added bounce option in rootshell script

source/rootshell.src

@@ -1,6 +1,6 @@
-if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
+if params.len < 1 or params.len > 2 or params[0] == "-h" or params[0] == "--help" then
 	current_program = get_shell.host_computer.File(program_path)
-	exit "Usage: " + current_program.name + " <remote ip>"
+	exit "Usage: " + current_program.name + " <gateway ip> [host ip]\n\nWithout host ip, scan the gateway and choose a port.\nWith host ip, try router bounce exploits on gateway:0 against host ip."
 end if
 
 mx = include_lib("/lib/metaxploit.so")
@@ -13,6 +13,11 @@ if not crypto then crypto = include_lib(current_path + "/crypto.so")
 local_shell = get_shell
 local_cp = local_shell.host_computer
 ip = params[0]
+bounce_host = ""
+if params.len == 2 then bounce_host = params[1]
+bounce_mode = bounce_host != ""
+login_ip = ip
+if bounce_mode then login_ip = bounce_host
 KNOWN_PASS = "Root1234"
 
 rank_of = function(user)
@@ -22,6 +27,12 @@ rank_of = function(user)
 	return 2
 end function
 
+is_requested_host = function(comp)
+	if not bounce_mode then return 1
+	if not comp then return 0
+	return comp.local_ip == bounce_host
+end function
+
 extract_value = function(line)
 	start = line.indexOf("<b>")
 	finish = line.indexOf("</b>")
@@ -94,7 +105,11 @@ redraw = function()
 	end if
 	clear_screen
 	last_clear[0] = time
-	print ip + " " + chosen_port
+	if bounce_mode then
+		print ip + " 0 -> " + bounce_host
+	else
+		print ip + " " + chosen_port
+	end if
 	for line in logs
 		print line
 	end for
@@ -115,6 +130,7 @@ end function
 
 take_shell = function(sh)
 	if typeof(sh) != "shell" then return
+	if not is_requested_host(sh.host_computer) then return
 	user = object_user(sh.host_computer)
 	if state.best_shell == null or rank_of(user) > rank_of(state.best_user) then
 		state.best_shell = sh
@@ -126,6 +142,7 @@ end function
 
 take_computer = function(comp)
 	if typeof(comp) != "computer" then return
+	if not is_requested_host(comp) then return
 	user = object_user(comp)
 	if state.best_computer == null or rank_of(user) > rank_of(object_user(state.best_computer)) then
 		state.best_computer = comp
@@ -240,58 +257,65 @@ add_scan_row = function(port_num, state_name, libname, version, lan)
 	push_ssh port_num, libname
 end function
 
-print "scanning " + ip
+if bounce_mode then
+	chosen_port = 0
+	note("bouncing through " + ip + " to " + bounce_host)
+else
+	print "scanning " + ip
 
-router_sess = mx.net_use(ip)
-if router_sess then
-	router_lib = router_sess.dump_lib
-	if router_lib then
-		add_scan_row 0, "open", router_lib.lib_name, router_lib.version, ""
+	router_sess = mx.net_use(ip)
+	if router_sess then
+		router_lib = router_sess.dump_lib
+		if router_lib then
+			add_scan_row 0, "open", router_lib.lib_name, router_lib.version, ""
+		end if
 	end if
-end if
 
-router = get_router(ip)
-if router then
-	used = router.used_ports
-	if used then
-		for p in used
-			if p.is_closed == 0 then st = "open" else st = "closed"
-			lan = p.get_lan_ip
-			sess = mx.net_use(ip, p.port_number)
-			if not sess then
-				add_scan_row p.port_number, st, "N/A", "N/A", lan
-				continue
-			end if
-			lib = sess.dump_lib
-			if not lib then
-				add_scan_row p.port_number, st, "N/A", "N/A", lan
-				continue
-			end if
-			add_scan_row p.port_number, st, lib.lib_name, lib.version, lan
-		end for
+	router = get_router(ip)
+	if router then
+		used = router.used_ports
+		if used then
+			for p in used
+				if p.is_closed == 0 then st = "open" else st = "closed"
+				lan = p.get_lan_ip
+				sess = mx.net_use(ip, p.port_number)
+				if not sess then
+					add_scan_row p.port_number, st, "N/A", "N/A", lan
+					continue
+				end if
+				lib = sess.dump_lib
+				if not lib then
+					add_scan_row p.port_number, st, "N/A", "N/A", lan
+					continue
+				end if
+				add_scan_row p.port_number, st, lib.lib_name, lib.version, lan
+			end for
+		end if
 	end if
+
+	if scan_rows.len == 0 then exit("Unable to scan target")
+
+	table = "PORT STATE LIBRARY VERSION LAN"
+	for row in scan_rows
+		table = table + "\n" + row.port + " " + row.state + " " + row.lib + " " + row.version + " " + row.lan
+	end for
+	print format_columns(table)
+
+	port_in = user_input("port: ")
+	chosen_port = port_in.to_int
+	if typeof(chosen_port) != "number" then exit("Invalid port")
 end if
 
-if scan_rows.len == 0 then exit("Unable to scan target")
-
-table = "PORT STATE LIBRARY VERSION LAN"
-for row in scan_rows
-	table = table + "\n" + row.port + " " + row.state + " " + row.lib + " " + row.version + " " + row.lan
-end for
-print format_columns(table)
-
 if ssh_ports.len == 0 then ssh_ports.push 22
 
-port_in = user_input("port: ")
-chosen_port = port_in.to_int
-if typeof(chosen_port) != "number" then exit("Invalid port")
-
 try_login = function(user, password)
 	if user == "" or password == "" then return null
-	sh = get_shell(user, password)
-	if typeof(sh) == "shell" then return sh
+	if not bounce_mode then
+		sh = get_shell(user, password)
+		if typeof(sh) == "shell" then return sh
+	end if
 	for ssh_port in ssh_ports
-		sh = local_shell.connect_service(ip, ssh_port, user, password)
+		sh = local_shell.connect_service(login_ip, ssh_port, user, password)
 		if typeof(sh) == "shell" then return sh
 	end for
 	return null
@@ -487,16 +511,22 @@ overflow_target = function(port_num, extras)
 	end for
 end function
 
-extras = [""]
-if chosen_port == 0 then
-	for lan in lan_ips
-		if has_item(extras, lan) then continue
-		extras.push lan
-	end for
+if bounce_mode then
+	extras = [bounce_host]
+else
+	extras = [""]
+	if chosen_port == 0 then
+		for lan in lan_ips
+			if has_item(extras, lan) then continue
+			extras.push lan
+		end for
+	end if
+end if
+if not bounce_mode then
+	if not has_item(extras, KNOWN_PASS) then extras.push KNOWN_PASS
+	mail = user_mail_address
+	if mail then extras.push mail
 end if
-if not has_item(extras, KNOWN_PASS) then extras.push KNOWN_PASS
-mail = user_mail_address
-if mail then extras.push mail
 
 note("exploiting port " + chosen_port)
 overflow_target chosen_port, extras