Sometimes Ethereum nodes are vulnerable to a JSON-RPC exploit - this is a handful of scripts to secure those funds.
Requirements:
- Shodan API key to generate targets
- Elasticsearch running locally
- Other requirements outlined in
setup.py
Generating targets works by querying shodan for geth, checking nodes which
are misconfigured by performing admin level tasks, and then checking if they
are located on the main Ethereum network (running a v1 ethereum node). Nodes
which are valid targets will be index into elasticsearch in an index named:
hackgeth_main. All other nodes which are misconfigured but not running v1
software will be indexed into hackgeth_shodan_main.
(venv) ➜ pwngeth git:(master) ✗ generate-targets-pg -h
usage: generate-targets-pg [-h] -c CONFIG --shodan_key SHODAN_KEY
Args that start with '--' (eg. --shodan_key) can also be set in a config file
(specified via -c). The config file uses YAML syntax and must represent a YAML
'mapping' (for details, see http://learn.getgrav.org/advanced/yaml). If an arg
is specified in more than one place, then commandline values override config
file values which override defaults.
optional arguments:
-h, --help show this help message and exit
-c CONFIG, --config CONFIG
config file path
--shodan_key SHODAN_KEY
Shodan API keyPwning works by first querying the hackgeth_shodan_main index for valid
targets. Once found, it will spin up a process which will try to secure the
funds for 300 seconds. Fund securing will only work if the secure funds web3
request is made while the wallet is unlocked by a user with the wallet key.
The goal of the process is to basically make so many requests that we wait until
the wallet is unlocked.
(venv) ➜ pwngeth git:(master) ✗ pwn-targets-pg -h
usage: pwn-targets-pg [-h] -c CONFIG --secure_address SECURE_ADDRESS
Args that start with '--' (eg. --secure_address) can also be set in a config
file (specified via -c). The config file uses YAML syntax and must represent a
YAML 'mapping' (for details, see http://learn.getgrav.org/advanced/yaml). If
an arg is specified in more than one place, then commandline values override
config file values which override defaults.
optional arguments:
-h, --help show this help message and exit
-c CONFIG, --config CONFIG
config file path
--secure_address SECURE_ADDRESS
Secure eth wallet addressArticle outlining the exploit: https://thehackernews.com/2018/06/ethereum-geth-hacking.html
- Make the pwn timeout configurable
DISCLAIMER
I am not responsible for any funds which are secured using these scripts. They are meant as educational purposes only.