PathWalk

/*

Code simples para listar paths
para serem abertos com Curl

para testes de Full Path Disclosure

para testar contra erros para ajudar em codereview
mostre local do arquivo do apache

exemplo ./code pasta_site localhost/pasta/ log.txt
entao ele ira usar o curl em cada
url relacionada a
http://localhost/site/pasta_site/View...
http://localhost/site/pasta_site/Controller...

ira salvar em file de log


gcc -o code code.c

$ ./code pasta url log.txt
$ cat logWalk.txt

contact: c00f3r[at]gmail[dot]com
by Cooler_
code test

depois add api do curl faco algo decente
*/
#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <string.h>
#include <errno.h>
#include <dirent.h>
#include <limits.h>
#include <unistd.h>
#include <alloca.h>

#define LOG "logWalk.txt"

void *xmalloc(unsigned int len);
char *StrRep(char *st, char *orig, char *repl,int mim);
char **split(char *src, const char *token, int *total);
char *StrChunk(char *src, const int start, const int count);
int PathWalk(char * dir2find,char *buffer);
void writefile(char *filename,char *msg,int msglen);

int main(int argc, char ** argv)
{
 char *buffer=(char *)xmalloc(PATH_MAX*sizeof(char));
 char *LocalPath=(char *)xmalloc(512*sizeof(char));
 char *CMD=(char *)xmalloc(1024*sizeof(char));
 char **URL;
 int total=128,NumFiles=0,x=0;

 if(strlen(argv[1])>128)
 {
  puts("PATH muito grande");
  return 0;
 }

 if(strlen(argv[2])>256)
 {
  puts("URL muito grande");
  return 0;
 }

 if(strlen(argv[3])>32)
 {
  puts("file de LOG muito grande");
  return 0;
 }

  getcwd(LocalPath, 256);
  NumFiles=PathWalk(argv[1],buffer);

  puts("Listando files");
  puts(buffer);

  puts("Listando array de strings");
  URL=split(buffer,"\n",&NumFiles);
  fprintf(stdout,"Files: %d \n",NumFiles);

 puts("PATHs para evidencia");

  while(x<(NumFiles-1))
  {
// apagando o path inicial "/home/local/app/dir" para "/app/dir"
   URL[x]=StrRep(URL[x],LocalPath,"", 512 );
   URL[x]=StrRep(URL[x],"\n","", 512 );
   puts("---");
   puts(URL[x]);
   puts("---");

   sprintf(CMD,"curl %s%s >> %s",argv[2],URL[x],argv[3]);
   system(CMD);
   sprintf(CMD,"\nPATH: %s\n---\nCMD: curl %s%s >> %s \n---\n",URL[x],argv[2],URL[x],argv[3]);
   writefile(argv[3],CMD,strlen(CMD));

   x++;
  }


 // free(URL);
  free(CMD);
  free(buffer);
  free(LocalPath);
 return 0;
}


void *xmalloc(unsigned int len)
{
 void *ptr;

 ptr=malloc(len);
 if(ptr==NULL)
  fprintf(stderr,"fail malloc with size %d",len);

 return ptr;
}

//string replace
char *StrRep(char *st,char *orig,char *repl,const int mim)
{
 char bufer[mim];
 char *ch;

  if(!(ch = strstr(st, orig)))
   return st;

 strncpy(bufer, st, ch-st);
 bufer[ch-st] = 0;
 sprintf(bufer+(ch-st),"%s%s",repl,ch+strlen(orig));

 char *out=bufer;

 return out;
}

char *StrChunk(char *src, const int start, const int count)
{
 char *tmp;
 tmp = (char *)xmalloc(count+1);
 if (tmp == NULL)
 {
  puts("error");
  return NULL;
 }

 strncpy(tmp, src+start, count);
 tmp[count] = '\0';

 free(tmp);

 return tmp;
}

// simple split return array of strings between string separator
char **split(char *src, const char *token, int *total)
{
 char **str;
 register int i, j, count, item, start;
 int len;

 if(!src || !token)
 {
  *total = 0;
  return NULL;
 }

 count = item = start = 0;
 j = 1;
 len = strlen(src);

 for(i = 0; i < len; i++)
 {
  if(src[i] == *token)
   count++;
 }

 if(!count)
 {
  *total = 0;
  return NULL;
 }

 str = (char **)xmalloc(count * sizeof(char *));
 if(str == NULL)
  puts("error");

 for(i = 0; i < len; i++)
 {
  if(src[i] != *token)
   j++;
  else {
   str[item] = (char *)xmalloc(j-start);
    if (str[item] == NULL)
    {
     puts("error");
     return NULL;
    }
   *(str+item) = StrChunk(src, start, j-1);
   str[item][j-start-1] = '\0';
   item++;
   start = j++;
  }
 }

 *(str+count) = (char *)xmalloc(j);
 if(str[count] == NULL)
  puts("error");

 str[count] = StrChunk(src, start, j);
 str[count][j-start] = '\0';
 *total = ++count;

 free(str);

 return str;
}




int PathWalk(char * dir2find,char *buffer)
{
 DIR *d;
 struct dirent *entry;
 const char *d_name;
 int path_length,counter=0;
 char path[PATH_MAX];
 char dir_name[PATH_MAX];
 char *tmp=(char *)alloca(PATH_MAX*sizeof(char));

  strcpy(dir_name,"");

  if( dir2find[0] != '/')
  {
   getcwd(dir_name, PATH_MAX);
   dir_name[strlen(dir_name)] = '/';
  }
  strncat(dir_name,dir2find,PATH_MAX-strlen(dir_name));
  d=opendir(dir_name);

    if(!d)
    {
     fprintf(stderr, "Cannot open directory '%s': %s\n", dir_name, strerror (errno));
     return;
    }

    while(1)
    {

     entry=readdir(d);

      if(!entry)
       break;

      d_name = entry->d_name;

      if(entry->d_type & DT_DIR)
      {
       if(d_name[0]!='.')
       {

        path_length = snprintf(path, PATH_MAX, "%s/%s", dir_name, d_name);

        if(path_length >= PATH_MAX)
        {
         fprintf (stderr, "Path length has got too long.\n");
         exit (EXIT_FAILURE);
        }

        counter=PathWalk(path,buffer);
       }
      }
      else
      {

       sprintf(tmp,"%s/%s\n",dir_name,d_name);
       strncat(buffer,tmp,strlen(tmp));
       counter++;
      }
    }


    if(closedir(d))
    {
     fprintf (stderr, "Could not close '%s': %s\n",dir_name, strerror (errno));
     exit (EXIT_FAILURE);
    }
  return counter;
}

void writefile(char *filename,char *msg,int msglen)
{
 __asm__(
// syscall open("string", O_CREAT | O_WRONLY, 0644);
   "movl $0x05, %eax\n"
// nosso primeiro argumento
   "movl 8(%ebp), %ebx\n"
// O_CREAT | O_WRONLY
   "movl $1001, %ecx\n"
// aqui você já sabe permissões em octal do unix
   "movl $0644, %edx\n"
   "int $0x80\n"
// fd esta em %eax do open(), movemos para o %ebx para o write()
   "movl %eax, %ebx\n"
// syscall write(fd, message, messageLen);
   "movl $0x04, %eax\n"
// fd em  %ebx para acima
// segundo argumento
   "movl 12(%ebp), %ecx\n"
// 12+4 terceiro argumento nosso
   "movl 16(%ebp), %edx\n"
   "int $0x80\n"
// syscall close(fd);
   "movl $0x06, %eax\n"
// fd still in %ebx
   "int $0x80\n"
 );
}