#!/bin/bash
# Optionen mit getopts parsen
while getopts "o:" opt; do
  case $opt in
    o) OKT="$OPTARG" ;;
    *) echo "Ungueltige Option" >&2; exit 1 ;;
  esac
done
IP=$(ip a s enp0s3 | grep "inet\>" | awk '{ print $ 2}' | cut -d / -f 1)

# Gueltigkeit prüfen
if [[ -z "$OKT" ]]; then
  echo "Fehlender OKT! Nutzung: -o <OKT>"
  echo "$0 -o $OKT"
  exit 1
fi

echo "Tabula Rasa"
apt purge -y suricata
apt purge -y evebox
apt purge -y expect
rm -fr /etc/suricata
rm -f /etc/systemd/system/evebox.service
echo "Install Suricata"
apt update
apt install -y suricata

cat<<HERE >/etc/suricata/suricata.yaml
%YAML 1.1
---
vars:
  address-groups:
    LAN: "[172.26.$OKT.0/24]"
    DMZ: "[10.88.$OKT.0/24]"
    SERVER: "[10.$OKT.1.0/24]"
    INT: "[\$LAN,\$DMZ,\$SERVER]"
    HOME_NET: "\$INT"
    EXTERNAL_NET: "!\$INT"

# Sniffing-Interface (Mirror/SPAN Port)
af-packet:
  - interface: enp0s8
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

# Standard-Log-Verzeichnis
default-log-dir: /var/log/suricata/

# Statistiken
stats:
  enabled: yes
  interval: 8

# Ausgaben
outputs:
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls
        - flow
        - ssh
        - stats

# Logging
logging:
  default-log-level: notice
  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      level: info
      filename: suricata.log

pid-file: /var/run/suricata.pid

unix-command:
  enabled: yes
  filename: /var/run/suricata-command.socket

default-rule-path: /etc/suricata/rules

rule-files:
  - local.rules

classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config

app-layer:
  protocols:
    http:
      enabled: yes
    tls:
      enabled: yes
    smb:
      enabled: yes
    ftp:
      enabled: yes
    ssh:
      enabled: yes
    smtp:
      enabled: yes
    dns:
      enabled: yes
    nfs:
      enabled: yes
    ntp:
      enabled: yes
    krb5:
      enabled: yes
    dhcp:
      enabled: yes
    rdp:
      enabled: yes
    http2:
      enabled: yes
HERE
cat<<HERE >/etc/suricata/rules/local.rules
# ICMP: einfacher Ping/Traceroute (schneller Funktionstest)
# Test: ping -c 1 1.1.1.1
alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activity; sid:9000041;)

# HTTP: mögliches Command-Injection-Merkmal (Semikolon) in POST-Body
# Test: curl -X POST http://www.it$OKT.int/host.php --data-urlencode "fqdn=example.com;ls" -d "submit=Auflösen"
alert http any any -> any any (msg:"Command Injection - Semicolon in POST DATA"; classtype:web-application-attack; flow:established; content:"%3B"; nocase; http_client_body; sid:9000002;)

# HTTP: mögliches SQLi-Merkmal (einfaches Hochkomma) in POST-Body
# Test: curl -X POST http://www.it$OKT.int/sql-classic.php --data-urlencode "username=' OR '1'='1' --"
alert http any any -> any any (msg:"Possible SQL Injection (singlequote in POST)"; classtype:web-application-attack; flow:established,to_server; content:"%27"; nocase; http_client_body; sid:9000003;)

# DNS: Policy - verbietet "google" in DNS-Queries
# Test: host google.de
alert dns any any -> any any (msg:"Kein Googlen"; dns.query; content:"google"; nocase; classtype:policy-violation; sid:9000043;)

# DoS: viele identische kurze HTTP-GETs (LOIC-ähnlich)
# Test: ab -n 1000 -c 500 http://www.it$OKT.int/
alert tcp any any -> any any (msg:"ET DOS Terse HTTP GET Likely LOIC"; flow:to_server,established; dsize:18; content:"GET / HTTP/1.1|0d 0a 0d 0a|"; depth:18; threshold:type both,track by_dst,count 500,seconds 60; classtype:own-dos; sid:9000054; rev:2;)

# Scan: TCP SYN-Sweep (viele SYN in kurzer Zeit)
# Test: nmap -sS -p1-100 10.88.$OKT.21
alert tcp any any -> any any (msg:"OWN SCAN TCP SYN sweep"; flow:stateless,to_server; flags:S; detection_filter:track by_src,count 20,seconds 5; classtype:attempted-recon; sid:9000060; rev:1;)

# Scan: TCP NULL-Scan (keine Flags gesetzt)
# Test: nmap -sN -p1-100 10.88.$OKT.21
alert tcp any any -> any any (msg:"OWN SCAN TCP NULL scan"; flow:stateless,to_server; flags:0; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:9000061; rev:1;)

# Scan: UDP-Sweep mit leerer Payload
# Test: nmap -sU --min-rate=1000 10.88.$OKT.21
alert udp any any -> any any (msg:"OWN SCAN UDP sweep (empty probes)"; flow:to_server; dsize:0; detection_filter:track by_src,count 15,seconds 10; classtype:attempted-recon; sid:9000064; rev:1;)

# Scan: ICMP Ping-Sweep (viele Echo-Requests)
# Test: nmap -sn 10.88.$OKT.0/24
alert icmp any any -> any any (msg:"OWN SCAN ICMP ping sweep"; itype:8; detection_filter:track by_src,count 10,seconds 5; classtype:attempted-recon; sid:9000065; rev:1;)

# Brute Force SSH
# Test: hydra -l kit -P bad-passwords ssh://10.88.$OKT.21
alert tcp any any -> any 22 (msg:"OWN SSH Brute Force"; flow:to_server,stateless; flags:S; detection_filter:track by_src,count 10,seconds 60; classtype:attempted-recon; sid:9000066; rev:1;)

# HTTP: sqlmap User-Agent erkennen
# Test: sqlmap -u "http://www.it$OKT.int/sql-classic.php" --data "username=test"
alert http any any -> any any (msg:"SQLmap Scanner detected"; http.user_agent; content:"sqlmap"; nocase; classtype:web-application-attack; sid:9000070; rev:1;)

# HTTP: curl User-Agent erkennen
# Test: curl http://www.it$OKT.int/host.php
alert http any any -> any any (msg:"curl User-Agent detected"; http.user_agent; content:"curl"; nocase; classtype:policy-violation; sid:9000071; rev:1;)

# ICMP Tunnel - großes Payload
# Test: ping -c 5 -s 500 10.88.$OKT.21
alert icmp any any -> any any (msg:"OWN ICMP Large Payload - possible tunnel"; itype:8; dsize:>200; classtype:misc-attack; sid:9000072; rev:1;)

# TCP SYN Flood
# Test: hping3 -S --flood -V -p 80 10.88.$OKT.21
alert tcp any any -> any any (msg:"TCP SYN Flood Potential Detected"; flags:S; threshold: type both, track by_dst, count 150, seconds 10; classtype:misc-attack; sid:9000073; rev:1;)

# SSH Connection Attempt
# Test: ssh root@10.88.$OKT.21
alert tcp any any -> any 22 (msg:"SSH Connection Attempt"; content:"SSH"; nocase; classtype:misc-activity; sid:9000074; rev:1;)
HERE
echo "Enable und Start von Suricata"
systemctl enable --now suricata
echo "Download und Install evebox"
rm -f evebox_0.24.0_amd64.deb
wget https://xinux.de/downloads/script/evebox_0.24.0_amd64.deb
apt install -y ./evebox_0.24.0_amd64.deb
cat<<HERE > /etc/systemd/system/evebox.service
# /etc/systemd/system/evebox.service
[Unit]
Description=EveBox Webinterface
After=network.target

[Service]
ExecStart=/usr/bin/evebox server --host 0.0.0.0 --datastore sqlite --input /var/log/suricata/eve.json
Restart=always

[Install]
WantedBy=multi-user.target
HERE
echo "Enable und Start von evebox"
systemctl daemon-reexec
systemctl enable --now evebox
echo "Passwort setzen"
expect -c '
spawn evebox config users passwd admin
expect "Password:"
send "123Start$\r"
expect "Confirmation:"
send "123Start$\r"
expect eof
'
echo "URL : https://$IP:5636"
echo "USER: admin"
echo "PASS: 123Start$"