From 10c9648854218161b968b439e8907fb0052a3a9c Mon Sep 17 00:00:00 2001 From: Daniel Goldberg Date: Mon, 25 Sep 2017 12:01:48 +0300 Subject: [PATCH 1/3] Add mysql fingerprinting and improve struct parsing --- chaos_monkey/config.py | 4 +- chaos_monkey/example.conf | 3 +- chaos_monkey/network/__init__.py | 1 + chaos_monkey/network/mysqlfinger.py | 78 +++++++++++++++++++++++++++++ chaos_monkey/network/tools.py | 28 +++++++++++ 5 files changed, 111 insertions(+), 3 deletions(-) create mode 100644 chaos_monkey/network/mysqlfinger.py diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index cfda27913..b0f615552 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -3,7 +3,7 @@ import sys from network.range import FixedRange, RelativeRange, ClassCRange from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter,\ SambaCryExploiter -from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger +from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger, MySQLFinger from abc import ABCMeta from itertools import product import uuid @@ -140,7 +140,7 @@ class Configuration(object): max_iterations = 1 scanner_class = TcpScanner - finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger] + finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger, MySQLFinger] exploiter_classes = [SmbExploiter, WmiExploiter, RdpExploiter, Ms08_067_Exploiter, # Windows exploits SSHExploiter, ShellShockExploiter, SambaCryExploiter # Linux ] diff --git a/chaos_monkey/example.conf b/chaos_monkey/example.conf index 4396cae34..55a716c7c 100644 --- a/chaos_monkey/example.conf +++ b/chaos_monkey/example.conf @@ -39,7 +39,8 @@ "SSHFinger", "PingScanner", "HTTPFinger", - "SMBFinger" + "SMBFinger", + "MySQLFinger" ], "max_iterations": 3, "monkey_log_path_windows": "%temp%\\~df1563.tmp", diff --git a/chaos_monkey/network/__init__.py b/chaos_monkey/network/__init__.py index 850159342..e7f22de28 100644 --- a/chaos_monkey/network/__init__.py +++ b/chaos_monkey/network/__init__.py @@ -23,5 +23,6 @@ from tcp_scanner import TcpScanner from smbfinger import SMBFinger from sshfinger import SSHFinger from httpfinger import HTTPFinger +from mysqlfinger import MySQLFinger from info import local_ips from info import get_free_tcp_port diff --git a/chaos_monkey/network/mysqlfinger.py b/chaos_monkey/network/mysqlfinger.py new file mode 100644 index 000000000..0bda6c5ac --- /dev/null +++ b/chaos_monkey/network/mysqlfinger.py @@ -0,0 +1,78 @@ +import socket +import logging +from network import HostFinger +from .tools import struct_unpack_tracker, struct_unpack_tracker_string +from model.host import VictimHost + +MYSQL_PORT = 3306 +SQL_SERVICE = 'mysqld-3306' + +LOG = logging.getLogger(__name__) + + +class MySQLFinger(HostFinger): + """ + Fingerprints mysql databases, only on port 3306 + """ + + def __init__(self): + self._config = __import__('config').WormConfiguration + + def get_host_fingerprint(self, host): + """ + Returns mySQLd data using the host header + :param host: + :return: Success/failure, data is saved in the host struct + """ + assert isinstance(host, VictimHost) + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.settimeout(0.5) + + try: + s.connect((host.ip_addr, MYSQL_PORT)) + header = s.recv(4) # max header size? + + tmp, curpos = struct_unpack_tracker(header, 0, "I") + tmp = tmp[0] + response_length = tmp & 0xff + data = s.recv(response_length) + # now we can start parsing + protocol, curpos = struct_unpack_tracker(data, 0, "B") + protocol = protocol[0] + + if protocol == 0xFF: + # error code, bug out + LOG.debug("Mysql server returned error") + return False + + version, curpos = struct_unpack_tracker_string(data, curpos) # special coded to solve string parsing + version = version[0] + host.services[SQL_SERVICE]['version'] = version + version = version.split('-')[0].split('.') + host.services[SQL_SERVICE]['major_version'] = version[0] + host.services[SQL_SERVICE]['minor_version'] = version[1] + host.services[SQL_SERVICE]['build_version'] = version[2] + thread_id, curpos = struct_unpack_tracker(data, curpos, " Date: Mon, 25 Sep 2017 17:34:19 +0300 Subject: [PATCH 2/3] Fix CR comments, see https://github.com/guardicore/monkey/pull/47#pullrequestreview-64871377 --- chaos_monkey/config.py | 22 ++++++++++++---------- chaos_monkey/example.conf | 1 + chaos_monkey/network/mysqlfinger.py | 21 ++++++++++++++------- chaos_monkey/network/tools.py | 3 +-- 4 files changed, 28 insertions(+), 19 deletions(-) diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index b0f615552..33c514190 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -1,13 +1,14 @@ import os import sys -from network.range import FixedRange, RelativeRange, ClassCRange -from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter,\ - SambaCryExploiter -from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger, MySQLFinger +import types +import uuid from abc import ABCMeta from itertools import product -import uuid -import types + +from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter, \ + SambaCryExploiter +from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger, MySQLFinger +from network.range import FixedRange __author__ = 'itamar' @@ -15,6 +16,7 @@ GUID = str(uuid.getnode()) EXTERNAL_CONFIG_FILE = os.path.join(os.path.abspath(os.path.dirname(sys.argv[0])), 'monkey.bin') + def _cast_by_example(value, example): """ a method that casts a value to the type of the parameter given as example @@ -178,7 +180,7 @@ class Configuration(object): range_class = FixedRange range_size = 1 - range_fixed = ['',] + range_fixed = ['10.0.1.63', ] blocked_ips = ['', ] @@ -186,7 +188,7 @@ class Configuration(object): HTTP_PORTS = [80, 8080, 443, 8008, # HTTP alternate ] - tcp_target_ports = [22, 2222, 445, 135, 3389] + tcp_target_ports = [22, 2222, 445, 135, 3389, 3306, ] tcp_target_ports.extend(HTTP_PORTS) tcp_scan_timeout = 3000 # 3000 Milliseconds tcp_scan_interval = 200 @@ -217,7 +219,7 @@ class Configuration(object): exploit_password_list = ["Password1!", "1234", "password", "12345678"] # smb/wmi exploiter - smb_download_timeout = 300 # timeout in seconds + smb_download_timeout = 300 # timeout in seconds smb_service_name = "InfectionMonkey" # Timeout (in seconds) for sambacry's trigger to yield results. @@ -243,7 +245,6 @@ class Configuration(object): # Monkey copy filename on share (64 bit) sambacry_monkey_copy_filename_64 = "monkey64_2" - # system info collection collect_system_info = True @@ -253,4 +254,5 @@ class Configuration(object): mimikatz_dll_name = "mk.dll" + WormConfiguration = Configuration() diff --git a/chaos_monkey/example.conf b/chaos_monkey/example.conf index 55a716c7c..6ef9558ae 100644 --- a/chaos_monkey/example.conf +++ b/chaos_monkey/example.conf @@ -84,6 +84,7 @@ 80, 8080, 443, + 3306, 8008 ], "timeout_between_iterations": 10, diff --git a/chaos_monkey/network/mysqlfinger.py b/chaos_monkey/network/mysqlfinger.py index 0bda6c5ac..39baa05ac 100644 --- a/chaos_monkey/network/mysqlfinger.py +++ b/chaos_monkey/network/mysqlfinger.py @@ -1,8 +1,9 @@ -import socket import logging +import socket + +from model.host import VictimHost from network import HostFinger from .tools import struct_unpack_tracker, struct_unpack_tracker_string -from model.host import VictimHost MYSQL_PORT = 3306 SQL_SERVICE = 'mysqld-3306' @@ -15,6 +16,9 @@ class MySQLFinger(HostFinger): Fingerprints mysql databases, only on port 3306 """ + SOCKET_TIMEOUT = 0.5 + HEADER_SIZE = 4 # in bytes + def __init__(self): self._config = __import__('config').WormConfiguration @@ -26,15 +30,15 @@ class MySQLFinger(HostFinger): """ assert isinstance(host, VictimHost) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - s.settimeout(0.5) + s.settimeout(self.SOCKET_TIMEOUT) try: s.connect((host.ip_addr, MYSQL_PORT)) - header = s.recv(4) # max header size? + header = s.recv(self.HEADER_SIZE) # max header size? - tmp, curpos = struct_unpack_tracker(header, 0, "I") - tmp = tmp[0] - response_length = tmp & 0xff + response, curpos = struct_unpack_tracker(header, 0, "I") + response = response[0] + response_length = response & 0xff # first byte is significant data = s.recv(response_length) # now we can start parsing protocol, curpos = struct_unpack_tracker(data, 0, "B") @@ -47,6 +51,7 @@ class MySQLFinger(HostFinger): version, curpos = struct_unpack_tracker_string(data, curpos) # special coded to solve string parsing version = version[0] + host.services[SQL_SERVICE] = {} host.services[SQL_SERVICE]['version'] = version version = version.split('-')[0].split('.') host.services[SQL_SERVICE]['major_version'] = version[0] @@ -54,6 +59,8 @@ class MySQLFinger(HostFinger): host.services[SQL_SERVICE]['build_version'] = version[2] thread_id, curpos = struct_unpack_tracker(data, curpos, " Date: Mon, 25 Sep 2017 18:07:26 +0300 Subject: [PATCH 3/3] Update config.py --- chaos_monkey/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index 33c514190..e1ebfcdcd 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -180,7 +180,7 @@ class Configuration(object): range_class = FixedRange range_size = 1 - range_fixed = ['10.0.1.63', ] + range_fixed = ['', ] blocked_ips = ['', ]