A simple and lightweight server that allows clients to connect and launch a shell remotely through a browser.

Last update: Dec 27, 2022

Overview

carrotsh

A simple and lightweight server that allows clients to connect and launch a shell remotely through a browser. Uses xterm.js for the frontend and express for the backend.

Requirements

node.js
npm
python
python-cryptography

Installation

# Clone the repository
git clone https://github.com/AnnikaV9/carrotsh.git
 
# Change the working directory
cd carrotsh

# Install the dependencies
npm install

# Start the server
node index.js

Configuration

config.json should be used as the config file.

Available options:

port: The port the server should listen on.
shell: Path to the shell executable.
shell_timeout: The max age (ms) of the spawned shell session.
python_path: Path to your python interpreter.
salt: The password hashing salt.

Setting a password:

npm install will run setpass.py initially, but you will have to run it again if you change the password salt:

python3 setpass.py

Note: Before using carrotsh in production, it is highly recommended to enable TLS support:

Use a reverse proxy like ngnix
Modify index.js manually

Comments

Bump ws from 8.9.0 to 8.10.0
Bumps ws from 8.9.0 to 8.10.0.

Release notes

Sourced from ws's releases.

8.10.0

Features

Added an export for package.json (211d5d38).

Commits

cdca711 [dist] 8.10.0

211d5d3 [pkg] Add package.json export

c4d6eb3 [ci] Do not use the set-output command

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 1
Bump cryptography from 38.0.1 to 38.0.2
Bumps cryptography from 38.0.1 to 38.0.2.

Changelog

Sourced from cryptography's changelog.

38.0.2 - 2022-10-11

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.6.
.. _v38-0-1:

Commits

277ee0d 38.0.2 release (#7691)

ce119b8 version properly in the changelog (#7578)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 1
Bump vm2 from 3.9.10 to 3.9.11
Bumps vm2 from 3.9.10 to 3.9.11.

Release notes

Sourced from vm2's releases.

3.9.11

New Features

https://github.com/patriksimek/vm2/commit/58478a58c6f4af3c54faf4117ed5ab72d2cc8cd5: Add option require.strict to allow to load required modules in non strict mode.

Fixes

https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873: Security fix.

Changelog

Sourced from vm2's changelog.

v3.9.11 (2022-08-28)

[new] Add option require.strict to allow to load required modules in non strict mode.
[fix] Security fix.

Commits

392f126 Merge pull request #469 from XmiliaH/release-3.9.11

d6379e1 Merge pull request #468 from XmiliaH/fix-467

58478a5 Merge pull request #448 from XmiliaH/fix-442

6b0b71a Merge pull request #457 from XmiliaH/fix-456

06f8ef0 Finish release 3.9.11

d9a7f3c Fix 467

b8314b0 Allow false for require option

cb647c0 Clear up wording

a34b167 Add documentation

67c3fd4 Allow to override strict mode setting for modules

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 1
Bump ws from 8.9.0 to 8.11.0
Bumps ws from 8.9.0 to 8.11.0.

Release notes

Sourced from ws's releases.

8.11.0

Features

WebSocket.prototype.addEventListener() now supports an event listener specified as an object with a handleEvent() method. (9ab743aa).

Bug fixes

WebSocket.prototype.addEventListener() now adds an event listener only if it is not already in the list of the event listeners for the specified event type (1cec17da).

8.10.0

Features

Added an export for package.json (211d5d38).

Commits

afd8c62 [dist] 8.11.0

1cec17d [fix] Add the same event listener only once

9ab743a [feature] Add support for objets with a handleEvent() method

38f7879 [ci] Test on node 19

cdca711 [dist] 8.10.0

211d5d3 [pkg] Add package.json export

c4d6eb3 [ci] Do not use the set-output command

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
Bump cryptography from 38.0.1 to 38.0.3
Bumps cryptography from 38.0.1 to 38.0.3.

Changelog

Sourced from cryptography's changelog.

38.0.3 - 2022-11-01

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.7, which resolves *CVE-2022-3602* and *CVE-2022-3786*. .. _v38-0-2:
38.0.2 - 2022-10-11 (YANKED)

.. attention::

This release was subsequently yanked from PyPI due to a regression in OpenSSL.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.6.

.. _v38-0-1:

Commits

7d9c6c3 Bump for 38.0.3 release (#7761)

39f8011 attempt to workaround downstream package testing situation (#7725) (#7757)

5b12ac8 Use PyPy binaries from manylinux image instead of our own (#7678) (#7693)

277ee0d 38.0.2 release (#7691)

ce119b8 version properly in the changelog (#7578)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 0
Bump pm2 from 5.2.0 to 5.2.2
Bumps pm2 from 5.2.0 to 5.2.2.

Release notes

Sourced from pm2's releases.

5.2.2

fix cluster error avoiding process restart (#5396)

ensure increment_var value is a number (#5435)

update dependencies

add node latest to travis testing

Changelog

Sourced from pm2's changelog.

5.2.1

fix cluster error avoiding process restart (#5396)

ensure increment_var value is a number (#5435)

update dependencies

add node latest to travis testing

Commits

5e70845 [email protected]

d78f5ec [email protected]

09c5c52 add back 16/14/12 node.js versions

1dd1574 change php test dependency

e13ab5c add dist:focal

7c472e2 try out node 18

7e2850e [email protected]

fa16e17 Merge branch 'development' of github.com:Unitech/pm2 into development

b3b2ca7 Merge pull request #5396 from TeamGuilded/restartonerror

8ef8fd2 Merge pull request #5435 from watsonian/master

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
Bump express from 4.18.1 to 4.18.2
Bumps express from 4.18.1 to 4.18.2.

Release notes

Sourced from express's releases.

4.18.2

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

Changelog

Sourced from express's changelog.

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

Commits

8368dc1 4.18.2

61f4049 docs: replace Freenode with Libera Chat

bb7907b build: [email protected]

f56ce73 build: [email protected]

24b3dc5 deps: [email protected]

689d175 deps: [email protected]

340be0f build: [email protected]

33e8dc3 docs: use Node.js name style

644f646 build: [email protected]

ecd7572 build: [email protected]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
Bump ws from 8.8.1 to 8.9.0
Bumps ws from 8.8.1 to 8.9.0.

Release notes

Sourced from ws's releases.

8.9.0

Features

Added the ability to connect to Windows named pipes (#2079).

Commits

966f9d4 [dist] 8.9.0

e628f2b [feature] Support Windows named pipes (#2079)

7ff26d9 [doc] Fix nits

4ed2c87 [doc] Remove "note that"

0da6036 [test] Remove leftover from test

6b71a49 [minor] Rename the invalidURLMessage variable

2995349 [minor] Simplify the ws+unix: URL form

c22cbc9 [doc] Revise WebSocket#send() docs for clarity (#2077)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies javascript
opened by dependabot[bot] 0
Bump pyotp from 2.6.0 to 2.7.0
Bumps pyotp from 2.6.0 to 2.7.0.

Release notes

Sourced from pyotp's releases.

v2.7.0

Support Steam TOTP (#142)

Build, test, and documentation updates

Changelog

Sourced from pyotp's changelog.

Changes for v2.7.0 (2022-09-11)

Support Steam TOTP (#142)

Build, test, and documentation updates

Commits

8ced63e v2.7.0

b9b11d3 Use isort and black

d8acd41 Steam TOTP (#142)

6568c1a Add synonym

3089124 Remove unused target

c1dc430 Use unittest runner directly

baf8b99 Fix sphinx import path. Fixes #126

4a1fedc Build and test infra updates

a7d6e5e Release script: Correctly parse HTTPS origin URLs

cbe2c41 Create FUNDING.yml

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 0
Bump cryptography from 38.0.0 to 38.0.1
Bumps cryptography from 38.0.0 to 38.0.1.

Changelog

Sourced from cryptography's changelog.

38.0.1 - 2022-09-07

* Fixed parsing TLVs in ASN.1 with length greater than 65535 bytes (typically seen in large CRLs).
.. _v38-0-0:

Commits

3ff5218 Backport tlv fix, 38.0.1 bump (#7576)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 0

Bump cryptography from 37.0.4 to 38.0.0

Bumps cryptography from 37.0.4 to 38.0.0.

Changelog

Sourced from cryptography's changelog.

38.0.0 - 2022-09-06


* Final deprecation of OpenSSL 1.1.0. The next release of ``cryptography``
  will drop support.
* We no longer ship ``manylinux2010`` wheels. Users should upgrade to the
  latest ``pip`` to ensure this doesn't cause issues downloading wheels on
  their platform. We now ship ``manylinux_2_28`` wheels for users on new
  enough platforms.
* Updated the minimum supported Rust version (MSRV) to 1.48.0, from 1.41.0.
  Users with the latest ``pip`` will typically get a wheel and not need Rust
  installed, but check :doc:`/installation` for documentation on installing a
  newer ``rustc`` if required.
* :meth:`~cryptography.fernet.Fernet.decrypt` and related methods now accept
  both ``str`` and ``bytes`` tokens.
* Parsing ``CertificateSigningRequest`` restores the behavior of enforcing
  that the ``Extension`` ``critical`` field must be correctly encoded DER. See
  `the issue <https://github.com/pyca/cryptography/issues/6368>`_ for complete
  details.
* Added two new OpenSSL functions to the bindings to support an upcoming
  ``pyOpenSSL`` release.
* When parsing :class:`~cryptography.x509.CertificateRevocationList` and
  :class:`~cryptography.x509.CertificateSigningRequest` values, it is now
  enforced that the ``version`` value in the input must be valid according to
  the rules of :rfc:`2986` and :rfc:`5280`.
* Using MD5 or SHA1 in :class:`~cryptography.x509.CertificateBuilder` and
  other X.509 builders is deprecated and support will be removed in the next
  version.
* Added additional APIs to
  :class:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp`, including
  :attr:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp.signature_hash_algorithm`,
  :attr:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp.signature_algorithm`,
  :attr:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp.signature`, and
  :attr:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp.extension_bytes`.
* Added :attr:`~cryptography.x509.Certificate.tbs_precertificate_bytes`, allowing
  users to access the to-be-signed pre-certificate data needed for signed
  certificate timestamp verification.
* :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC` and
  :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC` now support
  :attr:`~cryptography.hazmat.primitives.kdf.kbkdf.CounterLocation.MiddleFixed`
  counter location.
* Fixed :rfc:`4514` name parsing to reverse the order of the RDNs according
  to the section 2.1 of the RFC, affecting method
  :meth:`~cryptography.x509.Name.from_rfc4514_string`.
* It is now possible to customize some aspects of encryption when serializing
  private keys, using
  :meth:`~cryptography.hazmat.primitives.serialization.PrivateFormat.encryption_builder`.
* Removed several legacy symbols from our OpenSSL bindings. Users of pyOpenSSL
  versions older than 22.0 will need to upgrade.
* Added
</tr></table>

... (truncated)

Commits

52d6f1a version bump for 38 release (#7567)
8c687e6 Bump rust-asn1 to 0.12.1 (#7564)
aca4b10 Bump rust-asn1 to 0.12.0 (#7563)
1742975 support setting more PKCS12 serialization encryption options (#7560)
abb1f54 Bump once_cell from 1.13.1 to 1.14.0 in /src/rust (#7559)
01a0e3b Bump BoringSSL version to 8462a367bb57e9524c3d8eca9c62733c63a63cf4 (#7558)
35a965f Bump ouroboros from 0.15.3 to 0.15.4 in /src/rust (#7557)
9a208e1 Bump BoringSSL version to 19009c51bff0706362e824f66a0b189326a1c27d (#7555)
b342224 Bump iana-time-zone from 0.1.46 to 0.1.47 in /src/rust (#7552)
edd1e69 attempt to fix josepy tests by pinning poetry (#7553)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python

opened by dependabot[bot] 0

Bump pyotp from 2.7.0 to 2.8.0
Bumps pyotp from 2.7.0 to 2.8.0.

Release notes

Sourced from pyotp's releases.

v2.8.0

Modify OTP generation to run in constant time (#148)

Documentation improvements

Drop Python 3.6 support; introduce Python 3.11 support

Changelog

Sourced from pyotp's changelog.

Changes for v2.8.0 (2022-12-13)

Modify OTP generation to run in constant time (#148)

Documentation improvements

Drop Python 3.6 support; introduce Python 3.11 support

Commits

618106c v2.8.0

ff1d3d0 Linting and CI improvements (#149)

0b6319b Modify OTP generation to run in constant time (#148)

3e7999d Update README.rst

179dc68 update readme to include import statement(s) (#146)

03045d5 Fixes for docs rendering (#145)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 0
Bump cryptography from 38.0.3 to 38.0.4
Bumps cryptography from 38.0.3 to 38.0.4.

Changelog

Sourced from cryptography's changelog.

38.0.4 - 2022-11-27

* Fixed compilation when using LibreSSL 3.6.0. * Fixed error when using ``py2app`` to build an application with a ``cryptography`` dependency.
.. _v38-0-3:

Commits

c18d056 38.0.4 changelog and version bump (#7854)

61e9d6a backport #7833 (#7853)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies python
opened by dependabot[bot] 0
Plaintext storage of TOTP secret key
Severity: Low (At the moment)

The Issue

The TOTP secret key generated by the server is stored as plaintext in login/2fa_key. While it is unlikely anyone who doesn't have access to the server can retrieve this key, this may change when new bugs or vulnerabilities surface in future updates.
commands/csh_setup_2fa.py#L16-L19

Patch Status

This issue has not been patched yet.

Symmetric/Asymmetric encryption with key file(s) is pointless, since the encryption key needs to be stored in the same server, and will face the same issue as the plaintext 2fa secret key.

Encrypting the 2fa key with the user password as the encryption passphrase is also not feasible, as the whole point of having an otp system is to keep the server secure even if the password is compromised.

A method to save the key in the operating system's keyring/keychain/secret-service is being worked on at the moment.

Workarounds

Ensure that only trusted user accounts can access the carrotsh directory in your server.

Ensure that no other webserver/fileserver is exposing the carrotsh directory to the internet.

If you do have a proper solution, feel free to make a pull request which references this issue
good first issue vulnerability
opened by AnnikaV9 4

Owner

V9

GitHub

Passive TCP/IP Fingerprinting Tool. Run this on your server and find out what Operating Systems your clients are really using.

Passive TCP/IP Fingerprinting This is a passive TCP/IP fingerprinting tool. Run this on your server and find out what operating systems your clients a

158 Dec 20, 2022

It can be used both locally and remotely (indicating IP and port)

It can be used both locally and remotely (indicating IP and port). It automatically finds the offset to the Instruction Pointer stored in the stack.

13 Dec 29, 2022

Interact remotely with the computer using Python and MQTT protocol 💻

Comandos_Remotos Interagir remotamento com o computador através do Python e protocolo MQTT. ?? Status: em desenvolvimento ?? Objetivo: Interagir com o

6 May 10, 2022

This tool will scans your wi-fi/wlan and show you the connected clients

3 Mar 24, 2022

Repo for investigation of timeouts that happens with prolonged training on clients

Flower-timeout Repo for investigation of timeouts that happens with prolonged training on clients. This repository is meant purely for demonstration o

1 Jan 21, 2022

jarbou3 is rat tool coded in python with C&C which can accept multiple connections from clients

jarbou3 Jarbou3 is rat tool with coded in python with C&C which can accept multi

108 Dec 29, 2022

🎥 PYnema is a simple UDP server written in python, allows you to watch downloaded videos.

?? PYnema is a simple UDP server written in python, allows you to watch downloaded videos.

1 Jan 16, 2022

Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect

wifi-password Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect. Works on macOS and Li

2.6k Jan 5, 2023

Python Program to connect to different VPN servers autoatically using Windscribe VPN.

AutomateVPN What is VPN ? VPN stands for Virtual Private Network , it is a technology that creates a safe and encrypted connectionover a less secure n

1 Oct 27, 2021

A python shell / chat bot for XMPP and cloud services

XMPP_Shell_Bot A python shell / chat bot for XMPP and cloud services, designed for penetration testers to bypass network filters. To better understand

1 Jan 9, 2022

This is a Client-Server-System which can share the screen from the server to client and in the other direction.

Screenshare-Streaming-Python This is a Client-Server-System which can share the screen from the server to client and in the other direction. You have

1 Nov 19, 2021

This is a Client-Server-System which can send audio from a microphone from the server to client and in the other direction.

Audio-Streaming-Python This is a Client-Server-System which can send audio from a microphone from the server to client and in the other direction. You

0 Jan 5, 2023

A simple and lightweight server that allows clients to connect and launch a shell remotely through a browser.

Related tags

Overview

carrotsh

Requirements

Installation

Configuration

Comments

8.10.0

Features

3.9.11

v3.9.11 (2022-08-28)

8.11.0

Features

Bug fixes

8.10.0

Features

5.2.2

5.2.1

4.18.2

4.18.2 / 2022-10-08

8.9.0

Features

v2.7.0

Changes for v2.7.0 (2022-09-11)

v2.8.0

Changes for v2.8.0 (2022-12-13)

The Issue

Patch Status

Workarounds

Owner

V9

Passive TCP/IP Fingerprinting Tool. Run this on your server and find out what Operating Systems your clients are *really* using.

It can be used both locally and remotely (indicating IP and port)

Interact remotely with the computer using Python and MQTT protocol 💻

This tool will scans your wi-fi/wlan and show you the connected clients

Repo for investigation of timeouts that happens with prolonged training on clients

jarbou3 is rat tool coded in python with C&C which can accept multiple connections from clients

🎥 PYnema is a simple UDP server written in python, allows you to watch downloaded videos.

Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect

Python Program to connect to different VPN servers autoatically using Windscribe VPN.

A python shell / chat bot for XMPP and cloud services

This is a Client-Server-System which can share the screen from the server to client and in the other direction.

This is a Client-Server-System which can send audio from a microphone from the server to client and in the other direction.

Test - Python project for Collection Server and API Server

Anonymously Reverse shell over Tor Network using Hidden Services without portfortwarding

Base on browser-time to get har from network, and use python to analyze the data .

A vpn that sits in your browser, accessible via a website

A vpn that sits in your browser, accessible via a website

GhostVPN - Simple and lightweight TUI application for CyberGhostVPN

A web-based app that allows easy, simple - and if desired high-throughput - analysis of qPCR data

Passive TCP/IP Fingerprinting Tool. Run this on your server and find out what Operating Systems your clients are really using.