feat(server): added more CLI flags. Fixed bug with ASCII85/'<' in SVG

Author: six-two

python/self_unzip_html/cli/__init__.py

@@ -2,6 +2,7 @@
 from enum import Enum
 
 class Subcommand(Enum):
+    SERVE = "serve"
     SVG = "svg"
     HTML = "html"
     SVG_ENCRYPTED = "encrypted-svg"
@@ -27,18 +28,16 @@ def main_wrapped() -> None:
         (Subcommand.HTML_ENCRYPTED, "Create an encrypted HTML smuggling page"),
         (Subcommand.SVG, "Create an unencrypted SVG with HTML smuggling code"),
         (Subcommand.SVG_ENCRYPTED, "Create an encrypted SVG with HTML smuggling code"),
+        (Subcommand.SERVE, "Start a HTTP server that dynamically creates HTML smuggling pages for files in the current directory")
     ]:
         ap_subcommand = subparsers.add_parser(subcommand.value, description=description, help=description)
         ap_subcommand.add_argument("-q", "--quiet", action="store_true", help="minimize console output")
 
+        register_server_argument_parser(ap_subcommand, subcommand)
         register_output_argument_parser(ap_subcommand, subcommand)
         register_action_argument_parser(ap_subcommand, subcommand)
         register_encryption_argument_parser(ap_subcommand, subcommand)
         register_template_argument_parser(ap_subcommand, subcommand)
-    
-    ap_serve = subparsers.add_parser("serve", description="start HTTP server", help="start HTTP server")
-    ap_serve.add_argument("-q", "--quiet", action="store_true", help="minimize console output")
-    register_server_argument_parser(ap_serve)
 
     args = ap.parse_args()
 
@@ -47,12 +46,10 @@ def main_wrapped() -> None:
         PRINT_INFO_MESSAGES = True
 
     if args.encoder == "serve":
-        main_serve(args)
+        start_server(args.bind, args.port, args)
     else:
         main_encode(args)
 
-def main_serve(args):
-    start_server(args.bind, args.port)
 
 def main_encode(args):
     input_data, file_name = read_input_file(args)
@@ -61,7 +58,7 @@ def main_encode(args):
         get_javascript(args, file_name, is_svg(args)),
         get_encryptor(args),
         obscure_action=args.obscure_action,
-        encode_library_as_base64=is_svg(args),
+        encode_library_as_base64=False,
         insert_debug_statements=args.console_log,
         compression_list=get_compression_list(args),
         encoding_list=get_encoding_list(args)

python/self_unzip_html/cli/action.py

@@ -6,18 +6,21 @@
 from ..util import OperationNotImplemented
 
 def register_action_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
-    payload_option_visual_group = ap.add_argument_group("Payload Action")
-    payload_option_mutex = payload_option_visual_group.add_mutually_exclusive_group(required=True)
-    payload_option_mutex.add_argument("--download", nargs="?", metavar="FILE_NAME", const="", help="show a download link to download the payload as a file. If you specify an argument that is used as the name of the file to download")
-    payload_option_mutex.add_argument("--eval", action="store_true", help="pass the payload to eval() to run it as JavaScript code")
-    if subcommand not in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED]:
-        # Setting the innerHTML of a svg.text always resulted in errors. So we do not show this option with SVGs
-        payload_option_mutex.add_argument("--replace", action="store_true", help="replace the page's content with the payload. Use this to compress HTML pages")
-    
-    payload_option_mutex.add_argument("--show-text", action="store_true", help="use this to show plain text. Unlike --replace this does not interpret HTML tags and does not change whitespace")
-    payload_option_mutex.add_argument("--driveby-redirect", metavar="REDIRECT_URL", help="downlaod the payload as a file in the background and immediately redirect the user to another site. Useful for phishing")
-    payload_option_mutex.add_argument("--custom", metavar="YOUR_JAVASCRIPT_CODE", help="run your own action. Provide a JavaScript snippet that uses the decoded payload, which is stored in the 'og_data' variable. Note that data is a byte array, so you likely want to use 'new TextDecoder().decode(og_data)' to convert it to Unicode")
-    payload_option_visual_group.add_argument("--obscure-action", action="store_true", help="obscures the action JavaScript code")
+    if subcommand != Subcommand.SERVE: #@TODO: figure out how to do it later
+        payload_option_visual_group = ap.add_argument_group("Payload Action")
+        payload_option_mutex = payload_option_visual_group.add_mutually_exclusive_group(required=True)
+        payload_option_mutex.add_argument("--download", nargs="?", metavar="FILE_NAME", const="", help="show a download link to download the payload as a file. If you specify an argument that is used as the name of the file to download")
+        payload_option_mutex.add_argument("--eval", action="store_true", help="pass the payload to eval() to run it as JavaScript code")
+        if subcommand not in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED]:
+            # Setting the innerHTML of a svg.text always resulted in errors. So we do not show this option with SVGs
+            payload_option_mutex.add_argument("--replace", action="store_true", help="replace the page's content with the payload. Use this to compress HTML pages")
+        
+        payload_option_mutex.add_argument("--show-text", action="store_true", help="use this to show plain text. Unlike --replace this does not interpret HTML tags and does not change whitespace")
+        payload_option_mutex.add_argument("--driveby-redirect", metavar="REDIRECT_URL", help="downlaod the payload as a file in the background and immediately redirect the user to another site. Useful for phishing")
+        payload_option_mutex.add_argument("--custom", metavar="YOUR_JAVASCRIPT_CODE", help="run your own action. Provide a JavaScript snippet that uses the decoded payload, which is stored in the 'og_data' variable. Note that data is a byte array, so you likely want to use 'new TextDecoder().decode(og_data)' to convert it to Unicode")
+        payload_option_visual_group.add_argument("--obscure-action", action="store_true", help="obscures the action JavaScript code")
+    else:
+        ap.add_argument("--obscure-action", action="store_true", help="obscures the action JavaScript code")
 
 
 def get_javascript(args: Any, file_name: str, is_svg: bool) -> str:

python/self_unzip_html/cli/encryption.py

@@ -4,10 +4,11 @@
 from ..crypto import BaseEncryptor, NullEncryptor
 
 def register_encryption_argument_parser(ap: ArgumentParser, subcommand: Subcommand) -> None:
-    if subcommand in [Subcommand.HTML_ENCRYPTED, Subcommand.SVG_ENCRYPTED]:
+    if subcommand in [Subcommand.HTML_ENCRYPTED, Subcommand.SVG_ENCRYPTED, Subcommand.SERVE]:
+        require_password = subcommand != Subcommand.SERVE
         # Only show encryption options when an encrypted subcommand is used
         ap_encryption = ap.add_argument_group("Encryption Options")
-        ap_encryption.add_argument("-p", "--password", required=True, help="encrypt the compressed data using this password")
+        ap_encryption.add_argument("-p", "--password", required=require_password, help="encrypt the compressed data using this password")
         ap_encryption.add_argument("-P", "--password-prompt", default="Please enter the decryption password", help="provide your custom password prompt, that can for example be used to provide a password hint")
         ap_encryption.add_argument("-C", "--cache-password", action="store_true", help="cache password to localStorage, so that you can reload the page without entering password again")
         ap_encryption.add_argument("--iterations", "-I", type=int, default=1_000_000, help="minimum number of iterations for the PBKDF2 key derivation function")

python/self_unzip_html/cli/output.py

@@ -6,12 +6,15 @@
 from ..page_builder import Compression, Encoding
 from ..util import print_info
 
-def register_output_argument_parser(ap: ArgumentParser, _subcommand: Subcommand):
-    ap.add_argument("-i", "--input", metavar="INPUT_FILE", required=True, help="the file to encode. Use '-' to read from standard input")
+def register_output_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
+    if subcommand != Subcommand.SERVE:
+        ap.add_argument("-i", "--input", metavar="INPUT_FILE", required=True, help="the file to encode. Use '-' to read from standard input")
 
     ap_output = ap.add_argument_group("Output Options")
-    ap_output.add_argument("-o", "--output", help="the location to write the output to. If not specified stdout will be used instead")
-    ap_output.add_argument("-O", "--open", action="store_true", help="if writing output to a file, try to immediately open the file in the default web browser afterwards")
+    if subcommand != Subcommand.SERVE:
+        ap_output.add_argument("-o", "--output", help="the location to write the output to. If not specified stdout will be used instead")
+        ap_output.add_argument("-O", "--open", action="store_true", help="if writing output to a file, try to immediately open the file in the default web browser afterwards")
+
     ap_output.add_argument("-c", "--compression", default="auto", choices=["auto", "none", "gzip"], help="how to compress the contents (default: auto)")
     ap_output.add_argument("-e", "--encoding", default="auto", choices=["auto", "base64", "ascii85", "hex"], help="how to encode the binary data  (default: auto). base64 may not work for large contents (>65kB) due to different browser limitations")
     ap_output.add_argument("--console-log", action="store_true", help="insert debug statements to see the output of the individual steps")

python/self_unzip_html/cli/server.py

@@ -6,22 +6,47 @@
 from urllib.parse import unquote
 from http.server import HTTPServer, BaseHTTPRequestHandler
 # local
-from ..template import get_html_template, get_svg_template
-from ..crypto import NullEncryptor
-from ..page_builder import PageBuilder, Compression, Encoding, DEFAULT_TEMPLATE_FILE, DEFAULT_SVG_FILE
+from . import Subcommand
+from .template import get_initial_page_contents
+from .encryption import get_encryptor
+from .output import get_compression_list, get_encoding_list
+from ..template import get_html_template, get_svg_template, DEFAULT_HTML_TEMPLATE_PATH
+from ..page_builder import PageBuilder
 from ..static_js import JS_DOWNLOAD, JS_DOWNLOAD_SVG
 
 
-def register_server_argument_parser(ap: ArgumentParser):
-    ap.add_argument("-b", "--bind", default="0.0.0.0", help="IP address to bind to (default: 0.0.0.0)")
-    ap.add_argument("-p", "--port", type=int, default=8000, help="port to bind to (default: 8000)")
+def register_server_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
+    if subcommand == Subcommand.SERVE:
+        ap_server = ap.add_argument_group("Server options")
+        ap_server.add_argument("-b", "--bind", default="0.0.0.0", help="IP address to bind to (default: 0.0.0.0)")
+        ap_server.add_argument("port", nargs="?", type=int, default=8000, help="port to bind to (default: 8000)")
 
 class HTMLSmugglingServer(HTTPServer):
-    def __init__(self, server_address, RequestHandlerClass):
+    def __init__(self, server_address, RequestHandlerClass, args):
         super().__init__(server_address, RequestHandlerClass)
-        self.html_template = get_html_template(DEFAULT_TEMPLATE_FILE, "File Download", "File download link should be shown immediately")
-        self.svg_template = get_svg_template(DEFAULT_SVG_FILE)
-        self.encryptor = NullEncryptor()
+
+        try:
+            self.svg_template = get_svg_template(args.svg)
+        except:
+            raise Exception(f"Failed to load SVG file '{args.svg}'. Try specifying a different file with the --svg option")
+
+        template_file = args.template or DEFAULT_HTML_TEMPLATE_PATH
+        initial_page_contents = get_initial_page_contents(args)
+        try:
+            self.html_template = get_html_template(template_file, args.title, initial_page_contents)
+        except:
+            raise Exception(f"Failed to load template file '{template_file}'. Try specifying a different file with the --template option")
+
+        self.compression_list = get_compression_list(args)
+        self.encoding_list = get_encoding_list(args)
+        self.obscure_action = args.obscure_action
+        self.insert_debug_statements = args.console_log
+
+        self.encryptor = get_encryptor(args)
+
+        # self.html_template = get_html_template(DEFAULT_TEMPLATE_FILE, "File Download", "File download link should be shown immediately")
+        # self.svg_template = get_svg_template(DEFAULT_SVG_FILE)
+        # self.encryptor = NullEncryptor()
 
 
 class HTMLSmugglingRequestHandler(BaseHTTPRequestHandler):
@@ -60,38 +85,38 @@ def serve_html(self, path):
         with open(path, "rb") as f:
             file_contents = f.read()
 
-        html_page_builder = PageBuilder(
-            self.server.html_template,
-            JS_DOWNLOAD.replace("{{NAME}}", file_name),
-            self.server.encryptor,
-            compression_list = [Compression.NONE],
-            encoding_list = [Encoding.BASE64],
-        )
-        html_str = html_page_builder.build_page(file_contents)
+        file_contents = self.build_page(file_name, file_contents, self.server.html_template, JS_DOWNLOAD, False)
 
         self.send_response(200)
         self.send_header("Content-type", "text/html; charset=utf-8")
         self.end_headers()
-        self.wfile.write(html_str.encode())
+        self.wfile.write(file_contents)
 
     def serve_svg(self, path):
         file_name = os.path.basename(path)
         with open(path, "rb") as f:
             file_contents = f.read()
 
+        file_contents = self.build_page(file_name, file_contents, self.server.svg_template, JS_DOWNLOAD_SVG, True)
+
+        self.send_response(200)
+        self.send_header("Content-type", "image/svg+xml")
+        self.end_headers()
+        self.wfile.write(file_contents)
+
+    def build_page(self, file_name: str, file_contents: bytes, template: str, js_payload: str, is_svg: bool) -> bytes:
         html_page_builder = PageBuilder(
-            self.server.svg_template,
-            JS_DOWNLOAD_SVG.replace("{{NAME}}", file_name),
+            template,
+            js_payload.replace("{{NAME}}", file_name),
             self.server.encryptor,
-            compression_list = [Compression.NONE],
-            encoding_list = [Encoding.BASE64],
+            obscure_action=self.server.obscure_action,
+            encode_library_as_base64=False,
+            insert_debug_statements=self.server.insert_debug_statements,
+            compression_list = self.server.compression_list,
+            encoding_list = self.server.encoding_list,
         )
         html_str = html_page_builder.build_page(file_contents)
-
-        self.send_response(200)
-        self.send_header("Content-type", "text/html; charset=utf-8")
-        self.end_headers()
-        self.wfile.write(html_str.encode())
+        return html_str.encode()
 
     def list_directory(self, path):
         try:
@@ -133,10 +158,10 @@ def translate_path(self, path):
         return base_path
 
 
-def start_server(bind_ip: str, bind_port: int):
+def start_server(bind_ip: str, bind_port: int, args):
     try:
         server_address = (bind_ip, bind_port)
-        httpd = HTMLSmugglingServer(server_address, HTMLSmugglingRequestHandler)
+        httpd = HTMLSmugglingServer(server_address, HTMLSmugglingRequestHandler, args)
         print(f"Serving at http://{bind_ip}:{bind_port}")
         httpd.serve_forever()
     except KeyboardInterrupt:

python/self_unzip_html/cli/template.py

@@ -6,9 +6,9 @@
 
 def register_template_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
     ap_template = ap.add_argument_group("Template Settings")
-    if subcommand in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED]:
+    if subcommand in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED, Subcommand.SERVE]:
         ap_template.add_argument("--svg", metavar="SVG_FILE_PATH", nargs="?", default=DEFAULT_SVG_TEMPLATE_PATH, help="use this SVG instead of a normal HTML page for the smuggling")
-    else:
+    if subcommand in [Subcommand.HTML, Subcommand.HTML_ENCRYPTED, Subcommand.SERVE]:
         ap_template.add_argument("--template", help="use this template file instead of the default one")
         ap_template.add_argument("--title", default="Self Extracting Page", help="set the title of the HTML page")
         initial_page_contents_mutex = ap_template.add_mutually_exclusive_group()

python/self_unzip_html/template.py

@@ -1,13 +1,13 @@
 import os
 
 SCRIPT_TAG_TEMPLATE_FOR_SVG_FILES = """
-    <script>
+    <script><![CDATA[
         {{LIBRARY_CODE}}
         // My code (c) six-two, MIT License
         const action = (og_data) => { {{PAYLOAD_CODE}} };
         const c_data = "{{DATA}}";
         {{GLUE_CODE}}
-    </script>
+    ]]></script>
 """
 
 SCRIPT_DIR = os.path.dirname(os.path.realpath(__file__))