Compare commits
4 Commits
5e68391057
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
209db74ac6 | ||
|
|
a0a00b09d4 | ||
|
|
d4e1913fd5 | ||
|
|
6b69855372 |
@@ -6,17 +6,12 @@ myComputer = myShell.host_computer
|
|||||||
crypto = include_lib("/lib/crypto.so")
|
crypto = include_lib("/lib/crypto.so")
|
||||||
if not crypto then exit("<center><color=red>There is no crypto.so in you /lib\n</color></center>")
|
if not crypto then exit("<center><color=red>There is no crypto.so in you /lib\n</color></center>")
|
||||||
|
|
||||||
|
g = get_custom_object
|
||||||
|
|
||||||
passFile = user_input("Path to encrypted file: \n")
|
passFile = user_input("Path to encrypted file: \n")
|
||||||
fullString = myComputer.File(passFile).get_content
|
fullString = myComputer.File(passFile).get_content
|
||||||
lines = fullString.split(char(10))
|
lines = fullString.split(char(10))
|
||||||
|
|
||||||
|
|
||||||
/* TODO
|
|
||||||
Fix logic to properly display name:pass combo
|
|
||||||
I think I'm deciphering too late
|
|
||||||
I think I should decipher first, then split
|
|
||||||
*/
|
|
||||||
|
|
||||||
userNames = []
|
userNames = []
|
||||||
hashes = []
|
hashes = []
|
||||||
passes = []
|
passes = []
|
||||||
@@ -25,15 +20,26 @@ for line in lines
|
|||||||
line = line.trim
|
line = line.trim
|
||||||
if line == "" then continue
|
if line == "" then continue
|
||||||
parts = line.split(":")
|
parts = line.split(":")
|
||||||
//if parts.len < 2 then continue
|
if parts.len < 2 then continue
|
||||||
userNames.push(parts[0])
|
userNames.push(parts[0])
|
||||||
hashes.push(parts[1])
|
hashes.push(parts[1])
|
||||||
end for
|
end for
|
||||||
|
|
||||||
for entry in hashes
|
for entry in hashes
|
||||||
passes.push(crypto.decipher(entry))
|
if g.hashTable.hasIndex(hashes[entry]) then
|
||||||
|
passes.push(hashes[entry])
|
||||||
|
continue
|
||||||
|
end if
|
||||||
|
passes.push(entry)
|
||||||
end for
|
end for
|
||||||
|
|
||||||
|
if passes.len > 0 then
|
||||||
|
for line in passes
|
||||||
|
passes.replace([line], crypto.decipher(line))
|
||||||
|
g.hashTable.push(passes[line])
|
||||||
|
end for
|
||||||
|
end if
|
||||||
|
|
||||||
for line in userNames
|
for line in userNames
|
||||||
if not passes[indexOf(line)] then passes.indexOf(line) = "|no password found|"
|
if not passes[indexOf(line)] then passes.indexOf(line) = "|no password found|"
|
||||||
print(userNames[indexOf(line)] + " has the password " + passes[indexOf(line)])
|
print(userNames[indexOf(line)] + " has the password " + passes[indexOf(line)])
|
||||||
|
|||||||
44
myShit/shlockcrack.src
Normal file
44
myShit/shlockcrack.src
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
metax = include_lib("/lib/metaxploit.so")
|
||||||
|
if not metax then metax = include_lib(current_path + "/metaexploit.so")
|
||||||
|
if not metax then exit("<color=red><b><center>No metaxploit.so found\nAcceptable places: /lib or current directory<center/><b/><color/>")
|
||||||
|
|
||||||
|
g = get_custom_object
|
||||||
|
|
||||||
|
expectedParamCount = 0
|
||||||
|
|
||||||
|
if not g.currentAdd then
|
||||||
|
g.currentAdd = params[expectedParamCount]
|
||||||
|
expectedParamCount += 1
|
||||||
|
end if
|
||||||
|
if not g.port then
|
||||||
|
g.port = params[expectedParamCount]
|
||||||
|
expectedParamCount += 1
|
||||||
|
end if
|
||||||
|
if not g.targetMem then
|
||||||
|
g.targetMem = params[expectedParamCount]
|
||||||
|
expectedParamCount += 1
|
||||||
|
end if
|
||||||
|
if not g.targetExploit then
|
||||||
|
g.targetExploit = params[expectedParamCount]
|
||||||
|
expectedParamCount += 1
|
||||||
|
end if
|
||||||
|
|
||||||
|
if not g.netSession then g.netSession = metax.net_use(g.currentAdd, g.port)
|
||||||
|
if not g.netSession then exit("Couldn't connect to net session")
|
||||||
|
|
||||||
|
overflowResult = g.metLib.overflow(g.targetMem, g.targetExploit)
|
||||||
|
|
||||||
|
if not overflowResult then exit("Not able to exploit this vector")
|
||||||
|
|
||||||
|
if typeof(overflowResult) == "shell" then
|
||||||
|
overflowResult.start_terminal
|
||||||
|
|
||||||
|
else if typeof(overflowResult) == "computer" then
|
||||||
|
print("Computer object obtained for " + overflowResult.get_name)
|
||||||
|
|
||||||
|
else if typeof(overflowResult) == "file" then
|
||||||
|
print("Obtained file object")
|
||||||
|
|
||||||
|
else
|
||||||
|
print("<color=red>Erorr: expected shell, computer or file - result: " + overflowResult)
|
||||||
|
end if
|
||||||
29
myShit/shlockmap.src
Normal file
29
myShit/shlockmap.src
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
metax = include_lib("/lib/metaxploit.so")
|
||||||
|
if not metax then metax = include_lib(current_path + "/metaexploit.so")
|
||||||
|
if not metax then exit("<color=red><b><center>No metaxploit.so found\nAcceptable places: /lib or current directory<center/><b/><color/>")
|
||||||
|
g = get_custom_object
|
||||||
|
if not params[0] then exit("No IP address provided")
|
||||||
|
add = ""
|
||||||
|
port = 0
|
||||||
|
ports = get_router(add).used_ports
|
||||||
|
for port in ports
|
||||||
|
print(ports[port].port_number)
|
||||||
|
end for
|
||||||
|
if not add.hasIndex(params[0]) then add = params[0]
|
||||||
|
if params.len > 1 then port = params[1].to_int
|
||||||
|
netSession = metax.net_use(add, ports[0].port_number)
|
||||||
|
metLib = netSession.dump_lib
|
||||||
|
print(metLib.lib_name + " "+ metLib.version +"\nkernel_router.so " + get_router(add).kernel_version)
|
||||||
|
scanResult = metax.scan(metLib)
|
||||||
|
for hit in scanResult
|
||||||
|
scanAdd = metax.scan_address(metLib, hit)
|
||||||
|
segments = scanAdd.split("Unsafe check: ")[1:]
|
||||||
|
exploits = []
|
||||||
|
for segment in segments
|
||||||
|
labelStart = segment.indexOf("<b>")
|
||||||
|
labelEnd = segment.indexOf("</b>")
|
||||||
|
exploits.push(segment[labelStart + 3: labelEnd])
|
||||||
|
end for
|
||||||
|
print("Memory address " + hit)
|
||||||
|
print("Vulnerabilities: " + exploits.join(", ") + "\n")
|
||||||
|
end for
|
||||||
@@ -1,46 +1,25 @@
|
|||||||
homePW = #envar homePW
|
homePW = #envar homePW
|
||||||
doomKey = #envar doomKey
|
doomKey = #envar doomKey
|
||||||
|
|
||||||
g = get_custom_object
|
|
||||||
|
|
||||||
doomPath = "/root/doom"
|
doomPath = "/root/doom"
|
||||||
myShell = get_shell("root", homePW)
|
myShell = get_shell("root", homePW)
|
||||||
|
|
||||||
/*
|
|
||||||
g.count = 0
|
|
||||||
|
|
||||||
while g.count < 2
|
|
||||||
myShell.launch("/usr/bin/Terminal.exe", "doom")
|
|
||||||
print("Launched terminal #" + g.count + "\n")
|
|
||||||
g.count += 1
|
|
||||||
wait 2
|
|
||||||
end while
|
|
||||||
*/
|
|
||||||
|
|
||||||
if not myShell then
|
if not myShell then
|
||||||
exit("<color=red><b>Not able to get root shell...\n</b></color>")
|
exit("<color=red><b>Not able to get root shell...\n</b></color>")
|
||||||
else
|
else
|
||||||
print("<color=green><b>Root shell obtained</b></color>")
|
print("<color=green><b>Root shell obtained</b></color>")
|
||||||
end if
|
end if
|
||||||
|
|
||||||
i = 0
|
filePath = "usr/bin/"
|
||||||
while (i < 4)
|
extension = ".exe"
|
||||||
myShell.launch("usr/bin/Terminal.exe", "some terminal launch arg")
|
|
||||||
wait 2
|
|
||||||
i += 1
|
|
||||||
end while
|
|
||||||
i = 0
|
|
||||||
|
|
||||||
somePath = launch_path
|
launchSequence = ["Terminal", "Terminal", "Terminal", "Terminal", "AdminMonitor", "FileExplorer", "Mail", "Notepad", "Chat"]
|
||||||
print("\n<b> Debug log: <b>\n Parent path: " + parent_path(somePath) + "\n\n")
|
argSequence = ["", "doom", "doom", "doom", "", "", "", "", ""]
|
||||||
|
|
||||||
|
if launchSequence.len != argSequence.len then exit(user_input("<center><b><color=red>Launch and args arent the same length...\n</color>Press enter to exit...</b></center>"))
|
||||||
|
|
||||||
// uncomment for MP
|
for lines in launchSequence
|
||||||
//myShell.launch("/usr/bin/Chat.exe")
|
myShell.launch(filePath + launchSequence[line] + extension, argSequence[line])
|
||||||
myShell.launch("/usr/bin/AdminMonitor.exe")
|
|
||||||
wait 2
|
wait 2
|
||||||
myShell.launch("/usr/bin/FileExplorer.exe")
|
end for
|
||||||
wait 2
|
exit()
|
||||||
myShell.launch("/usr/bin/Mail.exe")
|
|
||||||
wait 2
|
|
||||||
myShell.launch("/usr/bin/Notepad.exe")
|
|
||||||
Reference in New Issue
Block a user