File server handler needs reworking

[c0okB]

In the put function（CChandle.go）,I input put '/root/too/curl.exe' 'c:\users\public\curl.exe', the author's code directly splices the absolute path of the local file (such as /root/tool/curl.exe) to www/. Although the file has been transferred to the www/ at this time, when the agent downloads the file, it will download curl.exe on http://example.com/www//root/tool/curl.exe instead of http://example.com/www/curl.exe. But http://example.com/www//root/tool/ is 404

[jm33-m0]

Thanks for reporting this, I will look into it shortly

[c0okB]

` if len(cmdSlice) < 4 { sendResponse(fmt.Sprintf("args error: %v", cmdSlice)) return }

    filename_length := len(cmdSlice[1])
    filename_index := strings.LastIndex(cmdSlice[1],"/")
    DownloadFilename := SubStr(cmdSlice[1],filename_index+1,filename_length)

    url := fmt.Sprintf("%swww/%s", emp3r0r_data.CCAddress, DownloadFilename)

    path := cmdSlice[2]
    size, err := strconv.ParseInt(cmdSlice[3], 10, 64)
    if err != nil {
        out = fmt.Sprintf("processCCData: cant get size of %s: %v", url, err)
        sendResponse(out)
        return
    }

`

[jm33-m0]

I will rewrite the HTTP handler for better authentication, and when I am done there should be no problem with this upload function.

[jm33-m0]

TODO

• [x] Allow only connected agents to download files
• [x] Replace http.FileServer with a custom handler, so the /www path will change into something like /www/{token}
• [x] Examine other APIs for security issues