def parse_path(self,fpath): sections=fpath.split('/') finalpath='' if len(sections) > 1: if sections[1] != '': for pi in plugins.get_xml(): if (pi.get('id') == sections[1]): finalpath = '/plugins'+fpath if finalpath =='': finalpath = '/w'+fpath return finalpath
def do_POST(self): # Parse the form data posted form = cgi.FieldStorage( fp=self.rfile, headers=self.headers, environ={'REQUEST_METHOD':'POST', 'CONTENT_TYPE':self.headers['Content-Type'], }) # Module manager results = {'poc':'','message':'','action':'','data':''} plugin_id='' action='' url='' cookies='' headers='' postdata='' pocid='' global current_target for field in form.keys(): if field == 'plugin': plugin_id=form[field].value elif field == 'action': action=form[field].value elif field == 'url': url=form[field].value elif field == 'cookies': cookies=form[field].value elif field == 'headers': headers=form[field].value elif field == 'postdata': postdata=form[field].value elif field == 'pocid': pocid=form[field].value if headers=='': headers=self.headers if action == 'you_ok?': self.send_response(200) self.end_headers() self.wfile.write('yes') return try: if (plugin_id != '') and (action!=''): for pi in plugins.get_xml(): if (pi.get('id') == plugin_id): if (action == 'get_info'): print 'Get Plugin info for:'+plugin_id results['poc']='true' results['data']='name<:>'+str(pi.get('name'))+'<;>description<:>'+str(pi.get('description'))+'<;>author<:>'+str(pi.get('author')) if (pi.get('mod') != None and pi.get('mod') != ''): print pi.get('mod') client_action='pyttacker' else: client_action='go' for poc in pi.findall('poc'): #Carefully take care of the payload payload=str(poc.get('payload')) if (payload != 'None'): payload = server_process(payload) payload = escape(payload) else: payload='' results['action']+=str(poc.get('id'))+'<:>'+str(poc.get('name'))+'<:>'+client_action+'<:>'+payload+'<;>' else: print 'Performing action '+action+' in Plugin:'+plugin_id if (url!=''): for poc in pi.findall('poc'): if str(poc.get('id'))==action: results=plugins.run_module(plugin_id, action, url, headers, cookies, postdata) if (results['action']=='go_payload'): current_target=url print 'Target: ',current_target else: print 'Error: Plugin ID and Action are required fields' if results['poc'] != '': self.send_response(200) self.end_headers() self.wfile.write('poc<=>'+results['poc']+'<|>message<=>'+results['message']+'<|>action<=>'+results['action']+'<|>data<=>'+results['data']) else: self.send_response(500) self.end_headers() self.wfile.write('Error: 500 Function or method not implemented: ') print 'Error:',500,'Function or method not implemented: ',plugin_id except Exception as inst: self.send_response(500) self.end_headers() self.wfile.write('Error: 500 Exception: ') print 'Error:',500,'Exception: ',inst