#!/usr/bin/bash
#
# wget.sh
#
# Brett Lee
##########################################################################

# Don't have access to wget?  Use 'portals' instead!!!
#
# Am calling it portals, as that is the name BSD gave it back in the day.
# For more, see the article 'Portals in 4.4 BSD' by Stevens & Pendry.
#
#
# Anyway, I was doing some pen testing and looking for a way to copy files to 
# the node under test (NUT).  It's amazing how many tools exist for this on a 
# Unix system.  Once the tools are exhausted, we're left to our own
# code.  Assuming we don't have access to a compiler (cc, gcc, g++, javac, etc.)
# on the NUT, scripting languages that provide sockets (perl, python, gawk, etc.)
# are the next logical choices.  So after exhausting all those, I found that
# sockets could also be made with certain shells (Bash, Ksh-93) using /dev/tcp.
#
# Here's a quick example:  `cat </dev/tcp/time-a.nist.gov/13`
#
# For a little bit more, below you will find my implementation of 'wget' 
# using /dev/tcp.  Enjoy !
#
#
# Note:
# -------
# Many OS installs of Bash support this functionality by default.
# Check your system to see if '/dev/tcp' is there before proceeding.
# It is certainly a security hole, so to disable this functionality recompile
# Bash with --disable-net-redirections.
# It turns out that you do not actually read or write from this device file.
# Instead, Bash intercepts the reads/writes and handles the sockets itself.
# 
# If you don't have /dev/tcp, you *can* enable it by recompiling Bash with
# --enable-net-redirections, but you will be *MUCH* better off using 
# 'netcat' instead.  See this directory or Google for 'netcat' examples.
#
#

usage() {
  echo "Usage: $0 <url>"
  echo "Example: $0 http://www.google.com/index.html"
  exit 0
}
[ -z $1 ] && usage;

[ $(echo $1|grep "http://"|wc -l) -eq 1 ] || usage;

nohttpprefix=${1#*//}
host=${nohttpprefix%%/*}
pathtofile=${nohttpprefix#*/}
filename=${1##*/}

if [ $pathtofile == $host ]; then
  pathtofile="" && filename="index.html"
fi


# wget function - issue HTTP request for a file
#
wget() {

# echo "Host: $host"
# echo "Full path to file: $pathtofile"
# echo "File: $filename"

  # Open a TCP socket and connect stdin and stdout to file
  # descriptor '3'
  exec 3<>/dev/tcp/${host}/80


  # Issue a HTTP request for a file.  The response will be sent
  # to file descriptor '3'
  #
  echo -e "GET /${pathtofile} HTTP/1.1\r
User-Agent: BrettGet/1.10.2\r
Accept: */*\r
Host: ${host}\r
Connection: Keep-Alive\r\n\r\n" >&3


  # The response includes both a HTTP header as well as the file.
  # Let's cat the response through a 'filter' function to filter
  # off the header and save only the file.
  #
  cat <&3 | filter
}


# Filter function - filter off the HTTP header and save only the file
#
filter() {
  count=0; while read line; do
#   echo "$((count++)): " $line
    [ $(echo $line | wc -c) -eq 2 ] && break
  done
  echo "Saving file to ${filename}..."
  cat >${filename}
}


wget