From 5c0e0b3f9f23f0e31fda55426122f72248387838 Mon Sep 17 00:00:00 2001
From: Bryan Joshua Pedini <bryan@pedini.dev>
Date: Mon, 24 Aug 2026 04:24:02 +0200
Subject: [PATCH] added decipherall script, made use of all File objects in
 rootshell

---
 source/decipherall.src | 35 +++++++++++++++++++++++++++++++++++
 source/rootshell.src   | 11 +++++++++--
 2 files changed, 44 insertions(+), 2 deletions(-)
 create mode 100644 source/decipherall.src

diff --git a/source/decipherall.src b/source/decipherall.src
new file mode 100644
index 0000000..b4ab71e
--- /dev/null
+++ b/source/decipherall.src
@@ -0,0 +1,35 @@
+if params.len != 1 or params[0] == "-h" or params[0] == "--help" then
+	current_program = get_shell.host_computer.File(program_path)
+	exit "Usage: " + current_program.name + " <password file path>"
+end if
+
+crypto = include_lib(current_path + "/crypto.so")
+if not crypto then exit("Unable to load crypto.so from " + current_path)
+
+computer = get_shell.host_computer
+password_file = computer.File(params[0])
+if not password_file then
+	password_file = computer.File(current_path + "/" + params[0])
+end if
+if not password_file then exit("Unable to find file: " + params[0])
+if password_file.is_folder then exit("Expected a file, not a folder")
+if not password_file.has_permission("r") then exit("Permission denied: " + password_file.path)
+
+content = password_file.get_content
+if not content then exit("Unable to read: " + password_file.path)
+
+found = 0
+for line in content.split(char(10))
+	if line == "" then continue
+	parts = line.split(":")
+	if parts.len < 2 then continue
+	user = parts[0]
+	hash = parts[1]
+	if user == "" or hash == "" then continue
+	plain = crypto.decipher(hash)
+	if not plain then continue
+	print(user + ":" + plain)
+	found = found + 1
+end for
+
+if found == 0 then print("No passwords could be deciphered")
diff --git a/source/rootshell.src b/source/rootshell.src
index fad4714..9db18d6 100644
--- a/source/rootshell.src
+++ b/source/rootshell.src
@@ -88,6 +88,7 @@ state = {
 	"best_user": "guest",
 	"best_computer": null,
 	"passwd_file": null,
+	"passwd_processed": 0,
 	"password_changed": 0,
 }
 
@@ -160,10 +161,14 @@ take_file = function(f)
 		end for
 		return
 	end if
-	if f.name != "passwd" then return
-	if not f.has_permission("r") then return
+	if f.path != "/etc/passwd" then return
+	if not f.has_permission("r") then
+		note("/etc/passwd is not readable")
+		return
+	end if
 	state.passwd_file = f
 	note("file " + f.path)
+	crack_passwd_on(null)
 end function
 
 consider = function(of)
@@ -334,11 +339,13 @@ login_accounts = function(accounts)
 end function
 
 crack_passwd_on = function(comp)
+	if state.passwd_processed then return 1
 	content = read_passwd_text(comp)
 	if not content then return 0
 	note("reading /etc/passwd")
 	accounts = parse_passwd(content)
 	if accounts.len == 0 then return 0
+	state.passwd_processed = 1
 	login_accounts accounts
 	return 1
 end function