diff --git a/core/checks.py b/core/checks.py index 0d7f9e8..284c5a8 100644 --- a/core/checks.py +++ b/core/checks.py @@ -22,7 +22,6 @@ from core.clis import Shell, MultilineShell from core.tcpserver import TcpServer import time -import telnetlib import sys if sys.version_info.major > 2 : @@ -54,6 +53,16 @@ Ejs ] +def _interact_with_telnet(hostname, port, timeout = 5): + try: + from telnetlib import Telnet + except ImportError: + log.error("The --bind-shell option requires telnetlib. On Python 3.13 or newer, install standard-telnetlib.") + return False + + Telnet(hostname, port, timeout = timeout).interact() + return True + def _print_injection_summary(channel): prefix = channel.data.get('prefix', '').replace('\n', '\\n') @@ -285,11 +294,11 @@ def check_template_injection(channel): try: - telnetlib.Telnet(urlparsed.hostname, bind_shell_port, timeout = 5).interact() + if _interact_with_telnet(urlparsed.hostname, bind_shell_port): - # If telnetlib does not rise an exception, we can assume that - # ended correctly and return from `run()` - return + # If telnetlib does not rise an exception, we can assume that + # ended correctly and return from `run()` + return except Exception as e: log.debug( "Error connecting to %s:%i %s" % ( diff --git a/requirements.txt b/requirements.txt index 031fa4b..dd31d32 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,5 +3,6 @@ certifi==2018.10.15 chardet==3.0.4 idna==2.8 requests==2.22.0 +standard-telnetlib==3.13.0; python_version >= "3.13" urllib3==1.24.1 wsgiref==0.1.2