pwn 0.5.509 → 0.5.510

data/bin/pwn_jenkins_thinBackup_aws_s3

@@ -0,0 +1,113 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'aws-sdk'
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-rREGION', '--region=REGION', "<Optional - AWS STS Region (Defaults to 'us-west-1')>") do |sts_region|
+    opts[:sts_region] = sts_region
+  end
+
+  options.on('-aARN', '--sts_role_arn=ARN', '<Required - STS Role ARN>') do |sts_role_arn|
+    opts[:sts_role_arn] = sts_role_arn
+  end
+
+  options.on('-nRNAME', '--sts_role_name=RNAME', '<Required - STS Role Name>') do |sts_role_name|
+    opts[:sts_role_name] = sts_role_name
+  end
+
+  options.on('-eEXPIRES', '--sts_expiration=EXPIRES', '<Optional - STS Expiration (Defaults to 900 Seconds)>') do |sts_expiration|
+    opts[:sts_expiration] = sts_expiration
+  end
+
+  options.on('-sBUCKET', '--s3_bucket=BUCKET', '<Required - AWS S3 Bucket Destination>') { |s3_bucket| opts[:s3_bucket] = s3_bucket }
+
+  options.on('-fFOLDER', '--s3_folder=FOLDER', '<Required - AWS S3 Folder Destinaiton>') do |s3_folder|
+    opts[:s3_folder] = s3_folder
+  end
+
+  options.on('-bBACKROOT', '--jenkins_thinBackup_root=BACKROOT', '<Optional - Jenkins thinBackup Root Folder (Defaults to /var/lib/jenkins/thinBackup)>') do |backup_root|
+    opts[:backup_root] = backup_root
+  end
+end.parse!
+
+sts_region = if opts[:sts_region].nil?
+               'us-west-1'
+             else
+               opts[:sts_region].to_s.scrub
+             end
+
+sts_role_arn = opts[:sts_role_arn].to_s.scrub
+sts_role_name = opts[:sts_role_name].to_s.scrub
+
+sts_expiration = if opts[:sts_expiration].nil?
+                   900
+                 else
+                   opts[:sts_expiration].to_i
+                 end
+
+credentials = PWN::AWS::STS.get_temp_credentials(
+  region: sts_region,
+  role_arn: sts_role_arn,
+  role_session_name: sts_role_name,
+  duration_seconds: sts_expiration
+)
+
+# S3 Variables
+s3_bucket = opts[:s3_bucket].to_s.scrub
+s3_folder = opts[:s3_folder].to_s.scrub # Trailing Forward Slash is Important as it Denotes the S3 Object is a Folder Instead of File
+
+backup_root = if opts[:backup_root].nil?
+                '/var/lib/jenkins/thinBackup'
+              else
+                opts[:backup_root].to_s.scrub
+              end
+
+s3_buck_arr = []
+s3_obj_arr = []
+
+s3 = Aws::S3::Client.new(
+  region: 'us-west-1',
+  access_key_id: credentials[:access_key_id],
+  secret_access_key: credentials[:secret_access_key],
+  session_token: credentials[:session_token]
+)
+
+puts s3.list_buckets.buckets
+puts "\n"
+
+s3.list_buckets.buckets.each { |bucket| s3_buck_arr.push(bucket.name) }
+if s3_buck_arr.uniq.include?(s3_bucket)
+  puts 'S3 Bucket: {s3_bucket} already exists...moving on.'
+else
+  print 'Creating S3 Bucket: {s3_bucket}...'
+  s3.create_bucket(bucket: s3_bucket)
+  puts 'complete.'
+end
+
+puts s3.list_buckets.buckets
+puts "\n"
+
+objects = s3.list_objects(bucket: s3_bucket)
+objects.contents.each { |object| s3_obj_arr.push(object.key) }
+
+s3.put_object(bucket: s3_bucket, key: s3_folder) unless s3_obj_arr.uniq.include?(s3_folder)
+
+objects = s3.list_objects(bucket: s3_bucket)
+puts objects.contents
+puts "\n"
+
+Dir.entries(backup_root).sort.each do |entry|
+  puts "#{s3_folder}#{entry} backup exists...skipping to next entry." if s3_obj_arr.uniq.include?("#{s3_folder}#{entry}")
+
+  next unless File.file?("#{backup_root}/#{entry}")
+
+  print "Backing up #{backup_root}/#{entry} => #{s3_bucket}/#{s3_folder}#{entry}..."
+  File.open("#{backup_root}/#{entry}", 'rb') do |file|
+    s3.put_object(bucket: s3_bucket, key: "#{s3_folder}#{entry}", body: file)
+  end
+  puts 'complete.'
+end
+puts 'backup complete.'

data/bin/pwn_jenkins_update_plugins

@@ -0,0 +1,77 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-sIP', '--ip=IP', '<Required - Jenkins Server IP>') { |s| opts[:ip] = s }
+
+  options.on('-dPORT', '--dest-port=PORT', '<Optional - Jenkins Server Port (Defaults to 8080)>') do |port|
+    opts[:port] = port
+  end
+
+  options.on('-UUSER', '--username=USER', '<Required - Jenkins Username>') do |user|
+    opts[:username] = user
+  end
+
+  options.on('-PKEY', '--api-key=KEY', '<Required - Jenkins API Key>') do |api_key|
+    opts[:api_key] = api_key
+  end
+
+  options.on('-pPLUGIN', '--plugin-name=PLUGIN', '<Optional - Update Specific Plugin>') do |plugin_name|
+    opts[:plugin_name] = plugin_name
+  end
+
+  options.on('-L', '--[no-]list-updates', '<Optional - List of Installed Plugins Requiring Updates>') do |list_updates_bool|
+    opts[:list_updates_bool] = list_updates_bool
+  end
+
+  options.on('-R', '--[no-]restart-jenkins', '<Restart Jenkins - Defaults to true>') do |restart_bool|
+    opts[:restart_jenkins] = restart_bool
+  end
+end.parse!
+
+ip = opts[:ip].to_s.scrub
+port = opts[:port].to_i
+username = opts[:username]
+api_key = opts[:api_key]
+plugin_name = opts[:plugin_name]
+list_updates_bool = if opts[:list_updates_bool]
+                      true
+                    else
+                      false
+                    end
+
+restart_jenkins = opts[:restart_jenkins].nil?
+
+if port.positive?
+  jenkins_obj = PWN::Plugins::Jenkins.connect(
+    ip: ip,
+    port: port,
+    username: username,
+    api_key: api_key
+  )
+else
+  jenkins_obj = PWN::Plugins::Jenkins.connect(
+    ip: ip,
+    username: username,
+    api_key: api_key
+  )
+end
+
+if list_updates_bool
+  puts jenkins_obj.plugin.list_updates
+else
+  if plugin_name.nil?
+    jenkins_obj.plugin.list_updates.each_key do |current_plugin_name|
+      jenkins_obj.plugin.update(current_plugin_name)
+    end
+  else
+    jenkins_obj.plugin.update(plugin_name)
+  end
+
+  jenkins_obj.system.restart if restart_jenkins
+end
+
+PWN::Plugins::Jenkins.disconnect(jenkins_obj: jenkins_obj)

data/bin/pwn_jenkins_useradd

@@ -0,0 +1,76 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-sIP', '--ip=IP', '<Required - Jenkins Server IP>') { |s| opts[:ip] = s }
+
+  options.on('-dPORT', '--dest-port=PORT', '<Optional - Jenkins Server Port (Defaults to 8080)>') do |port|
+    opts[:port] = port
+  end
+
+  options.on('-UAUSER', '--admin-username=AUSER', '<Required - Jenkins Admin Username>') do |auser|
+    opts[:admin_username] = auser
+  end
+
+  options.on('-PKEY', '--admin-password=KEY', '<Required - Jenkins Admin API Key>') do |akey|
+    opts[:admin_api_key] = akey
+  end
+
+  options.on('-uNUSER', '--new-username=NUSER', '<Required - Jenkins Username to Create>') do |nuser|
+    opts[:new_username] = nuser
+  end
+
+  options.on('-pNPASS', '--new-password=NPASS', '<Required - Jenkins Password for New User>') do |npass|
+    opts[:new_password] = npass
+  end
+
+  options.on('-nNAME', '--new-fullname=NAME', '<Required - Full Name New User>') do |fullname|
+    opts[:new_fullname] = fullname
+  end
+
+  options.on('-eEMAIL', '--new-email=EMAIL', '<Required - email for New User>') do |email|
+    opts[:new_email] = email
+  end
+end.parse!
+
+ip = opts[:ip].to_s.scrub
+port = opts[:port].to_i
+
+admin_username = opts[:admin_username]
+admin_api_key = opts[:admin_api_key]
+
+new_username = opts[:new_username]
+new_password = opts[:new_password]
+new_fullname = opts[:new_fullname]
+new_email = opts[:new_email]
+
+if port.positive?
+  jenkins_obj = PWN::Plugins::Jenkins.connect(
+    ip: ip,
+    port: port,
+    username: admin_username,
+    api_key: admin_api_key
+  )
+else
+  jenkins_obj = PWN::Plugins::Jenkins.connect(
+    ip: ip,
+    username: admin_username,
+    api_key: admin_api_key
+  )
+end
+
+sleep 3
+
+PWN::Plugins::Jenkins.create_user(
+  jenkins_obj: jenkins_obj,
+  username: new_username,
+  password: new_password,
+  fullname: new_fullname,
+  email: new_email
+)
+
+PWN::Plugins::Jenkins.disconnect(jenkins_obj: jenkins_obj)
+puts 'complete.'

data/bin/pwn_mail_agent

@@ -0,0 +1,114 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-aTYPE', '--agent-type=TYPE', '<Required - Mail Agent Type office365|gmail|hotmail_n_live|yahoo|manual>') do |a|
+    opts[:agent_type] = a
+  end
+
+  options.on('-l', '--[no-]list-agent-opts', '<Optional List Options Available for an Agent and Exit>') do |l|
+    opts[:list_agent_opts] = l
+  end
+
+  options.on('-mYAML', '--msg-body-yaml=YAML', '<Required - Mail Agent YAML File>') do |m|
+    opts[:msg_body_yaml] = m
+  end
+end.parse!
+
+private_methods def initiate_action
+  puts @list_agent_opts
+  if @list_agent_opts
+    puts "The following is an example YAML file for #{@agent_type}:\n#{@example_msg_body_yaml}"
+    exit
+  else
+    PWN::Plugins::MailAgent.public_send(@agent_type_sym, @msg_body_yaml)
+  end
+end
+
+begin
+  logger = PWN::Plugins::PWNLogger.create
+
+  @agent_type = opts[:agent_type].to_s.scrub.strip.chomp
+  @agent_type_sym = @agent_type.to_sym
+  @list_agent_opts = opts[:list_agent_opts]
+  # Needs to be YAML instead of JSON to better support backslashes.
+  # Technically backslashes shouldn't exist in JSON, # however, they're
+  # needed in this case for specifying domains in usernames for agents
+  # like office365.
+  @msg_body_yaml = YAML.load_file(opts[:msg_body_yaml].to_s.scrub.strip.chomp) if File.exist?(opts[:msg_body_yaml].to_s.scrub.strip.chomp)
+
+  case @agent_type_sym
+  when :office365
+    @example_msg_body_yaml = %q{
+      :from: 'required'
+      :to: 'required'
+      :cc: 'optional'
+      :bcc: 'optional'
+      :reply_to: 'optional'
+      :subject: 'optional'
+      :html_body: 'optional'
+      :txt_body: 'optional alternative to :html_body'
+      :attachments_hash:
+        attachment_name1.doc: 'attachment file path 1'
+        attachment_name2.xls: 'attachment file path 2'
+      :username: 'required domain\username'
+      :password: 'optional (but will be prompted if not submitted)'
+      :debug: true
+    }
+
+    initiate_action
+  when :gmail,
+       :hotmail_n_live,
+       :yahoo
+
+    @example_msg_body_yaml = "
+      :from: 'required'
+      :to: 'required'
+      :cc: 'optional'
+      :bcc: 'optional'
+      :reply_to: 'optional'
+      :subject: 'optional'
+      :html_body: 'optional'
+      :txt_body: 'optional alternative to :html_body'
+      :attachments_hash:
+        attachment_name1.doc: 'attachment file path 1'
+        attachment_name2.xls: 'attachment file path 2'
+      :username: 'required'
+      :password: 'optional (but will be prompted if not submitted)'
+      :debug: true
+    "
+
+    initiate_action
+  when :manual
+    @example_msg_body_yaml = "
+      :from: 'required'
+      :to: 'required'
+      :cc: 'optional'
+      :bcc: 'optional'
+      :reply_to: 'optional'
+      :subject: 'optional'
+      :html_body: 'optional'
+      :txt_body: 'optional alternative to :html_body'
+      :attachments_hash:
+        attachment_name1.doc: 'attachment file path 1'
+        attachment_name2.xls: 'attachment file path 2'
+      :address: 'smtp server ip or domain'
+      :port: 'smtp port'
+      :tls_auto: true
+      :authentication: 'optional defaults to plain - available login, plain, or cram_md5'
+      :username: 'required'
+      :password: 'optional (but will be prompted if not submitted)'
+      :debug: true
+    "
+
+    initiate_action
+  else
+    raise "ERROR: #{@agent_type} is not supported."
+  end
+rescue StandardError, Interrupt => e
+  puts 'ERROR: Something Happened'
+  raise e
+end

data/bin/pwn_msf_postgres_login

@@ -0,0 +1,28 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+msfrpcd_yaml_conf = ARGV[0].to_s.strip.chomp
+rhosts = ARGV[1].to_s.strip.chomp
+rport = ARGV[2].to_s.strip.chomp
+
+logger = PWN::Plugins::PWNLogger.create
+
+logger.info('MSF Postgres Login for ' << rhosts)
+
+results = PWN::MSF::PostgresLogin.exploit(
+  msfrpcd_yaml_conf: msfrpcd_yaml_conf,
+  rhosts: rhosts,
+  rport: rport
+)
+
+File.write("#{rhosts}_msf_postgres_login.txt", results['data'])
+
+if results['data'].include?('- LOGIN SUCCESSFUL:')
+  logger.error(
+    "Successful Postgres AuthN!!!  See #{rhosts}_msf_postgres_login.txt for more information."
+  )
+end
+
+# TODO: - Publish as HTML