adding the LDAP server, also adjusting flags and printouts, as well as readme

Author: guybarnhartmagen

README.md

@@ -28,37 +28,26 @@ The tool does not send any exploits to the vulnerable hosts, and is designed to
 In this example we run the tool against the `192.168.1.59/29` subnet (which contains a vulnerable server). 
 
 The tools does the following:
-1. Open a TCP server on the default address (the local IP at port 5555)
-2. Adds the flag `--ports=top100` to adjust the scan to include the top 100 ports
+1. Open a server on the default address (the local IP at port 5555)
+2. POssibly, add the flag `--ports=top100` to adjust the scan to include the top 100 ports
 3. The tool then tries all ports on each of the IP addresses in the subnet. If a remote server responds at one of the ports, the request is sent to it.
 4. If the server is vulnerable, a callback is made to our server (created on step 1) and the IP address of the remote is logged
-5. After all IP addresses in the subnet are scanned, the TCP server waits 10s for any lingering connections and closes down
+5. After all IP addresses in the subnet are scanned, the server waits for a default duration of 10s for any lingering connections and closes down
 6. The tools displays the summary of the connections made:
    1. Requests sent to responding remote servers (and the status code they responded with)
-   2. Any callback address made to our TCP server
+   2. Any callback address made to our server
 
 ## Important Note about Assumptions
 
 * If a callback happened, this means that a vulnerable server exists, the exploit worked and it initiated a callback. 
-However, the logged IP address might not belong to the actual vulnerable server (it might be behind a NAT or a proxy)
+However.
 * A good rule of thumb, if the callback IP address is not in the subnet scanned, the vulnerable server is behind a NAT 
 (e.g. a docker container responds with its own IP address, not the host running the docker)
 * The network traffic created by the tool might be classified as malicious by security products, or cause a lot of noise for monitoring services
-* The TCP server created by the tool assumes that it is open to receive inbound traffic. That means that opening a FW inbound rule on the host running the scan is needed.
-
-### What to do if the vulnerable server is behind a NAT?
-
-Let's assume that we are scannon `192.168.1.0/24` and a vulnerable application is running inside a docker container on the `192.168.1.2` host.
-
-The tool will scan that host, sending requests to `192.168.1.2` but the callback we get will be from '172.10.0.1' (which is the internal docker subnet)
-
-what we can do is minimize the search. we can get the list of all successful requests made by the scanner from the log, and the enumerate 
-through them, one by one, to see which one is triggering the callback.
-
-as this is a bit tedious, we plan on automating this if this becomes a real issue 
-
+* The server created by the tool assumes that it is open to receive inbound traffic. That means that opening a FW inbound rule on the host running the scan is needed.
 
 ## Basic usage
+
 Download the tool for your specific platform (Windows, Linux or Mac), to run the tool, make sure port 5555 on the host is available (or change it via configuration), 
 and specify the subnet to scan (it is possible to configure a separate server:port combination using the `--server` flag):
 
@@ -90,7 +79,7 @@ if you wish to disable the callback server, use `--noserver`
 * `--nocolor` provide output without color
 * `--ports` either top10 (default) or top100 (list of the 100 most common web ports)
 * `--noserver` only scan, do not use a local callback server
-* `--ports=slow` is currently disabled due to a bug, to be fixed in the next release
+* `--timeout=10` is setting the server shutdown timeout to 10 seconds
 
 ### Methods Used
 

cmd/ldapserver.go

@@ -15,10 +15,9 @@ import (
 
 var LDAPServer *Server
 
-func StartServer(ctx context.Context, serverUrl string) {
+func StartServer(ctx context.Context, serverUrl string, serverTimeout int) {
 	pterm.Info.Println("Server URL: " + serverUrl)
 	log.Info("Server URL: " + serverUrl)
-
 	listenUrl, err := url.Parse("//" + serverUrl)
 	if err != nil {
 		pterm.Error.Println("Failed to parse server url")
@@ -31,6 +30,7 @@ func StartServer(ctx context.Context, serverUrl string) {
 	log.Info("Starting LDAP server on ", listenUrl.Host)
 	LDAPServer = NewServer()
 	LDAPServer.sChan = make(chan string, 10000)
+	LDAPServer.timeout = time.Duration(serverTimeout) * time.Second
 
 	go LDAPServer.server.ListenAndServe(listenUrl.Host)
 }
@@ -52,8 +52,9 @@ func (s *Server) ReportIP(vulnerableServiceLocation string) {
 }
 
 type Server struct {
-	server *ldap.Server
-	sChan  chan string
+	server  *ldap.Server
+	sChan   chan string
+	timeout time.Duration
 }
 
 func (s *Server) handleBind(w ldap.ResponseWriter, m *ldap.Message) {
@@ -65,7 +66,7 @@ func (s *Server) handleBind(w ldap.ResponseWriter, m *ldap.Message) {
 func (s *Server) handleSearch(w ldap.ResponseWriter, m *ldap.Message) {
 	r := m.GetSearchRequest()
 
-	pterm.Info.Println("Got LDAP search request: " + r.BaseObject())
+	//pterm.Info.Println("Got LDAP search request: " + r.BaseObject())
 	log.Info("Got LDAP search request: " + r.BaseObject())
 
 	vulnerableLocation := strings.ReplaceAll(string(r.BaseObject()), "_", ":")
@@ -96,7 +97,8 @@ func NewServer() *Server {
 
 func (s *Server) Stop() {
 	spinnerSuccess, _ := pterm.DefaultSpinner.Start("Stopping LDAP server")
-	time.Sleep(10 * time.Second)
+	timeout := LDAPServer.timeout
+	time.Sleep(timeout)
 	s.server.Stop()
 	spinnerSuccess.Stop()
 }

cmd/scan.go

@@ -42,14 +42,14 @@ For example: log4jScanner scan --cidr "192.168.0.1/24`,
 
 		disableServer, err := cmd.Flags().GetBool("noserver")
 		if err != nil {
-			log.Error("server flag error")
+			pterm.Error.Println("server flag error")
 			cmd.Usage()
 			return
 		}
 		// TODO: add cancel context
 		cidr, err := cmd.Flags().GetString("cidr")
 		if err != nil {
-			log.Error("CIDR flag error")
+			pterm.Error.Println("CIDR flag error")
 			cmd.Usage()
 			return
 		}
@@ -63,14 +63,14 @@ For example: log4jScanner scan --cidr "192.168.0.1/24`,
 
 		ports, err := cmd.Flags().GetString("ports")
 		if err != nil || (ports != "top100" && ports != "slow" && ports != "top10") {
-			fmt.Println("error in ports flag")
+			pterm.Error.Println("error in ports flag")
 			cmd.Usage()
 			return
 		}
 
 		serverUrl, err := cmd.Flags().GetString("server")
 		if err != nil {
-			fmt.Println("Error in server flag")
+			pterm.Error.Println("Error in server flag")
 			cmd.Usage()
 			return
 		}
@@ -82,15 +82,22 @@ For example: log4jScanner scan --cidr "192.168.0.1/24`,
 
 		csvPath, err = cmd.Flags().GetString("csv-output")
 		if err != nil {
-			fmt.Println("Error in csv-output flag")
+			pterm.Error.Println("Error in csv-output flag")
 			cmd.Usage()
 			return
 		}
 		initCSV()
 
+		serverTimeout, err := cmd.Flags().GetInt("timeout")
+		if err != nil {
+			pterm.Error.Println("error in timeout flag")
+			cmd.Usage()
+			return
+		}
+
 		ctx := context.Background()
 		if !disableServer {
-			StartServer(ctx, serverUrl)
+			StartServer(ctx, serverUrl, serverTimeout)
 		}
 		ScanCIDR(ctx, cidr, ports, serverUrl)
 	},
@@ -111,6 +118,7 @@ func init() {
 		"Ports to scan. By default scans top 10 ports; 'top100' will scan the top 100 ports, 'slow' will scan all possible ports")
 	scanCmd.Flags().String("csv-output", "log4jScanner-results.csv",
 		"Set path (inc. filename) to save the CSV file containing the scan results (e.g /tmp/log4jScanner_results.csv). By default will be saved in the running folder.")
+	scanCmd.Flags().Int("timeout", 10, "Duration of time to wait before closing the callback server, in secods")
 	createPrivateIPBlocks()
 }
 
@@ -201,7 +209,7 @@ func PrintResults(resChan chan string) {
 		close(LDAPServer.sChan)
 		for suc := range LDAPServer.sChan {
 			fullSuc := strings.Split(suc, ",")
-			msg := fmt.Sprintf("Summary: Callback from %s", fullSuc[1])
+			msg := fmt.Sprintf("Summary: Callback from %s:%s", fullSuc[1], fullSuc[2])
 			pterm.Info.Println(msg)
 			log.Info(msg)
 		}

cmd/server.go

@@ -56,7 +56,7 @@ func init() {
 }
 
 func ServerStart(serverUrl string) {
-	StartServer(nil, serverUrl)
+	StartServer(nil, serverUrl, 10)
 	pterm.Info.Println("Press ctr-l-c to exit")
 	for {
 	}

go.mod

@@ -22,6 +22,7 @@ require (
 	github.com/lor00x/goldap v0.0.0-20180618054307-a546dffdd1a3 // indirect
 	github.com/magiconair/properties v1.8.5 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/maykonlf/semver-cli v1.0.2 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect