bryanpedini/greyhack
1
0
Fork 0
Code Issues Pull Requests Releases Activity

fixed betteroverflow

Browse Source
This commit is contained in:
Bryan Joshua Pedini
2026-08-23 20:57:22 +02:00
parent 24b5d618d2
commit 9446e6228e
1 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
source/betteroverflow.src
View File

@@ -1,6 +1,6 @@
if params.len < 1 or params[0] == "-h" or params[0] == "--help" then if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
current_program = get_shell.host_computer.File(program_path) current_program = get_shell.host_computer.File(program_path)
exit("Usage: " + current_program.name + " <remote ip> [remote port]") exit "Usage: " + current_program.name + " <remote ip> [remote port]"
end if end if
mx = include_lib("/lib/metaxploit.so") mx = include_lib("/lib/metaxploit.so")
@@ -10,7 +10,7 @@ extract_value = function(line)
start = line.indexOf("<b>") start = line.indexOf("<b>")
finish = line.indexOf("</b>") finish = line.indexOf("</b>")
if start != -1 and finish != -1 and finish > start then if start != -1 and finish != -1 and finish > start then
return line[start + 3:finish] return line[start + 3 : finish]
end if end if
before_dot = line.split("\.")[0] before_dot = line.split("\.")[0]
@@ -37,7 +37,7 @@ end if
if not sess then exit("Unable to establish session") if not sess then exit("Unable to establish session")
lib = sess.dump_lib() lib = sess.dump_lib
adds = mx.scan(lib) adds = mx.scan(lib)
found = 0 found = 0
candidates = [] candidates = []
@@ -54,7 +54,7 @@ for add in adds
value = extract_value(line) value = extract_value(line)
if value == "" then continue if value == "" then continue
candidates.push(add + " " + value) candidates.push add + " " + value
end for end for
end for end for
@@ -69,19 +69,19 @@ for candidate in candidates
sess = mx.net_use(ip, port) sess = mx.net_use(ip, port)
end if end if
if not sess then continue if not sess then continue
lib = sess.dump_lib() lib = sess.dump_lib
if not lib then continue if not lib then continue
of = lib.overflow(add, value) oflow = lib.overflow(add, value)
if typeof(of) == "shell" then if typeof(oflow) == "shell" then
// create a temporary file for whoami output // create a temporary file for whoami output
tmp_name = "/tmp/whoami_" + add + "_" + value + "_" + candidate tmp_name = "/tmp/whoami_" + add + "_" + value
// run whoami and capture output // run whoami and capture output
of.launch("/bin/sh -c 'whoami > " + tmp_name + "'") oflow.launch "whoami > " + tmp_name
// small wait to ensure command completes // small wait to ensure command completes
wait(0.1) wait 0.1
// read the output via host computer // read the output via host computer
host = of.host_computer host = oflow.host_computer
f = host.File(tmp_name) f = host.File(tmp_name)
if not f then if not f then
// if file reading failed, skip cleanup and continue // if file reading failed, skip cleanup and continue
@@ -90,10 +90,10 @@ if typeof(of) == "shell" then
output = f.get_content output = f.get_content
// remove trailing newline and carriage return // remove trailing newline and carriage return
if output.endsWith(char(10)) then if output.endsWith(char(10)) then
output = output[0:output.len-1] output = output[0 : output.len - 1]
end if end if
if output.endsWith(char(13)) then if output.endsWith(char(13)) then
output = output[0:output.len-1] output = output[0 : output.len - 1]
end if end if
// determine privilege level // determine privilege level
if output == "root" then if output == "root" then
@@ -101,9 +101,9 @@ if typeof(of) == "shell" then
else else
priv = "guest" priv = "guest"
end if end if
print(add + " " + value + " user:" + output + " privilege:" + priv) print add + " " + value + " user:" + output + " privilege:" + priv
// cleanup // cleanup
of.launch("/bin/rm -f " + tmp_name) oflow.launch "/bin/rm -f " + tmp_name
found = 1 found = 1
end if end if
end for end for