added betteroverflow script

source/betteroverflow.src

@@ -0,0 +1,111 @@
+if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
+	current_program = get_shell.host_computer.File(program_path)
+	exit("Usage: " + current_program.name + " <remote ip> [remote port]")
+end if
+
+mx = include_lib("/lib/metaxploit.so")
+if not mx then exit("Unable to load /lib/metaxploit.so")
+
+extract_value = function(line)
+	start = line.indexOf("<b>")
+	finish = line.indexOf("</b>")
+	if start != -1 and finish != -1 and finish > start then
+		return line[start + 3:finish]
+	end if
+
+	before_dot = line.split("\.")[0]
+	words = before_dot.split(" ")
+	value = ""
+	for word in words
+		if word != "" then value = word
+	end for
+	return value
+end function
+
+ip = params[0]
+port = 0
+
+if params.len > 1 then
+	port = params[1].to_int
+end if
+
+if port == 0 then
+	sess = mx.net_use(ip)
+else
+	sess = mx.net_use(ip, port)
+end if
+
+if not sess then exit("Unable to establish session")
+
+lib = sess.dump_lib()
+adds = mx.scan(lib)
+found = 0
+candidates = []
+
+for add in adds
+	info = mx.scan_address(lib, add)
+	if not info then continue
+
+	lines = info.split(char(10))
+	for line in lines
+		pos = line.indexOf("Unsafe check:")
+		if pos == null then continue
+		if pos == -1 then continue
+
+		value = extract_value(line)
+		if value == "" then continue
+		candidates.push(add + " " + value)
+	end for
+end for
+
+for candidate in candidates
+	parts = candidate.split(" ")
+	add = parts[0]
+	value = parts[1]
+
+	if port == 0 then
+		sess = mx.net_use(ip)
+	else
+		sess = mx.net_use(ip, port)
+	end if
+	if not sess then continue
+	lib = sess.dump_lib()
+	if not lib then continue
+
+	of = lib.overflow(add, value)
+if typeof(of) == "shell" then
+        // create a temporary file for whoami output
+        tmp_name = "/tmp/whoami_" + add + "_" + value + "_" + candidate
+        // run whoami and capture output
+        of.launch("/bin/sh -c 'whoami > " + tmp_name + "'")
+        // small wait to ensure command completes
+        wait(0.1)
+        // read the output via host computer
+        host = of.host_computer
+        f = host.File(tmp_name)
+        if not f then
+            // if file reading failed, skip cleanup and continue
+            continue
+        end if
+        output = f.get_content
+        // remove trailing newline and carriage return
+        if output.endsWith(char(10)) then
+            output = output[0:output.len-1]
+        end if
+        if output.endsWith(char(13)) then
+            output = output[0:output.len-1]
+        end if
+        // determine privilege level
+        if output == "root" then
+            priv = "root"
+        else
+            priv = "guest"
+        end if
+        print(add + " " + value + " user:" + output + " privilege:" + priv)
+        // cleanup
+        of.launch("/bin/rm -f " + tmp_name)
+        found = 1
+      end if
+end for
+
+if found == 0 then print("Nothing found")