Skip to content

Commit 03b9f0e

Browse files
404tk404tk
committed
feat(tat):support ExecuteCloudVMCommand for tencent
1 parent af6efcc commit 03b9f0e

File tree

7 files changed

+143
-9
lines changed

7 files changed

+143
-9
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Cloud Penetration Testing Toolkit
66
| Providers | Payload | Supported |
77
| :-------------------------: | :-----------------------------------------: | :----------------------------------------------------------: |
88
| Alibaba Cloud | cloudlist<br/>backdoor-user<br/>bucket-dump<br/>event-dump<br/>exec-command | ECS (Elastic Compute Service)<br/>OSS (Object Storage Service)<br/>RAM (Resource Access Management)<br/>RDS (Relational Database Service)<br/>SMS (Short Message Service)<br/>AliDNS |
9-
| Tencent Cloud | cloudlist<br/>backdoor-user | CVM (Cloud Virtual Machine)<br/>Lighthouse<br/>COS (Cloud Object Storage)<br/>CAM (Cloud Access Management)<br/>CDB (Cloud DataBase)<br/>DNSPod |
9+
| Tencent Cloud | cloudlist<br/>backdoor-user<br/>exec-command | CVM (Cloud Virtual Machine)<br/>Lighthouse<br/>COS (Cloud Object Storage)<br/>CAM (Cloud Access Management)<br/>CDB (Cloud DataBase)<br/>DNSPod |
1010
| Huawei Cloud | cloudlist<br/>backdoor-user | ECS (Elastic Cloud Server)<br/>OBS (Object Storage Service)<br/>IAM (Identity and Access Management)<br/>RDS (Relational Database Service) |
1111
| Microsoft Azure | cloudlist | Virtual Machines<br/>Blob Storage |
1212
| AWS (Amazon web services) | cloudlist<br/>backdoor-user<br/>bucket-dump | EC2 (Elastic Compute Cloud)<br/>S3 (Simple Storage Service)<br/>IAM (Identity and Access Management) |

‎go.mod‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,15 @@ require (
1717
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/billing v1.0.628
1818
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.557
1919
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdb v1.0.678
20-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.694
20+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.743
2121
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cvm v1.0.557
2222
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/dnspod v1.0.694
2323
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/lighthouse v1.0.557
2424
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mariadb v1.0.678
2525
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/postgres v1.0.678
2626
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sqlserver v1.0.678
2727
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sts v1.0.557
28+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tat v1.0.743
2829
github.com/tencentyun/cos-go-sdk-v5 v0.7.40
2930
github.com/tidwall/gjson v1.14.4
3031
golang.org/x/oauth2 v0.7.0

‎pkg/providers/tencent/cvm/instances.go‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@ package cvm
33
import (
44
"context"
55
"fmt"
6+
"strings"
67

78
"github.com/404tk/cloudtoolkit/pkg/schema"
9+
"github.com/404tk/cloudtoolkit/utils"
810
"github.com/404tk/cloudtoolkit/utils/logger"
911
"github.com/404tk/cloudtoolkit/utils/processbar"
1012
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
@@ -17,14 +19,24 @@ type Driver struct {
1719
Region string
1820
}
1921

22+
func (d *Driver) NewClient() (*cvm.Client, error) {
23+
cpf := profile.NewClientProfile()
24+
region := d.Region
25+
if region == "all" || region == "" {
26+
region = "ap-guangzhou"
27+
}
28+
return cvm.NewClient(d.Credential, region, cpf)
29+
}
30+
31+
var linuxSet = []string{"CentOS", "Ubuntu", "Debian", "OpenSUSE", "SUSE", "CoreOS", "FreeBSD", "Kylin", "UnionTech", "TencentOS", "Other Linux"}
32+
2033
// GetResource returns all the resources in the store for a provider.
2134
func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
2235
list := schema.NewResources().Hosts
2336
logger.Info("Start enumerating CVM ...")
24-
cpf := profile.NewClientProfile()
2537
var regions []string
2638
if d.Region == "all" {
27-
client, _ := cvm.NewClient(d.Credential, "ap-guangzhou", cpf)
39+
client, _ := d.NewClient()
2840
req := cvm.NewDescribeRegionsRequest()
2941
resp, err := client.DescribeRegions(req)
3042
if err != nil {
@@ -40,7 +52,8 @@ func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
4052
flag := false
4153
prevLength := 0
4254
for _, r := range regions {
43-
client, _ := cvm.NewClient(d.Credential, r, cpf)
55+
d.Region = r
56+
client, _ := d.NewClient()
4457
request := cvm.NewDescribeInstancesRequest()
4558
response, err := client.DescribeInstances(request)
4659
if err != nil {
@@ -58,11 +71,18 @@ func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
5871
}
5972
host := schema.Host{
6073
HostName: *instance.InstanceName,
74+
ID: *instance.InstanceId,
6175
PublicIPv4: ipv4,
6276
PrivateIpv4: privateIPv4,
6377
Public: ipv4 != "",
6478
Region: r,
6579
}
80+
os_name := strings.Split(*instance.OsName, " ")[0]
81+
if utils.IsContain(linuxSet, os_name) {
82+
host.OSType = "LINUX_UNIX"
83+
} else {
84+
host.OSType = "WINDOWS"
85+
}
6686
list = append(list, host)
6787
}
6888
select {

‎pkg/providers/tencent/lighthouse/instances.go‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ type Driver struct {
1717
Region string
1818
}
1919

20+
func (d *Driver) NewClient() (*lighthouse.Client, error) {
21+
cpf := profile.NewClientProfile()
22+
region := d.Region
23+
if region == "all" || region == "" {
24+
region = "ap-guangzhou"
25+
}
26+
return lighthouse.NewClient(d.Credential, region, cpf)
27+
}
28+
2029
// GetResource returns all the resources in the store for a provider.
2130
func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
2231
list := schema.NewResources().Hosts
@@ -26,10 +35,9 @@ func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
2635
default:
2736
logger.Info("Start enumerating Lighthouse ...")
2837
}
29-
cpf := profile.NewClientProfile()
3038
var regions []string
3139
if d.Region == "all" {
32-
client, _ := lighthouse.NewClient(d.Credential, "ap-guangzhou", cpf)
40+
client, _ := d.NewClient()
3341
req := lighthouse.NewDescribeRegionsRequest()
3442
resp, err := client.DescribeRegions(req)
3543
if err != nil {
@@ -46,7 +54,8 @@ func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
4654
flag := false
4755
prevLength := 0
4856
for _, r := range regions {
49-
client, _ := lighthouse.NewClient(d.Credential, r, cpf)
57+
d.Region = r
58+
client, _ := d.NewClient()
5059
request := lighthouse.NewDescribeInstancesRequest()
5160
response, err := client.DescribeInstances(request)
5261
if err != nil {
@@ -64,8 +73,10 @@ func (d *Driver) GetResource(ctx context.Context) ([]schema.Host, error) {
6473
}
6574
_host := schema.Host{
6675
HostName: *instance.InstanceName,
76+
ID: *instance.InstanceId,
6777
PublicIPv4: ipv4,
6878
PrivateIpv4: privateIPv4,
79+
OSType: *instance.PlatformType, // LINUX_UNIX or WINDOWS
6980
Public: ipv4 != "",
7081
Region: r,
7182
}

‎pkg/providers/tencent/tat/exec.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package tat
2+
3+
import (
4+
"encoding/base64"
5+
6+
"github.com/404tk/cloudtoolkit/pkg/schema"
7+
"github.com/404tk/cloudtoolkit/utils/logger"
8+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
9+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
10+
tat "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tat/v20201028"
11+
)
12+
13+
type Driver struct {
14+
Credential *common.Credential
15+
Region string
16+
}
17+
18+
var CacheHostList []schema.Host
19+
20+
func (d *Driver) RunCommand(instanceId, ostype, cmd string) string {
21+
cpf := profile.NewClientProfile()
22+
client, _ := tat.NewClient(d.Credential, d.Region, cpf)
23+
request := tat.NewRunCommandRequest()
24+
switch ostype {
25+
case "LINUX_UNIX":
26+
request.CommandType = common.StringPtr("SHELL")
27+
case "WINDOWS":
28+
request.CommandType = common.StringPtr("POWERSHELL")
29+
default:
30+
logger.Error("Unknown ostype", ostype)
31+
return ""
32+
}
33+
request.Content = common.StringPtr(base64.StdEncoding.EncodeToString([]byte(cmd)))
34+
request.InstanceIds = common.StringPtrs([]string{instanceId})
35+
response, err := client.RunCommand(request)
36+
if err != nil {
37+
logger.Error(err)
38+
return ""
39+
}
40+
invid := *response.Response.InvocationId
41+
return describeInvocations(client, invid)
42+
}
43+
44+
func describeInvocations(client *tat.Client, invid string) string {
45+
request := tat.NewDescribeInvocationsRequest()
46+
request.InvocationIds = common.StringPtrs([]string{invid})
47+
response, err := client.DescribeInvocations(request)
48+
if err != nil {
49+
logger.Error(err)
50+
return ""
51+
}
52+
taskId := *response.Response.InvocationSet[0].InvocationTaskBasicInfoSet[0].InvocationTaskId
53+
return describeInvocationTasks(client, taskId)
54+
}
55+
56+
func describeInvocationTasks(client *tat.Client, taskId string) string {
57+
request := tat.NewDescribeInvocationTasksRequest()
58+
request.InvocationTaskIds = common.StringPtrs([]string{taskId})
59+
request.HideOutput = common.BoolPtr(false)
60+
response, err := client.DescribeInvocationTasks(request)
61+
if err != nil {
62+
logger.Error(err)
63+
return ""
64+
}
65+
output := *response.Response.InvocationTaskSet[0].TaskResult.Output
66+
raw, err := base64.StdEncoding.DecodeString(output)
67+
if err != nil {
68+
logger.Error(output, err)
69+
return ""
70+
}
71+
return string(raw)
72+
}

‎pkg/providers/tencent/tencent.go‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package tencent
22

33
import (
44
"context"
5+
"fmt"
56

67
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/billing"
78
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/cam"
@@ -10,6 +11,7 @@ import (
1011
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/cvm"
1112
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/dns"
1213
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/lighthouse"
14+
"github.com/404tk/cloudtoolkit/pkg/providers/tencent/tat"
1315
"github.com/404tk/cloudtoolkit/pkg/schema"
1416
"github.com/404tk/cloudtoolkit/utils"
1517
"github.com/404tk/cloudtoolkit/utils/cache"
@@ -87,6 +89,7 @@ func (p *Provider) Resources(ctx context.Context) (schema.Resources, error) {
8789
light := &lighthouse.Driver{Credential: p.credential, Region: p.region}
8890
lights, err = light.GetResource(ctx)
8991
list.Hosts = append(list.Hosts, lights...)
92+
tat.CacheHostList = list.Hosts
9093
case "domain":
9194
dnsprovider := &dns.Driver{Credential: p.credential}
9295
list.Domains, err = dnsprovider.GetDomains(ctx)
@@ -142,4 +145,22 @@ func (p *Provider) BucketDump(ctx context.Context, action, bucketname string) {
142145

143146
func (p *Provider) EventDump(action, sourceIp string) {}
144147

145-
func (p *Provider) ExecuteCloudVMCommand(instanceId, cmd string) {}
148+
func (p *Provider) ExecuteCloudVMCommand(instanceId, cmd string) {
149+
var region, ostype string
150+
for _, host := range tat.CacheHostList {
151+
if host.ID == instanceId {
152+
region = host.Region
153+
ostype = host.OSType
154+
break
155+
}
156+
}
157+
if region == "" {
158+
logger.Error("Run cloudlist first")
159+
return
160+
}
161+
d := tat.Driver{Credential: p.credential, Region: region}
162+
output := d.RunCommand(instanceId, ostype, cmd)
163+
if output != "" {
164+
fmt.Println(output)
165+
}
166+
}

‎utils/utils.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,15 @@ func Md5Encode(s string) string {
2727
return fmt.Sprintf("%x", has)
2828
}
2929

30+
func IsContain(items []string, item string) bool {
31+
for _, eachItem := range items {
32+
if eachItem == item {
33+
return true
34+
}
35+
}
36+
return false
37+
}
38+
3039
func HttpGet(url string) ([]byte, error) {
3140
resp, err := http.Get(url)
3241
if err != nil {

0 commit comments

Comments
 (0)