search

vulncheck-oss / go-exploit

A Go-based Exploit Framework
https://pkg.go.dev/github.com/vulncheck-oss/go-exploit
Apache License 2.0
308 stars 29 forks source link

Add protocol based flag handling #267

Open terrorbyte opened 2 weeks ago

terrorbyte commented 2 weeks ago

Closes #234

Allows for protocols to have explicit flags that will resolve when they get defined. For example, if your exploit defines "HTTP" as it's protocol, this change automatically applies the "user-agent" flag to the cli args and if it does not it will not appear.

I of course wanted to support multi-protocol or sub-protocol situations, so this also adds the cli.AddProtocolFlags function that will allow for manually adding flags where applicable.

Also adds a few checks for whether to print the Global User-Agent string based on that ~and a quick Warning check for if proxies are supported.~

Here's the negative test case where a CVE does not use HTTP so the flag no longer appears:

poptart@grimm $ make && ./build/cve-2024-4548* -h 2>&1 | grep -A 1 "user-agent"
gofmt -d -w cve-2024-4548.go reverse_shell.go
golangci-lint run --fix --timeout 3m cve-2024-4548.go
GOOS=linux GOARCH=amd64 go build  -o build/cve-2024-4548_linux-amd64 cve-2024-4548.go
  -user-agent string
        The User-Agent to use in HTTP requests (default "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36")
poptart@grimm $ go mod edit -replace github.com/vulncheck-oss/go-exploit=$DEV/go-exploit
poptart@grimm $ make && ./build/cve-2024-4548* -h 2>&1 | grep -A 1 "user-agent"
gofmt -d -w cve-2024-4548.go reverse_shell.go
golangci-lint run --fix --timeout 3m cve-2024-4548.go
GOOS=linux GOARCH=amd64 go build  -o build/cve-2024-4548_linux-amd64 cve-2024-4548.go

And here's the positive test case where a CVE does use HTTP so the flag appears:

poptart@grimm $ make && ./build/cve-2024-* -h 2>&1 | grep -A 1 "user-agent"
gofmt -d -w cve-2024-45216.go verification.go
golangci-lint run --fix --timeout 3m cve-2024-45216.go verification.go
GOOS=linux GOARCH=amd64 go build  -o build/cve-2024-45216_linux-amd64 cve-2024-45216.go verification.go
  -user-agent string
        The User-Agent to use in HTTP requests (default "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36")
poptart@grimm $ go mod edit -replace github.com/vulncheck-oss/go-exploit=$DEV/go-exploit
poptart@grimm $ make && ./build/cve-2024-* -h 2>&1 | grep -A 1 "user-agent"
gofmt -d -w cve-2024-45216.go verification.go
golangci-lint run --fix --timeout 3m cve-2024-45216.go verification.go
GOOS=linux GOARCH=amd64 go build  -o build/cve-2024-45216_linux-amd64 cve-2024-45216.go verification.go
  -user-agent string
        The User-Agent to use in HTTP requests (default "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36")