備忘録/にわかエンジニアが好きなように書く

個人的にとりあえず仕組みを知りたいから勉強になる?ってことで、 (利便性無視で)触りたように好きに構築してみる 個人用の備忘録となるので内容の保証はないのでその点はご了承ください。 ※変な内容や間違いを書いているなどありましたらコメントやご指摘いただけると幸いです。

Faraday ServerとClientのパッケージでの導入と起動まで

Faradayについて

~~サイト抜粋~~

https://github.com/infobyte/faraday/wiki/installation-community

Faraday Server is the interface between CouchDB and Faraday Client sessions. The server's responsibility is to transmit information between the client and CouchDB, and make sure that they are kept in sync. It also serves the Web UI client, which allows you to handle enormous workspaces from your favorite web browser.

~~~~~~~~~

おそらく、サーバはDBとの橋渡しをするから設定はFaradayClient or WebUIなどから行う必要がある。ということかな。

クライアントはワークスペースの作成と削除、プラグイン設定の指定、ホストに関する情報の表示などを行うこともできるとも書いてありそう。

 

環境

VMware ESXi 6.5 ホストに仮想マシンを作成してインストール。

Ubuntu 16.04.3 

 

事前確認

Faladay導入サーバにSSHで接続を行い、xclock , xeyesなどが起動することを確認。

Xが起動しないと、後ほどの手順で run.sh を実行させた場合にエラーが出る。

 

Faladayインストール

ユーザ作成

ユーザーアカウント作成
user@sv001:~$ sudo useradd -d /home/faraday -m faraday
user@sv001:~$ sudo passwd faraday
user@sv001:~$ sudo vi /etc/sudoers
【追加】dojo ALL=(ALL:ALL) ALL

user@sv001:~$ sudo vi /etc/passwd

【追加】faraday:x:1001:1001::/home/faraday:/bin/bash
ユーザ変更

su - xxx でユーザ変更するとxauthで失敗する(cookあたりを登録する必要あり?)ので、いったんログアウトしてから作成したユーザでのログインを行う。

xauthの修正が可能なら su でのユーザ変更でも可

user@sv001:~$ exit
ログアウト

各種パッケージインストール

faraday@sv001:~$ sudo apt-get update

faraday@sv001:~$ sudo apt-get install git

Faraday(Server)インストール

Gitクローン取得
faraday@sv001:~$ git clone https://github.com/infobyte/faraday.git faraday-dev
Cloning into 'faraday-dev'...
remote: Counting objects: 29206, done.
remote: Total 29206 (delta 0), reused 0 (delta 0), pack-reused 29206
Receiving objects: 100% (29206/29206), 9.19 MiB | 1.79 MiB/s, done.
Resolving deltas: 100% (18148/18148), done.
Checking connectivity... done.
faraday@sv001:~$
faraday@sv001:~$ ls
examples.desktop faraday-dev
faraday@sv001:~$ cd faraday-dev/
faraday@sv001:~/faraday-dev$
サーバーのPython要件確認
faraday@sv001:~/faraday-dev$ more requirements_server.txt
couchdbkit>=0.6.5
restkit>=4.2.2
requests>=2.18.4
flask>=0.12.2
twisted>=17.5.0
sqlalchemy>=1.1.13
pyopenssl>=17.2.0
service_identity>=17.0.0
pyasn1-modules>=0.0.11
faraday@sv001:~/faraday-dev$
Python要件で必要なパッケージインストール
faraday@sv001:~$ sudo apt-get install build-essential ipython python-setuptools \
> python-pip python-dev libssl-dev libffi-dev couchdb \
> pkg-config libssl-dev libffi-dev libxml2-dev \
> libxslt1-dev libfreetype6-dev libpng12-dev
Python 2の依存関係のインストール
faraday@sv001:~/faraday-dev$ sudo pip2 install -r requirements_server.txt
Collecting couchdbkit>=0.6.5 (from -r requirements_server.txt (line 1))
Downloading couchdbkit-0.6.5.tar.gz (81kB)
100% |????????????????????????????????| 81kB 1.7MB/s
Collecting restkit>=4.2.2 (from -r requirements_server.txt (line 2))
Downloading restkit-4.2.2.tar.gz (1.3MB)
100% |????????????????????????????????| 1.3MB 817kB/s
Collecting requests>=2.18.4 (from -r requirements_server.txt (line 3))

~省略~

Successfully built couchdbkit restkit twisted sqlalchemy http-parser socketpool itsdangerous MarkupSafe ipaddress pycparser

Installing collected packages: http-parser, socketpool, restkit, couchdbkit, certifi, chardet, idna, urllib3, requests, MarkupSafe, Jinja2, Werkzeug, click, itsdangerous, flask, zope.interface, constantly, incremental, attrs, six, Automat, hyperlink, twisted, sqlalchemy, pycparser, cffi, enum34, asn1crypto, ipaddress, cryptography, pyopenssl, pyasn1, pyasn1-modules, service-identity
Successfully installed Automat-0.6.0 Jinja2-2.10 MarkupSafe-1.0 Werkzeug-0.14.1 asn1crypto-0.24.0 attrs-17.4.0 certifi-2018.1.18 cffi-1.11.4 chardet-3.0.4 click-6.7 constantly-15.1.0 couchdbkit-0.6.5 cryptography-2.1.4 enum34-1.1.6 flask-0.12.2 http-parser-0.8.3 hyperlink-17.3.1 idna-2.6 incremental-17.5.0 ipaddress-1.0.19 itsdangerous-0.24 pyasn1-0.4.2 pyasn1-modules-0.2.1 pycparser-2.18 pyopenssl-17.5.0 requests-2.18.4 restkit-4.2.2 service-identity-17.0.0 six-1.11.0 socketpool-0.5.3 sqlalchemy-1.2.2 twisted-17.9.0 urllib3-1.22 zope.interface-4.4.3
You are using pip version 8.1.1, however version 9.0.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
faraday@sv001:~/faraday-dev$
CouchDB設定

Ubuntデスクトップからアクセスすると設定用画面が開きます。

おそらく、この時点ではアクセス制限によってローカルからのみしかアクセスできない

URL : http://127.0.0.1:5984/_utils/

f:id:pocket01:20180209202939p:plain

 

操作用PCからCouchDBへの接続許可 ※本来は不要かも

faraday@sv001:~/.faraday/config$ sudo vi /etc/couchdb/local.ini

user@sv001:~$ sudo vi /etc/passwd

【追加】
[httpd]
;bind_address = 127.0.0.1
bind_address = 192.168.20.3

ブラウザからの設定は右側の"configration"から設定が可能

f:id:pocket01:20180211132804p:plain

サーバ起動スクリプト実行①

設定ファイルを自動作成させるために(仮)起動確認のみ実施する

■対象スクリプトのオプションを確認

faraday@sv001:~/faraday-dev$ sudo python2 faraday-server.py --help
[sudo] faraday のパスワード:
usage: faraday-server.py [-h] [--ssl] [--debug] [--start] [--stop] [--nodeps]
[-v]

optional arguments:
-h, --help show this help message and exit
--ssl enable HTTPS
--debug run Faraday Server in debug mode
--start run Faraday Server in background
--stop stop Faraday Server
--nodeps Skip dependency check
-v, --version show program's version number and exit

※バージョン確認
faraday@sv001:~/faraday-dev$ sudo python2 faraday-server.py -v
Faraday v2.7.1
faraday@sv001:~/faraday-dev$

■対象スクリプト実行

faraday@sv001:~/faraday-dev$ sudo python2 faraday-server.py
2018-02-09 20:44:08,321 - faraday-server.server.config - INFO - Local faraday-server configuration created at /home/faraday/.faraday/config/server.ini
2018-02-09 20:44:08,534 - faraday-server.__main__ - INFO - Checking dependencies...
2018-02-09 20:44:08,534 - faraday-server.__main__ - INFO - Dependencies met
Error while opening file.
[Errno 2] No such file or directory: '/home/faraday/.faraday/config/config.xml'. /home/faraday/.faraday/config/config.xml
2018-02-09 20:44:15,688 - faraday-server.server.importer - INFO - Setting up workspace test_suite_db
2018-02-09 20:44:15,706 - faraday-server.server.importer - INFO - Creating database for workspace test_suite_db
2018-02-09 20:44:15,964 - faraday-server.server.importer - INFO - test_suite_db importation done!
2018-02-09 20:44:15,980 - faraday-server.server.importer - INFO - Setting up workspace test_suite_db2
2018-02-09 20:44:16,002 - faraday-server.server.importer - INFO - Creating database for workspace test_suite_db2
2018-02-09 20:44:16,238 - faraday-server.server.importer - INFO - test_suite_db2 importation done!
2018-02-09 20:44:16,754 - faraday-server.__main__ - INFO - Faraday Server is ready

" Ctrl + C "でスクリプトを停止させる。 

リモートからのアクセス許可設定

■設定ファイル”server.ini”の確認

faraday@sv001:~/faraday-dev$ cd /home/faraday/.faraday/config
faraday@sv001:~/.faraday/config$ ls -l
合計 4
-rw-r--r-- 1 root root 186 Feb 9 20:44 server.ini
faraday@sv001:~/.faraday/config$
faraday@sv001:~/.faraday/config$ cat server.ini
[faraday_server]
port=5985
bind_address=localhost

[ssl]
port=6985
certificate=
keyfile=
;keyfile_pwd=''

[couchdb]
host=localhost
port=5984
ssl_port=6984
user=
password=
protocol=http

faraday@sv001:~/.faraday/config$

■設定ファイル修正

変更前:bind_address=localhost

修正後:bind_address=0.0.0.0

faraday@sv001:~/.faraday/config$ sudo vi server.ini
-----------------------------------------------------
[faraday_server]
port=5985
bind_address=0.0.0.0
-----------------------------------------------------
サーバ起動スクリプト実行②
faraday@sv001:~/.faraday/config$ cd ~/faraday-dev/
faraday@sv001:~/faraday-dev$ sudo python2 faraday-server.py
2018-02-09 20:57:38,300 - faraday-server.__main__ - INFO - Checking dependencies...
2018-02-09 20:57:38,300 - faraday-server.__main__ - INFO - Dependencies met
Error while opening file.
[Errno 2] No such file or directory: '/home/faraday/.faraday/config/config.xml'. /home/faraday/.faraday/config/config.xml
2018-02-09 20:57:38,522 - faraday-server.server.importer - INFO - Setting up workspace test_suite_db
2018-02-09 20:57:38,574 - faraday-server.server.importer - INFO - Setting up workspace test_suite_db2
2018-02-09 20:57:38,832 - faraday-server.__main__ - INFO - Faraday Server is ready

Faraday起動確認

■ブラウザを使用してアクセス

URL http://192.168.20.171:5985/_ui/

f:id:pocket01:20180209205856p:plain

 

FarafdayへWorkspacesの登録

■確認

Workspacesの登録情報を確認する。

f:id:pocket01:20180209210517p:plain

Workspacesの登録なし

f:id:pocket01:20180209210147p:plain

■Workspaces作成

 右上のNewから作成

workspace名を入力し、saveを行う・

f:id:pocket01:20180211025056p:plain

Workspacesが追加される

f:id:pocket01:20180211025152p:plain

Faraday(client)インストール

Gitクローン取得

Serverインストール時に取得している場合は実施不要

faraday@sv001:~$ git clone https://github.com/infobyte/faraday.git faraday-dev
サーバーのPython要件確認
faraday@sv001:~/faraday-dev$ pwd
/home/faraday/faraday-dev
faraday@sv001:~/faraday-dev$ more requirements.txt
couchdbkit>=0.6.5
mockito>=1.0.12
whoosh>=2.7.4
IPy>=0.83
restkit>=4.2.2
requests>=2.18.4
tornado>=4.5.1
flask>=0.12.2
colorama>=0.3.9
faraday@sv001:~/faraday-dev$
faraday@sv001:~/faraday-dev$ more requirements_extras.txt
beautifulsoup4>=4.6.0
psycopg2>=2.7.3
w3af_api_client>=1.1.7
faraday@sv001:~/faraday-dev$
faraday@sv001:~/faraday-dev$
Python要件で必要なパッケージインストール
faraday@sv001:~$ sudo apt-get install libpq-dev python-pip \
python-dev gir1.2-gtk-3.0 \
gir1.2-vte-2.91 python-gobject \
zsh curl

※たまにインストール失敗しているので、全て正常にインストール完了することを確認。足りないとクライアントが起動しない。

※Ubuntu 12.04 LTS、またはUbuntu 14.04 LTSは別パッケージとなるため、インストールサイト参考に。

python 2の依存関係のインストール

faraday@sv001:~/faraday-dev$ sudo pip2 install -r requirements.txt
Requirement already satisfied (use --upgrade to upgrade): couchdbkit>=0.6.5 in /usr/local/lib/python2.7/dist-packages (from -r requirements.txt (line 1))
Collecting mockito>=1.0.12 (from -r requirements.txt (line 2))
Downloading mockito-1.0.12.tar.gz
Collecting whoosh>=2.7.4 (from -r requirements.txt (line 3))
Downloading Whoosh-2.7.4-py2.py3-none-any.whl (468kB)
100% |????????????????????????????????| 471kB 1.7MB/s
Collecting IPy>=0.83 (from -r requirements.txt (line 4))
Downloading IPy-0.83.tar.gz

~省略~

 Running setup.py bdist_wheel for tornado ... done

Stored in directory: /home/faraday/.cache/pip/wheels/0c/21/02/8cdc6a381450df92b449ea7c57be653dd7aa80ba42c716212c
Successfully built mockito IPy tornado
Installing collected packages: funcsigs, mockito, whoosh, IPy, singledispatch, backports-abc, tornado, colorama
Successfully installed IPy-0.83 backports-abc-0.5 colorama-0.3.9 funcsigs-1.0.2 mockito-1.0.12 singledispatch-3.4.0.3 tornado-4.5.3 whoosh-2.7.4
You are using pip version 8.1.1, however version 9.0.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
faraday@sv001:~/faraday-dev$

 
X11用のアプリ起動
faradayクライアントの起動①Pythonのライブラリ不足によるWARNINGが発生する

faraday@sv001:~/faraday-dev$ sudo python2 faraday.py
2018-02-11 13:41:11,345 - faraday.launcher - INFO - Checking dependencies...
2018-02-11 13:41:11,346 - faraday.launcher - INFO - Dependencies met

~省略~

2018-02-11 13:45:38,903 - faraday.launcher - INFO - Starting Faraday IDE.
2018-02-11 13:45:38,903 - faraday.launcher - INFO - Checking configuration.
2018-02-11 13:45:38,904 - faraday.launcher - INFO - Setting up plugins.
2018-02-11 13:45:38,904 - faraday.launcher - INFO - Removing old plugins folder.
2018-02-11 13:45:38,930 - faraday.launcher - INFO - Setting up ZSH integration.
2018-02-11 13:45:38,931 - faraday.launcher - INFO - Setting up user configuration.
2018-02-11 13:45:38,933 - faraday.launcher - INFO - Using custom user configuration.
2018-02-11 13:45:38,934 - faraday.launcher - INFO - Setting up icons for GTK interface.
2018-02-11 13:45:38,943 - faraday.launcher - INFO - Setting configuration.
2018-02-11 13:45:39,735 - faraday.launcher - INFO - No updates available, enjoy Faraday.
2018-02-11 13:45:39,918 - faraday.launcher - INFO - All done. Opening environment.
2018-02-11 13:45:39,987 - faraday.PluginManager - WARNING - Please install psycopg2 to use plugin: MetasploitOn
2018-02-11 13:45:40,019 - faraday.PluginManager - WARNING - No module named lxml
2018-02-11 13:45:40,030 - faraday.PluginManager - WARNING - No module named bs4
2018-02-11 13:45:40,034 - faraday.PluginManager - WARNING - No module named lxml
2018-02-11 13:45:42,266 - faraday.launcher - INFO - Main application ExceptHook enabled.
2018-02-11 13:45:42,267 - faraday.launcher - INFO - Starting main application.

~省略~

* faraday ui is ready
Make sure you got couchdb up and running.
If couchdb is up, point your browser to:
http://127.0.0.1:5985/_ui

2018-02-11 13:41:19,952 - faraday - INFO - XMLRPC API server configured on ('localhost', 9876)
2018-02-11 13:41:19,968 - faraday - INFO - REST API server configured on ('localhost', 9977)
2018-02-11 13:41:21,536 - faraday.GTK - ERROR - Workspace untitled wasn't found

 

 

faradayクライアントの起動①Pythonのライブラリ不足によるWARNINGが発生する

■Pythonのライブラリ追加

faraday@sv001:~/faraday-dev$ sudo pip install psycopg2
faraday@sv001:~/faraday-dev$ sudo pip install psycopg2-binary
faraday@sv001:~/faraday-dev$ sudo pip install lxml
faraday@sv001:~/faraday-dev$ sudo pip install bs4

 ■Faradayクライアントの起動

ライブラリに依存するエラーは表示されなくなった。

faraday@sv001:~/faraday-dev$ sudo python2 faraday.py
2018-02-11 13:55:47,213 - faraday.launcher - INFO - Checking dependencies...
2018-02-11 13:55:47,214 - faraday.launcher - INFO - Dependencies met

_____ .___
_/ ____\_____ ____________ __| _/_____ ___.__.
\ __\ \__ \ \_ __ \__ \ / __ | \__ \ < | |
| | / __ \_| | \// __ \_/ /_/ | / __ \_\___ |
|__| (____ /|__| (____ /\____ | (____ // ____|
\/ \/ \/ \/ \/

[*[ Open Source Penetration Test IDE ]*]
Where pwnage goes multiplayer

2018-02-11 13:55:47,221 - faraday.launcher - INFO - Starting Faraday IDE.
2018-02-11 13:55:47,224 - faraday.launcher - INFO - Checking configuration.
2018-02-11 13:55:47,225 - faraday.launcher - INFO - Setting up plugins.
2018-02-11 13:55:47,228 - faraday.launcher - INFO - Removing old plugins folder.
2018-02-11 13:55:47,257 - faraday.launcher - INFO - Setting up ZSH integration.
2018-02-11 13:55:47,258 - faraday.launcher - INFO - Setting up user configuration.
2018-02-11 13:55:47,259 - faraday.launcher - INFO - Using custom user configuration.
2018-02-11 13:55:47,259 - faraday.launcher - INFO - Setting up icons for GTK interface.
2018-02-11 13:55:47,268 - faraday.launcher - INFO - Setting configuration.
2018-02-11 13:55:48,080 - faraday.launcher - INFO - No updates available, enjoy Faraday.
2018-02-11 13:55:48,224 - faraday.launcher - INFO - All done. Opening environment.
2018-02-11 13:55:53,724 - faraday.launcher - INFO - Main application ExceptHook enabled.
2018-02-11 13:55:53,724 - faraday.launcher - INFO - Starting main application.

* faraday ui is ready
Make sure you got couchdb up and running.
If couchdb is up, point your browser to:
http://127.0.0.1:5985/_ui

2018-02-11 13:55:53,728 - faraday - INFO - XMLRPC API server configured on ('localhost', 9877)
2018-02-11 13:55:53,741 - faraday - INFO - REST API server configured on ('localhost', 9978)
2018-02-11 13:55:55,131 - faraday.GTK - ERROR - Workspace untitled wasn't found

 ■FaradayクライアントのX11起動

※今回の環境では、CouchDBで接続許可設定を行わないと、この時に接続できないというようなエラーが出る。

作成したworkspace名を選び、OKを選択する。

f:id:pocket01:20180211135746p:plain

 

f:id:pocket01:20180211140003p:plain