13 use English qw(-no_match_vars); |
13 use English qw(-no_match_vars); |
14 use lib "."; |
14 use lib "."; |
15 |
15 |
16 my $use_lwp = -f "lwp"; |
16 my $use_lwp = -f "lwp"; |
17 |
17 |
18 ($EUID, $UID) = ($UID, $EUID); # release ROOT, doesn't harm, if not suid |
18 ($UID, $EUID) = ($EUID, $UID); # release ROOT, doesn't harm, if not suid |
19 ($0) = ($0 =~ /([.\/\w-]+)/); # untaint $0 |
19 ($0) = ($0 =~ /([.\/\w-]+)/); # untaint $0 |
20 |
20 |
21 use constant ME => basename $0; |
21 use constant ME => basename $0; |
22 |
22 |
23 delete @ENV{ grep /PATH/, keys %ENV }; |
23 delete @ENV{ grep /PATH/, keys %ENV }; |
92 if not defined $opt_user |
92 if not defined $opt_user |
93 and not defined $opt_kill; |
93 and not defined $opt_kill; |
94 |
94 |
95 $opt_verbose += $opt_debug; |
95 $opt_verbose += $opt_debug; |
96 |
96 |
97 untaint($opt_host) or ohshit "hostname didn't pass verification\n"; |
97 untaint($opt_host) or ohshit "hostname didn't pass verification\n"; |
98 untaint($opt_linkname) or ohshit "linkname didn't pass verification\n"; |
98 untaint($opt_linkname) or ohshit "linkname didn't pass verification\n"; |
99 untaint($opt_script) |
99 untaint($opt_script) |
100 or ohshit "script name didn't pass verification\n" |
100 or ohshit "script name didn't pass verification\n" |
101 if $opt_script; |
101 if $opt_script; |
102 map { untaint } @ppp_opts; |
102 map { untaint } @ppp_opts; |
103 |
103 |
104 ohshit "need to run with root permissions!\n" |
104 # now get back the root permissions |
|
105 ($EUID, $UID) = ($UID, $EUID); |
|
106 ohshit "need to run with root permissions (current: $UID/$EUID)!\n" |
105 if not $EUID == 0 || $UID == 0; |
107 if not $EUID == 0 || $UID == 0; |
106 |
108 |
107 exit do_kill($opt_linkname) if $opt_kill; |
109 exit do_kill($opt_linkname) if $opt_kill; |
108 |
110 |
109 untaint($opt_user) |
111 untaint($opt_user) |
149 |
151 |
150 if (!$use_lwp) { |
152 if (!$use_lwp) { |
151 $request = |
153 $request = |
152 "GET /my.logon.php3?check=1 HTTP/1.0\r\n" |
154 "GET /my.logon.php3?check=1 HTTP/1.0\r\n" |
153 . "Content-Type: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" |
155 . "Content-Type: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" |
154 . "User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; de-de) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7\r\n" |
156 . "User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; de-de) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7\r\n" |
155 . "Connection: close\r\n" . "\r\n"; |
157 . "Connection: close\r\n" . "\r\n"; |
156 |
158 |
157 $response = qx(echo "${request}" | ${openssl} 2>/dev/null) |
159 $response = qx(echo "${request}" | ${openssl} 2>/dev/null) |
158 or ohshit "Invalid Host specified or not reachable: $opt_host\n"; |
160 or ohshit "Invalid Host specified or not reachable: $opt_host\n"; |
159 |
161 |
160 } |
162 } |
161 else { |
163 else { |
162 use LWP::UserAgent; |
164 use LWP::UserAgent; |
163 use HTTP::Request::Common; |
165 use HTTP::Request::Common; |
164 use HTTP::Status; |
166 use HTTP::Status; |
165 use HTTP::Cookies; |
167 use HTTP::Cookies; |
166 #use LWP::Debug qw(+); |
168 |
167 $cookies = new HTTP::Cookies; |
169 #use LWP::Debug qw(+); |
168 $ua = new LWP::UserAgent; |
170 $cookies = new HTTP::Cookies; |
|
171 $ua = new LWP::UserAgent; |
169 $ua->agent(""); |
172 $ua->agent(""); |
170 $ua->env_proxy; |
173 $ua->env_proxy; |
171 $ua->cookie_jar($cookies); |
174 $ua->cookie_jar($cookies); |
172 $response = $ua->get("https://$opt_host:443/my.logon.php3?check=1"); |
175 $response = $ua->get("https://$opt_host:443/my.logon.php3?check=1"); |
173 |
176 |
174 ohshit "initial failed with http code @{[$response->message]}\n" |
177 ohshit "initial failed with http code @{[$response->message]}\n" |
175 unless $response->is_success; |
178 unless $response->is_success; |
176 |
179 |
218 |
221 |
219 ohshit "login failed with http code @{[$response->message]}\n" |
222 ohshit "login failed with http code @{[$response->message]}\n" |
220 unless $response->is_success; |
223 unless $response->is_success; |
221 |
224 |
222 $response = $response->as_string; |
225 $response = $response->as_string; |
223 # ? $cookies->set_cookie(0, MRHSession => $sessionid, "/", $opt_host, 443, 1, 0, 10, 0, {}); |
226 |
|
227 # ? $cookies->set_cookie(0, MRHSession => $sessionid, "/", $opt_host, 443, 1, 0, 10, 0, {}); |
224 } |
228 } |
225 |
229 |
226 # We can then parse the response for the MRHSession Cookie, which contains our |
230 # We can then parse the response for the MRHSession Cookie, which contains our |
227 # SessionID. In this example, we print out the SessionID in order to verify |
231 # SessionID. In this example, we print out the SessionID in order to verify |
228 # that our log in attempt worked. |
232 # that our log in attempt worked. |
229 |
233 |
230 $response =~ /MRHSession=(\w+);/; |
234 $response =~ /MRHSession=(\w+);/; |
231 $sessionid = $1; |
235 $sessionid = $1; |
232 verbose "% session id ${sessionid}\n"; |
236 verbose "% session id ${sessionid}\n"; |
233 |
|
234 |
237 |
235 ### |
238 ### |
236 ### STEP 3 :: Create the SSL VPN tunnel. |
239 ### STEP 3 :: Create the SSL VPN tunnel. |
237 ### |
240 ### |
238 |
241 |
245 $request = "GET /vdesk/vpn/index.php3?outform=xml HTTP/1.0\r\n" |
248 $request = "GET /vdesk/vpn/index.php3?outform=xml HTTP/1.0\r\n" |
246 . "Cookie: MRHSession=${sessionid}\r\n" . "\r\n"; |
249 . "Cookie: MRHSession=${sessionid}\r\n" . "\r\n"; |
247 $response = qx(echo "${request}" | ${openssl} 2>/dev/null); |
250 $response = qx(echo "${request}" | ${openssl} 2>/dev/null); |
248 } |
251 } |
249 else { |
252 else { |
250 $response = $ua->get("https://$opt_host:443/vdesk/vpn/index.php3?outform=xml"); |
253 $response = |
|
254 $ua->get("https://$opt_host:443/vdesk/vpn/index.php3?outform=xml"); |
251 |
255 |
252 ohshit "creating tunnel failed with http code @{[$response->message]}\n" |
256 ohshit "creating tunnel failed with http code @{[$response->message]}\n" |
253 unless $response->is_success; |
257 unless $response->is_success; |
254 |
258 |
255 $response = $response->as_string; |
259 $response = $response->as_string; |
256 } |
260 } |
257 |
261 |
258 # The response is XML, so we can safely grab what we are looking for using some |
262 # The response is XML, so we can safely grab what we are looking for using some |
259 # regular expression magic. Same with the SessionID, we're printing out the |
263 # regular expression magic. Same with the SessionID, we're printing out the |
260 # final value to make sure we're on the right track. |
264 # final value to make sure we're on the right track. |
261 open(X, ">response.out") or die; |
265 #open(X, ">response.out") or die; |
262 print X $response; |
266 #print X $response; |
263 |
267 |
264 $response =~ /${opt_name}[^\n]+\n[^Z]+Z=\d+,(\d+)/; |
268 $response =~ /${opt_name}[^\n]+\n[^Z]+Z=\d+,(\d+)/; |
265 $favorite = $1; |
269 $favorite = $1; |
266 verbose "% favorite ${favorite}\n"; |
270 verbose "% favorite ${favorite}\n"; |
267 |
271 |