1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
#!/usr/bin/env python
# #sys.path.insert (0,"/var/www/cgi-bin")
import sys
import os
import commands
import cgi
import traceback
import string
import re
import socket
ROOTPATH="/tmp"
CGISH_HTML="""<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type=text/css>
body
{
font-family: "Courier New", Courier, mono;
font-size: 10pt;
color: #00cc00;
background-color: #002000;
}
.headline {font-size: 18pt}
a {color: #99ff99; text-decoration: none}
a:hover {color: #00FF00}
hr {color: #00ff00}
.cursor {color:#002000;background-color:#00cc00}
form {
font-family: "Courier New", Courier, mono;
color: #00CC00;
background-color: #003300;
}
input {
font-family: "Courier New", Courier, mono;
color: #00CC00;
background-color: #003300;
padding: 3px;
border: 0;
}
textarea {
font-family: "Courier New", Courier, mono;
color: #00CC00;
background-color: #003300;
}
</style>
<script language="JavaScript">
function firstFocus()
{if (document.forms.length > 0)
{var TForm = document.forms[0];
for (i=0;i<TForm.length;i++){
if ((TForm.elements[i].type=="text")||
(TForm.elements[i].type=="textarea")||
(TForm.elements[i].type.toString().charAt(0)=="s"))
{document.forms[0].elements[i].focus();break;}}}}
</script>
</head>
<body onLoad="firstFocus()">
<pre>%(SHELL_OUTPUT)s</pre>
<form action="http://www.chocho.org/cgi-bin/bd_client_web.py" method="POST">
<input name="command" type="text" size="80"><br>
<hr noshade="1">
<input name="submit" type="submit" value="Enter">
<input name="ctrl_c" type="submit" value="CTRL-C">
<input name="ctrl_d" type="submit" value="CTRL-D">
<input name="ctrl_z" type="submit" value="CTRL-Z">
<input name="esc" type="submit" value="ESC">
<input name="refresh" type="submit" value="REFRESH">
</form>
</body>
</html>
"""
def page (result = ''):
"""Return the main form"""
return CGISH_HTML % {'SHELL_OUTPUT':result}
def bd_client (command, host='localhost', port = 1666):
HOST = 'localhost' # The remote host
PORT = 1666 # The same port as used by the server
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.send(command)
data = s.recv (1920)
s.close()
return data
#fout = file ('/tmp/log2','w')
#fout.write (command)
#fout.write ('\n')
# s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# s.connect((host, port))
# s.send(command)
# data = s.recv(1024)
#fout.write (data)
#fout.write ('\n')
# s.close()
#fout.close()
# return data
#def link (matchobject):
# """Used in re.sub calls to replace a matched object with an HTML link."""
# path = matchobject.group(0)
# l = "<a href=\"http://63.199.26.227/cgi-bin/ls.py?root=%s&path=%s\">%s</a>" % \
# (ROOTPATH+"/"+path, ROOTPATH+"/"+path, path)
# return l
def escape_shell_meta_chars(s):
"""Escape shell meta characters. This is done for security."""
s = string.replace(s, "\\", "\\\\")
s = string.replace(s, "`", "\\`")
s = string.replace(s, " ", "\\ ",)
s = string.replace(s, "&", "\\&",)
s = string.replace(s, ";", "\\;",)
s = string.replace(s, "\"", "\\\"",)
s = string.replace(s, "\'", "\\'",)
s = string.replace(s, "|", "\\|",)
s = string.replace(s, "*", "\\*",)
s = string.replace(s, "<", "\\<",)
s = string.replace(s, ">", "\\>",)
return s
sys.path.insert (0,"/usr/local/apache/cgi-bin")
sys.stderr = sys.stdout
print "Content-type: text/html"
print
try:
form = cgi.FieldStorage()
if form.has_key("command"):
command = form["command"].value
result = bd_client (command)
print page(result)
else:
print page()
except:
print "\n\n<pre>"
traceback.print_exc()
print "</pre>"
|
