def view_file(request, api=False): """View File.""" logger.info('Viewing File') try: typ = '' rtyp = '' dat = '' sql_dump = {} if api: fil = request.POST['file'] md5_hash = request.POST['hash'] typ = request.POST['type'] else: fil = request.GET['file'] md5_hash = request.GET['hash'] typ = request.GET['type'] if not is_md5(md5_hash): return print_n_send_error_response(request, 'Invalid Parameters', api) src = os.path.join(settings.UPLD_DIR, md5_hash, 'DYNAMIC_DeviceData/') sfile = os.path.join(src, fil) if not is_safe_path(src, sfile) or is_path_traversal(fil): err = 'Path Traversal Attack Detected' return print_n_send_error_response(request, err, api) with io.open(sfile, mode='r', encoding='ISO-8859-1') as flip: dat = flip.read() if fil.endswith('.xml') and typ == 'xml': rtyp = 'xml' elif typ == 'db': dat = None sql_dump = read_sqlite(sfile) rtyp = 'asciidoc' elif typ == 'others': rtyp = 'asciidoc' else: err = 'File type not supported' return print_n_send_error_response(request, err, api) fil = escape(ntpath.basename(fil)) context = { 'title': fil, 'file': fil, 'data': dat, 'sqlite': sql_dump, 'type': rtyp, 'version': settings.MOBSF_VER, } template = 'general/view.html' if api: return context return render(request, template, context) except Exception: logger.exception('Viewing File') return print_n_send_error_response(request, 'Error Viewing File', api)
def run(request, api=False): """View the source of a file.""" try: logger.info('View Android Source File') exp = 'Error Description' if api: fil = request.POST['file'] md5 = request.POST['hash'] typ = request.POST['type'] viewsource_form = ViewSourceAndroidApiForm(request.POST) else: fil = request.GET['file'] md5 = request.GET['md5'] typ = request.GET['type'] viewsource_form = ViewSourceAndroidForm(request.GET) if not viewsource_form.is_valid(): err = FormUtil.errors_message(viewsource_form) return print_n_send_error_response(request, err, api, exp) base = Path(settings.UPLD_DIR) / md5 if typ == 'smali': src = base / 'smali_source' syntax = 'smali' else: try: src, syntax, _ = find_java_source_folder(base) except StopIteration: msg = 'Invalid Directory Structure' return print_n_send_error_response(request, msg, api) sfile = src / fil if not is_safe_path(src, sfile.as_posix()): msg = 'Path Traversal Detected!' return print_n_send_error_response(request, msg, api) context = { 'title': escape(ntpath.basename(fil)), 'file': escape(ntpath.basename(fil)), 'data': sfile.read_text('utf-8', 'ignore'), 'type': syntax, 'sqlite': {}, 'version': settings.MOBSF_VER, } template = 'general/view.html' if api: return context return render(request, template, context) except Exception as exp: logger.exception('Error Viewing Source') msg = str(exp) exp = exp.__doc__ return print_n_send_error_response(request, msg, api, exp)
def get_script(request): """Get frida scripts from others.""" data = {'status': 'ok', 'content': ''} try: scripts = request.POST.getlist('scripts[]') others = os.path.join(settings.TOOLS_DIR, 'frida_scripts', 'others') script_ct = [] for script in scripts: script_file = os.path.join(others, script + '.js') if not is_safe_path(others, script_file): return json_response(data) if is_file_exists(script_file): script_ct.append(Path(script_file).read_text()) data['content'] = '\n'.join(script_ct) except Exception: pass return json_response(data)
def run(request, api=False): """View iOS Files.""" try: logger.info('View iOS Source File') exp = 'Error Description' file_format = None if api: fil = request.POST['file'] md5_hash = request.POST['hash'] mode = request.POST['type'] viewsource_form = ViewSourceIOSApiForm(request.POST) else: fil = request.GET['file'] md5_hash = request.GET['md5'] mode = request.GET['type'] viewsource_form = ViewSourceIOSForm(request.GET) typ = set_ext_api(fil) if not viewsource_form.is_valid(): err = FormUtil.errors_message(viewsource_form) if api: return err return print_n_send_error_response(request, err, False, exp) base = Path(settings.UPLD_DIR) / md5_hash if mode == 'ipa': src1 = base / 'payload' src2 = base / 'Payload' if src1.exists(): src = src1 elif src2.exists(): src = src2 else: raise Exception('MobSF cannot find Payload directory') elif mode == 'ios': src = base sfile = src / fil sfile = sfile.as_posix() if not is_safe_path(src, sfile): msg = 'Path Traversal Detected!' if api: return {'error': 'Path Traversal Detected!'} return print_n_send_error_response(request, msg, False, exp) dat = '' sql_dump = {} if typ == 'm': file_format = 'cpp' with io.open(sfile, mode='r', encoding='utf8', errors='ignore') as flip: dat = flip.read() elif typ == 'xml': file_format = 'xml' with io.open(sfile, mode='r', encoding='utf8', errors='ignore') as flip: dat = flip.read() elif typ == 'plist': file_format = 'json' dat = biplist.readPlist(sfile) try: dat = json.dumps(dat, indent=4, sort_keys=True) except Exception: pass elif typ == 'db': file_format = 'asciidoc' sql_dump = read_sqlite(sfile) elif typ == 'txt' and fil == 'classdump.txt': file_format = 'cpp' app_dir = os.path.join(settings.UPLD_DIR, md5_hash + '/') cls_dump_file = os.path.join(app_dir, 'classdump.txt') if is_file_exists(cls_dump_file): with io.open(cls_dump_file, mode='r', encoding='utf8', errors='ignore') as flip: dat = flip.read() else: dat = 'Class Dump result not Found' elif typ == 'txt': file_format = 'text' with io.open(sfile, mode='r', encoding='utf8', errors='ignore') as flip: dat = flip.read() else: if api: return {'error': 'Invalid Parameters'} return HttpResponseRedirect('/error/') context = { 'title': escape(ntpath.basename(fil)), 'file': escape(ntpath.basename(fil)), 'type': file_format, 'dat': dat, 'sql': sql_dump, 'version': settings.MOBSF_VER, } template = 'general/view.html' if api: return context return render(request, template, context) except Exception as exp: logger.exception('Error Viewing Source') msg = str(exp) exp = exp.__doc__ if api: return print_n_send_error_response(request, msg, True, exp) return print_n_send_error_response(request, msg, False, exp)
def run(request, api=False): """View the source of a file.""" try: logger.info('View Android Source File') exp = 'Error Description' if api: fil = request.POST['file'] md5 = request.POST['hash'] typ = request.POST['type'] viewsource_form = ViewSourceAndroidApiForm(request.POST) else: fil = request.GET['file'] md5 = request.GET['md5'] typ = request.GET['type'] viewsource_form = ViewSourceAndroidForm(request.GET) if not viewsource_form.is_valid(): err = FormUtil.errors_message(viewsource_form) if api: return err return print_n_send_error_response(request, err, False, exp) if fil.endswith(('.java', '.kt')): if typ == 'eclipse': src = os.path.join(settings.UPLD_DIR, md5 + '/src/') elif typ == 'studio': src = os.path.join( settings.UPLD_DIR, md5 + '/app/src/main/java/') elif typ == 'apk': src = os.path.join( settings.UPLD_DIR, md5 + '/java_source/') elif fil.endswith('.smali'): src = os.path.join(settings.UPLD_DIR, md5 + '/smali_source/') else: msg = 'Not Found' doc = 'File not Found!' is_api = False if api: is_api = True return print_n_send_error_response(request, msg, is_api, doc) sfile = os.path.join(src, fil) if not is_safe_path(src, sfile): msg = 'Path Traversal Detected!' if api: return {'error': 'Path Traversal Detected!'} return print_n_send_error_response(request, msg, False, exp) dat = '' with io.open( sfile, mode='r', encoding='utf8', errors='ignore', ) as file_pointer: dat = file_pointer.read() context = { 'title': escape(ntpath.basename(fil)), 'file': escape(ntpath.basename(fil)), 'dat': dat, 'type': 'java', 'sql': {}, 'version': settings.MOBSF_VER, } template = 'general/view.html' if api: return context return render(request, template, context) except Exception as exp: logger.exception('Error Viewing Source') msg = str(exp) exp = exp.__doc__ if api: return print_n_send_error_response(request, msg, True, exp) else: return print_n_send_error_response(request, msg, False, exp)
def run(request, api=False): """View the source of a file.""" try: logger.info('View Android Source File') exp = 'Error Description' if api: fil = request.POST['file'] md5 = request.POST['hash'] typ = request.POST['type'] viewsource_form = ViewSourceAndroidApiForm(request.POST) else: fil = request.GET['file'] md5 = request.GET['md5'] typ = request.GET['type'] viewsource_form = ViewSourceAndroidForm(request.GET) if not viewsource_form.is_valid(): err = FormUtil.errors_message(viewsource_form) if api: return err return print_n_send_error_response(request, err, False, exp) base = Path(settings.UPLD_DIR) / md5 syntax = 'java' if fil.endswith(('.java', '.kt')): if typ == 'eclipse': src = base / 'src' elif typ == 'studio': src = base / 'app' / 'src' / 'main' / 'java' kt = base / 'app' / 'src' / 'main' / 'kotlin' if not src.exists() and kt.exists(): src = kt syntax = 'kotlin' elif typ == 'apk': src = base / 'java_source' elif fil.endswith('.smali'): src = base / 'smali_source' syntax = 'smali' else: msg = 'Not Found' doc = 'File not Found!' is_api = False if api: is_api = True return print_n_send_error_response(request, msg, is_api, doc) sfile = src / fil if not is_safe_path(src, sfile.as_posix()): msg = 'Path Traversal Detected!' if api: return {'error': 'Path Traversal Detected!'} return print_n_send_error_response(request, msg, False, exp) context = { 'title': escape(ntpath.basename(fil)), 'file': escape(ntpath.basename(fil)), 'data': sfile.read_text('utf-8', 'ignore'), 'type': syntax, 'sqlite': {}, 'version': settings.MOBSF_VER, } template = 'general/view.html' if api: return context return render(request, template, context) except Exception as exp: logger.exception('Error Viewing Source') msg = str(exp) exp = exp.__doc__ if api: return print_n_send_error_response(request, msg, True, exp) else: return print_n_send_error_response(request, msg, False, exp)