Apache ZooKeeper Information Disclosure - Metasploit

This page contains detailed information about how to use the auxiliary/gather/zookeeper_info_disclosure metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: Apache ZooKeeper Information Disclosure
Module: auxiliary/gather/zookeeper_info_disclosure
Source code: modules/auxiliary/gather/zookeeper_info_disclosure.rb
Disclosure date: 2020-10-14
Last modification time: 2021-08-27 17:15:33 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 2181
List of CVEs: -

Apache ZooKeeper server service runs on TCP 2181 and by default, it is accessible without any authentication. This module targets Apache ZooKeeper service instances to extract information about the system environment, and service statistics.

Module Ranking and Traits

Module Ranking:

• normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/gather/zookeeper_info_disclosure
msf auxiliary(zookeeper_info_disclosure) > show options
    ... show and set options ...
msf auxiliary(zookeeper_info_disclosure) > set RHOSTS ip-range
msf auxiliary(zookeeper_info_disclosure) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(zookeeper_info_disclosure) > set RHOSTS 192.168.1.3-192.168.1.200 

Example 2:

msf auxiliary(zookeeper_info_disclosure) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(zookeeper_info_disclosure) > set RHOSTS file:/tmp/ip_list.txt

Required Options

• RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Knowledge Base

msf5 > use auxiliary/gather/zookeeper_info_disclosure
msf5 auxiliary(gather/zookeeper_info_disclosure) > set rhosts 1.3.3.7
msf5 auxiliary(gather/zookeeper_info_disclosure) > show options

       Name: Apache ZooKeeper Information Disclosure
     Module: auxiliary/gather/zookeeper_info_disclosure
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2020-10-14

Provided by:
  Karn Ganeshen 

Check supported:
  No

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  RHOSTS   1.3.3.7          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
  RPORT    2181             yes       The target port (TCP)
  THREADS  1                yes       The number of concurrent threads (max one per host)
  TIMEOUT  30               yes       Timeout for the probe

Description:
  Apache ZooKeeper server service runs on TCP 2181 and by default, it 
  is accessible without any authentication. This module targets Apache 
  ZooKeeper service instances to extract information about the system 
  environment, and service statistics.

References:
  https://zookeeper.apache.org/doc/current/zookeeperAdmin.html


msf5 auxiliary(gather/zookeeper_info_disclosure) > run

[*] 1.3.3.7:2181     - Using a timeout of 30...
[*] 1.3.3.7:2181     - Verifying if service is responsive...
[+] 1.3.3.7:2181     - Service looks fine. Going ahead with extraction..

[*] 1.3.3.7:2181     - Dumping environment info...
[+] 1.3.3.7:2181     - Environment:
zookeeper.version=3.4.9-1757313, built on 08/23/2016 06:50 GMT
host.name=localhost.localdomain
java.version=1.8.0_162
java.vendor=Oracle Corporation
java.home=/usr/lib/jvm/jdk1.8.0_162/jre
java.class.path=/var/lib/zookeeper/bin/../build/classes:/var/lib/zookeeper/bin/../build/lib/*.jar:/var/lib/zookeeper/bin/../lib/slf4j-log4j12-1.6.1.jar:/var/lib/zookeeper/bin/../lib/slf4j-api-1.6.1.jar:/var/lib/zookeeper/bin/../lib/netty-3.10.5.Final.jar:/var/lib/zookeeper/bin/../lib/log4j-1.2.16.jar:/var/lib/zookeeper/bin/../lib/jline-0.9.94.jar:/var/lib/zookeeper/bin/../zookeeper-3.4.9.jar:/var/lib/zookeeper/bin/../src/java/lib/*.jar:/var/lib/zookeeper/bin/../conf:
java.library.path=/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib
java.io.tmpdir=/tmp
java.compiler=
os.name=Linux
os.arch=amd64
os.version=3.10.62-ltsi
user.name=root
user.home=/root/
user.dir=/opt/data/zookeeper

[+] 1.3.3.7:2181       - File saved in: /root/.msf4/loot/20201013203537_default_1.3.3.7_environlog_604018.txt 

[*] 1.3.3.7:2181       - Dumping statistics about performance and connected clients...
[+] 1.3.3.7:2181       - Zookeeper version: 3.4.9-1757313, built on 08/23/2016 06:50 GMT
Clients:
 /1.3.3.6:33935[0](queued=0,recved=1,sent=0)
 /1.3.3.13:39682[1](queued=0,recved=526446,sent=526446)
 /1.3.3.12:60371[1](queued=0,recved=526234,sent=526279)
 /1.3.3.12:60373[1](queued=0,recved=596717,sent=596727)
 /1.3.3.13:51193[1](queued=0,recved=78915,sent=78917)
 /1.3.3.13:49457[1](queued=0,recved=538585,sent=540938)

Latency min/avg/max: 0/0/20
Received: 2267148
Sent: 2269515
Connections: 6
Outstanding: 0
Zxid: 0x300000c6c
Mode: follower
Node count: 1041

[+] 1.3.3.7:2181       - File saved in: /root/.msf4/loot/20201013203537_default_1.3.3.7_statlog_417795.txt

[*] 1.3.3.7:2181       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed


msf5 auxiliary(gather/zookeeper_info_disclosure) > 
msf5 auxiliary(gather/zookeeper_info_disclosure) > loot

Loot
====

host           service      type            name             content        info       path
----           -------      ----            ----             -------        ----       ----
1.3.3.7        environ-log      ZooKeeper   Environment Log  text/plain     ZooKeeper  /root/.msf4/loot/20201013203537_default_1.3.3.7_environlog_604018.txt 
1.3.3.7        stat-log         ZooKeeper   Stat Log         text/plain     ZooKeeper  /root/.msf4/loot/20201013203537_default_1.3.3.7_statlog_417795.txt


msf5 auxiliary(gather/zookeeper_info_disclosure) > services 
Services
========

host       port  proto  name       state  info
----       ----  -----  ----       -----  ----
1.3.3.7    2181  tcp    zookeeper  open   Apache Zookeeper: 3.4.13-2--1

msf5 auxiliary(gather/zookeeper_info_disclosure) > hosts

Hosts
=====

address        mac   name        os_name  os_flavor  os_sp  purpose  info  comments
-------        ---   ----        -------  ---------  -----  -------  ----  --------
1.3.3.7              localhost   Linux    device                           Linux amd64 3.10.0-1062.12.1.el7.x86_64

Go back to menu.

Msfconsole Usage

Here is how the gather/zookeeper_info_disclosure auxiliary module looks in the msfconsole:

msf6 > use auxiliary/gather/zookeeper_info_disclosure

msf6 auxiliary(gather/zookeeper_info_disclosure) > show info

       Name: Apache ZooKeeper Information Disclosure
     Module: auxiliary/gather/zookeeper_info_disclosure
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2020-10-14

Provided by:
  Karn Ganeshen <[email protected]>

Check supported:
  No

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  RHOSTS                    yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT    2181             yes       The target port (TCP)
  THREADS  1                yes       The number of concurrent threads (max one per host)
  TIMEOUT  30               yes       Timeout for the probe

Description:
  Apache ZooKeeper server service runs on TCP 2181 and by default, it 
  is accessible without any authentication. This module targets Apache 
  ZooKeeper service instances to extract information about the system 
  environment, and service statistics.

References:
  https://zooKeeper.apache.org/doc/current/zookeeperAdmin.html

Module Options

This is a complete list of options available in the gather/zookeeper_info_disclosure auxiliary module:

msf6 auxiliary(gather/zookeeper_info_disclosure) > show options

Module options (auxiliary/gather/zookeeper_info_disclosure):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT    2181             yes       The target port (TCP)
   THREADS  1                yes       The number of concurrent threads (max one per host)
   TIMEOUT  30               yes       Timeout for the probe

Advanced Options

Here is a complete list of advanced options supported by the gather/zookeeper_info_disclosure auxiliary module:

msf6 auxiliary(gather/zookeeper_info_disclosure) > show advanced

Module advanced options (auxiliary/gather/zookeeper_info_disclosure):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ConnectTimeout       10               yes       Maximum number of seconds to establish a TCP connection
   Proxies                               no        A proxy chain of format type:host:port[,type:host:port][...]
   SSL                  false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                             no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode        PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion           Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              true             no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the gather/zookeeper_info_disclosure module can do:

msf6 auxiliary(gather/zookeeper_info_disclosure) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the gather/zookeeper_info_disclosure auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(gather/zookeeper_info_disclosure) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Server does not allow accessing environment information.

Here is a relevant code snippet related to the "Server does not allow accessing environment information." error message:

82:	              comments: os
83:	            }
84:	            report_host(host_info)
85:	            report_service(host: rhost, port: rport, name: 'ZooKeeper', info: "Apache ZooKeeper: #{version}")
86:	          else
87:	            print_error('Server does not allow accessing environment information.')
88:	            host_info = {
89:	              host: rhost
90:	            }
91:	            report_host(host_info)
92:	            report_service(host: rhost, port: rport, name: 'ZooKeeper', info: 'Apache ZooKeeper')

Server does not allow accessing statistics.

Here is a relevant code snippet related to the "Server does not allow accessing statistics." error message:

106:	            loot_desc = 'ZooKeeper Stat Log'
107:	            loot_service = 'ZooKeeper'
108:	            p = store_loot(loot_name, loot_type, datastore['RHOST'], data, loot_desc, loot_service)
109:	            print_good("File saved in: #{p} \n")
110:	          else
111:	            print_error('Server does not allow accessing statistics.')
112:	          end
113:	        else
114:	          print_error('No good response from server. Exiting.')
115:	        end
116:	      end

No good response from server. Exiting.

Here is a relevant code snippet related to the "No good response from server. Exiting." error message:

109:	            print_good("File saved in: #{p} \n")
110:	          else
111:	            print_error('Server does not allow accessing statistics.')
112:	          end
113:	        else
114:	          print_error('No good response from server. Exiting.')
115:	        end
116:	      end
117:	    rescue Timeout::Error, ::Rex::TimeoutError, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
118:	      print_error("#{rhost}:#{rport} - Connection Failed...")
119:	    ensure

<RHOST>:<RPORT> - Connection Failed...

Here is a relevant code snippet related to the "<RHOST>:<RPORT> - Connection Failed..." error message:

113:	        else
114:	          print_error('No good response from server. Exiting.')
115:	        end
116:	      end
117:	    rescue Timeout::Error, ::Rex::TimeoutError, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
118:	      print_error("#{rhost}:#{rport} - Connection Failed...")
119:	    ensure
120:	      disconnect
121:	    end
122:	  end
123:	end

Go back to menu.

Related Pull Requests

• #14806 Merged Pull Request: Rubocop recently landed modules continued
• #14734 Merged Pull Request: Rubocop recently landed modules
• #14269 Merged Pull Request: Apache Zookeeper Information Disclosure Auxiliary Module

References

• CVE: Not available
• https://zooKeeper.apache.org/doc/current/zookeeperAdmin.html

See Also

Check also the following modules related to this module:

• auxiliary/admin/http/webnms_cred_disclosure
• auxiliary/admin/webmin/file_disclosure
• auxiliary/gather/c2s_dvr_password_disclosure
• auxiliary/gather/cerberus_helpdesk_hash_disclosure
• auxiliary/gather/eventlog_cred_disclosure
• auxiliary/gather/f5_bigip_cookie_disclosure
• auxiliary/gather/flash_rosetta_jsonp_url_disclosure
• auxiliary/gather/ipcamera_password_disclosure
• auxiliary/gather/jetty_web_inf_disclosure
• auxiliary/gather/netgear_password_disclosure
• auxiliary/gather/pulse_secure_file_disclosure
• auxiliary/scanner/http/apache_activemq_source_disclosure
• auxiliary/scanner/http/litespeed_source_disclosure
• auxiliary/scanner/http/nginx_source_disclosure
• auxiliary/scanner/http/wp_mobile_pack_info_disclosure
• auxiliary/scanner/misc/dvr_config_disclosure
• auxiliary/scanner/sap/sap_soap_th_saprel_disclosure
• auxiliary/gather/hikvision_info_disclosure_cve_2017_7921
• exploit/multi/http/zpanel_information_disclosure_rce
• auxiliary/gather/browser_info
• auxiliary/gather/huawei_wifi_info
• auxiliary/gather/xymon_info
• auxiliary/scanner/afp/afp_server_info
• auxiliary/scanner/http/infovista_enum
• auxiliary/scanner/http/ntlm_info_enumeration
• auxiliary/scanner/kademlia/server_info
• auxiliary/scanner/misc/ib_service_mgr_info
• auxiliary/scanner/printer/printer_version_info
• auxiliary/scanner/quake/server_info
• auxiliary/scanner/sap/sap_icf_public_info
• auxiliary/scanner/sap/sap_router_info_request
• auxiliary/scanner/sap/sap_soap_rfc_system_info
• auxiliary/scanner/steam/server_info

Authors

• Karn Ganeshen <KarnGaneshen[at]gmail.com>

Version

This page has been produced using Metasploit Framework version 6.2.26-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.