#!/usr/bin/env python3
# CYBERDUDEBIVASH Cisco AsyncOS CVE-2025-20393 Scanner
# Copyright © 2026 CYBERDUDEBIVASH ECOSYSTEM – All Rights Reserved
# Authorized under CYBERDUDEBIVASH AUTHORITY – For ethical detection use only
# Version: 1.0 – January 16, 2026
# Description: Detects indicators of CVE-2025-20393 (unauthenticated RCE in Cisco Secure Email Gateway / SMA).
# Checks TCP/6025 exposure, optional safe probe, and local IOCs for known backdoors.
# Use ONLY on authorized systems. Non-destructive – no exploitation performed.
# Full docs & enterprise hardening: https://www.cyberdudebivash.com/contact

import socket
import requests
import os
import argparse
import sys
from urllib.parse import urljoin

def check_port_open(host, port=6025):
    """Checks if TCP port 6025 (Spam Quarantine service) is open."""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        result = sock.connect_ex((host, port))
        sock.close()
        return result == 0
    except Exception:
        return False

def probe_quarantine_interface(host, port=6025):
    """Non-exploitative probe – safe GET request to quarantine interface."""
    try:
        url = f"http://{host}:{port}/quarantine"
        response = requests.get(url, timeout=10, verify=False, headers={'User-Agent': 'CYBERDUDEBIVASH-Scanner/1.0'})
        if response.status_code == 200 and "Cisco" in response.text:
            return True, "Spam Quarantine interface appears exposed and responsive (potential vulnerability indicator)."
        else:
            return False, f"Probe returned {response.status_code}: {response.reason}"
    except requests.exceptions.RequestException as e:
        return False, f"Probe failed: {str(e)}"

def check_local_iocs():
    """Local IOC check for known post-exploitation artifacts (run on appliance only)."""
    iocs = []
    suspicious_paths = [
        "/data/web/euq_webui/htdocs/index.py",   # Potential webshell location
        "/tmp/chisel",                           # Known tunneling tool
        "/var/tmp/aqua",                         # AquaShell backdoor indicator
        "/opt/phoenix/phoenix.log"               # Log tampering check
    ]
    for path in suspicious_paths:
        if os.path.exists(path):
            iocs.append(f"[ALERT] Suspicious file/path found: {path}")
    return iocs

def scan_asyncos(target, probe=False, local_ioc=False):
    """
    Main scan function for CVE-2025-20393 indicators.
    
    Args:
        target (str): Host/IP of Cisco AsyncOS appliance
        probe (bool): Perform safe interface probe
        local_ioc (bool): Check local filesystem for IOCs (requires execution on appliance)
    
    Returns:
        dict: Scan results
    """
    results = {
        "port_open": False,
        "interface_exposed": False,
        "local_iocs": [],
        "message": "",
        "recommendations": []
    }

    # 1. Port exposure check
    results["port_open"] = check_port_open(target)
    if not results["port_open"]:
        results["message"] = "TCP/6025 (Spam Quarantine) is closed or unreachable. Low immediate exposure risk."
    else:
        results["message"] = "TCP/6025 is OPEN – potential attack surface for CVE-2025-20393."

    # 2. Optional interface probe
    if probe:
        exposed, msg = probe_quarantine_interface(target)
        results["interface_exposed"] = exposed
        results["message"] += f"\nProbe Result: {msg}"

    # 3. Local IOC check (only if running on the appliance)
    if local_ioc:
        results["local_iocs"] = check_local_iocs()
        if results["local_iocs"]:
            results["message"] += "\nLocal IOCs DETECTED – possible compromise!"

    # 4. Final risk classification & recommendations
    if results["port_open"] and (probe and results["interface_exposed"]):
        results["message"] = "HIGH RISK: Exposed port + responsive interface. Immediate action required!"
    elif results["port_open"]:
        results["message"] += "\nPOTENTIAL RISK: Port open – run probe or apply mitigations."

    results["recommendations"] = [
        "Disable Spam Quarantine feature if not required.",
        "Restrict TCP/6025 via firewall to trusted management IPs only.",
        "Apply Cisco patches as soon as available (no patch confirmed yet).",
        "Monitor logs for unauthorized root commands or new files in /data/web/",
        "Run full forensic scan for AquaShell / AQUATUNNEL indicators.",
        "For professional audit, hardening, or compromise assessment: https://www.cyberdudebivash.com/contact"
    ]

    return results

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CYBERDUDEBIVASH Cisco AsyncOS CVE-2025-20393 Scanner")
    parser.add_argument("target", help="Host/IP of Cisco AsyncOS appliance (e.g., esa.yourdomain.com)")
    parser.add_argument("--probe", action="store_true", help="Perform safe Spam Quarantine interface probe (authorized only)")
    parser.add_argument("--local-ioc", action="store_true", help="Check local filesystem for known IOCs (must run on appliance)")
    
    args = parser.parse_args()
    
    print(f"Scanning {args.target} for CVE-2025-20393 indicators...")
    print("=" * 60)
    
    results = scan_asyncos(args.target, args.probe, args.local_ioc)
    
    print(f"Port 6025 Open: {results['port_open']}")
    if args.probe:
        print(f"Interface Exposed: {results['interface_exposed']}")
    if args.local_ioc:
        print(f"Local IOCs Found: {len(results['local_iocs'])}")
        for ioc in results['local_iocs']:
            print(f"  - {ioc}")
    
    print(f"\nAssessment: {results['message']}")
    print("\nRecommendations:")
    for rec in results['recommendations']:
        print(f"• {rec}")
    
    print("=" * 60)
    print("\nJoin CYBERDUDEBIVASH Affiliates: https://www.cyberdudebivash.com/affiliates")