if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
	current_program = get_shell.host_computer.File(program_path)
	exit "Usage: " + current_program.name + " <remote ip> [remote port]"
end if

mx = include_lib("/lib/metaxploit.so")
if not mx then exit("Unable to load /lib/metaxploit.so")

extract_value = function(line)
	start = line.indexOf("<b>")
	finish = line.indexOf("</b>")
	if start != -1 and finish != -1 and finish > start then
		return line[start + 3 : finish]
	end if

	before_dot = line.split("\.")[0]
	words = before_dot.split(" ")
	value = ""
	for word in words
		if word != "" then value = word
	end for
	return value
end function

ip = params[0]
port = 0

if params.len > 1 then
	port = params[1].to_int
end if

if port == 0 then
	sess = mx.net_use(ip)
else
	sess = mx.net_use(ip, port)
end if

if not sess then exit("Unable to establish session")

lib = sess.dump_lib
adds = mx.scan(lib)
found = 0
candidates = []

for add in adds
	info = mx.scan_address(lib, add)
	if not info then continue

	lines = info.split(char(10))
	for line in lines
		pos = line.indexOf("Unsafe check:")
		if pos == null then continue
		if pos == -1 then continue

		value = extract_value(line)
		if value == "" then continue
		candidates.push add + " " + value
	end for
end for

for candidate in candidates
	parts = candidate.split(" ")
	add = parts[0]
	value = parts[1]

	if port == 0 then
		sess = mx.net_use(ip)
	else
		sess = mx.net_use(ip, port)
	end if
	if not sess then continue
	lib = sess.dump_lib
	if not lib then continue

	oflow = lib.overflow(add, value)
	if typeof(oflow) == "shell" then
		// create a temporary file for whoami output
		tmp_name = "/tmp/whoami_" + add + "_" + value
		// run whoami and capture output
		oflow.launch "whoami > " + tmp_name
		// small wait to ensure command completes
		wait 0.1
		// read the output via host computer
		host = oflow.host_computer
		f = host.File(tmp_name)
		if not f then
			// if file reading failed, skip cleanup and continue
			continue
		end if
		output = f.get_content
		// remove trailing newline and carriage return
		if output.endsWith(char(10)) then
			output = output[0 : output.len - 1]
		end if
		if output.endsWith(char(13)) then
			output = output[0 : output.len - 1]
		end if
		// determine privilege level
		if output == "root" then
			priv = "root"
		else
			priv = "guest"
		end if
		print add + " " + value + " user:" + output + " privilege:" + priv
		// cleanup
		oflow.launch "/bin/rm -f " + tmp_name
		found = 1
	end if
end for

if found == 0 then print("Nothing found")