Variable Nmap Scan Action Content to create an Uber Nmap Scan Action

(imported topic written by rmnetops91)

Does anyone know how to change static text of an action to be a variable instead, which will vary depending on the client it runs on?

For example, I want to dynamically set the IP range that nmap scans, based on the subnet of the machine where the nmap scan is being executed on (this way I don’t need to have 90+ actions for each of our subnets).

Example, here is the action in question from the Nmap scan task:

appendfile “{pathname of client folder of site “BESSupport” & “\RunQuiet.exe”}” “{pathname of folder “BESScanner-NMAP\NMAP” of parent folder of regapp “BESClient.exe”}\nmap.exe” -sV -sS -sU -p T:135,T:139,T:445,U:{value “ListenPort” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions” of registry} --exclude “{concatenation “,” of (addresses whose (it as string != “0.0.0.0”) of ip interfaces whose (loopback of it = false) of network as string)}”{if (exists key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP” whose (value “NmapVersion” of it as string as version = “4.20”) of registry) then " -O1 --osscan-guess" else " -O --osscan-guess"} -PE -PA80 -T 4 10.50.0-10.1-254 -oX “{pathname of windows folder}\temp\nmap\nmap-{computer name}-{(now - “01 Jan 1970 00:00:00” as local time)/second}.xml” >NUL 2>NUL

I want to change the static value of “10.50.0-10.1-254” shown in the second to last line above, to instead be something like the following:

{dynamically grab the first two octets of the subnet the BES agent is running the nmap scan from}.0-10.1-254

Any ideas?

(imported comment written by rmnetops91)

Figured it out.

Being that we use class B subnets, I replaced the flat text:

10.50.0-10.1-254

in the nmap command with:

preceding text of last “.0.0” of (subnet address of ip interfaces whose (loopback of it = false) of network as string).0-10.1-254

So it looks like this:

appendfile “{pathname of client folder of site “BESSupport” & “\RunQuiet.exe”}” “{pathname of folder “BESScanner-NMAP\NMAP” of parent folder of regapp “BESClient.exe”}\nmap.exe” -sV -sS -sU -p T:135,T:139,T:445,U:{value “ListenPort” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions” of registry} --exclude “{concatenation “,” of (addresses whose (it as string != “0.0.0.0”) of ip interfaces whose (loopback of it = false) of network as string)}”{if (exists key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP” whose (value “NmapVersion” of it as string as version = “4.20”) of registry) then " -O1 --osscan-guess" else " -O --osscan-guess"} -PE -PA80 -T 4 {preceding text of last “.0.0” of (subnet address of ip interfaces whose (loopback of it = false) of network as string)}.0-10.1-254 -oX “{pathname of windows folder}\temp\nmap\nmap-{computer name}-{(now - “01 Jan 1970 00:00:00” as local time)/second}.xml” >NUL 2>NUL

It’s beautiful!