diff --git a/etc/checksum/md5sum.md5 b/etc/checksum/md5sum.md5 index 118f904..d8044f3 100644 --- a/etc/checksum/md5sum.md5 +++ b/etc/checksum/md5sum.md5 @@ -1,4 +1,4 @@ -9874a6fea201b6c9a9105c61256c0335 ./zeus.py +f75a6d23bd80e9861153c9c52dce15bd ./zeus.py 6ad5f22ec4a6f8324bfb1b01ab6d51ec ./etc/scripts/cleanup.sh 155c9482f690f1482f324a7ffd8b8098 ./etc/scripts/fix_pie.sh 0e435c641bc636ac0b3d54e032d9cf6a .etc/scripts/install_nmap.sh @@ -32,20 +32,20 @@ c10fdf73c2b655e07d13ac8103bd321e ./lib/tamper_scripts/space2null_encode.py 3b8c95a6a3b7cecce5118f2fb1ccc6b8 ./lib/tamper_scripts/appendnull_encode.py d41d8cd98f00b204e9800998ecf8427e ./lib/__init__.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py -a48dc0484668393bece144e102273e99 ./lib/attacks/sqlmap_scan/__init__.py +d93cf7cdeabe951251f2f4d56687b5f4 ./lib/attacks/sqlmap_scan/__init__.py 5e5bb575014ebe613db6bf671d008cf8 ./lib/attacks/sqlmap_scan/sqlmap_opts.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/whois_lookup/__init__.py f27322b9716e1a2b0b0b0487f3149474 ./lib/attacks/whois_lookup/whois.py 2782c48ef762413f0e7ce7392786ce2d ./lib/attacks/admin_panel_finder/__init__.py 23c1e5e934029f9acc89d2c95e7748e7 ./lib/attacks/xss_scan/__init__.py -f5e10264d98d8c59b3d5ae86051bbcf2 ./lib/attacks/nmap_scan/__init__.py +27358f26bda30d7356143c3ea1fa99c5 ./lib/attacks/nmap_scan/__init__.py 216999fa0e84866d5c1d96d5676034e4 ./lib/attacks/nmap_scan/nmap_opts.py c5ebb0c56c9ae3b9a72a14e3f05afa16 ./lib/attacks/intel_me/__init__.py 1faa2b5dfad6eb538bbfe42942d2a9da ./lib/core/errors.py d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py -5e744093802861aa8548c29847fd3dbf ./lib/core/settings.py +95f45565a70e223e091ff306464c9888 ./lib/core/settings.py d41d8cd98f00b204e9800998ecf8427e ./var/google_search/__init__.py -b8761604c5d4f88ae653526057491a5f ./var/google_search/search.py +6fe42683a339115709c32562b305f116 ./var/google_search/search.py d41d8cd98f00b204e9800998ecf8427e ./var/__init__.py d41d8cd98f00b204e9800998ecf8427e ./var/auto_issue/__init__.py 4506850a02aa18e12bef4efeb760ad9e ./var/auto_issue/github.py diff --git a/lib/attacks/nmap_scan/__init__.py b/lib/attacks/nmap_scan/__init__.py index 8fb2370..3f34721 100644 --- a/lib/attacks/nmap_scan/__init__.py +++ b/lib/attacks/nmap_scan/__init__.py @@ -1,6 +1,7 @@ import json import os import socket +import shlex import subprocess import nmap @@ -140,7 +141,8 @@ def perform_port_scan(url, scanner=NmapHook, verbose=False, opts=None, **kwargs) "would you like to automatically install it", opts="yN" ) if question.lower().startswith("y"): - subprocess.call(["sudo", "sh", "{}".format(lib.core.settings.NMAP_INSTALLER_TOOL)]) + install_nmap_command = shlex.split("sudo sh {}".format(lib.core.settings.NMAP_INSTALLER_TOOL)) + subprocess.call(install_nmap_command) lib.core.settings.logger.info(lib.core.settings.set_color( "nmap has been successfully installed, re-running..." )) diff --git a/lib/attacks/sqlmap_scan/__init__.py b/lib/attacks/sqlmap_scan/__init__.py index 4ecc12d..dd6f9b0 100644 --- a/lib/attacks/sqlmap_scan/__init__.py +++ b/lib/attacks/sqlmap_scan/__init__.py @@ -1,6 +1,7 @@ import json import re import subprocess +import shlex try: import urllib2 # python 2 @@ -140,10 +141,10 @@ def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False): lib.core.settings.logger.info(lib.core.settings.set_color( "attempting to launch sqlmap API..." )) - subprocess.Popen( - ["sudo", "sh", "{}".format(lib.core.settings.LAUNCH_SQLMAP_API_TOOL), "p", "{}".format("".join(found_path))], - stdout=subprocess.PIPE - ) + sqlmap_api_command = shlex.split("sudo sh {} p {}".format( + lib.core.settings.LAUNCH_SQLMAP_API_TOOL, "".join(found_path) + )) + subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE) if is_started: lib.core.settings.logger.info(lib.core.settings.set_color( "sqlmap API is up and running, continuing process..." diff --git a/lib/core/settings.py b/lib/core/settings.py index 797a7e7..d153aed 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -5,6 +5,7 @@ import sys import glob import json import time +import shlex import difflib import logging import string @@ -482,15 +483,16 @@ def get_browser_version(): "attempting to get firefox browser version..." )) try: - output = subprocess.check_output(['firefox', '--version']) - except Exception: + firefox_version_command = shlex.split("firefox --version") + output = subprocess.check_output(firefox_version_command) + except (OSError, Exception): logger.error(set_color( "failed to run firefox...", level=50 )) return "failed to start" try: major, minor = map(int, re.search(r"(\d+).(\d+)", output).groups()) - except Exception: + except (ValueError, Exception): logger.error(set_color( "failed to parse '{}' for version number...".format(output), level=50 )) diff --git a/var/google_search/search.py b/var/google_search/search.py index b7ab79c..ed7a245 100644 --- a/var/google_search/search.py +++ b/var/google_search/search.py @@ -1,6 +1,7 @@ import os import re import time +import shlex import subprocess try: @@ -288,7 +289,8 @@ def parse_search_results( logger.warning(set_color( "this will kill all instances of the firefox web browser...", level=30 )) - subprocess.call(["sudo", "sh", CLEANUP_TOOL_PATH]) + auto_clean_command = shlex.split("sudo sh {}".format(CLEANUP_TOOL_PATH)) + subprocess.call(auto_clean_command) logger.info(set_color( "all open sessions of firefox killed, it should be safe to re-run " "Zeus..." @@ -307,7 +309,8 @@ def parse_search_results( logger.info(set_color( "attempting to reinstall failing dependency..." )) - subprocess.call(["sudo", "sh", FIX_PROGRAM_INSTALL_PATH]) + do_fix_command = shlex.split("sudo sh {}".format(FIX_PROGRAM_INSTALL_PATH)) + subprocess.call(do_fix_command) logger.info(set_color( "successfully installed, you should be good to re-run Zeus..." )) diff --git a/zeus.py b/zeus.py old mode 100755 new mode 100644 index d60d4bb..8657400 --- a/zeus.py +++ b/zeus.py @@ -2,6 +2,7 @@ import optparse import os +import shlex import subprocess import time @@ -510,7 +511,7 @@ if __name__ == "__main__": else: if URL_QUERY_REGEX.match(opt.spiderWebSite): is_sure = prompt( - "it is recomened to not use a URL that has a GET(query) parameter in it, " + "it is recommended to not use a URL that has a GET(query) parameter in it, " "would you like to continue", "yN" ) if is_sure.lower().startswith("y"): @@ -532,7 +533,8 @@ if __name__ == "__main__": "failed to provide a mandatory argument, you will be redirected to the help menu...", level=50 )) time.sleep(2) - subprocess.call("python zeus.py --help", shell=True) + zeus_help_menu_command = shlex.split("python zeus.py --help") + subprocess.call(zeus_help_menu_command) except IOError as e: if "Invalid URL" in str(e): logger.exception(set_color(