added privilege escalation script

source/privesc.src

@@ -0,0 +1,189 @@
+if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
+	current_program = get_shell.host_computer.File(program_path)
+	print("Usage: " + current_program.name + " [-h|<library path> [extra]]")
+	print("  -h                 show this help message")
+	print("  <library path>     only exploit the specified library (e.g. /lib/init.so)")
+	print("  extra              optional overflow value to attempt")
+	print("  (no args)          try all libraries in /lib and current_path")
+	exit
+end if
+
+mx = include_lib("/lib/metaxploit.so")
+if not mx then mx = include_lib(current_path + "/metaxploit.so")
+if not mx then exit("Unable to load metaxploit.so")
+
+computer = get_shell.host_computer
+
+ends_with = function(s, suffix)
+	if s.len < suffix.len then return 0
+	return s[s.len - suffix.len:] == suffix
+end function
+
+extra = ""
+target_lib = null
+if params.len > 0 then
+	if params[0].indexOf("/") != null or ends_with(params[0], ".so") then
+		target_lib = params[0]
+		if params.len > 1 then extra = params[1]
+	else
+		extra = params[0]
+	end if
+end if
+
+extract_value = function(line)
+	start = line.indexOf("<b>")
+	finish = line.indexOf("</b>")
+	if start == null or finish == null then return ""
+	if start == -1 or finish == -1 then return ""
+	if finish > start then
+		return line[start + 3:finish]
+	end if
+
+	before_dot = line.split("\.")[0]
+	words = before_dot.split(" ")
+	value = ""
+	for word in words
+		if word != "" then value = word
+	end for
+	return value
+end function
+
+shell_user = function(sh)
+	comp = sh.host_computer
+	if not comp then return "guest"
+
+	rootf = comp.File("/root")
+	if rootf and rootf.has_permission("w") then return "root"
+
+	passwd = comp.File("/etc/passwd")
+	if passwd and passwd.has_permission("w") then return "root"
+
+	home = comp.File("/home")
+	if not home then return "guest"
+	folders = home.get_folders
+	if not folders then return "guest"
+	for folder in folders
+		if folder.name == "guest" then continue
+		if folder.has_permission("w") then return folder.name
+	end for
+	return "guest"
+end function
+
+known_paths = []
+libs = []
+
+add_lib_dir = function(dirpath)
+	folder = computer.File(dirpath)
+	if not folder then return
+	if not folder.is_folder then return
+	if not folder.has_permission("r") then return
+	files = folder.get_files
+	if not files then return
+	for f in files
+		if not f.has_permission("r") then continue
+		if not ends_with(f.name, ".so") then continue
+		already = 0
+		for p in known_paths
+			if p == f.path then
+				already = 1
+				break
+			end if
+		end for
+		if already then continue
+		lib = mx.load(f.path)
+		if not lib then continue
+		known_paths.push(f.path)
+		libs.push({"path": f.path, "name": lib.lib_name, "version": lib.version, "lib": lib})
+	end for
+end function
+
+if target_lib then
+	lf = computer.File(target_lib)
+	if not lf then exit("Unable to locate library: " + target_lib)
+	lib = mx.load(target_lib)
+	if not lib then exit("Unable to load library: " + target_lib)
+	libs.push({"path": target_lib, "name": lib.lib_name, "version": lib.version, "lib": lib})
+else
+	add_lib_dir("/lib")
+	if current_path != "/lib" then add_lib_dir(current_path)
+end if
+
+if libs.len == 0 then
+	print("Nothing found")
+	exit
+end if
+
+preferred = ["kernel_module.so", "init.so", "net.so", "kernel_router.so"]
+ordered = []
+for name in preferred
+	for item in libs
+		if ends_with(item.path, "/" + name) or item.name == name then
+			ordered.push(item)
+		end if
+	end for
+end for
+for item in libs
+	already = 0
+	for o in ordered
+		if o.path == item.path then
+			already = 1
+			break
+		end if
+	end for
+	if already then continue
+	ordered.push(item)
+end for
+libs = ordered
+
+lines = "PATH LIBRARY VERSION"
+for item in libs
+	lines = lines + "\n" + item.path + " " + item.name + " " + item.version
+end for
+print(format_columns(lines))
+
+try_overflow = function(lib, add, value)
+	of = lib.overflow(add, value)
+	if typeof(of) == "shell" then return of
+	if extra != "" then
+		of = lib.overflow(add, value, extra)
+		if typeof(of) == "shell" then return of
+	end if
+	return null
+end function
+
+user_shell = null
+for item in libs
+	adds = mx.scan(item.lib)
+	if not adds then continue
+	for add in adds
+		info = mx.scan_address(item.lib, add)
+		if not info then continue
+		parts = info.split("Unsafe check:")
+		first = 1
+		for part in parts
+			if first then
+				first = 0
+				continue
+			end if
+			value = extract_value(part)
+			if value == "" then continue
+			of = try_overflow(item.lib, add, value)
+			if typeof(of) != "shell" then continue
+			user = shell_user(of)
+			if user == "root" then
+				of.start_terminal
+				exit
+			end if
+			if active_user == "guest" and user != "guest" and user != active_user then
+				if not user_shell then user_shell = of
+			end if
+		end for
+	end for
+end for
+
+if active_user == "guest" and user_shell then
+	user_shell.start_terminal
+	exit
+end if
+
+print("Nothing found")