cassandra-brute.nse – Performs brute force …

Posted on Posted in Nmap - Script

Performs brute force password auditing against the Cassandra database.

For more information about Cassandra, see: http://cassandra.apache.org/

local bin = require "bin"
local brute = require "brute"
local creds = require "creds"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local cassandra = require "cassandra"

description = [[
Performs brute force password auditing against the Cassandra database.

For more information about Cassandra, see:
http://cassandra.apache.org/
]]

---
-- @usage
-- nmap -p 9160 <ip> --script=cassandra-brute
--
-- @output
-- PORT     STATE SERVICE VERSION
-- 9160/tcp open  apani1?
-- | cassandra-brute: 
-- |   Accounts
-- |     admin:lover - Valid credentials
-- |   Statistics
-- |_    Performed 4581 guesses in 1 seconds, average tps: 4581
--

author = "Vlatko Kosturjak"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"intrusive", "brute"}

portrule = shortport.port_or_service({9160}, {"cassandra"})

Driver = {
  
  new = function(self, host, port, options)
    local o = { host = host, port = port, socket = nmap.new_socket() }
    setmetatable(o, self)
    self.__index = self
    return o
  end,
  
  connect = function(self)
    return self.socket:connect(self.host, self.port)
  end,

        -- bit faster login function than in cassandra library (no protocol error checks)
  login = function(self, username, password)
    local response, magic, size, _
    local loginstr = cassandra.loginstr (username, password)

    local status, err = self.socket:send(bin.pack(">I",string.len(loginstr)))
                local combo = username..":"..password
    if ( not(status) ) then
      local err = brute.Error:new( "couldn't send length:"..combo )
      err:setAbort( true )
      return false, err
    end

    status, err = self.socket:send(loginstr)
    if ( not(status) ) then
      local err = brute.Error:new( "couldn't send login packet: "..combo )
      err:setAbort( true )
      return false, err
    end

    status, response = self.socket:receive_bytes(22)
    if ( not(status) ) then
      local err = brute.Error:new( "couldn't receive login reply size: "..combo )
      err:setAbort( true )
      return false, err
    end
      
    _, size = bin.unpack(">I", response, 1)

                magic = string.sub(response,18,22)

    if (magic == cassandra.LOGINSUCC) then
                        stdnse.print_debug(3, "Account SUCCESS: "..combo)
      return true, brute.Account:new(username, password, creds.State.VALID)
    elseif (magic == cassandra.LOGINFAIL) then
                        stdnse.print_debug(3,"Account FAIL: "..combo)
      return false, brute.Error:new( "Incorrect password" )	
                elseif (magic == cassandra.LOGINACC) then
                        stdnse.print_debug(3, "Account VALID, but wrong password: "..combo)
                        return false, brute.Error:new( "Good user, bad password" )	
    else
                        stdnse.print_debug(3, "Unrecognized packet for "..combo)
                        stdnse.print_debug(3, "packet hex: %s", stdnse.tohex(response) )
                        stdnse.print_debug(3, "size packet hex: %s", stdnse.tohex(size) )
                        stdnse.print_debug(3, "magic packet hex: %s", stdnse.tohex(magic) )
      local err = brute.Error:new( response )
      err:setRetry( true )
      return false, err
    end	
  end,
  
  disconnect = function(self)
    return self.socket:close()
  end,
  
}

local function noAuth(host, port)
  local socket = nmap.new_socket()
  local status, result = socket:connect(host, port)

        local stat,err = cassandra.login (socket,"default","")
        socket:close()
        if (stat) then
          return true
        else
          return false
        end
end

action = function(host, port)

  if ( noAuth(host, port) ) then
    return "Any username and password would do, 'default' was used to test."
  end

  local engine = brute.Engine:new(Driver, host, port )
  
  engine.options.script_name = SCRIPT_NAME
  engine.options.firstonly = true
  local status, result = engine:start()

  return result
end
Facebooktwittergoogle_plus