mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
feat(modules): add tcp module executor and recon modules (#308)
* feat(modules): tcp module executor dial+probe+banner with word/regex/size matchers, ctx-honest watcher, port required. * feat(modules): add redis unauthenticated access tcp module first shipped tcp module: sends INFO to redis (6379) and matches redis_version in the reply, which an auth-required server never returns (it answers -NOAUTH). extracts the leaked version. * docs(modules): document the tcp module type flip the http-only note and add a tcp config section (port, data, word/regex/size matchers and regex extractors against the banner), pointing at the redis demo module. * feat(modules): support matchers-condition in tcp modules tcp matchers were and-only; add the matchers-condition key (and default, or) mirroring the http executor's checkMatchers, validated at load via the shared validateMatchersCondition. documents the override in the combining matchers section. * feat(modules): decode escape sequences in tcp data payloads decode C-style escapes (\\ \a \b \f \n \r \t \v \xHH) in a tcp module's data value before it goes on the wire, so a single-quoted or plain yaml scalar reaches the service with the same control bytes a double-quoted one already would. an unrecognized escape is kept verbatim so no bytes are silently lost. * feat(modules): add tcp recon modules for common services add five built-in tcp modules alongside the redis one so the executor ships a real service set: memcached (unauth version probe), ssh and ftp (passive banner version disclosure), mysql/mariadb (handshake exposure, matched with matchers-condition: or across both auth plugin names), and vnc (rfb handshake exposure). each fingerprint tracks the documented on-wire protocol and pulls the version into an extractor. * feat(modules): add mail and rsync tcp recon modules add four more passive-banner tcp modules: smtp, pop3, and imap read the greeting each mail service sends on connect (the smtp matcher requires an esmtp/smtp marker so it does not fire on a bare 220 ftp greeting), and rsync detects an exposed daemon by its @RSYNCD handshake. each pulls the banner or protocol version into an extractor.
This commit is contained in:
Tigah
@@ -0,0 +1,26 @@
|
||||
# FTP Service Banner Detection Module
|
||||
|
||||
id: ftp-banner-exposure
|
||||
info:
|
||||
name: FTP Service Banner Disclosure
|
||||
author: sif
|
||||
severity: info
|
||||
description: Reads the 220 greeting an FTP server sends on connect, disclosing the daemon and version (often vsFTPd, ProFTPD, or Pure-FTPd) that an attacker can fingerprint for known issues
|
||||
tags: [ftp, banner, version, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 21
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^220[ -]"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: ftp_banner
|
||||
regex:
|
||||
- "^220[ -]([^\\r\\n]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# IMAP Service Banner Detection Module
|
||||
|
||||
id: imap-banner-exposure
|
||||
info:
|
||||
name: IMAP Service Banner Disclosure
|
||||
author: sif
|
||||
severity: info
|
||||
description: Reads the untagged * OK greeting an IMAP server sends on connect (RFC 3501), confirming a mail-access service is reachable and disclosing the daemon banner and capabilities before authentication
|
||||
tags: [imap, mail, banner, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 143
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^\\* OK"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: imap_banner
|
||||
regex:
|
||||
- "^\\* OK ([^\\r\\n]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,27 @@
|
||||
# Memcached Unauthenticated Access Detection Module
|
||||
|
||||
id: memcached-unauth-exposure
|
||||
info:
|
||||
name: Memcached Unauthenticated Access
|
||||
author: sif
|
||||
severity: high
|
||||
description: Detects a Memcached server that answers the version command without authentication, confirming unauthenticated access to the cache (a reachable memcached is also a known UDP/TCP reflection-amplification vector)
|
||||
tags: [memcached, cache, database, tcp, unauth, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 11211
|
||||
data: "version\r\n"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "VERSION "
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: memcached_version
|
||||
regex:
|
||||
- "VERSION ([0-9.]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,30 @@
|
||||
# MySQL/MariaDB Network Exposure Detection Module
|
||||
|
||||
id: mysql-exposure
|
||||
info:
|
||||
name: MySQL/MariaDB Network Exposure
|
||||
author: sif
|
||||
severity: medium
|
||||
description: Detects a network-reachable MySQL or MariaDB server by its initial handshake packet, which advertises an authentication plugin and the server version in cleartext before any login (a database port open to the network is an attack surface regardless of credentials)
|
||||
tags: [mysql, mariadb, database, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 3306
|
||||
|
||||
matchers-condition: or
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "mysql_native_password"
|
||||
- type: word
|
||||
words:
|
||||
- "caching_sha2_password"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: mysql_version
|
||||
regex:
|
||||
- "([0-9]+\\.[0-9]+\\.[0-9]+[0-9A-Za-z.\\-]*)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# POP3 Service Banner Detection Module
|
||||
|
||||
id: pop3-banner-exposure
|
||||
info:
|
||||
name: POP3 Service Banner Disclosure
|
||||
author: sif
|
||||
severity: info
|
||||
description: Reads the +OK greeting a POP3 server sends on connect (RFC 1939), confirming a cleartext mail-retrieval service is reachable and disclosing the daemon banner before authentication
|
||||
tags: [pop3, mail, banner, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 110
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^\\+OK"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: pop3_banner
|
||||
regex:
|
||||
- "^\\+OK ?([^\\r\\n]*)"
|
||||
group: 1
|
||||
@@ -0,0 +1,27 @@
|
||||
# Redis Unauthenticated Access Detection Module
|
||||
|
||||
id: redis-unauth-exposure
|
||||
info:
|
||||
name: Redis Unauthenticated Access
|
||||
author: sif
|
||||
severity: high
|
||||
description: Detects a Redis server that answers INFO without authentication, leaking server details and confirming unauthenticated data access (an auth-required server replies -NOAUTH and never reaches redis_version)
|
||||
tags: [redis, database, tcp, unauth, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 6379
|
||||
data: "INFO\r\n"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "redis_version:"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: redis_version
|
||||
regex:
|
||||
- "redis_version:([0-9.]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# Rsync Daemon Exposure Detection Module
|
||||
|
||||
id: rsync-exposure
|
||||
info:
|
||||
name: Rsync Daemon Exposure
|
||||
author: sif
|
||||
severity: medium
|
||||
description: Detects an exposed rsync daemon by the @RSYNCD greeting it sends on connect, confirming a network-reachable rsync service that often permits anonymous module listing and unauthenticated file transfer
|
||||
tags: [rsync, file-transfer, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 873
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "@RSYNCD:"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: rsync_protocol
|
||||
regex:
|
||||
- "@RSYNCD: ([0-9.]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# SMTP Service Banner Detection Module
|
||||
|
||||
id: smtp-banner-exposure
|
||||
info:
|
||||
name: SMTP Service Banner Disclosure
|
||||
author: sif
|
||||
severity: info
|
||||
description: Reads the 220 ESMTP greeting a mail server sends on connect (RFC 5321), disclosing the MTA and version (often Postfix, Exim, Sendmail, or Exchange) that an attacker can fingerprint for known issues
|
||||
tags: [smtp, mail, banner, version, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 25
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "(?i)^220[ -].*smtp"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: smtp_banner
|
||||
regex:
|
||||
- "^220[ -]([^\\r\\n]+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# SSH Service Banner Detection Module
|
||||
|
||||
id: ssh-version-exposure
|
||||
info:
|
||||
name: SSH Service Version Disclosure
|
||||
author: sif
|
||||
severity: info
|
||||
description: Reads the SSH identification string the server sends on connect (RFC 4253), disclosing the implementation and version that an attacker can match against known CVEs
|
||||
tags: [ssh, banner, version, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 22
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^SSH-[0-9]+\\.[0-9]+-"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: ssh_software
|
||||
regex:
|
||||
- "^SSH-[0-9]+\\.[0-9]+-(\\S+)"
|
||||
group: 1
|
||||
@@ -0,0 +1,26 @@
|
||||
# VNC Service Exposure Detection Module
|
||||
|
||||
id: vnc-exposure
|
||||
info:
|
||||
name: VNC Service Exposure
|
||||
author: sif
|
||||
severity: medium
|
||||
description: Detects a network-reachable VNC server by the RFB ProtocolVersion handshake it sends on connect (RFC 6143), confirming a remote-desktop service is exposed and disclosing the protocol version before authentication
|
||||
tags: [vnc, rfb, remote-access, tcp, exposure, recon]
|
||||
|
||||
type: tcp
|
||||
|
||||
tcp:
|
||||
port: 5900
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^RFB [0-9]{3}\\.[0-9]{3}"
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: rfb_version
|
||||
regex:
|
||||
- "^RFB ([0-9]{3}\\.[0-9]{3})"
|
||||
group: 1
|
||||
Reference in New Issue
Block a user