mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
bf8c6a8643
* feat(modules): tcp module executor dial+probe+banner with word/regex/size matchers, ctx-honest watcher, port required. * feat(modules): add redis unauthenticated access tcp module first shipped tcp module: sends INFO to redis (6379) and matches redis_version in the reply, which an auth-required server never returns (it answers -NOAUTH). extracts the leaked version. * docs(modules): document the tcp module type flip the http-only note and add a tcp config section (port, data, word/regex/size matchers and regex extractors against the banner), pointing at the redis demo module. * feat(modules): support matchers-condition in tcp modules tcp matchers were and-only; add the matchers-condition key (and default, or) mirroring the http executor's checkMatchers, validated at load via the shared validateMatchersCondition. documents the override in the combining matchers section. * feat(modules): decode escape sequences in tcp data payloads decode C-style escapes (\\ \a \b \f \n \r \t \v \xHH) in a tcp module's data value before it goes on the wire, so a single-quoted or plain yaml scalar reaches the service with the same control bytes a double-quoted one already would. an unrecognized escape is kept verbatim so no bytes are silently lost. * feat(modules): add tcp recon modules for common services add five built-in tcp modules alongside the redis one so the executor ships a real service set: memcached (unauth version probe), ssh and ftp (passive banner version disclosure), mysql/mariadb (handshake exposure, matched with matchers-condition: or across both auth plugin names), and vnc (rfb handshake exposure). each fingerprint tracks the documented on-wire protocol and pulls the version into an extractor. * feat(modules): add mail and rsync tcp recon modules add four more passive-banner tcp modules: smtp, pop3, and imap read the greeting each mail service sends on connect (the smtp matcher requires an esmtp/smtp marker so it does not fire on a bare 220 ftp greeting), and rsync detects an exposed daemon by its @RSYNCD handshake. each pulls the banner or protocol version into an extractor.
27 lines
610 B
YAML
27 lines
610 B
YAML
# Rsync Daemon Exposure Detection Module
|
|
|
|
id: rsync-exposure
|
|
info:
|
|
name: Rsync Daemon Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects an exposed rsync daemon by the @RSYNCD greeting it sends on connect, confirming a network-reachable rsync service that often permits anonymous module listing and unauthenticated file transfer
|
|
tags: [rsync, file-transfer, tcp, exposure, recon]
|
|
|
|
type: tcp
|
|
|
|
tcp:
|
|
port: 873
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "@RSYNCD:"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: rsync_protocol
|
|
regex:
|
|
- "@RSYNCD: ([0-9.]+)"
|
|
group: 1
|