You've already forked greyhack
add Computer object handling in betteroverflow
This commit is contained in:
@@ -22,6 +22,54 @@ extract_value = function(line)
|
||||
return value
|
||||
end function
|
||||
|
||||
computer_is_root = function(comp)
|
||||
if not comp then return 0
|
||||
root_dir = comp.File("/root")
|
||||
if root_dir and root_dir.has_permission("w") then return 1
|
||||
passwd = comp.File("/etc/passwd")
|
||||
if passwd and passwd.has_permission("w") then return 1
|
||||
return 0
|
||||
end function
|
||||
|
||||
dump_remote_passwd = function(comp, add, value)
|
||||
if not computer_is_root(comp) then return 0
|
||||
|
||||
passwd = comp.File("/etc/passwd")
|
||||
if not passwd then return 0
|
||||
if not passwd.has_permission("r") then return 0
|
||||
content = passwd.get_content
|
||||
if not content then return 0
|
||||
|
||||
local_cp = get_shell.host_computer
|
||||
passwd_name = "remote_passwd.txt"
|
||||
passwd_path = home_dir + "/" + passwd_name
|
||||
existing = local_cp.File(passwd_path)
|
||||
if existing then existing.delete
|
||||
|
||||
created = local_cp.touch(home_dir, passwd_name)
|
||||
if typeof(created) == "string" then return 0
|
||||
local_passwd = local_cp.File(passwd_path)
|
||||
if not local_passwd then return 0
|
||||
|
||||
written = local_passwd.set_content(content)
|
||||
if typeof(written) == "string" then
|
||||
local_passwd.delete
|
||||
return 0
|
||||
end if
|
||||
|
||||
decipher = local_cp.File("/bin/decipher")
|
||||
if not decipher then
|
||||
local_passwd.delete
|
||||
return 0
|
||||
end if
|
||||
|
||||
print add + " " + value + " type:computer privilege:root"
|
||||
get_shell.launch("/bin/decipher", passwd_path)
|
||||
leftover = local_cp.File(passwd_path)
|
||||
if leftover then leftover.delete
|
||||
return 1
|
||||
end function
|
||||
|
||||
ip = params[0]
|
||||
port = 0
|
||||
|
||||
@@ -105,6 +153,10 @@ for candidate in candidates
|
||||
// cleanup
|
||||
oflow.launch "/bin/rm " + tmp_name
|
||||
found = 1
|
||||
else if typeof(oflow) == "computer" then
|
||||
if dump_remote_passwd(oflow, add, value) then
|
||||
found = 1
|
||||
end if
|
||||
end if
|
||||
end for
|
||||
|
||||
|
||||
Reference in New Issue
Block a user