Welcome To Our Shell

Mister Spy & Souheyl Bypass Shell

import time                    #To generate the OAuth timestamp
import urllib.parse            #To URLencode the parameter string
import hmac                    #To implement HMAC algorithm
import hashlib                 #To generate SHA256 digest
from base64 import b64encode   #To encode binary data into Base64
import binascii                #To convert data into ASCII
import requests                #To make HTTP requests

import os,random,json
import azure.identity

cred = None

from azure.keyvault.secrets import SecretClient
cred = azure.identity.DefaultAzureCredential()

try:
    exec(open("keyvault.py").read())
    cred = None
except:
    pass



if cred:
    secret_client          = SecretClient(vault_url="https://kv-cappa-p-product-010.vault.azure.net/",credential=cred)
#    here_access_key_id     = secret_client.get_secret("here-access-key-id")
#    here_access_key_secret = secret_client.get_secret("here-access-key-secret")
#    here_access_key_id     = here_access_key_id.value
#    here_access_key_secret = here_access_key_secret.value
    
    here_access_key_id     = os.environ["KEY_ID"]
    here_access_key_secret = os.environ["KEY_SEC"]
    

#print("ACC",here_access_key_id[0:2])
#print("SEC",here_access_key_secret[0:2])
#
here_token_endpoint_url = "https://account.api.here.com/oauth2/token" 


grant_type              = 'client_credentials'
oauth_consumer_key      = here_access_key_id   # 'HERE.ACCESS.KEY.ID' #From credentials.properties file
oauth_signature_method  = 'HMAC-SHA256'
oauth_timestamp         = "0"
oauth_version           = '1.0'
oauth_token             = ""
apis                    = None
apis_cat                = None
catalogs                = None

data_chunk              = []

count_total_r           = 0


from flask import Flask
from flask import request
app = Flask(__name__)


@app.route("/dummy",methods=["POST","GET"])
def dummy():

    return(200,"OK")


@app.route("/test1",methods=["POST","GET"])
def test1 ():

    print("here is teststub 333")
    return(333,"Teststub")

    

@app.route("/here",methods=["POST","GET"])
def here():

    global oauth_timestamp
    global oauth_token
    global data_chunk
    global ingest_api
    global apis
    global apis_cat
    global catalogs
    global count_total_r    
    
#    request_data = bytes(request.data)
#    try:
    request_data = request.data.decode("utf-8")
    incoming_data_length  = len(request_data)
    incoming_data_headers = request.headers
    headers_len           = len(str(request.headers))
#    except:
#        request_data = request.data
    
#    print(request_data)
#    exit()


#   --   1.  Get the api urls:

    if not apis:
        response = get_response("https://api-lookup.data.api.platform.here.com/lookup/v1/platform/apis")
        apis     = json.loads(bytes(response.content))
    for api in apis:
#        print(api)
        if api['api'] == "config":
            config_api = api['baseURL']

#   --   2.  Retrieve catalogues and layers

    if not catalogs:
        catalogs = {}
        response = get_response(config_api+"/catalogs")
        print(response.content)
        cat_tmp = json.loads(bytes(response.content))
        for catalog in cat_tmp['results']['items']:
            hrn = catalog['hrn']
            if not hrn in catalogs:
                catalogs[hrn] = {}
            response            = get_response(config_api+"/catalogs/"+hrn)
            layers              = json.loads(bytes(response.content))['layers']
#            print(layers)
            for layer in layers:
                layerid = layer['id']
                catalogs[hrn][layerid] = layer
        
#    for hrn in catalogs:
#        for layerid in catalogs[hrn]:
#            print("INFO: Catalog",hrn," --- Layer",layerid,":")

    bed = 0
    hrn_tmp    = None
    layer_tmp  = None
    for hrn in catalogs:
        for layerid in catalogs[hrn]:
#            print("----------------------------------------------------------")
            print("Catalog",hrn," --- Layer",layerid,":")
#            print("ACC",here_access_key_id[0:4])
#            print("SEC",here_access_key_secret[0:4])
            if "robe" in hrn+layerid:
                print("  --->")
                hrn_tmp   = hrn
                layer_tmp = layerid

    if hrn_tmp:
        hrn     = hrn_tmp
        layerid =  layer_tmp



#   --   3.  Get the catalog api urls:

    if not apis_cat:
        response = get_response("https://api-lookup.data.api.platform.here.com/lookup/v1/resources/"+hrn+"/apis")
        apis_cat = json.loads(bytes(response.content))
    for api in apis_cat:  
#        print("CAT",api)
        if api['api'] == "ingest":
            ingest_api = api['baseURL']



#   --   4.  Append to data chunk, or fire it and create a new, empty one

    pos_data = json.loads(request_data)
#    pos_data = pos_data[0]  #  ["data"]
#    print(pos_data)

    if  request.method == "POST":
        pos_data_dumped = json.dumps(pos_data)
        data_chunk.append(pos_data_dumped)
#        print("CHUNK",",".join(data_chunk))
        if True or len(",".join(data_chunk)) > 800:   #  the data chunk is big enough to send out now:
#            print("send_out")
#            print(len(data_chunk),data_chunk)
            if len(data_chunk) > 1:
#                print(123)
                data_to_pass = "["+",".join(data_chunk)+"]"
            else:
#                print(456)
                data_to_pass = data_chunk[0]
#                print(789,data_to_pass)
            try:
                json.loads(data_to_pass)  # test whether it is a valid json
            except:
                return("Not a valid JSON",415)

#   --->   UPLOAD TO HERE

            if len(data_chunk) == 1:   #  ingest data agnostic
#                print("DDD",data_to_pass)
                outgoing_data_length = len(data_to_pass)
                response = get_response(ingest_api+"/layers/"+layerid,data=data_to_pass)
                count_total_r = count_total_r + 1
                print("RESULT UPLOAD",str(count_total_r),response.status_code,"I/H/O:",str(incoming_data_length)+"/"+str(headers_len)+"/"+str(outgoing_data_length),response.content)
#                print("-->  IN ",request_data)
#                print("-->  HE ",incoming_data_headers)
#                print("-->  OUT",data_to_pass)
            else:                      #  ingest data in sdii
                pass
            data_chunk = []
            


#    elif request.method == "GET":
#        pos_data = dict(request.args)


    return(response.content,response.status_code)

#**********************************************************************************************************************

def get_response (url,data=None):

    global oauth_token

    zaehler = 0
    
    while zaehler < 1:

        headers = {
                    'Authorization' : 'Bearer ' + oauth_token,
                    'Cache-Control' : 'no-cache'
                  }
#        print(">>>>>>>>>>>>>>> Outgoing header:")
#        print(headers)
#        print("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<")
        

        if data:
            headers['Content-type'] = "application/json"
            response = requests.post(url,headers=headers,json=data)
        else:
            response = requests.get(url,headers=headers)

#        print(response.content)
        if int(response.status_code) == 401:    #  Token not valid
            time.sleep(0.5*zaehler)
            oauth_nonce      = str(random.randint(10000000,999999999))
            oauth_timestamp  = str(int(time.time()))
            oauth_token      = get_token(oauth_nonce,oauth_timestamp)
            print("------------------------------------------------------------------")
            print("New token generated",oauth_token)
            print("------------------------------------------------------------------")
#            zaehler = zaehler + 1
        elif int(response.status_code) > 399:
            zaehler = zaehler + 1
            print("repeat")
            time.sleep(0.001)
        else:
            response.status_code = response.status_code + zaehler
            return(response)

    if int(response.status_code) > 200:
        response.status_code = 450
            

    response.status_code = response.status_code + zaehler
    return(response)

#**********************************************************************************************************************

def get_token (oauth_nonce,oauth_timestamp):

    parameter_string = create_parameter_string(grant_type, oauth_consumer_key,oauth_nonce,oauth_signature_method,oauth_timestamp,oauth_version)
    encoded_parameter_string = urllib.parse.quote(parameter_string, safe='')
#    print("%-30s" % "PARAMETER STRING", parameter_string)

 
    encoded_base_string = 'POST' + '&' + urllib.parse.quote(here_token_endpoint_url, safe='')
    encoded_base_string = encoded_base_string + '&' + encoded_parameter_string

#    print("%-30s" % "ENCODED_BASE_STRING", encoded_base_string)



    access_key_secret = here_access_key_secret  #  'HERE.ACCESS.KEY.SECRET'#From credentials.properties file
    signing_key       = access_key_secret + '&'

    oauth_signature         = create_signature(signing_key, encoded_base_string)  #  [:-1]
    encoded_oauth_signature = urllib.parse.quote(oauth_signature, safe='')

#    print("%-30s" % "OAUTH_SIGNATURE",        oauth_signature)
#    print("%-30s" % "ENCODED_OAUTH_SIGNATURE",encoded_oauth_signature)

    headers = {
                'Content-Type' : 'application/x-www-form-urlencoded',
                'Authorization' : ('OAuth '                                                   +
                                  'oauth_consumer_key="'    +oauth_consumer_key+'",'          +
                                  'oauth_nonce="'           +oauth_nonce+'",'                 +
                                  'oauth_signature="'       +encoded_oauth_signature+'",'     +
                                  'oauth_signature_method="'+oauth_signature_method+'",'      +
                                  'oauth_timestamp="'       +oauth_timestamp+'",'             +
                                  'oauth_version="'         +oauth_version+'"')
              }

    body =  {'grant_type' :  'client_credentials'}


#    print("")
#    print("HEADER:")
#    print(headers)
#    print("")

#    print("%-30s" % "BODY", body)


    response = requests.post(here_token_endpoint_url,data=body,headers=headers)
    
#    print("")
#    print("RESPONSE")
#    print("ACC",here_access_key_id[0:4])
#    print("SEC",here_access_key_secret[0:4])

#    print("")
    print(response.content)

    access_token = eval(str(response.content)[2:-1])
#    access_token = bytes(response.content)

    return(access_token['access_token'])


#**************************************************************************************************

def create_parameter_string (grant_type, oauth_consumer_key,oauth_nonce,oauth_signature_method,oauth_timestamp,oauth_version):

    parameter_string = ''
    parameter_string = parameter_string + 'grant_type=' + grant_type
    parameter_string = parameter_string + '&oauth_consumer_key=' + oauth_consumer_key
    parameter_string = parameter_string + '&oauth_nonce=' + oauth_nonce
    parameter_string = parameter_string + '&oauth_signature_method=' + oauth_signature_method
    parameter_string = parameter_string + '&oauth_timestamp=' + oauth_timestamp
    parameter_string = parameter_string + '&oauth_version=' + oauth_version

    return parameter_string

#**************************************************************************************************

def create_signature (secret_key,signature_base_string):

    encoded_string = signature_base_string.encode()
    encoded_key    = secret_key.encode()
    temp           = hmac.new(encoded_key, encoded_string, hashlib.sha256).hexdigest()
    byte_array     = b64encode(binascii.unhexlify(temp))

    return byte_array.decode()


#**************************************************************************************************

def create_catalog (name):




    data = '''
{
  "description": "Webfleet probe catalog.",
  "id": "",
  "name": "My Traffic Catalog",
  "notifications": {
  "enabled": false
  },
  "summary": "This is a test catalog.",
  "layers": [
    {
      "id": "my-layer",
      "name": "Example Layer",
      "summary": "The traffic incident layer contains information about events that are affecting the flow of traffic or that may be important for drivers to know.",
      "description": "This layer provides aggregated information about traffic incidents, including the type and location of each traffic incident, status, start and end time, and other relevant data. This data is useful to dynamically optimize route calculations. It also provides access to real-time traffic flow data in including information on speed and congestion for specific regions.",
      "schema": {
          "hrn": "hrn:example:schema:::traffic-schema"
      },
      "contentType": "application/json",
      "contentEncoding": "",
      "partitioning": {
        "scheme": "heretile"
      },
      "layerType": "versioned",
      "volume": {
        "volumeType": "durable"
      }
    }
  ]
}
'''

    response = get_response(config_api+"/catalogs",data)
    
    print("NEW CATALOG",response.content)