better usage of shell, better screen output

source/betteroverflow.src

@@ -6,6 +6,32 @@ end if
 mx = include_lib("/lib/metaxploit.so")
 if not mx then exit("Unable to load /lib/metaxploit.so")
 
+crypto = include_lib("/lib/crypto.so")
+if not crypto then crypto = include_lib(current_path + "/crypto.so")
+
+results = []
+last_clear = [0]
+
+redraw = function()
+	gap = 0.11
+	elapsed = time - last_clear[0]
+	if elapsed < gap then
+		delay = gap - elapsed
+		if delay < 0.01 then delay = 0.01
+		wait delay
+	end if
+	clear_screen
+	last_clear[0] = time
+	for line in results
+		print line
+	end for
+end function
+
+note = function(line)
+	results.push(line)
+	redraw
+end function
+
 extract_value = function(line)
 	start = line.indexOf("<b>")
 	finish = line.indexOf("</b>")
@@ -22,52 +48,50 @@ extract_value = function(line)
 	return value
 end function
 
-computer_is_root = function(comp)
-	if not comp then return 0
+object_user = function(comp)
+	if not comp then return "guest"
+
 	root_dir = comp.File("/root")
-	if root_dir and root_dir.has_permission("w") then return 1
+	if root_dir and root_dir.has_permission("w") then return "root"
+
 	passwd = comp.File("/etc/passwd")
-	if passwd and passwd.has_permission("w") then return 1
-	return 0
+	if passwd and passwd.has_permission("w") then return "root"
+
+	home = comp.File("/home")
+	if not home then return "guest"
+	folders = home.get_folders
+	if not folders then return "guest"
+	for folder in folders
+		if folder.name == "guest" then continue
+		if folder.has_permission("w") then return folder.name
+	end for
+	return "guest"
 end function
 
-dump_remote_passwd = function(comp, add, value)
-	if not computer_is_root(comp) then return 0
+dump_remote_passwd = function(comp)
+	cracked = []
+	if not crypto then return cracked
+	if object_user(comp) != "root" then return cracked
 
 	passwd = comp.File("/etc/passwd")
-	if not passwd then return 0
-	if not passwd.has_permission("r") then return 0
+	if not passwd then return cracked
+	if not passwd.has_permission("r") then return cracked
 	content = passwd.get_content
-	if not content then return 0
+	if not content then return cracked
 
-	local_cp = get_shell.host_computer
-	passwd_name = "remote_passwd.txt"
-	passwd_path = home_dir + "/" + passwd_name
-	existing = local_cp.File(passwd_path)
-	if existing then existing.delete
-
-	created = local_cp.touch(home_dir, passwd_name)
-	if typeof(created) == "string" then return 0
-	local_passwd = local_cp.File(passwd_path)
-	if not local_passwd then return 0
-
-	written = local_passwd.set_content(content)
-	if typeof(written) == "string" then
-		local_passwd.delete
-		return 0
-	end if
-
-	decipher = local_cp.File("/bin/decipher")
-	if not decipher then
-		local_passwd.delete
-		return 0
-	end if
-
-	print add + " " + value + " type:computer privilege:root"
-	get_shell.launch("/bin/decipher", passwd_path)
-	leftover = local_cp.File(passwd_path)
-	if leftover then leftover.delete
-	return 1
+	for line in content.split(char(10))
+		if line == "" then continue
+		parts = line.split(":")
+		if parts.len < 2 then continue
+		user = parts[0]
+		hash = parts[1]
+		if user == "" or hash == "" then continue
+		plain = crypto.decipher(hash)
+		redraw
+		if not plain then continue
+		cracked.push(user + ":" + plain)
+	end for
+	return cracked
 end function
 
 ip = params[0]
@@ -87,6 +111,7 @@ if not sess then exit("Unable to establish session")
 
 lib = sess.dump_lib
 adds = mx.scan(lib)
+redraw
 found = 0
 candidates = []
 
@@ -116,48 +141,37 @@ for candidate in candidates
 	else
 		sess = mx.net_use(ip, port)
 	end if
-	if not sess then continue
+	if not sess then
+		redraw
+		continue
+	end if
 	lib = sess.dump_lib
-	if not lib then continue
+	if not lib then
+		redraw
+		continue
+	end if
 
 	oflow = lib.overflow(add, value)
 	if typeof(oflow) == "shell" then
-		// create a temporary file for whoami output
-		tmp_name = "/tmp/whoami_" + add + "_" + value
-		// run whoami and capture output
-		oflow.launch "whoami > " + tmp_name
-		// small wait to ensure command completes
-		wait 0.1
-		// read the output via host computer
-		host = oflow.host_computer
-		f = host.File(tmp_name)
-		if not f then
-			// if file reading failed, skip cleanup and continue
-			continue
-		end if
-		output = f.get_content
-		// remove trailing newline and carriage return
-		if output.endsWith(char(10)) then
-			output = output[0 : output.len - 1]
-		end if
-		if output.endsWith(char(13)) then
-			output = output[0 : output.len - 1]
-		end if
-		// determine privilege level
-		if output == "root" then
-			priv = "root"
-		else
-			priv = "guest"
-		end if
-		print add + " " + value + " user:" + output + " privilege:" + priv
-		// cleanup
-		oflow.launch "/bin/rm " + tmp_name
+		note(add + " " + value + " user:" + object_user(oflow.host_computer))
 		found = 1
 	else if typeof(oflow) == "computer" then
-		if dump_remote_passwd(oflow, add, value) then
+		cracked = dump_remote_passwd(oflow)
+		if cracked.len > 0 then
+			results.push(add + " " + value + " type:computer privilege:root")
+			for line in cracked
+				results.push(line)
+			end for
 			found = 1
 		end if
+		redraw
+	else
+		redraw
 	end if
 end for
 
-if found == 0 then print("Nothing found")
+if found == 0 then
+	note("Nothing found")
+else
+	redraw
+end if