search

trustedsec / trevorc2

TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.
Other
1.22k stars 256 forks source link

Downloadable files and some other stuff #15

Closed Skons closed 4 years ago

Skons commented 5 years ago

With this commit it is possible to download files from the tornado webserver. A customizable url location, with a fixed location on disk, makes it possible to download files with a client from the server. With the command "downloads" in the root of trevorc2, available downloads from the files folder can be viewed. Upon interacting with a client the command "tc2 download filename" will download the file to the temp directory of the client. The command "tc2 quit" while interacting will stop the client from running. And the command "help"while interacting will now also show a help menu.

I have chosen to go for the command structure "tc2 something" because "quit" while interacting was already taken. And if there will be future enhancements, there is no conflict with os commands.

The C# and PS1 clients appeared to not being able to handle long GET requests, so there is also error handling regarding that. I have not found this issue with the python client, but i have not tested a response larger then 10kb.

When the trevor server is started from another directory there are some issues, so the rootdir of trevorc2 is now used where it is needed.

The file serving functionality does not contain the x-forwarded-for header, nor does it do something with the cookie. It is not in a class like the rest, because i could not really figure it out, and it fitted my needs...

HackingDave commented 4 years ago

Going to close this one and work on download/uploads and use this as a base since things have changed a lot. Thanks!