diff --git a/CHANGELOG.md b/CHANGELOG.md index e47936c55..02f2301a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,7 @@ Changelog](https://keepachangelog.com/en/1.0.0/). - MITRE ATT&CK configuration screen. #1532 - Propagation credentials from "GET /api/monkey/" endpoint. #1538 - "GET /api/monkey_control/check_remote_port/" endpoint. #1635 +- MySQL fingerprinter. #1648 ### Fixed - A bug in network map page that caused delay of telemetry log loading. #1545 diff --git a/docs/content/reference/scanners/_index.md b/docs/content/reference/scanners/_index.md index 8cca71b21..6de0a8099 100644 --- a/docs/content/reference/scanners/_index.md +++ b/docs/content/reference/scanners/_index.md @@ -29,8 +29,7 @@ The currently implemented Fingerprint modules are: 2. [`SSHFinger`][ssh-finger] - Fingerprints target machines over SSH (port 22) and extracts the computer version and SSH banner. 3. [`PingScanner`][ping-scanner] - Fingerprints target machine's TTL to differentiate between Linux and Windows hosts. 4. [`HTTPFinger`][http-finger] - Detects HTTP/HTTPS services, using the ports listed in `HTTP_PORTS` in the configuration, will return the server type and if it supports SSL. -5. [`MySQLFinger`][mysql-finger] - Fingerprints MySQL (port 3306) and will extract MySQL banner info - version, major/minor/build and capabilities. -6. [`ElasticFinger`][elastic-finger] - Fingerprints ElasticSearch (port 9200) will extract the cluster name, node name and node version. +5. [`ElasticFinger`][elastic-finger] - Fingerprints ElasticSearch (port 9200) and will extract the cluster name, node name and node version. ## Adding a scanner/fingerprinter @@ -44,7 +43,6 @@ At this point, the Infection Monkey knows how to use the new scanner/fingerprint [http-finger]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/httpfinger.py [host-finger]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/__init__.py [host-scanner]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/__init__.py - [mysql-finger]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/mysqlfinger.py [ping-scanner]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/ping_scanner.py [smb-finger]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/smbfinger.py [ssh-finger]: https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/network/sshfinger.py diff --git a/monkey/infection_monkey/example.conf b/monkey/infection_monkey/example.conf index 42b37ddf4..8468b1422 100644 --- a/monkey/infection_monkey/example.conf +++ b/monkey/infection_monkey/example.conf @@ -38,7 +38,6 @@ "SSHFinger", "HTTPFinger", "SMBFinger", - "MySQLFinger", "MSSQLFingerprint", "ElasticFinger" ], diff --git a/monkey/infection_monkey/network/mysqlfinger.py b/monkey/infection_monkey/network/mysqlfinger.py deleted file mode 100644 index d0bc14dc6..000000000 --- a/monkey/infection_monkey/network/mysqlfinger.py +++ /dev/null @@ -1,85 +0,0 @@ -import logging -import socket - -import infection_monkey.config -from infection_monkey.network.HostFinger import HostFinger -from infection_monkey.network.tools import struct_unpack_tracker, struct_unpack_tracker_string - -MYSQL_PORT = 3306 -SQL_SERVICE = "mysqld-3306" -logger = logging.getLogger(__name__) - - -class MySQLFinger(HostFinger): - """ - Fingerprints mysql databases, only on port 3306 - """ - - _SCANNED_SERVICE = "MySQL" - SOCKET_TIMEOUT = 0.5 - HEADER_SIZE = 4 # in bytes - - def __init__(self): - self._config = infection_monkey.config.WormConfiguration - - def get_host_fingerprint(self, host): - """ - Returns mySQLd data using the host header - :param host: - :return: Success/failure, data is saved in the host struct - """ - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - s.settimeout(self.SOCKET_TIMEOUT) - - try: - s.connect((host.ip_addr, MYSQL_PORT)) - header = s.recv(self.HEADER_SIZE) # max header size? - - response, curpos = struct_unpack_tracker(header, 0, "I") - response = response[0] - response_length = response & 0xFF # first byte is significant - data = s.recv(response_length) - # now we can start parsing - protocol, curpos = struct_unpack_tracker(data, 0, "B") - protocol = protocol[0] - - if protocol == 0xFF: - # error code, bug out - logger.debug("Mysql server returned error") - return False - - version, curpos = struct_unpack_tracker_string( - data, curpos - ) # special coded to solve string parsing - version = version[0].decode() - self.init_service(host.services, SQL_SERVICE, MYSQL_PORT) - host.services[SQL_SERVICE]["version"] = version - version = version.split("-")[0].split(".") - host.services[SQL_SERVICE]["major_version"] = version[0] - host.services[SQL_SERVICE]["minor_version"] = version[1] - host.services[SQL_SERVICE]["build_version"] = version[2] - thread_id, curpos = struct_unpack_tracker(data, curpos, "