You've already forked greyhack
112 lines
2.5 KiB
Plaintext
112 lines
2.5 KiB
Plaintext
if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
|
|
current_program = get_shell.host_computer.File(program_path)
|
|
exit "Usage: " + current_program.name + " <remote ip> [remote port]"
|
|
end if
|
|
|
|
mx = include_lib("/lib/metaxploit.so")
|
|
if not mx then exit("Unable to load /lib/metaxploit.so")
|
|
|
|
extract_value = function(line)
|
|
start = line.indexOf("<b>")
|
|
finish = line.indexOf("</b>")
|
|
if start != -1 and finish != -1 and finish > start then
|
|
return line[start + 3 : finish]
|
|
end if
|
|
|
|
before_dot = line.split("\.")[0]
|
|
words = before_dot.split(" ")
|
|
value = ""
|
|
for word in words
|
|
if word != "" then value = word
|
|
end for
|
|
return value
|
|
end function
|
|
|
|
ip = params[0]
|
|
port = 0
|
|
|
|
if params.len > 1 then
|
|
port = params[1].to_int
|
|
end if
|
|
|
|
if port == 0 then
|
|
sess = mx.net_use(ip)
|
|
else
|
|
sess = mx.net_use(ip, port)
|
|
end if
|
|
|
|
if not sess then exit("Unable to establish session")
|
|
|
|
lib = sess.dump_lib
|
|
adds = mx.scan(lib)
|
|
found = 0
|
|
candidates = []
|
|
|
|
for add in adds
|
|
info = mx.scan_address(lib, add)
|
|
if not info then continue
|
|
|
|
lines = info.split(char(10))
|
|
for line in lines
|
|
pos = line.indexOf("Unsafe check:")
|
|
if pos == null then continue
|
|
if pos == -1 then continue
|
|
|
|
value = extract_value(line)
|
|
if value == "" then continue
|
|
candidates.push add + " " + value
|
|
end for
|
|
end for
|
|
|
|
for candidate in candidates
|
|
parts = candidate.split(" ")
|
|
add = parts[0]
|
|
value = parts[1]
|
|
|
|
if port == 0 then
|
|
sess = mx.net_use(ip)
|
|
else
|
|
sess = mx.net_use(ip, port)
|
|
end if
|
|
if not sess then continue
|
|
lib = sess.dump_lib
|
|
if not lib then continue
|
|
|
|
oflow = lib.overflow(add, value)
|
|
if typeof(oflow) == "shell" then
|
|
// create a temporary file for whoami output
|
|
tmp_name = "/tmp/whoami_" + add + "_" + value
|
|
// run whoami and capture output
|
|
oflow.launch "whoami > " + tmp_name
|
|
// small wait to ensure command completes
|
|
wait 0.1
|
|
// read the output via host computer
|
|
host = oflow.host_computer
|
|
f = host.File(tmp_name)
|
|
if not f then
|
|
// if file reading failed, skip cleanup and continue
|
|
continue
|
|
end if
|
|
output = f.get_content
|
|
// remove trailing newline and carriage return
|
|
if output.endsWith(char(10)) then
|
|
output = output[0 : output.len - 1]
|
|
end if
|
|
if output.endsWith(char(13)) then
|
|
output = output[0 : output.len - 1]
|
|
end if
|
|
// determine privilege level
|
|
if output == "root" then
|
|
priv = "root"
|
|
else
|
|
priv = "guest"
|
|
end if
|
|
print add + " " + value + " user:" + output + " privilege:" + priv
|
|
// cleanup
|
|
oflow.launch "/bin/rm " + tmp_name
|
|
found = 1
|
|
end if
|
|
end for
|
|
|
|
if found == 0 then print("Nothing found")
|