-
Notifications
You must be signed in to change notification settings - Fork 4
/
status_stk.py
executable file
·109 lines (97 loc) · 2.67 KB
/
status_stk.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
#!/usr/bin/env python3
import bs4 as BeautifulSoup
import os
import os.path
import requests
import subprocess
import sys
import urllib3
if len(sys.argv) != 2:
print("%s <address>" % (sys.argv[0],))
sys.exit(1)
host = sys.argv[1]
# Silence SSL Certification warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# Start a requests Session to have persistent cookies
s = requests.Session()
s.headers.update(
{
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:63.0) Gecko/20100101 Firefox/63.0",
"Accept-Language": "en-US,en;q=0.5",
}
)
s.verify = False
# Download the applet page
r = s.get("http://%s" % host)
# Verify we actually got some data
assert len(r.text) > 0
soup = BeautifulSoup.BeautifulSoup(r.text, "html.parser")
orig_port = 5002
redir_port = 5002
with open("library_admin.html", "w") as f:
# f.write(soup.prettify())
f.write(
"""
<HTML>
<HEAD>
<TITLE>Library Admin</TITLE>
</HEAD>
<BODY>
<APPLET CODE = "libconnect.App.class" ARCHIVE = libconnect.jar WIDTH = 847 HEIGHT = 700 >
<PARAM NAME = type VALUE ="shipxafff">
</APPLET>
</BODY>
</HTML>
"""
)
jars = [x.strip() for x in soup("embed")[0]["java_archive"].replace(",", " ").split()]
for jar in jars:
r = s.get("http://%s/%s" % (host, jar))
assert len(r.text) > 0
with open(jar, "wb") as f:
f.write(r.content)
# Write out temporary weak java security settings. Just to make sure we're not breaking on old KVM viewers
with open("java.security", "w") as f:
f.write(
"""jdk.certpath.disabledAlgorithms=
jdk.jar.disabledAlgorithms=
jdk.tls.disabledAlgorithms=
jdk.tls.legacyAlgorithms= \
K_NULL, C_NULL, M_NULL, \
DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_anon_EXPORT, DH_DSS_EXPORT, \
DH_RSA_EXPORT, RSA_EXPORT, \
DH_anon, ECDH_anon, \
RC4_128, RC4_40, DES_CBC, DES40_CBC, \
3DES_EDE_CBC"""
)
with open("java.policy", "w") as f:
f.write(
"""grant {
permission java.security.AllPermission;
};"""
)
# Start port redirection
redirect1 = subprocess.Popen(
["socat", "TCP-LISTEN:%s,fork,reuseaddr" % (5001,), "TCP:%s:%s" % (host, 5001)]
)
redirect2 = subprocess.Popen(
["socat", "TCP-LISTEN:%s,fork,reuseaddr" % (5002,), "TCP:%s:%s" % (host, 5002)]
)
# Start javaws viewer
subprocess.call(
[
"appletviewer",
"-J-Djava.security.properties=java.security",
"-J-Djava.security.policy=java.policy",
"library_admin.html",
]
)
# Stop port redirection
redirect1.kill()
redirect2.kill()
# Remove our temporary files
os.remove("library_admin.html")
os.remove("java.security")
os.remove("java.policy")
for jar in jars:
os.remove(jar)