diff --git a/source/rootshell.src b/source/rootshell.src index e2ff139..fad4714 100644 --- a/source/rootshell.src +++ b/source/rootshell.src @@ -1,6 +1,6 @@ -if params.len < 1 or params[0] == "-h" or params[0] == "--help" then +if params.len < 1 or params.len > 2 or params[0] == "-h" or params[0] == "--help" then current_program = get_shell.host_computer.File(program_path) - exit "Usage: " + current_program.name + " " + exit "Usage: " + current_program.name + " [host ip]\n\nWithout host ip, scan the gateway and choose a port.\nWith host ip, try router bounce exploits on gateway:0 against host ip." end if mx = include_lib("/lib/metaxploit.so") @@ -13,6 +13,11 @@ if not crypto then crypto = include_lib(current_path + "/crypto.so") local_shell = get_shell local_cp = local_shell.host_computer ip = params[0] +bounce_host = "" +if params.len == 2 then bounce_host = params[1] +bounce_mode = bounce_host != "" +login_ip = ip +if bounce_mode then login_ip = bounce_host KNOWN_PASS = "Root1234" rank_of = function(user) @@ -22,6 +27,12 @@ rank_of = function(user) return 2 end function +is_requested_host = function(comp) + if not bounce_mode then return 1 + if not comp then return 0 + return comp.local_ip == bounce_host +end function + extract_value = function(line) start = line.indexOf("") finish = line.indexOf("") @@ -94,7 +105,11 @@ redraw = function() end if clear_screen last_clear[0] = time - print ip + " " + chosen_port + if bounce_mode then + print ip + " 0 -> " + bounce_host + else + print ip + " " + chosen_port + end if for line in logs print line end for @@ -115,6 +130,7 @@ end function take_shell = function(sh) if typeof(sh) != "shell" then return + if not is_requested_host(sh.host_computer) then return user = object_user(sh.host_computer) if state.best_shell == null or rank_of(user) > rank_of(state.best_user) then state.best_shell = sh @@ -126,6 +142,7 @@ end function take_computer = function(comp) if typeof(comp) != "computer" then return + if not is_requested_host(comp) then return user = object_user(comp) if state.best_computer == null or rank_of(user) > rank_of(object_user(state.best_computer)) then state.best_computer = comp @@ -240,58 +257,65 @@ add_scan_row = function(port_num, state_name, libname, version, lan) push_ssh port_num, libname end function -print "scanning " + ip +if bounce_mode then + chosen_port = 0 + note("bouncing through " + ip + " to " + bounce_host) +else + print "scanning " + ip -router_sess = mx.net_use(ip) -if router_sess then - router_lib = router_sess.dump_lib - if router_lib then - add_scan_row 0, "open", router_lib.lib_name, router_lib.version, "" + router_sess = mx.net_use(ip) + if router_sess then + router_lib = router_sess.dump_lib + if router_lib then + add_scan_row 0, "open", router_lib.lib_name, router_lib.version, "" + end if end if -end if -router = get_router(ip) -if router then - used = router.used_ports - if used then - for p in used - if p.is_closed == 0 then st = "open" else st = "closed" - lan = p.get_lan_ip - sess = mx.net_use(ip, p.port_number) - if not sess then - add_scan_row p.port_number, st, "N/A", "N/A", lan - continue - end if - lib = sess.dump_lib - if not lib then - add_scan_row p.port_number, st, "N/A", "N/A", lan - continue - end if - add_scan_row p.port_number, st, lib.lib_name, lib.version, lan - end for + router = get_router(ip) + if router then + used = router.used_ports + if used then + for p in used + if p.is_closed == 0 then st = "open" else st = "closed" + lan = p.get_lan_ip + sess = mx.net_use(ip, p.port_number) + if not sess then + add_scan_row p.port_number, st, "N/A", "N/A", lan + continue + end if + lib = sess.dump_lib + if not lib then + add_scan_row p.port_number, st, "N/A", "N/A", lan + continue + end if + add_scan_row p.port_number, st, lib.lib_name, lib.version, lan + end for + end if end if + + if scan_rows.len == 0 then exit("Unable to scan target") + + table = "PORT STATE LIBRARY VERSION LAN" + for row in scan_rows + table = table + "\n" + row.port + " " + row.state + " " + row.lib + " " + row.version + " " + row.lan + end for + print format_columns(table) + + port_in = user_input("port: ") + chosen_port = port_in.to_int + if typeof(chosen_port) != "number" then exit("Invalid port") end if -if scan_rows.len == 0 then exit("Unable to scan target") - -table = "PORT STATE LIBRARY VERSION LAN" -for row in scan_rows - table = table + "\n" + row.port + " " + row.state + " " + row.lib + " " + row.version + " " + row.lan -end for -print format_columns(table) - if ssh_ports.len == 0 then ssh_ports.push 22 -port_in = user_input("port: ") -chosen_port = port_in.to_int -if typeof(chosen_port) != "number" then exit("Invalid port") - try_login = function(user, password) if user == "" or password == "" then return null - sh = get_shell(user, password) - if typeof(sh) == "shell" then return sh + if not bounce_mode then + sh = get_shell(user, password) + if typeof(sh) == "shell" then return sh + end if for ssh_port in ssh_ports - sh = local_shell.connect_service(ip, ssh_port, user, password) + sh = local_shell.connect_service(login_ip, ssh_port, user, password) if typeof(sh) == "shell" then return sh end for return null @@ -487,16 +511,22 @@ overflow_target = function(port_num, extras) end for end function -extras = [""] -if chosen_port == 0 then - for lan in lan_ips - if has_item(extras, lan) then continue - extras.push lan - end for +if bounce_mode then + extras = [bounce_host] +else + extras = [""] + if chosen_port == 0 then + for lan in lan_ips + if has_item(extras, lan) then continue + extras.push lan + end for + end if +end if +if not bounce_mode then + if not has_item(extras, KNOWN_PASS) then extras.push KNOWN_PASS + mail = user_mail_address + if mail then extras.push mail end if -if not has_item(extras, KNOWN_PASS) then extras.push KNOWN_PASS -mail = user_mail_address -if mail then extras.push mail note("exploiting port " + chosen_port) overflow_target chosen_port, extras