Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/tarunkant/Gopherus
This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
https://github.com/tarunkant/Gopherus
fastcgi github-rce gopher memcache mysql postgresql rce redis smtp ssrf zabbix
Last synced: about 1 month ago
JSON representation
This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
- Host: GitHub
- URL: https://github.com/tarunkant/Gopherus
- Owner: tarunkant
- License: mit
- Created: 2018-08-11T20:18:39.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2023-04-18T11:47:14.000Z (over 1 year ago)
- Last Synced: 2024-10-16T04:42:10.856Z (about 2 months ago)
- Topics: fastcgi, github-rce, gopher, memcache, mysql, postgresql, rce, redis, smtp, ssrf, zabbix
- Language: Python
- Homepage:
- Size: 280 KB
- Stars: 2,827
- Watchers: 22
- Forks: 369
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-bugbounty-tools - Gopherus - This tool generates gopher link for exploiting SSRF and gaining RCE in various servers (Exploitation / Server Side Request Forgery)
- WebHackersWeapons - Gopherus
- awesome-hacking-lists - tarunkant/Gopherus - This tool generates gopher link for exploiting SSRF and gaining RCE in various servers (Python)
- StarryDivineSky - tarunkant/Gopherus
README
# Gopherus
If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF (Server Side Request Forgery) and gaining RCE (Remote Code Execution). And also it will help you to get the Reverse shell on the victim server. And for more
information you can get a blog on the same [Blog on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/)
## About
This tool can generate payload for following:
1. MySQL (Port-3306)
2. PostgreSQL(Port-5432)
3. FastCGI (Port-9000)
4. Memcached (Port-11211)
- If stored data is getting De-serialized by:
- Python
- Ruby
- PHP
5. Redis (Port-6379)
6. Zabbix (Port-10050)
7. SMTP (Port-25)
## Installation
``` bash
chmod +x install.sh
```
```bash
sudo ./install.sh
```
## Usage
| Command | Description |
|--------------------------|--------------------------------|
| gopherus --help | Help |
| gopherus --exploit | Arguments can be : |
| | --exploit mysql |
| | --exploit postgresql |
| | --exploit fastcgi |
| | --exploit redis |
| | --exploit zabbix |
| | --exploit pymemcache |
| | --exploit rbmemcache |
| | --exploit phpmemcache |
| | --exploit dmpmemcache |
| | --exploit smtp |
## Examples
* MySQL: If the user is not protected with password you can dump his database and also you can put malicious files in his system.
```bash
gopherus --exploit mysql
```
It only asks username of the MySQL user and it will provide you gopher link.
* PostgreSQL: If the user is not protected with password you can dump his database and also you can put malicious files in his system.
```bash
gopherus --exploit postgresql
```
It only asks username of the Postgres user and database name then it will provide you gopher link.
* FastCGI: If port 9000 is open with no security then you can get RCE.
```bash
gopherus --exploit fastcgi
```
It only asks for a file which must be present in the victim system(preferable .php file), BTW we have default one.
* Redis: If redis port is open then we can overwrite the file in the system which is too dangerous.
So here is two things you can get:
a. Reverse Shell
b. PHP Shell
```bash
gopherus --exploit redis
```
* Zabbix: If port 10050 is open and `EnableRemoteCommands = 1` then you can run shell commands on the victim system.
```bash
gopherus --exploit zabbix
```
* Memcached: It is used for mainly storing serialized data, but when it comes to De-serialize these data then known vulnerability such as PHP De-serialization issue, Python-Pickle De-serialization issue, Ruby-Marshal De-serialization issue comes into picture which can lead to RCE.
So for each of them I created different scripts and also one script for dumping Memcached content:
```bash
gopherus --exploit pymemcache
```
```bash
gopherus --exploit rbmemcache
```
```bash
gopherus --exploit phpmemcache
```
```bash
gopherus --exploit dmpmemcache
```
* SMTP: If port 25 is open and we can access it then, we can send message to anyone as victim user, So this tool will generate gopher payload for sending mail.
```bash
gopherus --exploit smtp
```
## Screenshots
## Author
Tarunkant Gupta (SpyD3r)
* Website: https://spyclub.tech
* Email: [email protected]
* Twitter: https://twitter.com/TarunkantG
* Linkedin: https://linkedin.com/in/tarunkant-g-215830129/
## Reference
* http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt
* http://blog.safebuff.com/2016/07/03/SSRF-Tips/
* https://hackerone.com/reports/115748
* https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf
* https://www.exploit-db.com/exploits/42392/