#!/usr/bin/env python3 # -*- coding: utf-8 -*-" """ Prommetrix - Tool to obtain relevant information from the instances of 'Node Exporter' executed by 'Prometheus' - 2024 - by psy (https://03c8.net) ---------- Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations including Uber, Slack, Robinhood, and more. By scraping real-time metrics from various endpoints, Prometheus allows easy observation of a system’s state in addition to observation of hardware and software metrics such as memory usage, network usage and software-specific defined metrics (ex. number of failed login attempts to a web application). - https://prometheus.io/docs/guides/node-exporter/ Since the numeric metrics captured by Prometheus are not considered sensitive data, Prometheus has held an understandable policy of avoiding built-in support for security features such as authentication and encryption, in order to focus on developing the monitoring-related features. This changed less than a year ago (Jan 2021), on the release of version 2.24.0 where Transport Layer Security (TLS) and basic authentication support were introduced. Due to the fact that authentication and encryption support is relatively new, many organizations that use Prometheus haven’t yet enabled these features and thus many Prometheus endpoints are completely exposed to the Internet (e.g. endpoints that run earlier versions), leaking metric and label data. ---------- Dork (using default port): - inurl:":9100/metrics" ---------- This vulnerabily can be described in a Pentest/Report like: - PRM-01-001 Client: Clients leak Metrics data through unprotected endpoint (LOW) "Metric data are to be collected for some services and these items need to implement a client-library that enables the core Prometheus service to scrape the data. The client- library opens a minimal HTTP server and exposes a route which is then registered with the core service for scraping. This endpoint is unauthenticated by default, which allows anybody who knows the URI to read the metric data. It is recommended to put some form of authentication in place. Only the core Prometheus service should be allowed to read the metric data." ---------- Prommetrix - will take advantage of these metrics to obtain relevant information from the Prometheus instance, as well as, of the machine in which it is running. [!] The information obtained can be used to build other types of attacks over the different pieces of software/versions exposed (ex: CVE). ---------- You should have received a copy of the GNU General Public License along with Prommetrix; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA """ VERSION=str(0.2) import os, sys, requests, random, re def banner(): print(r'''==================================================================== ___ _ ___ __ | _ \ _ __ ___ _ __ ___ _ __ ___ ___| |_ _ __(_) \/ / | |_) | '__/ _ \| '_ ` _ \| '_ ` _ \ / _ \ __| '__| |\ / | __/| | | (_) | | | | | | | | | | | __/ |_| | | |/ \ |_| |_| \___/|_| |_| |_|_| |_| |_|\___|\__|_| |_/_/\_\ (v'''+VERSION+''') by psy (https://03c8.net) | 2024 Source Code: - Official: https://code.03c8.net/epsylon/prommetrix - Mirror: https://github.com/epsylon/prommetrix Usage: python3 prommetrix.py --target --port (default: 9100) ====================================================================''') def init(): if "--target" in sys.argv: print("") banner() user_agent_list = [ 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36', 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1', 'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363', ] headers={"User-Agent": user_agent_list[random.randint(0, len(user_agent_list)-1)]} try: if "--port" in sys.argv: r = requests.get("http://"+sys.argv[2]+":"+sys.argv[4]+"/metrics", headers=headers) else: r = requests.get("http://"+sys.argv[2]+":9100"+"/metrics", headers=headers) except: print("") banner() sys.exit(2) if r.status_code != 200: print("\n[ERROR] Not any 'Prometheus' have been detected <-> ABORTING!\n") banner() sys.exit(2) else: with open('tmp.txt','w') as fd: metrics= re.sub(r'^#.*\n?', '', r.text, flags=re.MULTILINE) fd.write(metrics) r_text = open("tmp.txt", "r").read() print("\n[INFO] 'Prometheus' detected at: "+sys.argv[2]+" <-> EXPOSING!\n") print(" - Metrics path:") print(" - URL: "+r.url) print("\n - 'Go' (environment):") print(" - Version: "+r_text.split('go_info{version="')[1].split('"}')[0]) node_exporter_build_branch = r_text.split('node_exporter_build_info{branch="')[1].split('"')[0] node_exporter_build_goversion = r_text.split('goversion="')[1].split('"')[0] node_exporter_build_revision = r_text.split('revision="')[1].split('"')[0] node_exporter_build_version = r_text.split('version="')[1].split('"')[0] try: node_dmi_bios_date = r_text.split('node_dmi_info{bios_date="')[1].split('"')[0] node_dmi_bios_release = r_text.split('bios_release="')[1].split('"')[0] node_dmi_bios_version = r_text.split('bios_version="')[1].split('"')[0] node_dmi_bios_vendor = r_text.split('bios_vendor="')[1].split('"')[0] system_flag = True bios_flag = True except: node_dmi_bios_date = None node_dmi_bios_release = None node_dmi_bios_version = None node_dmi_bios_vendor = None system_flag = False bios_flag = False try: node_os_build = r_text.split('node_os_info{build_id="')[1].split('",id')[0] node_os_id = r_text.split(',id="')[1].split('",id_like')[0] node_os_id_like = r_text.split('id_like="')[1].split('",image_id')[0] node_os_image_id = r_text.split('image_id="')[1].split('",image_version')[0] node_os_image_version = r_text.split('image_version="')[1].split('",name')[0] node_os_pretty_name = r_text.split('pretty_name="')[1].split('",variant')[0] node_os_variant = r_text.split('variant="')[1].split('",variant_id')[0] node_os_variant_id = r_text.split('variant_id="')[1].split('",version')[0] node_os_version_codename = r_text.split('version_codename="')[1].split('",version_id')[0] node_os_version_id = r_text.split('version_id="')[1].split('"}')[0] os_flag = True except: node_os_build = None node_os_id = None node_os_id_like = None node_os_image_id = None node_os_image_version = None node_os_name = None node_os_pretty_name = None node_os_variant = None node_os_variant_id = None node_os_version_codename = None node_os_version_id = None os_flag = False try: node_dmi_board_asset_tag = r_text.split('board_asset_tag="')[1].split('"')[0] node_dmi_board_name = r_text.split('board_name="')[1].split('"')[0] node_dmi_board_version = r_text.split('board_version="')[1].split('"')[0] node_dmi_board_vendor = r_text.split('board_vendor="')[1].split('"')[0] node_dmi_chassis_asset_tag = r_text.split('chassis_asset_tag="')[1].split('"')[0] node_dmi_chassis_version = r_text.split('chassis_version="')[1].split('"')[0] node_dmi_chassis_vendor = r_text.split('chassis_vendor="')[1].split('"')[0] node_dmi_product_family = r_text.split('product_family="')[1].split('"')[0] node_dmi_product_name = r_text.split('product_name="')[1].split('"')[0] node_dmi_product_sku = r_text.split('product_sku="')[1].split('"')[0] node_dmi_product_version = r_text.split('product_version="')[1].split('"')[0] node_dmi_system_vendor = r_text.split('system_vendor="')[1].split('"')[0] board_flag = True except: node_dmi_board_asset_tag = None node_dmi_board_name = None node_dmi_board_version = None node_dmi_board_vendor = None node_dmi_chassis_asset_tag = None node_dmi_chassis_version = None node_dmi_chassis_vendor = None node_dmi_product_family = None node_dmi_product_name = None node_dmi_product_sku = None node_dmi_product_version = None node_dmi_system_vendor = None board_flag = False node_cpus = r_text.split('node_softnet_dropped_total{cpu="') node_uname_info_domainname = r_text.split('node_uname_info{domainname="')[1].split('"')[0] node_uname_info_machine = r_text.split('machine="')[1].split('",nodename')[0] node_uname_info_nodename = r_text.split('nodename="')[1].split('",release')[0] node_uname_info_release = r_text.split(',release="')[1].split('",sysname')[0] node_uname_info_sysname = r_text.split(',sysname="')[1].split('",version')[0] node_uname_info_version = r_text.split('version="#')[1].split('"} ')[0] try: node_time_zone = r_text.split('node_time_zone_offset_seconds{time_zone="')[1].split('"')[0] time_zone_flag = True except: node_time_zone = None time_zone_flag = False print("\n - 'Node Export' (build):") if node_exporter_build_branch: print(" - Branch: "+node_exporter_build_branch) if node_exporter_build_revision: print(" - Revision: "+node_exporter_build_revision) if node_exporter_build_version: print(" - Version: "+node_exporter_build_version) if node_cpus: print("\n - CPUs (total):") node_cpus_number = 0 for d in node_cpus[1:]: node_cpus_number = node_cpus_number + 1 print(" - "+str(node_cpus_number)) if system_flag == True: print("\n - SYSTEM:") if node_dmi_bios_vendor: print(" - Vendor: "+node_dmi_bios_vendor) if bios_flag == True: print("\n - BIOS:") if node_dmi_bios_date: print(" - Date: "+node_dmi_bios_date) if node_dmi_bios_release: print(" - Release: "+node_dmi_bios_release) if node_dmi_bios_version: print(" - Version: "+node_dmi_bios_version) if os_flag == True: print("\n - OS:") if node_os_build: print(" - Build ID: "+node_os_build) if node_os_id: print(" - ID: "+node_os_id) if node_os_id_like: print(" - ID Like: "+node_os_id_like) if node_os_image_id: print(" - Image ID: "+node_os_image_id) if node_os_image_version: print(" - Image version: "+node_os_image_version) if node_os_pretty_name: print(" - Name: "+node_os_pretty_name) if node_os_variant: print(" - Variant: "+node_os_variant) if node_os_variant_id: print(" - Variant ID: "+node_os_variant_id) if node_os_version_codename: print(" - Version codename: "+node_os_version_codename) if node_os_version_id: print(" - Version ID: "+node_os_version_id) print("\n - UNAME:") if node_uname_info_domainname: print(" - Domainname: "+node_uname_info_domainname) if node_uname_info_machine: print(" - Machine: "+node_uname_info_machine) if node_uname_info_nodename: print(" - Nodename: "+node_uname_info_nodename) if node_uname_info_release: print(" - Release: "+node_uname_info_release) if node_uname_info_sysname: print(" - Sysname: "+node_uname_info_sysname) if node_uname_info_version: print(" - Version: "+node_uname_info_version) if time_zone_flag == True: if node_time_zone: print("\n - TIMEZONE:") print(" - Location: "+node_time_zone) if board_flag == True: print("\n - BOARD:") if node_dmi_board_asset_tag: print(" - TAG: "+node_dmi_board_asset_tag) if node_dmi_board_name: print(" - Name: "+node_dmi_board_name) if node_dmi_board_vendor: print(" - Vendor: "+node_dmi_board_vendor) if node_dmi_board_version: print(" - Version: "+node_dmi_board_version) print("\n - CHASSIS:") if node_dmi_chassis_asset_tag: print(" - TAG: "+node_dmi_chassis_asset_tag) if node_dmi_chassis_vendor: print(" - Vendor: "+node_dmi_chassis_vendor) if node_dmi_chassis_version: print(" - Version: "+node_dmi_chassis_version) print("\n - PRODUCT:") if node_dmi_product_family: print(" - Family: "+node_dmi_product_family) if node_dmi_product_name: print(" - Name: "+node_dmi_product_name) if node_dmi_product_sku: print(" - SKU: "+node_dmi_product_sku) if node_dmi_product_version: print(" - Version: "+node_dmi_product_version) try: node_selinux = r_text.split('node_selinux_enabled') node_selinux_flag = True except: node_selinux_flag = False if node_selinux_flag == True: print("\n - SELINUX:") if node_selinux == 1: print(" - Status: ON") else: print(" - Status: OFF") try: node_disk_info_devices = r_text.split('node_disk_info{device="') node_disk_info_devices_flag = True except: node_disk_info_devices_flag = False if node_disk_info_devices_flag == True: if node_disk_info_devices: print("\n - Info of /sys/block/:") for d in node_disk_info_devices[1:]: node_disk_info_device = d.split('"')[0] print(" - "+node_disk_info_device) node_disk_filesystem_devices = r_text.split('node_filesystem_files_free{device="') if node_disk_filesystem_devices: print("\n - Info of node_filesystem_files:") for d in node_disk_filesystem_devices[1:]: node_disk_filesystem_device = d.split('} ')[0] print(" - "+node_disk_filesystem_device) node_network_iface_id_devices = r_text.split('node_network_iface_id{device="') if node_network_iface_id_devices: print("\n - NETWORK devices:") for d in node_network_iface_id_devices[1:]: node_network_iface_id_device = d.split('"')[0] print(" - "+node_network_iface_id_device) node_network_info_devices = r_text.split('node_network_info{') if node_network_info_devices: print("\n - NETWORK entries by device:") for d in node_network_info_devices[1:]: node_network_info_device = d.split('} ')[0] print(" - "+node_network_info_device) node_arp_devices = r_text.split('node_arp_entries{device="') if node_arp_devices: print("\n - ARP entries by device:") for d in node_arp_devices[1:]: arp_device = d.split('"')[0] print(" - "+arp_device) print("\n - PROMETHEUS HTTP_metrics:") try: promhttp_metric_handler_errors_total_encoding = r_text.split('promhttp_metric_handler_errors_total{cause="encoding"}')[1].split("\n")[0] promhttp_metric_handler_errors_total_gathering = r_text.split('promhttp_metric_handler_errors_total{cause="gathering"}')[1].split("\n")[0] prom_gathering_flag = True except: prom_gathering_flag = False promhttp_metric_handler_requests_in_flight = r_text.split('promhttp_metric_handler_requests_in_flight')[1].split("\n")[0] promhttp_metric_handler_requests_total_200 = r_text.split('promhttp_metric_handler_requests_total{code="200"}')[1].split("\n")[0] promhttp_metric_handler_requests_total_500 = r_text.split('promhttp_metric_handler_requests_total{code="500"}')[1].split("\n")[0] promhttp_metric_handler_requests_total_503 = r_text.split('promhttp_metric_handler_requests_total{code="503"}')[1].split("\n")[0] print(" - HTTP-200 (OK) : "+promhttp_metric_handler_requests_total_200) print(" - HTTP-500 (FAIL) : "+promhttp_metric_handler_requests_total_500) print(" - HTTP-503 (FAIL) : "+promhttp_metric_handler_requests_total_503) if prom_gathering_flag == True: print(" - ENCODING (FAIL) : "+promhttp_metric_handler_errors_total_encoding) print(" - GHATERING (FAIL): "+promhttp_metric_handler_errors_total_gathering) print("") else: print("") banner() if os.path.exists("tmp.txt"): os.remove("tmp.txt") init()