WangYihang / Platypus

:hammer: A modern multiple reverse shell sessions manager written in go
http://platypus-reverse-shell.vercel.app
GNU Lesser General Public License v3.0
1.52k stars 226 forks source link

Add nil check to prevent interface conversion exception that could occur if ClientInfo.Body was nil #131

Closed TheRemote closed 2 years ago

TheRemote commented 2 years ago

Hello again!

Everything has been working great with my several Platypus servers except I'm occasionally getting an exception:

 panic: interface conversion: interface {} is nil, not *message.BodyClientInfo

goroutine 452 [running]:
github.com/WangYihang/Platypus/internal/context.(*TermiteClient).GatherClientInfo(0xc00011c300, {0xc0003e8270, 0xe})
        github.com/WangYihang/Platypus/internal/context/termite.go:165 +0x66e
github.com/WangYihang/Platypus/internal/context.(*TCPServer).Handle(0xc0000b2e70, {0xccb150?, 0xc00009e380?})
        github.com/WangYihang/Platypus/internal/context/server.go:138 +0xa5
created by github.com/WangYihang/Platypus/internal/context.(*TCPServer).Run
        github.com/WangYihang/Platypus/internal/context/server.go:257 +0x75e

Interestingly this has only ever occurred on my server that serves webcams. My other servers that serve other types of devices have never got this crash. The webcam Platypus server can't run for more than about 24-36 hours before this happens.

It seems like the termite client is sending an empty body but is able to pass this check:

if msg.Type == message.CLIENT_INFO {

This does not happen every time on this platform and there's probably an average of 20 or so of these connected at once with the exception occurring every 24-36 hours. It may only be one bad/corrupted client that does this somewhere in the pool but it takes down the entire Platypus server when it happens.

I ended up adding a simple check like this:

if msg.Body != nil {
...
} else {
  log.Error("Client sent empty client info body: %v", msg)
  return false
}

This seems to be rare and platform dependent somehow but I figured I'd submit it. Thank you!

vercel[bot] commented 2 years ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
platypus ✅ Ready (Inspect) Visit Preview May 8, 2022 at 5:57AM (UTC)
WangYihang commented 2 years ago

Thanks for your excellent work! Looks good to me.