Daniel Goldberg 2017-09-25 18:02:21 +03:00
parent d5f6812a08
commit f3a172fc4a
3 changed files with 12 additions and 19 deletions

View File

@ -189,6 +189,7 @@ class Configuration(object):
8008, # HTTP alternate 8008, # HTTP alternate
] ]
tcp_target_ports = [22, tcp_target_ports = [22,
2222,
445, 445,
135, 135,
3389, 3389,

View File

@ -9,15 +9,15 @@ from model.host import VictimHost
from network import HostFinger from network import HostFinger
ES_PORT = 9200 ES_PORT = 9200
ES_SERVICE = 'es-3306' ES_SERVICE = 'elastic-seach-3306'
ES_HTTP_TIMEOUT = 5
LOG = logging.getLogger(__name__) LOG = logging.getLogger(__name__)
__author__ = 'danielg' __author__ = 'danielg'
class ElasticFinger(HostFinger): class ElasticFinger(HostFinger):
""" """
Fingerprints mysql databases, only on port 3306 Fingerprints elastic search clusters, only on port 3306
""" """
def __init__(self): def __init__(self):
@ -32,11 +32,12 @@ class ElasticFinger(HostFinger):
assert isinstance(host, VictimHost) assert isinstance(host, VictimHost)
try: try:
url = 'http://%s:%s/' % (host.ip_addr, ES_PORT) url = 'http://%s:%s/' % (host.ip_addr, ES_PORT)
with closing(requests.get(url, timeout=1)) as req: with closing(requests.get(url, timeout=ES_HTTP_TIMEOUT)) as req:
data = json.loads(req.text) data = json.loads(req.text)
host.services[ES_SERVICE] = {} host.services[ES_SERVICE] = {}
host.services[ES_SERVICE]['name'] = 'ElasticSearch' host.services[ES_SERVICE]['name'] = 'ElasticSearch'
host.services[ES_SERVICE]['cluster_name'] = data['name'] host.services[ES_SERVICE]['cluster_name'] = data['cluster_name']
host.services[ES_SERVICE]['name'] = data['name']
host.services[ES_SERVICE]['version'] = data['version']['number'] host.services[ES_SERVICE]['version'] = data['version']['number']
return True return True
except Timeout: except Timeout:

View File

@ -1,8 +1,10 @@
import sys
import socket import socket
import sys
import psutil import psutil
from enum import IntEnum from enum import IntEnum
from network.info import get_host_subnets, local_ips
from network.info import get_host_subnets
__author__ = 'uri' __author__ = 'uri'
@ -68,18 +70,7 @@ class InfoCollector(object):
"cmdline": " ".join(process.cmdline()), "cmdline": " ".join(process.cmdline()),
"full_image_path": process.exe(), "full_image_path": process.exe(),
} }
except psutil.AccessDenied: except (psutil.AccessDenied, WindowsError):
# we may be running as non root
# and some processes are impossible to acquire in Windows/Linux
# in this case we'll just add what we can
processes[process.pid] = {"name": "null",
"pid": process.pid,
"ppid": process.ppid(),
"cmdline": "ACCESS DENIED",
"full_image_path": "null",
}
continue
except WindowsError:
# we may be running as non root # we may be running as non root
# and some processes are impossible to acquire in Windows/Linux # and some processes are impossible to acquire in Windows/Linux
# in this case we'll just add what we can # in this case we'll just add what we can