Annotation of botnow/Shell.pm, Revision 1.1.1.1
1.1 bountyht 1: #!/usr/bin/perl
2:
3: package Shell;
4:
5: use strict;
6: use warnings;
7: use OpenBSD::Pledge;
8: use OpenBSD::Unveil;
9: use MIME::Base64;
10: use Data::Dumper;
11: use Digest::SHA qw(sha256_hex);
12: use lib './';
13: require "SQLite.pm";
14: require "Hash.pm";
15:
16: my %conf = %main::conf;
17: my $chans = $conf{chans};
18: my $teamchans = $conf{teamchans};
19: my @teamchans = split /[,\s]+/m, $teamchans;
20: my $staff = $conf{staff};
21: my $captchaURL = "https://example.com/captcha.php?vhost=";
22: my $hostname = $conf{hostname};
23: my $terms = $conf{terms};
24: my $expires = $conf{expires};
25: my $mailfrom = $conf{mailfrom};
26: my $mailname = $conf{mailname};
27: my $passpath = "/etc/passwd";
28: my $httpdconfpath = "/etc/httpd.conf";
29: my $acmeconfpath = "/etc/acme-client.conf";
30: main::cbind("pub", "-", "shell", \&mshell);
31: main::cbind("msg", "-", "shell", \&mshell);
32:
33: sub init {
34: #dependencies for figlet
35: unveil("/usr/local/bin/figlet", "rx") or die "Unable to unveil $!";
36: unveil("/usr/lib/libc.so.95.1", "r") or die "Unable to unveil $!";
37: unveil("/usr/libexec/ld.so", "r") or die "Unable to unveil $!";
38: #dependencies for shell account
39: unveil($passpath, "r") or die "Unable to unveil $!";
40: unveil($httpdconfpath, "rwxc") or die "Unable to unveil $!";
41: unveil($acmeconfpath, "rwxc") or die "Unable to unveil $!";
42: unveil("/usr/sbin/chown", "rx") or die "Unable to unveil $!";
43: unveil("/bin/chmod", "rx") or die "Unable to unveil $!";
44: unveil("/usr/sbin/groupadd", "rx") or die "Unable to unveil $!";
45: unveil("/usr/sbin/useradd", "rx") or die "Unable to unveil $!";
46: unveil("/usr/sbin/groupdel", "rx") or die "Unable to unveil $!";
47: unveil("/usr/sbin/userdel", "rx") or die "Unable to unveil $!";
48: unveil("/bin/mkdir", "rx") or die "Unable to unveil $!";
49: unveil("/bin/ln", "rx") or die "Unable to unveil $!";
50: unveil("/usr/sbin/acme-client", "rx") or die "Unable to unveil $!";
51: unveil("/bin/rm", "rx") or die "Unable to unveil $!";
52: unveil("/bin/mv", "rx") or die "Unable to unveil $!";
53: unveil("/home/", "rwxc") or die "Unable to unveil $!";
54: }
55:
56: # !shell <username> <email>
57: # !shell captcha <captcha>
58: sub mshell {
59: my ($bot, $nick, $host, $hand, @args) = @_;
60: my ($chan, $text);
61: if (@args == 2) {
62: ($chan, $text) = ($args[0], $args[1]);
63: } else { $text = $args[0]; }
64: my $hostmask = "$nick!$host";
65: if (defined($chan) && $chans =~ /$chan/) {
66: main::putserv($bot, "PRIVMSG $chan :$nick: Please check private message");
67: }
68: if ($text =~ /^$/) {
69: main::putserv($bot, "PRIVMSG $nick :Type !help for new instructions");
70: foreach my $chan (@teamchans) {
71: main::putservlocalnet($bot, "PRIVMSG $chan :Help shell *$nick* on ".$bot->{name});
72: }
73: return;
74: } elsif (main::isstaff($bot, $nick) && $text =~ /^delete\s+([[:ascii:]]+)/) {
75: my $username = $1;
76: if (SQLite::deleterows("shell", "username", $username)) {
77: # TODO delete shell
78: deleteshell($bot, $username);
79: foreach my $chan (@teamchans) {
80: main::putserv($bot, "PRIVMSG $chan :$username deleted");
81: }
82: }
83: return;
84: }
85: ### TODO: Check duplicate emails ###
86: my @rows = SQLite::selectrows("irc", "nick", $nick);
87: foreach my $row (@rows) {
88: my $password = SQLite::get("shell", "ircid", $row->{id}, "password");
89: if (defined($password)) {
90: main::putserv($bot, "PRIVMSG $nick :Sorry, only one account per person. Please contact staff if you need help.");
91: return;
92: }
93: }
94: if ($text =~ /^lastseen\s+([[:alnum:]]+)/) {
95: }
96: if ($text =~ /^captcha\s+([[:alnum:]]+)/) {
97: my $text = $1;
98: my $ircid = SQLite::id("irc", "nick", $nick, $expires);
99: if (!defined($ircid)) { die "undefined ircid"; }
100: my $captcha = SQLite::get("shell", "ircid", $ircid, "captcha");
101: if ($text ne $captcha) {
102: main::putserv($bot, "PRIVMSG $nick :Wrong captcha. To get a new captcha, type !shell <username> <email>");
103: return;
104: }
105: my $pass = Hash::newpass();
106: chomp(my $encrypted = `encrypt $pass`);
107: my $username = SQLite::get("shell", "ircid", $ircid, "username");
108: my $email = SQLite::get("shell", "ircid", $ircid, "email");
109: my $version = SQLite::get("shell", "ircid", $ircid, "version");
110: my $bindhost = "$username.$hostname";
111: SQLite::set("shell", "ircid", $ircid, "password", $encrypted);
112: if (DNS::nextdns($username)) {
113: sleep(2);
114: createshell($bot, $username, $pass, $bindhost);
115: mailshell($username, $email, $pass, "shell", $version);
116: main::putserv($bot, "PRIVMSG $nick :Check your email!");
117:
118: #www($newnick, $reply, $password, "bouncer");
119: } else {
120: foreach my $chan (@teamchans) {
121: main::putserv($bot, "PRIVMSG $chan :Assigning bindhost $bindhost failed");
122: }
123: }
124: return;
125: } elsif ($text =~ /^([[:alnum:]]+)\s+([[:ascii:]]+)/) {
126: my ($username, $email) = ($1, $2);
127: my @users = col($passpath, 1, ":");
128: my @matches = grep(/^$username$/i, @users);
129: if (scalar(@matches) > 0) {
130: main::putserv($bot, "PRIVMSG $nick :Sorry, username taken. Please choose another username, or contact staff for help.");
131: return;
132: }
133: # my $captcha = join'', map +(0..9,'a'..'z','A'..'Z')[rand(10+26*2)], 1..4;
134: my $captcha = int(rand(999));
135: my $ircid = int(rand(2147483647));
136: SQLite::set("irc", "id", $ircid, "localtime", time());
137: SQLite::set("irc", "id", $ircid, "date", main::date());
138: SQLite::set("irc", "id", $ircid, "hostmask", $hostmask);
139: SQLite::set("irc", "id", $ircid, "nick", $nick);
140: SQLite::set("shell", "ircid", $ircid, "username", $username);
141: SQLite::set("shell", "ircid", $ircid, "email", $email);
142: SQLite::set("shell", "ircid", $ircid, "captcha", $captcha);
143: main::whois($bot->{sock}, $nick);
144: main::ctcp($bot->{sock}, $nick);
145: main::putserv($bot, "PRIVMSG $nick :".`figlet $captcha`);
146: main::putserv($bot, "PRIVMSG $nick :$captchaURL".encode_base64($captcha));
147: main::putserv($bot, "PRIVMSG $nick :Type !shell captcha <text>");
148: foreach my $chan (@teamchans) {
149: main::putservlocalnet($bot, "PRIVMSG $chan :$nick\'s captcha on $bot->{name} is $captcha");
150: }
151: } else {
152: main::putserv($bot, "PRIVMSG $nick :Invalid username or email. Type !shell <username> <email> to try again.");
153: foreach my $chan (@teamchans) {
154: main::putserv($bot, "PRIVMSG $chan :Help *$nick* on ".$bot->{name});
155: }
156: }
157: }
158: sub mailshell {
159: my( $username, $email, $password, $service, $version )=@_;
160: my $passhash = sha256_hex("$username");
161: my $versionhash = encode_base64($version);
162: my $ports;
163: my $body = <<"EOF";
164: You created a shell account!
165:
166: Username: $username
167: Password: $password
168: Server: $hostname
169: SSH Port: 22
170: Your Ports: $ports for plaintext
171:
172: *IMPORTANT*: Verify your email address:
173:
174: https://www.$hostname/register.php?id=$passhash&version=$versionhash
175:
176: You *MUST* click on the link or your account will be deleted.
177:
178: IRCNow
179: EOF
180: Mail::mail($mailfrom, $email, $mailname, "Verify IRCNow Account", $body);
181: }
182:
183:
184: #sub mregex {
185: # my ($bot, $nick, $host, $hand, $text) = @_;
186: # if ($staff !~ /$nick/) { return; }
187: # if ($text =~ /^ips?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
188: # my $ips = $1; # space-separated list of IPs
189: # main::putserv($bot, "PRIVMSG $nick :".regexlist($ips));
190: # } elsif ($text =~ /^users?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
191: # my $users = $1; # space-separated list of usernames
192: # main::putserv($bot, "PRIVMSG $nick :".regexlist($users));
193: # } elsif ($text =~ /^[-_()|0-9A-Za-z:,\.?*\s]{3,}$/) {
194: # my @lines = regex($text);
195: # foreach my $l (@lines) { print "$l\n"; }
196: # }
197: #}
198: #sub mforeach {
199: # my ($bot, $nick, $host, $hand, $text) = @_;
200: # if ($staff !~ /$nick/) { return; }
201: # if ($text =~ /^network\s+del\s+([[:graph:]]+)\s+(#[[:graph:]]+)$/) {
202: # my ($user, $chan) = ($1, $2);
203: # foreach my $n (@main::networks) {
204: # main::putserv($bot, "PRIVMSG *controlpanel :delchan $user $n->{name} $chan");
205: # }
206: # }
207: #}
208:
209: #sub loadlog {
210: # open(my $fh, '<', "$authlog") or die "Could not read file 'authlog' $!";
211: # chomp(@logs = <$fh>);
212: # close $fh;
213: #}
214:
215: # return all lines matching a pattern
216: #sub regex {
217: # my ($pattern) = @_;
218: # if (!@logs) { loadlog(); }
219: # return grep(/$pattern/, @logs);
220: #}
221:
222: # given a list of IPs, return matching users
223: # or given a list of users, return matching IPs
224: #sub regexlist {
225: # my ($items) = @_;
226: # my @items = split /[,\s]+/m, $items;
227: # my $pattern = "(".join('|', @items).")";
228: # if (!@logs) { loadlog(); }
229: # my @matches = grep(/$pattern/, @logs);
230: # my @results;
231: # foreach my $match (@matches) {
232: # if ($match =~ /^\[\d{4}-\d\d-\d\d \d\d:\d\d:\d\d\] \[([^]\/]+)(\/[^]]+)?\] connected to ZNC from (.*)/) {
233: # my ($user, $ip) = ($1, $3);
234: # if ($items =~ /[.:]/) { # items are IP addresses
235: # push(@results, $user);
236: # } else { # items are users
237: # push(@results, $ip);
238: # }
239: # }
240: # }
241: # my @sorted = sort @results;
242: # @results = do { my %seen; grep { !$seen{$_}++ } @sorted }; # uniq
243: # return join(' ', @results);
244: #}
245:
246: sub createshell {
247: my ($bot, $username, $password, $bindhost) = @_;
248: my $netname = $bot->{name};
249: system "doas groupadd $username";
250: system "doas adduser -batch $username $username $username `encrypt $password`";
251: system "doas chmod 700 /home/$username /home/$username/.ssh";
252: system "doas chmod 600 /home/$username/{.Xdefaults,.cshrc,.cvsrc,.login,.mailrc,.profile}";
253: system "doas mkdir /var/www/htdocs/$username";
254: system "doas ln -s /var/www/htdocs/$username /home/$username/htdocs";
255: system "doas chown -R $username:www /var/www/htdocs/$username /home/$username/htdocs";
256: system "doas chmod -R o-rx /var/www/htdocs/$username /home/$username/htdocs";
257: system "doas chmod -R g+rwx /var/www/htdocs/$username /home/$username/htdocs";
258: my $lusername = lc $username;
259: my $block = <<"EOF";
260: server "$lusername.$hostname" {
261: listen on * port 80
262: listen on * port 8001
263: location "/.well-known/acme-challenge/*" {
264: root "/acme"
265: request strip 2
266: }
267: location "*.php" {
268: fastcgi socket "/run/php-fpm.sock"
269: }
270: root "/htdocs/$username"
271: }
272: EOF
273: main::appendfile($httpdconfpath, $block);
274: $block = <<"EOF";
275: domain "$lusername.$hostname" {
276: domain key "/etc/ssl/private/$lusername.$hostname.key"
277: domain full chain certificate "/etc/ssl/$lusername.$hostname.fullchain.pem"
278: sign with letsencrypt
279: }
280: EOF
281: main::appendfile($acmeconfpath, $block);
282:
283: system "doas rcctl reload httpd";
284: system "doas mv /etc/ssl/private/$hostname.key /etc/ssl/private/l.k";
285: system "doas acme-client -F $lusername.$hostname";
286: system "doas ln -s /etc/ssl/crt/$lusername.$hostname.fullchain.pem /etc/ssl/$lusername.$hostname.crt";
287: system "doas mv /etc/ssl/private/l.k /etc/ssl/private/$hostname.key";
288: #edquota $username
289: return 1;
290: }
291:
292: sub deleteshell {
293: my ($bot, $username, $bindhost) = @_;
294: my $netname = $bot->{name};
295: my $lusername = lc $username;
296: system "doas groupdel $username";
297: system "doas userdel $username";
298: system "doas rm -f /etc/ssl/$lusername.$hostname.crt /etc/ssl/$lusername.$hostname.fullchain.pem /etc/ssl/private/$lusername.$hostname.key";
299: my $httpdconf = main::readstr($httpdconfpath);
300: my $block = <<"EOF";
301: server "$lusername.$hostname" {
302: listen on * port 80
303: location "/.well-known/acme-challenge/*" {
304: root "/acme"
305: request strip 2
306: }
307: location "*.php" {
308: fastcgi socket "/run/php-fpm.sock"
309: }
310: root "/htdocs/$username"
311: }
312: EOF
313: $block =~ s/{/\\{/gm;
314: $block =~ s/}/\\}/gm;
315: $block =~ s/\./\\./gm;
316: $block =~ s/\*/\\*/gm;
317: $httpdconf =~ s{$block}{}gm;
318: print $httpdconf;
319: main::writefile($httpdconfpath, $httpdconf);
320:
321: my $acmeconf = main::readstr($acmeconfpath);
322: $block = <<"EOF";
323: domain "$lusername.$hostname" {
324: domain key "/etc/ssl/private/$lusername.$hostname.key"
325: domain full chain certificate "/etc/ssl/$lusername.$hostname.fullchain.pem"
326: sign with letsencrypt
327: }
328: EOF
329: $block =~ s/{/\\{/gm;
330: $block =~ s/}/\\}/gm;
331: $block =~ s/\./\\./gm;
332: $block =~ s/\*/\\*/gm;
333: $acmeconf =~ s{$block}{}gm;
334: main::writefile($acmeconfpath, $acmeconf);
335: return 1;
336: }
337:
338: #TODO Fix for $i
339: # Return column $i from $filename as an array with file separator $FS
340: sub col {
341: my ($filename, $i, $FS) = @_;
342: my @rows = main::readarray($filename);
343: my @results;
344: foreach my $row (@rows) {
345: if ($row =~ /^(.*?)$FS/) {
346: push(@results, $1);
347: }
348: }
349: return @results;
350: }
351: #unveil("./newacct", "rx") or die "Unable to unveil $!";
352: 1; # MUST BE LAST STATEMENT IN FILE
CVSweb
![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to Shell.pm CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [local] / botnow