Skip to content

Commit ce4efb0

Browse files
404tk404tk
committed
feat(aliyun):support DBManagement for alibaba
1 parent 03b9f0e commit ce4efb0

34 files changed

Lines changed: 283 additions & 104 deletions

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Cloud Penetration Testing Toolkit
55

66
| Providers | Payload | Supported |
77
| :-------------------------: | :-----------------------------------------: | :----------------------------------------------------------: |
8-
| Alibaba Cloud | cloudlist<br/>backdoor-user<br/>bucket-dump<br/>event-dump<br/>exec-command | ECS (Elastic Compute Service)<br/>OSS (Object Storage Service)<br/>RAM (Resource Access Management)<br/>RDS (Relational Database Service)<br/>SMS (Short Message Service)<br/>AliDNS |
8+
| Alibaba Cloud | cloudlist<br/>backdoor-user<br/>bucket-dump<br/>event-dump<br/>exec-command<br/>database-account | ECS (Elastic Compute Service)<br/>OSS (Object Storage Service)<br/>RAM (Resource Access Management)<br/>RDS (Relational Database Service)<br/>SMS (Short Message Service)<br/>AliDNS |
99
| Tencent Cloud | cloudlist<br/>backdoor-user<br/>exec-command | CVM (Cloud Virtual Machine)<br/>Lighthouse<br/>COS (Cloud Object Storage)<br/>CAM (Cloud Access Management)<br/>CDB (Cloud DataBase)<br/>DNSPod |
1010
| Huawei Cloud | cloudlist<br/>backdoor-user | ECS (Elastic Cloud Server)<br/>OBS (Object Storage Service)<br/>IAM (Identity and Access Management)<br/>RDS (Relational Database Service) |
1111
| Microsoft Azure | cloudlist | Virtual Machines<br/>Blob Storage |

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/404tk/cloudtoolkit
33
go 1.18
44

55
require (
6-
github.com/404tk/table v0.0.3
6+
github.com/404tk/table v0.0.4
77
github.com/Azure/azure-sdk-for-go v67.1.0+incompatible
88
github.com/Azure/go-autorest/autorest v0.11.28
99
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11

‎pkg/providers/alibaba/alibaba.go‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ func New(options schema.Options) (*Provider, error) {
4646
cred := credentials.NewStsTokenCredential(accessKey, secretKey, token)
4747

4848
payload, _ := options.GetMetadata(utils.Payload)
49-
if payload == "cloudlist" || payload == "sessions" {
49+
if payload == "cloudlist" {
5050
// Get current username
5151
stsclient, err := sts.NewClientWithOptions("cn-hangzhou", sdk.NewConfig(), cred)
5252
request := sts.CreateGetCallerIdentityRequest()
@@ -168,7 +168,7 @@ func (p *Provider) BucketDump(ctx context.Context, action, bucketname string) {
168168
}
169169
}
170170

171-
func (p *Provider) EventDump(action, sourceIp string) {
171+
func (p *Provider) EventDump(action, args string) {
172172
d := _sas.Driver{Cred: p.cred}
173173
switch action {
174174
case "dump":
@@ -189,7 +189,7 @@ func (p *Provider) EventDump(action, sourceIp string) {
189189
logger.Info(msg)
190190
}
191191
case "whitelist":
192-
d.HandleEvents(sourceIp) // sourceIp here means SecurityEventIds
192+
d.HandleEvents(args) // args here means SecurityEventIds
193193
default:
194194
logger.Error("Please set metadata like \"dump all\"")
195195
}
@@ -219,3 +219,30 @@ func (p *Provider) ExecuteCloudVMCommand(instanceId, cmd string) {
219219
fmt.Println(output)
220220
}
221221
}
222+
223+
func (p *Provider) DBManagement(action, args string) {
224+
r := &_rds.Driver{Cred: p.cred, Region: p.region}
225+
switch action {
226+
case "useradd":
227+
var region, dbname string
228+
//var instance schema.Database
229+
for _, db := range _rds.CacheDBList {
230+
if db.InstanceId == args {
231+
region = db.Region
232+
dbname = db.DBNames
233+
//instance = db
234+
break
235+
}
236+
}
237+
if region == "" {
238+
logger.Error("Run cloudlist first")
239+
return
240+
}
241+
r.Region = region
242+
r.CreateAccount(args, dbname)
243+
case "userdel":
244+
r.DeleteAccount(args)
245+
default:
246+
logger.Error("`instanceId` is missing")
247+
}
248+
}

‎pkg/providers/alibaba/ram/roledel.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func (d *Driver) DelRole() {
1919
logger.Error(fmt.Sprintf("Delete role %s failed: %s", d.RoleName, err.Error()))
2020
return
2121
}
22-
logger.Info("Done.")
22+
logger.Warning(d.RoleName + " role delete completed.")
2323
}
2424

2525
func detachPolicyFromRole(client *ram.Client, roleName string) error {

‎pkg/providers/alibaba/ram/userdel.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ func (d *Driver) DelUser() {
2222
logger.Error(fmt.Sprintf("Delete user %s failed: %s", d.UserName, err))
2323
return
2424
}
25-
logger.Info("Done.")
25+
logger.Warning(d.UserName + " user delete completed.")
2626
}
2727

2828
func detachPolicyFromUser(client *ram.Client, userName string) error {

‎pkg/providers/alibaba/ram/users.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ func (d *Driver) GetRamUser(ctx context.Context) ([]schema.User, error) {
5858
UserName: user.UserName,
5959
UserId: user.UserId,
6060
}
61+
date, _ := time.Parse(time.RFC3339, user.CreateDate)
62+
_user.CreateTime = date.String()
6163

6264
request := ram.CreateGetLoginProfileRequest()
6365
request.Scheme = "https"
@@ -73,10 +75,6 @@ func (d *Driver) GetRamUser(ctx context.Context) ([]schema.User, error) {
7375
lastLoginDate, _ := time.Parse(time.RFC3339, getUserResponse.User.LastLoginDate)
7476
_user.LastLogin = lastLoginDate.String()
7577
}
76-
if err == nil && getUserResponse.User.CreateDate != "" {
77-
date, _ := time.Parse(time.RFC3339, getUserResponse.User.CreateDate)
78-
_user.CreateTime = date.String()
79-
}
8078
}
8179

8280
_user.Policies = listPoliciesForUser(client, _user.UserName)

‎pkg/providers/alibaba/rds/accounts.go‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
package rds
2+
3+
import (
4+
"fmt"
5+
"strings"
6+
7+
"github.com/404tk/cloudtoolkit/utils"
8+
"github.com/404tk/cloudtoolkit/utils/logger"
9+
"github.com/aliyun/alibaba-cloud-sdk-go/services/rds"
10+
)
11+
12+
func (d *Driver) CreateAccount(instanceId, dbname string) bool {
13+
client, err := d.NewClient()
14+
if err != nil {
15+
logger.Error(err)
16+
return false
17+
}
18+
account := strings.Split(utils.DBAccount, ":")
19+
request := rds.CreateCreateAccountRequest()
20+
request.Scheme = "https"
21+
request.DBInstanceId = instanceId
22+
request.AccountName = account[0]
23+
request.AccountPassword = account[1]
24+
request.AccountType = "Normal"
25+
_, err = client.CreateAccount(request)
26+
if err != nil {
27+
logger.Error(err)
28+
return false
29+
}
30+
err = grantAccountPrivilege(client, instanceId, account[0], dbname)
31+
if err != nil {
32+
logger.Error(err)
33+
return false
34+
}
35+
fmt.Printf("\n%-10s\t%-10s\t%-60s\n", "Username", "Password", "Privilege")
36+
fmt.Printf("%-10s\t%-10s\t%-60s\n", "--------", "--------", "---------")
37+
fmt.Printf("%-10s\t%-10s\t%-60s\n\n",
38+
account[0], account[1], "ReadOnly")
39+
return true
40+
}
41+
42+
func (d *Driver) DeleteAccount(instanceId string) {
43+
client, err := d.NewClient()
44+
if err != nil {
45+
logger.Error(err)
46+
return
47+
}
48+
account := strings.Split(utils.DBAccount, ":")
49+
request := rds.CreateDeleteAccountRequest()
50+
request.Scheme = "https"
51+
request.DBInstanceId = instanceId
52+
request.AccountName = account[0]
53+
resp, err := client.DeleteAccount(request)
54+
if err != nil {
55+
logger.Error(err)
56+
return
57+
}
58+
if resp.IsSuccess() {
59+
logger.Warning(account[0] + " user delete completed.")
60+
}
61+
}
62+
63+
func grantAccountPrivilege(client *rds.Client, instanceId, uname, dbname string) error {
64+
request := rds.CreateGrantAccountPrivilegeRequest()
65+
request.Scheme = "https"
66+
request.DBInstanceId = instanceId
67+
request.AccountName = uname
68+
request.DBName = dbname
69+
request.AccountPrivilege = "ReadOnly"
70+
_, err := client.GrantAccountPrivilege(request)
71+
return err
72+
}
73+
74+
/*
75+
func describeAccounts(instanceId string) {
76+
request := rds.CreateDescribeAccountsRequest()
77+
request.Scheme = "https"
78+
request.DBInstanceId = instanceId
79+
//response, err := client.DescribeAccounts(request)
80+
//AccountStatus
81+
//AccountDescription
82+
//AccountType
83+
//AccountName
84+
//DatabasePrivileges
85+
}
86+
*/

‎pkg/providers/alibaba/rds/databases.go‎

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package rds
33
import (
44
"context"
55
"math"
6+
"strings"
67

78
"github.com/404tk/cloudtoolkit/pkg/schema"
89
"github.com/404tk/cloudtoolkit/utils/logger"
@@ -17,6 +18,16 @@ type Driver struct {
1718
Region string
1819
}
1920

21+
var CacheDBList []schema.Database
22+
23+
func (d *Driver) NewClient() (*rds.Client, error) {
24+
region := d.Region
25+
if region == "all" {
26+
region = "cn-hangzhou"
27+
}
28+
return rds.NewClientWithOptions(region, sdk.NewConfig(), d.Cred)
29+
}
30+
2031
func (d *Driver) GetDatabases(ctx context.Context) ([]schema.Database, error) {
2132
list := schema.NewResources().Databases
2233
select {
@@ -25,11 +36,8 @@ func (d *Driver) GetDatabases(ctx context.Context) ([]schema.Database, error) {
2536
default:
2637
logger.Info("Start enumerating RDS ...")
2738
}
28-
region := d.Region
29-
if region == "all" {
30-
region = "cn-hangzhou"
31-
}
32-
client, err := rds.NewClientWithOptions(region, sdk.NewConfig(), d.Cred)
39+
defer func() { CacheDBList = list }()
40+
client, err := d.NewClient()
3341
if err != nil {
3442
return list, err
3543
}
@@ -46,15 +54,17 @@ func (d *Driver) GetDatabases(ctx context.Context) ([]schema.Database, error) {
4654
pageCount := int(math.Ceil(float64(response.TotalRecordCount) / 100))
4755
for _, dbInstance := range response.Items.DBInstance {
4856
_db := schema.Database{
49-
DBInstanceId: dbInstance.DBInstanceId,
57+
InstanceId: dbInstance.DBInstanceId,
5058
Engine: dbInstance.Engine,
5159
EngineVersion: dbInstance.EngineVersion,
5260
Region: dbInstance.RegionId,
61+
Address: dbInstance.ConnectionString,
62+
NetworkType: dbInstance.InstanceNetworkType,
5363
}
54-
if dbInstance.DBInstanceNetType == "Internet" {
55-
_db.Address = dbInstance.ConnectionString
56-
}
57-
64+
// if dbInstance.DBInstanceNetType == "Internet" {
65+
// _db.Address = dbInstance.ConnectionString
66+
// }
67+
_db.DBNames = describeDatabases(client, dbInstance.DBInstanceId)
5868
list = append(list, _db)
5969
}
6070
if page == pageCount || pageCount == 0 {
@@ -70,3 +80,22 @@ func (d *Driver) GetDatabases(ctx context.Context) ([]schema.Database, error) {
7080
}
7181
return list, nil
7282
}
83+
84+
func describeDatabases(client *rds.Client, instanceId string) string {
85+
request := rds.CreateDescribeDatabasesRequest()
86+
request.Scheme = "https"
87+
request.DBInstanceId = instanceId
88+
request.PageSize = requests.NewInteger(30)
89+
request.PageNumber = requests.NewInteger(1)
90+
request.DBStatus = "Running"
91+
response, err := client.DescribeDatabases(request)
92+
if err != nil {
93+
logger.Error(err)
94+
return ""
95+
}
96+
dbs := []string{}
97+
for _, db := range response.Databases.Database {
98+
dbs = append(dbs, db.DBName)
99+
}
100+
return strings.Join(dbs, ",")
101+
}

‎pkg/providers/aws/aws.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ func New(options schema.Options) (*Provider, error) {
5555
}
5656

5757
payload, _ := options.GetMetadata(utils.Payload)
58-
if payload == "cloudlist" || payload == "sessions" {
58+
if payload == "cloudlist" {
5959
// Get current username
6060
stsclient := sts.New(session)
6161
resp, err := stsclient.GetCallerIdentity(&sts.GetCallerIdentityInput{})
@@ -156,3 +156,5 @@ func (p *Provider) BucketDump(ctx context.Context, action, bucketname string) {
156156
func (p *Provider) EventDump(action, sourceIp string) {}
157157

158158
func (p *Provider) ExecuteCloudVMCommand(instanceId, cmd string) {}
159+
160+
func (p *Provider) DBManagement(action, args string) {}

‎pkg/providers/azure/azure.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func New(options schema.Options) (*Provider, error) {
5656
}
5757
for _, v := range resp.Values() {
5858
payload, _ := options.GetMetadata(utils.Payload)
59-
if payload == "cloudlist" || payload == "sessions" {
59+
if payload == "cloudlist" {
6060
logger.Warning(fmt.Sprintf("Found Subscription: %s(%s)", *v.DisplayName, *v.SubscriptionID))
6161
cache.Cfg.CredInsert(*v.DisplayName, options)
6262
}
@@ -117,3 +117,5 @@ func (p *Provider) BucketDump(ctx context.Context, action, bucketname string) {
117117
func (p *Provider) EventDump(action, sourceIp string) {}
118118

119119
func (p *Provider) ExecuteCloudVMCommand(instanceId, cmd string) {}
120+
121+
func (p *Provider) DBManagement(action, args string) {}

0 commit comments

Comments
 (0)