Add a Web Server based on Rogue Mysql Server to allow remote user get

Overview

介绍

对于需要使用 Rogue Mysql Server 的漏洞来说,若想批量检测这种漏洞的话需要自备一个服务器。并且我常用的Rogue Mysql Server 脚本 不支持动态更改读取文件名、不支持远程用户访问读取结果、不支持批量化检测网站。于是乎萌生了这个小脚本的想法


Rogue-MySql-Web-Server 有两个重要文件:server.pyrogue_mysql_server.py。其中 server.py 是主脚本,用于起一个简陋的Web服务以及远程用户交互;rogue_mysql_server.py 是魔改了 Rogue Mysql Server 脚本 的产物。支持通过传参的方式来起 Rogue Mysql Server。


功能

Rogue-MySql-Web-Server 的主要功能为:使授权远程用户可通过参数拉起指定配置的 Rogue Mysql Server、获取Mysql客户端被读取文件内容。为了能够实现这些功能,Rogue-MySql-Web-Server 的基本结构如下:

  1. 鉴权,仅允许密码正确的用户访问资源,密码不正确 或 url格式不正确者 直接断开连接
  2. 根据远程用户传参确定 Code(相当于唯一id),拉起一个 Rogue Mysql Server 实例,存入 Server池中
  3. 每个新的 Rogue Mysql Server 实例都监听着不同的端口,以保证同时测试多个网站时不会冲突
  4. 若有需要,可通过远程用户传参销毁指定 Code 的 Rogue Mysql Server 实例
  5. Rogue-MySql-Web-Server 会根据远程用户传入 Code 获取对应 Rogue Mysql Server 的读取结果

项目结构如下:

使用

环境:

python 2.7 & python 3.x

ps:python2 和 python3 都要有。。。因为 rogue_mysql_server.py 是魔改别人的脚本,,懒得改成 python3了,,一般装 Linux 都会预装 python2 和 python3 的吧。。。。。


配置

需要修改的地方主要有四处:

  1. password --- 连接密码
  2. port --- Web服务监听端口
  3. pythonPath --- 服务器中 python 2 可执行文件路径
  4. for p in range(2000,3000) --- Rogue Mysql Server 实例的端口范围。指定多少端口就决定了能拉起多少个 Rogue Mysql Server实例。最好配置成没有任何一个端口占用的范围

默认值如下:


运行:

配置完毕后,使用命令 python3 server.py 运行主程序。这样就是跑起来了

注意一定要用 python 3.x 版本来运行主程序,建议使用 python 3.7。若使用 python 2 会有 Subprocess 和 Socket 连用 Socket 返回特别慢的bug。


访问格式

由于主程序实现了一个简陋的Web服务,所以我使用 url的格式 来给程序传参。格式如下:

/password/operation/code/sqlRandomString?x=file

不管是什么操作都必须按照这个格式来发送,不然无法正常与程序交互


新建Rogue Mysql Server 实例

在开始测试 Rogue Mysql Server 漏洞前,需要先从 Rogue-MySql-Web-Server 上获取一个 Rogue Mysql Server 实例。使用如下请求可让 Rogue-MySql-Web-Server 生成一个 Rogue Mysql Server 实例 并返回相关信息:

##Request:##
GET /ebf734024jto485/instantiate/202cb962ac59075b964b07152d234b70-1622045270467/x1x2x3x4?x=/etc/passwd HTTP/1.1

Host: 127.0.0.1:1921

##Response:##
HTTP/1.1 200 ok
Content-Type: application/json

{"code": "1", "msg": "2000"}

Request:

  1. operation 设置为 instantiate
  2. password 需要和 server.py 中定义的一致
  3. code 需要客户端自行生成。推荐格式:随机数的md5-微秒级时间戳。这是为每个 Rogue Mysql Server实例分配的 id
  4. sqlRandomString 虽然在这阶段没用,但仍然需要发送
  5. file 用于配置 Rogue Mysql Server,指定要读取的客户端文件路径。只能设置一个文件,不支持多个

Response:

  1. Rogue-MySql-Web-Server 将以 json 形式返回数据。字段只有两个:codemsg
  2. code 为 1 代表实例化成功,为 0 代表实例化失败
  3. msg 为该 Rogue Mysql Server实例监听的端口

读取 Rogue Mysql Server 结果

被攻击的客户端执行的 SQL Query 是有讲究的, SQL Query 中需要包含 code+sqlRandomString 以便 Rogue-MySql-Web-Server 筛选文件内容。推荐格式如下:

select/update/delete ..... where x='{code}{sqlRandomString}'

insert into x values('{code}{sqlRandomString}')

其中:

{code} 为 “新建 Rogue Mysql Server实例” 时传的 code 参数。

{sqlRandomString} 为 “新建 Rogue Mysql Server实例” 时传的 sqlRandomString 参数。


模拟场景:客户端连接 Rogue Mysql Server:

其中 连接端口 为 “新建 Rogue Mysql Server实例” 请求中响应的 msg 字段,并且Sql语句中需要存在 code+sqlRandomString 的字符串。

客户端成功连接 Rogue Mysql Server 后,我们便可获取客户端读取的文件内容了。请求如下:

##Request:##
GET /ebf734024jto485/readInfo/202cb962ac59075b964b07152d234b70-1622045270467/x1x2x3x4?x=/etc/passwd HTTP/1.1

Host: 127.0.0.1:1921


##Response:##
HTTP/1.1 200 ok
Content-Type: application/json

{"code": "1", "msg": "'xxxxx"}

Request:

  1. operation 设置为 readInfo
  2. password 需要和 server.py 中定义的一致
  3. code 需要客户端自行生成。推荐格式:随机数的md5-微秒级时间戳。用于指定读取哪个 Rogue Mysql Server 的内容
  4. sqlRandomString 用于区分同一个 Rogue Mysql Server 内容中,不同时间段读取的文件内容。会在下文详细说
  5. file 虽然在这阶段没用,但仍然需要发送

Response:

  1. Rogue-MySql-Web-Server 将以 json 形式返回数据。字段只有两个:codemsg
  2. code 为 1 代表通过 code+sqlRandomString 成功匹配到文件内容,为 0 代表没用匹配到文件内容
  3. code 为 1 时,msg 仅为匹配到的文件内容;当 code 为 2 时, msg 代表全部文件内容;当 code 为 0 时, msg 代表 读取文件时有异常

sqlRandomString 用于区分同一个 Rogue Mysql Server 内容中,不同时间段读取的文件内容。如下所示:

首先,客户端执行了如下 SQL query,code 为 202cb962ac59075b964b07152d234b70-1622045270468,sqlRandomString 为 a1a2a3

select 1 where x='202cb962ac59075b964b07152d234b70-1622045270468a1a2a3';

构造读取文件请求,如下,成功获取到客户端 /var/www/html/config.txt 文件内容


假设此时 /var/www/html/config.txt 文件内容发生了变化,想要获取最新的文件内容,需要修改 SQL query 中的 sqlRandomString 并让客户端再执行一次。下面Demo修改 sqlRandomString 为 b1b2b3

select 1 where x='202cb962ac59075b964b07152d234b70-1622045270468b1b2b3';

构造读取文件请求,修改 sqlRandomString 使之与 SQL query 对应。如下,成功获取到客户端 /var/www/html/config.txt 文件新内容


code+sqlRandomString 无法匹配到文件内容,将会返回整个文件内容,并且 code 为 2:


销毁Rogue Mysql Server 实例

当成功读取完客户端文件不需要再使用 Rogue Mysql Server时,可以将其销毁,避免占用系统资源。使用如下请求可销毁对应 code 的 Rogue Mysql Server实例:

##Request:##
GET /ebf734024jto485/destroy/202cb962ac59075b964b07152d234b70-1622045270467/x1x2x3?x=/etc/passwd HTTP/1.1

Host: 127.0.0.1:1921


##Response:##
HTTP/1.1 200 ok
Content-Type: application/json

{"code": "1", "msg": "destroied"}

Request:

  1. operation 设置为 destroy
  2. password 需要和 server.py 中定义的一致
  3. code 需要客户端自行生成。推荐格式:随机数的md5-微秒级时间戳。用于指定销毁哪个 Rogue Mysql Server
  4. sqlRandomString 虽然在这阶段没用,但仍然需要发送
  5. file 虽然在这阶段没用,但仍然需要发送

Response:

  1. Rogue-MySql-Web-Server 将以 json 形式返回数据。字段只有两个:codemsg
  2. code 为 1 代表销毁成功

Reference

https://github.com/allyshka/Rogue-MySql-Server

You might also like...
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

Pupy Installation Installation instructions are on the wiki, in addition to all other documentation. For maximum compatibility, it is recommended to u

Remote Desktop Protocol in Twisted Python

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP (Remote Desktop Protocol) protocol (client a

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoS

Strapi Framework Vulnerable to Remote Code Execution

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Execution well, I didnt found any exploit for CVE-2019-19609 so I wrote one. :/ Usage pytho

Übersicht remote command execution 0day exploit
Übersicht remote command execution 0day exploit

Übersicht RCE 0day Unauthenticated remote command execution 0day exploit for Übersicht. Description Übersicht is a desktop widget application for m

A Python replicated exploit for Webmin 1.580 /file/show.cgi Remote Code Execution

CVE-2012-2982 John Hammond | September 4th, 2021 Checking searchsploit for Webmin 1.580 I only saw a Metasploit module for the /file/show.cgi Remote C

CVE-2021-26084 Remote Code Execution on Confluence Servers
CVE-2021-26084 Remote Code Execution on Confluence Servers

CVE-2021-26084 CVE-2021-26084 Remote Code Execution on Confluence Servers. Dork Fofa: app="ATLASSIAN-Confluence" Usage Show help information. python P

On the 11/11/21 the apache 2.4.49-2.4.50 remote command execution POC has been published online and this is a loader so that you can mass exploit servers using this.
On the 11/11/21 the apache 2.4.49-2.4.50 remote command execution POC has been published online and this is a loader so that you can mass exploit servers using this.

ApacheRCE ApacheRCE is a small little python script that will allow you to input the apache version 2.4.49-2.4.50 and then input a list of ip addresse

Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files tha

Releases(v1.0.1)
一款辅助探测Orderby注入漏洞的BurpSuite插件,Python3编写,适用于上xray等扫描器被ban的场景

OrderbyHunter 一款辅助探测Orderby注入漏洞的BurpSuite插件,Python3编写,适用于上xray等扫描器被ban的场景 1. 支持Get/Post型请求参数的探测,被动探测,对于存在Orderby注入的请求将会在HTTP Histroy里标红 2. 自定义排序参数list

Automne 21 Aug 12, 2022
Simplify getting and using cookies from the browser to use in Python.

CookieCache Simplify getting and using cookies from the browser to use in Python. NOTE: All the logic to interface with the browsers is done by the Br

pat_h/to/file 2 May 06, 2022
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

CVE-2011-2523 - vsftpd 2.3.4 Exploit Discription vsftpd, which stands for Very Secure FTP Daemon,is an FTP server for Unix-like systems, including Lin

Padsala Tushal 5 Nov 08, 2022
A hack for writing switch statements with type annotations in Python.

py_annotation_switch A hack for writing switch statements in type annotations for Python. Why should I use this? You most definitely should not use th

6 Oct 17, 2021
This is simple python FTP password craker. To crack FTP login using wordlist based brute force attack

This is simple python FTP password craker. To crack FTP login using wordlist based brute force attack

Varun Jagtap 5 Oct 08, 2022
Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

之乎者也 2.8k Dec 29, 2022
Red Team Toolkit is an Open-Source Django Offensive Web-App which is keeping the useful offensive tools used in the red-teaming together.

RedTeam Toolkit Note: Only legal activities should be conducted with this project. Red Team Toolkit is an Open-Source Django Offensive Web-App contain

Mohammadreza Sarayloo 382 Jan 01, 2023
🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

BhavKaran 1.5k Dec 28, 2022
Tools for investigating Log4j CVE-2021-44228

Log4jTools Tools for investigating Log4j CVE-2021-44228 FetchPayload.py (Get java payload from ldap path provided in JNDI lookup). Example command: Re

MalwareTech 91 Dec 29, 2022
Midas ELF64 Injector is a tool that will help you inject a C program from source code into an ELF64 binary.

Midas ELF64 Injector Description Midas ELF64 Injector is a tool that will help you inject a C program from source code into an ELF64 binary. All you n

midas 20 Dec 24, 2022
Lightweight and beneficial Dependency Injection plugin for apscheduler

Implementation of dependency injection for apscheduler Prerequisites: apscheduler-di solves the problem since apscheduler doesn't support Dependency I

Glib 11 Dec 07, 2022
Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4

Minecraft-Server-Scanner Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4 Installation and running i

116 Jan 08, 2023
MayorSec DNS Enumeration Tool

MayorSecDNSScan MSDNSScan is used to identify DNS records for target domains and check for zone transfers. There really isn't much special about it, a

Joe Helle 68 Dec 12, 2022
PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

yLog4j This is Y-Sec's @PortSwigger Burp Plugin for the Log4j CVE-2021-44228 vulnerability. The focus of yLog4j is to support mass-scanning of the Log

Y-Security 1 Jan 31, 2022
Linus-png.github.io - Versionsverwaltung & Open Source Hausaufgabe

Let's Git - Versionsverwaltung & Open Source Hausaufgabe Herzlich Willkommen zu

1 Jan 24, 2022
Tool-X is a kali linux hacking Tool installer.

Tool-X is a kali linux hacking Tool installer. Tool-X developed for termux and other Linux based systems. using Tool-X you can install almost 370+ hacking tools in termux app and other linux based di

Rajkumar Dusad 4.2k May 29, 2022
Buff A simple BOF library I wrote under an hour to help me automate with BOF attack

What is Buff? A simple BOF library I wrote under an hour to help me automate with BOF attack. It comes with fuzzer and a generic method to generate ex

0x00 3 Nov 21, 2022
About Hive Burp Suite Extension

Hive Burp Suite Extension Description Hive extension for Burp Suite. This extension allows you to send data from Burp to Hive in one click. Create iss

7 Dec 07, 2022
Cve-2022-23131 - Cve-2022-23131 zabbix-saml-bypass-exp

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp replace [zbx_signed_session

东方有鱼名为咸 135 Dec 14, 2022
MS-FSRVP coercion abuse PoC

ShadowCoerce MS-FSRVP coercion abuse PoC Credits: Gilles LIONEL (a.k.a. Topotam)

Shutdown 219 Dec 28, 2022