You've already forked greyhack
add Computer object handling in betteroverflow
This commit is contained in:
@@ -22,6 +22,54 @@ extract_value = function(line)
|
|||||||
return value
|
return value
|
||||||
end function
|
end function
|
||||||
|
|
||||||
|
computer_is_root = function(comp)
|
||||||
|
if not comp then return 0
|
||||||
|
root_dir = comp.File("/root")
|
||||||
|
if root_dir and root_dir.has_permission("w") then return 1
|
||||||
|
passwd = comp.File("/etc/passwd")
|
||||||
|
if passwd and passwd.has_permission("w") then return 1
|
||||||
|
return 0
|
||||||
|
end function
|
||||||
|
|
||||||
|
dump_remote_passwd = function(comp, add, value)
|
||||||
|
if not computer_is_root(comp) then return 0
|
||||||
|
|
||||||
|
passwd = comp.File("/etc/passwd")
|
||||||
|
if not passwd then return 0
|
||||||
|
if not passwd.has_permission("r") then return 0
|
||||||
|
content = passwd.get_content
|
||||||
|
if not content then return 0
|
||||||
|
|
||||||
|
local_cp = get_shell.host_computer
|
||||||
|
passwd_name = "remote_passwd.txt"
|
||||||
|
passwd_path = home_dir + "/" + passwd_name
|
||||||
|
existing = local_cp.File(passwd_path)
|
||||||
|
if existing then existing.delete
|
||||||
|
|
||||||
|
created = local_cp.touch(home_dir, passwd_name)
|
||||||
|
if typeof(created) == "string" then return 0
|
||||||
|
local_passwd = local_cp.File(passwd_path)
|
||||||
|
if not local_passwd then return 0
|
||||||
|
|
||||||
|
written = local_passwd.set_content(content)
|
||||||
|
if typeof(written) == "string" then
|
||||||
|
local_passwd.delete
|
||||||
|
return 0
|
||||||
|
end if
|
||||||
|
|
||||||
|
decipher = local_cp.File("/bin/decipher")
|
||||||
|
if not decipher then
|
||||||
|
local_passwd.delete
|
||||||
|
return 0
|
||||||
|
end if
|
||||||
|
|
||||||
|
print add + " " + value + " type:computer privilege:root"
|
||||||
|
get_shell.launch("/bin/decipher", passwd_path)
|
||||||
|
leftover = local_cp.File(passwd_path)
|
||||||
|
if leftover then leftover.delete
|
||||||
|
return 1
|
||||||
|
end function
|
||||||
|
|
||||||
ip = params[0]
|
ip = params[0]
|
||||||
port = 0
|
port = 0
|
||||||
|
|
||||||
@@ -105,6 +153,10 @@ for candidate in candidates
|
|||||||
// cleanup
|
// cleanup
|
||||||
oflow.launch "/bin/rm " + tmp_name
|
oflow.launch "/bin/rm " + tmp_name
|
||||||
found = 1
|
found = 1
|
||||||
|
else if typeof(oflow) == "computer" then
|
||||||
|
if dump_remote_passwd(oflow, add, value) then
|
||||||
|
found = 1
|
||||||
|
end if
|
||||||
end if
|
end if
|
||||||
end for
|
end for
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user