install.sh

#!/bin/bash

################################################################################
# WebSocket SSH Proxy Installer
# 
# This script automates the installation and configuration of the WebSocket
# SSH Proxy for use with HTTP Injector Custom Payload mode.
#
# Usage: bash <(curl -sL https://raw.githubusercontent.com/Codexxxa/wspros/main/install.sh)
################################################################################

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Default values
INSTALL_DIR="/usr/local/bin"
SERVICE_NAME="ws-proxy"
WS_PROXY_SCRIPT="${INSTALL_DIR}/ws-proxy.py"
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
DEFAULT_PORT=8080

################################################################################
# Helper Functions
################################################################################

print_header() {
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BLUE}  $1${NC}"
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
}

print_success() {
    echo -e "${GREEN}✓${NC} $1"
}

print_error() {
    echo -e "${RED}✗${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}⚠${NC} $1"
}

print_info() {
    echo -e "${BLUE}ℹ${NC} $1"
}

################################################################################
# Check Prerequisites
################################################################################

check_root() {
    print_header "Checking Root Privileges"
    if [ "$EUID" -ne 0 ]; then
        print_error "This script must be run as root or with sudo"
        echo "Please run: sudo bash $0"
        exit 1
    fi
    print_success "Running as root"
}

################################################################################
# Port Selection
################################################################################

select_port() {
    print_header "Port Selection"
    echo ""
    echo "Select the port for WebSocket proxy:"
    echo "  1) Port 80 (default HTTP port)"
    echo "  2) Port 8080 (recommended)"
    echo "  3) Port 443 (HTTPS port)"
    echo "  4) Custom port"
    echo ""
    
    while true; do
        read -p "Enter your choice [1-4] (default: 2): " choice
        choice=${choice:-2}
        
        case $choice in
            1)
                SELECTED_PORT=80
                break
                ;;
            2)
                SELECTED_PORT=8080
                break
                ;;
            3)
                SELECTED_PORT=443
                break
                ;;
            4)
                read -p "Enter custom port number (1024-65535): " custom_port
                if [[ $custom_port =~ ^[0-9]+$ ]] && [ $custom_port -ge 1024 ] && [ $custom_port -le 65535 ]; then
                    SELECTED_PORT=$custom_port
                    break
                else
                    print_error "Invalid port number. Please try again."
                fi
                ;;
            *)
                print_error "Invalid choice. Please select 1-4."
                ;;
        esac
    done
    
    print_success "Selected port: $SELECTED_PORT"
}

################################################################################
# Install Dependencies
################################################################################

install_dependencies() {
    print_header "Installing Dependencies"
    
    # Detect OS
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
    else
        print_error "Cannot detect OS"
        exit 1
    fi
    
    print_info "Detected OS: $OS"
    
    # Update package list
    print_info "Updating package list..."
    if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
        apt-get update -qq
    elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
        if command -v dnf &> /dev/null; then
            dnf check-update -q || true
        else
            yum check-update -q || true
        fi
    else
        print_warning "Unsupported OS. Attempting to continue..."
    fi
    
    # Install Python3
    if ! command -v python3 &> /dev/null; then
        print_info "Installing Python3..."
        if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
            apt-get install -y python3 python3-pip
        elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
            if command -v dnf &> /dev/null; then
                dnf install -y python3 python3-pip
            else
                yum install -y python3 python3-pip
            fi
        fi
        print_success "Python3 installed"
    else
        print_success "Python3 already installed ($(python3 --version))"
    fi
    
    # Install OpenSSH Server
    if ! command -v sshd &> /dev/null; then
        print_info "Installing OpenSSH Server..."
        if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
            apt-get install -y openssh-server
        elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
            if command -v dnf &> /dev/null; then
                dnf install -y openssh-server
            else
                yum install -y openssh-server
            fi
        fi
        print_success "OpenSSH Server installed"
    else
        print_success "OpenSSH Server already installed"
    fi
    
    # Install curl
    if ! command -v curl &> /dev/null; then
        print_info "Installing curl..."
        if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
            apt-get install -y curl
        elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
            if command -v dnf &> /dev/null; then
                dnf install -y curl
            else
                yum install -y curl
            fi
        fi
        print_success "curl installed"
    else
        print_success "curl already installed"
    fi
    
    # Install UFW
    if ! command -v ufw &> /dev/null; then
        print_info "Installing UFW firewall..."
        if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
            apt-get install -y ufw
        elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
            print_warning "UFW not available on this OS. Will use firewalld instead."
            if command -v dnf &> /dev/null; then
                dnf install -y firewalld
            else
                yum install -y firewalld
            fi
        fi
        print_success "Firewall installed"
    else
        print_success "Firewall already installed"
    fi
}

################################################################################
# Enable and Start SSH Service
################################################################################

setup_ssh() {
    print_header "Configuring SSH Service"
    
    # Enable SSH service
    print_info "Enabling SSH service..."
    systemctl enable ssh 2>/dev/null || systemctl enable sshd 2>/dev/null || true
    
    # Start SSH service
    print_info "Starting SSH service..."
    systemctl start ssh 2>/dev/null || systemctl start sshd 2>/dev/null || true
    
    # Check SSH status
    if systemctl is-active --quiet ssh || systemctl is-active --quiet sshd; then
        print_success "SSH service is running"
    else
        print_warning "SSH service may not be running properly"
    fi
}

################################################################################
# Handle Port Conflicts
################################################################################

handle_port_conflicts() {
    print_header "Checking Port Conflicts"
    
    # Install lsof if not available
    if ! command -v lsof &> /dev/null; then
        print_info "Installing lsof for port checking..."
        if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
            apt-get install -y lsof >/dev/null 2>&1
        elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "fedora" ]; then
            if command -v dnf &> /dev/null; then
                dnf install -y lsof >/dev/null 2>&1
            else
                yum install -y lsof >/dev/null 2>&1
            fi
        fi
    fi
    
    # Check if port is in use
    if command -v lsof &> /dev/null && lsof -Pi :$SELECTED_PORT -sTCP:LISTEN -t >/dev/null 2>&1 ; then
        print_warning "Port $SELECTED_PORT is currently in use"
        
        # Get the process using the port
        PROCESS=$(lsof -Pi :$SELECTED_PORT -sTCP:LISTEN | tail -n 1 | awk '{print $1}')
        print_info "Process using port: $PROCESS"
        
        # Stop Apache if it's using the port
        if [ "$PROCESS" = "apache2" ] || [ "$PROCESS" = "httpd" ]; then
            print_info "Stopping Apache..."
            systemctl stop apache2 2>/dev/null || systemctl stop httpd 2>/dev/null || true
            systemctl disable apache2 2>/dev/null || systemctl disable httpd 2>/dev/null || true
            print_success "Apache stopped and disabled"
        fi
        
        # Stop Nginx if it's using the port
        if [ "$PROCESS" = "nginx" ]; then
            print_info "Stopping Nginx..."
            systemctl stop nginx 2>/dev/null || true
            systemctl disable nginx 2>/dev/null || true
            print_success "Nginx stopped and disabled"
        fi
        
        # Check again
        if lsof -Pi :$SELECTED_PORT -sTCP:LISTEN -t >/dev/null 2>&1 ; then
            print_error "Port $SELECTED_PORT is still in use. Please manually stop the service."
            exit 1
        fi
    else
        print_success "Port $SELECTED_PORT is available"
    fi
}

################################################################################
# Create WebSocket Proxy Script
################################################################################

create_proxy_script() {
    print_header "Creating WebSocket Proxy Script"
    
    cat > "$WS_PROXY_SCRIPT" << 'EOFPYTHON'
#!/usr/bin/env python3
"""
SSH WebSocket Proxy

A simple proxy server that listens on a configurable port and forwards traffic
to a local SSH server on port 22 after handling WebSocket upgrade requests.

This script uses only Python standard libraries (socket, threading) to avoid
any C++ build tool requirements.
"""

import socket
import threading
import logging
import sys
import os

# Configuration - Port will be set by installer
LISTEN_HOST = '0.0.0.0'
LISTEN_PORT = int(os.environ.get('WS_PROXY_PORT', '8080'))
SSH_HOST = '127.0.0.1'
SSH_PORT = 22
BUFFER_SIZE = 4096

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    datefmt='%Y-%m-%d %H:%M:%S'
)
logger = logging.getLogger(__name__)


def forward_data(source, destination, direction):
    """
    Forward data from source socket to destination socket.
    
    Args:
        source: Source socket to read from
        destination: Destination socket to write to
        direction: String describing the direction for logging
    """
    try:
        while True:
            data = source.recv(BUFFER_SIZE)
            if not data:
                break
            destination.sendall(data)
    except (socket.error, OSError) as e:
        logger.debug(f"Connection closed ({direction}): {e}")
    finally:
        try:
            source.close()
        except (socket.error, OSError):
            pass
        try:
            destination.close()
        except (socket.error, OSError):
            pass


def is_websocket_upgrade(data):
    """
    Check if the HTTP request contains a WebSocket upgrade header.
    
    Args:
        data: Raw HTTP request data as bytes
        
    Returns:
        bool: True if the request is a WebSocket upgrade request
    """
    try:
        request = data.decode('utf-8', errors='ignore').lower()
        return 'upgrade: websocket' in request or 'upgrade:websocket' in request
    except (UnicodeDecodeError, AttributeError):
        return False


def is_connect_method(data):
    """
    Check if the HTTP request uses the CONNECT method.
    
    Args:
        data: Raw HTTP request data as bytes
        
    Returns:
        bool: True if the request uses CONNECT method
    """
    try:
        request = data.decode('utf-8', errors='ignore')
        return request.startswith('CONNECT ')
    except (UnicodeDecodeError, AttributeError):
        return False


def handle_client(client_socket, client_address):
    """
    Handle a client connection by intercepting WebSocket upgrade requests,
    CONNECT method, or direct connections and establishing a tunnel to the SSH server.
    
    Args:
        client_socket: The client socket connection
        client_address: The client's address tuple (ip, port)
    """
    logger.info(f"Client connected: {client_address[0]}:{client_address[1]}")
    
    ssh_socket = None
    try:
        # Receive initial data from client
        initial_data = client_socket.recv(BUFFER_SIZE)
        if not initial_data:
            logger.warning(f"No data received from {client_address}")
            client_socket.close()
            return
        
        # Check request type
        is_ws_upgrade = is_websocket_upgrade(initial_data)
        is_connect = is_connect_method(initial_data)
        
        if is_ws_upgrade:
            logger.info(f"WebSocket upgrade request detected from {client_address}")
            
            # Send HTTP 101 Switching Protocols response
            response = (
                "HTTP/1.1 101 Switching Protocols\r\n"
                "Upgrade: websocket\r\n"
                "Connection: Upgrade\r\n"
                "\r\n"
            )
            client_socket.sendall(response.encode('utf-8'))
            logger.info(f"Sent 101 Switching Protocols to {client_address}")
            
        elif is_connect:
            logger.info(f"CONNECT method detected from {client_address}")
            
            # Send HTTP 200 Connection Established response
            response = (
                "HTTP/1.1 200 Connection Established\r\n"
                "\r\n"
            )
            client_socket.sendall(response.encode('utf-8'))
            logger.info(f"Sent 200 Connection Established to {client_address}")
            
        else:
            # Direct connection - send 200 OK
            logger.info(f"Direct connection from {client_address}")
            response = (
                "HTTP/1.1 200 OK\r\n"
                "Connection: keep-alive\r\n"
                "\r\n"
            )
            client_socket.sendall(response.encode('utf-8'))
            logger.info(f"Sent 200 OK to {client_address}")
        
        # Connect to the local SSH server
        ssh_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        ssh_socket.connect((SSH_HOST, SSH_PORT))
        logger.info(f"Connected to SSH server at {SSH_HOST}:{SSH_PORT}")
        
        # For direct connections (not WebSocket/CONNECT), forward the initial data to SSH
        if not is_ws_upgrade and not is_connect:
            ssh_socket.sendall(initial_data)
        
        # Create threads to forward data bidirectionally
        client_to_ssh = threading.Thread(
            target=forward_data,
            args=(client_socket, ssh_socket, "client->ssh"),
            daemon=True
        )
        ssh_to_client = threading.Thread(
            target=forward_data,
            args=(ssh_socket, client_socket, "ssh->client"),
            daemon=True
        )
        
        # Start both forwarding threads
        client_to_ssh.start()
        ssh_to_client.start()
        
        # Wait for both threads to complete
        client_to_ssh.join()
        ssh_to_client.join()
        
    except ConnectionRefusedError:
        logger.error(f"Could not connect to SSH server at {SSH_HOST}:{SSH_PORT}")
        try:
            error_response = "HTTP/1.1 502 Bad Gateway\r\n\r\nSSH server unavailable"
            client_socket.sendall(error_response.encode('utf-8'))
        except (socket.error, OSError):
            pass
    except socket.error as e:
        logger.error(f"Socket error handling client {client_address}: {e}")
    except Exception as e:
        logger.error(f"Error handling client {client_address}: {e}")
    finally:
        try:
            client_socket.close()
        except (socket.error, OSError):
            pass
        try:
            if ssh_socket:
                ssh_socket.close()
        except (socket.error, OSError):
            pass
        logger.info(f"Client disconnected: {client_address[0]}:{client_address[1]}")


def start_proxy():
    """
    Start the SSH WebSocket proxy server.
    """
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    
    try:
        server_socket.bind((LISTEN_HOST, LISTEN_PORT))
        server_socket.listen(5)
        logger.info(f"SSH WebSocket Proxy started on {LISTEN_HOST}:{LISTEN_PORT}")
        logger.info(f"Forwarding traffic to {SSH_HOST}:{SSH_PORT}")
        logger.info("Press Ctrl+C to stop the proxy")
        
        while True:
            try:
                client_socket, client_address = server_socket.accept()
                # Handle each client in a separate thread
                client_thread = threading.Thread(
                    target=handle_client,
                    args=(client_socket, client_address),
                    daemon=True
                )
                client_thread.start()
            except KeyboardInterrupt:
                break
                
    except PermissionError:
        logger.error(f"Permission denied: Cannot bind to port {LISTEN_PORT}")
        logger.error("Try using a port > 1024 or run with proper permissions")
        sys.exit(1)
    except OSError as e:
        logger.error(f"Could not start proxy: {e}")
        sys.exit(1)
    finally:
        logger.info("Shutting down proxy server...")
        server_socket.close()


if __name__ == "__main__":
    start_proxy()
EOFPYTHON

    chmod +x "$WS_PROXY_SCRIPT"
    print_success "WebSocket proxy script created at $WS_PROXY_SCRIPT"
}

################################################################################
# Create Systemd Service
################################################################################

create_systemd_service() {
    print_header "Creating Systemd Service"
    
    cat > "$SERVICE_FILE" << EOF
[Unit]
Description=WebSocket SSH Proxy
After=network.target sshd.service

[Service]
Type=simple
User=root
Environment="WS_PROXY_PORT=$SELECTED_PORT"
ExecStart=/usr/bin/python3 $WS_PROXY_SCRIPT
Restart=always
RestartSec=3
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

    print_success "Systemd service file created at $SERVICE_FILE"
    
    # Reload systemd daemon
    print_info "Reloading systemd daemon..."
    systemctl daemon-reload
    
    # Enable service
    print_info "Enabling $SERVICE_NAME service..."
    systemctl enable $SERVICE_NAME
    
    # Start service
    print_info "Starting $SERVICE_NAME service..."
    systemctl start $SERVICE_NAME
    
    # Check service status
    sleep 2
    if systemctl is-active --quiet $SERVICE_NAME; then
        print_success "$SERVICE_NAME service is running"
    else
        print_error "$SERVICE_NAME service failed to start"
        systemctl status $SERVICE_NAME --no-pager
        exit 1
    fi
}

################################################################################
# Configure Firewall
################################################################################

configure_firewall() {
    print_header "Configuring Firewall"
    
    if command -v ufw &> /dev/null; then
        # Using UFW
        print_info "Configuring UFW firewall..."
        
        # Allow SSH first (critical to prevent lockout)
        ufw allow 22/tcp comment 'SSH' >/dev/null 2>&1
        print_success "Allowed SSH port 22 (prevents lockout)"
        
        # Allow WebSocket port
        ufw allow $SELECTED_PORT/tcp comment 'WebSocket Proxy' >/dev/null 2>&1
        print_success "Allowed WebSocket port $SELECTED_PORT"
        
        # Enable UFW (with auto-confirm)
        print_warning "Enabling UFW firewall (SSH port 22 is already allowed to prevent lockout)"
        echo "y" | ufw enable >/dev/null 2>&1
        print_success "UFW firewall enabled"
        
    elif command -v firewall-cmd &> /dev/null; then
        # Using firewalld
        print_info "Configuring firewalld..."
        
        systemctl start firewalld >/dev/null 2>&1
        systemctl enable firewalld >/dev/null 2>&1
        
        # Allow SSH
        firewall-cmd --permanent --add-service=ssh >/dev/null 2>&1
        print_success "Allowed SSH port 22"
        
        # Allow WebSocket port
        firewall-cmd --permanent --add-port=$SELECTED_PORT/tcp >/dev/null 2>&1
        print_success "Allowed WebSocket port $SELECTED_PORT"
        
        # Reload firewall
        firewall-cmd --reload >/dev/null 2>&1
        print_success "Firewalld enabled and configured"
    else
        print_warning "No firewall found. Please configure manually."
    fi
}

################################################################################
# Get Server IP
################################################################################

get_server_ip() {
    # Try multiple methods to get the public IP with timeout and HTTPS
    SERVER_IP=$(timeout 5 curl -s https://ifconfig.me 2>/dev/null || \
                timeout 5 curl -s https://icanhazip.com 2>/dev/null || \
                timeout 5 curl -s https://ipinfo.io/ip 2>/dev/null || \
                echo "Unable to detect")
    
    # If public IP detection failed, try to get local IP
    if [ "$SERVER_IP" = "Unable to detect" ]; then
        SERVER_IP=$(hostname -I | awk '{print $1}' 2>/dev/null || echo "Unknown")
    fi
}

################################################################################
# Display Post-Installation Information
################################################################################

display_info() {
    print_header "Installation Complete!"
    
    get_server_ip
    
    echo ""
    echo -e "${GREEN}╔════════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}║           WebSocket SSH Proxy Setup Complete!                  ║${NC}"
    echo -e "${GREEN}╚════════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "${BLUE}Server Information:${NC}"
    echo -e "  • Server IP Address: ${GREEN}$SERVER_IP${NC}"
    echo -e "  • WebSocket Port: ${GREEN}$SELECTED_PORT${NC}"
    echo -e "  • SSH Port: ${GREEN}22${NC}"
    echo ""
    echo -e "${BLUE}HTTP Injector Configuration:${NC}"
    echo -e "  • ${YELLOW}SSH Host:${NC} $SERVER_IP"
    echo -e "  • ${YELLOW}SSH Port:${NC} 22"
    echo -e "  • ${YELLOW}Username:${NC} <your-ssh-username>"
    echo -e "  • ${YELLOW}Password:${NC} <your-ssh-password>"
    echo ""
    echo -e "${BLUE}Custom Payload Examples:${NC}"
    echo ""
    echo -e "${YELLOW}1. WebSocket Payload (Recommended):${NC}"
    echo -e "   ${GREEN}GET / HTTP/1.1[crlf]Host: $SERVER_IP:$SELECTED_PORT[crlf]Upgrade: websocket[crlf][crlf]${NC}"
    echo ""
    echo -e "${YELLOW}2. WebSocket with Bug Host:${NC}"
    echo -e "   ${GREEN}GET / HTTP/1.1[crlf]Host: [host][crlf]Upgrade: websocket[crlf]Connection: Upgrade[crlf][crlf]${NC}"
    echo ""
    echo -e "${YELLOW}3. CONNECT Method:${NC}"
    echo -e "   ${GREEN}CONNECT [host_port] HTTP/1.1[crlf]Host: $SERVER_IP:$SELECTED_PORT[crlf][crlf]${NC}"
    echo ""
    echo -e "${YELLOW}4. Direct Connection (200 OK):${NC}"
    echo -e "   ${GREEN}GET / HTTP/1.1[crlf]Host: $SERVER_IP:$SELECTED_PORT[crlf]Connection: keep-alive[crlf][crlf]${NC}"
    echo ""
    echo -e "${BLUE}Useful Commands:${NC}"
    echo -e "  • Check status: ${GREEN}sudo systemctl status $SERVICE_NAME${NC}"
    echo -e "  • View logs: ${GREEN}sudo journalctl -u $SERVICE_NAME -f${NC}"
    echo -e "  • Restart service: ${GREEN}sudo systemctl restart $SERVICE_NAME${NC}"
    echo -e "  • Stop service: ${GREEN}sudo systemctl stop $SERVICE_NAME${NC}"
    echo -e "  • Disable service: ${GREEN}sudo systemctl disable $SERVICE_NAME${NC}"
    echo ""
    echo -e "${YELLOW}⚠ Important Notes:${NC}"
    echo -e "  • Make sure to set up SSH user authentication before connecting"
    echo -e "  • The proxy service will auto-start on system boot"
    echo -e "  • For HTTP Injector, use 'Custom Payload' mode with SSH tunnel"
    echo ""
    echo -e "${GREEN}Happy tunneling! 🚀${NC}"
    echo ""
}

################################################################################
# Main Installation Flow
################################################################################

main() {
    clear
    print_header "WebSocket SSH Proxy Installer"
    echo ""
    
    # Check prerequisites
    check_root
    echo ""
    
    # Select port
    select_port
    echo ""
    
    # Install dependencies
    install_dependencies
    echo ""
    
    # Setup SSH
    setup_ssh
    echo ""
    
    # Handle port conflicts
    handle_port_conflicts
    echo ""
    
    # Create proxy script
    create_proxy_script
    echo ""
    
    # Create systemd service
    create_systemd_service
    echo ""
    
    # Configure firewall
    configure_firewall
    echo ""
    
    # Display information
    display_info
}

# Run the installer
main