Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e4699f3

Browse files
committed
some bug fixes regarding --os-shell usage against windows servers
1 parent ea045ea commit e4699f3

3 files changed

Lines changed: 12 additions & 5 deletions

File tree

lib/core/common.py

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ def getDocRoot():
235235
absFilePath = normalizePath(absFilePath)
236236
absFilePathWin = None
237237

238-
if re.match("[A-Za-z]:([\\/][\w.\\/]*)?", absFilePath):
238+
if isWindowsPath(absFilePath):
239239
absFilePathWin = absFilePath.replace("/", "\\")
240240
absFilePath = absFilePath[2:].replace("\\", "/")
241241

@@ -282,7 +282,10 @@ def getDirs():
282282

283283
for absFilePath in kb.absFilePaths:
284284
if absFilePath:
285-
directories.add(directoryPath(absFilePath))
285+
directory = directoryPath(absFilePath)
286+
if isWindowsPath(directory):
287+
directory = directory.replace('\\', '/')
288+
directories.add(directory)
286289
else:
287290
warnMsg = "unable to retrieve any web server path"
288291
logger.warn(warnMsg)
@@ -902,3 +905,6 @@ def decloakToMkstemp(filepath, **kwargs):
902905
retVal.write(decloak(filepath))
903906
retVal.seek(0)
904907
return retVal
908+
909+
def isWindowsPath(filepath):
910+
return re.search("\A[A-Za-z]:", filepath) is not None

lib/request/basic.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
import zlib
3030

3131
from lib.core.common import directoryPath
32+
from lib.core.common import isWindowsPath
3233
from lib.core.common import urlEncodeCookieValues
3334
from lib.core.data import conf
3435
from lib.core.data import kb
@@ -81,7 +82,7 @@ def parseResponse(page, headers):
8182
for match in reobj.finditer(page):
8283
absFilePath = match.group("result").strip()
8384
page = page.replace(absFilePath, "")
84-
if re.search("\A[A-Za-z]:", absFilePath):
85+
if isWindowsPath(absFilePath):
8586
absFilePath = absFilePath.replace("/", "\\")
8687
if absFilePath not in kb.absFilePaths:
8788
kb.absFilePaths.add(absFilePath)

lib/takeover/web.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from lib.core.common import fileToStr
3232
from lib.core.common import getDirs
3333
from lib.core.common import getDocRoot
34+
from lib.core.common import isWindowsPath
3435
from lib.core.common import normalizePath
3536
from lib.core.common import readInput
3637
from lib.core.convert import hexencode
@@ -165,7 +166,6 @@ def webInit(self):
165166

166167
for directory in directories:
167168
# Upload the uploader agent
168-
169169
outFile = normalizePath("%s/%s" % (directory, uploaderName))
170170
uplQuery = uploaderContent.replace("WRITABLE_DIR", directory)
171171
query = " LIMIT 1 INTO OUTFILE '%s' " % outFile
@@ -176,7 +176,7 @@ def webInit(self):
176176
page = Request.queryPage(payload)
177177

178178
requestDir = directory.replace('\\', '/').replace(kb.docRoot.replace('\\', '/'), "/").replace("//", "/")
179-
if re.search("\A[A-Za-z]:", requestDir):
179+
if isWindowsPath(requestDir):
180180
requestDir = requestDir[2:]
181181
requestDir = normalizePath(requestDir)
182182
self.webBaseUrl = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, requestDir)

0 commit comments

Comments
 (0)