One Hat Cyber Team

View File Name : cgishell.cgi

#!/usr/bin/python
##!/usr/bin/env python
"""CGI shell server

This exposes a shell terminal on a web page.
It uses AJAX to send keys and receive screen updates.
The client web browser needs nothing but CSS and Javascript.

    --hostname : sets the remote host name to open an ssh connection to.
    --username : sets the user name to login with
    --password : (optional) sets the password to login with
    --port     : set the local port for the server to listen on
    --watch    : show the virtual screen after each client request

This project is probably not the most security conscious thing I've ever built.
This should be considered an experimental tool -- at best.
"""

from __future__ import absolute_import
from __future__ import print_function

import sys,os
sys.path.insert (0,os.getcwd()) # let local modules precede any installed modules
import socket, random, string, traceback, cgi, time, getopt, getpass, threading, resource, signal
import pxssh, pexpect, ANSI

def exit_with_usage(exit_code=1):
    print(globals()['__doc__'])
    os._exit(exit_code)

def client (command, host='localhost', port=-1):
    """This sends a request to the server and returns the response.
    If port <= 0 then host is assumed to be the filename of a Unix domain socket.
    If port > 0 then host is an inet hostname.
    """
    if port <= 0:
        s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
        s.connect(host)
    else:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
    s.send(command)
    data = s.recv (2500)
    s.close()
    return data

def server (hostname, username, password, socket_filename='/tmp/server_sock', daemon_mode = True, verbose=False):
    """This starts and services requests from a client.
        If daemon_mode is True then this forks off a separate daemon process and returns the daemon's pid.
        If daemon_mode is False then this does not return until the server is done.
    """
    if daemon_mode:
        mypid_name = '/tmp/%d.pid' % os.getpid()
        daemon_pid = daemonize(daemon_pid_filename=mypid_name)
        time.sleep(1)
        if daemon_pid != 0:
            os.unlink(mypid_name)
            return daemon_pid

    virtual_screen = ANSI.ANSI (24,80) 
    child = pxssh.pxssh()
    try:
        child.login (hostname, username, password, login_naked=True)
    except:
        return   
    if verbose: print('login OK')
    virtual_screen.write (child.before)
    virtual_screen.write (child.after)

    if os.path.exists(socket_filename): os.remove(socket_filename)
    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    s.bind(socket_filename)
    os.chmod(socket_filename, 0o777)
    if verbose: print('Listen')
    s.listen(1)

    r = roller (endless_poll, (child, child.PROMPT, virtual_screen))
    r.start()
    if verbose: print("started screen-poll-updater in background thread")
    sys.stdout.flush()
    try:
        while True:
            conn, addr = s.accept()
            if verbose: print('Connected by', addr)
            data = conn.recv(1024)
            request = data.split(' ', 1)
            if len(request)>1:
                cmd = request[0].strip()
                arg = request[1].strip()
            else:
                cmd = request[0].strip()
                arg = ''

            if cmd == 'exit':
                r.cancel()
                break
            elif cmd == 'sendline':
                child.sendline (arg)
                time.sleep(0.1)
                shell_window = str(virtual_screen)
            elif cmd == 'send' or cmd=='xsend':
                if cmd=='xsend':
                    arg = arg.decode("hex")
                child.send (arg)
                time.sleep(0.1)
                shell_window = str(virtual_screen)
            elif cmd == 'cursor':
                shell_window = '%x,%x' % (virtual_screen.cur_r, virtual_screen.cur_c)
            elif cmd == 'refresh':
                shell_window = str(virtual_screen)
            elif cmd == 'hash':
                shell_window = str(hash(str(virtual_screen)))

            response = []
            response.append (shell_window)
            if verbose: print('\n'.join(response))
            sent = conn.send('\n'.join(response))
            if sent < len (response):
                if verbose: print("Sent is too short. Some data was cut off.")
            conn.close()
    except e:
        pass
    r.cancel()
    if verbose: print("cleaning up socket")
    s.close()
    if os.path.exists(socket_filename): os.remove(socket_filename)
    if verbose: print("server done!")

class roller (threading.Thread):
    """This class continuously loops a function in a thread.
        This is basically a thin layer around Thread with a
        while loop and a cancel.
    """
    def __init__(self, function, args=[], kwargs={}):
        threading.Thread.__init__(self)
        self.function = function
        self.args = args
        self.kwargs = kwargs
        self.finished = threading.Event()
    def cancel(self):
        """Stop the roller."""
        self.finished.set()
    def run(self):
        while not self.finished.isSet():
            self.function(*self.args, **self.kwargs)

def endless_poll (child, prompt, screen, refresh_timeout=0.1):
    """This keeps the screen updated with the output of the child.
        This will be run in a separate thread. See roller class.
    """
    #child.logfile_read = screen
    try:
        s = child.read_nonblocking(4000, 0.1)
        screen.write(s)
    except:
        pass

def daemonize (stdin=None, stdout=None, stderr=None, daemon_pid_filename=None):
    """This runs the current process in the background as a daemon.
    The arguments stdin, stdout, stderr allow you to set the filename that the daemon reads and writes to.
    If they are set to None then all stdio for the daemon will be directed to /dev/null.
    If daemon_pid_filename is set then the pid of the daemon will be written to it as plain text
    and the pid will be returned. If daemon_pid_filename is None then this will return None.
    """
    UMASK = 0
    WORKINGDIR = "/"
    MAXFD = 1024

    # The stdio file descriptors are redirected to /dev/null by default.
    if hasattr(os, "devnull"):
        DEVNULL = os.devnull
    else:
        DEVNULL = "/dev/null"
    if stdin is None: stdin = DEVNULL
    if stdout is None: stdout = DEVNULL
    if stderr is None: stderr = DEVNULL

    try:
        pid = os.fork() # fork first child
    except OSError as e:
        raise Exception("%s [%d]" % (e.strerror, e.errno))

    if pid != 0: 
        os.waitpid(pid,0)
        if daemon_pid_filename is not None:
            daemon_pid = int(file(daemon_pid_filename,'r').read())
            return daemon_pid
        else:
            return None

    # first child
    os.setsid()
    signal.signal(signal.SIGHUP, signal.SIG_IGN)

    try:
        pid = os.fork() # fork second child
    except OSError as e:
        raise Exception("%s [%d]" % (e.strerror, e.errno))

    if pid != 0:
        if daemon_pid_filename is not None:
            file(daemon_pid_filename,'w').write(str(pid))
        os._exit(0) # exit parent (the first child) of the second child.

    # second child
    os.chdir(WORKINGDIR)
    os.umask(UMASK)

    maxfd = resource.getrlimit(resource.RLIMIT_NOFILE)[1]
    if maxfd == resource.RLIM_INFINITY:
        maxfd = MAXFD
  
    # close all file descriptors
    for fd in range(0, maxfd):
        try:
            os.close(fd)
        except OSError:   # fd wasn't open to begin with (ignored)
            pass

    os.open (DEVNULL, os.O_RDWR)  # standard input

    # redirect standard file descriptors
    si = open(stdin, 'r')
    so = open(stdout, 'a+')
    se = open(stderr, 'a+', 0)
    os.dup2(si.fileno(), sys.stdin.fileno())
    os.dup2(so.fileno(), sys.stdout.fileno())
    os.dup2(se.fileno(), sys.stderr.fileno())

    return 0

def client_cgi ():
    """This handles the request if this script was called as a cgi.
    """
    sys.stderr = sys.stdout
    ajax_mode = False
    TITLE="Shell"
    SHELL_OUTPUT=""
    SID="NOT"
    print("Content-type: text/html;charset=utf-8\r\n")
    try:
        form = cgi.FieldStorage()
        if 'ajax' in form:
            ajax_mode = True
            ajax_cmd = form['ajax'].value
            SID=form['sid'].value
            if ajax_cmd == 'send':
                command = 'xsend'
                arg = form['arg'].value.encode('hex')
                result = client (command + ' ' + arg, '/tmp/'+SID)
                print(result)
            elif ajax_cmd == 'refresh':
                command = 'refresh'
                result = client (command, '/tmp/'+SID)
                print(result)
            elif ajax_cmd == 'cursor':
                command = 'cursor'
                result = client (command, '/tmp/'+SID)
                print(result)
            elif ajax_cmd == 'exit':
                command = 'exit'
                result = client (command, '/tmp/'+SID)
                print(result)
            elif ajax_cmd == 'hash':
                command = 'hash'
                result = client (command, '/tmp/'+SID)
                print(result)
        elif 'sid' not in form:
            SID=random_sid()
            print(LOGIN_HTML % locals());
        else:
            SID=form['sid'].value
            if 'start_server' in form:
                USERNAME = form['username'].value
                PASSWORD = form['password'].value
                dpid = server ('127.0.0.1', USERNAME, PASSWORD, '/tmp/'+SID)
                SHELL_OUTPUT="daemon pid: " + str(dpid)
            else:
                if 'cli' in form:
                    command = 'sendline ' + form['cli'].value
                else:
                    command = 'sendline'
                SHELL_OUTPUT = client (command, '/tmp/'+SID)
            print(CGISH_HTML % locals())
    except:
        tb_dump = traceback.format_exc()
        if ajax_mode:
            print(str(tb_dump))
        else:
            SHELL_OUTPUT=str(tb_dump)
            print(CGISH_HTML % locals())

def server_cli():
    """This is the command line interface to starting the server.
    This handles things if the script was not called as a CGI
    (if you run it from the command line).
    """
    try:
        optlist, args = getopt.getopt(sys.argv[1:], 'h?d', ['help','h','?', 'hostname=', 'username=', 'password=', 'port=', 'watch'])
    except Exception as e:
        print(str(e))
        exit_with_usage()

    command_line_options = dict(optlist)
    options = dict(optlist)
    # There are a million ways to cry for help. These are but a few of them.
    if [elem for elem in command_line_options if elem in ['-h','--h','-?','--?','--help']]:
        exit_with_usage(0)
  
    hostname = "127.0.0.1"
    #port = 1664
    username = os.getenv('USER')
    password = ""
    daemon_mode = False
    if '-d' in options:
        daemon_mode = True
    if '--watch' in options:
        watch_mode = True
    else:
        watch_mode = False
    if '--hostname' in options:
        hostname = options['--hostname']
    if '--port' in options:
        port = int(options['--port'])
    if '--username' in options:
        username = options['--username']
    if '--password' in options:
        password = options['--password']
    else:
        password = getpass.getpass('password: ')
   
    server (hostname, username, password, '/tmp/mysock', daemon_mode)

def random_sid ():
    a=random.randint(0,65535)
    b=random.randint(0,65535)
    return '%04x%04x.sid' % (a,b)

def parse_host_connect_string (hcs):
    """This parses a host connection string in the form
    username:password@hostname:port. All fields are options expcet hostname. A
    dictionary is returned with all four keys. Keys that were not included are
    set to empty strings ''. Note that if your password has the '@' character
    then you must backslash escape it.
    """
    if '@' in hcs:
        p = re.compile (r'(?P<username>[^@:]*)(:?)(?P<password>.*)(?!\\)@(?P<hostname>[^:]*):?(?P<port>[0-9]*)')
    else:
        p = re.compile (r'(?P<username>)(?P<password>)(?P<hostname>[^:]*):?(?P<port>[0-9]*)')
    m = p.search (hcs)
    d = m.groupdict()
    d['password'] = d['password'].replace('\\@','@')
    return d
     
def pretty_box (s, rows=24, cols=80):
    """This puts an ASCII text box around the given string.
    """
    top_bot = '+' + '-'*cols + '+\n'
    return top_bot + '\n'.join(['|'+line+'|' for line in s.split('\n')]) + '\n' + top_bot

def main ():
    if os.getenv('REQUEST_METHOD') is None:
        server_cli()
    else:
        client_cgi()

# It's mostly HTML and Javascript from here on out.
CGISH_HTML="""<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>%(TITLE)s %(SID)s</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type=text/css>
a {color: #9f9; text-decoration: none}
a:hover {color: #0f0}
hr {color: #0f0}
html,body,textarea,input,form
{
font-family: "Courier New", Courier, mono; 
font-size: 8pt; 
color: #0c0;
background-color: #020;
margin:0;
padding:0;
border:0;
}
input { background-color: #010; }
textarea {
border-width:1;
border-style:solid;
border-color:#0c0;
padding:3;
margin:3;
}
</style>

<script language="JavaScript">
function focus_first()
{if (document.forms.length > 0)
{var TForm = document.forms[0];
for (i=0;i<TForm.length;i++){
if ((TForm.elements[i].type=="text")||
(TForm.elements[i].type=="textarea")||
(TForm.elements[i].type.toString().charAt(0)=="s"))
{document.forms[0].elements[i].focus();break;}}}}

// JavaScript Virtual Keyboard
// If you like this code then buy me a sandwich.
// Noah Spurrier <noah@noah.org>
var flag_shift=0;
var flag_shiftlock=0;
var flag_ctrl=0;
var ButtonOnColor="#ee0";

function init ()
{
    // hack to set quote key to show both single quote and double quote
    document.form['quote'].value = "'" + '  "';
    //refresh_screen();
    poll();
    document.form["cli"].focus();
}
function get_password ()
{
    var username = prompt("username?","");
    var password = prompt("password?","");
    start_server (username, password);
}
function multibrowser_ajax ()
{
    var xmlHttp = false;
/*@cc_on @*/
/*@if (@_jscript_version >= 5)
    try
    {
        xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");
    }
    catch (e)
    {
        try
        {
            xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
        }
        catch (e2)
        {
              xmlHttp = false;
        }
    }
@end @*/

    if (!xmlHttp && typeof XMLHttpRequest != 'undefined')
    {
        xmlHttp = new XMLHttpRequest();
    }
    return xmlHttp;
}
function load_url_to_screen(url)
{ 
    xmlhttp = multibrowser_ajax();
    //window.XMLHttpRequest?new XMLHttpRequest(): new ActiveXObject("Microsoft.XMLHTTP");
    xmlhttp.onreadystatechange = update_virtual_screen;
    xmlhttp.open("GET", url);
    xmlhttp.setRequestHeader("If-Modified-Since", "Sat, 1 Jan 2000 00:00:00 GMT");
    xmlhttp.send(null);
}
function update_virtual_screen()
{
    if ((xmlhttp.readyState == 4) && (xmlhttp.status == 200))
    {
        var screen_text = xmlhttp.responseText;
        document.form["screen_text"].value = screen_text;
        //var json_data = json_parse(xmlhttp.responseText);
    }
}
function poll()
{
    refresh_screen();
    timerID  = setTimeout("poll()", 2000);
    // clearTimeout(timerID);
}
//function start_server (username, password)
//{
//    load_url_to_screen('cgishell.cgi?ajax=serverstart&username=' + escape(username) + '&password=' + escape(password);
//}
function refresh_screen()
{
    load_url_to_screen('cgishell.cgi?ajax=refresh&sid=%(SID)s');
}
function query_hash()
{
    load_url_to_screen('cgishell.cgi?ajax=hash&sid=%(SID)s');
}
function query_cursor()
{
    load_url_to_screen('cgishell.cgi?ajax=cursor&sid=%(SID)s');
}
function exit_server()
{
    load_url_to_screen('cgishell.cgi?ajax=exit&sid=%(SID)s');
}
function type_key (chars)
{
    var ch = '?';
    if (flag_shiftlock || flag_shift)
    {
        ch = chars.substr(1,1);
    }
    else if (flag_ctrl)
    {
        ch = chars.substr(2,1);
    }
    else
    {
        ch = chars.substr(0,1);
    }
    load_url_to_screen('cgishell.cgi?ajax=send&sid=%(SID)s&arg=' + escape(ch));
    if (flag_shift || flag_ctrl)
    {
        flag_shift = 0;
        flag_ctrl = 0;
    }
    update_button_colors();
}

function key_shiftlock()
{
    flag_ctrl = 0;
    flag_shift = 0;
    if (flag_shiftlock)
    {
        flag_shiftlock = 0;
    }
    else
    {
        flag_shiftlock = 1;
    }
    update_button_colors();
}

function key_shift()
{
    if (flag_shift)
    {
        flag_shift = 0;
    }
    else
    {
        flag_ctrl = 0;
        flag_shiftlock = 0;
        flag_shift = 1;
    }
    update_button_colors(); 
}
function key_ctrl ()
{
    if (flag_ctrl)
    {
        flag_ctrl = 0;
    }
    else
    {
        flag_ctrl = 1;
        flag_shiftlock = 0;
        flag_shift = 0;
    }
    
    update_button_colors();
}
function update_button_colors ()
{
    if (flag_ctrl)
    {
        document.form['Ctrl'].style.backgroundColor = ButtonOnColor;
        document.form['Ctrl2'].style.backgroundColor = ButtonOnColor;
    }
    else
    {
        document.form['Ctrl'].style.backgroundColor = document.form.style.backgroundColor;
        document.form['Ctrl2'].style.backgroundColor = document.form.style.backgroundColor;
    }
    if (flag_shift)
    {
        document.form['Shift'].style.backgroundColor = ButtonOnColor;
        document.form['Shift2'].style.backgroundColor = ButtonOnColor;
    }
    else
    {
        document.form['Shift'].style.backgroundColor = document.form.style.backgroundColor;
        document.form['Shift2'].style.backgroundColor = document.form.style.backgroundColor;
    }
    if (flag_shiftlock)
    {
        document.form['ShiftLock'].style.backgroundColor = ButtonOnColor;
    }
    else
    {
        document.form['ShiftLock'].style.backgroundColor = document.form.style.backgroundColor;
    }
    
}
function keyHandler(e)
{
    var pressedKey;
    if (document.all)    { e = window.event; }
    if (document.layers) { pressedKey = e.which; }
    if (document.all)    { pressedKey = e.keyCode; }
    pressedCharacter = String.fromCharCode(pressedKey);
    type_key(pressedCharacter+pressedCharacter+pressedCharacter);
    alert(pressedCharacter);
//    alert(' Character = ' + pressedCharacter + ' [Decimal value = ' + pressedKey + ']');
}
//document.onkeypress = keyHandler;
//if (document.layers)
//    document.captureEvents(Event.KEYPRESS);
//http://sniptools.com/jskeys
//document.onkeyup = KeyCheck;       
function KeyCheck(e)
{
    var KeyID = (window.event) ? event.keyCode : e.keyCode;
    type_key(String.fromCharCode(KeyID));
    e.cancelBubble = true;
    window.event.cancelBubble = true;
}
</script>

</head>

<body onload="init()">
<form id="form" name="form" action="/cgi-bin/cgishell.cgi" method="POST">
<input name="sid" value="%(SID)s" type="hidden">
<textarea name="screen_text" cols="81" rows="25">%(SHELL_OUTPUT)s
""" LOGIN_HTML=""" Shell Login
""" if __name__ == "__main__": try: main() except Exception as e: print(str(e)) tb_dump = traceback.format_exc() print(str(tb_dump))