def POST(self):
params = web.input()
kw = {
k: params[k].strip()
for k in ("title", "url", "ip", "port", "protocol", "level", "os",
"server_info", "middleware", "description", "project_id")
}
Host.insert(**kw)
return jsonSuccess()
def POST(self):
params = web.input()
kw = {
k: params[k].strip()
for k in ("title", "url", "ip", "port", "protocol", "level", "os",
"server_info", "middleware", "description")
}
Host.where(id=params.id.strip()).update(**kw)
return jsonSuccess()
def GET(self):
params = web.input()
try:
projectid = int(params.id)
except (ValueError, AttributeError):
raise web.internalerror("parameter error.")
project = Project.getraw(projectid)
if project:
hosts = Host.where(project_id=projectid,tmp=0).getsraw()
for host in hosts:
host['vuls'] = Vul.where(host_id=host['id']).getsraw('name','url','info','type','level','description')
host['comments'] = Comment.where(host_id=host['id']).getsraw('name','url','info','level','description')
del host['id']
del host['tmp']
del host['project_id']
project['hosts'] = hosts
del project['id']
projectName = "_".join(project['name'].split(" "))
projectFile = os.path.join("static","tmp",projectName+".proj")
try:
with open(projectFile,'w') as fd:
json.dump(project, fd)
except IOError:
raise web.internalerror("save imported project failed")
def GET(self):
params = web.input()
result = Host.where(project_id=params.projectid.strip(),
tmp=0).orderby(params.orderby.strip()).getsraw(
'id', 'title', 'url', 'ip', 'level',
'protocol')
return json.dumps(result)
def GET(self):
params = web.input()
try:
projectid = int(params.id)
except (ValueError, AttributeError):
raise web.internalerror("parameter error.")
project = Project.getraw(projectid)
if project:
hosts = Host.where(project_id=projectid, tmp=0).getsraw()
for host in hosts:
host['vuls'] = Vul.where(host_id=host['id']).getsraw(
'name', 'url', 'info', 'type', 'level', 'description')
host['comments'] = Comment.where(host_id=host['id']).getsraw(
'name', 'url', 'info', 'level', 'description')
del host['id']
del host['tmp']
del host['project_id']
project['hosts'] = hosts
del project['id']
projectName = "_".join(project['name'].split(" "))
projectFile = os.path.join("static", "tmp", projectName + ".proj")
try:
with open(projectFile, 'w') as fd:
json.dump(project, fd)
except IOError:
raise web.internalerror("save imported project failed")
def GET(self):
web.header('Content-Type', 'application/json')
params = web.input()
try:
hid = str(int(params.id))
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
try:
Host.delete(hid)
except (KeyError, AttributeError, FieldError, ModelError, DBError) as error:
RTD.log.error(error)
raise web.internalerror(error)
return jsonSuccess()
def POST(self):
web.header('Content-Type', 'application/json')
params = web.input(projectfile={})
try:
fileName = params.projectfile.filename
fileStr = params.projectfile.value
except AttributeError:
raise web.internalerror("Missing parameter.")
projectDict = json.loads(fileStr)
hosts = projectDict.get("hosts", [])
try:
del projectDict['hosts']
except KeyError:
pass
try:
Project(**projectDict).save()
except DBError as error:
raise web.internalerror("failed to insert project " + str(error))
projectid = Project.where(
name=projectDict.get('name')).getsraw('id')[0]['id']
for host in hosts:
vuls = host.get("vuls", [])
comments = host.get("comments", [])
try:
del host['vuls']
del host['comments']
except KeyError:
pass
host['project_id'] = projectid
Host(**host).save()
kwargs = {
key: host[key]
for key in ['url', 'ip', 'port'] if key in host
}
hostid = Host.where(**kwargs).getsraw('id')[0]['id']
for vul in vuls:
vul['host_id'] = hostid
Vul(**vul).save()
for comment in comments:
comment['host_id'] = hostid
Comment(**comment).save()
return jsonSuccess()
def handle(self, data):
if not isinstance(data, Host):
self.put(data)
else:
dnsresolver = DnsResolver(data.url)
records = dnsresolver.getZoneRecords()
for line in records:
if line[2] == "A":
self.put(
Host(url=line[0],
ip=line[1],
description="Generated by zonetrans plugin."))
elif line[2] == "CNAME":
self.put(
Host(url=line[0],
description=
"Generated by zonetrans plugin. Domain alias " +
line[1]))
def GET(self):
web.header('Content-Type', 'application/json')
params = web.input()
try:
hid = str(int(params.id))
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
try:
Host.delete(hid)
except (KeyError, AttributeError, FieldError, ModelError,
DBError) as error:
RTD.log.error(error)
raise web.internalerror(error)
return jsonSuccess()
def handle(self, data):
if not isinstance(data, Host):
self.put(data)
else:
for host in ServiceIdentify(self.ptype, **data):
if 'description' in data: host.description = data.description
if 'level' in data: host.level = data.level
if host.get('protocol', None) in ['http', 'https']:
if 'url' in data: host.url = data.url
if 'title' in data: host.title = data.title
self.put(Host(**host))
def handle(self, data):
if not isinstance(data, Host):
self.put(data)
return
try:
dataDomain = self.urlPattern.match(data.url).groups()[0].lower()
except AttributeError:
raise PluginError("dns brute plugin, domain format error")
for item in DnsBrute(dataDomain, self.dictlist, self.bruteTopDomain):
self.put(Host(**item))
def POST(self):
web.header('Content-Type', 'application/json')
originParams = web.input()
options = (("domain", "string", "1-200"), ("type", "integer", "0-3"),
("project_id", "integer", ""))
try:
params = formatParam(originParams, options)
except ParamError as error:
raise web.internalerror("Parameter error, {0}.".format(error))
domain = params.domain.lower()
protocol = ""
port = None
#resolve protocol
if domain.startswith("http://"):
protocol = "http"
domain = domain[7:]
port = 80
elif domain.startswith("https://"):
protocol = "https"
domain = domain[8:]
port = 443
elif "://" in domain:
raise web.internalerror(
"unrecognized protocol, should be 'http' or 'https'.")
#resolve port
try:
pos = domain.rindex(":")
except ValueError:
pass
else:
try:
port = int(domain[pos + 1:])
except ValueError:
pass
domain = domain[:pos]
if not protocol: protocol = "http"
if not port: port = 80
task = ServiceIdentifyPlugin(ptype=int(params.type)) | DataSavePlugin(
projectid=params.project_id)
host = Host(url=domain, protocol=protocol, port=port)
task.dostart([host])
return jsonSuccess()
def GET(self):
web.header('Content-Type', 'application/json')
params = web.input()
try:
projectid = int(params.project_id)
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
iplist = self.getIPList(projectid)
hosts = Host.where(project_id=projectid, tmp=1).orderby("ip").getsraw('id','title','ip','port','protocol')
result = {'iplist':iplist, 'hosts':hosts}
return json.dumps(result)
def handle(self, data):
if not isinstance(data, Host):
self.put(data)
else:
try:
hostStr = data.ip + "/24"
except AttributeError:
raise PluginError(
"SubnetScanPlugin plugin got an invalid model")
portStr = ",".join([str(x) for x in self.portList])
cmd = "nmap -n -PS{ports} -p{ports} {host} -oX -".format(
ports=portStr, host=hostStr)
result = Nmap.scan(cmd)
for host in result:
self.put(Host(**host))
def GET(self):
params = web.input()
if not params.id.strip().isdigit():
raise web.internalerror("Parameter type error.")
host = Host.get(params.id.strip())
vuls = Vul.where(host_id=host.id).gets("id")
for vul in vuls:
vul.remove()
comments = Comment.where(host_id=host.id).gets("id")
for comment in comments:
comment.remove()
host.remove()
return jsonSuccess()
def GET(self):
web.header('Content-Type', 'application/json')
params = web.input()
try:
projectid = int(params.project_id)
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
iplist = self.getIPList(projectid)
hosts = Host.where(project_id=projectid, tmp=1).orderby("ip").getsraw(
'id', 'title', 'ip', 'port', 'protocol')
result = {'iplist': iplist, 'hosts': hosts}
return json.dumps(result)
def GET(self):
params = web.input()
if not params.id.strip().isdigit():
raise web.internalerror("Parameter type error.")
host = Host.get(params.id.strip())
vuls = Vul.where(host_id=host.id).gets("id")
for vul in vuls:
vul.remove()
comments = Comment.where(host_id=host.id).gets("id")
for comment in comments:
comment.remove()
host.remove()
return jsonSuccess()
def POST(self):
web.header('Content-Type', 'application/json')
params = web.input(projectfile={})
try:
fileName = params.projectfile.filename
fileStr = params.projectfile.value
except AttributeError:
raise web.internalerror("Missing parameter.")
projectDict = json.loads(fileStr)
hosts = projectDict.get("hosts",[])
try:
del projectDict['hosts']
except KeyError:
pass
try:
Project(**projectDict).save()
except DBError as error:
raise web.internalerror("failed to insert project "+str(error))
projectid = Project.where(name=projectDict.get('name')).getsraw('id')[0]['id']
for host in hosts:
vuls = host.get("vuls",[])
comments = host.get("comments",[])
try:
del host['vuls']
del host['comments']
except KeyError:
pass
host['project_id'] = projectid
Host(**host).save()
kwargs = {key:host[key] for key in ['url','ip','port'] if key in host}
hostid = Host.where(**kwargs).getsraw('id')[0]['id']
for vul in vuls:
vul['host_id'] = hostid
Vul(**vul).save()
for comment in comments:
comment['host_id'] = hostid
Comment(**comment).save()
return jsonSuccess()
def POST(self):
web.header('Content-Type', 'application/json')
params = web.input()
rawParam = web.data()
try:
projectid = int(params.project_id)
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
rawParamList = [x.split("=") for x in rawParam.split("&")]
ipList = [x[1] for x in rawParamList if x[0] == "iplist"]
hosts = [Host(ip=x) for x in ipList]
defaultValue = {"tmp": 1}
task = SubnetScanPlugin() | ServiceIdentifyPlugin(
ptype=1) | DataSavePlugin(defaultValue=defaultValue,
projectid=projectid)
task.dostart(hosts)
return jsonSuccess()
def getIPList(self, projectid):
try:
hosts = Host.where(project_id=projectid).getsraw("ip")
except (KeyError, AttributeError, FieldError, ModelError, DBError) as error:
RTD.log.error(error)
raise web.internalerror(error)
result = list()
for host in hosts:
try:
pos = host['ip'].rindex(".")
ip = host['ip'][:pos] + ".1"
except (KeyError, ValueError, AttributeError):
continue
for key in result:
if ip == key[0]:
key[1] += 1
break
else:
result.append([ip,1])
return result
def POST(self):
web.header('Content-Type', 'application/json')
params = web.input()
rawParam = web.data()
try:
projectid = int(params.project_id)
except AttributeError as error:
RTD.log.error(error)
raise web.internalerror(error)
rawParamList = [x.split("=") for x in rawParam.split("&")]
dictList = [x[1] for x in rawParamList if x[0] == "dictlist"]
options = (("domain", "url", ""), )
try:
domainParams = formatParam(params, options)
except ParamError as error:
raise web.internalerror("Parameter error, {0}.".format(error))
task = None
if "dnsbrute" in params.keys():
task = DnsBrutePlugin(dictList)
if "googlehacking" in params.keys():
task = (task +
GoogleHackingPlugin()) if task else GoogleHackingPlugin()
if "zonetrans" in params.keys():
task = (task + ZoneTransPlugin()) if task else ZoneTransPlugin()
if task is None:
task = GoogleHackingPlugin()
task = task | ServiceIdentifyPlugin() | DataSavePlugin(
projectid=projectid)
host = Host(url=domainParams.domain)
task.dostart([host])
return jsonSuccess()
def getIPList(self, projectid):
try:
hosts = Host.where(project_id=projectid).getsraw("ip")
except (KeyError, AttributeError, FieldError, ModelError,
DBError) as error:
RTD.log.error(error)
raise web.internalerror(error)
result = list()
for host in hosts:
try:
pos = host['ip'].rindex(".")
ip = host['ip'][:pos] + ".1"
except (KeyError, ValueError, AttributeError):
continue
for key in result:
if ip == key[0]:
key[1] += 1
break
else:
result.append([ip, 1])
return result
def handle(self, data):
if not isinstance(data, Host):
self.put(data)
else:
try:
domain = data.url[4:] if data.url.startswith("www.") else data.url
except AttributeError:
raise PluginError("GoogleHackingPlugin plugin got an invalid model")
query = Query(site=domain) | -Query(site="www."+domain)
resultBaidu = query.doSearch(engine="baidu", size=10)
resultBing = query.doSearch(engine="bing", size=10)
urlSet = set()
for line in itertools.chain(resultBaidu,resultBing):
try:
url = self.urlPattern.match(line.url).groups()[0]
except AttributeError:
continue
else:
if url not in urlSet:
urlSet.add(url)
description = "Generated by googlehacking plugin.\r\n" + "href: " + line.url + "\r\n" + "description: " + line.brief
host = Host(title=line.title,url=url,description=description)
self.put(host)
def GET(self):
params = web.input()
result = Host.where(project_id=params.projectid.strip(),tmp=0).orderby(params.orderby.strip()).getsraw('id','title','url','ip','level','protocol')
return json.dumps(result)
def POST(self):
params = web.input()
kw = {k:params[k].strip() for k in ("title","url","ip","port","protocol","level","os","server_info","middleware","description","project_id")}
Host.insert(**kw)
return jsonSuccess()
def GET(self):
params = web.input()
result = Host.getraw(params.id)
return json.dumps(result)
def POST(self):
params = web.input()
kw = {k:params[k].strip() for k in ("title","url","ip","port","protocol","level","os","server_info","middleware","description")}
Host.where(id=params.id.strip()).update(**kw)
return jsonSuccess()
def __parse_options():
parser = argparse.ArgumentParser(description="配置下发/获取工具")
parser.add_argument("-a",
"--account",
type=str,
help="""
登录时的用户名密码，可指定多对。用户名和密码之间用空格分隔；每对之间用空格分隔。
如：
user1 pass1 user2 pass2 user3 pass3
如果同时指定了--account-from-file, 则以--account-from-file为准
""")
parser.add_argument(
"--account-from-file",
help="以文件的形式指定用户名密码。格式为: user1 pass1<换行>user2 pass2<换行>user3 pass3"
)
# get or set
parser.add_argument("--opmode",
choices=[consts.OP_MODE_GET, consts.OP_MODE_SET],
required=True,
help="操作模式（设置:get, 还是读取: set)")
parser.add_argument("--one-command-timeout",
type=int,
default=600,
help="get模式下每条命令超时时间(一条命令最长执行多久). 单位为秒. 默认为600")
# 采用手动登录的形式， 不借助库来登录； 只依赖于prompt
# # 这个device-type选项只在ssh中有用， 如果写了auto, 会自动探测
# parser.add_argument(
# "-t", "--device-type",
# choices=[
# consts.MF_CISCO, consts.MF_HUAWEI, consts.MF_H3C,
# consts.MF_JUNIPER, consts.MF_LINUX, consts.MF_AUTODETECT
# ],
# default=consts.MF_AUTODETECT,
# help="设备类型, 只针对ssh登录(opmode=set). h3c的自动检测不出来, 可以指定一下. 默认自动检测, 支持: cisco|h3c|juniper|huawei|linux|autodetect")
parser.add_argument("--host",
default='',
required=False,
help="""
对哪个host的设备操作，多个用英文逗号分隔, 每一个的格式为 ip[ device_type],
如 "192.168.3.3 cisco" 或者"192.168.3.3", 其中device_type可选, 无默认值, 不指定的话将会自动探测.
如果同时指定了--host-from-file, 以--host-from-file为准
""")
parser.add_argument("--host-from-file",
required=False,
help="""
如果host太多，可用文件指定， 一行一个, 每行的格式为: ip[ device_type].
如 "192.168.3.3 cisco" 或者"192.168.3.3", 其中device_type可选, 无默认值, 不指定的话将会自动探测.
""")
parser.add_argument("--conn-timeout",
required=False,
default=5,
type=int,
help="""
每个设备通过ssh/telnet建立TCP连接的超时时间(秒). 如果指定时间内未连接成功, 认为连接失败.
""")
parser.add_argument("--empty-command-interval",
required=False,
default=30,
type=int,
help="""
一个命令执行时间过长时, 可能会导致连接会话断开, 需要下发空命令(如空格)来实现"保活"
此选项即为 下发空命令的时间间隔, 单位为秒
""")
parser.add_argument(
"--command",
default='',
required=False,
help=
"要执行的命令，多个用英文分号分隔. 如果同时指定了command-from-file, 以--command-from-file为准"
)
parser.add_argument("--command-from-file",
required=False,
help="如果命令太多，可用文件指定，一行一条命令. 会忽略空白行")
parser.add_argument("--protocol",
default='',
choices=["ssh", "telnet"],
help="登录时使用的协议，目前支持ssh, telnet. 不指定的话取所有支持的挨个试。")
parser.add_argument("--ssh-port",
default=22,
type=int,
help="ssh协议端口，默认22")
parser.add_argument("--telnet-port",
default=23,
type=int,
help="telnet协议端口，默认23")
parser.add_argument("--command-interval",
default=0.5,
type=float,
help="两条命令之间执行的间隔，单位为秒。默认0.5")
# parser.add_argument(
# "--cmd-exec-until-prompt",
# default=False,
# action="store_true",
# help="""
# get模式时, 每条命令执行直到出现提示符(一般为主机名), 默认为true
# 如果这个选项为true, 则会忽略--cmd-interval
# """
# )
parser.add_argument("--debug",
default=False,
help="开启debug模式,默认为false",
action="store_true")
# parser.add_argument("--parallel", default=False, help="多个host并发执行,默认为false", action="store_true")
parser.add_argument("--concurrency",
default=1,
type=int,
help="并发执行时, 同时最多的协程数(默认为1). 为1时表示表示串行, 大于1表示并发")
# 对某设备在执行命令时， 发现有报错的（如： Error: Unrecognized command）， 跳过此设备
# 如在ssh中执行发现有命令报错的， telnet的也不要再执行了
parser.add_argument(
"--ignore-on-command-error",
default=False,
help="如果命令执行过程出错，是否直接跳过当前设备？ 默认为false， 即：命令执行出错就跳过当前设备",
action="store_true")
parser.add_argument("--output",
default='stdout',
choices=["stdout", "file"],
help="结果输出位置， 默认为标准输出。 如果要输出到文件， 传file")
parser.add_argument("--output-dir",
default=".",
help="如果是输出到文件， 文件放到哪个目录？ 默认为当前目录")
parser.add_argument(
"--output-filename-format",
default=
"{protocol}-{host}-{username}-{connect_ok}-{login_ok}-{time}",
help="""
如果选择输出到文件， 文件名的格式。time为生成结果时的时间，格式(年月日时分秒)如：20200723_153029.
默认为: {protocol}-{host}-{username}-{connect_ok}-{login_ok}-{time}
其中的{host}, {protocol}等为占位符， 中间的连字符可换成其他的字符。
{login_ok}表示是否登录成功， 具体的会以login_ok, login_err来作为实际的值
如： {host}@{protocol}-{time}
""")
parser.add_argument(
"--ttl",
type=int,
default=1800,
help="""
脚本执行总时长(秒), 不管多少个主机, 默认1800秒(30分钟).
如果过了这个时间, 脚本会立刻退出
""",
)
parser.add_argument(
"--output-password",
default=False,
help="""
输出结果时要不要打印密码, 默认为false
""",
action="store_true",
)
args = parser.parse_args()
args_map = vars(args)
# debug模式
global DEBUG_MODE
DEBUG_MODE = args_map.get("debug")
args_map2 = copy.deepcopy(args_map)
if not args_map.get("output_password"):
args_map2.pop("account")
debug_print("options passed from cli: {}".format(args_map2))
# 命令行参数校验
host = args_map.get("host")
host_from_file = args_map.get("host_from_file")
host_list = None # split host to list
if host:
host_list = host.split(",")
if host_from_file: # 未指定host,则从文件读取
host_list = utils.get_file_as_lines(host_from_file,
ignore_empty_line=True)
if not host_list:
utils.exit_err(msg="host is empty")
# host去重复, 如果重复给出提示
tmp_host_list = []
host_obj_list = [] # Host object slice
for host in host_list:
if not host:
continue
host = host.strip()
host_pair = host.split(" ") # format: ip[ device_type]
host_addr = host_pair[0]
host_device_type = consts.MF_AUTODETECT
if len(host_pair) > 2:
utils.exit_err("host format error: " + host)
if len(host_pair) == 2:
host_device_type = host_pair[1]
host_obj_list.append(
Host(addr=host_addr, device_type=host_device_type))
# 重复判断
if host not in tmp_host_list:
tmp_host_list.append(host)
else:
utils.exit_err(msg="duplicated host: " + host)
# 每个host都要合法(暂时按ipv4来判断）
for host_obj in host_obj_list:
host_obj.addr = host_obj.addr.strip()
if not utils.valid_ipv4(host_obj.addr):
utils.exit_err(msg="invalid ipv4 " + host_obj.addr)
args_map["host_list"] = host_obj_list
# 处理command
command = args_map.get("command")
command_from_file = args_map.get("command_from_file")
command_list = None
if command:
command_list = command.split(";")
if command_from_file:
command_list = utils.get_file_as_lines(command_from_file,
ignore_empty_line=True)
if not command_list:
utils.exit_err(msg="command is empty")
# 针对特殊前缀的命令做处理(转ascii码)
# 如C^-32 => ' '
for i, _ in enumerate(command_list):
if command_list[i].startswith(consts.EMPTY_CMD_PREFIX):
command_list[i] = chr(
int(command_list[i][len(consts.EMPTY_CMD_PREFIX):]))
args_map["command_list"] = command_list
# 处理用户名密码
account = args_map.get("account")
account_from_file = args_map.get("account_from_file")
account_list = []
accounts = [] # [u1, p1, u2, p2, ..., un, pn]
if account:
accounts = account.split(" ")
if account_from_file:
tmp_accounts = utils.get_file_as_lines(account_from_file)
for a in tmp_accounts:
pair = a.split(" ")
if len(pair) != 2:
utils.exit_err(
"username password: {} format error".format(pair))
u = pair[0].strip()
p = pair[1].strip()
accounts.append(u)
accounts.append(p)
if len(accounts) % 2 != 0:
utils.exit_err("username and password count not match")
i = 0
while i < len(accounts):
account_list.append(
Account(
username=accounts[i + 0],
password=accounts[i + 1],
string_show_password=args_map.get("output_password"),
))
i += 2
if not account_list:
utils.exit_err(msg="account is empty")
cos = CliOptions()
cos.account_list = account_list
cos.host_list = host_list
cos.command_list = command_list
fields = vars(cos)
for k in args_map:
if k in fields:
cos.__setattr__(k, args_map[k])
# print(vars(cos))
return cos
def GET(self):
params = web.input()
result = Host.getraw(params.id)
return json.dumps(result)