|
| 1 | +#!/usr/bin/env python |
| 2 | +''' |
| 3 | +owtf is an OWASP+PTES-focused try to unite great tools & facilitate pentesting |
| 4 | +Copyright (c) 2013, Abraham Aranguren <name.surname@gmail.com> http://7-a.org |
| 5 | +All rights reserved. |
| 6 | +
|
| 7 | +Redistribution and use in source and binary forms, with or without |
| 8 | +modification, are permitted provided that the following conditions are met: |
| 9 | + * Redistributions of source code must retain the above copyright |
| 10 | + notice, this list of conditions and the following disclaimer. |
| 11 | + * Redistributions in binary form must reproduce the above copyright |
| 12 | + notice, this list of conditions and the following disclaimer in the |
| 13 | + documentation and/or other materials provided with the distribution. |
| 14 | + * Neither the name of the copyright owner nor the |
| 15 | + names of its contributors may be used to endorse or promote products |
| 16 | + derived from this software without specific prior written permission. |
| 17 | +
|
| 18 | +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
| 19 | +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
| 20 | +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
| 21 | +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
| 22 | +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
| 23 | +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 24 | +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON |
| 25 | +ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 26 | +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 27 | +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 28 | +
|
| 29 | +# Inbound Proxy Module developed by Bharadwaj Machiraju (blog.tunnelshade.in) |
| 30 | +# as a part of Google Summer of Code 2013 |
| 31 | +''' |
| 32 | +from OpenSSL import crypto |
| 33 | +import os |
| 34 | +import hashlib |
| 35 | +import re |
| 36 | + |
| 37 | + |
| 38 | +def gen_signed_cert(domain, ca_crt, ca_key, ca_pass, certs_folder): |
| 39 | + """ |
| 40 | + This function takes a domain name as a parameter and then creates a certificate and key with the |
| 41 | + domain name(replacing dots by underscores), finally signing the certificate using specified CA and |
| 42 | + returns the path of key and cert files. If you are yet to generate a CA then check the top comments |
| 43 | + """ |
| 44 | + key_path = os.path.join(certs_folder, re.sub( |
| 45 | + '[^-0-9a-zA-Z_]', '_', domain) + ".key") |
| 46 | + cert_path = os.path.join(certs_folder, re.sub( |
| 47 | + '[^-0-9a-zA-Z_]', '_', domain) + ".crt") |
| 48 | + |
| 49 | + # The first conditions checks if file exists, and does nothing if true |
| 50 | + # If file doenst exist lock is obtained for writing (Other processes in race must wait) |
| 51 | + # After obtaining lock another check to handle race conditions gracefully |
| 52 | + if os.path.exists(key_path) and os.path.exists(cert_path): |
| 53 | + pass |
| 54 | + else: |
| 55 | + |
| 56 | + # Check happens if the certificate and key pair already exists for a |
| 57 | + # domain |
| 58 | + if os.path.exists(key_path) and os.path.exists(cert_path): |
| 59 | + pass |
| 60 | + else: |
| 61 | + # Serial Generation - Serial number must be unique for each certificate, |
| 62 | + # so serial is generated based on domain name |
| 63 | + md5_hash = hashlib.md5() |
| 64 | + md5_hash.update(domain) |
| 65 | + serial = int(md5_hash.hexdigest(), 36) |
| 66 | + # The CA stuff is loaded from the same folder as this script |
| 67 | + |
| 68 | + ca_cert = crypto.load_certificate( |
| 69 | + crypto.FILETYPE_PEM, open(ca_crt).read()) |
| 70 | + # The last parameter is the password for your CA key file |
| 71 | + ca_key = crypto.load_privatekey( |
| 72 | + crypto.FILETYPE_PEM, open(ca_key).read(), ca_pass) |
| 73 | + key = crypto.PKey() |
| 74 | + key.generate_key(crypto.TYPE_RSA, 2048) |
| 75 | + cert = crypto.X509() |
| 76 | + cert.get_subject().C = "IN" |
| 77 | + cert.get_subject().ST = "BL" |
| 78 | + cert.get_subject().L = "127.0.0.1" |
| 79 | + cert.get_subject().O = "MobSec" |
| 80 | + cert.get_subject().OU = "MobSec-Proxy" |
| 81 | + cert.get_subject().CN = domain |
| 82 | + cert.gmtime_adj_notBefore(0) |
| 83 | + cert.gmtime_adj_notAfter(365 * 24 * 60 * 60) |
| 84 | + cert.set_serial_number(serial) |
| 85 | + cert.set_issuer(ca_cert.get_subject()) |
| 86 | + cert.set_pubkey(key) |
| 87 | + cert.sign(ca_key, "sha1") |
| 88 | + # The key and cert files are dumped and their paths are returned |
| 89 | + domain_key = open(key_path, "w") |
| 90 | + domain_key.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, key)) |
| 91 | + domain_cert = open(cert_path, "w") |
| 92 | + domain_cert.write(crypto.dump_certificate( |
| 93 | + crypto.FILETYPE_PEM, cert)) |
| 94 | + # print(("[*] Generated signed certificate for %s" % (domain))) |
| 95 | + return key_path, cert_path |
0 commit comments