diff --git a/source/betteroverflow.src b/source/betteroverflow.src index 53ef618..fd7170b 100644 --- a/source/betteroverflow.src +++ b/source/betteroverflow.src @@ -22,6 +22,54 @@ extract_value = function(line) return value end function +computer_is_root = function(comp) + if not comp then return 0 + root_dir = comp.File("/root") + if root_dir and root_dir.has_permission("w") then return 1 + passwd = comp.File("/etc/passwd") + if passwd and passwd.has_permission("w") then return 1 + return 0 +end function + +dump_remote_passwd = function(comp, add, value) + if not computer_is_root(comp) then return 0 + + passwd = comp.File("/etc/passwd") + if not passwd then return 0 + if not passwd.has_permission("r") then return 0 + content = passwd.get_content + if not content then return 0 + + local_cp = get_shell.host_computer + passwd_name = "remote_passwd.txt" + passwd_path = home_dir + "/" + passwd_name + existing = local_cp.File(passwd_path) + if existing then existing.delete + + created = local_cp.touch(home_dir, passwd_name) + if typeof(created) == "string" then return 0 + local_passwd = local_cp.File(passwd_path) + if not local_passwd then return 0 + + written = local_passwd.set_content(content) + if typeof(written) == "string" then + local_passwd.delete + return 0 + end if + + decipher = local_cp.File("/bin/decipher") + if not decipher then + local_passwd.delete + return 0 + end if + + print add + " " + value + " type:computer privilege:root" + get_shell.launch("/bin/decipher", passwd_path) + leftover = local_cp.File(passwd_path) + if leftover then leftover.delete + return 1 +end function + ip = params[0] port = 0 @@ -105,6 +153,10 @@ for candidate in candidates // cleanup oflow.launch "/bin/rm " + tmp_name found = 1 + else if typeof(oflow) == "computer" then + if dump_remote_passwd(oflow, add, value) then + found = 1 + end if end if end for