Guide to API Privilege Escalation - Application Files

#!/usr/local/cpanel/3rdparty/bin/perl

# Package the module.
package MyNamespace::MyExample;

# Use the strict pragma. (Manners!)
use strict;

#Make this module inherit from this "groundwork" admin module.
#This eliminates a large swath of the boilerplate code that admin #modules used to require!
use parent qw( Cpanel::AdminBin::Script::Call );

# Use any additional modules.
use Cpanel::Logger               ();
use Cpanel::PwCache              ();

#Run the module as a script if (and only if) it is called that way.
#This "modulino" approach helps to facilitate testing and code
#reusability; for example, you could put some of this class's methods
#into a base class, then have 2 or more admin modules inherit
#from that base class.
__PACKAGE__->run() if !caller;

#This special function is a "whitelist" of actions that
#a caller may call. Anything not listed here cannot be called.
#
#By convention, these functions are named
#in ALLCAPS_SNAKE_CASE.
sub _actions {
    return qw(
        DEATH
        ECHO
        MIRROR
        BOUNCY
        HASHIFY
    );
}

#If, for some reason, you want to enable an admin action for a demo account,
#then list that action here.
sub _demo_actions { }

#------------------------
#Each "action" is its own method.
#It receives the arguments in list form as they were passed
#in to Cpanel::AdminBin::Call::call().
#
#For example, you could call the ECHO action thusly:
#
#Cpanel::AdminBin::Call::call(
#    'MyNamespace',
#    'MyExample',
#    'ECHO',
#    'the string',
#);
#
#...and ECHO would receive 'the string' as the $string argument.
#-----------------------

sub ECHO {
    my ($self, $string) = @_;
    return $string;
}

sub MIRROR {
    my ($self, $string) = @_;
    return scalar reverse $string;
}

sub BOUNCY {
    my ($self, $string) = @_;
    return _bouncy($string);
}

sub HASHIFY {
    my ($self, $string) = @_;
    return { ourdata => $string };
}

sub DEATH {
    die 'Arrgh!';
}

#This OPTIONAL function will be called before the function invocation.
#
#The $metadata_hr is a hash reference that contains, as of 11.54,
#a "wantarray" key that indicates the calling context: void, scalar, or list.
#(cf. perldoc wantarray)
#
#$args_ar is the array of arguments from the caller.
#
#NOTE: Both of the foregoing are "live" references. Take extra care
#not to modify them!
#
sub pre_execute_hook {
    my ($self, $metadata_hr, $args_ar) = @_;
    my $mod_name = (__PACKAGE__ =~ s<.*::><>r);
    Cpanel::Logger->new()->warn(
        sprintf(
            "User %s called the module "%s" with the function "%s" and arguments [%s]",
            $self->get_caller_username(),
            $self->get_action(),
            join( q< >, @$args_ar ),
        )
    );
    return;   #the actual return value(s) is/are ignored
}

sub _bouncy {
    my $data_in = shift;
    my $data_out = q{};

    for my $i ( 0 .. length($data_in) - 1 ) {
        if ($i % 2) {
            $data_out .= substr( $data_in,$i,1);
        }
        else {
            $data_out .= uc(substr( $data_in,$i,1));
        }
    }

    return $data_out;
}

1;

#!/usr/local/cpanel/3rdparty/bin/perl
use strict;
use Cpanel::AdminBin::Serializer ();
use Cpanel::Logger               ();
use Cpanel::PwCache              ();

my $stdin = <STDIN>;
chomp $stdin;
my ($uid,$function,$data) = split (/ /,$stdin,3);
#
 sanitize the input; in this case, only alphanumeric, underscore, space,
 period, and exclamation are allowed $data =~ s/![\w \.\!]//g;  

# make a note in the logs! my $user = (Cpanel::PwCache::getpwuid($uid))[0];
my $logger = Cpanel::Logger->new();
$logger -> warn("Myexample called by user $user with function: $function");

if ($function eq 'ECHO') {
        print $data;
        exit(0);
}

elsif ($function eq 'MIRROR') {
        print scalar reverse($data);
        exit(0);
}

elsif ($function eq 'BOUNCY') {
        print _bouncy($data);
        exit(0);
}

elsif ($function eq 'HASHIFY') {
        print ".\n" . Cpanel::AdminBin::Serializer::Dump ({ 'ourdata' =>  $data} );
        exit(0);
}

else {
        print "Invalid function specified to MyExample adminbin function";
        exit(1);
}

1;

sub _bouncy {
        my $data_in = shift;
        my $data_out = q{};
        for my $i (0..length($data_in)-1) {
                if ($i % 2) {
                        $data_out .= substr( $data_in,$i,1); }
                else {
                        $data_out .= uc(substr( $data_in,$i,1)); }}
        return $data_out;
}