File server handler needs reworking

[c0okB]

In the put function（CChandle.go）,I input put '/root/too/curl.exe' 'c:\users\public\curl.exe', the author's code directly splices the absolute path of the local file (such as /root/tool/curl.exe) to www/. Although the file has been transferred to the www/ at this time, when the agent downloads the file, it will download curl.exe on http://example.com/www//root/tool/curl.exe instead of http://example.com/www/curl.exe. But http://example.com/www//root/tool/ is 404

[jm33-m0]

Thanks for reporting this, I will look into it shortly

[c0okB]

`
if len(cmdSlice) < 4 {
sendResponse(fmt.Sprintf("args error: %v", cmdSlice))
return
}

	filename_length := len(cmdSlice[1])
	filename_index := strings.LastIndex(cmdSlice[1],"/")
	DownloadFilename := SubStr(cmdSlice[1],filename_index+1,filename_length)


	url := fmt.Sprintf("%swww/%s", emp3r0r_data.CCAddress, DownloadFilename)



	path := cmdSlice[2]
	size, err := strconv.ParseInt(cmdSlice[3], 10, 64)
	if err != nil {
		out = fmt.Sprintf("processCCData: cant get size of %s: %v", url, err)
		sendResponse(out)
		return
	}

`

[jm33-m0]

I will rewrite the HTTP handler for better authentication, and when I am done there should be no problem with this upload function.

[jm33-m0]

TODO

• Allow only connected agents to download files
• Replace http.FileServer with a custom handler, so the /www path will change into something like /www/{token}
• Examine other APIs for security issues