MagicTree is a tool developed in Java by Gremwell. It enables to organize data gathered during a pentest. The tool also enables to launch commands (Nmap, Nikto, ...) for a better integration of the results. Here are some of the features:
- Automatic creation of nodes from netblock address
- Drag and drop objects from the tree
- Launch CLI-based tools (Nmap, Nikto, ...) from MagicTree
- Import results from other tools (Nessus, ...)
- Sort findings by severity
- Generate reports (*.odt, *.docx)
- And much more...
This article introduces the basics of the tool. For a more complete documentation, please refer to http://www.gremwell.com/magictreedoc/.
You will need to install Java. Under *ubuntu, edit your /etc/apt/sources.list file and uncomment these 2 repositories:
deb http://archive.canonical.com/ubuntu lucid partner deb-src http://archive.canonical.com/ubuntu lucid partner
Then update your local repositories and install Java:
$ sudo apt-get update $ sudo apt-get install sun-java6-plugin
$ mkdir -p /pentest/misc/magictree/ $ cd /pentest/misc/magictree/ $ wget http://www.gremwell.com/dist/1381.5c2a7c0734ce8c65ba59f3c2b8884470/MagicTree-1381.jar
To start MagicTree, simply issue following command:
$ cd /pentest/misc/magictree/ $ java -jar MagicTree-1381.jar
You should see following screen:
Create, rename and delete nodes
To automatically create a node from a netblock (e.g. 192.168.100.0/24), select "Node > Auto Create" from the menu. Then, enter the netblock with the CIDR form.
- To create a node from the root, right click on the top node and select:
- "Create child > Branch Node" to create a new branch
- "Create Child > Simple Node" to create an object (e.g. host)
- To rename an object, double click on it to edit the label.
- To delete an object, right click on it and select "Delete" from the menu.
Also notice that you can move any object by drag/drop-ing it.
Tables enable to use a list of hosts in a command line (e.g. Nmap). In the example above, we use -iL $in to use the list of hosts/networks:
- -iL <inputfilename>: Input from list of hosts/networks
- $in: Variable used to process data from the table
We also use an output to be able to get the results of our command:
- -oX <file>: Output scan in XML format
- $out: Variable that will be processed to inject the results in the tree.
Click on "Console" to see the scan running (usefull to enter sudo password).
Once the scan is finished, select $out in the variables and click on "Import" to inject the results in the tree.
Import results from external tools
On the right hand side of the window frame there is a button that says "Repo Browser". Clicking on it opens the query and method repository. You can browse it by tags and execute queries and methods stored in it. You can also save the queries and commands that you use to the repository, to be able to quickly execute them later.
Once you have completed your penetration tests, you can export the results in a *.odt (OpenOffice) or *.docx (MS Office) file. Select "Report > Generate Report" from the menu, and select one of the templates available in the ~/.magictree/report-templates/ directory.
Notice that if you use KDE (e.g. Kubuntu), you will get an error:
20:18.14 Report generation failed java.lang.UnsupportedOperationException: Desktop API is not supported on the current platform at java.awt.Desktop.getDesktop(Desktop.java:144) at bU.b(SourceFile:277) at bU.a(SourceFile:78) at bU.a(SourceFile:24) at cV.run(SourceFile:244) at java.lang.Thread.run(Thread.java:636) 20:18.14 java.lang.UnsupportedOperationException: Desktop API is not supported on the current platform at java.awt.Desktop.getDesktop(Desktop.java:144) at bU.b(SourceFile:277) at bU.a(SourceFile:78) at bU.a(SourceFile:24) at cV.run(SourceFile:244) at java.lang.Thread.run(Thread.java:636)
It appears that the Java Desktop API that MagicTree is using to start OpenOffice does not work in KDE (it only works on Gnome). For more information on that issue, refer to http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6486393.
Although, the reports are successfully generated and saved in your ~/.magictree/tmp/ directory.