{"id":1414,"date":"2009-05-12T10:00:58","date_gmt":"2009-05-12T18:00:58","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/2009\/05\/12\/a-powershell-port-scan\/"},"modified":"2009-05-12T10:00:58","modified_gmt":"2009-05-12T18:00:58","slug":"a-powershell-port-scan","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2009\/05\/12\/a-powershell-port-scan\/","title":{"rendered":"A PowerShell Port Scan"},"content":{"rendered":"

I recently guest-hosted Episode 69<\/a> the PowerScripting Podcast<\/a>. One of the items we discussed was a port scanning script from TheAdminGuy blog. Here’s the original script: http:\/\/theadminguy.wordpress.com\/2009\/04\/30\/portscan-with-powershell\/.<\/a> As written, there’s nothing technically wrong with it. The script gets the job done and tells the user which ports are open. However, I thought this was an opportunity to demonstrate an even more PowerShell-like approach. Even the author admits there are limitations to his script.<\/p>\n

Whenever I see a script like this, the first thing I try to do is separate the functionality. In the VBScript days we would write monolithic scripts to do everything. Sure, we might write a function or subroutine, but based on my forum experiences, even that was not a common occurrence. In PowerShell, we want to use smaller, cmdlet-like tools that leverage the pipeline.<\/p>\n

In the original script, each computer is first pinged and only if reachable is a port scan conducted. This is a great purpose for a function, and you’ll find many test ping variations. Here’s another.<\/p>\n

\n
\n
Function Try-Ping {<\/pre>\n
    Param([string]$computername=$(Throw \"You must enter a computername to ping\"<\/span>))<\/pre>\n
    $ping = New-Object System.Net.NetworkInformation.Ping<\/pre>\n
    if<\/span> ($ping.Send($computername).status.value__ -eq<\/span> 0) {<\/pre>\n
        write $TRUE<\/pre>\n
     }<\/pre>\n
     else<\/span> {<\/pre>\n
        write $FALSE<\/pre>\n
     }<\/pre>\n
} #end<\/span> Try-Ping<\/pre>\n<\/div>\n<\/div>\n
The function takes a computername as a parameter and returns $True if the computername can be pinged. The rest of the original script was primarily the port scanning code, which again can be neatly modularized. One main change I introduced was to create a custom object with computer and port information. The existing script was merely checking in the port was open, but there’s other useful information so why not use it? You’ll see at the end how this all comes together, but here’s my port scanning function.<\/p>\n
\n
\n
Function Scan-Port {<\/pre>\n
    Param([string]$computername=$env:computername,<\/pre>\n
          [array]$ports=@(\"21\"<\/span>,\"22\"<\/span>,\"23\"<\/span>,\"25\"<\/span>,\"80\"<\/span>,\"443\"<\/span>,\"3389\"<\/span>)<\/pre>\n
         )<\/pre>\n
  #turn off error pipeline  <\/span><\/pre>\n
  $ErrorActionPreference = \"SilentlyContinue\"<\/span><\/pre>\n
  <\/pre>\n
  #set values for Write-Progress<\/span><\/pre>\n
  $activity=\"Port Scan\"<\/span><\/pre>\n
  $status=\"Scanning $computername\"<\/span><\/pre>\n
  $i=0<\/pre>\n
    <\/pre>\n
       foreach<\/span> ($port in<\/span> $ports){ <\/pre>\n
       $i++<\/pre>\n
        Write-Progress -Activity $activity -status $status `<\/pre>\n
        -currentoperation \"port $port\"<\/span> -percentcomplete (($i\/$ports.count)*100)<\/pre>\n
       <\/pre>\n
        #create empty custom object<\/span><\/pre>\n
        $obj=New-Object PSObject<\/pre>\n
        $obj | Add-Member -MemberType Noteproperty -name \"Computername\"<\/span> -value $computername.ToUpper()<\/pre>\n
        $obj | Add-Member -MemberType Noteproperty -name \"Port\"<\/span> -value $port<\/pre>\n
        <\/pre>\n
        $tcp=New-Object System.Net.Sockets.TcpClient($computername, $port)<\/pre>\n
        <\/pre>\n
        if<\/span> ($tcp.client.connected) {<\/pre>\n
 <\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"PortOpen\"<\/span> -value $True<\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"TTL\"<\/span> -value $($tcp.client.ttl)<\/pre>\n
            <\/pre>\n
            [string]$rep=$tcp.client.RemoteEndPoint<\/pre>\n
            [string]$ip=$rep.substring(0,$rep.indexof(\":\"<\/span>))<\/pre>\n
            <\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"RemoteIP\"<\/span> -value $ip<\/pre>\n
 <\/pre>\n
            }<\/pre>\n
        else<\/span> {<\/pre>\n
#            Write-Warning \"$computername not open on port: $port\"<\/span><\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"PortOpen\"<\/span> -value $False<\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"TTL\"<\/span> -value -1<\/pre>\n
            $obj | Add-Member -MemberType Noteproperty -name \"RemoteIP\"<\/span> -value $Null<\/pre>\n
         }  #end Else<\/span><\/pre>\n
         <\/pre>\n
            write $obj<\/pre>\n
            #disconnect the socket connection<\/span><\/pre>\n
            $tcp.client.disconnect($False)<\/pre>\n
 <\/pre>\n
        } #end foreach<\/span><\/pre>\n
        <\/pre>\n
        #dispose and disconnect<\/span><\/pre>\n
        $tcp.close()<\/pre>\n
 <\/pre>\n
        Write-Progress -Activity $activity -status \"Complete\"<\/span> -Completed<\/pre>\n
        <\/pre>\n
} #end function<\/span><\/pre>\n<\/div>\n<\/div>\n
The function takes a computername and an array of ports as parameters. I’ve provided a set of defaults. Most of the code is the same as the original script except I create a custom object and populate with some properties. I also use the Write-Progress<\/strong> cmdlet to provide feedback about what the script is doing. Here’s how I might use this function once it’s been loaded into my PowerShell session. <\/p>\n
PS C:\\test> scan-port blog.sapien.com -ports @(25,80) <\/font><\/p>\n
Computername : BLOG.SAPIEN.COM
Port         : 25
PortOpen     : False
TTL          : -1
RemoteIP     : <\/font><\/p>\n
Computername : BLOG.SAPIEN.COM
Port         : 80
PortOpen     : True
TTL          : 128
RemoteIP     : 63.131.159.243<\/font> <\/p>\n
Or how about including the ping test? Now that I have objects, I can sort, filter, format, export or whatever. <\/p>\n
$ports=get-content ports.txt<\/font><\/p>\n
get-content computers.txt | foreach { 
if (Try-Ping $_) { 
   Scan-Port -computername $_ -ports $ports}
   } | sort Computername | Format-Table -group computername -auto<\/font><\/p>\n
This will scan the list of ports from ports.txt. Finally, what about TheAdminGuy’s original goal? Here’s my slightly modified version of what I think he is trying to accomplish.<\/p>\n
\n
\n
$ports=get-content ports.txt<\/pre>\n
 <\/pre>\n
get-content computers.txt | foreach<\/span> {<\/pre>\n
 if<\/span> (Try-Ping $_) {<\/pre>\n
   $results=Scan-port -computer $_ -ports $ports<\/pre>\n
   write-host \"$_ Ports \"<\/span> -foreground \"GREEN\"<\/span> -nonewline<\/pre>\n
   foreach<\/span> ($port in<\/span> $results) {<\/pre>\n
    if<\/span> ($port.Portopen) {<\/pre>\n
        write-host \"$($port.Port) \"<\/span> -foreground \"GREEN\"<\/span> -nonewline<\/pre>\n
    }<\/pre>\n
    else<\/span> {<\/pre>\n
        write-host \"$($port.Port) \"<\/span> -foreground \"RED\"<\/span> -nonewline<\/pre>\n
    }<\/pre>\n
   }<\/pre>\n
   <\/pre>\n
 } #end if try-ping<\/span><\/pre>\n
 else<\/span> {<\/pre>\n
    write-host \"$_ not found\"<\/span> -foreground \"RED\"<\/span> -nonewline<\/pre>\n
 }<\/pre>\n
Write-Host `r<\/pre>\n
} #end<\/span> foreach<\/pre>\n<\/div>\n<\/div>\n
These lines could be entered interactively in the shell, or put into a PS1 file, which is what I would do. I would dot source the scan port script at the beginning and I’m good to go! Now I have a port scanning function and I can use the output anyway I want.  I also now have a ping test function that I can re-use often. <\/p>\n
These are the concepts I try to stress in forums I frequent and when teaching PowerShell. Break your work down into re-usable components centered around objects and leverage the pipeline to pull everything together. <\/p>\n
\n
You can download a zip file with my script samples here.<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
I recently guest-hosted Episode 69 the PowerScripting Podcast. One of the items we discussed was a port scanning script from TheAdminGuy blog. Here’s the original script: http:\/\/theadminguy.wordpress.com\/2009\/04\/30\/portscan-with-powershell\/. As written, there’s nothing technically wrong with it. The script gets the job done and tells the user which ports are open. However, I thought this was an opportunity to demonstrate an even more PowerShell-like approach. Even the author admits there are limitations to his script.<\/p>\n
Whenever I see a script like this, the first thing I try to do is separate the functionality. In the VBScript days we would write monolithic scripts to do everything. Sure, we might write a function or subroutine, but based on my forum experiences, even that was not a common occurrence. In PowerShell, we want to use smaller, cmdlet-like tools that leverage the pipeline.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[501,28,503,57,502],"class_list":["post-1414","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-port","tag-powershell","tag-scan","tag-scripting","tag-socket"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=1414"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1414\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=1414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=1414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=1414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}