts "Read Access".light_yellow + ": Enabled".white
    puts "Write Access".light_yellow + ": Enabled".white if @wite_access
    puts "Write Access".light_yellow + ": Disabled".white unless @wite_access
    @host = snmp_target
    @port = snmp_port
    @string = snmp_string
  else
    puts "Can".light_red + "'".white + "t connect using".light_red + ": #{snmp_string}".white
    puts "Re-run creds command to change and re-set the SNMP connection".light_red + "....".white
    @manager=nil
  end
  puts
end

# Check/Confirm Write Access
def can_we_write
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    begin
      original = @manager.get_value('SNMPv2-MIB::sysContact.0') # SNMP System Contact String Value
      varbind = VarBind.new('1.3.6.1.2.1.1.4.0', OctetString.new("SNMP_Stalker")) # Write a String Value
      @manager.set(varbind)
      new = @manager.get_value('SNMPv2-MIB::sysContact.0')
      if new == "SNMP_Stalker"
        varbind = VarBind.new('1.3.6.1.2.1.1.4.0', OctetString.new(original)) # Write a String Value
        @manager.set(varbind)
        return true
      else
        return false
      end
    rescue SNMP::RequestTimeout => e
      return false
    rescue SNMP::BER::InvalidObjectId => e
      return false
    rescue ArgumentError => e
      return false
    end
  end
end

# Convert OID 2 Symbolic Name
def o2n(oid)
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    begin
      name = @manager.mib.name(oid)
      t = [['OID', 'Symbolic Name'], ["#{oid}", "#{name}"]]
      table = t.to_table(:first_row_is_head => true)
      puts table.to_s
    rescue ArgumentError => e
      puts "Problem trying to convert!"
      puts "This is NOT a valid OID!"
    end
  end
end

# Convert Symbolic Name to OID
def n2o(name)
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    begin
      oid = @manager.mib.oid(name)
      t = [['OID', 'Symbolic Name'], ["#{oid}", "#{name}"]]
      table = t.to_table(:first_row_is_head => true)
      puts table.to_s
    rescue ArgumentError => e
      puts "Problem trying to convert!"
      puts "This is NOT a valid OID Name!"
    end
  end
end

# Fetch Value for given OID
def get(oidname)
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    begin
      res = @manager.get(oidname)
      res.each_varbind do |vb|
        puts "Name: #{vb.name.to_s}"
        puts "Type: #{vb.value.asn1_type}"
        puts "Value: #{vb.value.to_s}"
      end
    rescue SNMP::BER::InvalidObjectId => e
      puts "Bad OID Value passed!"
      puts "\t=> #{e}"
    end
  end
end

# Walk the target OID or OID Symbolic Name tree if available....
def walk(oidname)
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts "Trying to Walk the '#{oidname}' tree......"
    begin
      @manager.walk(oidname) { |x| puts "#{x}" }
    rescue SNMP::BER::InvalidObjectId => e
      puts "Bad OID Value passed!"
      puts "\t=> #{e}"
    end
  end
end

# SET value for specified OID with given integer
# ex: set("1.3.6.1.2.1.25.4.2.1.7.#{pid}", 4) # => would kill windows process where process id = #{pid}
# oid, value to write, and the type of value (s=>String, i=>Integer)
def set(oid, data, type='s')
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts "Trying to SET value of ".light_yellow + "#{oid}".white + " to ".light_yellow + "#{data}".white
    begin
      old = @manager.get_value(oid)
      puts "Current Value".light_yellow + ": #{old}".white
      if type == 's'
        varbind = VarBind.new(oid, OctetString.new("#{data}")) # Write a String Value
      else
        varbind = VarBind.new(oid, SNMP::Integer.new(data)) # Write an Integer Value
      end
      @manager.set(varbind)
      new = @manager.get_value(oid)
      puts "Updated Value".light_yellow + ": #{new}".white
    rescue SNMP::BER::InvalidObjectId => e
      puts "Bad OID Value passed".light_red + "!".white
      puts "\t=> #{e}".light_red
    rescue ArgumentError => e
      puts "Problem trying to convert".light_red + "!".white
      puts "This is NOT a valid OID Name".light_red + "!".white
    end
  end
end

# CEnumerate Some Basic Info
def basic
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    # Grab some basic info using OID values which should be fairly generic in nature
    target = "#{@manager.config[:host]}:#{@manager.config[:port]}"
    cstring = @manager.config[:community]
    snmp_version = @manager.config[:version]
    sys_name = @manager.get_value("sysName.0")
    sys_descr = @manager.get_value("sysDescr.0")
    sys_time = @manager.get_value("sysUpTime.0")

    # Print out our basic info for user now....
    puts "[*] ".light_green + "Target".light_yellow + ": #{target}".white
    puts "[*] ".light_green + "Community String".light_yellow + ": #{cstring}".white
    puts "[*] ".light_green + "Read Access".light_yellow + ": Enabled".white
    puts "[*] ".light_green + "Write Access".light_yellow + ": Enabled".white if @wite_access
    puts "[*] ".light_green + "Write Access".light_yellow + ": Disabled".white unless @wite_access
    if snmp_version
      puts "[*] ".light_green + "SNMP Version".light_yellow + ": #{snmp_version}".white
    else
      puts "Unable to determine SNMP Version in use".light_red + "?".white
    end
    if sys_name
      puts "[*] ".light_green + "System Name".light_yellow + ": #{sys_name}".white
    else
      puts "Unable to determine system name".light_red + "!".white
    end
    if sys_descr
      puts "[*] ".light_green + "System Description".light_yellow + ": \n#{sys_descr}".white
    else
      puts "Unable to find system description".light_red + "!".white
    end
    if sys_time
      puts "[*] ".light_green + "System Uptime".light_yellow + ": #{sys_time}".white
    else
      puts "Unable to find system uptime".light_red + "!".white
    end
  end
end

# Dump the 'MGMT' OID
# Discloses most everything it has stored....
# Nice if you need something random perhaps
def dump
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts "Dumping a bunch of info from the ".light_yellow + "'mgmt'".white + " OID".light_yellow + "......".white
    dumpz=[]
    @manager.walk('mgmt') { |x| dumpz << x }
    if dumpz.empty?
      puts "No Values Found".light_red + "!".white
    else
      puts "[*] ".light_green + "SNMP MGMT Dump".light_yellow + ": ".white
      dumpz.each do |entry|
        puts "#{entry}"
      end
    end
  end
end

# Walk the "SNMPv2-SMI::enterprises.77.1.2.25" or "1.3.6.1.4.1.77.1.2.25" tree
# This will disclose the existing Windows Usernames for valid accounts on box
def users
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts "Enumerating Usernames".light_yellow + ".....".white
    users=[['Usernames']]
    @manager.walk('enterprises.77.1.2.25') { |x| users << ["#{x.value}"] }
    if users.empty?
      puts "No Values Found".light_red + "!".white
    else
      puts "#{users.size}".white + " Usernames Found".light_green + "!".white
      table = users.to_table(:first_row_is_head => true)
      puts table.to_s
    end
  end
end

# Walk the 'SNMPv2-SMI::mib-2.25.6.3.1.2' or '1.3.6.1.2.1.25.6.3.1.2' tree
# This will disclose the currently installed software on system
def software
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts 'Enumerating Installed Software'.light_yellow + ".....".white
    sw=[['Installed Software']]
    @manager.walk('mib-2.25.6.3.1.2') { |x| sw << ["#{x.value}"] }
    if sw.empty?
      puts "No Values Found".light_red + "!".white
    else
      table = sw.to_table(:first_row_is_head => true)
      puts table.to_s
    end
  end
end

# Enumerate Running Services (Windows)
# Walk the 'SNMPv2-SMI::enterprises.77.1.2.3.1.1' or '1.3.6.1.4.1.77.1.2.3.1.1' tree
# This will disclose the currently running windows services
def services
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    puts 'Enumerating Running Services'.light_yellow + '.....'.white
    services=[['Running Services']]
    @manager.walk('enterprises.77.1.2.3.1.1') { |x| services << ["#{x.value}"] }
    if services.empty?
      puts "No Values Found".light_red + "!".white
    else
      table = services.to_table(:first_row_is_head => true)
      puts table.to_s
    end
  end
end

# Enumerate Open TCP & UDP Ports, similar to Netstat
def netstat
  if @manager.nil?
    puts "Set Credentials and try again".light_red + "....".white
  else
    netstat_tcp
    puts
    netstat_udp
  end
end

# Enumerate Listening and Open TCP Ports (a.k.a. Netstat Output)
# Walk the tcpConnState or 1.3.6.1.2.1.6.13.1.1 oid names (not values)
# Results needs some formatting to make like netstat....
def netstat_tcp
  if @manager.nil?
    puts "Set Credentials and try again".light_red + ".....".white
  else
    tcp=[]
    @manager.walk('tcpConnState') {|x| tcp << x.to_s.split(", ")[0].sub('[name=TCP-MIB::tcpConnState.', '') }
    if not tcp.empty?
      puts "[*] ".light_green + "OPEN TCP PORTS".light_yellow + ": ".white
      tcp.each do |entry|
        if entry =~ /(\d+.\d+.\d+.\d+).(\d+).(\d+.\d+.\d+.\d+).(\d+)/ or entry =~ /(\d+.\d+.\d+.\d+).(\d+)/
          ip=$1
          port=$2
          ip2=$3
          port2=$4
          puts "#{ip}:#{port}".white
          if ip2 and port2
            puts "#{ip2}:#{port2}".white
          end
        else
          puts "#{entry}".white
        end
      end
    else
      puts "No Values Found".light_red + "!".white
    end
  end
end

# Enumerate Listening and Open UDP Ports (a.k.a. Netstat Output)
# Walk the udpLocalAddress or 1.3.6.1.2.1.7.5.1.1 oid names (not values)
# Results needs some formatting to make like netstat....
def netstat_udp
  if @manager.nil?
    puts "Set Credentials and try again".light_red + ".....".white
  else
    udp=[]
    @manager.walk('udpLocalAddress') {|x| udp << x.to_s.split(", ")[0].sub('[name=UDP-MIB::udpLocalAddress.', '') }
    if not udp.empty?
      puts "[*] ".light_green + "OPEN UDP PORTS".light_yellow + ": ".white
      udp.each do |entry|
        if entry =~ /(\d+.\d+.\d+.\d+).(\d+)/
          ip=$1
          port=$2
          puts "#{ip}:#{port}"
        else
          puts "#{entry}"
        end
      end
    else
      puts "No Values Found".light_red + "!".white
    end
  end
end

# Enumerate the Currently Running Processes
# Process Name, PID, and PATH returned
# PROCESS: Symbolic Name: mib-2.25.4.2.1.2 or OID: 1.3.6.1.2.1.25.4.2.1.2
# PID: Symbolic Name: mib-2.25.4.2.1.1 or OID: 1.3.6.1.2.1.25.4.2.1.1
# PATH: Symbolic Name: mib-2.25.4.2.1.4 or OID: 1.3.6.1.2.1.25.4.2.1.4
def processes
  if @manager.nil?
    puts "Set Credentials and try again".light_red + ".....".white
  else
    puts 'Enumerating Running Process'.light_yellow + '.....'.white
    psz=[] #process name
    @manager.walk('mib-2.25.4.2.1.2') { |x| psz << x.value }
    if psz.empty?
      puts "No Values Found".light_red + "!".white
    else
      ps_present = [['PID', 'Process', 'Path']]
      pidz=[] #PID valud
      @manager.walk('mib-2.25.4.2.1.1') { |x| pidz << x.value }
      pathz=[] #Path of process
      @manager.walk('mib-2.25.4.2.1.4') do |path|
        if path.value.chomp != '' and not path.nil?
          pathz << path.value
        else
          pathz << " - "
        end
      end
      count=0
      while count.to_i < psz.size
        ps_present << [[ "#{pidz[count]}", "#{psz[count]}", "#{pathz[count]}" ]]
        count = count.to_i + 1
      end
      table = ps_present.to_table(:first_row_is_head => true)
      puts table.to_s
    end
  end
end

# Kill Running Process Identified by PID
# Requires Community Write String Access
def kill(pid)
  if @manager.nil?
    puts "Set Credentials and try again".light_red + ".....".white
  else
    pidz=[] # PID values
    @manager.walk('mib-2.25.4.2.1.1') { |x| pidz << x.value }
    if pidz.include?(pid)
      puts "Sending Kill request to PID#".light_yellow + "#{pid}".white
      set("1.3.6.1.2.1.25.4.2.1.7.#{pid}", 2, 'i')
    else
      puts "Not finding Process ID ".light_red + "#{pid}".white + " in active process list".light_red + "!".white
    end
  end
end

# Close the SNMP Connection cleanly
def close
  @manager.close
end

## Main --
options = {}
optparse = OptionParser.new do |opts|
  opts.banner = "Usage: #{$0} [OPTIONS]"
  opts.separator ""
  opts.separator "EX: #{$0} -i 192.168.2.43 -p 161 --main"
  opts.separator "EX: #{$0} -i 192.168.2.43 -p 161 --recon"
  opts.separator "EX: #{$0} -i 192.168.2.43 -p 161 --brute"
  opts.separator ""
  opts.separator "Options: "
  # Assisted Modes
  opts.on('-m', '--main', "\n\tStart in Main Menu".white) do |method|
    options[:method] = 1
  end
  opts.on('-r', '--recon', "\n\tSNMP Recon & Discovery".white) do |method|
    options[:method] = 2
  end
  opts.on('-b', '--brute', "\n\tCommunity String Bruteforcer".white) do |method|
    options[:method] = 3
  end
  opts.on('-h', '--help', "\n\tHelp Menu") do
    cls
    banner
    puts
    puts opts
    puts
    exit 69;
  end
end
begin
  foo = ARGV[0] || ARGV[0] = "-m"
  optparse.parse!
  mandatory = [:method]
  missing = mandatory.select{ |param| options[param].nil? }
  if not missing.empty?
    cls
    banner
    puts
    puts "Missing options: #{missing.join(', ')}"
    puts optparse
    exit 666;
  end
rescue OptionParser::InvalidOption, OptionParser::MissingArgument
  cls
  banner
  puts
  puts $!.to_s
  puts
  puts optparse
  puts
  exit 666;
end
cls
banner
@manager=nil
case options[:method].to_i
when 1
  core_shell
when 2
  nmap_snmp
when 3
  snmp_brute
end
puts
puts
#EOF