From 1ba0ddfefb934428d1e706d0928c08876bb225b1 Mon Sep 17 00:00:00 2001 From: Bucky Wilson Date: Tue, 21 Nov 2017 13:47:51 +1000 Subject: [PATCH 01/70] Fixed: 'DataObjects::ConnectionError - database is locked:' error Getting error using sqlite database. Added: db_pool, and db_timeout to correct. --- config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config.yaml b/config.yaml index fc6ae1dd04..1126759d60 100644 --- a/config.yaml +++ b/config.yaml @@ -106,6 +106,8 @@ beef: # db_file is only used for sqlite db_file: "beef.db" + db_pool: 50 # Issues with sqlite locking. + db_timeout: 500 # https://stackoverflow.com/questions/7154664/ruby-sqlite3busyexception-database-is-locked # db connection information is only used for mysql/postgres db_host: "localhost" From 1fe6ee1dcbd30fa23c1efd8eb620b73d1dd03b3c Mon Sep 17 00:00:00 2001 From: Bucky Wilson Date: Tue, 21 Nov 2017 13:52:18 +1000 Subject: [PATCH 02/70] And then removing these lines - still no error Error maynot be solved by the introduction of db_pool/db_timeout Restarting - may resolve issues. --- config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config.yaml b/config.yaml index 1126759d60..7972955a39 100644 --- a/config.yaml +++ b/config.yaml @@ -106,8 +106,8 @@ beef: # db_file is only used for sqlite db_file: "beef.db" - db_pool: 50 # Issues with sqlite locking. - db_timeout: 500 # https://stackoverflow.com/questions/7154664/ruby-sqlite3busyexception-database-is-locked + #db_pool: 50 # Issues with sqlite locking. + #db_timeout: 500 # https://stackoverflow.com/questions/7154664/ruby-sqlite3busyexception-database-is-locked # db connection information is only used for mysql/postgres db_host: "localhost" From 1f7565e4170ed8827f2838c73f43d6d1285d9e57 Mon Sep 17 00:00:00 2001 From: Bucky Wilson Date: Fri, 24 Nov 2017 09:26:29 +1000 Subject: [PATCH 03/70] Gemfile - whitespace, added dev group: pry --- Gemfile | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/Gemfile b/Gemfile index c919795cac..641e1af9d2 100644 --- a/Gemfile +++ b/Gemfile @@ -83,22 +83,27 @@ end # For running unit tests group :test do -if ENV['BEEF_TEST'] - gem 'rake' - gem 'test-unit' - gem 'test-unit-full' - gem 'curb' - gem 'selenium' - gem 'selenium-webdriver' - gem 'rspec' - gem 'bundler-audit' - # nokogirl is needed by capybara which may require one of the below commands - # sudo apt-get install libxslt-dev libxml2-dev - # sudo port install libxml2 libxslt - gem 'capybara' - # RESTful API tests/generic command module tests - gem 'rest-client', '>= 2.0.1' + if ENV['BEEF_TEST'] + gem 'rake' + gem 'test-unit' + gem 'test-unit-full' + gem 'curb' + gem 'selenium' + gem 'selenium-webdriver' + gem 'rspec' + gem 'bundler-audit' + # nokogirl is needed by capybara which may require one of the below commands + # sudo apt-get install libxslt-dev libxml2-dev + # sudo port install libxml2 libxslt + gem 'capybara' + # RESTful API tests/generic command module tests + gem 'rest-client', '>= 2.0.1' + end end + +# For development +group :dev do + gem 'pry' end source 'https://rubygems.org' From 2f749b78c96ce64db4b0ee4e633f917671cce8c2 Mon Sep 17 00:00:00 2001 From: Bucky Wilson Date: Fri, 24 Nov 2017 17:00:58 +1000 Subject: [PATCH 04/70] 1333: Rate Limit API - 1 in user defined value Allow api connection every api_attempt_delay milliseconds. Currently 50 mSec Uses the same process as ui/admin rate limiting. Changes to be committed: modified: config.yaml modified: core/main/rest/api.rb modified: core/main/router/router.rb --- config.yaml | 2 ++ core/main/rest/api.rb | 27 ++++++++++++++++++++++++++- core/main/router/router.rb | 8 ++++++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/config.yaml b/config.yaml index 7972955a39..2205e3f3c3 100644 --- a/config.yaml +++ b/config.yaml @@ -27,6 +27,8 @@ beef: # subnet of IP addresses that can connect to the admin UI #permitted_ui_subnet: "127.0.0.1/32" permitted_ui_subnet: "0.0.0.0/0" + # slow API calls to 1 every api_attempt_delay seconds + api_attempt_delay: "0.05" # HTTP server http: diff --git a/core/main/rest/api.rb b/core/main/rest/api.rb index 1b046a3b00..ae87547429 100644 --- a/core/main/rest/api.rb +++ b/core/main/rest/api.rb @@ -63,7 +63,7 @@ def self.mount_handler(server) # This is from extensions/admin_ui/controllers/authentication/authentication.rb # def self.permitted_source?(ip) - # get permitted subnet + # get permitted subnet permitted_ui_subnet = BeEF::Core::Configuration.instance.get("beef.restrictions.permitted_ui_subnet") target_network = IPAddr.new(permitted_ui_subnet) @@ -74,6 +74,31 @@ def self.permitted_source?(ip) return target_network.include?(ip) end + # + # Rate limit through timeout + # This is from extensions/admin_ui/controllers/authentication/ + # + # Brute Force Mitigation + # Only one login request per config_delay_id seconds + # + # @param config_delay_id configuration name for the timeout + # @param last_time_attempt