package main import ( "fmt" "html/template" "log" "net/http" "strconv" "strings" "time" "github.com/gorilla/mux" "github.com/radareorg/r2pipe-go" ) type Bot struct { ID int Name string Source string Users []User Archs []Arch Bits []Bit } ////////////////////////////////////////////////////////////////////////////// // GENERAL PURPOSE func BotCreate(name string, source string) (int, error) { return globalState.InsertBot(Bot{Name: name, Source: source}) } func BotUpdate(botid int, name string, source string) error { return globalState.UpdateBot(Bot{ID: botid, Name: name, Source: source}) } func BotGetById(id int) (Bot, error) { return globalState.GetBotById(id) } func BotGetAll() ([]Bot, error) { return globalState.GetAllBot() } func BotLinkArchIDs(botid int, archIDs []int) error { return globalState.LinkArchIDsToBot(botid, archIDs) } func BotLinkBitIDs(botid int, bitIDs []int) error { return globalState.LinkBitIDsToBot(botid, bitIDs) } ////////////////////////////////////////////////////////////////////////////// // DATABASE func (s *State) InsertBot(bot Bot) (int, error) { res, err := s.db.Exec("INSERT INTO bots VALUES(NULL,?,?,?);", time.Now(), bot.Name, bot.Source) if err != nil { return 0, err } var id int64 if id, err = res.LastInsertId(); err != nil { return 0, err } return int(id), nil } func (s *State) UpdateBot(bot Bot) error { _, err := s.db.Exec("UPDATE bots SET name=?, source=? WHERE id=?", bot.Name, bot.Source, bot.ID) if err != nil { return err } return nil } func (s *State) GetBotById(id int) (Bot, error) { var botid int var botname string var botsource string var ownerids string var ownernames string var archids string var archnames string var bitids string var bitnames string err := s.db.QueryRow(` SELECT bo.id, bo.name, bo.source, COALESCE(group_concat(ub.user_id), ""), COALESCE(group_concat(us.name), ""), COALESCE(group_concat(ab.arch_id), ""), COALESCE(group_concat(ar.name), ""), COALESCE(group_concat(bb.bit_id), ""), COALESCE(group_concat(bi.name), "") FROM bots bo LEFT JOIN user_bot_rel ub ON ub.bot_id = bo.id LEFT JOIN users us ON us.id = ub.user_id LEFT JOIN arch_bot_rel ab ON ab.bot_id = bo.id LEFT JOIN archs ar ON ar.id = ab.arch_id LEFT JOIN bit_bot_rel bb ON bb.bot_id = bo.id LEFT JOIN bits bi ON bi.id = bb.bit_id WHERE bo.id=? GROUP BY bo.id; `, id).Scan(&botid, &botname, &botsource, &ownerids, &ownernames, &archids, &archnames, &bitids, &bitnames) if err != nil { log.Println(err) return Bot{}, err } // log.Println("botid: ", botid) // log.Println("botname: ", botname) // log.Println("botsource: ", botsource) // log.Println("ownerids: ", ownerids) // log.Println("ownernames: ", ownernames) // log.Println("archid: ", archids) // log.Println("archname: ", archnames) // log.Println("bitid: ", bitids) // log.Println("bitname: ", bitnames) ownerIDList := strings.Split(ownerids, ",") ownerNameList := strings.Split(ownernames, ",") var users []User for i, _ := range ownerIDList { id, err := strconv.Atoi(ownerIDList[i]) if err != nil { log.Println("ERR1: ", err) return Bot{}, err } users = append(users, User{ID: id, Name: ownerNameList[i], PasswordHash: nil}) } // assemble the archs archIDList := strings.Split(archids, ",") archNameList := strings.Split(archnames, ",") var archs []Arch if archIDList[0] != "" { for i, _ := range archIDList { id, err := strconv.Atoi(archIDList[i]) if err != nil { log.Println("Err handling archs: ", err) return Bot{}, err } archs = append(archs, Arch{id, archNameList[i], true}) } } else { archs = []Arch{} } // assemble the bits bitIDList := strings.Split(bitids, ",") bitNameList := strings.Split(bitnames, ",") var bits []Bit if bitIDList[0] != "" { for i, _ := range bitIDList { id, err := strconv.Atoi(bitIDList[i]) if err != nil { log.Println("Err handling bits: ", err) return Bot{}, err } bits = append(bits, Bit{id, bitNameList[i], true}) } } else { bits = []Bit{} } switch { case err != nil: log.Println("ERR4: ", err) return Bot{}, err default: return Bot{botid, botname, botsource, users, archs, bits}, nil } } func (s *State) UpdateBotSource(name string, source string) error { _, err := s.db.Exec("UPDATE bots SET source=? WHERE name=?", source, name) if err != nil { return err } else { return nil } } func (s *State) UpdateBotName(orig_name string, new_name string) error { _, err := s.db.Exec("UPDATE bots SET name=? WHERE name=?", new_name, orig_name) if err != nil { return err } else { return nil } } // Returns the users belonging to the given bot func (s *State) GetBotUsers(botid int) ([]User, error) { rows, err := s.db.Query("SELECT id, name FROM users u LEFT JOIN user_bot_rel ub ON ub.user_id = u.id WHERE ub.bot_id=?", botid) defer rows.Close() if err != nil { return nil, err } var users []User for rows.Next() { var user User if err := rows.Scan(&user.ID, &user.Name); err != nil { return users, err } users = append(users, user) } if err = rows.Err(); err != nil { return users, err } return users, nil } // Returns the users belonging to the given bot func (s *State) GetAllBot() ([]Bot, error) { rows, err := s.db.Query("SELECT id, name FROM bots;") defer rows.Close() if err != nil { return nil, err } var bots []Bot for rows.Next() { var bot Bot if err := rows.Scan(&bot.ID, &bot.Name); err != nil { return bots, err } bots = append(bots, bot) } if err = rows.Err(); err != nil { return bots, err } return bots, nil } // Returns the users belonging to the given bot func (s *State) GetAllBotsWithUsers() ([]Bot, error) { rows, err := s.db.Query(`SELECT b.id, b.name, b.source, group_concat(ub.user_id), group_concat(u.name) FROM bots b LEFT JOIN user_bot_rel ub ON ub.bot_id = b.id LEFT JOIN users u ON ub.user_id = u.id GROUP BY b.id;`) defer rows.Close() if err != nil { return nil, err } var bots []Bot for rows.Next() { var bot Bot var userIDListString string var usernameListString string err := rows.Scan(&bot.ID, &bot.Name, &bot.Source, &userIDListString, &usernameListString) if err != nil { return nil, err } userIDList := strings.Split(userIDListString, ",") usernameList := strings.Split(usernameListString, ",") var users []User for i, _ := range userIDList { id, err := strconv.Atoi(userIDList[i]) if err != nil { return nil, err } users = append(users, User{ID: id, Name: usernameList[i], PasswordHash: nil}) } bot.Users = users bots = append(bots, bot) } if err = rows.Err(); err != nil { return bots, err } return bots, nil } func (s *State) LinkArchIDsToBot(botid int, archIDs []int) error { // delete preexisting links _, err := s.db.Exec("DELETE FROM arch_bot_rel WHERE bot_id=?;", botid) if err != nil { log.Println("Error deleting old arch bot link: ", err) return err } // yes, we're building this by hand, but as we only insert int's I'm just confident that whoever // gets some sqli here just deserves it :D query := "INSERT INTO arch_bot_rel (arch_id, bot_id) VALUES" for idx, id := range archIDs { query += fmt.Sprintf("(%d, %d)", id, botid) if idx != len(archIDs)-1 { query += ", " } } query += ";" log.Println(query) _, err = s.db.Exec(query) if err != nil { log.Println("LinkArchIDsToBot err: ", err) return err } else { return nil } } func (s *State) LinkBitIDsToBot(botid int, bitIDs []int) error { // delete preexisting links _, err := s.db.Exec("DELETE FROM bit_bot_rel WHERE bot_id=?;", botid) if err != nil { log.Println("Error deleting old bit bot link: ", err) return err } // yes, we're building this by hand, but as we only insert int's I'm just confident that whoever // gets some sqli here just deserves it :D query := "INSERT INTO bit_bot_rel (bit_id, bot_id) VALUES" for idx, id := range bitIDs { query += fmt.Sprintf("(%d, %d)", id, botid) if idx != len(bitIDs)-1 { query += ", " } } query += ";" log.Println(query) _, err = s.db.Exec(query) if err != nil { log.Println("LinkBitIDsToBot err: ", err) return err } else { return nil } } ////////////////////////////////////////////////////////////////////////////// // HTTP func botsHandler(w http.ResponseWriter, r *http.Request) { switch r.Method { case "GET": // define data data := map[string]interface{}{} session, _ := globalState.sessions.Get(r, "session") username := session.Values["username"] data["pagelink1"] = Link{"bot", "/bot"} data["pagelink1options"] = []Link{ {Name: "user", Target: "/user"}, {Name: "battle", Target: "/battle"}, } data["pagelinknext"] = []Link{ {Name: "new", Target: "/new"}, } if username == nil { http.Redirect(w, r, "/login", http.StatusMethodNotAllowed) } user, err := UserGetUserFromUsername(username.(string)) if err != nil { data["err"] = "Could not fetch the user" } else { data["user"] = user } bots, err := globalState.GetAllBotsWithUsers() data["bots"] = bots // get the template t, err := template.ParseGlob("./templates/*.html") if err != nil { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Error reading template file")) http.Error(w, err.Error(), http.StatusInternalServerError) return } // exec! t.ExecuteTemplate(w, "bots", data) default: http.Redirect(w, r, "/", http.StatusMethodNotAllowed) } } func botSingleHandler(w http.ResponseWriter, r *http.Request) { vars := mux.Vars(r) botid, err := strconv.Atoi(vars["id"]) if err != nil { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Invalid bot id")) http.Error(w, err.Error(), http.StatusInternalServerError) return } switch r.Method { case "GET": // define data data := map[string]interface{}{} data["pagelink1"] = Link{"bot", "/bot"} data["pagelink1options"] = []Link{ {Name: "user", Target: "/user"}, {Name: "battle", Target: "/battle"}, } // display errors passed via query parameters log.Println("[d] Getting previous results") queryres := r.URL.Query().Get("res") if queryres != "" { data["res"] = queryres } session, _ := globalState.sessions.Get(r, "session") username := session.Values["username"].(string) viewer, err := UserGetUserFromUsername(username) if err != nil { data["err"] = "Could not get the id four your username... Please contact an admin" } bot, err := BotGetById(int(botid)) data["bot"] = bot data["user"] = viewer // open radare without input for building the bot r2p1, err := r2pipe.NewPipe("--") if err != nil { panic(err) } defer r2p1.Close() src := strings.ReplaceAll(bot.Source, "\r\n", "; ") radareCommand := fmt.Sprintf("rasm2 -a %s -b %s \"%+v\"", bot.Archs[0].Name, bot.Bits[0].Name, src) bytecode, err := r2cmd(r2p1, radareCommand) if err != nil { data["err"] = "Error assembling the bot" http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) return } data["bytecode_r2cmd"] = radareCommand data["bytecode"] = bytecode radareCommand = fmt.Sprintf("rasm2 -a %s -b %s -D %+v", bot.Archs[0].Name, bot.Bits[0].Name, bytecode) disasm, err := r2cmd(r2p1, radareCommand) if err != nil { data["err"] = "Error disassembling the bot" http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) return } data["err"] = "Could not get the id four your username... Please contact an admin" data["disasm_r2cmd"] = radareCommand data["disasm"] = disasm // define the breadcrumbs data["pagelink2"] = Link{bot.Name, fmt.Sprintf("/%d", bot.ID)} allBotNames, err := BotGetAll() var opts []Link for _, bot := range allBotNames { opts = append(opts, Link{Name: bot.Name, Target: fmt.Sprintf("/%d", bot.ID)}) } data["pagelink2options"] = opts editable := false for _, user := range bot.Users { if user.ID == viewer.ID { editable = true } } if editable == true { data["editable"] = true } // get all architectures and set the enable flag on the ones that are enabled in the battle archs, err := ArchGetAll() if err != nil { data["err"] = "Could not fetch the archs" } else { data["archs"] = archs } for i, a := range archs { for _, b := range bot.Archs { if a.ID == b.ID { archs[i].Enabled = true } } } // get all bits and set the enable flag on the ones that are enabled in the battle bits, err := BitGetAll() if err != nil { data["err"] = "Could not fetch the bits" } else { data["bits"] = bits } for i, a := range bits { for _, b := range bot.Bits { if a.ID == b.ID { bits[i].Enabled = true } } } // get the template t, err := template.ParseGlob("./templates/*.html") if err != nil { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Error reading template file")) http.Error(w, err.Error(), http.StatusInternalServerError) return } // exec! t.ExecuteTemplate(w, "botSingle", data) case "POST": // checking if the user submitting the bot information is allowed to do so session, _ := globalState.sessions.Get(r, "session") username := session.Values["username"].(string) // get the user submitting log.Println("Getting the user submitting the change request...") requesting_user, err := UserGetUserFromUsername(username) if err != nil { log.Println("err: ", err) http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) return } // get the users the bot belongs log.Println("Getting the user the bot belongs to...") orig_bot, err := BotGetById(int(botid)) if err != nil { log.Println("err: ", err) http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) return } // check if the user submitting the change request is within the users the bot belongs to log.Println("Checking if edit is allowed...") allowed_to_edit := false for _, user := range orig_bot.Users { if user.ID == requesting_user.ID { allowed_to_edit = true } } if allowed_to_edit == false { http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) return } // at this point, we're sure the user is allowed to edit the bot r.ParseForm() name := r.Form.Get("name") source := r.Form.Get("source") var archIDs []int var bitIDs []int for k, _ := range r.Form { if strings.HasPrefix(k, "arch-") { id, err := strconv.Atoi(strings.TrimPrefix(k, "arch-")) if err != nil { msg := "ERROR: Invalid arch id" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } archIDs = append(archIDs, id) } if strings.HasPrefix(k, "bit-") { id, err := strconv.Atoi(strings.TrimPrefix(k, "bit-")) if err != nil { msg := "ERROR: Invalid bit id" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } bitIDs = append(bitIDs, id) } } if len(archIDs) == 0 { msg := "ERROR: Please select an architecture" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } if len(archIDs) >= 2 { msg := "ERROR: Please select ONE architecture" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } if len(bitIDs) == 0 { msg := "ERROR: Please select one of the bits" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } if len(bitIDs) >= 2 { msg := "ERROR: Please select ONE of the bits" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } // link archs to battle err = BotLinkArchIDs(botid, archIDs) if err != nil { log.Println("Error linking the arch ids to the battle: ", err) msg := "ERROR: Could not create due to internal reasons" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } // link bits to battle err = BotLinkBitIDs(botid, bitIDs) if err != nil { log.Println("Error linking the bit ids to the battle: ", err) msg := "ERROR: Could not create due to internal reasons" http.Redirect(w, r, fmt.Sprintf("/bot/%d?res=%s", botid, msg), http.StatusSeeOther) return } if name != "" { if source != "" { log.Println("Updating bot...") err := BotUpdate(botid, name, source) if err != nil { log.Println("err: ", err) w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Error inserting bot into db")) http.Error(w, err.Error(), http.StatusInternalServerError) return } } } http.Redirect(w, r, fmt.Sprintf("/bot/%d", botid), http.StatusSeeOther) default: http.Redirect(w, r, "/", http.StatusMethodNotAllowed) } } func botNewHandler(w http.ResponseWriter, r *http.Request) { switch r.Method { case "GET": // define data data := map[string]interface{}{} session, _ := globalState.sessions.Get(r, "session") username := session.Values["username"].(string) data["pagelink1"] = Link{Name: "bot", Target: "/bot"} data["pagelink1options"] = []Link{ {Name: "user", Target: "/user"}, {Name: "battle", Target: "/battle"}, } data["pagelink2"] = Link{Name: "new", Target: "/new"} data["pagelink2options"] = []Link{ {Name: "list", Target: ""}, } // display errors passed via query parameters log.Println("[d] Getting previous results") queryres := r.URL.Query().Get("res") if queryres != "" { data["res"] = queryres } user, err := UserGetUserFromUsername(username) if err != nil { data["err"] = "Could not fetch the user" } else { data["user"] = user } archs, err := ArchGetAll() if err != nil { data["err"] = "Could not fetch the archs" } else { data["archs"] = archs } bits, err := BitGetAll() if err != nil { data["err"] = "Could not fetch the bits" } else { data["bits"] = bits } // get the template t, err := template.ParseGlob("./templates/*.html") if err != nil { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Error reading template file")) http.Error(w, err.Error(), http.StatusInternalServerError) return } // exec! t.ExecuteTemplate(w, "botNew", data) case "POST": session, _ := globalState.sessions.Get(r, "session") username := session.Values["username"].(string) // parse the post parameters r.ParseForm() log.Println("---") log.Println(r.Form) log.Println("---") name := r.Form.Get("name") source := r.Form.Get("source") if name == "" { msg := "ERROR: Please provide a name" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } if source == "" { msg := "ERROR: Please provide some source" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } var archIDs []int var bitIDs []int for k, _ := range r.Form { if strings.HasPrefix(k, "arch-") { id, err := strconv.Atoi(strings.TrimPrefix(k, "arch-")) if err != nil { msg := "ERROR: Invalid arch id" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } archIDs = append(archIDs, id) } if strings.HasPrefix(k, "bit-") { id, err := strconv.Atoi(strings.TrimPrefix(k, "bit-")) if err != nil { msg := "ERROR: Invalid bit id" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } bitIDs = append(bitIDs, id) } } if len(archIDs) == 0 { msg := "ERROR: Please select an architecture" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } if len(archIDs) >= 2 { msg := "ERROR: Please select ONE architecture" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } if len(bitIDs) == 0 { msg := "ERROR: Please select one of the bits" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } if len(bitIDs) >= 2 { msg := "ERROR: Please select ONE of the bits" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } botid, err := BotCreate(name, source) if err != nil { log.Println("Error creating the bot: ", err) msg := "ERROR: Could not create bot" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } err = UserLinkBot(username, botid) if err != nil { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte("500 - Error adding the bot to the user")) http.Error(w, err.Error(), http.StatusInternalServerError) return } if len(archIDs) == 0 { msg := "ERROR: Please select an architecture" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } // link archs to battle err = BotLinkArchIDs(botid, archIDs) if err != nil { log.Println("Error linking the arch ids to the bot: ", err) msg := "ERROR: Could not create due to internal reasons" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } if len(bitIDs) == 0 { msg := "ERROR: Please select an bits" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } // link bits to battle err = BotLinkBitIDs(botid, bitIDs) if err != nil { log.Println("Error linking the bit ids to the bot: ", err) msg := "ERROR: Could not create due to internal reasons" http.Redirect(w, r, fmt.Sprintf("/bot/new?res=%s", msg), http.StatusSeeOther) return } http.Redirect(w, r, "/bot", http.StatusSeeOther) return default: http.Redirect(w, r, "/", http.StatusMethodNotAllowed) } }