archive/revsuit
1
0
Fork 0
mirror of https://github.com/Li4n0/revsuit.git synced 2026-09-26 16:41:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

release revsuit vBeta0.1.0 (#15)

Browse Source 
Co-authored-by: E99p1ant <[email protected]>
This commit is contained in:
Li4n0
2021-05-16 12:11:35 +08:00
committed by GitHub
co-authored by E99p1ant
parent b39ee101f9
commit 5b63e90390
98 changed files with 2357 additions and 623 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/mysql/mysql.go
+40 -11
View File
@@ -3,7 +3,6 @@ package mysql
import (
"encoding/base64"
"fmt"
"os"
"regexp"
"strings"
"sync"
@@ -13,6 +12,7 @@ import (
"github.com/li4n0/revsuit/internal/file"
"github.com/li4n0/revsuit/internal/qqwry"
"github.com/li4n0/revsuit/pkg/mysql/vmysql"
"github.com/pkg/errors"
log "unknwon.dev/clog/v2"
"vitess.io/vitess/go/sqltypes"
)
@@ -25,8 +25,9 @@ var (
type Server struct {
Config
rules []*Rule
rulesLock sync.RWMutex
rules []*Rule
rulesLock sync.RWMutex
livingLock sync.Mutex
listener *vmysql.Listener
Handler vmysql.Handler
@@ -36,7 +37,7 @@ type Server struct {
func GetServer() *Server {
once.Do(func() {
server = &Server{rulesLock: sync.RWMutex{}}
server = &Server{rulesLock: sync.RWMutex{}, livingLock: sync.Mutex{}}
})
return server
}
@@ -51,7 +52,7 @@ func (s *Server) updateRules() error {
db := database.DB.Model(new(Rule))
defer s.rulesLock.Unlock()
s.rulesLock.Lock()
return db.Order("rank desc").Find(&s.rules).Error
return errors.Wrap(db.Order("rank desc").Find(&s.rules).Error, "MySQL update rules error")
}
// NewConnection is part of the mysql.Handler interface.
@@ -146,14 +147,14 @@ func (s *Server) ConnectionClosed(c *vmysql.Conn) {
if _rule.PushToClient {
if flagGroup != "" {
var count int64
database.DB.Where("rule_name=? and domain like ?", _rule.Name, "%"+flagGroup+"%").Model(&Record{}).Count(&count)
database.DB.Where("rule_name=? and (user like ? or schema like ?)", _rule.Name, "%"+flagGroup+"%", "%"+flagGroup+"%").Model(&Record{}).Count(&count)
if count <= 1 {
r.PushToClient()
log.Trace("MySQL record[id%d] has been put to client message queue", r.ID)
log.Trace("MySQL record[id:%d, flagGroup:%s] has been put to client message queue", r.ID, flagGroup)
}
} else {
r.PushToClient()
log.Trace("MySQL record[id%d] has been put to client message queue", r.ID)
log.Trace("MySQL record[id:%d, flag:%s] has been put to client message queue", r.ID, flag)
}
}
@@ -266,9 +267,31 @@ func (s *Server) WarningCount(c *vmysql.Conn) uint16 {
return 0
}
func (s *Server) Stop() {
log.Info("MySQL Server is stopping...")
s.Enable = false
s.livingLock.Unlock()
}
func (s *Server) Restart() {
s.Enable = false
time.Sleep(time.Second * 2)
go s.Run()
}
func (s *Server) Run() {
s.Enable = true
s.livingLock.Lock()
defer func() {
if s.Enable {
log.Error("MySQL Server exited unexpectedly")
}
s.Enable = false
s.livingLock.Unlock()
}()
if err := s.updateRules(); err != nil {
log.Fatal(err.Error())
log.Error(err.Error())
return
}
s.Handler = s
@@ -279,9 +302,15 @@ func (s *Server) Run() {
log.Info("Starting MySQL Server at %s", s.Addr)
s.listener, err = vmysql.NewListener("tcp", s.Addr, authServer, s, s.VersionString, 0, 0)
if err != nil {
log.Warn("New MySQL Server failed: %s", err)
os.Exit(-1)
log.Error("New MySQL Server failed: %s", err)
}
go func() {
if !s.Enable {
s.listener.Close()
}
}()
s.listener.Accept()
}
pkg/mysql/record.go
+13 -4
View File
@@ -55,12 +55,21 @@ func ListRecords(c *gin.Context) {
res []Record
count int64
order = c.Query("order")
pageSize int
)
if c.Query("pageSize") == "" {
pageSize = 10
} else if n, err := strconv.Atoi(c.Query("pageSize")); err == nil {
if n <= 0 || n > 100 {
pageSize = 10
}
}
if err := c.ShouldBind(&mysqlRecord); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"result": nil,
})
}
@@ -93,7 +102,7 @@ func ListRecords(c *gin.Context) {
if err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"result": nil,
})
return
@@ -103,10 +112,10 @@ func ListRecords(c *gin.Context) {
order = "desc"
}
if err := db.Preload("Files").Order("id" + " " + order).Count(&count).Offset((page - 1) * 10).Limit(10).Find(&res).Error; err != nil {
if err := db.Preload("Files").Order("id" + " " + order).Count(&count).Offset((page - 1) * pageSize).Limit(pageSize).Find(&res).Error; err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
pkg/mysql/rule.go
+27 -18
View File
@@ -11,9 +11,9 @@ import (
)
type Rule struct {
rule.BaseRule
rule.BaseRule `yaml:",inline"`
Files string `form:"files" json:"files"`
ExploitJdbcClient bool `gorm:"exploit_jdbc_client" form:"exploit_jdbc_client" json:"exploit_jdbc_client"`
ExploitJdbcClient bool `gorm:"exploit_jdbc_client" form:"exploit_jdbc_client" json:"exploit_jdbc_client" yaml:"exploit_jdbc_client"`
Payloads database.MapField `json:"payloads" form:"payloads"`
}
@@ -21,7 +21,7 @@ func (Rule) TableName() string {
return "mysql_rules"
}
// Create or update the mysql rule in database and ruleSet
// CreateOrUpdate creates or updates the mysql rule in database and ruleSet
func (r *Rule) CreateOrUpdate() (err error) {
db := database.DB.Model(r)
err = db.Clauses(clause.OnConflict{
@@ -45,7 +45,7 @@ func (r *Rule) CreateOrUpdate() (err error) {
return err
}
// Delete the mysql rule in database and ruleSet
// Delete deletes the mysql rule in database and ruleSet
func (r *Rule) Delete() (err error) {
db := database.DB.Model(r)
err = db.Delete(r).Error
@@ -56,19 +56,28 @@ func (r *Rule) Delete() (err error) {
return err
}
// List all mysql rules those satisfy the filter
// ListRules lists all mysql rules those satisfy the filter
func ListRules(c *gin.Context) {
var (
mysqlRule Rule
res []Rule
count int64
order = c.Query("order")
pageSize int
)
if c.Query("pageSize") == "" {
pageSize = 10
} else if n, err := strconv.Atoi(c.Query("pageSize")); err == nil {
if n <= 0 || n > 100 {
pageSize = 10
}
}
if err := c.ShouldBind(&mysqlRule); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"result": nil,
})
return
@@ -84,7 +93,7 @@ func ListRules(c *gin.Context) {
if err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"result": nil,
})
return
@@ -94,10 +103,10 @@ func ListRules(c *gin.Context) {
order = "desc"
}
if err := db.Order("rank desc").Order("id" + " " + order).Count(&count).Offset((page - 1) * 10).Limit(10).Find(&res).Error; err != nil {
if err := db.Order("rank desc").Order("id" + " " + order).Count(&count).Offset((page - 1) * pageSize).Limit(pageSize).Find(&res).Error; err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
@@ -110,7 +119,7 @@ func ListRules(c *gin.Context) {
})
}
// Create or update mysql rule from user submit
// UpsertRules create or update mysql rule from user submit
func UpsertRules(c *gin.Context) {
var (
mysqlRule Rule
@@ -120,7 +129,7 @@ func UpsertRules(c *gin.Context) {
if err := c.ShouldBind(&mysqlRule); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
@@ -133,16 +142,16 @@ func UpsertRules(c *gin.Context) {
if err := mysqlRule.CreateOrUpdate(); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
}
if update {
log.Trace("MySQL rule[id%d] has been updated", mysqlRule.ID)
log.Trace("MySQL rule[id:%d] has been updated", mysqlRule.ID)
} else {
log.Trace("MySQL rule[id%d] has been created", mysqlRule.ID)
log.Trace("MySQL rule[id:%d] has been created", mysqlRule.ID)
}
c.JSON(200, gin.H{
@@ -152,14 +161,14 @@ func UpsertRules(c *gin.Context) {
})
}
// Delete mysql rule from user submit
// DeleteRules Delete mysql rule from user submit
func DeleteRules(c *gin.Context) {
var mysqlRule Rule
if err := c.ShouldBind(&mysqlRule); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
@@ -168,13 +177,13 @@ func DeleteRules(c *gin.Context) {
if err := mysqlRule.Delete(); err != nil {
c.JSON(400, gin.H{
"status": "failed",
"error": err,
"error": err.Error(),
"data": nil,
})
return
}
log.Trace("MySQL rule[id%d] has been deleted", mysqlRule.ID)
log.Trace("MySQL rule[id:%d] has been deleted", mysqlRule.ID)
c.JSON(200, gin.H{
"status": "succeed",
pkg/mysql/vmysql/server.go
+12 -12
View File
@@ -259,7 +259,7 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
// Catch panics, and close the connection in any case.
defer func() {
if x := recover(); x != nil {
log.Warn("mysql_server caught panic:\n%v\n%s", x, tb.Stack(4))
log.Trace("mysql_server caught panic:\n%v\n%s", x, tb.Stack(4))
}
// We call flush here in case there's a premature return after
// startWriterBuffering is called
@@ -275,7 +275,7 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
salt, err := c.writeHandshakeV10(l.ServerVersion, l.authServer, l.TLSConfig != nil)
if err != nil {
if err != io.EOF {
log.Warn("Cannot send HandshakeV10 packet to %s: %v", c, err)
log.Trace("Cannot send HandshakeV10 packet to %s: %v", c, err)
}
return
}
@@ -286,13 +286,13 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
if err != nil {
// Don't log EOF errors. They cause too much spam, same as main read loop.
if err != io.EOF {
log.Warn("Cannot read client handshake response from %s: %v", c, err)
log.Trace("Cannot read client handshake response from %s: %v", c, err)
}
return
}
user, authMethod, authResponse, err := l.parseClientHandshakePacket(c, true, response)
if err != nil {
log.Warn("Cannot parse client handshake response from %s: %v", c, err)
log.Trace("Cannot parse client handshake response from %s: %v", c, err)
return
}
@@ -305,14 +305,14 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
// SSL was enabled. We need to re-read the auth packet.
response, err = c.readEphemeralPacket()
if err != nil {
log.Warn("Cannot read post-SSL client handshake response from %s: %v", c, err)
log.Trace("Cannot read post-SSL client handshake response from %s: %v", c, err)
return
}
// Returns copies of the data, so we can recycle the buffer.
user, authMethod, authResponse, err = l.parseClientHandshakePacket(c, false, response)
if err != nil {
log.Warn("Cannot parse post-SSL client handshake response from %s: %v", c, err)
log.Trace("Cannot parse post-SSL client handshake response from %s: %v", c, err)
return
}
c.RecycleReadPacket()
@@ -366,13 +366,13 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
data := make([]byte, 21) //nolint:ineffassign,staticcheck // SA4006 This line is required because the binary protocol requires padding with 0
data = append(salt, byte(0x00))
if err := c.writeAuthSwitchRequest(MysqlNativePassword, data); err != nil {
log.Warn("Error writing auth switch packet for %s: %v", c, err)
log.Trace("Error writing auth switch packet for %s: %v", c, err)
return
}
response, err := c.readEphemeralPacket()
if err != nil {
log.Warn("Error reading auth switch response for %s: %v", c, err)
log.Trace("Error reading auth switch response for %s: %v", c, err)
return
}
c.RecycleReadPacket()
@@ -402,7 +402,7 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
data = authServerDialogSwitchData()
}
if err := c.writeAuthSwitchRequest(authServerMethod, data); err != nil {
log.Warn("Error writing auth switch packet for %s: %v", c, err)
log.Trace("Error writing auth switch packet for %s: %v", c, err)
return
}
@@ -424,7 +424,7 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
// Negotiation worked, send OK packet.
if err := c.writeOKPacket(0, 0, c.StatusFlags, 0); err != nil {
log.Warn("Cannot write OK packet to %s: %v", c, err)
log.Trace("Cannot write OK packet to %s: %v", c, err)
return
}
@@ -435,7 +435,7 @@ func (l *Listener) handle(conn net.Conn, connectionID uint32, acceptTime time.Ti
connectTime := time.Since(acceptTime)
if l.SlowConnectWarnThreshold != 0 && connectTime > l.SlowConnectWarnThreshold {
connSlow.Add(1)
log.Warn("Slow connection from %s: %v", c, connectTime)
log.Trace("Slow connection from %s: %v", c, connectTime)
}
for {
@@ -692,7 +692,7 @@ func (l *Listener) parseClientHandshakePacket(c *Conn, firstTime bool, data []by
// Decode connection attributes send by the client
if clientFlags&CapabilityClientConnAttr != 0 {
if connAttrs, _, err := parseConnAttrs(data, pos); err != nil {
log.Warn("Decode connection attributes send by the client: %v", err)
log.Trace("Decode connection attributes send by the client: %v", err)
} else {
c.ConnAttrs = connAttrs
}