exploitgraph 1.0.0__py3-none-any.whl

modules/cloud/gcp_enum.py

@@ -0,0 +1,272 @@
+"""
+ExploitGraph Module: GCP Storage Bucket Enumerator
+Category: cloud
+
+Detects publicly accessible Google Cloud Storage buckets.
+Works without credentials (HTTP/JSON API mode).
+
+Real-world misconfigurations:
+  - allUsers READ permission on bucket
+  - allAuthenticatedUsers READ (all Google accounts)
+  - Public bucket with sensitive data
+  - Firebase storage rules set to public
+
+GCP Parallel:
+  gsutil ls gs://bucket-name
+  curl https://storage.googleapis.com/bucket-name/?list-type=2
+"""
+from __future__ import annotations
+import re
+import json
+from typing import TYPE_CHECKING
+
+import requests
+from requests.packages.urllib3.exceptions import InsecureRequestWarning
+requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
+
+from modules.base import BaseModule, ModuleResult
+
+if TYPE_CHECKING:
+    from core.session_manager import Session
+
+GCS_API   = "https://storage.googleapis.com"
+GCS_JSON  = "https://www.googleapis.com/storage/v1/b"
+
+COMMON_SUFFIXES = [
+    "-backup", "-backups", "-storage", "-assets", "-static", "-public",
+    "-media", "-files", "-data", "-uploads", "-logs", "-config",
+    ".appspot.com", "-dev", "-prod", "-staging",
+]
+
+
+class GcpEnum(BaseModule):
+
+    NAME        = "gcp_enum"
+    DESCRIPTION = "Enumerate GCP Cloud Storage buckets — detect public access and Firebase misconfigurations"
+    AUTHOR      = "ExploitGraph Team"
+    VERSION     = "1.0.0"
+    CATEGORY    = "cloud"
+    SEVERITY    = "CRITICAL"
+    MITRE       = ["T1530", "T1580"]
+    AWS_PARALLEL = "GCP equivalent of: aws s3 ls s3://bucket --no-sign-request"
+
+    OPTIONS = {
+        "TARGET":       {"default": "",     "required": True,  "description": "Target URL or GCP project ID"},
+        "PROJECT_ID":   {"default": "",     "required": False, "description": "GCP project ID to enumerate"},
+        "BUCKET_NAME":  {"default": "",     "required": False, "description": "Specific bucket name to test"},
+        "WORDLIST":     {"default": "",     "required": False, "description": "Custom bucket name wordlist"},
+        "TIMEOUT":      {"default": "8",    "required": False, "description": "Request timeout"},
+        "CHECK_FIREBASE":{"default": "true","required": False, "description": "Check Firebase storage endpoints"},
+    }
+
+    def run(self, session: "Session") -> ModuleResult:
+        from core.logger import log
+
+        target  = self.get_option("TARGET") or session.target
+        timeout = int(self.get_option("TIMEOUT", "8"))
+
+        self._timer_start()
+        log.section("GCP Cloud Storage Enumeration")
+        log.info("MITRE: T1530 — Data from Cloud Storage Object")
+        log.info("GCP cmd: gsutil ls gs://bucket-name  (no credentials needed if public)")
+
+        found_buckets = []
+
+        bucket_names = self._discover_bucket_names(target, timeout)
+        if b := self.get_option("BUCKET_NAME"):
+            bucket_names.insert(0, b)
+
+        for name in bucket_names[:25]:
+            result = self._test_bucket(name, timeout, session)
+            if result:
+                found_buckets.append(result)
+
+        # Firebase check
+        if self.get_option("CHECK_FIREBASE", "true").lower() == "true":
+            self._check_firebase(target, timeout, session)
+
+        if found_buckets:
+            session.add_graph_node("gcp_exposure",
+                                   f"GCP Storage\nExposed ({len(found_buckets)} buckets)",
+                                   "exposure", "CRITICAL")
+            session.add_graph_edge("http_enum", "gcp_exposure",
+                                   "public GCS access", "T1530")
+
+        elapsed = self._timer_stop()
+        log.success(f"GCP enum done in {elapsed}s — {len(found_buckets)} public buckets")
+
+        return ModuleResult(True, {"buckets_found": len(found_buckets)})
+
+    def _discover_bucket_names(self, target: str, timeout: int) -> list[str]:
+        from core.logger import log
+        from urllib.parse import urlparse
+        names = set()
+
+        hostname = urlparse(target).hostname or ""
+        base = hostname.split(".")[0]
+
+        if base and base not in ("localhost", "127"):
+            names.add(base)
+            for suffix in COMMON_SUFFIXES:
+                names.add(f"{base}{suffix}")
+
+        # Scan target for GCS references
+        log.step("Scanning for GCS/Firebase references...")
+        try:
+            r = requests.get(target, timeout=timeout, verify=False)
+            # GCS bucket patterns
+            for pattern in [
+                r'storage\.googleapis\.com/([a-z0-9][-a-z0-9_.]{1,220})',
+                r'([a-z0-9][-a-z0-9_.]{1,220})\.storage\.googleapis\.com',
+                r'gs://([a-z0-9][-a-z0-9_.]{1,220})',
+                r'firebasestorage\.googleapis\.com/v0/b/([^/\s"\']+)',
+            ]:
+                for match in re.finditer(pattern, r.text, re.IGNORECASE):
+                    name = match.group(1).lower().rstrip("/")
+                    names.add(name)
+                    log.found(f"GCS reference: {name}")
+
+            # Project ID references
+            for match in re.finditer(r'"projectId"\s*:\s*"([^"]+)"', r.text):
+                pid = match.group(1)
+                names.add(pid)
+                names.add(f"{pid}.appspot.com")
+                log.found(f"GCP project ID: {pid}")
+
+        except Exception:
+            pass  # network/connection error — continue scanning
+
+        return list(names)
+
+    def _test_bucket(self, name: str, timeout: int, session: "Session") -> dict | None:
+        from core.logger import log
+
+        urls_to_try = [
+            f"{GCS_API}/{name}/",
+            f"{GCS_API}/{name}/?list-type=2",
+            f"https://{name}.storage.googleapis.com/",
+        ]
+
+        for url in urls_to_try:
+            try:
+                r = requests.get(url, timeout=timeout, verify=False)
+
+                # Public bucket with listing
+                if r.status_code == 200 and (
+                    "<ListBucketResult" in r.text or
+                    '"kind": "storage#objects"' in r.text or
+                    "<Contents>" in r.text
+                ):
+                    log.critical(f"PUBLIC GCS BUCKET: {name}")
+                    log.info(f"GCP cmd: gsutil ls gs://{name}")
+
+                    # Parse object names
+                    objects = re.findall(r'"name":\s*"([^"]+)"', r.text)
+                    objects += re.findall(r'<Key>([^<]+)</Key>', r.text)
+                    log.success(f"  Objects: {len(objects)}")
+                    for obj in objects[:5]:
+                        log.secret("Object", obj)
+
+                    session.add_finding(
+                        module="gcp_enum",
+                        title=f"Public GCS Bucket: {name}",
+                        severity="CRITICAL",
+                        description=f"GCS bucket '{name}' is publicly accessible with object listing enabled.",
+                        evidence=f"URL: {url}\nHTTP 200\nObjects: {', '.join(objects[:5])}",
+                        recommendation=(
+                            f"Remove allUsers permission:\n"
+                            f"gsutil iam ch -d allUsers:objectViewer gs://{name}\n"
+                            f"gsutil iam ch -d allUsers:legacyBucketReader gs://{name}"
+                        ),
+                        cvss_score=9.8,
+                        aws_parallel="S3 bucket with public-read ACL and no Block Public Access",
+                        mitre_technique="T1530",
+                    )
+
+                    # Download interesting files
+                    for obj in objects:
+                        if any(x in obj.lower() for x in [".env","config","secret","key","backup",".sql"]):
+                            try:
+                                obj_r = requests.get(f"{GCS_API}/{name}/{obj}", timeout=timeout)
+                                if obj_r.status_code == 200:
+                                    log.found(f"Downloaded: {obj}")
+                                    session.exposed_files.append({
+                                        "url": f"{GCS_API}/{name}/{obj}",
+                                        "path": obj,
+                                        "content": obj_r.text,
+                                        "source": "gcp_enum",
+                                    })
+                            except Exception:
+                                pass  # network/connection error — continue scanning
+
+                    return {"name": name, "url": url, "objects": len(objects)}
+
+                # Bucket exists but private
+                elif r.status_code == 403:
+                    log.step(f"[403] gs://{name} — exists but private")
+
+            except Exception:
+                pass  # network/connection error — continue scanning
+
+        # Try JSON API
+        try:
+            r = requests.get(f"{GCS_JSON}/{name}/iam", timeout=timeout)
+            if r.status_code == 200:
+                iam = r.json()
+                bindings = iam.get("bindings", [])
+                for b in bindings:
+                    if "allUsers" in b.get("members", []) or "allAuthenticatedUsers" in b.get("members", []):
+                        log.critical(f"PUBLIC IAM on gs://{name}: {b['role']} → {b['members']}")
+                        session.add_finding(
+                            module="gcp_enum",
+                            title=f"GCS Bucket Public IAM: {name}",
+                            severity="CRITICAL",
+                            description=f"Bucket '{name}' has IAM policy granting {b['role']} to {b['members']}.",
+                            evidence=f"IAM binding: {b}",
+                            recommendation=f"gsutil iam ch -d allUsers:{b['role'].split('/')[-1]} gs://{name}",
+                            cvss_score=9.5,
+                            aws_parallel="S3 bucket policy with Principal: '*'",
+                            mitre_technique="T1530",
+                        )
+        except Exception:
+            pass  # network/connection error — continue scanning
+
+        return None
+
+    def _check_firebase(self, target: str, timeout: int, session: "Session"):
+        from core.logger import log
+        from urllib.parse import urlparse
+
+        hostname = urlparse(target).hostname or ""
+        base = hostname.split(".")[0]
+        if not base or base in ("localhost", "127"):
+            return
+
+        # Firebase Realtime Database
+        firebase_db = f"https://{base}-default-rtdb.firebaseio.com/.json"
+        try:
+            r = requests.get(firebase_db, timeout=timeout)
+            if r.status_code == 200:
+                log.critical(f"PUBLIC FIREBASE DATABASE: {firebase_db}")
+                try:
+                    data = r.json()
+                    data_preview = str(data)[:200]
+                except Exception:
+                    pass  # error handled upstream
+                except Exception:
+
+                    pass  # error handled upstream
+                session.add_finding(
+                    module="gcp_enum",
+                    title="Public Firebase Realtime Database",
+                    severity="CRITICAL",
+                    description="Firebase Realtime Database is publicly readable without authentication.",
+                    evidence=f"URL: {firebase_db}\nHTTP 200\nData: {data_preview}",
+                    recommendation="Set Firebase security rules to require authentication:\n"
+                                   '{"rules": {".read": "auth != null", ".write": "auth != null"}}',
+                    cvss_score=10.0,
+                    aws_parallel="DynamoDB table with no IAM conditions — publicly readable",
+                    mitre_technique="T1530",
+                )
+        except Exception:
+            pass  # network/connection error — continue scanning

modules/cloud/iam_enum.py

@@ -0,0 +1,321 @@
+"""
+ExploitGraph Module: AWS IAM Enumerator
+Category: cloud
+Read-only IAM enumeration using boto3 or discovered AWS credentials.
+All operations are NON-DESTRUCTIVE (list/get only).
+
+Real AWS misconfigurations detected:
+  - Users without MFA enabled
+  - Access keys older than 90 days
+  - Overly permissive policies (AdministratorAccess attached)
+  - Inline policies with wildcard actions
+  - Roles with overly broad trust policies
+"""
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+from modules.base import BaseModule, ModuleResult
+
+if TYPE_CHECKING:
+    from core.session_manager import Session
+
+
+class IamEnum(BaseModule):
+
+    NAME        = "iam_enum"
+    DESCRIPTION = "Enumerate AWS IAM users, roles, and policies — detect privilege escalation paths and MFA gaps"
+    AUTHOR      = "ExploitGraph Team"
+    VERSION     = "1.0.0"
+    CATEGORY    = "cloud"
+    SEVERITY    = "HIGH"
+    MITRE       = ["T1078.004", "T1580", "T1069.003"]
+    AWS_PARALLEL = "aws iam list-users | aws iam list-roles | aws iam get-account-summary"
+
+    OPTIONS = {
+        "AWS_PROFILE":      {"default": "",          "required": False, "description": "AWS CLI profile name"},
+        "AWS_REGION":       {"default": "us-east-1", "required": False, "description": "AWS region"},
+        "AWS_ACCESS_KEY":   {"default": "",          "required": False, "description": "AWS Access Key ID (from secrets module)"},
+        "AWS_SECRET_KEY":   {"default": "",          "required": False, "description": "AWS Secret Access Key (from secrets module)"},
+        "CHECK_MFA":        {"default": "true",      "required": False, "description": "Check for users without MFA"},
+        "CHECK_KEY_AGE":    {"default": "true",      "required": False, "description": "Check for old access keys (>90 days)"},
+        "CHECK_POLICIES":   {"default": "true",      "required": False, "description": "Check for dangerous policies"},
+        "MAX_ITEMS":        {"default": "100",       "required": False, "description": "Max items to enumerate per list call"},
+    }
+
+    def run(self, session: "Session") -> ModuleResult:
+        from core.logger import log
+
+        self._timer_start()
+        log.section("AWS IAM Enumeration")
+        log.info("MITRE: T1580 — Cloud Infrastructure Discovery")
+        log.info("All operations are READ-ONLY (list/get only)")
+
+        # Auto-populate credentials from file_secrets findings
+        self._auto_populate_creds(session)
+
+        try:
+            import boto3
+            from botocore.exceptions import ClientError, NoCredentialsError
+        except ImportError:
+            pass  # error handled upstream
+        except ImportError:
+            log.info("HTTP-based IAM detection running instead...")
+            return self._http_fallback(session)
+
+        try:
+            client = self._get_client("iam", session)
+            findings = []
+
+            # Identify caller
+            sts = self._get_client("sts", session)
+            try:
+                identity = sts.get_caller_identity()
+                account = identity.get("Account", "unknown")
+                arn     = identity.get("Arn", "unknown")
+                log.found(f"Authenticated as: {arn}")
+                log.found(f"Account ID: {account}")
+                session.add_graph_node("aws_identity", f"AWS Identity\n{arn.split('/')[-1]}",
+                                       "asset", "INFO", arn)
+            except Exception as e:
+                pass  # error handled upstream
+            except Exception as e:
+                account = "unknown"
+
+            # Enumerate users
+            users_findings = self._enum_users(client, account, session)
+            findings.extend(users_findings)
+
+            # Enumerate roles
+            roles_findings = self._enum_roles(client, session)
+            findings.extend(roles_findings)
+
+            # Check account summary (password policy, MFA)
+            self._check_account_summary(client, session)
+
+            elapsed = self._timer_stop()
+            log.success(f"IAM enumeration done in {elapsed}s — {len(findings)} findings")
+
+            return ModuleResult(True, {
+                "findings": len(findings),
+                "account":  account,
+            })
+
+        except Exception as e:
+            pass  # error handled upstream
+        except Exception as e:
+            return ModuleResult(False, {}, str(e))
+
+    def _auto_populate_creds(self, session: "Session"):
+        """If file_secrets found AWS keys, use them automatically."""
+        from core.logger import log
+        access_key = secret_key = None
+        for s in session.secrets:
+            if s["secret_type"] == "AWS_ACCESS_KEY" and not self.get_option("AWS_ACCESS_KEY"):
+                access_key = s["value"]
+                self.set_option("AWS_ACCESS_KEY", access_key)
+            elif s["secret_type"] == "AWS_SECRET_KEY" and not self.get_option("AWS_SECRET_KEY"):
+                secret_key = s["value"]
+                self.set_option("AWS_SECRET_KEY", secret_key)
+
+        if access_key:
+            log.info(f"Auto-using discovered AWS Access Key: {access_key[:12]}...")
+
+    def _get_client(self, service: str, session: "Session"):
+        import boto3
+        profile    = self.get_option("AWS_PROFILE", "")
+        region     = self.get_option("AWS_REGION", "us-east-1")
+        access_key = self.get_option("AWS_ACCESS_KEY", "")
+        secret_key = self.get_option("AWS_SECRET_KEY", "")
+
+        if access_key and secret_key:
+            return boto3.client(service, region_name=region,
+                                aws_access_key_id=access_key,
+                                aws_secret_access_key=secret_key)
+        elif profile:
+            boto_session = boto3.Session(profile_name=profile, region_name=region)
+            return boto_session.client(service)
+        else:
+            return boto3.client(service, region_name=region)
+
+    def _enum_users(self, iam, account: str, session: "Session") -> list:
+        from core.logger import log
+        import datetime
+        findings = []
+        max_items = int(self.get_option("MAX_ITEMS", "100"))
+
+        try:
+            paginator = iam.get_paginator("list_users")
+            users = []
+            for page in paginator.paginate(PaginationConfig={"MaxItems": max_items}):
+                users.extend(page["Users"])
+
+            log.info(f"IAM Users found: {len(users)}")
+
+            for user in users:
+                name = user["UserName"]
+                arn  = user["Arn"]
+                log.step(f"User: {name} ({arn})")
+
+                # Check MFA
+                if self.get_option("CHECK_MFA", "true").lower() == "true":
+                    try:
+                        mfa = iam.list_mfa_devices(UserName=name)
+                        if not mfa["MFADevices"]:
+                            log.warning(f"  No MFA: {name}")
+                            findings.append(f"no_mfa:{name}")
+                            session.add_finding(
+                                module="iam_enum",
+                                title=f"IAM User Without MFA: {name}",
+                                severity="HIGH",
+                                description=f"IAM user '{name}' does not have MFA enabled.",
+                                evidence=f"User ARN: {arn}\nMFA devices: 0",
+                                recommendation="Enable MFA: aws iam enable-mfa-device --user-name {name} --serial-number arn:aws:iam::ACCOUNT:mfa/{name} --authentication-code1 CODE1 --authentication-code2 CODE2",
+                                cvss_score=7.5,
+                                aws_parallel="IAM user without MFA — vulnerable to credential stuffing",
+                                mitre_technique="T1078.004",
+                            )
+                    except Exception:
+                        pass  # network/connection error — continue scanning
+
+                # Check access key age
+                if self.get_option("CHECK_KEY_AGE", "true").lower() == "true":
+                    try:
+                        keys = iam.list_access_keys(UserName=name)
+                        for key in keys["AccessKeyMetadata"]:
+                            if key["Status"] == "Active":
+                                age = (datetime.datetime.now(datetime.timezone.utc) -
+                                       key["CreateDate"].astimezone(datetime.timezone.utc)).days
+                                if age > 90:
+                                    log.warning(f"  Old key ({age} days): {key['AccessKeyId']}")
+                                    findings.append(f"old_key:{key['AccessKeyId']}")
+                                    session.add_finding(
+                                        module="iam_enum",
+                                        title=f"Access Key Older Than 90 Days: {name}",
+                                        severity="MEDIUM",
+                                        description=f"Access key {key['AccessKeyId']} for user {name} is {age} days old.",
+                                        evidence=f"Key: {key['AccessKeyId']}\nAge: {age} days\nStatus: Active",
+                                        recommendation="Rotate: aws iam create-access-key --user-name {name} && aws iam delete-access-key --access-key-id {old_key}",
+                                        cvss_score=5.5,
+                                        aws_parallel="Stale IAM access key — increased exposure window",
+                                        mitre_technique="T1078.004",
+                                    )
+                    except Exception:
+                        pass  # network/connection error — continue scanning
+
+                # Check for admin policies
+                if self.get_option("CHECK_POLICIES", "true").lower() == "true":
+                    try:
+                        attached = iam.list_attached_user_policies(UserName=name)
+                        for policy in attached["AttachedPolicies"]:
+                            if "AdministratorAccess" in policy["PolicyName"] or \
+                               "FullAccess" in policy["PolicyName"]:
+                                log.critical(f"  ADMIN POLICY: {policy['PolicyName']} on {name}")
+                                findings.append(f"admin_policy:{name}:{policy['PolicyName']}")
+                                session.add_finding(
+                                    module="iam_enum",
+                                    title=f"Overly Permissive Policy: {name}",
+                                    severity="HIGH",
+                                    description=f"User {name} has {policy['PolicyName']} attached.",
+                                    evidence=f"Policy: {policy['PolicyArn']}",
+                                    recommendation="Apply least-privilege. Remove AdministratorAccess. Use specific service policies.",
+                                    cvss_score=8.0,
+                                    aws_parallel="IAM user with AdministratorAccess — violates least privilege",
+                                    mitre_technique="T1078.004",
+                                )
+                    except Exception:
+                        pass  # network/connection error — continue scanning
+
+        except Exception as e:
+            pass  # error handled upstream
+        except Exception as e:
+
+            pass  # error handled upstream
+        return findings
+
+    def _enum_roles(self, iam, session: "Session") -> list:
+        from core.logger import log
+        import json
+        findings = []
+
+        try:
+            paginator = iam.get_paginator("list_roles")
+            roles = []
+            for page in paginator.paginate():
+                roles.extend(page["Roles"])
+
+            log.info(f"IAM Roles found: {len(roles)}")
+
+            for role in roles:
+                name  = role["RoleName"]
+                trust = role.get("AssumeRolePolicyDocument", {})
+                trust_str = json.dumps(trust)
+
+                # Check for overly broad trust
+                if '"*"' in trust_str or '"AWS": "*"' in trust_str:
+                    log.critical(f"  Wildcard trust policy: {name}")
+                    findings.append(f"wildcard_trust:{name}")
+                    session.add_finding(
+                        module="iam_enum",
+                        title=f"IAM Role with Wildcard Trust Policy: {name}",
+                        severity="CRITICAL",
+                        description=f"Role '{name}' can be assumed by any AWS principal (trust policy uses *).",
+                        evidence=f"Trust policy: {trust_str[:200]}",
+                        recommendation="Restrict trust policy to specific accounts/services/roles.",
+                        cvss_score=9.0,
+                        aws_parallel="iam:AssumeRole with wildcard principal — privilege escalation path",
+                        mitre_technique="T1548",
+                    )
+
+        except Exception as e:
+            pass  # error handled upstream
+        except Exception as e:
+
+            pass  # error handled upstream
+        return findings
+
+    def _check_account_summary(self, iam, session: "Session"):
+        from core.logger import log
+        try:
+            summary = iam.get_account_summary()["SummaryMap"]
+            root_mfa   = summary.get("AccountMFAEnabled", 0)
+            pw_policy  = summary.get("AccountSigningCertificatesPresent", 0)
+
+            log.info(f"Root account MFA: {'Enabled' if root_mfa else 'DISABLED'}")
+            if not root_mfa:
+                session.add_finding(
+                    module="iam_enum",
+                    title="CRITICAL: Root Account MFA Not Enabled",
+                    severity="CRITICAL",
+                    description="The AWS root account does not have MFA enabled.",
+                    evidence="AccountMFAEnabled: 0",
+                    recommendation="Enable MFA on root account immediately via AWS Console.",
+                    cvss_score=9.5,
+                    aws_parallel="Root account without MFA — highest possible AWS security risk",
+                    mitre_technique="T1078.004",
+                )
+        except Exception:
+            pass  # network/connection error — continue scanning
+
+    def _http_fallback(self, session: "Session") -> ModuleResult:
+        """When boto3 not available, look for IAM clues in HTTP responses."""
+        from core.logger import log
+        log.info("Running HTTP-based IAM indicator detection...")
+
+        # Check if any found secrets look like AWS keys
+        aws_keys = [s for s in session.secrets if s["secret_type"] == "AWS_ACCESS_KEY"]
+        if aws_keys:
+            log.warning(f"Found {len(aws_keys)} AWS Access Keys but cannot verify without boto3")
+            log.info("Install boto3 for full IAM analysis: pip install boto3")
+            session.add_finding(
+                module="iam_enum",
+                title="AWS Credentials Found — boto3 Required for Full Analysis",
+                severity="HIGH",
+                description="AWS access keys were discovered but boto3 is not available for API verification.",
+                evidence=f"{len(aws_keys)} AWS Access Key(s) found",
+                recommendation="Install boto3 and rerun: pip install boto3",
+                cvss_score=7.0,
+                aws_parallel="Unverified IAM credentials — may grant significant AWS access",
+                mitre_technique="T1078.004",
+            )
+
+        return ModuleResult(True, {"boto3_available": False, "aws_keys_found": len(aws_keys)})