0

Overview: The flask application will accept a hostname from a user on the web-interface and then the hostname will be scanned using the testssl.sh script and for this I have tried to use the subprocess module to execute a sequence of commands by accessing the powershell using the subprocess module. When I am running the application on the development server, it is working as expected, but after deploying it on Microsoft IIS the following happens:

  1. If deployed using HttpPlatformHandler, the application does not work as expected and in the log file it gets logged that The system cannot find the path specified (whereas nothing as such is depicted when using development server i.e. localhost:5000) Image of Log file when deployed using HttpPlatformHandler

  2. If deployed using FastCGIHandler, then it throws the error like this (as shown in this post: https://stackoverflow.com/a/74404235/21615762). Even if I do make the changes as mentioned in the only answer given in this post, the application does not work as expected and in the log file only the following texts are logged and nothing else:

2023-05-25 07:46:27.325112: wfastcgi.py will restart when files in C:\inetpub\wwwroot\scanFCGI\ are changed: .((.py)|(.config))$ 2023-05-25 07:46:27.330072: wfastcgi.py 3.0.0 initialized 2023-05-25 07:46:27.760587: wfastcgi.py will restart when files in C:\inetpub\wwwroot\scanFCGI\ are changed: .((.py)|(.config))$ 2023-05-25 07:46:27.763589: wfastcgi.py 3.0.0 initialized 2023-05-25 07:51:40.936882: Running on_exit tasks 2023-05-25 07:51:40.952487: wfastcgi.py 3.0.0 closed 2023-05-25 07:51:42.405906: Running on_exit tasks 2023-05-25 07:51:42.405906: wfastcgi.py 3.0.0 closed

FLASK APPLICATION

from flask import Flask, render_template, request, jsonify, url_for, send_file
import subprocess
import os
import datetime

onlytime = datetime.datetime.now().strftime("%H%M")
app = Flask(__name__)  # Name of the flask application


@app.route("/")  # Default Route
def index():
    return render_template("Internal_Scanner.html")


@app.route(
    "/scan", methods=["POST"]
)  # Route to be taken when the Begin Scan button is clicked on the webpage
def scan():
    # Get the hostname from the form data
    hostname = request.form.get("hostname")
    if len(hostname) > 50:
        return jsonify({"return_output": "The hostname is too long."})
    elif hostname.find(" ") != -1:
        return jsonify(
            {
                "return_output": "The entered hostname is not valid as it has a whitespace."
            }
        )
    else:
        if hostname.find(":") == -1:
            htmlfilename = "{}_{}.html".format(hostname, onlytime)
        else:
            htmlfilename = "{}_{}.html".format((hostname.split(":"))[0], onlytime)
        
        # form the command sequence to be executed in powershell

        comm = "cd ..; cd .\\Ubuntu\\Ubuntu_2004.2021.825.0_x64\\; .\\ubuntu.exe run 'cd ..; cd ..; cd testssl.sh-3.1dev/; ./testssl.sh --htmlfile ../scanner/reports/scans/{} {}'".format(htmlfilename, hostname)

        subprocess.run(['powershell.exe','-Command',comm], shell=True)
        return_output = f"Scan completed for hostname: {hostname}."
        download_link = f"/api/download/{htmlfilename}"
        return jsonify(return_output=return_output, download_link=download_link)


@app.route(
    "/api/download/<string:filename>", methods=["GET"]
)  # Route to serve the generated report as a URL
def download_report(filename):
    # Serve the file from the reports directory
    # r"C:\WSL\reports\scans"
    file_path = os.path.join(r"C:\inetpub\wwwroot\scanner\reports\scans", filename)
    if os.path.isfile(file_path):
        return send_file(file_path, as_attachment=True)
    else:
        return jsonify({"error": "File not found"})

if __name__ == "__main__":
    app.run()`

HttpPlatformHandler web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <httpPlatform processPath="C:\Users\PRATEEK\AppData\Local\Programs\Python\Python311\python.exe" arguments="-m flask run --port %HTTP_PLATFORM_PORT%" stdoutLogEnabled="true" stdoutLogFile="C:\inetpub\wwwroot\scanner\logs\app.log" />
        <handlers>
            <add name="HphHandler" path="*" verb="*" modules="httpPlatformHandler" resourceType="Unspecified" />
        </handlers>
    </system.webServer>
</configuration>`

FastCGIHandler web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <add name="ScannerFCGIPowershellHandler" path="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" verb="*" modules="CgiModule" scriptProcessor="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" resourceType="Unspecified" requireAccess="Execute" />            
            <add name="ScannerFCGI" path="*" verb="*" modules="FastCgiModule" scriptProcessor="C:\inetpub\wwwroot\scanner\env\Scripts\python.exe|C:\inetpub\wwwroot\scanner\env\Lib\site-packages\wfastcgi.py" resourceType="Unspecified" requireAccess="Script" />
        </handlers>
    </system.webServer>
    <appSettings>
        <add key="WSGI_HANDLER" value="app.app" /> <!-- {name_o`your text`f_file}.{name_of_flask_app}-->
        <add key="PYTHONPATH" value="C:\inetpub\wwwroot\scanner" />
        <add key="WSGI_LOG" value="C:\inetpub\wwwroot\scanner\logs\app.log" />
    </appSettings>
</configuration>
PeaBee
  • 3
  • 4
  • For Python developers, it is recommended to use HttpPlatformHandler, because Microsoft no longer recommends FastCGI. You mentioned that the application doesn't work as expected when deployed using HttpPlatformHandler, please provide detailed error information. – YurongDai May 29 '23 at 07:53
  • Thank you @YurongDai for atleast trying to help me out. If you could kindly check the post once more, you may find that I have mentioned that when I deploy using HttpPlatformHandler, in the logs the only thing that is generated is that *The system cannot find the path specified*. I have uploaded an image of the log file for you generous reference, and other than this there is no other error message or anything displayed as such. – PeaBee May 30 '23 at 08:01
  • Based on my understanding, the error message might be thrown becasue of these lines in the flask application: comm = "cd ..; cd .\\Ubuntu\\Ubuntu_2004.2021.825.0_x64\\; .\\ubuntu.exe run 'cd ..; cd ..; cd testssl.sh-3.1dev/; ./testssl.sh --htmlfile ../scanner/reports/scans/{} {}'".format(htmlfilename, hostname) subprocess.run(['powershell.exe','-Command',comm], shell=True) – PeaBee May 30 '23 at 08:26
  • The error message you provided is probably caused by the way you structure and execute the subprocess.run command in your Flask application. There are a few potential issues that could cause this error. You'd better ask the developer familiar with your project to help you troubleshoot the issue. – YurongDai Jun 21 '23 at 09:19

0 Answers0