greyhack/source/betteroverflow.src

if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
	current_program = get_shell.host_computer.File(program_path)
	exit "Usage: " + current_program.name + " <remote ip> [remote port]"
end if

mx = include_lib("/lib/metaxploit.so")
if not mx then exit("Unable to load /lib/metaxploit.so")

crypto = include_lib("/lib/crypto.so")
if not crypto then crypto = include_lib(current_path + "/crypto.so")

results = []
last_clear = [0]

redraw = function()
	gap = 0.11
	elapsed = time - last_clear[0]
	if elapsed < gap then
		delay = gap - elapsed
		if delay < 0.01 then delay = 0.01
		wait delay
	end if
	clear_screen
	last_clear[0] = time
	print ip + " " + port
	for line in results
		print line
	end for
end function

note = function(line)
	results.push(line)
	redraw
end function

extract_value = function(line)
	start = line.indexOf("<b>")
	finish = line.indexOf("</b>")
	if start != -1 and finish != -1 and finish > start then
		return line[start + 3 : finish]
	end if

	before_dot = line.split("\.")[0]
	words = before_dot.split(" ")
	value = ""
	for word in words
		if word != "" then value = word
	end for
	return value
end function

object_user = function(comp)
	if not comp then return "guest"

	root_dir = comp.File("/root")
	if root_dir and root_dir.has_permission("w") then return "root"

	passwd = comp.File("/etc/passwd")
	if passwd and passwd.has_permission("w") then return "root"

	home = comp.File("/home")
	if not home then return "guest"
	folders = home.get_folders
	if not folders then return "guest"
	for folder in folders
		if folder.name == "guest" then continue
		if folder.has_permission("w") then return folder.name
	end for
	return "guest"
end function

dump_remote_passwd = function(comp)
	cracked = []
	if not crypto then return cracked
	if object_user(comp) != "root" then return cracked

	passwd = comp.File("/etc/passwd")
	if not passwd then return cracked
	if not passwd.has_permission("r") then return cracked
	content = passwd.get_content
	if not content then return cracked

	for line in content.split(char(10))
		if line == "" then continue
		parts = line.split(":")
		if parts.len < 2 then continue
		user = parts[0]
		hash = parts[1]
		if user == "" or hash == "" then continue
		plain = crypto.decipher(hash)
		redraw
		if not plain then continue
		cracked.push(user + ":" + plain)
	end for
	return cracked
end function

ip = params[0]
port = 0

if params.len > 1 then
	port = params[1].to_int
end if

if port == 0 then
	sess = mx.net_use(ip)
else
	sess = mx.net_use(ip, port)
end if

if not sess then exit("Unable to establish session")

lib = sess.dump_lib
adds = mx.scan(lib)
redraw
found = 0
candidates = []

for add in adds
	info = mx.scan_address(lib, add)
	if not info then continue

	lines = info.split(char(10))
	for line in lines
		pos = line.indexOf("Unsafe check:")
		if pos == null then continue
		if pos == -1 then continue

		value = extract_value(line)
		if value == "" then continue
		candidates.push add + " " + value
	end for
end for

for candidate in candidates
	parts = candidate.split(" ")
	add = parts[0]
	value = parts[1]

	if port == 0 then
		sess = mx.net_use(ip)
	else
		sess = mx.net_use(ip, port)
	end if
	if not sess then
		redraw
		continue
	end if
	lib = sess.dump_lib
	if not lib then
		redraw
		continue
	end if

	oflow = lib.overflow(add, value)
	if typeof(oflow) == "shell" then
		note(add + " " + value + " user:" + object_user(oflow.host_computer))
		found = 1
	else if typeof(oflow) == "computer" then
		cracked = dump_remote_passwd(oflow)
		if cracked.len > 0 then
			results.push(add + " " + value + " type:computer privilege:root")
			for line in cracked
				results.push(line)
			end for
			found = 1
		end if
		redraw
	else
		redraw
	end if
end for

if found == 0 then
	note("Nothing found")
else
	redraw
end if