Atucom: 2020

Friday, November 20, 2020

AWS EC2 & Quick FTP Server

Sometimes you just need to transfer some files back and forth over FTP and want something quick and easy. There are a couple of caveats to getting a one-liner-ish FTP server running in AWS EC2 or lightsail:

Additional ports must be opened. Lightsail by default opens 80 & 22. You'll have to also open 21 & 8000-9000 for the following to work. Or you know, open it all because yolo.
File transfers must happen in FTP passive mode. This is the default mode of pftp and lftp on Kali. If you use the basic ftp binary, you have to issue the "passive" command after you connect.

Here are the commands to quick-start:

	# Start an EC2 or lightsail box, change security group permissions to allow all ports (or at least 21,8000-9000)
	sudo apt update
	sudo apt install -y python3-pip #because we're not 2.7 cavemen
	sudo pip3 install pyftpdlib
	mkdir /tmp/temp-ftp-dir
	sudo python3 -m pyftpdlib --directory=/tmp/temp-ftp-dir --port=21 --write --debug --nat-address=$(curl ifconfig.io)

	# Connect from Kali:
	pftp example.com
	# login as anonymous with whatever password
	# Transfer files as you'd like

view raw SetupEC2FTP hosted with ❤ by GitHub

Wednesday, July 15, 2020

Python Debugging: Output Function Name and Args

Sprinkling print statements everywhere gets annoying so here is a decorator that does 99% of what I need when it comes to debugging function input.

	def verbose(func):
	def output_args(args, *kwargs):
	print("Called {} with: {}".format(func.__name__, [args, kwargs]))
	func(args, *kwargs)
	return output_args

	@verbose
	def say_thing(thing):
	print(thing)

	say_thing('yolo')

	"""Output:
	Called say_thing with: [('yolo',), {}]
	yolo
	"""

view raw verbose_decorator.py hosted with ❤ by GitHub

Wednesday, February 26, 2020

Simple DLL To Pop A CMD Shell

Below is some sample code to pop a cmd shell upon execution of the DLL. Pretty great for testing various code injection techniques. Compile it as a DLL project in Visual Studio to generate the .dll file.

	// dllmain.cpp : Defines the entry point for the DLL application.
	#include "pch.h"
	#include <stdlib.h>

	BOOL APIENTRY DllMain( HMODULE hModule,
	DWORD ul_reason_for_call,
	LPVOID lpReserved
	)
	{
	system("cmd.exe");
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
	}

view raw PopCMD.dll.cpp hosted with ❤ by GitHub

Wednesday, February 12, 2020

A Better, More Modern, HTML Link Grabber

Lots of examples of HTML <a> link grabbers simply parse the source code of the page for a links and output that. I'm sure I don't need to say that technique is antiquated and doesn't really work that well with modern web applications and front-end frameworks. Everybody and their mother just loves modifying HTML using javascript. The old method would miss that stuff badly.

Take the following HTML file for example:

<html>
    <head>
        <body>
            <a href="http://example.com/plain-html-a-link">html-link</a>
            <a id=jsalink href=placeholder>jsalink</a>
        <script>
            var jslink = document.getElementById("jsalink")
            jslink.href = "http://example.com/js_a_link"
        </script>
        </body>
    </head>
</html>

There are obviously two A links there, but one of them is being modified by JS. This dynamic modification of elements is extremely common today. So what happens if you use the old method of getting A links?

$ curl localhost:8000/jsalink.html 2>/dev/null | grep '<a'
            <a href="http://example.com/plain-html-a-link">html-link</a>
            <a id=jsalink href=placeholder>jsalink</a>

Well that obviously didn't work... How about using the BeautifulSoup python module?

$ python3 atu-getlinks.py http://localhost:8000/jsalink.html
http://example.com/plain-html-a-link
http://localhost:8000/placeholder

Also no...The best way i've found to do it is to actually have a browser engine parse the entire file and execute the JS, and then grab all the a links by issuing a command to the JS interpreter. I wrote the following script to do exactly that. It uses the Chrome browser in headless mode to perform all the parsing, and then via selenium, issues a JS statement to grab all the A links:

	#!/usr/bin/env python3
	from selenium import webdriver
	import argparse
	import re
	from time import sleep


	def get_links(url):
	options = webdriver.ChromeOptions()
	options.add_argument('--ignore-certificate-errors')
	options.add_argument('--headless')
	options.add_argument('--user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36"')
	driver = webdriver.Chrome(options=options)
	driver.get(url)
	sleep(3)
	#return a tags once page is rendered and javascript executed
	a_tags = driver.execute_script('return document.getElementsByTagName("a")')
	for tag in a_tags:
	print(tag.get_attribute('href'))

	if __name__ == '__main__':
	parser = argparse.ArgumentParser()
	parser.add_argument("url" ,help='Target URL to scrape')
	args = parser.parse_args()
	#handle arguments
	if args.url:
	get_links(args.url)
	else:
	exit(1)

view raw selenium-getlinks.py hosted with ❤ by GitHub

Running this results in:

$ python3 selenium-getlinks.py http://localhost:8000/jsalink.html
http://example.com/plain-html-a-link
http://example.com/js_a_link

That's more like it.

PS. This is still not "perfect" since certain frameworks will change content via certain event handlers. This handles some (e.g. DOMContentLoaded), but not others (e.g. onclick events). You kinda just have to deal with that. Making a script to identify changes based on all event handlers would likely be extremely risky.