mirror of
https://github.com/cliffe/SecGen.git
synced 2026-02-21 11:18:06 +00:00
Cliffe
@@ -0,0 +1,7 @@
|
||||
# begining of puppet code execution
|
||||
contain apache_couchdb::install
|
||||
contain apache_couchdb::couchdb
|
||||
contain apache_couchdb::configure
|
||||
Class['apache_couchdb::install']
|
||||
-> Class['apache_couchdb::couchdb']
|
||||
-> Class['apache_couchdb::configure']
|
||||
Binary file not shown.
@@ -0,0 +1,32 @@
|
||||
class apache_couchdb::configure {
|
||||
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
|
||||
$database = 'couchdb'
|
||||
$user = $secgen_parameters['leaked_username'][0]
|
||||
$password = $secgen_parameters['leaked_password'][0]
|
||||
$jsondb = 'sampledata' ##TODO secgen
|
||||
$strings_to_leak = $secgen_parameters['strings_to_leak']
|
||||
$leaked_filenames = $secgen_parameters['leaked_filenames']
|
||||
$user_home = "/home/${user}"
|
||||
|
||||
Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
|
||||
|
||||
#create database
|
||||
#exec { 'create-database':
|
||||
# command => "curl -X PUT http://localhost:34023/${database} -u \"${username}:${password}\"",
|
||||
# logoutput => true
|
||||
#}->
|
||||
#exec { 'import_data':
|
||||
# cwd=> '/usr/bin/',
|
||||
# command => "curl -d @${jsondb}.json -H \"Content-type: application/json\" -X POST http://127.0.0.1:34023/${database}/_bulk_docs -u \"${username}:${password}\"",
|
||||
# logoutput => true
|
||||
#}
|
||||
|
||||
::secgen_functions::leak_files { 'couchdb-flag-leak':
|
||||
storage_directory => $user_home,
|
||||
leaked_filenames => $leaked_filenames,
|
||||
strings_to_leak => $strings_to_leak,
|
||||
owner => $user,
|
||||
mode => '0644',
|
||||
leaked_from => 'apache_couchdb',
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
class apache_couchdb::couchdb {
|
||||
$secgen_parameters=secgen_functions::get_parameters($::base64_inputs_file)
|
||||
$username = $secgen_parameters['leaked_username'][0]
|
||||
$password = $secgen_parameters['leaked_password'][0]
|
||||
$host ='127.0.0.1'
|
||||
$docroot = '/opt/couchdb'
|
||||
$database_dir = '/var/lib/couchdb'
|
||||
$uid = fqdn_uuid('localhost.com')
|
||||
$port = $secgen_parameters['port'][0]
|
||||
|
||||
Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
|
||||
#create user
|
||||
#create system user
|
||||
user { $username:
|
||||
ensure => present,
|
||||
shell => '/bin/bash',
|
||||
password => pw_hash($password, 'SHA-512', 'mysalt'),
|
||||
}
|
||||
#set folder permissions
|
||||
-> exec { 'chown-couchdb':
|
||||
command => "chown -R ${username}:${username} ${docroot}",
|
||||
logoutput => true
|
||||
}
|
||||
-> exec { 'chmod-couchdb':
|
||||
command => "chmod -R 770 ${docroot}",
|
||||
logoutput => true
|
||||
}
|
||||
#configuration file
|
||||
-> file { "${docroot}/etc/local.ini" :
|
||||
ensure => file,
|
||||
content => template('apache_couchdb/local.ini.erb'),
|
||||
}
|
||||
# add vm.args files
|
||||
-> file { "${docroot}/etc/vm.args":
|
||||
ensure => file,
|
||||
content => template('apache_couchdb/vm.args.erb'),
|
||||
notify => Exec['restart-couchdb'],
|
||||
}
|
||||
|
||||
#restart couch db
|
||||
exec {'restart-couchdb':
|
||||
command => 'systemctl restart couchdb',
|
||||
logoutput => true,
|
||||
notify => Exec['wait-apache-couchdb'],
|
||||
}
|
||||
|
||||
exec { 'wait-apache-couchdb':
|
||||
command => 'sleep 4',
|
||||
logoutput => true,
|
||||
notify => Exec['chown-uri-file'],
|
||||
}
|
||||
|
||||
exec { 'chown-uri-file':
|
||||
command => "chown -R ${username}:${username} /var/run/couchdb/",
|
||||
logoutput => true,
|
||||
}
|
||||
-> exec { 'chmod-uri-file':
|
||||
command => 'chmod -R 770 /var/run/couchdb/',
|
||||
logoutput => true,
|
||||
}
|
||||
-> service { 'epmd-restart':
|
||||
name => 'epmd',
|
||||
restart => '',
|
||||
flags => '-port 1337',
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
class apache_couchdb::install {
|
||||
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
|
||||
$responsefile = 'installresponse'
|
||||
$packagename = 'couchdb_3.2.1_buster_amd64'
|
||||
$jsondb = 'sampledata.json'
|
||||
$password = $secgen_parameters['leaked_password'][0]
|
||||
|
||||
Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
|
||||
|
||||
ensure_packages(['build-essential',
|
||||
'pkg-config',
|
||||
'erlang',
|
||||
'libicu-dev',
|
||||
'libmozjs-60-dev',
|
||||
'libcurl4-openssl-dev',
|
||||
'gnupg'])
|
||||
|
||||
# copy archive
|
||||
file { "/usr/local/src/${packagename}.deb" :
|
||||
ensure => file,
|
||||
source => "puppet:///modules/apache_couchdb/${packagename}.deb",
|
||||
}
|
||||
-> file { "/usr/bin/${responsefile}" :
|
||||
ensure => file,
|
||||
content => template("apache_couchdb/${responsefile}.erb"),
|
||||
}
|
||||
-> file { "/usr/bin/${jsondb}.json" :
|
||||
ensure => file,
|
||||
content => template("apache_couchdb/${jsondb}.erb"),
|
||||
}
|
||||
#install couch db from deb file
|
||||
-> package {'couchdb-install':
|
||||
name => $packagename,
|
||||
provider => dpkg,
|
||||
source => "/usr/local/src/${packagename}.deb",
|
||||
responsefile => $responsefile,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
<vulnerability xmlns="http://www.github/cliffe/SecGen/vulnerability"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://www.github/cliffe/SecGen/vulnerability">
|
||||
|
||||
<name>Apache CouchDB Unauthenticated RCE</name>
|
||||
<author>Sofia Markusfeld</author>
|
||||
<author>James Davis</author>
|
||||
<module_license>Apache v2</module_license>
|
||||
<description>
|
||||
Apache CouchDB versions 3.2.1 and below default installation settings are vulnerable to an
|
||||
Earling RCE exploit.
|
||||
</description>
|
||||
|
||||
<type>remote</type>
|
||||
<privilege>user_rwx</privilege>
|
||||
<access>remote</access>
|
||||
<platform>linux</platform>
|
||||
<difficulty>low</difficulty>
|
||||
|
||||
<read_fact>port</read_fact>
|
||||
<read_fact>known_username</read_fact>
|
||||
<read_fact>known_password</read_fact>
|
||||
<read_fact>strings_to_leak</read_fact>
|
||||
<read_fact>strings_to_preleak</read_fact>
|
||||
<read_fact>leaked_filenames</read_fact>
|
||||
|
||||
<default_input into="port">
|
||||
<generator type="random_number_generator" />
|
||||
</default_input>
|
||||
|
||||
<!-- flags or other secrets exposed after exploitation -->
|
||||
<default_input into="strings_to_leak">
|
||||
<generator type="message_generator" />
|
||||
</default_input>
|
||||
|
||||
<default_input into="leaked_filenames">
|
||||
<generator type="filename_generator" />
|
||||
</default_input>
|
||||
|
||||
<default_input into="leaked_username">
|
||||
<value>couchdb</value>
|
||||
</default_input>
|
||||
|
||||
<default_input into="leaked_password">
|
||||
<generator type="password_generator" />
|
||||
</default_input>
|
||||
|
||||
<!--optional
|
||||
vulnerability details-->
|
||||
<!-- rce vuln -->
|
||||
<cve>CVE-2022-24706</cve>
|
||||
<cvss_base_score>9</cvss_base_score>
|
||||
<cvss_vector>AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector>
|
||||
<reference>https://www.exploit-db.com/exploits/50914</reference>
|
||||
<reference>
|
||||
https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/apache_couchdb_erlang_rce.rb</reference>
|
||||
<software_name>Apache CouchDB</software_name>
|
||||
<software_license>Apache</software_license>
|
||||
|
||||
<!--optional
|
||||
hints-->
|
||||
<hint>This exploit is based off on 1F98D's Erlang Cookie - Remote Code Execution </hint>
|
||||
|
||||
<requires>
|
||||
<type>update</type>
|
||||
</requires>
|
||||
<!--<requires>
|
||||
<module_path>.*apache.*compatible.*</module_path>
|
||||
</requires>-->
|
||||
|
||||
</vulnerability>
|
||||
@@ -0,0 +1,8 @@
|
||||
<%= @packagename %> couchdb/mode select standalone
|
||||
<%= @packagename %> couchdb/mode seen true
|
||||
<%= @packagename %> couchdb/bindaddress string 127.0.0.1
|
||||
<%= @packagename %> couchdb/bindaddress seen true
|
||||
<%= @packagename %> couchdb couchdb/adminpass password ${<%= @password %>}
|
||||
<%= @packagename %> couchdb couchdb/adminpass seen true
|
||||
<%= @packagename %> couchdb couchdb/adminpass_again password ${<%= @password %>}
|
||||
<%= @packagename %> couchdb couchdb/adminpass_again seen true
|
||||
@@ -0,0 +1,106 @@
|
||||
; CouchDB Configuration Settings
|
||||
|
||||
; Custom settings should be made in this file. They will override settings
|
||||
; in default.ini, but unlike changes made to default.ini, this file won't be
|
||||
; overwritten on server upgrade.
|
||||
|
||||
[couchdb]
|
||||
max_document_size = 4294967296 ; bytes
|
||||
os_process_timeout = 5000
|
||||
database_dir = <%= @database_dir %>
|
||||
default_security = admin_only
|
||||
file_compression = snappy
|
||||
max_dbs_open = 100
|
||||
single_node = true
|
||||
uri_file = /var/run/couchdb/couchdb.uri
|
||||
users_db_suffix = _users
|
||||
util_driver_dir = /usr/lib/couchdb/erlang/lib/couch-1.5.0/priv/lib
|
||||
uuid = <%= @uid %>
|
||||
view_index_dir = /var/lib/couchdb
|
||||
|
||||
|
||||
[couch_peruser]
|
||||
; If enabled, couch_peruser ensures that a private per-user database
|
||||
; exists for each document in _users. These databases are writable only
|
||||
; by the corresponding user. Databases are in the following form:
|
||||
; userdb-{hex encoded username}
|
||||
;enable = true
|
||||
; If set to true and a user is deleted, the respective database gets
|
||||
; deleted as well.
|
||||
;delete_dbs = true
|
||||
; Set a default q value for peruser-created databases that is different from
|
||||
; cluster / q
|
||||
;q = 1
|
||||
|
||||
[chttpd]
|
||||
port = <%= @port %>
|
||||
bind_address = <%= @host %>
|
||||
; Options for the MochiWeb HTTP server.
|
||||
;server_options = [{backlog, 128}, {acceptor_pool_size, 16}]
|
||||
; For more socket options, consult Erlang's module 'inet' man page.
|
||||
;socket_options = [{sndbuf, 262144}, {nodelay, true}]
|
||||
|
||||
[httpd]
|
||||
; NOTE that this only configures the "backend" node-local port, not the
|
||||
; "frontend" clustered port. You probably don't want to change anything in
|
||||
; this section.
|
||||
; Uncomment next line to trigger basic-auth popup on unauthorized requests.
|
||||
;WWW-Authenticate = Basic realm="administrator"
|
||||
|
||||
; Uncomment next line to set the configuration modification whitelist. Only
|
||||
; whitelisted values may be changed via the /_config URLs. To allow the admin
|
||||
; to change this value over HTTP, remember to include {httpd,config_whitelist}
|
||||
; itself. Excluding it from the list would require editing this file to update
|
||||
; the whitelist.
|
||||
;config_whitelist = [{httpd,config_whitelist}, {log,level}, {etc,etc}]
|
||||
|
||||
[chttpd_auth]
|
||||
; If you set this to true, you should also uncomment the WWW-Authenticate line
|
||||
; above. If you don't configure a WWW-Authenticate header, CouchDB will send
|
||||
; Basic realm="server" in order to prevent you getting logged out.
|
||||
require_valid_user = false
|
||||
|
||||
[ssl]
|
||||
;enable = true
|
||||
;cert_file = /full/path/to/server_cert.pem
|
||||
;key_file = /full/path/to/server_key.pem
|
||||
;password = somepassword
|
||||
; set to true to validate peer certificates
|
||||
;verify_ssl_certificates = false
|
||||
; Set to true to fail if the client does not send a certificate. Only used if verify_ssl_certificates is true.
|
||||
;fail_if_no_peer_cert = false
|
||||
; Path to file containing PEM encoded CA certificates (trusted
|
||||
; certificates used for verifying a peer certificate). May be omitted if
|
||||
; you do not want to verify the peer.
|
||||
;cacert_file = /full/path/to/cacertf
|
||||
; The verification fun (optional) if not specified, the default
|
||||
; verification fun will be used.
|
||||
;verify_fun = {Module, VerifyFun}
|
||||
; maximum peer certificate depth
|
||||
;ssl_certificate_max_depth = 1
|
||||
;
|
||||
; Reject renegotiations that do not live up to RFC 5746.
|
||||
;secure_renegotiate = true
|
||||
; The cipher suites that should be supported.
|
||||
; Can be specified in erlang format "{ecdhe_ecdsa,aes_128_cbc,sha256}"
|
||||
; or in OpenSSL format "ECDHE-ECDSA-AES128-SHA256".
|
||||
;ciphers = ["ECDHE-ECDSA-AES128-SHA256", "ECDHE-ECDSA-AES128-SHA"]
|
||||
; The SSL/TLS versions to support
|
||||
;tls_versions = [tlsv1, 'tlsv1.1', 'tlsv1.2']
|
||||
|
||||
; To enable Virtual Hosts in CouchDB, add a vhost = path directive. All requests to
|
||||
; the Virual Host will be redirected to the path. In the example below all requests
|
||||
; to http://example.com/ are redirected to /database.
|
||||
; If you run CouchDB on a specific port, include the port number in the vhost:
|
||||
; example.com:5984 = /database
|
||||
[vhosts]
|
||||
;example.com = /database/
|
||||
|
||||
; To create an admin account uncomment the '[admins]' section below and add a
|
||||
; line in the format 'username = password'. When you next start CouchDB, it
|
||||
; will change the password to a hash (so that your passwords don't linger
|
||||
; around in plain-text files). You can add more admin accounts with more
|
||||
; 'username = password' lines. Don't forget to restart CouchDB after
|
||||
; changing this.
|
||||
[admins]
|
||||
<%= @username %> = <%= @password %>
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"docs": [
|
||||
{
|
||||
"id": 1,
|
||||
"pantone_value": "11-0103",
|
||||
"name": "egret",
|
||||
"hex": "#f3ece0"
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"pantone_value": "11-0602",
|
||||
"name": "snow-white",
|
||||
"hex": "#f2f0eb"
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"name": "true red",
|
||||
"year": 2002,
|
||||
"color": "#BF1932",
|
||||
"pantone_value": "19-1664"
|
||||
},
|
||||
{
|
||||
"id": 4,
|
||||
"name": "aqua sky",
|
||||
"year": 2003,
|
||||
"color": "#7BC4C4",
|
||||
"pantone_value": "14-4811"
|
||||
},
|
||||
{
|
||||
"id": 5,
|
||||
"year": 2004,
|
||||
"color": "#E2583E",
|
||||
"pantone_value": "17-1456"
|
||||
},
|
||||
{
|
||||
"id": 6,
|
||||
"name": "blue turquoise",
|
||||
"year": 2005,
|
||||
"color": "#53B0AE",
|
||||
"pantone_value": "15-5217"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy of
|
||||
# the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations under
|
||||
# the License.
|
||||
|
||||
# Each node in the system must have a unique name. These are specified through
|
||||
# the Erlang -name flag, which takes the form:
|
||||
#
|
||||
# -name nodename@<FQDN>
|
||||
#
|
||||
# or
|
||||
#
|
||||
# -name nodename@<IP-ADDRESS>
|
||||
#
|
||||
# CouchDB recommends the following values for this flag:
|
||||
#
|
||||
# 1. If this is a single node, not in a cluster, use:
|
||||
# -name couchdb@127.0.0.1
|
||||
#
|
||||
# 2. If DNS is configured for this host, use the FQDN, such as:
|
||||
# -name couchdb@my.host.domain.com
|
||||
#
|
||||
# 3. If DNS isn't configured for this host, use IP addresses only, such as:
|
||||
# -name couchdb@192.168.0.1
|
||||
#
|
||||
# Do not rely on tricks with /etc/hosts or libresolv to handle anything
|
||||
# other than the above 3 approaches correctly. They will not work reliably.
|
||||
#
|
||||
# Multiple CouchDBs running on the same machine can use couchdb1@, couchdb2@,
|
||||
# etc.
|
||||
-name couchdb@<%= @host %>
|
||||
|
||||
# All nodes must share the same magic cookie for distributed Erlang to work.
|
||||
# Comment out this line if you synchronized the cookies by other means (using
|
||||
# the ~/.erlang.cookie file, for example).
|
||||
-setcookie monster
|
||||
|
||||
# Tell kernel and SASL not to log anything
|
||||
-kernel error_logger silent
|
||||
-sasl sasl_error_logger false
|
||||
|
||||
# Use kernel poll functionality if supported by emulator
|
||||
+K true
|
||||
|
||||
# Start a pool of asynchronous IO threads
|
||||
+A 16
|
||||
|
||||
# Comment this line out to enable the interactive Erlang shell on startup
|
||||
+Bd -noinput
|
||||
|
||||
# Force use of the smp scheduler, fixes #1296
|
||||
-smp enable
|
||||
|
||||
# Set maximum SSL session lifetime to reap terminated replication readers
|
||||
-ssl session_lifetime 300
|
||||
|
||||
## TLS Distribution
|
||||
## Use TLS for connections between Erlang cluster members.
|
||||
## http://erlang.org/doc/apps/ssl/ssl_distribution.html
|
||||
##
|
||||
## Generate Cert(PEM) File
|
||||
## This is just an example command to generate a certfile (PEM).
|
||||
## This is not an endorsement of specific expiration limits, key sizes, or algorithms.
|
||||
## $ openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
|
||||
## $ cat key.pem cert.pem > dev/erlserver.pem && rm key.pem cert.pem
|
||||
##
|
||||
## Generate a Config File (couch_ssl_dist.conf)
|
||||
## [{server,
|
||||
## [{certfile, "</path/to/erlserver.pem>"},
|
||||
## {secure_renegotiate, true}]},
|
||||
## {client,
|
||||
## [{secure_renegotiate, true}]}].
|
||||
##
|
||||
## CouchDB recommends the following values for no_tls flag:
|
||||
## 1. Use TCP only, set to true, such as:
|
||||
## -couch_dist no_tls true
|
||||
## 2. Use TLS only, set to false, such as:
|
||||
## -couch_dist no_tls false
|
||||
## 3. Specify which node to use TCP, such as:
|
||||
## -couch_dist no_tls \"*@127.0.0.1\"
|
||||
##
|
||||
## To ensure search works, make sure to set 'no_tls' option for the clouseau node.
|
||||
## By default that would be "clouseau@127.0.0.1".
|
||||
## Don't forget to override the paths to point to your certificate(s) and key(s)!
|
||||
##
|
||||
#-proto_dist couch
|
||||
#-couch_dist no_tls \"clouseau@127.0.0.1\"
|
||||
#-ssl_dist_optfile <path/to/couch_ssl_dist.conf>
|
||||
-couch_ini <%= @docroot %>/etc/default.ini <%= @docroot %>/etc/local.ini
|
||||
16
scenarios/examples/vulnerability_examples/apache_couchdb.xml
Normal file
16
scenarios/examples/vulnerability_examples/apache_couchdb.xml
Normal file
@@ -0,0 +1,16 @@
|
||||
<?xml version="1.0"?>
|
||||
|
||||
<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
|
||||
|
||||
<system>
|
||||
<system_name>couchdb</system_name>
|
||||
<base distro="Debian 10" type="desktop" name="KDE" />
|
||||
|
||||
<vulnerability module_path=".*/apache_couchdb" />
|
||||
|
||||
<network type="private_network" range="dhcp" />
|
||||
</system>
|
||||
|
||||
</scenario>
|
||||
Reference in New Issue
Block a user