Skip to content

Commit c68e5bd

Browse files
authored
Merge pull request #292 from 13ph03nix/master
Some improvements & Bug fixes
2 parents afc2b4c + 62d716b commit c68e5bd

File tree

22 files changed

+191
-117
lines changed

22 files changed

+191
-117
lines changed

CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,3 +332,14 @@ Cross-platform shell code generation
332332
* support http/https protocol autocorrect { _check() method in POCBase }
333333
* refactor --update
334334
* support version check { minimum_version_required() method }
335+
336+
# version 1.9.5
337+
----------------
338+
* refactor --ppt, optimize mosaic for url
339+
* optimize poc template
340+
* optimize pocsuite command default prompt message
341+
* adjust the default timeout to 10 seconds
342+
* adjust the default number of threads to 150
343+
* target url support cidr, user can use -p provide additional ports
344+
* support local mode, local mode do not need any targets, e.g. LPE
345+
* bug fixes

Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ RUN sh -c "$(wget -O- https://raw.githubusercontent.com/13ph03nix/zsh-in-docker/
3131
&& sudo apt-get clean -y \
3232
&& sudo rm -rf /var/lib/apt/lists/*
3333

34-
RUN sudo pip3 install --upgrade pip && sudo pip3 install --upgrade pocsuite3==1.9.4
34+
RUN sudo pip3 install --upgrade pip && sudo pip3 install --upgrade pocsuite3==1.9.5
3535

3636
WORKDIR /home/pocsuite3
3737
CMD ["zsh"]

docs/USAGE.md

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,11 @@ Target:
2626
At least one of these options has to be provided to define the target(s)
2727
2828
-u URL [URL ...], --url URL [URL ...]
29-
Target URL (e.g. "http://www.site.com/vuln.php?id=1")
29+
Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1")
3030
-f URL_FILE, --file URL_FILE
31-
Scan multiple targets given in a textual file
31+
Scan multiple targets given in a textual file (one per line)
32+
-p PORTS, --ports PORTS
33+
add additional port to each target (e.g. 8080,8443)
3234
-r POC [POC ...] Load PoC file from local or remote from seebug website
3335
-k POC_KEYWORD Filter PoC by keyword, e.g. ecshop
3436
-c CONFIGFILE Load options from a configuration INI file
@@ -50,8 +52,8 @@ Request:
5052
--proxy PROXY Use a proxy to connect to the target URL
5153
--proxy-cred PROXY_CRED
5254
Proxy authentication credentials (name:password)
53-
--timeout TIMEOUT Seconds to wait before timeout connection (default 30)
54-
--retry RETRY Time out retrials times
55+
--timeout TIMEOUT Seconds to wait before timeout connection (default 10)
56+
--retry RETRY Time out retrials times (default 0)
5557
--delay DELAY Delay between two request of one thread
5658
--headers HEADERS Extra headers (e.g. "key1: value1\nkey2: value2")
5759
@@ -119,7 +121,7 @@ Optimization:
119121
--plugins PLUGINS Load plugins to execute
120122
--pocs-path POCS_PATH
121123
User defined poc scripts path
122-
--threads THREADS Max number of concurrent network requests (default 1)
124+
--threads THREADS Max number of concurrent network requests (default 150)
123125
--batch BATCH Automatically choose defaut choice without asking
124126
--requires Check install_requires
125127
--quiet Activate quiet mode, working without logger
@@ -182,7 +184,7 @@ $ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --shell
182184

183185
**--threads THREADS**
184186

185-
Using multiple threads, the default number of threads is 1
187+
Using multiple threads, the default number of threads is 150
186188

187189
```
188190
$ pocsuite -r pocs/poc_example.py -f url.txt --verify --threads 10

manpages/poc-console.1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ is maintained at:
3131
.I https://github.com/knownsec/pocsuite3/blob/master/docs/USAGE.md
3232
.PP
3333
.SH VERSION
34-
This manual page documents pocsuite3 version 1.9.4
34+
This manual page documents pocsuite3 version 1.9.5
3535
.SH AUTHOR
3636
.br
3737
(c) 2014-2022 by Knownsec 404 Team

manpages/pocsuite.1

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,13 @@ Verbosity level: 0\-6 (default 1)
4545
At least one of these options has to be provided to define the target(s)
4646
.TP
4747
\fB\-u\fR URL [URL ...], \fB\-\-url\fR URL [URL ...]
48-
Target URL (e.g. "http://www.site.com/vuln.php?id=1")
48+
Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1")
4949
.TP
5050
\fB\-f\fR URL_FILE, \fB\-\-file\fR URL_FILE
51-
Scan multiple targets given in a textual file
51+
Scan multiple targets given in a textual file (one per line)
52+
.TP
53+
\fB\-p\fR PORTS, \fB\-\-ports\fR PORTS
54+
add additional port to each target (e.g. 8080,8443)
5255
.TP
5356
\fB\-r\fR POC [POC ...]
5457
Load POC file from local or remote from seebug website
@@ -93,10 +96,10 @@ Use a proxy to connect to the target URL
9396
Proxy authentication credentials (name:password)
9497
.TP
9598
\fB\-\-timeout\fR TIMEOUT
96-
Seconds to wait before timeout connection (default 30)
99+
Seconds to wait before timeout connection (default 10)
97100
.TP
98101
\fB\-\-retry\fR RETRY
99-
Time out retrials times
102+
Time out retrials times (default 0)
100103
.TP
101104
\fB\-\-delay\fR DELAY
102105
Delay between two request of one thread
@@ -204,7 +207,7 @@ Load plugins to execute
204207
User defined poc scripts path
205208
.TP
206209
\fB\-\-threads\fR THREADS
207-
Max number of concurrent network requests (default 1)
210+
Max number of concurrent network requests (default 150)
208211
.TP
209212
\fB\-\-batch\fR BATCH
210213
Automatically choose defalut choice without asking
@@ -257,7 +260,7 @@ Run poc with shell mode, if executed successfully, pocsuite will drop into inter
257260
\fI% pocsuite -r poc_example.py -u http://example.com/ --shell\fR
258261
.PP
259262
.br
260-
Using multiple threads, the default number of threads is 1.
263+
Using multiple threads, the default number of threads is 150.
261264
.PP
262265
.br
263266
\fI% pocsuite -r poc_example.py -u http://example.com/ --verify --threads 20\fR
@@ -277,7 +280,7 @@ is maintained at:
277280
.I https://github.com/knownsec/pocsuite3/blob/master/docs/USAGE.md
278281
.PP
279282
.SH VERSION
280-
This manual page documents pocsuite3 version 1.9.4
283+
This manual page documents pocsuite3 version 1.9.5
281284
.SH AUTHOR
282285
.br
283286
(c) 2014-2022 by Knownsec 404 Team

pocsuite.ini

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
[Target]
2-
; target url (e.g. "http://www.site.com/vuln.php?id=1")
2+
; target url/cidr (e.g. "http://www.site.com/vuln.php?id=1")
33
url = https://www.google.com
4-
; scan multiple targets given in a textual file
4+
; scan multiple targets given in a textual file (one per line)
55
url_file =
6+
; add additional port to each target (e.g. 8080,8443)
7+
ports =
68
; load poc file from local or remote from seebug website
79
poc =
810
; filter poc by keyword, e.g. cve-2021-22005
@@ -27,9 +29,9 @@ agent =
2729
proxy =
2830
; proxy authentication credentials (name:password)
2931
proxy_cred =
30-
; seconds to wait before timeout connection (default 30)
32+
; seconds to wait before timeout connection (default 10)
3133
timeout =
32-
; time out retrials times
34+
; time out retrials times (default 0)
3335
retry =
3436
; delay between two request of one thread
3537
delay =
@@ -101,8 +103,8 @@ dork_b64 = False
101103
plugins =
102104
; user defined poc scripts path
103105
pocs_path =
104-
; max number of concurrent network requests (default 1)
105-
threads = 1
106+
; max number of concurrent network requests (default 150)
107+
threads =
106108
; automatically choose defaut choice without asking
107109
batch =
108110
; check install_requires

pocsuite3/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
__title__ = 'pocsuite3'
2-
__version__ = '1.9.4'
2+
__version__ = '1.9.5'
33
__author__ = 'Knownsec 404 Team'
44
__author_email__ = '[email protected]'
55
__license__ = 'GPLv2'

pocsuite3/api/__init__.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
get_host_ipv6, single_time_warn_message)
55
from pocsuite3.lib.core.data import conf, kb, logger, paths
66
from pocsuite3.lib.core.datatype import AttribDict
7-
from pocsuite3.lib.core.common import OrderedSet, OrderedDict, mosaic
7+
from pocsuite3.lib.core.common import OrderedSet, OrderedDict, mosaic, urlparse
88
from pocsuite3.lib.core.enums import PLUGIN_TYPE, POC_CATEGORY, VUL_TYPE
99
from pocsuite3.lib.core.interpreter_option import (OptBool, OptDict, OptFloat,
1010
OptInteger, OptIP, OptItems,
@@ -39,7 +39,7 @@
3939
'DEFAULT_LISTENER_PORT', 'load_file_to_module', 'OrderedDict', 'OrderedSet',
4040
'load_string_to_module', 'single_time_warn_message', 'CEye',
4141
'Seebug', 'ZoomEye', 'Shodan', 'Fofa', 'Quake', 'Hunter', 'Censys',
42-
'PHTTPServer', 'REVERSE_PAYLOAD', 'get_listener_ip', 'mosaic',
42+
'PHTTPServer', 'REVERSE_PAYLOAD', 'get_listener_ip', 'mosaic', 'urlparse',
4343
'get_listener_port', 'get_results', 'init_pocsuite',
4444
'start_pocsuite', 'get_poc_options', 'crawl', 'OSShellcodes',
4545
'WebShell', 'OptDict', 'OptIP', 'OptPort', 'OptBool', 'OptInteger',

pocsuite3/lib/controller/controller.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,17 @@
1717

1818
def runtime_check():
1919
if not kb.registered_pocs:
20-
error_msg = "no PoC loaded, please check your PoC file"
21-
logger.error(error_msg)
22-
raise PocsuiteSystemException(error_msg)
20+
msg = "try 'pocsuite -h' or 'pocsuite --help' for more information"
21+
logger.warn(msg)
22+
raise PocsuiteSystemException(msg)
2323

2424

2525
def start():
2626
runtime_check()
2727
tasks_count = kb.task_queue.qsize()
2828
info_msg = "pocsusite got a total of {0} tasks".format(tasks_count)
2929
logger.info(info_msg)
30+
conf.threads = min(conf.threads, tasks_count)
3031
logger.debug("pocsuite will open {} threads".format(conf.threads))
3132

3233
try:

pocsuite3/lib/core/common.py

Lines changed: 54 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
import collections
1616
import chardet
1717
import requests
18-
import ipaddress
18+
import urllib
1919
from collections import OrderedDict
2020
from functools import wraps
2121
from ipaddress import ip_address, ip_network
@@ -51,6 +51,22 @@
5151
collectionsAbc = collections
5252

5353

54+
def urlparse(address):
55+
# https://stackoverflow.com/questions/50499273/urlparse-fails-with-simple-url
56+
try:
57+
ip = ip_address(address)
58+
if ip.version == 4:
59+
return urllib.parse.urlparse(f'tcp://{address}')
60+
elif ip.version == 6:
61+
return urllib.parse.urlparse(f'tcp://[{address}]')
62+
except ValueError:
63+
pass
64+
65+
if not re.search(r'^[A-Za-z0-9+.\-]+://', address):
66+
address = f'tcp://{address}'
67+
return urllib.parse.urlparse(address)
68+
69+
5470
def read_binary(filename):
5571
content = ''
5672
with open(filename, 'rb') as f:
@@ -242,7 +258,8 @@ def parse_target_url(url):
242258
ret = "[" + ret + "]"
243259

244260
if not re.search("^http[s]*://", ret, re.I) and not re.search("^ws[s]*://", ret, re.I) and '://' not in ret:
245-
if re.search(":443[/]*$", ret):
261+
port = urlparse(ret).port
262+
if port and str(port).endswith('443'):
246263
ret = "https://" + ret
247264
else:
248265
ret = "http://" + ret
@@ -343,11 +360,10 @@ def get_file_items(filename, comment_prefix='#', unicode_=True, lowercase=False,
343360
try:
344361
with open(filename, 'r') as f:
345362
for line in f.readlines():
346-
# xreadlines doesn't return unicode strings when codecs.open() is used
347-
if comment_prefix and line.find(comment_prefix) != -1:
348-
line = line[:line.find(comment_prefix)]
349-
350363
line = line.strip()
364+
# xreadlines doesn't return unicode strings when codecs.open() is used
365+
if comment_prefix and line.startswith(comment_prefix):
366+
continue
351367

352368
if not unicode_:
353369
try:
@@ -376,38 +392,41 @@ def get_file_items(filename, comment_prefix='#', unicode_=True, lowercase=False,
376392
return ret if not unique else ret.keys()
377393

378394

379-
def parse_target(address):
380-
target = None
381-
if is_domain_format(address) \
382-
or is_url_format(address) \
383-
or is_ip_address_with_port_format(address):
384-
target = address
395+
def parse_target(address, additional_ports=[]):
396+
# parse IPv4/IPv6 CIDR
397+
targets = OrderedSet()
398+
try:
399+
for ip in ip_network(address, strict=False).hosts():
385400

386-
elif is_ipv6_url_format(address):
387-
conf.ipv6 = True
388-
target = address
401+
if ip.version == 6:
402+
conf.ipv6 = True
389403

390-
elif is_ip_address_format(address):
391-
try:
392-
ip = ip_address(address)
393-
target = ip.exploded
394-
except ValueError:
395-
pass
396-
else:
397-
if is_ipv6_address_format(address):
404+
targets.add(str(ip))
405+
406+
for port in additional_ports:
407+
targets.add(f'[{ip}]:{port}' if conf.ipv6 else f'{ip}:{port}')
408+
409+
return targets
410+
411+
except ValueError:
412+
pass
413+
414+
# URL
415+
try:
416+
if ip_address(urlparse(address).hostname).version == 6:
398417
conf.ipv6 = True
399-
try:
400-
ip = ip_address(address)
401-
target = ip.exploded
402-
except ValueError:
403-
try:
404-
network = ip_network(address, strict=False)
405-
for host in network.hosts():
406-
target = host.exploded
407-
except ValueError:
408-
pass
418+
except ValueError:
419+
pass
409420

410-
return target
421+
targets.add(address)
422+
pr = urlparse(address)
423+
for port in additional_ports:
424+
netloc = f'[{pr.hostname}]:{port}' if conf.ipv6 else f'{pr.hostname}:{port}'
425+
t = pr._replace(netloc=netloc).geturl()
426+
if t.startswith('tcp://'):
427+
t = t.lstrip('tcp://')
428+
targets.add(t)
429+
return targets
411430

412431

413432
def single_time_log_message(message, level=logging.INFO, flag=None):
@@ -510,7 +529,7 @@ def get_host_ip(dst='8.8.8.8', check_private=True):
510529
finally:
511530
s.close()
512531

513-
if check_private and ipaddress.ip_address(ip).is_private:
532+
if check_private and ip_address(ip).is_private:
514533
logger.warn(
515534
f'your wan ip {mosaic(ip)} is a private ip, '
516535
'there may be some issues in the next stages of exploitation'

0 commit comments

Comments
 (0)