|
| 1 | +# -*- coding: utf-8 -*- |
| 2 | +"""A Drupal CMS server based on Python's HTTPServer.""" |
| 3 | +from __future__ import unicode_literals |
| 4 | + |
| 5 | +import os |
| 6 | + |
| 7 | +from six.moves.socketserver import ThreadingMixIn |
| 8 | +from six.moves.BaseHTTPServer import HTTPServer |
| 9 | +from six.moves.SimpleHTTPServer import SimpleHTTPRequestHandler |
| 10 | +from six.moves.urllib_parse import unquote, urlparse |
| 11 | + |
| 12 | + |
| 13 | +WEB_PORT = 80 |
| 14 | +WWW_FOLDER_NAME = "html" |
| 15 | +WEB_ALERT_TYPE_NAME = "drupal_rce" |
| 16 | +DEFAULT_SERVER_VERSION = "Apache 2" |
| 17 | +ALERTS = [WEB_ALERT_TYPE_NAME] |
| 18 | + |
| 19 | + |
| 20 | +class ThreadingHTTPServer(ThreadingMixIn, HTTPServer): |
| 21 | + """Extend both classes to have threading capabilities.""" |
| 22 | + |
| 23 | + |
| 24 | +class HoneyHTTPRequestHandler(SimpleHTTPRequestHandler, object): |
| 25 | + """Filter requests to catch Drupalgeddon 2 exploit attempts.""" |
| 26 | + |
| 27 | + def version_string(self): |
| 28 | + """Return the web server name that we run on.""" |
| 29 | + return DEFAULT_SERVER_VERSION |
| 30 | + |
| 31 | + def verify(self, query): |
| 32 | + """Filter HTTP request to make sure it's not an exploit attempt.""" |
| 33 | + self.logger.debug("Query: %s", query) |
| 34 | + if query and query.find("&") != -1: |
| 35 | + query_components = {} |
| 36 | + for param in query.split("&"): |
| 37 | + if param.find("=") == -1: |
| 38 | + continue |
| 39 | + else: |
| 40 | + key, value = param.split("=") |
| 41 | + query_components[key] = value |
| 42 | + |
| 43 | + for component in query_components: |
| 44 | + if component.find("[#") != -1 and len(component) > 1: |
| 45 | + self.alert(event_name=WEB_ALERT_TYPE_NAME, |
| 46 | + request=query, |
| 47 | + orig_ip=self.client_address[0], |
| 48 | + orig_port=self.client_address[1]) |
| 49 | + break |
| 50 | + |
| 51 | + def do_GET(self): |
| 52 | + """Handle an HTTP GET request.""" |
| 53 | + query = unquote(urlparse(self.path).query) |
| 54 | + self.verify(query) |
| 55 | + super(HoneyHTTPRequestHandler, self).do_GET() |
| 56 | + |
| 57 | + def do_POST(self): |
| 58 | + """Handle an HTTP POST request.""" |
| 59 | + content_length = int(self.headers['Content-Length']) |
| 60 | + post_data = unquote(self.rfile.read(content_length).decode()) |
| 61 | + self.verify(post_data) |
| 62 | + super(HoneyHTTPRequestHandler, self).do_GET() |
| 63 | + |
| 64 | + def log_error(self, message, *args): |
| 65 | + """Log an error.""" |
| 66 | + self.log_message("error", message, *args) |
| 67 | + |
| 68 | + def log_request(self, code="-", size="-"): |
| 69 | + """Log an incoming request.""" |
| 70 | + # Due to hilarity involving HTTPServer using "%s"-style formatting to format strings, |
| 71 | + # and the URLs sometimes having extra %'s in them, we have to escape them by making |
| 72 | + # them into %%'s. |
| 73 | + self.log_message("debug", '"{!s}" {!s} {!s}'.format(self.requestline.replace("%", "%%"), code, size)) |
| 74 | + |
| 75 | + def log_message(self, level, message, *args): |
| 76 | + """Send message to logger with standard apache format.""" |
| 77 | + try: |
| 78 | + getattr(self.logger, level) |
| 79 | + except AttributeError: |
| 80 | + self.logger.error("Invalid level of debug requested ({}), logging as debug".format(level)) |
| 81 | + level = "debug" |
| 82 | + |
| 83 | + self.logger.debug(message) |
| 84 | + self.logger.debug(str(args)) |
| 85 | + getattr(self.logger, level)("{!s} - - [{!s}] {!s}".format(self.client_address[0], |
| 86 | + self.log_date_time_string(), |
| 87 | + message % args)) |
| 88 | + |
| 89 | + |
| 90 | +class DrupalServer(object): |
| 91 | + """Drupal CMS honeypot.""" |
| 92 | + |
| 93 | + def __init__(self, logger, alert): |
| 94 | + self.logger = logger |
| 95 | + alerting_client_handler = HoneyHTTPRequestHandler |
| 96 | + alerting_client_handler.logger = logger |
| 97 | + alerting_client_handler.alert = alert |
| 98 | + self.httpd = ThreadingHTTPServer(("", WEB_PORT), alerting_client_handler) |
| 99 | + |
| 100 | + def start(self): |
| 101 | + """Start serving requests by starting the underlying HTTP server.""" |
| 102 | + os.chdir(os.path.join(os.path.dirname(__file__), WWW_FOLDER_NAME)) |
| 103 | + self.logger.info("Starting Drupal server on port {port}".format(port=WEB_PORT)) |
| 104 | + self.httpd.serve_forever() |
| 105 | + return True |
| 106 | + |
| 107 | + def stop(self): |
| 108 | + """Stop serving requests.""" |
| 109 | + self.logger.info("Shutting down Drupal server...") |
| 110 | + if self.httpd: |
| 111 | + self.httpd.shutdown() |
| 112 | + self.httpd = None |
0 commit comments