bryanpedini/greyhack
1
0
Fork 0
Code Issues Pull Requests Releases Activity

fixed betteroverflow

Browse Source
This commit is contained in:
Bryan Joshua Pedini
2026-08-23 20:57:22 +02:00
parent 24b5d618d2
commit 9446e6228e
1 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
source/betteroverflow.src
View File

@@ -1,6 +1,6 @@
if params.len < 1 or params[0] == "-h" or params[0] == "--help" then if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
current_program = get_shell.host_computer.File(program_path) current_program = get_shell.host_computer.File(program_path)
exit("Usage: " + current_program.name + " <remote ip> [remote port]") exit "Usage: " + current_program.name + " <remote ip> [remote port]"
end if end if
mx = include_lib("/lib/metaxploit.so") mx = include_lib("/lib/metaxploit.so")
@@ -37,7 +37,7 @@ end if
if not sess then exit("Unable to establish session") if not sess then exit("Unable to establish session")
lib = sess.dump_lib() lib = sess.dump_lib
adds = mx.scan(lib) adds = mx.scan(lib)
found = 0 found = 0
candidates = [] candidates = []
@@ -54,7 +54,7 @@ for add in adds
value = extract_value(line) value = extract_value(line)
if value == "" then continue if value == "" then continue
candidates.push(add + " " + value) candidates.push add + " " + value
end for end for
end for end for
@@ -69,19 +69,19 @@ for candidate in candidates
sess = mx.net_use(ip, port) sess = mx.net_use(ip, port)
end if end if
if not sess then continue if not sess then continue
lib = sess.dump_lib() lib = sess.dump_lib
if not lib then continue if not lib then continue
of = lib.overflow(add, value) oflow = lib.overflow(add, value)
if typeof(of) == "shell" then if typeof(oflow) == "shell" then
// create a temporary file for whoami output // create a temporary file for whoami output
tmp_name = "/tmp/whoami_" + add + "_" + value + "_" + candidate tmp_name = "/tmp/whoami_" + add + "_" + value
// run whoami and capture output // run whoami and capture output
of.launch("/bin/sh -c 'whoami > " + tmp_name + "'") oflow.launch "whoami > " + tmp_name
// small wait to ensure command completes // small wait to ensure command completes
wait(0.1) wait 0.1
// read the output via host computer // read the output via host computer
host = of.host_computer host = oflow.host_computer
f = host.File(tmp_name) f = host.File(tmp_name)
if not f then if not f then
// if file reading failed, skip cleanup and continue // if file reading failed, skip cleanup and continue
@@ -101,9 +101,9 @@ if typeof(of) == "shell" then
else else
priv = "guest" priv = "guest"
end if end if
print(add + " " + value + " user:" + output + " privilege:" + priv) print add + " " + value + " user:" + output + " privilege:" + priv
// cleanup // cleanup
of.launch("/bin/rm -f " + tmp_name) oflow.launch "/bin/rm -f " + tmp_name
found = 1 found = 1
end if end if
end for end for