evogix/Evil-Ollama
GitHub: evogix/Evil-Ollama
针对公开暴露的 Ollama LLM 实例的发现、漏洞扫描与代理工具，帮助安全测试人员快速评估 Ollama 服务的安全风险。
Stars: 0 | Forks: 0
```
╔══════════════════════════════════════════════════════════════════════════╗
║ ║
║ ███████╗██╗ ██╗██╗██╗ ██████╗ ██╗ ██╗ █████╗ ║
║ ██╔════╝██║ ██║██║██║ ██╔═══██╗██║ ██║ ██╔══██╗ ║
║ █████╗ ██║ ██║██║██║ ██║ ██║██║ ██║ ███████║ ║
║ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║ ██║██║ ██║ ██╔══██║ ║
║ ███████╗ ╚████╔╝ ██║███████╗ ╚██████╔╝███████╗███████╗██║ ██║ ║
║ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═════╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ║
║ ║
║ ██████╗ ██╗ ██╗ █████╗ ███╗ ███╗ █████╗ ║
║ ██╔══██╗██║ ██║ ██╔══██╗████╗ ████║██╔══██╗ ║
║ ██████╔╝██║ ██║ ███████║██╔████╔██║███████║ ║
║ ██╔═══╝ ██║ ██║ ██╔══██║██║╚██╔╝██║██╔══██║ ║
║ ██║ ███████╗███████╗██║ ██║██║ ╚═╝ ██║██║ ██║ ║
║ ╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ║
║ ║
║ 🔥 Exposed Ollama Instance Hunter v3.0 🔥 ║
║ Find · Exploit · Proxy · PWN ║
║ ║
║ [ For Authorized Security Testing Only ] ║
║ ║
╚══════════════════════════════════════════════════════════════════════════╝
```
# 🦙 EVIL-OLLAMA
```
╔══════════════════════════════════════════════════════════════════════════╗
║ [+] TARGET: Any exposed Ollama instance ║
║ [+] METHOD: Async TCP · DNS · CT Logs · Shodan · Censys · FOFA ║
║ [+] VULN SCAN: Auth · CVE-2024-37032 · SSRF · CORS · Metrics ║
║ [+] PROXY: OpenAI-compatible · Chat · Generate ║
║ [+] STATUS: ACTIVE ║
╚══════════════════════════════════════════════════════════════════════════╝
```
## 🔥 功能
| 类别 | 功能 |
|----------|----------|
| **🔍 扫描** | 随机 IP (加权) · CIDR · IP 列表 · DNS 发现 · CT Logs · Shodan · Censys · FOFA · **共 9 种方法** |
| **💀 漏洞** | 认证检查 · CVE-2024-37032 (RCE) · 模型创建/删除 · CORS · SSRF · Metrics · 信息泄露 · Timing · **共 10 项检查** |
| **🔌 代理** | 兼容 OpenAI SDK · 流式传输 · 完整 API 转发 · 所有 HTTP 方法 |
| **💬 聊天** | 交互式 · 批处理模式 · System prompts · Temperature · 原始 API |
| **🔎 指纹** | 18 个 endpoint · GPU 检测 · 模型分析 · 大小计算 · 运行中的模型 |
| **📦 模型** | 列表 · Pull 信息 · 深度分析 · 大小明细 |
| **📊 导出** | HTML (精美) · CSV · JSON · 漏洞统计 · 地理分布 |
| **🤖 自动化 PWN** | 扫描 → 漏洞扫描 → 地理定位 → 代理 → 报告 — **一条命令搞定** |
| **📡 监控** | 纯 CLI daemon · Telegram 告警 · 自动导出 |
## ⚡ 快速开始
### 🛠 安装
```
git clone https://github.com/evogix/Evil-Ollama
cd Evil-Ollama
pip install aiohttp flask requests
chmod +x launcher.sh
```
### 🎯 基础扫描
```
# 扫描 10000 个随机 IP 以查找 Ollama 实例
./launcher.sh scan --random 10000
# 带 geolocation 扫描 + 导出
./launcher.sh scan --random 10000 --geo --export html --notify
```
## 💀 命令
### 🔍 扫描
```
# 随机 IP 扫描（根据真实世界密度加权）
./launcher.sh scan --random 10000
# CIDR 范围扫描
./launcher.sh scan --cidr 0.0.0.0/8
# DNS 发现 — 查找 ollama.example.com, ai.example.com 等
./launcher.sh scan --dns example.com
# Certificate Transparency 日志发现
./launcher.sh scan --ct example.com
# Internet DB 搜索
./launcher.sh scan --shodan API_KEY
./launcher.sh scan --censys ID:SECRET
./launcher.sh scan --fofa EMAIL:KEY
# 带 extras 扫描
./launcher.sh scan --random 5000 --geo --export html --notify
```
### 💀 漏洞扫描
```
# 扫描特定实例
./launcher.sh vuln --target 1.2.3.4:11434
# 扫描所有找到的实例
./launcher.sh vuln --all
# 利用特定 CVE
./launcher.sh exploit --cve CVE-2024-37032 --target 1.2.3.4:11434
```
漏洞检查项：
```
💀 [CRITICAL] CVE-2024-37032 — RCE via Crafted Model Import
💀 [HIGH ] No Authentication — Open API access
💀 [HIGH ] Unauthenticated Model Creation
💀 [HIGH ] Unauthenticated Model Deletion
💀 [HIGH ] CVE-2024-39721 — SSRF in Model Pulling
💀 [MEDIUM ] CORS Misconfiguration
💀 [MEDIUM ] Prometheus Metrics Exposed
💀 [LOW ] Server Information Disclosure
💀 [LOW ] No CSRF Protection
💀 [LOW ] Response Timing Leak
```
### 🔌 代理 (兼容 OpenAI)
```
# 启动到远程 Ollama 的代理
./launcher.sh proxy --target 1.2.3.4:11434 --port 8080
# 配合 OpenAI SDK 使用：
# from openai import OpenAI
# client = OpenAI(base_url="http://127.0.0.1:8080/v1/", api_key="ollama")
```
### 💬 交互式聊天
```
# 与远程模型聊天
./launcher.sh chat --target 1.2.3.4:11434
# 从文件批量执行 prompts
./launcher.sh chat --batch prompts.txt --target 1.2.3.4:11434
# 聊天命令：/help, /models, /clear, /model N, /system, /temp, /raw, /info, /export
```
### 🔎 深度指纹
```
# 对单个实例进行指纹识别
./launcher.sh fingerprint --target 1.2.3.4:11434
# 对所有找到的实例进行指纹识别
./launcher.sh fingerprint --all
```
检查包括在内的 18 个 endpoint：`/api/tags`, `/api/version`, `/api/ps`, `/api/show`, `/api/blobs`, `/api/pull`, `/api/push`, `/api/create`, `/api/delete`, `/api/copy`, `/api/embed`, `/v1/models`, `/docs`, `/metrics`, `/debug`, `/health`, `/status`
### 📦 模型操作
```
# 列出模型及详细信息
./launcher.sh models --target 1.2.3.4:11434
# 拉取模型 info/config
./launcher.sh models --pull 1.2.3.4:11434 llama3.2
# 深度分析模型
./launcher.sh models --analyze 1.2.3.4:11434 llama3.2
```
### 📊 导出
```
./launcher.sh export --format html # Beautiful HTML report with geo & vuln stats
./launcher.sh export --format csv # CSV for analysis
./launcher.sh export --format json # Raw JSON
./launcher.sh export --format all # All formats
```
### 🤖 自动化 PWN (一条命令)
```
# 扫描 → 漏洞扫描 → 地理定位 → 代理 → 报告
./launcher.sh autopwn --random 5000
```
### 📡 监控 Daemon
```
# 持续扫描（仅限 CLI，无 web）
./launcher.sh monitor --interval 3600 --random 5000 --notify --export html
```
### ⚙️ 配置
```
./launcher.sh config --show # Show config
./launcher.sh config --telegram-token "BOT_TOKEN" # Telegram alerts
./launcher.sh config --telegram-chat "CHAT_ID"
./launcher.sh config --shodan-key "API_KEY"
./launcher.sh config --set scan_timeout 3 # Custom setting
```
## 📊 示例输出
```
╔══════════════════════════════════════════════════════════════════╗
║ 🦙 EVIL-OLLAMA v3.0 ║
╚══════════════════════════════════════════════════════════════════╝
[12:30:01] [▶ STEP ] Step 1/4: Scanning 5000 random IPs...
[12:30:01] [🎯 INFO] Scanning 5000 hosts on port 11434 (concurrency: 1000)
[░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░] 45% | 2250/5000 | 850/s | Found: 12 | ETA: 3.2s
[12:30:07] [🦙 FOUND] 203.0.113.42:11434 | v0.1.32 | llama3.2, mistral, codellama
[12:30:07] [🦙 FOUND] 198.51.100.73:11434 | v0.3.0 | llama3.1, nomic-embed-text
[...]
[12:30:10] [▶ STEP ] Step 2/4: Geolocating...
[12:30:10] [📍 GEO ] 203.0.113.42 → San Francisco, US | DigitalOcean
[12:30:11] [📍 GEO ] 198.51.100.73 → London, UK | Hetzner
[12:30:11] [▶ STEP ] Step 3/4: Vulnerability scanning...
[12:30:11] [🔴 VULN] 203.0.113.42:11434
💀 [HIGH ] No Authentication Required
💀 [CRITICAL] Potential RCE via Crafted Model Import (CVE-2024-37032)
💀 [HIGH ] Unauthenticated Model Creation
[12:30:14] [▶ STEP ] Step 4/4: Generating report...
[12:30:14] [📄 OK ] HTML report saved: evilollama_report.html (45.2 KB)
╔══════════════════════════════════════════════════════════════════╗
║ 🚀 AUTO-PWN COMPLETE ║
║ Instances found: 7 ║
║ Total models: 23 ║
║ Vulnerabilities: 12 ║
║ CVEs detected: 5 ║
║ Report: evilollama_report.html ║
╚══════════════════════════════════════════════════════════════════╝
[12:30:15] [🔌 PROXY] Proxy → 127.0.0.1:9090 → 203.0.113.42:11434
```
## 🛡️ CVE 数据库
| CVE ID | 严重程度 | CVSS | 描述 | 受影响版本 |
|--------|----------|------|-------------|-------------------|
| CVE-2024-37032 | **严重** | 9.1 | 通过构造的模型文件执行 RCE (路径遍历) | < 0.1.47 |
| CVE-2024-39720 | **高危** | 7.5 | 通过构造的 system prompt 进行 Prompt injection | < 0.1.34 |
| CVE-2024-39721 | **高危** | 7.5 | 模型拉取机制中的 SSRF | < 0.1.34 |
| CVE-2024-39722 | **高危** | 7.3 | API endpoint 中的路径遍历 | < 0.1.34 |
| CVE-2025-23104 | **高危** | 8.2 | /api/pull 中的 API 身份验证绕过 | < 0.3.0 |
## 📋 环境要求
```
pip install aiohttp flask requests
```
## ⚠️ 法律免责声明
```
╔══════════════════════════════════════════════════════════════════════════╗
║ ║
║ This tool is for AUTHORIZED SECURITY TESTING only. ║
║ ║
║ Only use on systems you own or have explicit written permission ║
║ to test. Unauthorized scanning or exploitation is ILLEGAL. ║
║ ║
║ The authors assume no liability for misuse. ║
║ ║
╚══════════════════════════════════════════════════════════════════════════╝
```
```
╔══════════════════════════════════════════════════════════════════════════╗
║ EVIL-OLLAMA v3.0 · https://github.com/evogix/Evil-Ollama ║
║ For authorized security research & bug bounty purposes only ║
╚══════════════════════════════════════════════════════════════════════════╝
```
标签：AI安全, Chat Copilot, LLM, LLM评估, Ollama, Unmanaged PE, XXE攻击, 字符串匹配, 实时处理, 密码管理, 应用安全, 插件系统, 逆向工具